VAMPIRE	eBACS: ECRYPT Benchmarking of Cryptographic Systems	ECRYPT II

Measurements of NISTLWC cipher candidates on one machine: amd64; Goldmont Plus (706a8); 2019 Intel Celeron N4020; 2 x 1100MHz; gemini, supercop-20241022

[Page version: 20241120 00:41:35]

eBAEAD (ECRYPT Benchmarking of Authenticated Ciphers) is a project to measure the performance of authenticated ciphers. This page presents an excerpt of the full eBAEAD benchmark results. The excerpt is for NISTLWC, specifically (starting with supercop-20221005) finalists.

Each table row lists the first quartile of many speed measurements, the median of many speed measurements, the third quartile of many speed measurements, and the name of the primitive. Measurements with large variance are indicated in red with question marks. The symbol T: (starting with supercop-20200816) means that the SUPERCOP database at the time of benchmarking did not list constant time as a goal for this implementation. The symbol T!!! means that constant time was listed as a goal for this implementation, but that the implementation failed TIMECOP. (TIMECOP failures are not necessarily security issues; they can sometimes be resolved by, e.g., declaring that a rejection-sampling condition is safe to declassify.)

There is a separate page with more information about each cipher and each implementation.

Test results

Graphs: (bytes,cycles)

Cycles/byte for long+0 encrypt 25% 50% 75% aead 2.13? 2.33? 2.37? T:aes128gcmv1 2.32 2.33 2.34 aes256gcmv1 10.46 10.47 10.47 ascon128av12 15.40 15.41 15.41 ascon80pqv12 16.00 16.00 16.00 ascon128v12 23.43 23.44 23.45 ascon128abi32v12 23.99 24.00 24.13 T:xoodyakround3 27.88 27.90 27.91 T:schwaemm256128v2 34.43 34.45 34.45 ascon128bi32v12 34.45 34.89 37.49 T:schwaemm256256v2 36.49 36.55 36.56 T:schwaemm128128v2 37.17 37.19 37.23 T:schwaemm192192v2 39.56 39.90 40.00 T:grain128aeadv2 45.54 45.75 49.75 romulusn 48.06 48.08 48.10 T:giftcofb128v1 62.45 62.46 62.49 T:isapa128av20 69.15 69.17 69.18 T:isapa128v20 77.91 78.00 78.28 romulusm 83.44 83.57 83.60 T:tinyjambu128v2 99.89 99.90 99.91 T:tinyjambu192v2 109.38 109.38 109.38 T:tinyjambu256v2 112.89 112.98 113.63 T:isapk128av20 142.69 144.63 155.97 T!!!romulust 149.66 149.77 150.17 T:isapk128v20 220.98 221.45 224.38 T:isapxv20 238.04 243.16 243.23 T:elephant200v2 11088.47 11092.76 11155.51 T:elephant176v2 12324.32 12324.93 12330.81 T:elephant160v2

Cycles/byte for long+0 decrypt 25% 50% 75% aead 2.20 2.43 2.44 T:aes128gcmv1 2.45 2.47 2.47 aes256gcmv1 9.95 10.06 10.06 ascon128av12 14.90 14.91 14.91 ascon80pqv12 15.43 15.44 15.44 ascon128v12 23.22 23.24 23.25 ascon128abi32v12 23.30 23.33 23.48 T:xoodyakround3 27.80 27.81 27.84 T:schwaemm256128v2 33.95 34.22 37.04 T:schwaemm256256v2 34.50 34.51 34.51 ascon128bi32v12 36.52 36.55 36.56 T:schwaemm128128v2 37.05 37.06 37.08 T:schwaemm192192v2 41.88 41.88 41.89 T:grain128aeadv2 45.19 45.86 49.25 romulusn 48.55 48.57 48.58 T:giftcofb128v1 62.88 62.90 62.96 T:isapa128av20 69.16 69.19 69.21 T:isapa128v20 77.41 77.46 77.55 romulusm 83.66 83.73 83.73 T:tinyjambu128v2 99.50 99.53 99.53 T:tinyjambu192v2 108.73 108.75 108.75 T:tinyjambu256v2 112.89 113.71 113.82 T:isapk128av20 143.57 144.65 155.26 T!!!romulust 148.86 150.08 151.12 T:isapk128v20 220.99 221.42 224.39 T:isapxv20 238.02 238.53 243.17 T:elephant200v2 11088.19 11090.76 11147.25 T:elephant176v2 12324.37 12325.22 12330.72 T:elephant160v2

