VAMPIRE	eBACS: ECRYPT Benchmarking of Cryptographic Systems	ECRYPT II

General information:	Introduction	eBASH	eBASC	eBAEAD	eBATS	SUPERCOP	XBX	Computers	Arch

How to submit new software:	Tips	hash	stream	aead	dh	kem	encrypt	sign

List of primitives measured:	lwc	sha3	hash	stream	lwc	caesar	aead	dh	kem	encrypt	sign

Measurements:	lwc	sha3	hash	stream	lwc	caesar	aead	dh	kem	encrypt	sign

List of subroutines:	verify	decode	encode	sort	core	hashblocks	xof	scalarmult

Measurements of stream ciphers on one machine: armeabi; Cortex-A7 (410fc075); 2016 Broadcom BCM2836; 4 x 900MHz; `berry2`, `supercop-20251222`

[Page version: 20260408 07:14:54]

eBASC (ECRYPT Benchmarking of Stream Ciphers) is a project to measure the performance of stream ciphers. This page presents benchmark results collected in eBASC:

Speed (cycles/byte) of encrypting an 8-byte message.
Speed of encrypting a 64-byte message.
Speed of encrypting a 576-byte message.
Speed of encrypting a 1536-byte message.
Speed of encrypting a 4096-byte message.
Speed of encrypting a long message. This is computed as 1/3072 of the difference in cycle counts between encrypting 4096-byte messages and encrypting 1024-byte messages.

Graphs show timings for all message lengths between 0 and 4096 bytes. The stair-step shape of a typical curve on the graphs reflects the fact that these stream ciphers handle messages in blocks, such as 64-byte blocks.

Each table row lists the first quartile of many speed measurements (or StQ1 starting with supercop-20260214), the median of many speed measurements (or StQ2 starting with supercop-20260214), the third quartile of many speed measurements (or StQ3 starting with supercop-20260214), and the name of the primitive. Measurements with large interquartile range (or stabilized interquartile range) are indicated in red with question marks. The symbol T: (starting with supercop-20200816) means that the SUPERCOP database at the time of benchmarking did not list constant time as a goal for this implementation. The symbol T!!! means that constant time was listed as a goal for this implementation, but that the implementation failed TIMECOP. (TIMECOP failures are not necessarily security issues; they can sometimes be resolved by, e.g., declaring that a rejection-sampling condition is safe to declassify.)

There is a separate page with more information about each stream cipher and each implementation. Designers and implementors interested in submitting new stream ciphers and new implementations should read the call for submissions.

Test results

Graphs: (bytes,cycles)

