Performance on 32-bit platforms

Table of Contents

• Introduction
• Performance on ARM Cortex M3
• Performance on ESP32
• Overall group rankings

Note

The 10 finalists of the NIST lightweight cryptography competition were announced in March 2021. I have forked this repository to create a new repository for the finalists and further improvements. This repository is now archived. New performance figures for the finalists can be found here.

NIST set a cut-off of 18 Septeber 2020 for status updates from the Round 2 candidate submission teams, leading up to the selection of Round 2 finalists in December 2020. All of my implementations prior to that date were in C.

Since that date, some newer implementations have been contributed by others and written by myself. The performance of the newer versions compared with the baseline versions can be found on the Phase 2 Performance Figures page. The tables on this page have been updated to reflect the latest figures.

The figures for the original baseline versions are now found on a separate page.

Introduction

There is a lot of variation in the capabilities of embedded microprocessors. Some are superscalar; others are not. Some have specialised vector instructions; others do not. Clock speeds can also vary considerably. All this means that "cycles per byte" or "megabytes per second" are pretty meaningless when trying to rank the algorithms on relative performance on any given microprocessor.

The approach I take here is "ChaChaPoly Units". The library contains a reasonably efficient 32-bit non-vectorized implementation of the ChaChaPoly AEAD scheme from my Arduino cryptography library. This makes it a known quanitity to compare with other algorithms side by side.

If an algorithm is measured at 0.8 ChaChaPoly Units on a specific embedded microprocessor at a specific clock speed, then that means that it is slower than ChaChaPoly by a factor of 0.8 on that microprocessor. If the algorithm is instead measured at 2 ChaChaPoly Units, then it is twice as fast as ChaChaPoly on the same microprocessor. The higher the number of units, the better the algorithm.

The number of ChaChaPoly Units for each algorithm will vary for each microprocessor that is tested and for different choices of optimisation options. The figures below should be used as a rough guide to the relative performance of the algorithms, not an absolute measurement.

For hash algorithms we use BLAKE2s as the basic unit. BLAKE2s is based on ChaCha20 so it is the most logical hashing counterpart to ChaChaPoly.

This page details the performance results for 32-bit platforms. A separate page that details preliminary results for the 8-bit AVR platform can be found here.

The masking performance page contains comparisons of masked versions of the algorithms with their baseline versions.

Performance on ARM Cortex M3

All tests were run on an Arduino Due which is an ARM Cortex M3 running at 84MHz. The code was optimised for size rather than speed, which is the default optimisation option for the Arduino IDE. I found that "-Os" size optimisation often did better on the Due than "-O2" or "-O3" with the compiler that I had. Your own results may vary.

Each algorithm was tested with two packet sizes: 128 and 16 bytes. Some algorithms can have better performance on small packet sizes. The associated data is always zero-length.

The value in the table below indicates the number of times faster than ChaChaPoly on the same packet. Higher numbers mean better performance. The table is ordered from best average performance down.

Where a NIST submission contains multiple algorithms in a family, bold italics indicates the primary algorithm in the family.

An asterisk (*) indicates algorithms that have been accelerated with assembly code.