Cycles/byte for long+0 forgery 25% 50% 75% aead 2.20 2.43 2.44 T:aes128gcmv1 2.44 2.45 2.46 aes256gcmv1 9.95 10.06 10.06 ascon128av12 14.89 14.91 14.92 ascon80pqv12 15.43 15.44 15.45 ascon128v12 23.23 23.24 23.25 ascon128abi32v12 23.37 23.40 23.57 T:xoodyakround3 27.79 27.80 27.84 T:schwaemm256128v2 34.50 34.51 34.51 ascon128bi32v12 34.49 34.51 34.78 T:isapa128v20 34.00 34.58 37.26 T:schwaemm256256v2 36.48 36.53 36.54 T:schwaemm128128v2 37.06 37.07 37.17 T:schwaemm192192v2 41.88 41.89 42.12 T:grain128aeadv2 42.57 42.59 42.62 T:isapa128av20 45.54 45.92 49.26 romulusn 48.55 48.57 48.58 T:giftcofb128v1 51.27 51.80 56.14 T!!!romulust 74.39 75.21 75.25 T:isapk128av20 77.38 77.53 77.57 romulusm 83.68 83.72 83.73 T:tinyjambu128v2 92.85 93.19 93.59 T:isapk128v20 99.25 99.51 99.53 T:tinyjambu192v2 108.75 108.75 108.75 T:tinyjambu256v2 129.96 129.96 130.91 T:isapxv20 238.02 238.52 243.17 T:elephant200v2 11086.47 11090.73 11138.45 T:elephant176v2 12324.22 12325.19 12330.95 T:elephant160v2

Cycles/byte for long+long encrypt 25% 50% 75% aead 1.78 1.81 1.82 aes256gcmv1 1.69? 1.81? 1.91? T:aes128gcmv1 10.22 10.35 10.41 ascon128av12 14.74 14.74 14.75 ascon80pqv12 15.25 15.25 15.26 ascon128v12 17.03 17.04 17.24 T:xoodyakround3 22.94 22.95 22.96 ascon128abi32v12 27.69 27.70 27.71 T:schwaemm256128v2 34.21 34.23 34.23 ascon128bi32v12 34.18 34.50 37.36 T:schwaemm256256v2 36.46 36.62 36.63 T:schwaemm128128v2 36.69 36.70 36.72 T:schwaemm192192v2 37.88 38.01 41.08 romulusn 39.43 39.58 39.61 T:grain128aeadv2 48.29 48.33 48.34 T:giftcofb128v1 51.61 51.62 51.63 T:isapa128v20 52.51 52.53 52.54 T:isapa128av20 54.65 54.69 54.79 romulusm 67.66 67.74 67.97 T:tinyjambu128v2 77.94 77.95 77.96 T:tinyjambu192v2 82.57 82.57 82.57 T:tinyjambu256v2 93.90 93.94 94.10 T:isapk128av20 96.56 97.79 106.28 T!!!romulust 121.42 121.57 122.05 T:isapk128v20 177.29 177.51 181.42 T:elephant200v2 176.16 179.13 179.29 T:isapxv20 8255.38 8258.42 8289.38 T:elephant176v2 9241.09 9241.66 9245.15 T:elephant160v2

