VAMPIRE	eBACS: ECRYPT Benchmarking of Cryptographic Systems	ECRYPT II

Measurements of NISTLWC cipher candidates on one machine: amd64; Tremont (906c0); 2021 Intel Pentium Silver N6000; 4 x 1100MHz; jasper, supercop-20251222

[Page version: 20260112 15:28:56]

eBAEAD (ECRYPT Benchmarking of Authenticated Ciphers) is a project to measure the performance of authenticated ciphers. This page presents an excerpt of the full eBAEAD benchmark results. The excerpt is for NISTLWC, specifically (starting with supercop-20221005) finalists.

Each table row lists the first quartile of many speed measurements, the median of many speed measurements, the third quartile of many speed measurements, and the name of the primitive. Measurements with large variance are indicated in red with question marks. The symbol T: (starting with supercop-20200816) means that the SUPERCOP database at the time of benchmarking did not list constant time as a goal for this implementation. The symbol T!!! means that constant time was listed as a goal for this implementation, but that the implementation failed TIMECOP. (TIMECOP failures are not necessarily security issues; they can sometimes be resolved by, e.g., declaring that a rejection-sampling condition is safe to declassify.)

There is a separate page with more information about each cipher and each implementation.

Test results

Graphs: (bytes,cycles)

Cycles/byte for long+0 encrypt 25% 50% 75% aead 1.44 1.45 1.47 T:aes128gcmv1 1.62 1.64 1.66 aes256gcmv1 10.74 10.76 10.77 ascon128av12 15.14 15.14 15.16 ascon80pqv12 15.33 15.35 15.36 ascon128v12 20.13 20.20 20.42 ascon128abi32v12 20.96 21.08 21.70 T:xoodyakround3 22.19 22.22 22.40 T:schwaemm256128v2 28.87? 29.54? 36.18? T:schwaemm192192v2 29.98 30.03 30.18 ascon128bi32v12 32.32 32.41 32.42 T:schwaemm256256v2 33.31 33.41 33.85 T:schwaemm128128v2 38.95 38.99 39.03 T:grain128aeadv2 47.45 47.48 47.51 romulusn 47.99 48.12 48.25 T:giftcofb128v1 61.55 62.07 62.34 T:isapa128av20 67.81 67.91 68.19 T:isapa128v20 75.98 76.08 76.19 T:tinyjambu128v2 75.82 76.81 77.05 romulusm 95.35 95.45 95.57 T:tinyjambu192v2 103.94 104.01 104.13 T:tinyjambu256v2 106.39 106.49 106.56 T:isapk128av20 141.52 141.79 143.58 T:isapk128v20 150.65 150.94 151.16 T!!!romulust 197.48 197.62 198.07 T:elephant200v2 211.38 213.13 214.65 T:isapxv20 10392.83 10404.06 10407.97 T:elephant176v2 11796.46 11804.11 11807.57 T:elephant160v2

Cycles/byte for long+0 decrypt 25% 50% 75% aead 1.46 1.46 1.48 T:aes128gcmv1 1.69 1.71 1.73 aes256gcmv1 10.24 10.25 10.27 ascon128av12 15.14 15.19 15.20 ascon128v12 15.36 15.37 15.38 ascon80pqv12 20.08 20.21 20.38 ascon128abi32v12 20.71 20.74 20.79 T:xoodyakround3 22.16 22.20 22.35 T:schwaemm256128v2 28.80? 29.44? 35.97? T:schwaemm192192v2 29.97 30.12 30.40 ascon128bi32v12 32.41 32.43 32.44 T:schwaemm256256v2 33.34 33.47 33.53 T:schwaemm128128v2 39.08 39.25 39.65 T:grain128aeadv2 45.35 46.14 46.45 romulusn 47.83 47.95 47.98 T:giftcofb128v1 61.02 61.29 61.99 T:isapa128av20 67.89 68.17 68.53 T:isapa128v20 74.80 75.03 75.60 romulusm 76.40 76.45 76.51 T:tinyjambu128v2 95.17 95.25 95.38 T:tinyjambu192v2 104.19 104.29 104.36 T:tinyjambu256v2 106.30 106.43 106.52 T:isapk128av20 140.65 141.55 142.73 T:isapk128v20 150.82 151.01 151.15 T!!!romulust 197.47 198.75 200.19 T:elephant200v2 212.61 213.22 213.79 T:isapxv20 10398.89 10407.74 10418.69 T:elephant176v2 11798.31 11805.24 11808.53 T:elephant160v2