Cycles/byte for long messages

25% 50% 75% stream

6.37 6.50 6.77 T!!!chacha8

6.74 6.89 7.19 T!!!salsa208

8.51? 8.83? 9.71? tango642

8.96 9.12 9.38 T!!!chacha12

8.60? 9.17? 9.65? T:tpy

9.16 9.26 9.48 T!!!salsa2012

9.15 9.42 10.09 T:nlsv2

9.44 9.64 10.07 T:tpy6

8.42? 9.84? 11.11? T:sosemanuk

11.09 11.56 12.18 T:cryptmtv3

11.15? 12.43? 13.81? T:panama

12.49? 13.16? 13.88? T:tpypy

13.99 14.11 14.35 T!!!salsa20

13.98 14.13 14.49 T!!!xsalsa20

14.09 14.25 14.56 T!!!chacha20

33.42 34.36 35.66 T:aes128ctr

40.02 40.79 42.19 T:aes192ctr

41.02 41.50 42.37 T:aes128estream

46.29 47.26 48.50 T:aes256ctr

60.91 61.60 62.25 T:aes256estream

83.53 84.31 84.92 T:ocelot1

85.28 86.77 92.67 T:ocelot2

148.17 153.23 158.72 T:amastrid

Cycles/byte for 4096 bytes

25% 50% 75% stream

6.51 6.57 6.77 T!!!chacha8

6.84 6.93 7.15 T!!!salsa208

9.10 9.18 9.36 T!!!chacha12

9.27 9.34 9.48 T!!!salsa2012

9.66 9.88 10.49 tango642

9.74 9.94 10.44 T:nlsv2

10.83 10.98 11.29 T:tpy6

11.32 11.73 12.56 T:sosemanuk

12.59 12.77 13.07 T:tpy

13.03 13.30 13.61 T:cryptmtv3

14.10 14.18 14.34 T!!!salsa20

14.23 14.31 14.54 T!!!chacha20

14.41 14.50 14.75 T!!!xsalsa20

16.12 16.47 17.29 T:panama

16.56 16.74 17.16 T:tpypy

36.00 36.05 36.74 T:aes128ctr

41.93 41.95 42.45 T:aes128estream

42.48 42.57 43.28 T:aes192ctr

49.01 49.06 49.72 T:aes256ctr

61.99 62.01 62.43 T:aes256estream

88.33 88.40 88.85 T:ocelot1

90.88 90.96 95.30 T:ocelot2

155.37 158.69 162.60 T:amastrid

Cycles/byte for 1536 bytes

25% 50% 75% stream

6.58 6.69 6.92 T!!!chacha8

6.91 6.99 7.03 T!!!salsa208

9.30 9.32 9.57 T!!!chacha12

9.39 9.40 9.47 T!!!salsa2012

11.13 11.18 11.55 T:nlsv2

11.41 11.57 12.40 tango642

13.13 13.29 14.02 T:tpy6

14.28 14.36 14.81 T!!!salsa20

14.47 14.57 15.04 T!!!chacha20

15.11 15.21 15.71 T!!!xsalsa20

14.70? 15.34? 17.85? T:sosemanuk

16.66 17.15 17.96 T:cryptmtv3

18.59 18.86 19.72 T:tpy

22.35 22.64 23.25 T:tpypy

22.57 23.04 25.02 T:panama

38.11 38.74 40.47 T:aes128ctr

42.36 42.70 43.60 T:aes128estream

44.70 45.21 47.01 T:aes192ctr

51.41 51.91 53.82 T:aes256ctr

62.48 62.80 64.04 T:aes256estream

95.18 95.61 99.81 T:ocelot1

97.74 97.79 99.06 T:ocelot2

164.42 165.56 167.50 T:amastrid

Cycles/byte for 576 bytes

25% 50% 75% stream

7.46 7.46 7.47 T!!!chacha8

7.82 7.90 8.03 T!!!salsa208

10.13 10.13 10.14 T!!!chacha12

10.39 10.39 10.39 T!!!salsa2012

14.56 14.84 15.94 T:nlsv2

15.47 15.62 15.78 T!!!chacha20

15.58 15.65 15.96 T!!!salsa20

16.20? 16.36? 18.28? tango642

17.76 17.90 18.11 T!!!xsalsa20

19.34 19.37 20.12 T:tpy6

21.29 21.99 23.62 T:cryptmtv3

22.97? 23.86? 27.17? T:sosemanuk

34.39 34.79 36.14 T:tpy

37.80 38.01 40.03 T:tpypy

38.92 40.03 43.02 T:panama

43.49 44.10 46.36 T:aes128estream

47.99? 49.50? 54.29? T:aes128ctr

55.36 57.13 61.27 T:aes192ctr

63.63 65.01 69.68 T:aes256ctr

64.13 65.20 67.70 T:aes256estream

113.45 114.10 119.75 T:ocelot1

115.97 117.00 122.32 T:ocelot2

192.39 193.06 197.03 T:amastrid

Cycles/byte for 64 bytes

25% 50% 75% stream

16.84 16.84 17.18 T!!!chacha8

16.97 16.98 17.50 T!!!salsa208

20.22 20.25 20.39 T!!!chacha12

21.05 21.16 21.39 T!!!salsa2012

27.03 27.06 28.01 T!!!chacha20

28.94 28.94 29.11 T!!!salsa20

48.17 48.22 48.79 T!!!xsalsa20

57.93 57.96 58.45 T:aes128estream

69.13 69.18 73.56 T:nlsv2

70.88 75.62 77.37 T:cryptmtv3

77.37 78.55 82.61 tango642

82.00 82.03 82.53 T:aes256estream

100.71 101.93 104.65 T:tpy6

100.73 102.23 111.92 T:aes128ctr

106.05 107.63 115.79 T:aes192ctr

116.02 116.91 124.93 T:aes256ctr

123.04? 127.14? 146.76? T:sosemanuk

236.14 238.32 255.15 T:tpypy

237.56 244.20 259.30 T:tpy

250.66? 255.85? 291.52? T:panama

349.90 351.32 367.49 T:ocelot2

347.97? 361.10? 390.23? T:ocelot1

514.39 525.35 550.15 T:amastrid

Cycles/byte for 8 bytes

25% 50% 75% stream

143.75 143.75 144.22 T!!!chacha8

168.75 169.17 173.48 T!!!salsa208

169.75 169.75 174.82 T!!!chacha12

201.00 203.38 211.71 T!!!salsa2012

211.57 211.85 214.02 T:aes128estream

226.25 226.25 227.68 T!!!chacha20

265.00 265.00 267.46 T!!!salsa20

280.31 280.50 284.66 T:aes256estream

347.38 348.02 358.56 T:nlsv2

363.52? 401.22? 419.37? T:cryptmtv3

422.18 422.33 431.87 T!!!xsalsa20

560.62 562.77 568.61 tango642

565.83 574.42 606.85 T:aes192ctr

559.34? 575.86? 658.12? T:aes128ctr

603.16 611.20 650.47 T:aes256ctr

722.88 723.28 726.67 T:tpy6

977.38? 1007.40? 1180.76? T:sosemanuk

1832.02 1855.16 2016.13 T:tpy

1798.72 1856.86 1979.38 T:tpypy

1986.17? 2012.70? 2256.66? T:panama

2186.95 2203.35 2407.53 T:ocelot1

2191.06 2210.51 2428.18 T:ocelot2

3375.22 3485.20 3648.14 T:amastrid

eBACS: ECRYPT Benchmarking of Cryptographic Systems

Measurements of stream ciphers on one machine: armeabi; Cortex-A7 (410fc075); 2016 Broadcom BCM2836; 4 x 900MHz; berry2, supercop-20251222

Measurements of stream ciphers on one machine: armeabi; Cortex-A7 (410fc075); 2016 Broadcom BCM2836; 4 x 900MHz; `berry2`, `supercop-20251222`