Cycles/byte for long+long decrypt 25% 50% 75% aead 1.72? 1.84? 1.95? T:aes128gcmv1 1.84 1.86 1.87 aes256gcmv1 10.06 10.06 10.07 ascon128av12 14.76 14.77 14.77 ascon80pqv12 14.96 14.97 14.97 ascon128v12 16.68 16.69 16.80 T:xoodyakround3 23.14 23.15 23.16 ascon128abi32v12 27.67 27.67 27.71 T:schwaemm256128v2 33.78 33.79 33.79 ascon128bi32v12 33.94 34.25 37.10 T:schwaemm256256v2 36.47 36.62 36.63 T:schwaemm128128v2 36.67 36.69 36.70 T:schwaemm192192v2 37.63 37.76 40.79 romulusn 40.51 40.77 40.79 T:grain128aeadv2 47.84 47.86 47.89 T:giftcofb128v1 51.32 51.34 51.61 T:isapa128v20 52.72 52.75 52.76 T:isapa128av20 54.51 54.69 54.72 romulusm 68.03 68.07 68.08 T:tinyjambu128v2 78.69 78.70 78.71 T:tinyjambu192v2 82.34 82.35 82.35 T:tinyjambu256v2 93.98 94.05 94.40 T:isapk128av20 97.24 97.93 106.05 T!!!romulust 120.78 121.56 122.13 T:isapk128v20 177.29 177.53 181.42 T:elephant200v2 176.11 179.12 179.17 T:isapxv20 8257.21 8258.46 8289.44 T:elephant176v2 9241.04 9241.65 9245.12 T:elephant160v2

Cycles/byte for long+long forgery 25% 50% 75% aead 1.73 1.84 1.87 T:aes128gcmv1 1.85 1.85 1.86 aes256gcmv1 10.07 10.07 10.07 ascon128av12 14.77 14.77 14.78 ascon80pqv12 14.97 14.98 14.98 ascon128v12 16.72 16.74 16.84 T:xoodyakround3 23.15 23.15 23.15 ascon128abi32v12 27.67 27.67 27.69 T:schwaemm256128v2 33.79 33.79 33.81 ascon128bi32v12 33.94 34.24 37.23 T:schwaemm256256v2 34.28 34.29 34.29 T:isapa128v20 36.45 36.62 36.62 T:schwaemm128128v2 36.69 36.70 36.71 T:schwaemm192192v2 37.64 37.81 40.80 romulusn 40.52 40.77 40.79 T:grain128aeadv2 42.59 42.60 42.77 T:isapa128av20 47.83 47.85 48.08 T:giftcofb128v1 50.99 51.50 56.23 T!!!romulust 54.48 54.49 54.72 romulusm 68.03 68.07 68.07 T:tinyjambu128v2 74.78 74.82 75.06 T:isapk128av20 78.69 78.70 78.71 T:tinyjambu192v2 82.35 82.35 82.35 T:tinyjambu256v2 93.13 93.17 93.52 T:isapk128v20 130.49 132.47 132.48 T:isapxv20 177.29 177.51 181.42 T:elephant200v2 8256.91 8258.85 8285.17 T:elephant176v2 9241.09 9241.71 9247.48 T:elephant160v2

Cycles/byte for 0+long encrypt 25% 50% 75% aead 1.25 1.28 1.29 aes256gcmv1 1.28? 1.30? 1.51? T:aes128gcmv1 9.98 10.00 10.01 ascon128av12 10.08 10.11 10.35 T:xoodyakround3 14.50 14.51 14.53 ascon128v12 14.62 14.62 14.63 ascon80pqv12 22.45 22.46 22.46 ascon128abi32v12 27.51 27.53 27.54 T:schwaemm256128v2 29.74 30.23 32.30 romulusn 31.56 31.57 31.75 romulusm 33.74 33.74 33.76 ascon128bi32v12 33.85 33.87 33.89 T:isapa128v20 33.94 34.33 36.93 T:schwaemm256256v2 36.40 36.41 36.43 T:schwaemm192192v2 36.38 36.42 36.73 T:schwaemm128128v2 38.99 39.23 39.28 T:grain128aeadv2 42.55 42.59 43.02 T:isapa128av20 47.71 47.72 47.98 T:giftcofb128v1 51.69 52.20 56.49 T!!!romulust 52.41 52.44 52.82 T:tinyjambu128v2 55.74 55.74 55.83 T:tinyjambu256v2 56.01 56.02 56.03 T:tinyjambu192v2 74.20 74.27 74.48 T:isapk128av20 92.98 93.43 93.60 T:isapk128v20 119.79 119.81 119.85 T:elephant200v2 130.99 131.07 132.97 T:isapxv20 5424.00 5426.62 5441.56 T:elephant176v2 6157.78 6158.13 6160.69 T:elephant160v2

