VAMPIRE	eBACS: ECRYPT Benchmarking of Cryptographic Systems	ECRYPT II

Measurements of NISTLWC cipher candidates on one machine: amd64; Zen 2 (830f10); 2019 AMD EPYC 7742; 64 x 2250MHz; rome0, supercop-20251222

[Page version: 20260112 15:28:56]

eBAEAD (ECRYPT Benchmarking of Authenticated Ciphers) is a project to measure the performance of authenticated ciphers. This page presents an excerpt of the full eBAEAD benchmark results. The excerpt is for NISTLWC, specifically (starting with supercop-20221005) finalists.

Each table row lists the first quartile of many speed measurements, the median of many speed measurements, the third quartile of many speed measurements, and the name of the primitive. Measurements with large variance are indicated in red with question marks. The symbol T: (starting with supercop-20200816) means that the SUPERCOP database at the time of benchmarking did not list constant time as a goal for this implementation. The symbol T!!! means that constant time was listed as a goal for this implementation, but that the implementation failed TIMECOP. (TIMECOP failures are not necessarily security issues; they can sometimes be resolved by, e.g., declaring that a rejection-sampling condition is safe to declassify.)

There is a separate page with more information about each cipher and each implementation.

Test results

Graphs: (bytes,cycles)

Cycles/byte for long+0 encrypt 25% 50% 75% aead 1.53 1.54 1.55 T:aes128gcmv1 1.66 1.68 1.68 aes256gcmv1 6.41 6.42 6.43 ascon128av12 9.38 9.38 9.39 ascon128v12 9.41 9.41 9.42 ascon80pqv12 11.13 11.30 11.41 ascon128abi32v12 16.96 17.06 17.14 ascon128bi32v12 17.89 17.91 18.00 T:xoodyakround3 19.45 19.60 19.74 T:schwaemm256128v2 23.35 23.38 23.55 T:schwaemm256256v2 25.61 25.72 25.85 T:schwaemm192192v2 26.96 27.03 27.46 T:grain128aeadv2 27.51 27.68 27.85 T:schwaemm128128v2 35.71 35.76 35.80 romulusn 36.36 36.38 36.45 T:isapa128av20 36.51 36.56 36.68 T:isapa128v20 40.48 40.50 40.54 T:giftcofb128v1 58.01 58.08 58.14 romulusm 61.63 61.63 61.69 T:tinyjambu128v2 64.98 65.07 65.22 T:isapk128av20 68.91 68.96 68.96 T:tinyjambu192v2 75.97 75.97 76.04 T:tinyjambu256v2 85.54 85.65 85.75 T:isapk128v20 118.44 118.47 118.55 romulust 148.48 149.30 150.73 T:isapxv20 228.03 229.71 246.04 T:elephant200v2 6484.26 6494.50 6540.14 T:elephant176v2 7158.76 7161.61 7163.77 T:elephant160v2

Cycles/byte for long+0 decrypt 25% 50% 75% aead 1.66 1.67 1.68 T:aes128gcmv1 1.77 1.77 1.80 aes256gcmv1 6.31 6.32 6.32 ascon128av12 9.50 9.51 9.54 ascon80pqv12 9.54 9.56 9.57 ascon128v12 11.23 11.25 11.27 ascon128abi32v12 16.78 16.91 16.98 ascon128bi32v12 17.74 17.77 17.86 T:xoodyakround3 19.51 19.59 19.67 T:schwaemm256128v2 23.34 23.39 23.51 T:schwaemm256256v2 25.65 25.76 25.82 T:schwaemm192192v2 27.52 27.59 27.78 T:schwaemm128128v2 27.42 27.61 27.63 T:grain128aeadv2 35.78 35.84 35.88 romulusn 36.29 36.34 36.54 T:isapa128v20 36.40 36.44 36.50 T:isapa128av20 40.50 40.54 40.59 T:giftcofb128v1 58.17 58.23 58.32 romulusm 61.45 61.52 61.58 T:tinyjambu128v2 64.99 65.11 65.17 T:isapk128av20 68.67 68.68 68.74 T:tinyjambu192v2 75.99 76.04 76.12 T:tinyjambu256v2 84.81 84.90 84.97 T:isapk128v20 118.40 118.46 118.53 romulust 149.09 149.35 151.56 T:isapxv20 228.33 229.85 245.87 T:elephant200v2 6478.13 6492.35 6540.31 T:elephant176v2 7158.71 7160.33 7162.77 T:elephant160v2

