Advanced Graph

Customise axes to compare schemes on any combination of size and performance dimensions.

pk size vs. sig size (log–log scale)

X axis

Y axis

Scroll to zoom · drag to pan· tap a point for details

		Programmes								Assumption
Aigis-Sig+	Lattices	NGCC R1	Aigis-Sig+-I	128-bit	928	2,015	2,943	400.8 µs	128.1 µs	MLWE/MSIS

Aigis-Sig+	Lattices	NGCC R1	Aigis-Sig+-II	256-bit	1,824	4,533	6,357	921.2 µs	452.1 µs	MLWE/MSIS

Aigis-Sig+	Lattices	NGCC R1	Aigis-Sig+-III	512-bit	4,672	9,134	13,806	3.36 ms	1.61 ms	MLWE/MSIS

AIMer	Symmetric	KpqC selected	AIMer-128f	1	32	6,944	6,976	1.18 ms	1.07 ms	AIM

AIMer	Symmetric	KpqC selected	AIMer-128s	1	32	4,704	4,736	9.14 ms	9.10 ms	AIM

AIMer	Symmetric	KpqC selected	AIMer-192f	3	48	15,408	15,456	3.81 ms	3.53 ms	AIM

AIMer	Symmetric	KpqC selected	AIMer-192s	3	48	10,320	10,368	29.08 ms	29.12 ms	AIM

AIMer	Symmetric	KpqC selected	AIMer-256f	5	64	31,360	31,424	8.00 ms	7.07 ms	AIM

AIMer	Symmetric	KpqC selected	AIMer-256s	5	64	20,224	20,288	59.58 ms	57.06 ms	AIM

BiT	Lattices	NGCC R1	BiT-128	128-bit	1,048	1,504	2,552	324.8 µs	95.0 µs	MLWE/MSIS

BiT	Lattices	NGCC R1	BiT-256	256-bit	2,144	3,456	5,600	582.7 µs	308.5 µs	MLWE/MSIS
BiT	Lattices	NGCC R1	BiT-512	512-bit	5,056	6,695	11,751	2.23 ms	903.8 µs	MLWE/MSIS

BiT	Lattices	NGCC R1	BiT-384	384-bit	2,435	5,251	7,686	no code(No implementation in the submission package)	no code(No implementation in the submission package)	MLWE/MSIS
CEDRUS+C	Symmetric	NGCC R1	CEDRUSC-160s	128-bit	40	9,460	9,500	2.37 s	5.89 ms	Hash-based

CEDRUS+C	Symmetric	NGCC R1	CEDRUSC-160f	128-bit	40	19,812	19,852	141.75 ms	4.33 ms	Hash-based

CEDRUS+C	Symmetric	NGCC R1	CEDRUSC-256s	256-bit	64	24,104	24,168	3.54 s	9.80 ms	Hash-based

CEDRUS+C	Symmetric	NGCC R1	CEDRUSC-256f	256-bit	64	43,548	43,612	344.87 ms	5.95 ms	Hash-based

CEDRUS+C	Symmetric	NGCC R1	CEDRUSC-384s	384-bit	96	61,572	61,668	13.19 s	15.07 ms	Hash-based

CEDRUS+C	Symmetric	NGCC R1	CEDRUSC-384f	384-bit	96	75,988	76,084	3.46 s	35.55 ms	Hash-based

CEDRUS+C	Symmetric	NGCC R1	CEDRUSC-512s	512-bit	128	98,212	98,340	23.90 s	32.59 ms	Hash-based

CEDRUS+C	Symmetric	NGCC R1	CEDRUSC-512f	512-bit	128	121,520	121,648	6.94 s	44.31 ms	Hash-based

CEDRUSɑ	Symmetric	NGCC R1	CEDRUSALPHA-160s	128-bit	40	10,300	10,340	2.16 s	5.34 ms	Hash-based

CEDRUSɑ	Symmetric	NGCC R1	CEDRUSALPHA-160f	128-bit	40	19,420	19,460	158.54 ms	4.94 ms	Hash-based