Cycles/byte for 0+long decrypt 25% 50% 75% aead 1.23? 1.26? 1.47? T:aes128gcmv1 1.24 1.27 1.28 aes256gcmv1 10.05 10.07 10.08 ascon128av12 10.06 10.08 10.15 T:xoodyakround3 14.49 14.50 14.51 ascon128v12 14.62 14.63 14.63 ascon80pqv12 22.65 22.66 22.66 ascon128abi32v12 27.51 27.54 27.54 T:schwaemm256128v2 29.95 30.19 32.31 romulusn 31.48 31.66 31.70 romulusm 33.06 33.07 33.07 ascon128bi32v12 33.96 34.28 37.13 T:schwaemm256256v2 34.42 34.44 34.46 T:isapa128v20 36.41 36.42 36.43 T:schwaemm192192v2 36.39 36.73 36.74 T:schwaemm128128v2 39.14 39.48 39.48 T:grain128aeadv2 42.53 42.58 42.61 T:isapa128av20 47.14 47.15 47.21 T:giftcofb128v1 50.95? 51.42? 56.70? T!!!romulust 52.43 52.45 52.83 T:tinyjambu128v2 56.03 56.03 56.03 T:tinyjambu256v2 57.88 57.88 57.89 T:tinyjambu192v2 74.26 74.31 74.52 T:isapk128av20 92.79 93.45 93.68 T:isapk128v20 119.81 119.85 120.17 T:elephant200v2 131.02 131.46 132.98 T:isapxv20 5424.30 5427.87 5445.65 T:elephant176v2 6157.63 6157.95 6161.00 T:elephant160v2

Cycles/byte for 0+long forgery 25% 50% 75% aead 1.24? 1.25? 1.47? T:aes128gcmv1 1.27 1.27 1.27 aes256gcmv1 10.06 10.07 10.09 ascon128av12 10.07 10.09 10.17 T:xoodyakround3 14.49 14.50 14.50 ascon128v12 14.62 14.63 14.64 ascon80pqv12 22.66 22.66 22.66 ascon128abi32v12 27.50 27.53 27.54 T:schwaemm256128v2 30.01 30.21 32.34 romulusn 31.65 31.67 31.90 romulusm 33.06 33.07 33.07 ascon128bi32v12 33.96 34.28 37.13 T:schwaemm256256v2 33.86 34.44 34.45 T:isapa128v20 36.41 36.42 36.42 T:schwaemm192192v2 36.41 36.73 36.73 T:schwaemm128128v2 39.20 39.49 39.50 T:grain128aeadv2 42.57 42.60 42.64 T:isapa128av20 47.14 47.15 47.20 T:giftcofb128v1 50.90 51.65 56.51 T!!!romulust 52.43 52.44 52.83 T:tinyjambu128v2 56.03 56.03 56.03 T:tinyjambu256v2 57.88 57.89 57.90 T:tinyjambu192v2 74.29 74.37 74.76 T:isapk128av20 93.14 93.17 93.87 T:isapk128v20 119.79 119.82 119.85 T:elephant200v2 131.01 131.07 132.98 T:isapxv20 5425.35 5427.74 5442.78 T:elephant176v2 6157.92 6158.27 6160.63 T:elephant160v2

Cycles/byte for 1536+1536 encrypt 25% 50% 75% aead 1.97 1.98 1.99 aes256gcmv1 1.86 1.99 2.01 T:aes128gcmv1 10.48 10.49 10.59 ascon128av12 14.98 14.98 14.98 ascon80pqv12 15.47 15.47 15.48 ascon128v12 17.18 17.18 17.36 T:xoodyakround3 23.46 23.46 23.47 ascon128abi32v12 28.50 28.50 28.51 T:schwaemm256128v2 34.73 34.73 34.73 ascon128bi32v12 35.30 35.39 38.02 T:schwaemm256256v2 36.94 37.09 37.48 T:schwaemm128128v2 37.51 37.52 37.52 T:schwaemm192192v2 38.41 38.42 41.33 romulusn 39.99 40.07 40.13 T:grain128aeadv2 48.85 48.86 48.88 T:giftcofb128v1 55.13 55.18 55.22 romulusm 56.35 56.37 56.38 T:isapa128av20 68.44 68.45 68.53 T:tinyjambu128v2 75.50 75.50 75.50 T:isapa128v20 78.54 78.54 78.56 T:tinyjambu192v2 83.20 83.20 83.21 T:tinyjambu256v2 99.55 99.74 107.25 T!!!romulust 109.27 109.39 109.41 T:isapk128av20 181.33 181.37 184.94 T:elephant200v2 220.84 220.93 221.80 T:isapk128v20 281.53 283.62 283.63 T:isapxv20 8323.55 8325.22 8354.81 T:elephant176v2 9345.72 9346.08 9349.38 T:elephant160v2