Algorithm	Key Bits	Nonce Bits	Tag Bits	Encrypt 128 bytes	Decrypt 128 bytes	Encrypt 16 bytes	Decrypt 16 bytes	Average
COMET-128_CHAM-128/1282 (*)	128	128	128	1.57	1.56	2.91	2.69	2.05
Schwaemm128-128 (SPARKLE) (*)	128	128	128	1.60	1.58	2.84	2.39	2.01
COMET-64_SPECK-64/128 (*)	128	120	128	1.42	1.43	2.86	2.75	1.94
Schwaemm256-128 (SPARKLE) (*)	128	256	128	1.74	1.63	1.90	1.93	1.80
ASCON-128a (*)	128	128	128	1.86	1.70	1.80	1.78	1.78
SATURNIN-Short1	256	128	256			1.82	1.66	1.73
Schwaemm192-192 (SPARKLE) (*)	192	192	192	1.47	1.50	1.98	1.81	1.68
Xoodyak (*)	128	128	128	1.66	1.51	1.73	1.60	1.62
ASCON-128 (*)	128	128	128	1.54	1.44	1.78	1.68	1.61
ASCON-80pq (*)	160	128	128	1.52	1.43	1.71	1.65	1.57
TinyJAMBU-128 (*)	128	96	64	0.93	0.95	1.63	1.61	1.21
GIMLI-24 (*)	256	128	128	1.08	1.09	1.29	1.28	1.18
Schwaemm256-256 (SPARKLE) (*)	256	256	256	1.18	1.16	1.15	1.09	1.14
GIFT-COFB (*)	128	128	128	1.01	1.01	1.16	1.15	1.08
TinyJAMBU-192 (*)	192	96	64	0.81	0.84	1.45	1.44	1.08
COMET-64_CHAM-64/128 (*)	128	120	128	0.70	0.75	1.35	1.37	0.97
TinyJAMBU-256 (*)	256	96	64	0.70	0.73	1.28	1.29	0.94
Spook-128-384-su	128	128	128	0.78	0.79	1.11	1.09	0.93
Spook-128-384-mu	128	128	128	0.78	0.79	1.10	1.09	0.93
Spook-128-512-su	256	128	128	0.92	0.93	0.88	0.89	0.90
Spook-128-512-mu	256	128	128	0.92	0.93	0.88	0.88	0.90
SpoC-128	128	128	128	0.59	0.62	1.14	1.14	0.82
HYENA (*)	128	96	128	0.68	0.74	0.87	0.88	0.80
DryGASCON128k16 (*)	128	128	128	0.59	0.62	1.03	1.02	0.78
SUNDAE-GIFT-0 (*)	128	0	128	0.57	0.61	1.04	1.05	0.78
Pyjamask-96-AEAD	128	64	96	0.66	0.67	0.81	0.83	0.74
ESTATE_TweGIFT-1282 (*)	128	128	128	0.53	0.57	1.04	1.04	0.74
Pyjamask-128-AEAD	128	96	128	0.67	0.63	0.80	0.79	0.72
SUNDAE-GIFT-64 (*)	128	64	128	0.54	0.58	0.84	0.86	0.69
SUNDAE-GIFT-96 (*)	128	96	128	0.54	0.58	0.83	0.85	0.69
SUNDAE-GIFT-128 (*)	128	128	128	0.54	0.58	0.81	0.83	0.68
SATURNIN-CTR-Cascade	256	128	256	0.39	0.42	0.42	0.44	0.42
SPIX	128	128	128	0.41	0.44	0.38	0.39	0.40
LOTUS-AEAD	128	128	64	0.29	0.31	0.56	0.58	0.40
LOCUS-AEAD	128	128	64	0.28	0.29	0.56	0.57	0.39
KNOT-AEAD-128-256	128	128	128	0.29	0.31	0.47	0.49	0.38
Grain-128AEAD	128	96	64	0.26	0.26	0.56	0.56	0.37
KNOT-AEAD-128-384	128	128	128	0.31	0.33	0.30	0.32	0.31
SpoC-64	128	128	64	0.22	0.24	0.42	0.44	0.31
SKINNY-AEAD-M6	128	96	64	0.19	0.20	0.33	0.34	0.25
SKINNY-AEAD-M5	128	96	128	0.19	0.20	0.33	0.34	0.25
Romulus-N3	128	96	128	0.19	0.20	0.30	0.31	0.24
ACE	128	128	128	0.20	0.22	0.23	0.24	0.22
SKINNY-AEAD-M4	128	96	64	0.16	0.17	0.26	0.27	0.21
SKINNY-AEAD-M3	128	128	64	0.16	0.17	0.26	0.27	0.21
SKINNY-AEAD-M2	128	96	128	0.16	0.17	0.26	0.27	0.21
SKINNY-AEAD-M1	128	128	128	0.16	0.17	0.26	0.27	0.21
Romulus-N2	128	96	128	0.15	0.17	0.23	0.24	0.19
Romulus-N1	128	128	128	0.15	0.17	0.21	0.22	0.19
ISAP-A-128A (*)	128	128	128	0.24	0.26	0.13	0.14	0.18
KNOT-AEAD-192-384	192	192	192	0.15	0.17	0.21	0.22	0.18
DryGASCON256k32	256	128	256	0.13	0.14	0.19	0.20	0.16
Oribatida-256-64	128	128	128	0.12	0.13	0.22	0.23	0.16
Romulus-M3	128	96	128	0.12	0.13	0.20	0.22	0.16
Subterranean	128	128	128	0.16	0.18	0.13	0.14	0.15
PAEF-ForkSkinny-128-256	128	112	128	0.10	0.09	0.32	0.28	0.15
PAEF-ForkSkinny-128-192	128	48	128	0.10	0.09	0.32	0.28	0.15
SAEF-ForkSkinny-128-256	128	120	128	0.10	0.09	0.32	0.28	0.15
SAEF-ForkSkinny-128-192	128	56	128	0.10	0.09	0.32	0.28	0.15
Romulus-M2	128	96	128	0.10	0.11	0.17	0.18	0.14
Romulus-M1	128	128	128	0.10	0.11	0.15	0.16	0.13
KNOT-AEAD-256-512	256	256	256	0.10	0.12	0.12	0.13	0.12
ORANGE-Zest	128	128	128	0.11	0.12	0.11	0.12	0.11
PAEF-ForkSkinny-128-288	128	104	128	0.07	0.06	0.24	0.20	0.11
Oribatida-192-96	128	64	96	0.07	0.08	0.12	0.13	0.10
PHOTON-Beetle-AEAD-ENC-128	128	128	128	0.06	0.07	0.11	0.12	0.08
PAEF-ForkSkinny-64-192	128	48	64	0.05	0.05	0.18	0.14	0.08
ISAP-A-128 (*)	128	128	128	0.08	0.08	0.03	0.04	0.05
Delirium (Elephant)	128	96	128	0.04	0.05	0.06	0.07	0.05
WAGE	128	128	128	0.03	0.03	0.03	0.03	0.03
PHOTON-Beetle-AEAD-ENC-32	128	128	128	0.02	0.02	0.05	0.05	0.03
ISAP-K-128A	128	128	128	0.02	0.02	0.01	0.01	0.02
Dumbo (Elephant)	128	96	64	0.01	0.02	0.03	0.03	0.02
Jumbo (Elephant)	128	96	64	0.01	0.02	0.02	0.02	0.02
ISAP-K-128	128	128	128	0.0034	0.0038	0.0015	0.0016	0.0021