CEDRUSɑ	Symmetric	NGCC R1	CEDRUSALPHA-256s	256-bit	64	25,568	25,632	3.36 s	8.15 ms	Hash-based
CEDRUSɑ	Symmetric	NGCC R1	CEDRUSALPHA-256f	256-bit	64	43,296	43,360	375.64 ms	6.71 ms	Hash-based
CEDRUSɑ	Symmetric	NGCC R1	CEDRUSALPHA-384s	384-bit	96	60,672	60,768	12.44 s	19.22 ms	Hash-based
CEDRUSɑ	Symmetric	NGCC R1	CEDRUSALPHA-384f	384-bit	96	76,176	76,272	3.49 s	34.73 ms	Hash-based
CEDRUSɑ	Symmetric	NGCC R1	CEDRUSALPHA-512s	512-bit	128	98,048	98,176	24.94 s	36.14 ms	Hash-based
CEDRUSɑ	Symmetric	NGCC R1	CEDRUSALPHA-512f	512-bit	128	127,488	127,616	5.88 s	40.99 ms	Hash-based
Chinith	Symmetric	NGCC R1	sm4th_d3_128f_loose	128-bit	32	6,724	6,756	4.23 ms	3.88 ms	Block-cipher OWF

Chinith	Symmetric	NGCC R1	sm4th_d3_128f_tight	128-bit	32	11,864	11,896	4.83 ms	4.39 ms	Block-cipher OWF

Chinith	Symmetric	NGCC R1	sm4th_d3_128s_loose	128-bit	32	5,056	5,088	30.23 ms	26.84 ms	Block-cipher OWF

Chinith	Symmetric	NGCC R1	sm4th_d3_128s_tight	128-bit	32	9,176	9,208	33.67 ms	30.77 ms	Block-cipher OWF

Chinith	Symmetric	NGCC R1	sm4th_em_d2_128f_loose	128-bit	32	4,932	4,964	3.88 ms	3.68 ms	Block-cipher OWF

Chinith	Symmetric	NGCC R1	sm4th_em_d2_128f_tight	128-bit	32	9,450	9,482	4.05 ms	3.81 ms	Block-cipher OWF

Chinith	Symmetric	NGCC R1	sm4th_em_d2_128s_loose	128-bit	32	3,818	3,850	28.65 ms	26.13 ms	Block-cipher OWF

Chinith	Symmetric	NGCC R1	sm4th_em_d2_128s_tight	128-bit	32	7,556	7,588	31.31 ms	29.39 ms	Block-cipher OWF

Chinith	Symmetric	NGCC R1	ublockith_d3_256f	256-bit	64	31,556	31,620	11.81 ms	11.34 ms	Block-cipher OWF

Chinith	Symmetric	NGCC R1	ublockith_d3_256s	256-bit	64	24,144	24,208	88.74 ms	86.12 ms	Block-cipher OWF

Chinith	Symmetric	NGCC R1	ublockith_em_d3_256f	256-bit	64	25,028	25,092	10.73 ms	10.23 ms	Block-cipher OWF

Chinith	Symmetric	NGCC R1	ublockith_em_d3_256s	256-bit	64	19,056	19,120	83.81 ms	78.41 ms	Block-cipher OWF

Chinith	Symmetric	NGCC R1	vistrutith_d3_512f	512-bit	128	106,788	106,916	49.26 ms	45.71 ms	Block-cipher OWF

Chinith	Symmetric	NGCC R1	vistrutith_d3_512s	512-bit	128	83,004	83,132	332.56 ms	323.86 ms	Block-cipher OWF

COMPASS-SIG	Lattices	NGCC R1	COMPASS-SIG-128	128-bit	1,664	2,080	3,744	663.5 µs	382.0 µs	MLWE/Shell-MISIS
COMPASS-SIG	Lattices	NGCC R1	COMPASS-SIG-256	256-bit	3,616	4,080	7,696	1.91 ms	1.42 ms	MLWE/Shell-MISIS

COMPASS-SIG	Lattices	NGCC R1	COMPASS-SIG-384	384-bit	5,792	7,344	13,136	1.56 ms	968.4 µs	MLWE/Shell-MISIS

COMPASS-SIG	Lattices	NGCC R1	COMPASS-SIG-512	512-bit	7,648	9,024	16,672	2.29 ms	1.53 ms	MLWE/Shell-MISIS

CS	Lattices	NGCC R1	CS-128	128-bit	976	1,548	2,524	722.0 µs	154.4 µs	MLWE/MSIS

CS	Lattices	NGCC R1	CS-256	256-bit	1,760	3,164	4,924	3.01 ms	289.0 µs	MLWE/MSIS

CS	Lattices	NGCC R1	CS-512	512-bit	4,288	5,975	10,263	11.14 ms	946.0 µs	MLWE/MSIS