Cycles/byte for long+0 forgery 25% 50% 75% aead 1.66 1.67 1.68 T:aes128gcmv1 1.77 1.78 1.81 aes256gcmv1 6.33 6.33 6.34 ascon128av12 9.50 9.52 9.53 ascon80pqv12 9.55 9.56 9.56 ascon128v12 11.24 11.25 11.25 ascon128abi32v12 16.76 16.91 16.99 ascon128bi32v12 17.77 17.84 17.91 T:xoodyakround3 18.03 18.09 18.13 T:isapa128v20 19.44 19.55 19.73 T:schwaemm256128v2 23.33 23.42 23.52 T:schwaemm256256v2 24.11 24.14 24.20 T:isapa128av20 25.67 25.75 25.80 T:schwaemm192192v2 27.44 27.53 27.64 T:grain128aeadv2 27.49 27.56 27.79 T:schwaemm128128v2 35.78 35.83 35.87 romulusn 39.68 39.73 39.81 romulust 40.48 40.50 40.53 T:giftcofb128v1 44.25 44.44 44.70 T:isapk128av20 54.62 54.64 54.67 T:isapk128v20 58.22 58.29 58.34 romulusm 61.52 61.58 61.61 T:tinyjambu128v2 68.70 68.72 68.79 T:tinyjambu192v2 76.01 76.04 76.10 T:tinyjambu256v2 86.46 87.31 89.45 T:isapxv20 228.06 229.92 245.68 T:elephant200v2 6478.41 6490.26 6532.56 T:elephant176v2 7158.11 7161.21 7162.93 T:elephant160v2

Cycles/byte for long+long encrypt 25% 50% 75% aead 1.02 1.03 1.03 T:aes128gcmv1 1.08 1.09 1.10 aes256gcmv1 6.37 6.42 6.43 ascon128av12 9.44 9.46 9.49 ascon80pqv12 9.45 9.48 9.48 ascon128v12 11.05 11.11 11.11 ascon128abi32v12 13.48 13.51 13.58 T:xoodyakround3 16.82 16.88 16.93 ascon128bi32v12 19.37 19.48 19.59 T:schwaemm256128v2 23.24 23.26 23.36 T:schwaemm256256v2 25.57 25.60 25.67 T:schwaemm192192v2 26.93 26.99 27.27 T:grain128aeadv2 27.25 27.40 27.44 T:isapa128v20 27.56 27.60 27.78 T:schwaemm128128v2 28.97 29.00 29.02 romulusn 30.28 30.31 30.32 T:isapa128av20 40.17 40.21 40.24 romulusm 40.37 40.41 40.43 T:giftcofb128v1 50.56 50.63 50.65 T:tinyjambu128v2 54.33 54.34 54.34 T:tinyjambu192v2 54.76 54.82 54.95 T:isapk128av20 58.01 58.03 58.05 T:tinyjambu256v2 70.16 70.19 70.23 T:isapk128v20 79.12 79.18 79.25 romulust 117.12 117.37 117.98 T:isapxv20 170.18 171.28 183.09 T:elephant200v2 4844.66 4850.84 4887.38 T:elephant176v2 5367.51 5369.03 5369.74 T:elephant160v2

