Additional digital signature schemes (On-ramp)
NIST's call for additional post-quantum signature schemes, to diversify beyond lattice-based signatures, with interest in short signatures and fast verification. Use the stage toggle to see each round's entrants as submitted, or every entrant at its latest specification.
- Organiser
- NIST, Gaithersburg
- Region
- United States
- Stage
- Round 3, since 14 May 2026
- Signatures
- 9 candidates (official) · 41 entrants across all rounds in our data
Timeline
Call for proposals
Submissions closed
Round 1: 40 candidates
Round 2: 14 candidates
Round 3: 9 candidates
Current ·
Security levels
NIST defines five security categories by comparison with attacks on AES and SHA-2/SHA-3. Each parameter set claims a category. This site shows each scheme on its own programme's scale and does not convert between scales.
| Category | At least as hard to break as |
|---|---|
| 1 | Key search on AES-128 |
| 2 | Collision search on SHA-256 / SHA3-256 |
| 3 | Key search on AES-192 |
| 4 | Collision search on SHA-384 / SHA3-384 |
| 5 | Key search on AES-256 |
Candidates
Signatures (41)
pk size vs. sig size (log–log scale)
Scroll to zoom · drag to pan· tap a point for details
| Programmes | Assumption | |||||||||
|---|---|---|---|---|---|---|---|---|---|---|
| 3WISE | Multivariate | On-ramp R1 | 256 | 5 | 2,860,000 | 64 | 2,860,064 | 93.0 µs | 15.33 ms | Cubic Degree |
| 3WISE | Multivariate | On-ramp R1 | 192 | 4 | 918,750 | 48 | 918,798 | 60.0 µs | 5.22 ms | Cubic Degree |
| 3WISE | Multivariate | On-ramp R1 | 128 | 2 | 187,000 | 32 | 187,032 | 38.0 µs | 1.11 ms | Cubic Degree |
| AIMer | Symmetric | KpqC selectedOn-ramp R1 | AIMer-128f | 1 | 32 | 6,944 | 6,976 | 1.18 ms | 1.07 ms | AIM |
| AIMer | Symmetric | KpqC selectedOn-ramp R1 | AIMer-128s | 1 | 32 | 4,704 | 4,736 | 9.14 ms | 9.10 ms | AIM |
| AIMer | Symmetric | KpqC selectedOn-ramp R1 | AIMer-192f | 3 | 48 | 15,408 | 15,456 | 3.81 ms | 3.53 ms | AIM |
| AIMer | Symmetric | KpqC selectedOn-ramp R1 | AIMer-192s | 3 | 48 | 10,320 | 10,368 | 29.08 ms | 29.12 ms | AIM |
| AIMer | Symmetric | KpqC selectedOn-ramp R1 | AIMer-256f | 5 | 64 | 31,360 | 31,424 | 8.00 ms | 7.07 ms | AIM |
| AIMer | Symmetric | KpqC selectedOn-ramp R1 | AIMer-256s | 5 | 64 | 20,224 | 20,288 | 59.58 ms | 57.06 ms | AIM |
| ALTEQ | Other | On-ramp R1 | Balanced-V | 5 | 73,632 | 122,336 | 195,968 | 23.88 ms(estimated from 59.7M cycles @ 2.5 GHz) | 41.39 ms(estimated from 103.5M cycles @ 2.5 GHz) | Alternating Trilinear Form Equiv. |
| ALTEQ | Other | On-ramp R1 | Balanced-III | 3 | 31,944 | 49,000 | 80,944 | 14.58 ms(estimated from 36.5M cycles @ 2.5 GHz) | 18.42 ms(estimated from 46.1M cycles @ 2.5 GHz) | Alternating Trilinear Form Equiv. |
| ALTEQ | Other | On-ramp R1 | ShortSig-V | 5 | 2,088,432 | 63,908 | 2,152,340 | 12.22 ms(estimated from 30.6M cycles @ 2.5 GHz) | 20.14 ms(estimated from 50.4M cycles @ 2.5 GHz) | Alternating Trilinear Form Equiv. |
| ALTEQ | Other | On-ramp R1 | ShortSig-III | 3 | 1,044,264 | 32,504 | 1,076,768 | 3.13 ms(estimated from 7.8M cycles @ 2.5 GHz) | 5.84 ms(estimated from 14.6M cycles @ 2.5 GHz) | Alternating Trilinear Form Equiv. |
| ALTEQ | Other | On-ramp R1 | Balanced-I | 1 | 8,024 | 15,896 | 23,920 | 1.14 ms(estimated from 2.8M cycles @ 2.5 GHz) | 1.69 ms(estimated from 4.2M cycles @ 2.5 GHz) | Alternating Trilinear Form Equiv. |
| ALTEQ | Other | On-ramp R1 | ShortSig-I | 1 | 523,968 | 9,528 | 533,496 | 290.4 µs(estimated from 726K cycles @ 2.5 GHz) | 706.7 µs(estimated from 1.8M cycles @ 2.5 GHz) | Alternating Trilinear Form Equiv. |
| Ascon-Sign | Symmetric | On-ramp R1 | 192s robust | 3 | 48 | 16,224 | 16,272 | 3.56 s(estimated from 8.89G cycles @ 2.5 GHz) | 3.07 ms(estimated from 7.7M cycles @ 2.5 GHz) | Hash-based |
| Ascon-Sign | Symmetric | On-ramp R1 | 192s simple | 3 | 48 | 16,224 | 16,272 | 2.02 s(estimated from 5.05G cycles @ 2.5 GHz) | 1.74 ms(estimated from 4.4M cycles @ 2.5 GHz) | Hash-based |
| Ascon-Sign | Symmetric | On-ramp R1 | 128s robust | 1 | 32 | 7,856 | 7,888 | 1.62 s(estimated from 4.04G cycles @ 2.5 GHz) | 1.69 ms(estimated from 4.2M cycles @ 2.5 GHz) | Hash-based |
| Ascon-Sign | Symmetric | On-ramp R1 | 128s simple | 1 | 32 | 7,856 | 7,888 | 889.75 ms(estimated from 2.22G cycles @ 2.5 GHz) | 855.1 µs(estimated from 2.1M cycles @ 2.5 GHz) | Hash-based |
| Ascon-Sign | Symmetric | On-ramp R1 | 192f robust | 3 | 48 | 35,664 | 35,712 | 152.69 ms(estimated from 381.7M cycles @ 2.5 GHz) | 8.56 ms(estimated from 21.4M cycles @ 2.5 GHz) | Hash-based |
| Ascon-Sign | Symmetric | On-ramp R1 | 192f simple | 3 | 48 | 35,664 | 35,712 | 90.48 ms(estimated from 226.2M cycles @ 2.5 GHz) | 4.93 ms(estimated from 12.3M cycles @ 2.5 GHz) | Hash-based |
| Ascon-Sign | Symmetric | On-ramp R1 | 128f robust | 1 | 32 | 17,088 | 17,120 | 73.04 ms(estimated from 182.6M cycles @ 2.5 GHz) | 4.51 ms(estimated from 11.3M cycles @ 2.5 GHz) | Hash-based |
| Ascon-Sign | Symmetric | On-ramp R1 | 128f simple | 1 | 32 | 17,088 | 17,120 | 42.81 ms(estimated from 107.0M cycles @ 2.5 GHz) | 2.61 ms(estimated from 6.5M cycles @ 2.5 GHz) | Hash-based |
| Biscuit | Multivariate | On-ramp R1 | 256s | 5 | 93 | 20,192 | 20,285 | 516.44 ms(estimated from 1.29G cycles @ 2.5 GHz) | 509.83 ms(estimated from 1.27G cycles @ 2.5 GHz) | Multivariate (Structured) |