DARTS	Lattices	NGCC R1	DARTS128	128-bit	1,120	1,449	2,569	3.00 ms	79.9 µs	MLWE/MSIS

DARTS	Lattices	NGCC R1	DARTS256	256-bit	2,208	2,489	4,697	5.07 ms	204.3 µs	MLWE/MSIS
DARTS	Lattices	NGCC R1	DARTS512	512-bit	4,672	5,851	10,523	5.19 ms	404.0 µs	MLWE/MSIS

DOVE	Multivariate	NGCC R1	dove_classic_128	128-bit	191,646	136	191,782	212.3 µs	346.8 µs	UOV
DOVE	Multivariate	NGCC R1	dove_classic_256	256-bit	2,050,352	296	2,050,648	1.42 ms	1.79 ms	UOV
DOVE	Multivariate	NGCC R1	dove_classic_512	512-bit	22,833,052	648	22,833,700	17.39 ms	23.21 ms	UOV
DOVE	Multivariate	NGCC R1	dove_pkc_skc_128	128-bit	43,576	136	43,712	2.48 ms	2.22 ms	UOV
DOVE	Multivariate	NGCC R1	dove_pkc_skc_256	256-bit	446,992	296	447,288	24.04 ms	22.19 ms	UOV
DOVE	Multivariate	NGCC R1	dove_pkc_skc_512	512-bit	5,062,192	648	5,062,840	272.48 ms	245.21 ms	UOV
ECDSA	Pre-Quantum	Classic	P-256	Pre-quantum	65	72	137	22.7 µs	63.2 µs	Elliptic Curves

ECDSA	Pre-Quantum	Classic	P-384	Pre-quantum	97	104	201	147.2 µs	328.7 µs	Elliptic Curves

ECDSA	Pre-Quantum	Classic	P-521	Pre-quantum	133	139	272	194.3 µs	365.0 µs	Elliptic Curves

EdDSA	Pre-Quantum	Classic	Ed25519	Pre-quantum	32	64	96	33.6 µs	88.6 µs	Elliptic Curves

EdDSA	Pre-Quantum	Classic	Ed448	Pre-quantum	57	114	171	144.7 µs	168.5 µs	Elliptic Curves

Facto-DSA	Other	NGCC R1	Facto-DSA-128	128-bit	40,040	40	40,080	283.1 µs	245.3 µs	Cubic factorisation

Facto-DSA	Other	NGCC R1	Facto-DSA-256	256-bit	456,960	68	457,028	1.03 ms	2.73 ms	Cubic factorisation
Facto-DSA	Other	NGCC R1	Facto-DSA-512	512-bit	5,674,240	128	5,674,368	50.87 ms	38.18 ms	Cubic factorisation

FAEST	Symmetric	On-ramp R3	128s	1	32	4,066	4,098	2.94 ms	2.57 ms	AES
FAEST	Symmetric	On-ramp R3	128f	1	32	5,170	5,202	399.7 µs	290.2 µs	AES
FAEST	Symmetric	On-ramp R3	192s	3	48	9,410	9,458	11.45 ms	9.89 ms	AES
FAEST	Symmetric	On-ramp R3	192f	3	48	11,738	11,786	1.80 ms	1.50 ms	AES
FAEST	Symmetric	On-ramp R3	256s	5	48	16,626	16,674	16.04 ms	15.69 ms	AES
FAEST	Symmetric	On-ramp R3	256f	5	48	20,856	20,904	2.57 ms	2.13 ms	AES
Falcon	Lattices	Std pending	1024	5	1,793	1,280	3,073	1.03 ms	23.4 µs	NTRU-SIS

Falcon	Lattices	Std pending	512	1	897	666	1,563	490.8 µs	13.5 µs	NTRU-SIS

FlexTree	Symmetric	NGCC R1	Flextree-160s	128-bit	40	9,580	9,620	2.31 s	6.03 ms	Hash-based

FlexTree	Symmetric	NGCC R1	Flextree-160f	128-bit	40	18,672	18,712	153.26 ms	4.37 ms	Hash-based

FlexTree	Symmetric	NGCC R1	Flextree-256s	256-bit	64	25,420	25,484	2.56 s	11.04 ms	Hash-based

FlexTree	Symmetric	NGCC R1	Flextree-256f	256-bit	64	46,856	46,920	269.36 ms	7.14 ms	Hash-based

