Software performance figures

Hashing

The table below shows a summary of the performance on recent PC processors of Keccak, including the most representative instances from FIPS 202 and SP 800-185, of KangarooTwelve and of the traditional hash functions MD5, SHA-1 and SHA-2. The figures are in cycles per byte for long messages (less is faster).

FunctionSkylakeXSkylakeHaswellSandy Bridge
KangarooTwelve 0.51* 1.38* 1.41* 2.91*
ParallelHash128 1.04* 2.65* 2.73* 5.63*
ParallelHash256 1.35* 3.31* 3.41* 7.15*
SHAKE128 4.43* 6.24* 7.09* 8.81*
SHAKE256 5.49* 7.70* 8.75* 10.87*
SHA3-512 11.00* 14.83* 16.68* 20.46*
MD5 4.95+ 4.97+ 4.94+ 5.40+
SHA-1 3.50+ 3.48+ 4.15+ 4.92+
SHA-256 7.64+ 7.59+ 9.27+ 11.45+
SHA-512 5.12+ 5.05+ 6.54+ 7.95+

Authentication/encryption with Xoofff

The table below shows a summary of the performance on recent PC processors of Xoofff and the different authenticated encryption (AE) modes based on it. The figures are in cycles per byte for long messages (less is faster).

FunctionSkylakeXSkylakeHaswellSandy Bridge
Xoofff — MAC computation 0.40* 0.91* 1.19* 3.75*
Xoofff — keystream generation 0.51* 0.94* 0.98* 3.56*
Xoofff-SANE (session AE) — processing of metadata 0.40* 0.90* 1.18* 3.73*
Xoofff-SANE (session AE) — processing of plaintext 0.93* 1.89* 2.20* 7.47*
Xoofff-SANSE (session AE + SIV) 0.93* 1.89* 2.20* 7.46*
Xoofff-WBC (tweakable wide block cipher) 1.41* 2.85* 3.45* 11.29*
AES-128 in counter mode — keystream generation 0.65° 0.65° 0.81° 1.16°
AES-128 GCM (plain AE) 1.55× 1.45× 1.91× 3.31×

Authentication/encryption with Kravatte

The table below shows a summary of the performance on recent PC processors of Kravatte and the different authenticated encryption (AE) modes based on it. The figures are in cycles per byte for long messages (less is faster).

FunctionSkylakeXSkylakeHaswellSandy Bridge
Kravatte — MAC computation 0.30* 0.64* 0.72* 1.96*
Kravatte — keystream generation 0.41* 0.63* 0.68* 1.94*
Kravatte-SANE (session AE) — processing of metadata 0.30* 0.64* 0.72* 1.96*
Kravatte-SANE (session AE) — processing of plaintext 0.92* 1.50* 1.65* 4.15*
Kravatte-SANSE (session AE + SIV) 0.92* 1.50* 1.63* 4.14*
Kravatte-WBC (tweakable wide block cipher) 1.28* 2.17* 2.42* 6.19*
AES-128 in counter mode — keystream generation 0.65° 0.65° 0.81° 1.16°
AES-128 GCM (plain AE) 1.55× 1.45× 1.91× 3.31×

Authenticated encryption with Keyak

The following table shows a summary of the performance on recent PC processors of the Keyak family of authenticated encryption (AE) schemes. The figures are in cycles per byte for long messages (less is faster).

Every entry contains a range given in the form a-b. The first number a indicates the speed when processing blocks containing only metadata, while the second number b is when processing blocks containing only plaintext. For blocks containing both metadata and plaintext, the speed is somewhere in between (not shown in this table).

FunctionSkylakeXSkylakeHaswellSandy Bridge
River Keyak 7.68-11.25* 7.62-11.10* 7.86-11.61* 10.41-15.48*
Lake Keyak 2.31-2.80* 3.09-3.82* 3.47-4.20* 4.56-5.78*
Sea Keyak 1.61-2.06* 2.22-2.85* 2.39-2.95* 2.52-3.13*
Ocean Keyak 0.89-1.20* 1.22-1.63* 1.26-1.64* 2.55-3.16*
Lunar Keyak 0.53-0.82* 1.24-1.66* 1.27-1.69* 2.55-3.23*

References

The performance measurements in a column were taken consistently on the same machine, with Turbo Boost disabled wherever applicable. More details:

  • Sandy Bridge: Intel® Core™ i5-2400 @ 3.10GHz
  • Haswell: Intel® Core™ i5-4570 CPU @ 3.20GHz
  • Skylake: Intel® Core™ i5-6500 CPU @ 3.20GHz
  • SkylakeX: Intel® Core™ i7-7800X CPU @ 3.50GHz

The measured implementations come from

We always show the fastest implementation found.