Note 1. SATURNIN-Short is limited to no more than 15 bytes of payload, so there are no performance figures for 128-byte packets, and the 16-byte columns report the results for 15 bytes of payload instead.

Note 2. COMET-128_CHAM-128/128 and ESTATE_TweGIFT-128 are not the primary members from the algorithm authors. Instead, the authors recommend AES-based versions of COMET and ESTATE, which are not implemented in this libary.

The hash algorithms are compared against BLAKE2s instead of ChaChaPoly:

Algorithm	Hash Bits	1024 bytes	128 bytes	16 bytes	Average
Esch256 (SPARKLE) (*)	256	0.89	0.78	1.50	1.06
Xoodyak (*)	256	0.71	0.65	1.43	0.93
GIMLI-24-HASH (*)	256	0.54	0.47	0.86	0.62
ASCON-HASH (*)	256	0.51	0.41	0.63	0.52
DryGASCON128-HASH (*)	256	0.29	0.29	0.88	0.48
Esch384 (SPARKLE) (*)	384	0.45	0.37	1.50	0.47
SATURNIN-Hash	256	0.28	0.23	0.57	0.36
ACE-HASH	256	0.10	0.09	0.15	0.11
DryGASCON256-HASH	512	0.06	0.05	0.11	0.08
KNOT-HASH-256-384	256	0.05	0.04	0.07	0.05
KNOT-HASH-256-256	256	0.03	0.03	0.08	0.04
Subterranean-Hash	256	0.02	0.02	0.05	0.03
ORANGISH	256	0.02	0.02	0.03	0.02
KNOT-HASH-384-384	384	0.01	0.01	0.04	0.02
PHOTON-Beetle-HASH	256	0.01	0.01	0.05	0.02
SKINNY-tk3-HASH	256	0.02	0.01	0.02	0.02
KNOT-HASH-512-512	512	0.01	0.01	0.02	0.01
SKINNY-tk2-HASH	256	0.01	0.01	0.02	0.01

Performance on ESP32

The tests below were run on an ESP32 Dev Module running at 240MHz. The ordering is mostly the same as ARM Cortext M3 with a few reversals where the architectural differences gives some algorithms an added advantage.