| Biscuit | Multivariate | On-ramp R1 | 192s | 3 | 69 | 11,349 | 11,418 | 289.79 ms(estimated from 724.5M cycles @ 2.5 GHz) | 285.98 ms(estimated from 714.9M cycles @ 2.5 GHz) | Multivariate (Structured) |
| Biscuit | Multivariate | On-ramp R1 | 256f | 5 | 93 | 27,348 | 27,441 | 58.84 ms(estimated from 147.1M cycles @ 2.5 GHz) | 54.94 ms(estimated from 137.4M cycles @ 2.5 GHz) | Multivariate (Structured) |
| Biscuit | Multivariate | On-ramp R1 | 192f | 3 | 69 | 15,129 | 15,198 | 32.60 ms(estimated from 81.5M cycles @ 2.5 GHz) | 30.33 ms(estimated from 75.8M cycles @ 2.5 GHz) | Multivariate (Structured) |
| Biscuit | Multivariate | On-ramp R1 | 128s | 1 | 50 | 4,758 | 4,808 | 32.22 ms(estimated from 80.6M cycles @ 2.5 GHz) | 31.56 ms(estimated from 78.9M cycles @ 2.5 GHz) | Multivariate (Structured) |
| Biscuit | Multivariate | On-ramp R1 | 128f | 1 | 50 | 6,726 | 6,776 | 3.86 ms(estimated from 9.7M cycles @ 2.5 GHz) | 3.49 ms(estimated from 8.7M cycles @ 2.5 GHz) | Multivariate (Structured) |
| CROSS | Code-based | On-ramp R2 | R-SDP 1 fast | 1 | 77 | 18,432 | 18,509 | 331.2 µs | 211.1 µs | Restricted Synd. Dec. |
| CROSS | Code-based | On-ramp R2 | R-SDP 1 balanced | 1 | 77 | 13,152 | 13,229 | 556.4 µs | 394.2 µs | Restricted Synd. Dec. |
| CROSS | Code-based | On-ramp R2 | R-SDP 1 small | 1 | 77 | 12,432 | 12,509 | 1.10 ms | 820.5 µs | Restricted Synd. Dec. |
| CROSS | Code-based | On-ramp R2 | R-SDP(G) 1 fast | 1 | 54 | 11,980 | 12,034 | 175.7 µs | 118.3 µs | Restricted Synd. Dec. |
| CROSS | Code-based | On-ramp R2 | R-SDP(G) 1 balanced | 1 | 54 | 9,120 | 9,174 | 321.5 µs | 231.9 µs | Restricted Synd. Dec. |
| CROSS | Code-based | On-ramp R2 | R-SDP(G) 1 small | 1 | 54 | 8,960 | 9,014 | 642.5 µs | 475.1 µs | Restricted Synd. Dec. |
| CROSS | Code-based | On-ramp R2 | R-SDP 3 fast | 3 | 115 | 41,406 | 41,521 | 742.5 µs | 487.7 µs | Restricted Synd. Dec. |
| CROSS | Code-based | On-ramp R2 | R-SDP 3 balanced | 3 | 115 | 29,853 | 29,968 | 1.20 ms | 871.2 µs | Restricted Synd. Dec. |
| CROSS | Code-based | On-ramp R2 | R-SDP 3 small | 3 | 115 | 28,391 | 28,506 | 1.78 ms | 1.31 ms | Restricted Synd. Dec. |
| CROSS | Code-based | On-ramp R2 | R-SDP(G) 3 fast | 3 | 83 | 26,772 | 26,855 | 438.0 µs | 294.8 µs | Restricted Synd. Dec. |
| CROSS | Code-based | On-ramp R2 | R-SDP(G) 3 balanced | 3 | 83 | 22,464 | 22,547 | 534.1 µs | 382.5 µs | Restricted Synd. Dec. |
| CROSS | Code-based | On-ramp R2 | R-SDP(G) 3 small | 3 | 83 | 20,452 | 20,535 | 1.01 ms | 771.5 µs | Restricted Synd. Dec. |
| CROSS | Code-based | On-ramp R2 | R-SDP 5 fast | 5 | 153 | 74,590 | 74,743 | 1.36 ms | 874.3 µs | Restricted Synd. Dec. |
| CROSS | Code-based | On-ramp R2 | R-SDP 5 balanced | 5 | 153 | 53,527 | 53,680 | 2.11 ms | 1.48 ms | Restricted Synd. Dec. |
| CROSS | Code-based | On-ramp R2 | R-SDP 5 small | 5 | 153 | 50,818 | 50,971 | 3.46 ms | 2.45 ms | Restricted Synd. Dec. |
| CROSS | Code-based | On-ramp R2 | R-SDP(G) 5 fast | 5 | 106 | 48,102 | 48,208 | 749.6 µs | 480.5 µs | Restricted Synd. Dec. |
| CROSS | Code-based | On-ramp R2 | R-SDP(G) 5 balanced | 5 | 106 | 40,100 | 40,206 | 828.1 µs | 589.2 µs | Restricted Synd. Dec. |
| CROSS | Code-based | On-ramp R2 | R-SDP(G) 5 small | 5 | 106 | 36,454 | 36,560 | 1.44 ms | 1.08 ms | Restricted Synd. Dec. |
| DME-Sign | Multivariate | On-ramp R1 | 2^64 | 5 | 2,889 | 64 | 2,953 | 40.0 µs | 10.0 µs | Deterministic Trapdoor Permutation |
| DME-Sign | Multivariate | On-ramp R1 | 2^48 | 3 | 2,169 | 48 | 2,217 | 40.0 µs | 10.0 µs | Deterministic Trapdoor Permutation |
| DME-Sign | Multivariate | On-ramp R1 | 2^32 | 1 | 1,449 | 32 | 1,481 | 20.0 µs | 10.0 µs | Deterministic Trapdoor Permutation |
| EagleSign | Lattices | On-ramp R1 | Recomm I | 3 | 1,824 | 2,336 | 4,160 | 514.6 µs(estimated from 1.3M cycles @ 2.5 GHz) | 900.4 µs(estimated from 2.3M cycles @ 2.5 GHz) | MNTRU/MLWE |
| EagleSign | Lattices | On-ramp R1 | High I | 5 | 3,616 | 3,488 | 7,104 | 366.9 µs(estimated from 917K cycles @ 2.5 GHz) | 601.2 µs(estimated from 1.5M cycles @ 2.5 GHz) | MNTRU/MLWE |
| EagleSign | Lattices | On-ramp R1 | Recomm II | 3 | 3,616 | 2,464 | 6,080 | —not yet benchmarked | —not yet benchmarked | MNTRU/MLWE |
| EagleSign | Lattices | On-ramp R1 | Medium | 2 | 1,824 | 2,144 | 3,968 | —not yet benchmarked | —not yet benchmarked | MNTRU/MLWE |
| EHTv3 / EHTv4 | Lattices | On-ramp R1 | v3-5 | 5 | 349,000 | 344 | 349,344 | 305.00 ms | 3.16 ms | Lattices? |
| EHTv3 / EHTv4 | Lattices | On-ramp R1 | v3-3 | 3 | 191,600 | 255 | 191,855 | 206.00 ms | 1.78 ms | Lattices? |
| EHTv3 / EHTv4 | Lattices | On-ramp R1 | v3-1 | 1 | 83,500 | 169 | 83,669 | 75.80 ms | 820.0 µs | Lattices? |
| EHTv3 / EHTv4 | Lattices | On-ramp R1 | v4-5 | 5 | 2,630 | 857 | 3,487 | 59.30 ms | 26.20 ms | Lattices? |
| EHTv3 / EHTv4 | Lattices | On-ramp R1 | v4-1 | 1 | 1,110 | 369 | 1,479 | 9.00 ms | 3.85 ms | Lattices? |
| eMLE-Sig 2.0 | Other | On-ramp R1 | Level V | 5 | 960 | 640 | 1,600 | 46.0 µs(estimated from 115K cycles @ 2.5 GHz) | 25.2 µs(estimated from 63K cycles @ 2.5 GHz) | Embedded Multilayer Equations |
| eMLE-Sig 2.0 | Other | On-ramp R1 | Level III | 3 | 672 | 456 | 1,128 | 32.3 µs(estimated from 81K cycles @ 2.5 GHz) | 15.3 µs(estimated from 38K cycles @ 2.5 GHz) | Embedded Multilayer Equations |
| eMLE-Sig 2.0 | Other | On-ramp R1 | Level I | 1 | 416 | 280 | 696 | 21.0 µs(estimated from 53K cycles @ 2.5 GHz) | 8.7 µs(estimated from 22K cycles @ 2.5 GHz) | Embedded Multilayer Equations |