Cycles/byte for long+long decrypt 25% 50% 75% aead 1.09 1.09 1.10 T:aes128gcmv1 1.15 1.17 1.18 aes256gcmv1 6.34 6.36 6.36 ascon128av12 9.49 9.53 9.55 ascon80pqv12 9.52 9.53 9.53 ascon128v12 11.08 11.09 11.11 ascon128abi32v12 13.38 13.40 13.49 T:xoodyakround3 16.72 16.74 16.78 ascon128bi32v12 19.42 19.49 19.58 T:schwaemm256128v2 23.23 23.25 23.40 T:schwaemm256256v2 25.57 25.62 25.65 T:schwaemm192192v2 27.25 27.29 27.48 T:isapa128v20 27.33 27.42 27.46 T:grain128aeadv2 27.45 27.55 27.58 T:schwaemm128128v2 29.02 29.03 29.05 romulusn 30.28 30.32 30.37 T:isapa128av20 40.16 40.27 40.30 romulusm 40.39 40.43 40.46 T:giftcofb128v1 50.60 50.61 50.64 T:tinyjambu128v2 54.21 54.22 54.23 T:tinyjambu192v2 54.76 54.81 54.87 T:isapk128av20 58.06 58.09 58.11 T:tinyjambu256v2 69.72 69.80 69.81 T:isapk128v20 79.09 79.12 79.21 romulust 117.53 117.56 118.03 T:isapxv20 170.40 171.36 182.96 T:elephant200v2 4843.83 4849.64 4885.40 T:elephant176v2 5367.33 5368.72 5370.46 T:elephant160v2

Cycles/byte for long+long forgery 25% 50% 75% aead 1.09 1.10 1.10 T:aes128gcmv1 1.16 1.17 1.18 aes256gcmv1 6.31 6.33 6.34 ascon128av12 9.53 9.53 9.55 ascon80pqv12 9.54 9.55 9.55 ascon128v12 11.10 11.11 11.14 ascon128abi32v12 13.41 13.45 13.49 T:xoodyakround3 16.70 16.73 16.74 ascon128bi32v12 18.11 18.12 18.21 T:isapa128v20 19.41 19.48 19.58 T:schwaemm256128v2 23.23 23.25 23.40 T:schwaemm256256v2 24.17 24.19 24.22 T:isapa128av20 25.57 25.62 25.67 T:schwaemm192192v2 27.26 27.40 27.46 T:grain128aeadv2 27.51 27.56 27.58 T:schwaemm128128v2 28.98 29.04 29.06 romulusn 39.71 39.78 39.81 romulust 40.14 40.22 40.27 romulusm 40.40 40.44 40.45 T:giftcofb128v1 44.38 44.48 44.62 T:isapk128av20 50.62 50.63 50.65 T:tinyjambu128v2 54.21 54.23 54.26 T:tinyjambu192v2 54.62 54.65 54.67 T:isapk128v20 58.04 58.08 58.08 T:tinyjambu256v2 86.41 86.66 86.88 T:isapxv20 170.47 171.50 182.93 T:elephant200v2 4845.07 4850.42 4887.92 T:elephant176v2 5367.64 5369.10 5370.40 T:elephant160v2

Cycles/byte for 0+long encrypt 25% 50% 75% aead 0.50 0.52 0.53 T:aes128gcmv1 0.51 0.52 0.54 aes256gcmv1 6.32 6.34 6.37 ascon128av12 9.01 9.07 9.13 T:xoodyakround3 9.52 9.52 9.53 ascon128v12 9.48 9.53 9.54 ascon80pqv12 10.92 10.95 10.95 ascon128abi32v12 16.51 16.67 16.73 ascon128bi32v12 18.18 18.24 18.27 T:isapa128v20 19.21 19.30 19.45 T:schwaemm256128v2 22.22 22.24 22.26 romulusn 22.24 22.25 22.38 romulusm 23.04 23.06 23.23 T:schwaemm256256v2 24.17 24.19 24.25 T:isapa128av20 25.43 25.52 25.59 T:schwaemm192192v2 26.89 27.13 27.20 T:grain128aeadv2 27.24 27.35 27.60 T:schwaemm128128v2 39.69 39.70 39.72 T:tinyjambu192v2 39.70 39.70 39.73 T:tinyjambu128v2 39.79 39.81 39.83 romulust 40.05 40.11 40.15 T:tinyjambu256v2 40.25 40.30 40.35 T:giftcofb128v1 44.37 44.58 44.77 T:isapk128av20 54.63 54.72 54.75 T:isapk128v20 85.83 86.49 86.89 T:isapxv20 112.46 113.29 120.74 T:elephant200v2 3193.78 3202.57 3223.68 T:elephant176v2 3572.05 3573.71 3576.12 T:elephant160v2