Cycles/byte for long+0 forgery 25% 50% 75% aead 1.46 1.46 1.47 T:aes128gcmv1 1.69 1.70 1.71 aes256gcmv1 10.25 10.27 10.29 ascon128av12 15.19 15.20 15.21 ascon128v12 15.36 15.39 15.47 ascon80pqv12 20.18 20.22 20.40 ascon128abi32v12 20.80 20.83 20.87 T:xoodyakround3 22.17 22.18 22.35 T:schwaemm256128v2 28.78? 29.41? 35.98? T:schwaemm192192v2 29.97 30.04 30.40 ascon128bi32v12 32.41 32.43 32.44 T:schwaemm256256v2 33.36 33.46 33.56 T:schwaemm128128v2 34.28 34.52 34.81 T:isapa128v20 39.07 39.21 39.65 T:grain128aeadv2 40.38 41.09 41.26 T:isapa128av20 45.15 45.32 46.06 romulusn 47.87 47.99 48.04 T:giftcofb128v1 53.02 53.14 53.32 T!!!romulust 70.62 70.67 70.71 T:isapk128av20 74.84 75.16 75.59 romulusm 76.45 76.48 76.51 T:tinyjambu128v2 88.23 88.38 88.94 T:isapk128v20 95.21 95.35 95.40 T:tinyjambu192v2 104.27 104.33 104.38 T:tinyjambu256v2 126.46 126.66 127.03 T:isapxv20 196.87 197.51 198.40 T:elephant200v2 10399.60 10402.48 10405.87 T:elephant176v2 11798.97 11807.47 11810.48 T:elephant160v2

Cycles/byte for long+long encrypt 25% 50% 75% aead 0.99 1.01 1.02 T:aes128gcmv1 1.08 1.10 1.11 aes256gcmv1 10.40 10.41 10.43 ascon128av12 15.00 15.01 15.05 ascon80pqv12 15.07 15.09 15.15 ascon128v12 15.52 15.53 15.55 T:xoodyakround3 20.42 20.45 20.53 ascon128abi32v12 21.97 22.02 22.19 T:schwaemm256128v2 28.66? 29.34? 35.95? T:schwaemm192192v2 30.12 30.28 30.43 ascon128bi32v12 32.26 32.27 32.29 T:schwaemm256256v2 33.28 33.45 33.93 T:schwaemm128128v2 38.19 38.51 38.61 romulusn 38.84 38.90 38.95 T:grain128aeadv2 48.00 48.12 48.19 T:giftcofb128v1 51.07 51.13 51.24 T:isapa128v20 51.17 51.30 51.77 T:isapa128av20 52.97 53.12 53.23 romulusm 62.21 62.26 62.29 T:tinyjambu128v2 74.58 74.63 74.71 T:tinyjambu192v2 78.49 78.56 78.61 T:tinyjambu256v2 88.53 88.59 88.87 T:isapk128av20 101.99 102.08 102.83 T!!!romulust 115.70 116.15 116.77 T:isapk128v20 148.78 149.25 149.90 T:elephant200v2 168.52 170.40 171.40 T:isapxv20 7761.45 7771.57 7772.30 T:elephant176v2 8849.74 8852.13 8854.38 T:elephant160v2