| Enhanced pqsigRM | Code-based | On-ramp R1 | 128 | 1 | 2,000,000 | 1,032 | 2,001,032 | 546.6 µs(estimated from 1.4M cycles @ 2.5 GHz) | 97.2 µs(estimated from 243K cycles @ 2.5 GHz) | Reed-Muller Codes |
| FAEST | Symmetric | On-ramp R3 | 128s | 1 | 32 | 4,066 | 4,098 | 2.94 ms | 2.57 ms | AES |
| FAEST | Symmetric | On-ramp R3 | 128f | 1 | 32 | 5,170 | 5,202 | 399.7 µs | 290.2 µs | AES |
| FAEST | Symmetric | On-ramp R3 | 192s | 3 | 48 | 9,410 | 9,458 | 11.45 ms | 9.89 ms | AES |
| FAEST | Symmetric | On-ramp R3 | 192f | 3 | 48 | 11,738 | 11,786 | 1.80 ms | 1.50 ms | AES |
| FAEST | Symmetric | On-ramp R3 | 256s | 5 | 48 | 16,626 | 16,674 | 16.04 ms | 15.69 ms | AES |
| FAEST | Symmetric | On-ramp R3 | 256f | 5 | 48 | 20,856 | 20,904 | 2.57 ms | 2.13 ms | AES |
| FuLeeca | Code-based | On-ramp R1 | V | 5 | 2,638 | 2,130 | 4,768 | 4.93 s(estimated from 12.33G cycles @ 2.5 GHz) | 1.52 ms(estimated from 3.8M cycles @ 2.5 GHz) | Code-based Lee Metric |
| FuLeeca | Code-based | On-ramp R1 | III | 3 | 1,982 | 1,620 | 3,602 | 844.46 ms(estimated from 2.11G cycles @ 2.5 GHz) | 978.8 µs(estimated from 2.4M cycles @ 2.5 GHz) | Code-based Lee Metric |
| FuLeeca | Code-based | On-ramp R1 | I | 1 | 1,318 | 1,100 | 2,418 | 738.71 ms(estimated from 1.85G cycles @ 2.5 GHz) | 504.0 µs(estimated from 1.3M cycles @ 2.5 GHz) | Code-based Lee Metric |
| HAETAE | Lattices | KpqC selectedOn-ramp R1 | HAETAE-2 | 2 | 992 | 1,474 | 2,466 | 1.45 ms | 41.1 µs | MLWE/MSIS |
| HAETAE | Lattices | KpqC selectedOn-ramp R1 | HAETAE-3 | 3 | 1,472 | 2,349 | 3,821 | 1.77 ms | 69.1 µs | MLWE/MSIS |
| HAETAE | Lattices | KpqC selectedOn-ramp R1 | HAETAE-5 | 5 | 2,080 | 2,948 | 5,028 | 2.21 ms | 82.9 µs | MLWE/MSIS |
| HAWK | Lattices | On-ramp R3 | 1024 | 5 | 2,440 | 1,221 | 3,661 | 29.9 µs | 47.7 µs | Lattice Isomorphism |
| HAWK | Lattices | On-ramp R3 | 512 | 1 | 1,024 | 555 | 1,579 | 14.8 µs | 23.6 µs | Lattice Isomorphism |
| HPPC | Multivariate | On-ramp R1 | 256 | 5 | 1,028,000 | 33 | 1,028,033 | 1.20 s | 25.10 ms | HFE |
| HPPC | Multivariate | On-ramp R1 | 192 | 4 | 434,250 | 25 | 434,275 | 1.00 s | 10.70 ms | HFE |
| HPPC | Multivariate | On-ramp R1 | 128 | 2 | 129,000 | 21 | 129,021 | 689.75 ms | 3.18 ms | HFE |
| HuFu | Lattices | On-ramp R1 | NIST-5 SHAKE | 5 | 3,573,000 | 4,520 | 3,577,520 | 8.74 ms(estimated from 21.8M cycles @ 2.5 GHz) | 5.48 ms(estimated from 13.7M cycles @ 2.5 GHz) | LWE/SIS |
| HuFu | Lattices | On-ramp R1 | NIST-3 SHAKE | 3 | 2,177,000 | 3,540 | 2,180,540 | 5.21 ms(estimated from 13.0M cycles @ 2.5 GHz) | 3.40 ms(estimated from 8.5M cycles @ 2.5 GHz) | LWE/SIS |
| HuFu | Lattices | On-ramp R1 | NIST-5 AES | 5 | 3,573,000 | 4,520 | 3,577,520 | 4.84 ms(estimated from 12.1M cycles @ 2.5 GHz) | 1.52 ms(estimated from 3.8M cycles @ 2.5 GHz) | LWE/SIS |
| HuFu | Lattices | On-ramp R1 | NIST-3 AES | 3 | 2,177,000 | 3,540 | 2,180,540 | 2.80 ms(estimated from 7.0M cycles @ 2.5 GHz) | 943.2 µs(estimated from 2.4M cycles @ 2.5 GHz) | LWE/SIS |
| HuFu | Lattices | On-ramp R1 | NIST-1 SHAKE | 1 | 1,059,000 | 2,455 | 1,061,455 | 2.54 ms(estimated from 6.3M cycles @ 2.5 GHz) | 1.23 ms(estimated from 3.1M cycles @ 2.5 GHz) | LWE/SIS |
| HuFu | Lattices | On-ramp R1 | NIST-1 AES | 1 | 1,059,000 | 2,455 | 1,061,455 | 1.55 ms(estimated from 3.9M cycles @ 2.5 GHz) | 320.4 µs(estimated from 801K cycles @ 2.5 GHz) | LWE/SIS |
| KAZ-Sign | Other | On-ramp R1 | KAZ970 | 5 | 243 | 153 | 396 | 43.32 s | 22.65 s | Second-order Discrete Log |
| KAZ-Sign | Other | On-ramp R1 | KAZ738 | 3 | 185 | 117 | 302 | 20.82 s | 10.31 s | Second-order Discrete Log |
| KAZ-Sign | Other | On-ramp R1 | KAZ458 | 1 | 115 | 74 | 189 | 9.96 s | 2.70 s | Second-order Discrete Log |
| LESS | Code-based | On-ramp R2 | 252-192 | 1 | 13,940 | 2,609 | 16,549 | 40.10 ms | 33.88 ms | Linear Equiv. |
| LESS | Code-based | On-ramp R2 | 252-68 | 1 | 41,788 | 1,825 | 43,613 | 14.63 ms | 13.40 ms | Linear Equiv. |
| LESS | Code-based | On-ramp R2 | 252-45 | 1 | 97,484 | 1,329 | 98,813 | 9.80 ms | 9.24 ms | Linear Equiv. |
| LESS | Code-based | On-ramp R2 | 400-220 | 3 | 35,074 | 6,353 | 41,427 | 126.89 ms | 114.18 ms | Linear Equiv. |
| LESS | Code-based | On-ramp R2 | 400-102 | 3 | 105,174 | 4,131 | 109,305 | 59.54 ms | 55.93 ms | Linear Equiv. |
| LESS | Code-based | On-ramp R2 | 548-345 | 5 | 65,793 | 10,712 | 76,505 | 445.69 ms | 412.37 ms | Linear Equiv. |
| LESS | Code-based | On-ramp R2 | 548-137 | 5 | 197,315 | 7,436 | 204,751 | 178.97 ms | 175.19 ms | Linear Equiv. |
| MAYO | Multivariate | On-ramp R3 | five | 5 | 5,554 | 964 | 6,518 | 216.0 µs | 89.9 µs | Multivariate Quadratic |
| MAYO | Multivariate | On-ramp R3 | three | 3 | 2,986 | 681 | 3,667 | 98.4 µs | 41.2 µs | Multivariate Quadratic |
| MAYO | Multivariate | On-ramp R3 | two | 1 | 2,928 | 239 | 3,167 | 29.2 µs | 12.2 µs | Multivariate Quadratic |
| MAYO | Multivariate | On-ramp R3 | one | 1 | 1,456 | 464 | 1,920 | 48.3 µs | 20.1 µs | Multivariate Quadratic |
| MEDS | Code-based | On-ramp R1 | 134180 | 5 | 134,180 | 132,528 | 266,708 | 651.94 ms(estimated from 1.63G cycles @ 2.5 GHz) | 645.02 ms(estimated from 1.61G cycles @ 2.5 GHz) | Matrix Code Equiv. |
| MEDS | Code-based | On-ramp R1 | 41711 | 3 | 41,711 | 41,080 | 82,791 | 586.80 ms(estimated from 1.47G cycles @ 2.5 GHz) | 584.79 ms(estimated from 1.46G cycles @ 2.5 GHz) | Matrix Code Equiv. |