FlexTree	Symmetric	NGCC R1	Flextree-384s	384-bit	96	60,180	60,276	12.36 s	15.29 ms	Hash-based

FlexTree	Symmetric	NGCC R1	Flextree-384f	384-bit	96	73,396	73,492	3.46 s	35.49 ms	Hash-based

FlexTree	Symmetric	NGCC R1	Flextree-512s	512-bit	128	94,948	95,076	23.82 s	33.25 ms	Hash-based

FlexTree	Symmetric	NGCC R1	Flextree-512f	512-bit	128	117,296	117,424	6.98 s	44.68 ms	Hash-based

Galas	Symmetric	NGCC R1	Galas-160S	128-bit	40	4,812	4,852	574.00 ms	408.55 ms	Gala OWF

Galas	Symmetric	NGCC R1	Galas-160F	128-bit	40	5,964	6,004	441.12 ms	285.33 ms	Gala OWF

Galas	Symmetric	NGCC R1	Galas-256S	256-bit	64	12,114	12,178	2.93 s	2.27 s	Gala OWF

Galas	Symmetric	NGCC R1	Galas-256F	256-bit	64	15,950	16,014	1.80 s	1.15 s	Gala OWF

Galas	Symmetric	NGCC R1	Galas-384S	384-bit	96	27,784	27,880	8.92 s	6.49 s	Gala OWF

Galas	Symmetric	NGCC R1	Galas-384F	384-bit	96	33,384	33,480	6.60 s	4.17 s	Gala OWF

Galas	Symmetric	NGCC R1	Galas-512S	512-bit	128	49,516	49,644	21.11 s	14.69 s	Gala OWF

Galas	Symmetric	NGCC R1	Galas-512F	512-bit	128	59,416	59,544	16.59 s	10.19 s	Gala OWF

GreatWall	Symmetric	NGCC R1	GreatWall192f	128-bit	50	8,012	8,062	2.82 ms	3.64 ms	Pylon OWF
GreatWall	Symmetric	NGCC R1	GreatWall192s	128-bit	50	6,804	6,854	11.22 ms	26.07 ms	Pylon OWF
GreatWall	Symmetric	NGCC R1	GreatWall256f	256-bit	66	14,260	14,326	5.17 ms	6.12 ms	Pylon OWF
GreatWall	Symmetric	NGCC R1	GreatWall256s	256-bit	66	12,236	12,302	17.82 ms	36.00 ms	Pylon OWF
GreatWall	Symmetric	NGCC R1	GreatWall512f	512-bit	132	57,812	57,944	80.80 ms	84.18 ms	Pylon OWF

GreatWall	Symmetric	NGCC R1	GreatWall512s	512-bit	132	50,012	50,144	324.39 ms	522.23 ms	Pylon OWF

HAETAE	Lattices	KpqC selected	HAETAE-2	2	992	1,474	2,466	1.45 ms	41.1 µs	MLWE/MSIS

HAETAE	Lattices	KpqC selected	HAETAE-3	3	1,472	2,349	3,821	1.77 ms	69.1 µs	MLWE/MSIS

HAETAE	Lattices	KpqC selected	HAETAE-5	5	2,080	2,948	5,028	2.21 ms	82.9 µs	MLWE/MSIS

HAWK	Lattices	On-ramp R3	1024	5	2,440	1,221	3,661	29.9 µs	47.7 µs	Lattice Isomorphism

HAWK	Lattices	On-ramp R3	512	1	1,024	555	1,579	14.8 µs	23.6 µs	Lattice Isomorphism

Lynxer	Symmetric	NGCC R1	Lynxer-160s	128-bit	40	4,607	4,647	19.81 ms	16.94 ms	Lynx OWF
Lynxer	Symmetric	NGCC R1	Lynxer-160f	128-bit	40	5,801	5,841	2.64 ms	2.38 ms	Lynx OWF
Lynxer	Symmetric	NGCC R1	Lynxer-256s	256-bit	64	12,191	12,255	54.80 ms	45.34 ms	Lynx OWF

Lynxer	Symmetric	NGCC R1	Lynxer-256f	256-bit	64	15,097	15,161	6.05 ms	5.63 ms	Lynx OWF

Lynxer	Symmetric	NGCC R1	Lynxer-384s	384-bit	96	27,495	27,591	218.22 ms	143.92 ms	Lynx OWF