Cycles/byte for long+long decrypt 25% 50% 75% aead 0.97 0.99 1.00 T:aes128gcmv1 1.10 1.13 1.14 aes256gcmv1 10.26 10.28 10.30 ascon128av12 14.93 14.95 15.06 ascon128v12 14.94 15.07 15.14 ascon80pqv12 15.35 15.36 15.39 T:xoodyakround3 20.43 20.46 20.56 ascon128abi32v12 22.02 22.06 22.21 T:schwaemm256128v2 28.66? 29.36? 35.75? T:schwaemm192192v2 30.13 30.27 30.34 ascon128bi32v12 32.19 32.28 32.35 T:schwaemm256256v2 33.21 33.25 33.74 T:schwaemm128128v2 37.32 37.67 37.97 romulusn 38.89 39.15 39.22 T:grain128aeadv2 47.99 48.06 48.24 T:giftcofb128v1 51.07 51.15 51.25 T:isapa128v20 51.17 51.43 51.54 T:isapa128av20 52.14 52.27 52.47 romulusm 62.42 62.47 62.50 T:tinyjambu128v2 74.43 74.55 74.63 T:tinyjambu192v2 78.69 78.74 78.79 T:tinyjambu256v2 88.49 88.56 88.63 T:isapk128av20 101.78 101.88 102.17 T!!!romulust 115.83 116.10 116.39 T:isapk128v20 148.73 148.88 149.26 T:elephant200v2 169.42 169.57 170.67 T:isapxv20 7762.51 7773.01 7775.09 T:elephant176v2 8845.24 8851.32 8852.38 T:elephant160v2

Cycles/byte for long+long forgery 25% 50% 75% aead 0.98 0.99 1.00 T:aes128gcmv1 1.13 1.13 1.14 aes256gcmv1 10.29 10.29 10.30 ascon128av12 14.96 15.00 15.10 ascon128v12 14.98 15.06 15.13 ascon80pqv12 15.37 15.39 15.44 T:xoodyakround3 20.43 20.47 20.56 ascon128abi32v12 22.00 22.02 22.15 T:schwaemm256128v2 28.69? 29.35? 35.75? T:schwaemm192192v2 30.21 30.29 30.36 ascon128bi32v12 32.22 32.29 32.35 T:schwaemm256256v2 33.17 33.37 34.01 T:schwaemm128128v2 34.17 34.30 34.32 T:isapa128v20 37.06 37.48 37.97 romulusn 38.93 39.12 39.22 T:grain128aeadv2 40.61 40.95 41.09 T:isapa128av20 47.99 48.13 48.23 T:giftcofb128v1 52.19 52.32 52.75 romulusm 52.90 53.02 53.09 T!!!romulust 62.40 62.44 62.48 T:tinyjambu128v2 70.65 70.68 70.99 T:isapk128av20 74.42 74.54 74.66 T:tinyjambu192v2 78.70 78.75 78.83 T:tinyjambu256v2 89.49 89.53 89.78 T:isapk128v20 126.52 126.87 127.04 T:isapxv20 148.98 149.25 149.59 T:elephant200v2 7764.95 7770.41 7772.78 T:elephant176v2 8848.28 8851.26 8853.35 T:elephant160v2

Cycles/byte for 0+long encrypt 25% 50% 75% aead 0.55 0.56 0.58 T:aes128gcmv1 0.54 0.57 0.58 aes256gcmv1 9.97 10.01 10.05 T:xoodyakround3 10.05 10.06 10.07 ascon128av12 14.80 14.81 14.82 ascon128v12 14.81 14.84 14.85 ascon80pqv12 20.72 20.73 20.74 ascon128abi32v12 21.84 21.93 21.99 T:schwaemm256128v2 28.45? 29.21? 35.86? T:schwaemm192192v2 29.37 29.46 29.64 romulusn 29.39 29.49 29.72 romulusm 30.08 30.22 30.48 ascon128bi32v12 31.99 32.14 32.24 T:schwaemm256256v2 33.15 33.63 33.96 T:schwaemm128128v2 34.10 34.25 34.28 T:isapa128v20 38.72 38.77 38.98 T:grain128aeadv2 40.98 41.02 41.18 T:isapa128av20 47.86 48.07 48.39 T:giftcofb128v1 48.33 48.41 48.47 T:tinyjambu128v2 52.78 53.11 53.39 T!!!romulust 53.14 53.20 53.22 T:tinyjambu256v2 53.77 53.88 53.94 T:tinyjambu192v2 70.67 70.75 71.19 T:isapk128av20 90.47 90.59 90.67 T:isapk128v20 99.97 100.19 100.53 T:elephant200v2 125.29 126.07 128.09 T:isapxv20 5132.50 5140.96 5148.22 T:elephant176v2 5889.90 5898.68 5901.13 T:elephant160v2