| MEDS | Code-based | On-ramp R1 | 167717 | 5 | 167,717 | 165,464 | 333,181 | 384.72 ms(estimated from 961.8M cycles @ 2.5 GHz) | 375.56 ms(estimated from 938.9M cycles @ 2.5 GHz) | Matrix Code Equiv. |
| MEDS | Code-based | On-ramp R1 | 9923 | 1 | 9,923 | 9,896 | 19,819 | 207.22 ms(estimated from 518.0M cycles @ 2.5 GHz) | 206.23 ms(estimated from 515.6M cycles @ 2.5 GHz) | Matrix Code Equiv. |
| MEDS | Code-based | On-ramp R1 | 69497 | 3 | 55,604 | 54,736 | 110,340 | 154.51 ms(estimated from 386.3M cycles @ 2.5 GHz) | 152.28 ms(estimated from 380.7M cycles @ 2.5 GHz) | Matrix Code Equiv. |
| MEDS | Code-based | On-ramp R1 | 13220 | 1 | 13,220 | 12,976 | 26,196 | 35.56 ms(estimated from 88.9M cycles @ 2.5 GHz) | 34.99 ms(estimated from 87.5M cycles @ 2.5 GHz) | Matrix Code Equiv. |
| MIRA | MPCitH | On-ramp R1 | 256S | 5 | 150 | 20,762 | 20,912 | 135.08 ms(estimated from 337.7M cycles @ 2.5 GHz) | 132.56 ms(estimated from 331.4M cycles @ 2.5 GHz) | MinRank |
| MIRA | MPCitH | On-ramp R1 | 256F | 5 | 150 | 27,678 | 27,828 | 128.92 ms(estimated from 322.3M cycles @ 2.5 GHz) | 129.28 ms(estimated from 323.2M cycles @ 2.5 GHz) | MinRank |
| MIRA | MPCitH | On-ramp R1 | 192S | 3 | 121 | 11,779 | 11,900 | 47.88 ms(estimated from 119.7M cycles @ 2.5 GHz) | 46.48 ms(estimated from 116.2M cycles @ 2.5 GHz) | MinRank |
| MIRA | MPCitH | On-ramp R1 | 192F | 3 | 121 | 15,540 | 15,661 | 42.88 ms(estimated from 107.2M cycles @ 2.5 GHz) | 42.80 ms(estimated from 107.0M cycles @ 2.5 GHz) | MinRank |
| MIRA | MPCitH | On-ramp R1 | 128S | 1 | 84 | 5,640 | 5,724 | 18.72 ms(estimated from 46.8M cycles @ 2.5 GHz) | 17.56 ms(estimated from 43.9M cycles @ 2.5 GHz) | MinRank |
| MIRA | MPCitH | On-ramp R1 | 128F | 1 | 84 | 7,376 | 7,460 | 14.96 ms(estimated from 37.4M cycles @ 2.5 GHz) | 14.68 ms(estimated from 36.7M cycles @ 2.5 GHz) | MinRank |
| Mirath | MPCitH | On-ramp R2 | 1a-Short | 1 | 73 | 3,182 | 3,255 | 3.28 ms | 2.94 ms | MinRank |
| Mirath | MPCitH | On-ramp R2 | 1a-Fast | 1 | 73 | 3,728 | 3,801 | 988.0 µs | 616.4 µs | MinRank |
| Mirath | MPCitH | On-ramp R2 | 1b-Short | 1 | 57 | 2,990 | 3,047 | 4.41 ms | 3.78 ms | MinRank |
| Mirath | MPCitH | On-ramp R2 | 1b-Fast | 1 | 57 | 3,456 | 3,513 | 2.25 ms | 1.37 ms | MinRank |
| Mirath | MPCitH | On-ramp R2 | 3a-Short | 3 | 107 | 7,456 | 7,563 | 31.37 ms | 30.82 ms | MinRank |
| Mirath | MPCitH | On-ramp R2 | 3a-Fast | 3 | 107 | 8,548 | 8,655 | 5.51 ms | 4.28 ms | MinRank |
| Mirath | MPCitH | On-ramp R2 | 3b-Short | 3 | 84 | 6,825 | 6,909 | 24.40 ms | 21.73 ms | MinRank |
| Mirath | MPCitH | On-ramp R2 | 3b-Fast | 3 | 84 | 7,924 | 8,008 | 12.63 ms | 10.24 ms | MinRank |
| Mirath | MPCitH | On-ramp R2 | 5a-Short | 5 | 147 | 13,091 | 13,238 | 28.94 ms | 26.60 ms | MinRank |
| Mirath | MPCitH | On-ramp R2 | 5a-Fast | 5 | 147 | 15,440 | 15,587 | 8.34 ms | 6.02 ms | MinRank |
| Mirath | MPCitH | On-ramp R2 | 5b-Short | 5 | 112 | 12,229 | 12,341 | 34.91 ms | 29.72 ms | MinRank |
| Mirath | MPCitH | On-ramp R2 | 5b-Fast | 5 | 112 | 14,198 | 14,310 | 18.10 ms | 14.17 ms | MinRank |
| MiRitH | MPCitH | On-ramp R1 | hypercube-Vb shortest | 5 | 274 | 18,292 | 18,566 | 6.99 s(estimated from 17.47G cycles @ 2.5 GHz) | 6.45 s(estimated from 16.11G cycles @ 2.5 GHz) | MinRank |
| MiRitH | MPCitH | On-ramp R1 | hypercube-Va shortest | 5 | 253 | 17,552 | 17,805 | 6.68 s(estimated from 16.71G cycles @ 2.5 GHz) | 6.61 s(estimated from 16.54G cycles @ 2.5 GHz) | MinRank |
| MiRitH | MPCitH | On-ramp R1 | hypercube-IIIb shortest | 3 | 205 | 10,314 | 10,519 | 3.95 s(estimated from 9.88G cycles @ 2.5 GHz) | 4.03 s(estimated from 10.06G cycles @ 2.5 GHz) | MinRank |
| MiRitH | MPCitH | On-ramp R1 | hypercube-IIIa shortest | 3 | 205 | 9,954 | 10,159 | 3.94 s(estimated from 9.86G cycles @ 2.5 GHz) | 3.86 s(estimated from 9.65G cycles @ 2.5 GHz) | MinRank |
| MiRitH | MPCitH | On-ramp R1 | hypercube-Ia shortest | 1 | 129 | 4,536 | 4,665 | 2.44 s(estimated from 6.11G cycles @ 2.5 GHz) | 2.48 s(estimated from 6.20G cycles @ 2.5 GHz) | MinRank |
| MiRitH | MPCitH | On-ramp R1 | hypercube-Ib shortest | 1 | 144 | 4,886 | 5,030 | 2.44 s(estimated from 6.11G cycles @ 2.5 GHz) | 2.42 s(estimated from 6.04G cycles @ 2.5 GHz) | MinRank |
| MiRitH | MPCitH | On-ramp R1 | hypercube-Vb shorter | 5 | 274 | 20,394 | 20,668 | 543.79 ms(estimated from 1.36G cycles @ 2.5 GHz) | 511.48 ms(estimated from 1.28G cycles @ 2.5 GHz) | MinRank |
| MiRitH | MPCitH | On-ramp R1 | hypercube-Va shorter | 5 | 253 | 19,393 | 19,646 | 516.39 ms(estimated from 1.29G cycles @ 2.5 GHz) | 508.86 ms(estimated from 1.27G cycles @ 2.5 GHz) | MinRank |
| MiRitH | MPCitH | On-ramp R1 | hypercube-IIIb shorter | 3 | 205 | 11,202 | 11,407 | 290.90 ms(estimated from 727.2M cycles @ 2.5 GHz) | 292.81 ms(estimated from 732.0M cycles @ 2.5 GHz) | MinRank |
| MiRitH | MPCitH | On-ramp R1 | hypercube-IIIa shorter | 3 | 205 | 10,746 | 10,951 | 289.24 ms(estimated from 723.1M cycles @ 2.5 GHz) | 283.30 ms(estimated from 708.3M cycles @ 2.5 GHz) | MinRank |
| MiRitH | MPCitH | On-ramp R1 | hypercube-Ib shorter | 1 | 144 | 5,491 | 5,635 | 183.47 ms(estimated from 458.7M cycles @ 2.5 GHz) | 180.18 ms(estimated from 450.4M cycles @ 2.5 GHz) | MinRank |
| MiRitH | MPCitH | On-ramp R1 | hypercube-Ia shorter | 1 | 129 | 5,036 | 5,165 | 182.20 ms(estimated from 455.5M cycles @ 2.5 GHz) | 182.63 ms(estimated from 456.6M cycles @ 2.5 GHz) | MinRank |
| MiRitH | MPCitH | On-ramp R1 | Vb short | 5 | 274 | 23,182 | 23,456 | 130.83 ms(estimated from 327.1M cycles @ 2.5 GHz) | 132.25 ms(estimated from 330.6M cycles @ 2.5 GHz) | MinRank |