Cycles/byte for 1536+1536 decrypt 25% 50% 75% aead 1.89? 2.02? 2.16? T:aes128gcmv1 2.03 2.04 2.04 aes256gcmv1 10.31 10.31 10.31 ascon128av12 15.00 15.01 15.01 ascon80pqv12 15.20 15.20 15.20 ascon128v12 16.84 16.84 16.94 T:xoodyakround3 23.66 23.66 23.67 ascon128abi32v12 28.47 28.47 28.49 T:schwaemm256128v2 34.30 34.30 34.30 ascon128bi32v12 35.13 35.14 37.77 T:schwaemm256256v2 37.07 37.08 37.57 T:schwaemm128128v2 37.51 37.51 37.52 T:schwaemm192192v2 38.17 38.18 41.03 romulusn 41.01 41.25 41.25 T:grain128aeadv2 48.42 48.42 48.46 T:giftcofb128v1 55.04 55.06 55.07 romulusm 56.58 56.60 56.62 T:isapa128av20 68.55 68.57 68.59 T:tinyjambu128v2 75.24 75.24 75.26 T:isapa128v20 79.29 79.30 79.31 T:tinyjambu192v2 83.02 83.02 83.03 T:tinyjambu256v2 99.56 99.63 107.29 T!!!romulust 109.47 109.50 109.57 T:isapk128av20 181.32 181.35 184.94 T:elephant200v2 220.82 220.98 221.21 T:isapk128v20 281.55 283.64 283.65 T:isapxv20 8323.97 8324.43 8345.28 T:elephant176v2 9345.65 9346.01 9349.23 T:elephant160v2

Cycles/byte for 1536+1536 forgery 25% 50% 75% aead 1.88 2.00 2.02 T:aes128gcmv1 2.03 2.03 2.04 aes256gcmv1 10.31 10.31 10.31 ascon128av12 15.00 15.01 15.01 ascon80pqv12 15.20 15.21 15.21 ascon128v12 16.89 16.89 16.98 T:xoodyakround3 23.66 23.66 23.67 ascon128abi32v12 28.47 28.47 28.48 T:schwaemm256128v2 34.30 34.30 34.30 ascon128bi32v12 35.06 35.14 37.91 T:schwaemm256256v2 37.07 37.07 37.62 T:schwaemm128128v2 37.51 37.51 37.52 T:schwaemm192192v2 38.18 38.21 41.24 romulusn 41.01 41.25 41.26 T:grain128aeadv2 44.76 44.77 45.07 T:isapa128av20 46.59 46.59 46.59 T:isapa128v20 48.42 48.44 48.44 T:giftcofb128v1 53.03 53.17 57.51 T!!!romulust 55.01 55.04 55.11 romulusm 68.55 68.57 68.59 T:tinyjambu128v2 79.29 79.30 79.31 T:tinyjambu192v2 83.02 83.03 83.03 T:tinyjambu256v2 85.37 85.38 85.65 T:isapk128av20 146.89 146.90 147.21 T:isapk128v20 181.31 181.35 184.94 T:elephant200v2 184.62 185.94 185.96 T:isapxv20 8323.51 8324.66 8346.57 T:elephant176v2 9345.66 9346.10 9349.27 T:elephant160v2