Cycles/byte for 0+long decrypt 25% 50% 75% aead 0.52 0.52 0.54 T:aes128gcmv1 0.52 0.52 0.54 aes256gcmv1 6.36 6.38 6.39 ascon128av12 9.04 9.07 9.16 T:xoodyakround3 9.48 9.52 9.57 ascon80pqv12 9.52 9.53 9.53 ascon128v12 10.94 10.97 11.09 ascon128abi32v12 16.51 16.61 16.67 ascon128bi32v12 18.19 18.23 18.25 T:isapa128v20 19.21 19.32 19.48 T:schwaemm256128v2 22.22 22.23 22.25 romulusm 22.24 22.26 22.28 romulusn 23.05 23.07 23.20 T:schwaemm256256v2 24.17 24.21 24.26 T:isapa128av20 25.46 25.56 25.61 T:schwaemm192192v2 27.13 27.23 27.29 T:grain128aeadv2 27.27 27.33 27.57 T:schwaemm128128v2 39.68 39.68 39.73 T:tinyjambu128v2 39.69 39.70 39.71 T:tinyjambu192v2 39.71 39.76 39.78 romulust 40.13 40.13 40.13 T:tinyjambu256v2 40.28 40.33 40.36 T:giftcofb128v1 44.32 44.47 44.73 T:isapk128av20 54.64 54.69 54.72 T:isapk128v20 85.74 86.31 86.71 T:isapxv20 112.44 113.30 120.88 T:elephant200v2 3193.42 3203.63 3223.90 T:elephant176v2 3571.37 3574.12 3576.24 T:elephant160v2

Cycles/byte for 0+long forgery 25% 50% 75% aead 0.52 0.52 0.53 T:aes128gcmv1 0.52 0.53 0.54 aes256gcmv1 6.32 6.34 6.35 ascon128av12 9.03 9.08 9.14 T:xoodyakround3 9.51 9.53 9.56 ascon80pqv12 9.55 9.57 9.57 ascon128v12 10.97 10.97 11.02 ascon128abi32v12 16.52 16.61 16.67 ascon128bi32v12 18.24 18.26 18.29 T:isapa128v20 19.23 19.37 19.47 T:schwaemm256128v2 22.23 22.24 22.27 romulusm 22.25 22.28 22.29 romulusn 23.11 23.15 23.19 T:schwaemm256256v2 24.15 24.20 24.25 T:isapa128av20 25.43 25.51 25.59 T:schwaemm192192v2 27.13 27.25 27.29 T:grain128aeadv2 27.28 27.43 27.66 T:schwaemm128128v2 39.68 39.68 39.70 T:tinyjambu128v2 39.70 39.70 39.72 T:tinyjambu192v2 39.75 39.79 39.85 romulust 40.01 40.01 40.02 T:tinyjambu256v2 40.30 40.34 40.37 T:giftcofb128v1 44.28 44.48 44.75 T:isapk128av20 54.66 54.70 54.71 T:isapk128v20 85.49 85.85 86.43 T:isapxv20 112.37 113.29 120.78 T:elephant200v2 3194.72 3202.38 3228.76 T:elephant176v2 3572.25 3574.68 3576.26 T:elephant160v2

Cycles/byte for 1536+1536 encrypt 25% 50% 75% aead 1.15 1.15 1.15 T:aes128gcmv1 1.22 1.23 1.24 aes256gcmv1 6.55 6.57 6.59 ascon128av12 9.60 9.61 9.64 ascon128v12 9.61 9.62 9.65 ascon80pqv12 11.38 11.40 11.41 ascon128abi32v12 13.59 13.60 13.65 T:xoodyakround3 17.18 17.21 17.24 ascon128bi32v12 19.97 20.04 20.16 T:schwaemm256128v2 23.82 23.87 23.98 T:schwaemm256256v2 26.18 26.21 26.26 T:schwaemm192192v2 27.38 27.41 27.62 T:grain128aeadv2 27.87 27.99 28.04 T:schwaemm128128v2 29.23 29.25 29.25 romulusn 33.52 33.53 33.54 T:isapa128av20 39.99 40.13 40.16 T:isapa128v20 40.47 40.49 40.51 romulusm 40.78 40.78 40.81 T:giftcofb128v1 50.96 51.03 51.05 T:tinyjambu128v2 54.74 54.75 54.76 T:tinyjambu192v2 58.45 58.46 58.48 T:tinyjambu256v2 60.99 61.00 61.02 T:isapk128av20 80.35 80.39 80.45 romulust 121.98 122.00 122.03 T:isapk128v20 174.85 174.86 185.99 T:elephant200v2 190.44 190.65 190.74 T:isapxv20 4881.28 4884.15 4917.35 T:elephant176v2 5427.24 5429.06 5430.14 T:elephant160v2