| MiRitH | MPCitH | On-ramp R1 | Va short | 5 | 253 | 21,795 | 22,048 | 123.43 ms(estimated from 308.6M cycles @ 2.5 GHz) | 124.24 ms(estimated from 310.6M cycles @ 2.5 GHz) | MinRank |
| MiRitH | MPCitH | On-ramp R1 | IIIb short | 3 | 205 | 13,136 | 13,341 | 97.01 ms(estimated from 242.5M cycles @ 2.5 GHz) | 81.94 ms(estimated from 204.9M cycles @ 2.5 GHz) | MinRank |
| MiRitH | MPCitH | On-ramp R1 | IIIa short | 3 | 205 | 12,440 | 12,645 | 77.14 ms(estimated from 192.9M cycles @ 2.5 GHz) | 70.21 ms(estimated from 175.5M cycles @ 2.5 GHz) | MinRank |
| MiRitH | MPCitH | On-ramp R1 | hypercube-Vb short | 5 | 274 | 23,182 | 23,456 | 55.40 ms(estimated from 138.5M cycles @ 2.5 GHz) | 55.45 ms(estimated from 138.6M cycles @ 2.5 GHz) | MinRank |
| MiRitH | MPCitH | On-ramp R1 | hypercube-Va short | 5 | 253 | 21,795 | 22,048 | 47.40 ms(estimated from 118.5M cycles @ 2.5 GHz) | 45.28 ms(estimated from 113.2M cycles @ 2.5 GHz) | MinRank |
| MiRitH | MPCitH | On-ramp R1 | Ia short | 1 | 129 | 5,673 | 5,802 | 30.62 ms(estimated from 76.5M cycles @ 2.5 GHz) | 30.75 ms(estimated from 76.9M cycles @ 2.5 GHz) | MinRank |
| MiRitH | MPCitH | On-ramp R1 | hypercube-IIIb short | 3 | 205 | 13,136 | 13,341 | 28.73 ms(estimated from 71.8M cycles @ 2.5 GHz) | 30.40 ms(estimated from 76.0M cycles @ 2.5 GHz) | MinRank |
| MiRitH | MPCitH | On-ramp R1 | hypercube-IIIa short | 3 | 205 | 12,440 | 12,645 | 28.10 ms(estimated from 70.3M cycles @ 2.5 GHz) | 27.06 ms(estimated from 67.7M cycles @ 2.5 GHz) | MinRank |
| MiRitH | MPCitH | On-ramp R1 | Ib short | 1 | 144 | 6,309 | 6,453 | 26.25 ms(estimated from 65.6M cycles @ 2.5 GHz) | 26.22 ms(estimated from 65.6M cycles @ 2.5 GHz) | MinRank |
| MiRitH | MPCitH | On-ramp R1 | hypercube-Ib short | 1 | 144 | 6,309 | 6,453 | 16.83 ms(estimated from 42.1M cycles @ 2.5 GHz) | 16.82 ms(estimated from 42.0M cycles @ 2.5 GHz) | MinRank |
| MiRitH | MPCitH | On-ramp R1 | hypercube-Ia short | 1 | 129 | 5,673 | 5,802 | 16.49 ms(estimated from 41.2M cycles @ 2.5 GHz) | 16.39 ms(estimated from 41.0M cycles @ 2.5 GHz) | MinRank |
| MiRitH | MPCitH | On-ramp R1 | hypercube-Vb fast | 5 | 274 | 33,048 | 33,322 | 16.27 ms(estimated from 40.7M cycles @ 2.5 GHz) | 13.89 ms(estimated from 34.7M cycles @ 2.5 GHz) | MinRank |
| MiRitH | MPCitH | On-ramp R1 | Vb fast | 5 | 274 | 33,048 | 33,322 | 15.46 ms(estimated from 38.7M cycles @ 2.5 GHz) | 15.25 ms(estimated from 38.1M cycles @ 2.5 GHz) | MinRank |
| MiRitH | MPCitH | On-ramp R1 | Va fast | 5 | 253 | 30,458 | 30,711 | 14.54 ms(estimated from 36.4M cycles @ 2.5 GHz) | 14.67 ms(estimated from 36.7M cycles @ 2.5 GHz) | MinRank |
| MiRitH | MPCitH | On-ramp R1 | hypercube-Va fast | 5 | 253 | 30,458 | 30,711 | 13.30 ms(estimated from 33.2M cycles @ 2.5 GHz) | 11.31 ms(estimated from 28.3M cycles @ 2.5 GHz) | MinRank |
| MiRitH | MPCitH | On-ramp R1 | IIIb fast | 3 | 205 | 18,459 | 18,664 | 9.82 ms(estimated from 24.5M cycles @ 2.5 GHz) | 8.99 ms(estimated from 22.5M cycles @ 2.5 GHz) | MinRank |
| MiRitH | MPCitH | On-ramp R1 | IIIa fast | 3 | 205 | 17,139 | 17,344 | 8.99 ms(estimated from 22.5M cycles @ 2.5 GHz) | 7.37 ms(estimated from 18.4M cycles @ 2.5 GHz) | MinRank |
| MiRitH | MPCitH | On-ramp R1 | hypercube-IIIb fast | 3 | 205 | 18,459 | 18,664 | 7.35 ms(estimated from 18.4M cycles @ 2.5 GHz) | 6.22 ms(estimated from 15.6M cycles @ 2.5 GHz) | MinRank |
| MiRitH | MPCitH | On-ramp R1 | hypercube-IIIa fast | 3 | 205 | 17,139 | 17,344 | 6.23 ms(estimated from 15.6M cycles @ 2.5 GHz) | 5.21 ms(estimated from 13.0M cycles @ 2.5 GHz) | MinRank |
| MiRitH | MPCitH | On-ramp R1 | hypercube-Ib fast | 1 | 144 | 9,105 | 9,249 | 3.79 ms(estimated from 9.5M cycles @ 2.5 GHz) | 3.17 ms(estimated from 7.9M cycles @ 2.5 GHz) | MinRank |
| MiRitH | MPCitH | On-ramp R1 | Ia fast | 1 | 129 | 7,877 | 8,006 | 3.48 ms(estimated from 8.7M cycles @ 2.5 GHz) | 2.92 ms(estimated from 7.3M cycles @ 2.5 GHz) | MinRank |
| MiRitH | MPCitH | On-ramp R1 | Ib fast | 1 | 144 | 9,105 | 9,249 | 3.21 ms(estimated from 8.0M cycles @ 2.5 GHz) | 3.02 ms(estimated from 7.6M cycles @ 2.5 GHz) | MinRank |
| MiRitH | MPCitH | On-ramp R1 | hypercube-Ia fast | 1 | 129 | 7,877 | 8,006 | 2.90 ms(estimated from 7.2M cycles @ 2.5 GHz) | 2.42 ms(estimated from 6.1M cycles @ 2.5 GHz) | MinRank |
| MQOM | MPCitH | On-ramp R3 | L1-gf2-shorter-ct | 1 | 52 | 2,492 | 2,544 | 2.46 ms | 1.23 ms | Multivariate Quadratic |
| MQOM | MPCitH | On-ramp R3 | L1-gf2-shorter-ot | 1 | 52 | 2,492 | 2,544 | 3.47 ms | 3.35 ms | Multivariate Quadratic |
| MQOM | MPCitH | On-ramp R3 | L1-gf16-short-ct | 1 | 64 | 2,932 | 2,996 | 634.3 µs | 612.2 µs | Multivariate Quadratic |
| MQOM | MPCitH | On-ramp R3 | L1-gf16-short-ot | 1 | 64 | 2,932 | 2,996 | 852.1 µs | 857.2 µs | Multivariate Quadratic |
| MQOM | MPCitH | On-ramp R3 | L1-gf16-fast-ct | 1 | 64 | 3,316 | 3,380 | 236.5 µs | 226.7 µs | Multivariate Quadratic |
| MQOM | MPCitH | On-ramp R3 | L1-gf16-fast-ot | 1 | 64 | 3,316 | 3,380 | 293.9 µs | 274.9 µs | Multivariate Quadratic |
| MQOM | MPCitH | On-ramp R3 | L3-gf2-shorter-ct | 3 | 78 | 5,932 | 6,010 | 7.24 ms | 6.04 ms | Multivariate Quadratic |
| MQOM | MPCitH | On-ramp R3 | L3-gf2-shorter-ot | 3 | 78 | 5,890 | 5,968 | 9.70 ms | 8.72 ms | Multivariate Quadratic |
| MQOM | MPCitH | On-ramp R3 | L3-gf16-short-ct | 3 | 96 | 6,556 | 6,652 | 3.72 ms | 3.45 ms | Multivariate Quadratic |