Lynxer	Symmetric	NGCC R1	Lynxer-384f	384-bit	96	34,109	34,205	20.75 ms	18.62 ms	Lynx OWF

Lynxer	Symmetric	NGCC R1	Lynxer-512s	512-bit	128	48,879	49,007	5.95 s	5.30 s	Lynx OWF

Lynxer	Symmetric	NGCC R1	Lynxer-512f	512-bit	128	61,091	61,219	589.27 ms	525.90 ms	Lynx OWF

MAYO	Multivariate	On-ramp R3	five	5	5,554	964	6,518	216.0 µs	89.9 µs	Multivariate Quadratic
MAYO	Multivariate	On-ramp R3	three	3	2,986	681	3,667	98.4 µs	41.2 µs	Multivariate Quadratic
MAYO	Multivariate	On-ramp R3	two	1	2,928	239	3,167	29.2 µs	12.2 µs	Multivariate Quadratic

MAYO	Multivariate	On-ramp R3	one	1	1,456	464	1,920	48.3 µs	20.1 µs	Multivariate Quadratic

ML-DSA	Lattices	FIPS 204	ML-DSA-87	5	2,592	4,627	7,219	93.1 µs	52.0 µs	MLWE/MSIS
ML-DSA	Lattices	FIPS 204	ML-DSA-65	3	1,952	3,309	5,261	73.3 µs	33.5 µs	MLWE/MSIS
ML-DSA	Lattices	FIPS 204	ML-DSA-44	2	1,312	2,420	3,732	50.2 µs	20.9 µs	MLWE/MSIS
MORNING-ATLAS	Lattices	NGCC R1	lwrdsa128	128-bit	1,328	2,081	3,409	1.25 ms	685.5 µs	MLWR/MSIS

MORNING-ATLAS	Lattices	NGCC R1	lwrdsa256	256-bit	2,848	4,656	7,504	1.52 ms	854.2 µs	MLWR/MSIS

MORNING-ATLAS	Lattices	NGCC R1	lwrdsa512	512-bit	6,688	10,081	16,769	4.21 ms	2.49 ms	MLWR/MSIS

MQOM	MPCitH	On-ramp R3	L1-gf2-shorter-ct	1	52	2,492	2,544	2.46 ms	1.23 ms	Multivariate Quadratic
MQOM	MPCitH	On-ramp R3	L1-gf2-shorter-ot	1	52	2,492	2,544	3.47 ms	3.35 ms	Multivariate Quadratic
MQOM	MPCitH	On-ramp R3	L1-gf16-short-ct	1	64	2,932	2,996	634.3 µs	612.2 µs	Multivariate Quadratic
MQOM	MPCitH	On-ramp R3	L1-gf16-short-ot	1	64	2,932	2,996	852.1 µs	857.2 µs	Multivariate Quadratic
MQOM	MPCitH	On-ramp R3	L1-gf16-fast-ct	1	64	3,316	3,380	236.5 µs	226.7 µs	Multivariate Quadratic
MQOM	MPCitH	On-ramp R3	L1-gf16-fast-ot	1	64	3,316	3,380	293.9 µs	274.9 µs	Multivariate Quadratic
MQOM	MPCitH	On-ramp R3	L3-gf2-shorter-ct	3	78	5,932	6,010	7.24 ms	6.04 ms	Multivariate Quadratic
MQOM	MPCitH	On-ramp R3	L3-gf2-shorter-ot	3	78	5,890	5,968	9.70 ms	8.72 ms	Multivariate Quadratic
MQOM	MPCitH	On-ramp R3	L3-gf16-short-ct	3	96	6,556	6,652	3.72 ms	3.45 ms	Multivariate Quadratic
MQOM	MPCitH	On-ramp R3	L3-gf16-short-ot	3	96	6,556	6,652	5.25 ms	4.86 ms	Multivariate Quadratic
MQOM	MPCitH	On-ramp R3	L3-gf16-fast-ct	3	96	7,564	7,660	1.10 ms	1.07 ms	Multivariate Quadratic
MQOM	MPCitH	On-ramp R3	L3-gf16-fast-ot	3	96	7,660	7,756	1.29 ms	1.27 ms	Multivariate Quadratic
MQOM	MPCitH	On-ramp R3	L5-gf2-shorter-ct	5	104	10,836	10,940	10.86 ms	10.12 ms	Multivariate Quadratic
MQOM	MPCitH	On-ramp R3	L5-gf2-shorter-ot	5	104	10,804	10,908	13.09 ms	12.87 ms	Multivariate Quadratic
MQOM	MPCitH	On-ramp R3	L5-gf16-short-ct	5	128	12,100	12,228	4.63 ms	4.37 ms	Multivariate Quadratic
MQOM	MPCitH	On-ramp R3	L5-gf16-short-ot	5	128	11,716	11,844	6.08 ms	5.87 ms	Multivariate Quadratic
MQOM	MPCitH	On-ramp R3	L5-gf16-fast-ct	5	128	13,540	13,668	1.88 ms	1.77 ms	Multivariate Quadratic
MQOM	MPCitH	On-ramp R3	L5-gf16-fast-ot	5	128	13,380	13,508	2.37 ms	2.01 ms	Multivariate Quadratic
Octarine	Lattices	NGCC R1	Octarine-128	128-bit	1,344	2,564	3,908	317.1 µs	138.4 µs	RR-LWR/RR-MSIS
Octarine	Lattices	NGCC R1	Octarine-256	256-bit	2,368	5,449	7,817	647.0 µs	263.1 µs	RR-LWR/RR-MSIS
Octarine	Lattices	NGCC R1	Octarine-512	512-bit	5,184	14,713	19,897	1.72 ms	640.2 µs	RR-LWR/RR-MSIS
OPS-DSA	Lattices	NGCC R1	OPSsig-128	128-bit	2,560	4,349	6,909	371.9 µs	263.2 µs	MLWE/MSIS