Cycles/byte for 0+long decrypt 25% 50% 75% aead 0.51 0.53 0.53 T:aes128gcmv1 0.55 0.56 0.57 aes256gcmv1 9.95 9.98 10.01 T:xoodyakround3 10.28 10.31 10.32 ascon128av12 14.54 14.60 14.85 ascon80pqv12 14.67 14.69 14.88 ascon128v12 20.71 20.72 20.74 ascon128abi32v12 21.95 21.98 22.16 T:schwaemm256128v2 28.43? 29.28? 35.65? T:schwaemm192192v2 29.38 29.46 29.54 romulusm 29.42 29.49 29.68 romulusn 30.22 30.34 30.51 ascon128bi32v12 31.97 31.98 32.27 T:schwaemm256256v2 33.15 33.58 33.95 T:schwaemm128128v2 34.11 34.26 34.33 T:isapa128v20 38.70 38.74 38.77 T:grain128aeadv2 40.92 40.97 41.21 T:isapa128av20 47.97 48.12 48.25 T:giftcofb128v1 48.33 48.39 48.52 T:tinyjambu128v2 52.75 52.93 53.06 T!!!romulust 53.11 53.17 53.23 T:tinyjambu256v2 53.78 53.82 53.86 T:tinyjambu192v2 70.65 70.73 70.76 T:isapk128av20 90.03 90.58 91.05 T:isapk128v20 100.16 100.58 100.87 T:elephant200v2 126.35 126.42 126.68 T:isapxv20 5133.64 5138.49 5140.28 T:elephant176v2 5894.60 5897.71 5900.71 T:elephant160v2

Cycles/byte for 0+long forgery 25% 50% 75% aead 0.51 0.52 0.52 T:aes128gcmv1 0.56 0.56 0.57 aes256gcmv1 9.98 10.02 10.06 T:xoodyakround3 10.30 10.31 10.32 ascon128av12 14.48 14.58 14.82 ascon80pqv12 14.70 14.88 14.89 ascon128v12 20.73 20.74 20.98 ascon128abi32v12 21.87 21.94 21.99 T:schwaemm256128v2 28.45? 29.30? 35.76? T:schwaemm192192v2 29.37 29.45 29.58 romulusm 29.41 29.50 29.60 romulusn 30.12 30.41 30.54 ascon128bi32v12 31.98 32.18 32.27 T:schwaemm256256v2 33.14 33.53 33.75 T:schwaemm128128v2 34.21 34.25 34.29 T:isapa128v20 38.72 38.72 38.81 T:grain128aeadv2 40.97 41.03 41.18 T:isapa128av20 47.86 48.07 48.11 T:giftcofb128v1 48.36 48.44 48.48 T:tinyjambu128v2 52.72 52.91 53.03 T!!!romulust 53.12 53.19 53.28 T:tinyjambu256v2 53.77 53.81 53.86 T:tinyjambu192v2 70.64 70.70 70.77 T:isapk128av20 90.52 90.59 90.77 T:isapk128v20 100.15 100.58 100.84 T:elephant200v2 126.37 126.41 127.03 T:isapxv20 5134.65 5138.57 5141.29 T:elephant176v2 5896.26 5899.58 5901.87 T:elephant160v2

Cycles/byte for 1536+1536 encrypt 25% 50% 75% aead 1.14 1.15 1.15 T:aes128gcmv1 1.25 1.26 1.26 aes256gcmv1 10.67 10.68 10.69 ascon128av12 15.24 15.25 15.30 ascon80pqv12 15.31 15.32 15.34 ascon128v12 15.68 15.70 15.74 T:xoodyakround3 20.86 20.91 20.95 ascon128abi32v12 22.71 22.72 22.82 T:schwaemm256128v2 29.96? 30.00? 36.11? T:schwaemm192192v2 30.47 30.73 30.79 ascon128bi32v12 33.08 33.15 33.16 T:schwaemm256256v2 33.80 33.93 34.27 T:schwaemm128128v2 38.76 38.82 38.98 romulusn 39.32 39.37 39.43 T:grain128aeadv2 48.54 48.62 48.66 T:giftcofb128v1 53.35 53.46 53.50 romulusm 55.07 55.26 55.67 T:isapa128av20 62.70 62.75 62.81 T:tinyjambu128v2 74.41 74.47 74.54 T:isapa128v20 75.17 75.22 75.26 T:tinyjambu192v2 79.10 79.15 79.23 T:tinyjambu256v2 102.03 102.06 102.11 T:isapk128av20 103.52 103.60 103.79 T!!!romulust 152.01 152.11 152.89 T:elephant200v2 206.23 206.28 207.00 T:isapk128v20 277.68 278.06 279.59 T:isapxv20 7825.14 7831.61 7836.07 T:elephant176v2 8947.72 8950.69 8952.43 T:elephant160v2