| MQOM | MPCitH | On-ramp R3 | L3-gf16-short-ot | 3 | 96 | 6,556 | 6,652 | 5.25 ms | 4.86 ms | Multivariate Quadratic |
| MQOM | MPCitH | On-ramp R3 | L3-gf16-fast-ct | 3 | 96 | 7,564 | 7,660 | 1.10 ms | 1.07 ms | Multivariate Quadratic |
| MQOM | MPCitH | On-ramp R3 | L3-gf16-fast-ot | 3 | 96 | 7,660 | 7,756 | 1.29 ms | 1.27 ms | Multivariate Quadratic |
| MQOM | MPCitH | On-ramp R3 | L5-gf2-shorter-ct | 5 | 104 | 10,836 | 10,940 | 10.86 ms | 10.12 ms | Multivariate Quadratic |
| MQOM | MPCitH | On-ramp R3 | L5-gf2-shorter-ot | 5 | 104 | 10,804 | 10,908 | 13.09 ms | 12.87 ms | Multivariate Quadratic |
| MQOM | MPCitH | On-ramp R3 | L5-gf16-short-ct | 5 | 128 | 12,100 | 12,228 | 4.63 ms | 4.37 ms | Multivariate Quadratic |
| MQOM | MPCitH | On-ramp R3 | L5-gf16-short-ot | 5 | 128 | 11,716 | 11,844 | 6.08 ms | 5.87 ms | Multivariate Quadratic |
| MQOM | MPCitH | On-ramp R3 | L5-gf16-fast-ct | 5 | 128 | 13,540 | 13,668 | 1.88 ms | 1.77 ms | Multivariate Quadratic |
| MQOM | MPCitH | On-ramp R3 | L5-gf16-fast-ot | 5 | 128 | 13,380 | 13,508 | 2.37 ms | 2.01 ms | Multivariate Quadratic |
| PERK | MPCitH | On-ramp R2 | 1-short | 1 | 104 | 3,473 | 3,577 | 3.97 ms | 3.36 ms | Permuted Kernel |
| PERK | MPCitH | On-ramp R2 | 1-fast | 1 | 104 | 4,312 | 4,416 | 1.26 ms | 934.5 µs | Permuted Kernel |
| PERK | MPCitH | On-ramp R2 | 3-short | 3 | 151 | 8,311 | 8,462 | 32.45 ms | 29.72 ms | Permuted Kernel |
| PERK | MPCitH | On-ramp R2 | 3-fast | 3 | 151 | 10,423 | 10,574 | 8.44 ms | 5.84 ms | Permuted Kernel |
| PERK | MPCitH | On-ramp R2 | 5-short | 5 | 195 | 14,830 | 15,025 | 45.50 ms | 40.21 ms | Permuted Kernel |
| PERK | MPCitH | On-ramp R2 | 5-fast | 5 | 195 | 18,216 | 18,411 | 16.44 ms | 11.27 ms | Permuted Kernel |
| PREON | Other | On-ramp R1 | 256A | 5 | 64 | 598,000 | 598,064 | 414.71 s | 11.55 s | zk-SNARK |
| PREON | Other | On-ramp R1 | 256B | 5 | 64 | 1,157,000 | 1,157,064 | 415.21 s | 12.49 s | zk-SNARK |
| PREON | Other | On-ramp R1 | 256C | 5 | 64 | 5,248,000 | 5,248,064 | 417.46 s | 26.84 s | zk-SNARK |
| PREON | Other | On-ramp R1 | 192A | 3 | 56 | 312,000 | 312,056 | 132.41 s | 2.18 s | zk-SNARK |
| PREON | Other | On-ramp R1 | 192B | 3 | 56 | 778,000 | 778,056 | 137.31 s | 2.69 s | zk-SNARK |
| PREON | Other | On-ramp R1 | 192C | 3 | 56 | 3,541,000 | 3,541,056 | 137.25 s | 7.46 s | zk-SNARK |
| PREON | Other | On-ramp R1 | 128A | 1 | 32 | 139,000 | 139,032 | 76.07 s | 397.00 ms | zk-SNARK |
| PREON | Other | On-ramp R1 | 128B | 1 | 32 | 372,000 | 372,032 | 80.87 s | 561.00 ms | zk-SNARK |
| PREON | Other | On-ramp R1 | 128C | 1 | 32 | 1,725,000 | 1,725,032 | 76.92 s | 2.30 s | zk-SNARK |
| PROV | Multivariate | On-ramp R1 | V | 5 | 524,192 | 304 | 524,496 | 136.66 ms | 182.48 ms | UOV |
| PROV | Multivariate | On-ramp R1 | III | 3 | 215,694 | 232 | 215,926 | 59.04 ms | 79.08 ms | UOV |
| PROV | Multivariate | On-ramp R1 | I | 1 | 68,326 | 160 | 68,486 | 17.71 ms | 24.00 ms | UOV |
| QR-UOV | Multivariate | On-ramp R3 | I-(127 156 54 3) | 1 | 24,256 | 200 | 24,456 | 139.4 µs | 77.5 µs | UOV |
| QR-UOV | Multivariate | On-ramp R3 | I-(127 540 60 10) | 1 | 11,041 | 541 | 11,582 | 665.3 µs | 217.4 µs | UOV |
| QR-UOV | Multivariate | On-ramp R3 | III-(127 228 78 3) | 3 | 71,884 | 292 | 72,176 | 376.4 µs | 218.7 µs | UOV |
| QR-UOV | Multivariate | On-ramp R3 | III-(127 820 90 10) | 3 | 35,454 | 821 | 36,275 | 2.16 ms | 713.4 µs | UOV |
| QR-UOV | Multivariate | On-ramp R3 | V-(127 306 105 3) | 5 | 173,660 | 392 | 174,052 | 885.8 µs | 523.4 µs | UOV |
| QR-UOV | Multivariate | On-ramp R3 | V-(127 1040 110 10) | 5 | 63,541 | 1,039 | 64,580 | 3.82 ms | 1.33 ms | UOV |
| Raccoon | Lattices | On-ramp R1 | 256-32 | 5 | 4,064 | 20,330 | 24,394 | 54.04 ms(estimated from 135.1M cycles @ 2.5 GHz) | 1.82 ms(estimated from 4.6M cycles @ 2.5 GHz) | MLWE/MSIS |
| Raccoon | Lattices | On-ramp R1 | 192-32 | 3 | 3,160 | 14,544 | 17,704 | 39.59 ms(estimated from 99.0M cycles @ 2.5 GHz) | 1.11 ms(estimated from 2.8M cycles @ 2.5 GHz) | MLWE/MSIS |
| Raccoon | Lattices | On-ramp R1 | 128-32 | 1 | 2,256 | 11,524 | 13,780 | 29.66 ms(estimated from 74.1M cycles @ 2.5 GHz) | 702.8 µs(estimated from 1.8M cycles @ 2.5 GHz) | MLWE/MSIS |
| Raccoon | Lattices | On-ramp R1 | 256-16 | 5 | 4,064 | 20,330 | 24,394 | 17.09 ms(estimated from 42.7M cycles @ 2.5 GHz) | 1.82 ms(estimated from 4.6M cycles @ 2.5 GHz) | MLWE/MSIS |
| Raccoon | Lattices | On-ramp R1 | 256-8 | 5 | 4,064 | 20,330 | 24,394 | 13.37 ms(estimated from 33.4M cycles @ 2.5 GHz) | 1.82 ms(estimated from 4.6M cycles @ 2.5 GHz) | MLWE/MSIS |
| Raccoon | Lattices | On-ramp R1 | 192-16 | 3 | 3,160 | 14,544 | 17,704 | 12.23 ms(estimated from 30.6M cycles @ 2.5 GHz) | 1.11 ms(estimated from 2.8M cycles @ 2.5 GHz) | MLWE/MSIS |
| Raccoon | Lattices | On-ramp R1 | 192-8 | 3 | 3,160 | 14,544 | 17,704 | 9.64 ms(estimated from 24.1M cycles @ 2.5 GHz) | 1.11 ms(estimated from 2.8M cycles @ 2.5 GHz) | MLWE/MSIS |
| Raccoon | Lattices | On-ramp R1 | 128-16 | 1 | 2,256 | 11,524 | 13,780 | 9.04 ms(estimated from 22.6M cycles @ 2.5 GHz) | 702.8 µs(estimated from 1.8M cycles @ 2.5 GHz) | MLWE/MSIS |
| Raccoon | Lattices | On-ramp R1 | 128-8 | 1 | 2,256 | 11,524 | 13,780 | 7.06 ms(estimated from 17.7M cycles @ 2.5 GHz) | 702.8 µs(estimated from 1.8M cycles @ 2.5 GHz) | MLWE/MSIS |