Cycles/byte for 64+64 encrypt 25% 50% 75% aead 8.28 8.36 8.66 T:aes128gcmv1 9.48 9.60 9.71 aes256gcmv1 15.92 16.00 16.40 ascon128av12 20.29 20.45 20.66 ascon80pqv12 20.44 20.52 20.72 ascon128v12 24.42 24.62 24.80 T:xoodyakround3 35.00 35.16 35.49 ascon128abi32v12 46.23 46.30 46.59 ascon128bi32v12 46.52 46.53 46.87 T:schwaemm256128v2 47.22 47.32 50.46 romulusn 47.48 47.61 47.64 T:schwaemm128128v2 50.74 50.88 51.14 T:grain128aeadv2 55.45 55.54 59.02 T:schwaemm256256v2 60.51 60.57 60.94 T:schwaemm192192v2 60.92 61.13 61.39 T:giftcofb128v1 63.90 64.09 64.49 romulusm 80.45 80.59 80.88 T:tinyjambu128v2 92.04 92.04 92.30 T:tinyjambu192v2 97.40 97.49 97.92 T:tinyjambu256v2 139.14 140.14 147.71 T!!!romulust 144.17 144.45 144.62 T:isapa128av20 261.45 261.81 261.94 T:elephant200v2 443.38 443.51 443.64 T:isapk128av20 624.50 624.55 625.23 T:isapa128v20 2476.80 2477.21 2487.45 T:isapk128v20 2652.08 2659.16 2677.58 T:isapxv20 10431.41 10443.91 10461.86 T:elephant176v2 12513.92 12517.00 12522.39 T:elephant160v2

Cycles/byte for 64+64 decrypt 25% 50% 75% aead 8.40? 8.59? 9.38? T:aes128gcmv1 9.68 9.89 10.20 aes256gcmv1 15.84 16.02 16.16 ascon128av12 20.30 20.40 20.45 ascon80pqv12 20.31 20.52 20.80 ascon128v12 23.86 23.88 24.16 T:xoodyakround3 35.27 35.30 36.12 ascon128abi32v12 45.96 46.06 46.41 ascon128bi32v12 46.62 46.66 46.79 T:schwaemm256128v2 47.26 47.41 47.51 T:schwaemm128128v2 47.35 47.49 50.27 romulusn 51.46 51.66 51.98 T:grain128aeadv2 55.54 55.60 58.73 T:schwaemm256256v2 60.42 60.44 60.70 T:schwaemm192192v2 60.84 61.29 61.41 T:giftcofb128v1 66.14 66.27 66.43 romulusm 80.42 80.55 80.70 T:tinyjambu128v2 92.86 92.90 92.96 T:tinyjambu192v2 97.95 97.97 98.12 T:tinyjambu256v2 139.45 139.51 146.99 T!!!romulust 144.79 145.22 145.27 T:isapa128av20 261.43 261.48 261.78 T:elephant200v2 444.27 445.49 446.16 T:isapk128av20 616.71 616.86 625.19 T:isapa128v20 2477.63 2481.67 2487.67 T:isapk128v20 2652.34 2652.62 2677.91 T:isapxv20 10441.73 10444.27 10450.08 T:elephant176v2 12513.66 12517.05 12520.01 T:elephant160v2

Cycles/byte for 64+64 forgery 25% 50% 75% aead 8.22 8.29 8.44 T:aes128gcmv1 9.59 9.67 9.79 aes256gcmv1 15.75 15.82 15.89 ascon128av12 20.20 20.22 20.28 ascon128v12 20.21 20.27 20.37 ascon80pqv12 23.94 24.27 24.29 T:xoodyakround3 35.27 35.30 35.38 ascon128abi32v12 45.98 46.02 46.07 ascon128bi32v12 46.62 46.62 46.63 T:schwaemm256128v2 46.91 47.20 50.40 romulusn 47.17 47.39 47.41 T:schwaemm128128v2 51.16 51.30 51.35 T:grain128aeadv2 55.51 55.55 59.29 T:schwaemm256256v2 60.42 60.44 60.45 T:schwaemm192192v2 60.90 61.06 61.29 T:giftcofb128v1 65.95 66.15 66.51 romulusm 80.34 80.43 80.43 T:tinyjambu128v2 90.40 90.55 96.94 T!!!romulust 92.86 92.86 92.86 T:tinyjambu192v2 94.57 94.59 94.83 T:isapa128av20 97.96 97.96 98.12 T:tinyjambu256v2 261.45 261.49 261.79 T:elephant200v2 312.70 312.77 313.55 T:isapk128av20 329.46 329.46 329.65 T:isapa128v20 1358.76 1359.11 1360.05 T:isapk128v20 1390.26 1391.16 1403.56 T:isapxv20 10441.59 10442.54 10450.31 T:elephant176v2 12512.80 12516.52 12519.73 T:elephant160v2