Algorithm	Key Bits	Nonce Bits	Tag Bits	Encrypt 128 bytes	Decrypt 128 bytes	Encrypt 16 bytes	Decrypt 16 bytes	Average
SATURNIN-Short	256	128	256			1.62	1.63	1.62
COMET-128_CHAM-128/128	128	128	128	1.17	1.11	1.88	1.73	1.43
COMET-64_SPECK-64/128	128	120	128	1.02	1.02	2.04	1.94	1.39
Schwaemm128-128 (SPARKLE)	128	128	128	1.07	1.06	1.68	1.60	1.32
Schwaemm256-128 (SPARKLE)	128	256	128	1.11	1.09	1.04	1.04	1.06
Schwaemm192-192 (SPARKLE)	192	192	192	0.87	0.90	1.02	1.00	0.95
ASCON-128a	128	128	128	0.86	0.88	0.92	0.93	0.90
GIFT-COFB	128	128	128	0.80	0.83	0.90	0.90	0.86
Xoodyak	128	128	128	0.84	0.86	0.80	0.82	0.83
TinyJAMBU-128	128	96	64	0.60	0.64	1.16	1.15	0.83
TinyJAMBU-192	192	96	64	0.54	0.58	1.06	1.06	0.75
GIMLI-24	256	128	128	0.65	0.69	0.79	0.81	0.74
Schwaemm256-256 (SPARKLE)	256	256	256	0.77	0.78	0.70	0.70	0.73
Spook-128-384-su	128	128	128	0.58	0.62	0.80	0.81	0.70
Spook-128-384-mu	128	128	128	0.58	0.62	0.80	0.80	0.70
Spook-128-512-su	256	128	128	0.71	0.74	0.63	0.65	0.68
Spook-128-512-mu	256	128	128	0.71	0.74	0.63	0.65	0.67
TinyJAMBU-256	256	96	64	0.47	0.51	0.94	0.95	0.67
HYENA	128	96	128	0.55	0.60	0.70	0.72	0.64
SUNDAE-GIFT-0	128	0	128	0.47	0.52	0.85	0.87	0.64
ASCON-128	128	128	128	0.67	0.46	0.86	0.66	0.63
ASCON-80pq	160	128	128	0.67	0.44	0.84	0.61	0.61
COMET-64_CHAM-64/128	128	120	128	0.42	0.46	0.82	0.84	0.59
KNOT-AEAD-128-384	128	128	128	0.57	0.61	0.57	0.59	0.59
KNOT-AEAD-128-256	128	128	128	0.45	0.49	0.73	0.75	0.59
SUNDAE-GIFT-64	128	64	128	0.44	0.49	0.69	0.71	0.57
SUNDAE-GIFT-96	128	96	128	0.44	0.49	0.68	0.70	0.57
SUNDAE-GIFT-128	128	128	128	0.44	0.49	0.67	0.70	0.57
SpoC-128	128	128	128	0.40	0.44	0.77	0.78	0.56
ESTATE_TweGIFT-128	128	128	128	0.38	0.42	0.74	0.76	0.54
Pyjamask-96-AEAD	128	64	96	0.46	0.49	0.54	0.56	0.51
Pyjamask-128-AEAD	128	96	128	0.44	0.46	0.51	0.52	0.48
Grain-128AEAD	128	96	64	0.33	0.30	0.65	0.59	0.43
SATURNIN-CTR-Cascade	256	128	256	0.34	0.37	0.38	0.39	0.37
DryGASCON128k16	128	128	128	0.23	0.25	0.40	0.42	0.31
SpoC-64	128	128	64	0.22	0.25	0.41	0.43	0.31
LOTUS-AEAD	128	128	64	0.20	0.22	0.40	0.42	0.29
LOCUS-AEAD	128	128	64	0.19	0.22	0.39	0.41	0.28
SPIX	128	128	128	0.27	0.30	0.24	0.26	0.26
KNOT-AEAD-192-384	192	192	192	0.28	0.32	0.39	0.41	0.25
Oribatida-256-64	128	128	128	0.17	0.19	0.34	0.35	0.25
Oribatida-192-96	128	64	96	0.17	0.19	0.28	0.30	0.22
KNOT-AEAD-256-512	256	256	256	0.18	0.21	0.21	0.23	0.21
DryGASCON256k32	256	128	256	0.16	0.18	0.25	0.27	0.21
ACE	128	128	128	0.13	0.15	0.15	0.16	0.15
SKINNY-AEAD-M6	128	96	64	0.11	0.12	0.19	0.20	0.15
SKINNY-AEAD-M5	128	96	128	0.11	0.12	0.19	0.20	0.15
Romulus-N3	128	96	128	0.10	0.12	0.17	0.19	0.14
SKINNY-AEAD-M4	128	96	64	0.09	0.10	0.15	0.16	0.12
SKINNY-AEAD-M3	128	128	64	0.09	0.10	0.14	0.16	0.12
SKINNY-AEAD-M2	128	96	128	0.09	0.10	0.14	0.15	0.12
SKINNY-AEAD-M1	128	128	128	0.09	0.10	0.14	0.15	0.12
Subterranean	128	128	128	0.12	0.14	0.10	0.11	0.12
Romulus-N2	128	96	128	0.09	1.10	0.13	0.14	0.11
Romulus-N1	128	128	128	0.09	0.10	0.12	0.13	0.11
ISAP-A-128A	128	128	128	0.13	0.15	0.08	0.09	0.10
ORANGE-Zest	128	128	128	0.09	0.11	0.10	0.11	0.10
PAEF-ForkSkinny-128-256	128	112	128	0.06	0.07	0.21	0.20	0.10
SAEF-ForkSkinny-128-256	128	120	128	0.06	0.06	0.21	0.20	0.10
PAEF-ForkSkinny-128-192	128	48	128	0.06	0.07	0.21	0.20	0.10
SAEF-ForkSkinny-128-192	128	56	128	0.06	0.06	0.21	0.20	0.10
Romulus-M3	128	96	128	0.07	0.08	0.12	0.13	0.09
Romulus-M2	128	96	128	0.06	0.07	0.09	0.10	0.08
Romulus-M1	128	128	128	0.06	0.07	0.09	0.10	0.08
PHOTON-Beetle-AEAD-ENC-128	128	128	128	0.05	0.06	0.10	0.11	0.08
PAEF-ForkSkinny-128-288	128	104	128	0.05	0.05	0.16	0.14	0.08
PAEF-ForkSkinny-64-192	128	48	64	0.04	0.04	0.14	0.12	0.07
Delirium (Elephant)	128	96	128	0.05	0.06	0.07	0.08	0.06
WAGE	128	128	128	0.03	0.04	0.04	0.04	0.04
ISAP-K-128A	128	128	128	0.03	0.03	0.02	0.02	0.02
ISAP-A-128	128	128	128	0.03	0.03	0.01	0.02	0.02
PHOTON-Beetle-AEAD-ENC-32	128	128	128	0.01	0.02	0.04	0.04	0.02
Dumbo (Elephant)	128	96	64	0.01	0.01	0.02	0.02	0.02
Jumbo (Elephant)	128	96	64	0.01	0.01	0.01	0.02	0.01
ISAP-K-128	128	128	128	0.0040	0.0047	0.0018	0.0020	0.0025

