Team Keccak

Guido Bertoni³, Joan Daemen², Seth Hoffert, Michaël Peeters¹, Gilles Van Assche¹ and Ronny Van Keer¹
¹STMicroelectronics - ²Radboud University - ³Security Pattern

Software performance figures

Hashing

The table below shows a summary of the performance on recent PC processors of Keccak, including the most representative instances from FIPS 202 and SP 800-185, of KangarooTwelve and of the traditional hash functions MD5, SHA-1 and SHA-2. The figures are in cycles per byte for long messages (less is faster).

Function	SkylakeX	Skylake	Haswell	Sandy Bridge
KangarooTwelve	0.51^*	1.38^*	1.41^*	2.91^*
ParallelHash128	1.04^*	2.65^*	2.73^*	5.63^*
ParallelHash256	1.35^*	3.31^*	3.41^*	7.15^*
SHAKE128	4.43^*	6.24^*	7.09^*	8.81^*
SHAKE256	5.49^*	7.70^*	8.75^*	10.87^*
SHA3-512	11.00^*	14.83^*	16.68^*	20.46^*
MD5	4.95⁺	4.97⁺	4.94⁺	5.40⁺
SHA-1	3.50⁺	3.48⁺	4.15⁺	4.92⁺
SHA-256	7.64⁺	7.59⁺	9.27⁺	11.45⁺
SHA-512	5.12⁺	5.05⁺	6.54⁺	7.95⁺

Authentication/encryption with Xoofff

The table below shows a summary of the performance on recent PC processors of Xoofff and the different authenticated encryption (AE) modes based on it. The figures are in cycles per byte for long messages (less is faster).

Function	SkylakeX	Skylake	Haswell	Sandy Bridge
Xoofff — MAC computation	0.40^*	0.91^*	1.19^*	3.75^*
Xoofff — keystream generation	0.51^*	0.94^*	0.98^*	3.56^*
Xoofff-SANE (session AE) — processing of metadata	0.40^*	0.90^*	1.18^*	3.73^*
Xoofff-SANE (session AE) — processing of plaintext	0.93^*	1.89^*	2.20^*	7.47^*
Xoofff-SANSE (session AE + SIV)	0.93^*	1.89^*	2.20^*	7.46^*
Xoofff-WBC (tweakable wide block cipher)	1.41^*	2.85^*	3.45^*	11.29^*
AES-128 in counter mode — keystream generation	0.65^°	0.65^°	0.81^°	1.16^°
AES-128 GCM (plain AE)	1.55^×	1.45^×	1.91^×	3.31^×

Authentication/encryption with Kravatte

The table below shows a summary of the performance on recent PC processors of Kravatte and the different authenticated encryption (AE) modes based on it. The figures are in cycles per byte for long messages (less is faster).

Function	SkylakeX	Skylake	Haswell	Sandy Bridge
Kravatte — MAC computation	0.30^*	0.64^*	0.72^*	1.96^*
Kravatte — keystream generation	0.41^*	0.63^*	0.68^*	1.94^*
Kravatte-SANE (session AE) — processing of metadata	0.30^*	0.64^*	0.72^*	1.96^*
Kravatte-SANE (session AE) — processing of plaintext	0.92^*	1.50^*	1.65^*	4.15^*
Kravatte-SANSE (session AE + SIV)	0.92^*	1.50^*	1.63^*	4.14^*
Kravatte-WBC (tweakable wide block cipher)	1.28^*	2.17^*	2.42^*	6.19^*
AES-128 in counter mode — keystream generation	0.65^°	0.65^°	0.81^°	1.16^°
AES-128 GCM (plain AE)	1.55^×	1.45^×	1.91^×	3.31^×

Authenticated encryption with Keyak

The following table shows a summary of the performance on recent PC processors of the Keyak family of authenticated encryption (AE) schemes. The figures are in cycles per byte for long messages (less is faster).

Every entry contains a range given in the form a-b. The first number a indicates the speed when processing blocks containing only metadata, while the second number b is when processing blocks containing only plaintext. For blocks containing both metadata and plaintext, the speed is somewhere in between (not shown in this table).

Function	SkylakeX	Skylake	Haswell	Sandy Bridge
River Keyak	7.68-11.25^*	7.62-11.10^*	7.86-11.61^*	10.41-15.48^*
Lake Keyak	2.31-2.80^*	3.09-3.82^*	3.47-4.20^*	4.56-5.78^*
Sea Keyak	1.61-2.06^*	2.22-2.85^*	2.39-2.95^*	2.52-3.13^*
Ocean Keyak	0.89-1.20^*	1.22-1.63^*	1.26-1.64^*	2.55-3.16^*
Lunar Keyak	0.53-0.82^*	1.24-1.66^*	1.27-1.69^*	2.55-3.23^*

References

The performance measurements in a column were taken consistently on the same machine, with Turbo Boost disabled wherever applicable. More details:

Sandy Bridge: Intel® Core™ i5-2400 @ 3.10GHz
Haswell: Intel® Core™ i5-4570 CPU @ 3.20GHz
Skylake: Intel® Core™ i5-6500 CPU @ 3.20GHz
SkylakeX: Intel® Core™ i7-7800X CPU @ 3.50GHz

The measured implementations come from

^*the extended Keccak code package,
⁺OpenSSL,
^°Crypto++,
^×an implementation by Romain Dolbeau in SUPERCOP.

We always show the fastest implementation found.