The Keccak sponge function family

Guido Bertoni¹, Joan Daemen¹, Michaël Peeters² and Gilles Van Assche¹

¹STMicroelectronics

²NXP Semiconductors

Software performance figures

On this page, we summarize the performance figures of Keccak[r=1024,c=576] as they can be found in eBASH. We select results with recent compilers (preferably GCC ≥ 4.4) and recent SUPERCOP (or XBX) versions on a given processor.

For long messages, the speed is directly proportional to the bitrate r. The figures below are for the nominal value r=1024. To estimate the performance for other bitrate values, one can simply multiply the number of cycles/byte by 1024/r. For instance, Keccak[r=1088,c=512] is 6.25% faster than Keccak[] and it is also benchmarked on eBASH under the name keccakc512.

For short messages, the speed is determined by the number of calls to Keccak-f, i.e., just one when the message length is ≤r-2 bits.

64-bit platforms

32-bit platforms

64-bit platforms used in 32-bit mode

Legend

• SUPERCOP version is the version of the SUPERCOP benchmarking software. This also determines the version of the hash function implementations therein.
• (XBX): the benchmark uses the eXternal Benchmarking eXtension (XBX) to SUPERCOP.
• Implementation: this characterises the fastest implementation on this machine. It includes the following properties:
• plain 32-bit: plain C code using 32-bit operations;
• plain 64-bit: plain C code using 64-bit operations;
• LC: code using the lane complementing technique (see the Keccak implementation overview for more details);
• BI: code using the bit interleaving technique to use 32-bit rotations instead of 64-bit ones;
• BI(T): same, where the bit interleaving is implemented with tables;
• SIMD64: the code uses the 64-bit SIMD operations of the processor (MMX on the AMD and Intel processors);
• SIMD128: the code uses the 128-bit SIMD operations of the processor (SSE2 on the AMD and Intel processors).
• Short gives the number of cycles to hash a 1-block message (≤ 127 bytes when r=1024).
• Long gives the number of cycles per byte to hash a long message with Keccak[r=1024,c=576].
• SHA-256 gives, as a comparison point, the number of cycles per byte of the fastest implementation of SHA-256 on this machine.
• SHA-512: same, for SHA-512.

Unless otherwise specified, the contents and files within the domain keccak.noekeon.org are © 2008-2011 Guido Bertoni, Joan Daemen, Michaël Peeters and Gilles Van Assche.

Last updated: 2011-01-27