| Raccoon | Lattices | On-ramp R1 | 256-4 | 5 | 4,064 | 20,330 | 24,394 | 5.27 ms(estimated from 13.2M cycles @ 2.5 GHz) | 1.82 ms(estimated from 4.6M cycles @ 2.5 GHz) | MLWE/MSIS |
| Raccoon | Lattices | On-ramp R1 | 256-2 | 5 | 4,064 | 20,330 | 24,394 | 4.45 ms(estimated from 11.1M cycles @ 2.5 GHz) | 1.82 ms(estimated from 4.6M cycles @ 2.5 GHz) | MLWE/MSIS |
| Raccoon | Lattices | On-ramp R1 | 256-1 | 5 | 4,064 | 20,330 | 24,394 | 4.02 ms(estimated from 10.1M cycles @ 2.5 GHz) | 1.82 ms(estimated from 4.6M cycles @ 2.5 GHz) | MLWE/MSIS |
| Raccoon | Lattices | On-ramp R1 | 192-4 | 3 | 3,160 | 14,544 | 17,704 | 3.63 ms(estimated from 9.1M cycles @ 2.5 GHz) | 1.11 ms(estimated from 2.8M cycles @ 2.5 GHz) | MLWE/MSIS |
| Raccoon | Lattices | On-ramp R1 | 192-2 | 3 | 3,160 | 14,544 | 17,704 | 3.08 ms(estimated from 7.7M cycles @ 2.5 GHz) | 1.11 ms(estimated from 2.8M cycles @ 2.5 GHz) | MLWE/MSIS |
| Raccoon | Lattices | On-ramp R1 | 192-1 | 3 | 3,160 | 14,544 | 17,704 | 2.74 ms(estimated from 6.9M cycles @ 2.5 GHz) | 1.11 ms(estimated from 2.8M cycles @ 2.5 GHz) | MLWE/MSIS |
| Raccoon | Lattices | On-ramp R1 | 128-4 | 1 | 2,256 | 11,524 | 13,780 | 2.59 ms(estimated from 6.5M cycles @ 2.5 GHz) | 702.8 µs(estimated from 1.8M cycles @ 2.5 GHz) | MLWE/MSIS |
| Raccoon | Lattices | On-ramp R1 | 128-2 | 1 | 2,256 | 11,524 | 13,780 | 2.16 ms(estimated from 5.4M cycles @ 2.5 GHz) | 702.8 µs(estimated from 1.8M cycles @ 2.5 GHz) | MLWE/MSIS |
| Raccoon | Lattices | On-ramp R1 | 128-1 | 1 | 2,256 | 11,524 | 13,780 | 1.93 ms(estimated from 4.8M cycles @ 2.5 GHz) | 702.8 µs(estimated from 1.8M cycles @ 2.5 GHz) | MLWE/MSIS |
| RYDE | MPCitH | On-ramp R2 | 1-Short | 1 | 69 | 3,115 | 3,184 | 18.06 ms | 17.21 ms | Rank Synd. Dec. |
| RYDE | MPCitH | On-ramp R2 | 1-Fast | 1 | 69 | 3,597 | 3,666 | 3.75 ms | 3.18 ms | Rank Synd. Dec. |
| RYDE | MPCitH | On-ramp R2 | 1-Faster | 1 | 69 | 4,976 | 5,045 | 986.8 µs | 803.3 µs | Rank Synd. Dec. |
| RYDE | MPCitH | On-ramp R2 | 3-Short | 3 | 101 | 7,064 | 7,165 | 52.53 ms | 49.61 ms | Rank Synd. Dec. |
| RYDE | MPCitH | On-ramp R2 | 3-Fast | 3 | 101 | 8,264 | 8,365 | 9.98 ms | 9.03 ms | Rank Synd. Dec. |
| RYDE | MPCitH | On-ramp R2 | 3-Faster | 3 | 101 | 11,672 | 11,773 | 2.39 ms | 2.18 ms | Rank Synd. Dec. |
| RYDE | MPCitH | On-ramp R2 | 5-Short | 5 | 132 | 12,607 | 12,739 | 84.98 ms | 81.38 ms | Rank Synd. Dec. |
| RYDE | MPCitH | On-ramp R2 | 5-Fast | 5 | 132 | 14,779 | 14,911 | 15.52 ms | 14.37 ms | Rank Synd. Dec. |
| RYDE | MPCitH | On-ramp R2 | 5-Faster | 5 | 132 | 20,850 | 20,982 | 4.06 ms | 3.69 ms | Rank Synd. Dec. |
| SDitH | MPCitH | On-ramp R3 | SDitH3-L1-gf2-short | 1 | 70 | 3,721 | 3,791 | 2.12 ms | 1.92 ms | Synd. Dec. |
| SDitH | MPCitH | On-ramp R3 | SDitH3-L1-gf2-fast | 1 | 70 | 4,914 | 4,984 | 454.8 µs | 399.7 µs | Synd. Dec. |
| SDitH | MPCitH | On-ramp R3 | SDitH3-L3-gf2-short | 3 | 98 | 8,484 | 8,582 | 8.96 ms | 8.86 ms | Synd. Dec. |
| SDitH | MPCitH | On-ramp R3 | SDitH3-L3-gf2-fast | 3 | 98 | 10,852 | 10,950 | 2.08 ms | 1.95 ms | Synd. Dec. |
| SDitH | MPCitH | On-ramp R3 | SDitH3-L5-gf2-short | 5 | 132 | 15,147 | 15,279 | 14.28 ms | 14.12 ms | Synd. Dec. |
| SDitH | MPCitH | On-ramp R3 | SDitH3-L5-gf2-fast | 5 | 132 | 19,144 | 19,276 | 3.25 ms | 3.07 ms | Synd. Dec. |
| SNOVA | Multivariate | On-ramp R3 | SNOVA_I_K | 1 | 376 | 528 | 904 | 210.3 µs | 64.9 µs | Non-comm. Ring UOV |
| SNOVA | Multivariate | On-ramp R3 | SNOVA_I_B | 1 | 656 | 388 | 1,044 | 209.7 µs | 58.5 µs | Non-comm. Ring UOV |
| SNOVA | Multivariate | On-ramp R3 | SNOVA_I_S | 1 | 1,016 | 272 | 1,288 | 142.6 µs | 47.6 µs | Non-comm. Ring UOV |
| SNOVA | Multivariate | On-ramp R3 | SNOVA_III_K | 3 | 912 | 688 | 1,600 | 439.4 µs | 134.9 µs | Non-comm. Ring UOV |
| SNOVA | Multivariate | On-ramp R3 | SNOVA_III_B | 3 | 1,416 | 532 | 1,948 | 457.2 µs | 135.6 µs | Non-comm. Ring UOV |
| SNOVA | Multivariate | On-ramp R3 | SNOVA_III_S | 3 | 2,032 | 456 | 2,488 | 515.3 µs | 139.2 µs | Non-comm. Ring UOV |
| SNOVA | Multivariate | On-ramp R3 | SNOVA_V_K | 5 | 1,216 | 896 | 2,112 | 1.10 ms | 261.1 µs | Non-comm. Ring UOV |
| SNOVA | Multivariate | On-ramp R3 | SNOVA_V_B | 5 | 1,891 | 691 | 2,582 | 1.10 ms | 217.8 µs | Non-comm. Ring UOV |
| SNOVA | Multivariate | On-ramp R3 | SNOVA_V_S | 5 | 2,716 | 591 | 3,307 | 1.17 ms | 209.0 µs | Non-comm. Ring UOV |
| SPHINCS-alpha | Symmetric | On-ramp R1 | 256s SHAKE | 5 | 64 | 27,232 | 27,296 | 798.70 ms(estimated from 2.00G cycles @ 2.5 GHz) | 2.90 ms(estimated from 7.3M cycles @ 2.5 GHz) | Hash-based |
| SPHINCS-alpha | Symmetric | On-ramp R1 | 256f SHAKE | 5 | 64 | 49,312 | 49,376 | 632.95 ms(estimated from 1.58G cycles @ 2.5 GHz) | 4.67 ms(estimated from 11.7M cycles @ 2.5 GHz) | Hash-based |
| SPHINCS-alpha | Symmetric | On-ramp R1 | 192f SHAKE | 3 | 48 | 34,896 | 34,944 | 36.83 ms(estimated from 92.1M cycles @ 2.5 GHz) | 1.21 ms(estimated from 3.0M cycles @ 2.5 GHz) | Hash-based |
| SPHINCS-alpha | Symmetric | On-ramp R1 | 256s SHA2 | 5 | 64 | 27,232 | 27,296 | 305.74 ms(estimated from 764.4M cycles @ 2.5 GHz) | 2.40 ms(estimated from 6.0M cycles @ 2.5 GHz) | Hash-based |
| SPHINCS-alpha | Symmetric | On-ramp R1 | 256f SHA2 | 5 | 64 | 49,312 | 49,376 | 36.53 ms(estimated from 91.3M cycles @ 2.5 GHz) | 1.27 ms(estimated from 3.2M cycles @ 2.5 GHz) | Hash-based |
| SPHINCS-alpha | Symmetric | On-ramp R1 | 192f SHA2 | 3 | 48 | 34,896 | 34,944 | 18.09 ms(estimated from 45.2M cycles @ 2.5 GHz) | 697.6 µs(estimated from 1.7M cycles @ 2.5 GHz) | Hash-based |