Cycles/byte for 1536+1536 decrypt 25% 50% 75% aead 1.22 1.22 1.22 T:aes128gcmv1 1.28 1.30 1.32 aes256gcmv1 6.51 6.52 6.53 ascon128av12 9.66 9.66 9.71 ascon80pqv12 9.69 9.69 9.69 ascon128v12 11.41 11.41 11.41 ascon128abi32v12 13.54 13.58 13.62 T:xoodyakround3 17.07 17.10 17.11 ascon128bi32v12 19.99 20.02 20.14 T:schwaemm256128v2 23.81 23.85 23.97 T:schwaemm256256v2 26.16 26.22 26.26 T:schwaemm192192v2 27.68 27.79 27.83 T:grain128aeadv2 27.87 27.98 28.13 T:schwaemm128128v2 29.27 29.30 29.30 romulusn 33.54 33.56 33.57 T:isapa128av20 40.00 40.01 40.16 T:isapa128v20 40.51 40.53 40.54 romulusm 40.78 40.79 40.82 T:giftcofb128v1 51.00 51.01 51.04 T:tinyjambu128v2 54.61 54.62 54.65 T:tinyjambu192v2 58.52 58.54 58.54 T:tinyjambu256v2 61.02 61.03 61.04 T:isapk128av20 80.26 80.34 80.37 romulust 121.66 121.67 121.69 T:isapk128v20 174.81 174.87 185.83 T:elephant200v2 190.37 190.71 191.50 T:isapxv20 4879.85 4883.88 4919.51 T:elephant176v2 5426.50 5428.74 5429.55 T:elephant160v2

Cycles/byte for 1536+1536 forgery 25% 50% 75% aead 1.22 1.22 1.22 T:aes128gcmv1 1.28 1.28 1.30 aes256gcmv1 6.49 6.49 6.51 ascon128av12 9.66 9.66 9.69 ascon80pqv12 9.70 9.70 9.70 ascon128v12 11.41 11.41 11.45 ascon128abi32v12 13.57 13.61 13.65 T:xoodyakround3 17.09 17.11 17.12 ascon128bi32v12 19.97 20.05 20.17 T:schwaemm256128v2 23.85 23.87 24.00 T:schwaemm256256v2 24.62 24.62 24.73 T:isapa128v20 25.97 25.99 26.03 T:isapa128av20 26.18 26.20 26.23 T:schwaemm192192v2 27.67 27.72 27.81 T:grain128aeadv2 27.94 28.08 28.17 T:schwaemm128128v2 29.27 29.29 29.30 romulusn 40.52 40.54 40.54 romulusm 40.78 40.79 40.82 T:giftcofb128v1 40.94 40.96 41.00 romulust 47.96 47.97 48.09 T:isapk128av20 51.02 51.03 51.06 T:tinyjambu128v2 54.60 54.62 54.62 T:tinyjambu192v2 58.47 58.49 58.52 T:tinyjambu256v2 81.17 81.19 81.21 T:isapk128v20 123.96 124.03 124.07 T:isapxv20 174.88 174.90 186.13 T:elephant200v2 4883.02 4887.26 4917.07 T:elephant176v2 5426.69 5427.72 5429.16 T:elephant160v2