Cycles/byte for 1536+1536 decrypt 25% 50% 75% aead 1.12 1.13 1.14 T:aes128gcmv1 1.29 1.29 1.30 aes256gcmv1 10.55 10.55 10.56 ascon128av12 15.22 15.27 15.27 ascon128v12 15.21 15.28 15.33 ascon80pqv12 15.51 15.54 15.56 T:xoodyakround3 20.89 20.90 20.99 ascon128abi32v12 22.69 22.70 22.83 T:schwaemm256128v2 29.87? 30.02? 35.97? T:schwaemm192192v2 30.56 30.66 30.79 ascon128bi32v12 33.07 33.15 33.20 T:schwaemm256256v2 33.70 33.81 34.22 T:schwaemm128128v2 37.71 38.34 38.74 romulusn 39.35 39.53 39.68 T:grain128aeadv2 48.54 48.61 48.66 T:giftcofb128v1 52.70 52.82 52.97 romulusm 55.01 55.17 55.25 T:isapa128av20 62.91 62.97 63.00 T:tinyjambu128v2 74.47 74.49 74.58 T:isapa128v20 75.05 75.12 75.23 T:tinyjambu192v2 79.32 79.35 79.36 T:tinyjambu256v2 102.07 102.09 102.25 T:isapk128av20 103.38 103.43 103.48 T!!!romulust 151.88 152.22 153.15 T:elephant200v2 206.34 206.48 206.66 T:isapk128v20 277.97 278.03 278.58 T:isapxv20 7825.64 7833.27 7836.25 T:elephant176v2 8949.61 8952.00 8953.36 T:elephant160v2

Cycles/byte for 1536+1536 forgery 25% 50% 75% aead 1.12 1.12 1.13 T:aes128gcmv1 1.27 1.28 1.29 aes256gcmv1 10.54 10.55 10.55 ascon128av12 15.21 15.27 15.39 ascon80pqv12 15.18 15.29 15.36 ascon128v12 15.55 15.57 15.60 T:xoodyakround3 20.83 20.89 20.99 ascon128abi32v12 22.67 22.67 22.83 T:schwaemm256128v2 29.87? 29.97? 35.98? T:schwaemm192192v2 30.53 30.69 30.81 ascon128bi32v12 33.07 33.14 33.20 T:schwaemm256256v2 33.90 33.90 34.21 T:schwaemm128128v2 38.12 38.31 38.53 romulusn 39.45 39.63 39.70 T:grain128aeadv2 42.90 43.03 43.11 T:isapa128av20 46.04 46.11 46.17 T:isapa128v20 48.52 48.63 48.73 T:giftcofb128v1 52.63 52.96 53.08 romulusm 54.52 54.54 54.68 T!!!romulust 62.90 62.96 62.97 T:tinyjambu128v2 75.02 75.15 75.26 T:tinyjambu192v2 79.32 79.33 79.39 T:tinyjambu256v2 79.93 79.94 80.06 T:isapk128av20 137.26 137.35 137.72 T:isapk128v20 151.96 152.30 152.96 T:elephant200v2 181.62 181.97 181.99 T:isapxv20 7831.42 7833.05 7834.54 T:elephant176v2 8950.34 8953.04 8954.22 T:elephant160v2