| SPHINCS-alpha | Symmetric | On-ramp R1 | 192s SHAKE | 3 | 48 | 14,568 | 14,616 | 798.70 ms(estimated from 2.00G cycles @ 2.5 GHz) | 2.90 ms(estimated from 7.3M cycles @ 2.5 GHz) | Hash-based |
| SPHINCS-alpha | Symmetric | On-ramp R1 | 128f SHAKE | 1 | 32 | 16,720 | 16,752 | 22.83 ms(estimated from 57.1M cycles @ 2.5 GHz) | 1.42 ms(estimated from 3.6M cycles @ 2.5 GHz) | Hash-based |
| SPHINCS-alpha | Symmetric | On-ramp R1 | 192s SHA2 | 3 | 48 | 14,568 | 14,616 | 395.56 ms(estimated from 988.9M cycles @ 2.5 GHz) | 1.54 ms(estimated from 3.8M cycles @ 2.5 GHz) | Hash-based |
| SPHINCS-alpha | Symmetric | On-ramp R1 | 128s SHAKE | 1 | 32 | 6,880 | 6,912 | 455.90 ms(estimated from 1.14G cycles @ 2.5 GHz) | 1.96 ms(estimated from 4.9M cycles @ 2.5 GHz) | Hash-based |
| SPHINCS-alpha | Symmetric | On-ramp R1 | 128f SHA2 | 1 | 32 | 16,720 | 16,752 | 10.65 ms(estimated from 26.6M cycles @ 2.5 GHz) | 811.3 µs(estimated from 2.0M cycles @ 2.5 GHz) | Hash-based |
| SPHINCS-alpha | Symmetric | On-ramp R1 | 128s SHA2 | 1 | 32 | 6,880 | 6,912 | 214.81 ms(estimated from 537.0M cycles @ 2.5 GHz) | 1.08 ms(estimated from 2.7M cycles @ 2.5 GHz) | Hash-based |
| SQIsign | Isogenies | On-ramp R3 | V | 5 | 169 | 406 | 575 | 208.06 ms | 20.05 ms | Isogenies |
| SQIsign | Isogenies | On-ramp R3 | III | 3 | 129 | 306 | 435 | 87.30 ms | 8.20 ms | Isogenies |
| SQIsign | Isogenies | On-ramp R3 | I | 1 | 83 | 200 | 283 | 24.65 ms | 3.15 ms | Isogenies |
| Squirrels | Lattices | On-ramp R1 | V | 5 | 2,786,580 | 2,025 | 2,788,605 | 4.27 ms(estimated from 10.7M cycles @ 2.5 GHz) | 192.8 µs(estimated from 482K cycles @ 2.5 GHz) | SIS |
| Squirrels | Lattices | On-ramp R1 | VI | 4 | 1,888,700 | 1,676 | 1,890,376 | 3.64 ms(estimated from 9.1M cycles @ 2.5 GHz) | 131.6 µs(estimated from 329K cycles @ 2.5 GHz) | SIS |
| Squirrels | Lattices | On-ramp R1 | III | 3 | 1,629,640 | 1,554 | 1,631,194 | 2.86 ms(estimated from 7.1M cycles @ 2.5 GHz) | 115.2 µs(estimated from 288K cycles @ 2.5 GHz) | SIS |
| Squirrels | Lattices | On-ramp R1 | II | 2 | 874,576 | 1,147 | 875,723 | 1.49 ms(estimated from 3.7M cycles @ 2.5 GHz) | 64.0 µs(estimated from 160K cycles @ 2.5 GHz) | SIS |
| Squirrels | Lattices | On-ramp R1 | I | 1 | 681,780 | 1,019 | 682,799 | 1.27 ms(estimated from 3.2M cycles @ 2.5 GHz) | 58.1 µs(estimated from 145K cycles @ 2.5 GHz) | SIS |
| TUOV | Multivariate | On-ramp R1 | V | 5 | 442,384 | 244 | 442,628 | 453.6 µs(estimated from 1.1M cycles @ 2.5 GHz) | 1.81 ms(estimated from 4.5M cycles @ 2.5 GHz) | UOV |
| TUOV | Multivariate | On-ramp R1 | III | 3 | 186,640 | 184 | 186,824 | 243.4 µs(estimated from 609K cycles @ 2.5 GHz) | 765.6 µs(estimated from 1.9M cycles @ 2.5 GHz) | UOV |
| TUOV | Multivariate | On-ramp R1 | Is | 1 | 65,552 | 80 | 65,632 | 109.0 µs(estimated from 272K cycles @ 2.5 GHz) | 228.1 µs(estimated from 570K cycles @ 2.5 GHz) | UOV |
| TUOV | Multivariate | On-ramp R1 | Ip | 1 | 42,608 | 112 | 42,720 | 88.3 µs(estimated from 221K cycles @ 2.5 GHz) | 196.4 µs(estimated from 491K cycles @ 2.5 GHz) | UOV |
| UOV | Multivariate | On-ramp R3 | V-pkc | 5 | 446,992 | 275 | 447,267 | 114.0 µs | 408.9 µs | UOV |
| UOV | Multivariate | On-ramp R3 | V-classic | 5 | 3,232,320 | 275 | 3,232,595 | 113.8 µs | 130.2 µs | UOV |
| UOV | Multivariate | On-ramp R3 | III-pkc | 3 | 189,232 | 209 | 189,441 | 39.7 µs | 173.6 µs | UOV |
| UOV | Multivariate | On-ramp R3 | III-classic | 3 | 1,347,912 | 209 | 1,348,121 | 40.1 µs | 58.1 µs | UOV |
| UOV | Multivariate | On-ramp R3 | Is-pkc | 1 | 66,576 | 96 | 66,672 | 17.5 µs | 48.3 µs | UOV |
| UOV | Multivariate | On-ramp R3 | Is-classic | 1 | 412,160 | 96 | 412,256 | 17.3 µs | 12.5 µs | UOV |
| UOV | Multivariate | On-ramp R3 | Ip-pkc | 1 | 46,591 | 135 | 46,726 | 14.2 µs | 43.8 µs | UOV |
| UOV | Multivariate | On-ramp R3 | Ip-classic | 1 | 321,300 | 135 | 321,435 | 14.2 µs | 16.7 µs | UOV |
| VOX | Multivariate | On-ramp R1 | 256 | 5 | 82,400 | 300 | 82,700 | 4.84 ms(estimated from 12.1M cycles @ 2.5 GHz) | 634.2 µs(estimated from 1.6M cycles @ 2.5 GHz) | UOV |
| VOX | Multivariate | On-ramp R1 | 192 | 3 | 30,351 | 184 | 30,535 | 1.08 ms(estimated from 2.7M cycles @ 2.5 GHz) | 285.6 µs(estimated from 714K cycles @ 2.5 GHz) | UOV |
| VOX | Multivariate | On-ramp R1 | 128 | 1 | 9,104 | 102 | 9,206 | 265.7 µs(estimated from 664K cycles @ 2.5 GHz) | 67.4 µs(estimated from 169K cycles @ 2.5 GHz) | UOV |
| Wave | Code-based | On-ramp R1 | 1644 | 5 | 13,632,308 | 1,644 | 13,633,952 | 2.96 s(estimated from 7.40G cycles @ 2.5 GHz) | 325.32 ms(estimated from 813.3M cycles @ 2.5 GHz) | Coding Theory |
| Wave | Code-based | On-ramp R1 | 1249 | 3 | 7,867,598 | 1,249 | 7,868,847 | 1.40 s(estimated from 3.51G cycles @ 2.5 GHz) | 185.64 ms(estimated from 464.1M cycles @ 2.5 GHz) | Coding Theory |
| Wave | Code-based | On-ramp R1 | 822 | 1 | 3,677,390 | 822 | 3,678,212 | 464.40 ms(estimated from 1.16G cycles @ 2.5 GHz) | 82.32 ms(estimated from 205.8M cycles @ 2.5 GHz) | Coding Theory |
| Xifrat1-Sign.I | Other | On-ramp R1 | I | 3 | 288 | 96 | 384 | 20.00 ms | 60.00 ms | Randomized Abelian Quasigroups |
283 parameter sets
Legend pre-quantumbroken schemeimplementation findingssecurity warningnote value estimated from cycle counts at 2.5 GHz — not yet benchmarked timeout / DNF benchmark did not finish (too slow / failed) no code: no implementation to benchmark Select an icon for details