Cycles/byte for 64+64 encrypt 25% 50% 75% aead 6.05 6.07 6.09 T:aes128gcmv1 7.47 7.70 8.16 aes256gcmv1 10.56 10.62 10.95 ascon128av12 12.74 12.74 13.33 ascon128v12 12.98 12.98 13.45 ascon80pqv12 17.93 18.25 18.88 ascon128abi32v12 20.15 20.58 20.89 T:xoodyakround3 23.73 23.73 25.72 ascon128bi32v12 33.09 33.30 33.39 T:schwaemm256128v2 35.00 35.06 35.12 romulusn 35.29 35.97 36.39 T:grain128aeadv2 35.69 36.07 36.81 T:schwaemm128128v2 38.02 38.23 38.35 T:schwaemm256256v2 42.26 42.85 43.27 T:schwaemm192192v2 47.18 47.35 47.59 romulusm 49.35 49.41 49.66 T:giftcofb128v1 59.99 60.20 60.26 T:tinyjambu128v2 64.16 64.27 64.59 T:tinyjambu192v2 68.09 68.36 68.82 T:tinyjambu256v2 106.87 107.35 107.66 T:isapa128av20 107.44 107.74 108.66 romulust 192.05 194.24 194.30 T:isapk128av20 246.17 246.74 262.39 T:elephant200v2 331.14 331.20 331.98 T:isapa128v20 1300.49 1300.51 1300.89 T:isapk128v20 1844.59 1848.76 1852.91 T:isapxv20 6063.19 6066.86 6109.73 T:elephant176v2 7258.51 7261.37 7263.56 T:elephant160v2

Cycles/byte for 64+64 decrypt 25% 50% 75% aead 5.73 5.75 5.83 T:aes128gcmv1 7.45 7.68 7.88 aes256gcmv1 10.32 10.34 10.84 ascon128av12 13.11 13.16 13.52 ascon128v12 12.96 13.26 13.41 ascon80pqv12 18.03 18.26 18.89 ascon128abi32v12 19.77 20.73 21.08 T:xoodyakround3 24.51 25.63 26.06 ascon128bi32v12 32.82 33.12 33.26 T:schwaemm256128v2 35.15 35.24 35.40 romulusn 36.16 36.34 36.80 T:grain128aeadv2 36.16 36.48 36.92 T:schwaemm128128v2 38.05 38.17 38.25 T:schwaemm256256v2 42.15 42.28 42.77 T:schwaemm192192v2 48.31 48.42 48.43 romulusm 49.54 49.65 50.07 T:giftcofb128v1 60.03 60.09 60.37 T:tinyjambu128v2 64.05 64.12 64.14 T:tinyjambu192v2 68.15 68.30 68.73 T:tinyjambu256v2 106.72 107.29 107.41 T:isapa128av20 108.18 108.23 108.41 romulust 192.63 192.95 194.77 T:isapk128av20 245.73 246.06 262.04 T:elephant200v2 329.31 331.30 332.51 T:isapa128v20 1300.74 1301.04 1301.65 T:isapk128v20 1849.09 1849.56 1850.25 T:isapxv20 6061.24 6066.55 6101.07 T:elephant176v2 7257.73 7262.04 7266.57 T:elephant160v2

Cycles/byte for 64+64 forgery 25% 50% 75% aead 5.73 5.73 5.74 T:aes128gcmv1 7.64 7.74 7.87 aes256gcmv1 10.26 10.39 10.55 ascon128av12 13.05 13.09 13.27 ascon80pqv12 13.11 13.11 13.36 ascon128v12 18.00 18.00 18.45 ascon128abi32v12 20.08 20.44 20.55 T:xoodyakround3 23.87 25.52 25.75 ascon128bi32v12 32.80 32.82 33.19 T:schwaemm256128v2 35.00 35.16 35.40 romulusn 35.66 36.09 36.30 T:grain128aeadv2 36.16 36.16 36.58 T:schwaemm128128v2 38.08 38.15 38.20 T:schwaemm256256v2 42.15 42.16 42.48 T:schwaemm192192v2 48.34 48.41 48.50 romulusm 49.90 50.02 50.16 T:giftcofb128v1 60.06 60.22 60.23 T:tinyjambu128v2 64.29 64.29 64.30 T:tinyjambu192v2 66.66 66.99 67.12 T:isapa128av20 67.45 67.55 68.23 romulust 68.29 68.31 68.34 T:tinyjambu256v2 118.63 118.99 121.95 T:isapk128av20 172.55 173.34 173.97 T:isapa128v20 245.52 245.59 262.35 T:elephant200v2 680.03 680.44 680.76 T:isapk128v20 967.42 967.94 971.74 T:isapxv20 6063.94 6068.15 6110.75 T:elephant176v2 7260.33 7263.22 7265.78 T:elephant160v2