Cycles/byte for 64+64 encrypt 25% 50% 75% aead 6.96 7.06 7.35 aes256gcmv1 7.59 7.64 7.74 T:aes128gcmv1 16.17 16.31 16.73 ascon128av12 20.22 20.36 20.57 ascon128v12 20.51 20.71 20.81 ascon80pqv12 23.06 23.24 23.31 T:xoodyakround3 30.65 30.73 31.07 ascon128abi32v12 37.09 37.23 37.43 T:schwaemm256128v2 39.93 40.03 40.73 ascon128bi32v12 43.84 44.16 44.41 T:schwaemm128128v2 46.34 46.55 46.80 romulusn 48.51? 48.81? 58.34? T:schwaemm192192v2 49.59 49.70 49.83 T:grain128aeadv2 52.66 52.82 52.96 T:schwaemm256256v2 59.06 59.16 59.51 T:giftcofb128v1 61.73 62.00 62.32 romulusm 73.95 74.14 74.40 T:tinyjambu128v2 88.23 88.33 88.62 T:tinyjambu192v2 92.51 92.74 93.14 T:tinyjambu256v2 140.02 140.27 141.09 T!!!romulust 141.15 141.44 141.87 T:isapa128av20 216.69 216.95 217.24 T:elephant200v2 395.12 395.23 398.22 T:isapk128av20 610.60 610.69 611.37 T:isapa128v20 2257.05 2258.54 2268.41 T:isapk128v20 2742.11 2742.33 2756.54 T:isapxv20 9742.59 9746.20 9760.72 T:elephant176v2 11986.59 11993.77 11998.59 T:elephant160v2

Cycles/byte for 64+64 decrypt 25% 50% 75% aead 6.74 6.95 7.30 aes256gcmv1 7.72 7.77 7.86 T:aes128gcmv1 16.11 16.16 16.42 ascon128av12 20.23 20.43 20.78 ascon128v12 20.41 20.54 20.85 ascon80pqv12 22.80 23.03 23.38 T:xoodyakround3 30.70 30.77 30.89 ascon128abi32v12 36.98 37.03 37.09 T:schwaemm256128v2 40.08 40.28 40.66 ascon128bi32v12 43.80 43.90 44.38 T:schwaemm128128v2 45.99 46.33 46.73 romulusn 48.45? 48.66? 58.18? T:schwaemm192192v2 49.70 49.79 50.13 T:grain128aeadv2 52.55 52.63 52.78 T:schwaemm256256v2 59.39 59.60 59.90 T:giftcofb128v1 63.53 63.71 64.38 romulusm 74.30 74.48 74.56 T:tinyjambu128v2 88.25 88.38 88.56 T:tinyjambu192v2 92.89 93.03 93.16 T:tinyjambu256v2 139.95 140.45 140.98 T!!!romulust 141.42 141.81 142.57 T:isapa128av20 216.30 216.76 216.87 T:elephant200v2 394.30 395.01 395.59 T:isapk128av20 610.70 611.02 611.34 T:isapa128v20 2258.73 2259.26 2261.59 T:isapk128v20 2742.61 2743.04 2743.62 T:isapxv20 9742.30 9752.73 9756.25 T:elephant176v2 11984.55 11986.77 11991.55 T:elephant160v2

Cycles/byte for 64+64 forgery 25% 50% 75% aead 6.73 6.81 6.89 aes256gcmv1 7.70 7.78 7.84 T:aes128gcmv1 16.04 16.09 16.14 ascon128av12 20.16 20.22 20.37 ascon128v12 20.16 20.30 20.43 ascon80pqv12 23.12 23.26 23.45 T:xoodyakround3 30.67 30.78 30.95 ascon128abi32v12 37.00 37.12 37.17 T:schwaemm256128v2 40.07 40.21 40.34 ascon128bi32v12 43.83 43.96 44.07 T:schwaemm128128v2 45.90 46.34 46.45 romulusn 48.31? 48.47? 58.22? T:schwaemm192192v2 49.62 49.77 50.06 T:grain128aeadv2 52.53 52.62 52.74 T:schwaemm256256v2 59.34 59.55 59.88 T:giftcofb128v1 63.55 63.97 64.21 romulusm 74.17 74.36 74.44 T:tinyjambu128v2 88.14 88.26 88.47 T:tinyjambu192v2 89.49 89.79 90.19 T!!!romulust 91.21 91.67 92.09 T:isapa128av20 92.91 92.98 93.06 T:tinyjambu256v2 216.55 216.77 216.82 T:elephant200v2 278.25 278.66 279.00 T:isapk128av20 318.71 318.79 318.98 T:isapa128v20 1218.74 1219.26 1219.77 T:isapk128v20 1434.97 1435.54 1436.06 T:isapxv20 9742.77 9745.50 9753.14 T:elephant176v2 11981.30 11986.68 11992.58 T:elephant160v2