Hash algorithms:

Algorithm	Hash Bits	1024 bytes	128 bytes	16 bytes	Average
Xoodyak	256	0.35	0.33	0.73	0.47
Esch256 (SPARKLE)	256	0.38	0.34	0.64	0.45
GIMLI-24-HASH	256	0.35	0.29	0.50	0.38
SATURNIN-Hash	256	0.23	0.19	0.48	0.30
Esch384 (SPARKLE)	384	0.24	0.20	0.30	0.25
ASCON-HASH	256	0.19	0.16	0.25	0.20
DryGASCON128-HASH	256	0.10	0.10	0.34	0.18
KNOT-HASH-256-384	256	0.09	0.07	0.13	0.10
DryGASCON256-HASH	512	0.08	0.07	0.15	0.10
ACE-HASH	256	0.07	0.06	0.10	0.07
KNOT-HASH-256-256	256	0.04	0.04	0.13	0.07
KNOT-HASH-384-384	384	0.03	0.03	0.07	0.04
SKINNY-tk3-HASH	256	0.07	0.01	0.01	0.03
SKINNY-tk2-HASH	256	0.05	0.03	0.01	0.03
ORANGISH	256	0.02	0.02	0.03	0.02
KNOT-HASH-512-512	512	0.02	0.02	0.04	0.02
PHOTON-Beetle-HASH	256	0.01	0.01	0.05	0.02
Subterranean-Hash	256	0.01	0.01	0.04	0.02

Overall group rankings

Based on the above data, the NIST submissions can be roughly grouped with those of similar performance. Changes in CPU, optimisation options, loop unrolling, or assembly code replacement might modify the rank of an algorithm.

Only the primary algorithm in each family is considered for this ranking. I took the average of the ARM Cortex M3 and ESP32 figures from the above tables to compute an average across different architectures. I then grouped the algorithms into 0.1-wide buckets; for example everything with rank 3 has an average between 0.30 and 0.39 ChaChaPoly units.

AEAD algorithm rankings:

Rank	Algorithms
17	COMET
14	SPARKLE
12	Xoodyak
11	ASCON
10	TinyJAMBU
9	GIFT-COFB, Gimli
7	HYENA, Spook
6	ESTATE, Pyjamask, SUNDAE-GIFT
5	DryGASCON
4	Grain128-AEAD, KNOT
3	LOTUS, Saturnin, SPIX, SpoC
2	Oribatida
1	ACE, ORANGE, Romulus, SKINNY-AEAD, Subterranean
0	Elephant, ForkAE, ISAP, PHOTON-Beetle, WAGE

Hash algorithm rankings:

Rank	Algorithms
7	SPARKLE, Xoodyak
5	Gimli
3	ASCON, DryGASCON, Saturnin
0	ACE, KNOT, ORANGE, PHOTON-Beetle, SKINNY-AEAD, Subterranean