OPS-DSA	Lattices	NGCC R1	OPSsig-256	256-bit	3,392	5,540	8,932	484.6 µs	347.9 µs	MLWE/MSIS

OPS-DSA	Lattices	NGCC R1	OPSsig-512	512-bit	6,720	12,021	18,741	996.8 µs	701.6 µs	MLWE/MSIS

Origami	Multivariate	NGCC R1	Origami-128	128-bit	2,996	116	3,112	7.76 ms	6.95 ms	Multivariate Quadratic

Origami	Multivariate	NGCC R1	Origami-256	256-bit	14,968	516	15,484	388.39 ms	375.51 ms	Multivariate Quadratic

Origami	Multivariate	NGCC R1	Origami-384	384-bit	27,940	948	28,888	1.85 s	1.78 s	Multivariate Quadratic

Origami	Multivariate	NGCC R1	Origami-512	512-bit	35,924	1,220	37,144	3.51 s	3.28 s	Multivariate Quadratic

Phoenix	Symmetric	NGCC R1	Phoenix-SHAKE-192s	128-bit	48	13,332	13,380	230.52 ms	4.00 ms	Hash-based
Phoenix	Symmetric	NGCC R1	Phoenix-SHAKE-192f	128-bit	48	30,766	30,814	56.15 ms	1.57 ms	Hash-based
Phoenix	Symmetric	NGCC R1	Phoenix-SHAKE-256s	256-bit	64	24,618	24,682	1.02 s	6.87 ms	Hash-based
Phoenix	Symmetric	NGCC R1	Phoenix-SHAKE-256f	256-bit	64	44,906	44,970	22.91 ms	3.12 ms	Hash-based
Phoenix	Symmetric	NGCC R1	Phoenix-SHAKE-384s	384-bit	96	54,726	54,822	682.22 ms	11.85 ms	Hash-based
Phoenix	Symmetric	NGCC R1	Phoenix-SHAKE-384f	384-bit	96	88,442	88,538	149.68 ms	7.48 ms	Hash-based
Phoenix	Symmetric	NGCC R1	Phoenix-SHAKE-512s	512-bit	128	98,476	98,604	1.61 s	8.01 ms	Hash-based
Phoenix	Symmetric	NGCC R1	Phoenix-SHAKE-512f	512-bit	128	138,454	138,582	383.81 ms	25.32 ms	Hash-based
Phoenix	Symmetric	NGCC R1	Phoenix-SM3-192s	128-bit	48	13,332	13,380	3.02 s	10.40 ms	Hash-based

Phoenix	Symmetric	NGCC R1	Phoenix-SM3-192f	128-bit	48	30,766	30,814	152.71 ms	4.10 ms	Hash-based

Phoenix	Symmetric	NGCC R1	Phoenix-SM3-256s	256-bit	64	24,618	24,682	2.65 s	18.02 ms	Hash-based

Phoenix	Symmetric	NGCC R1	Phoenix-SM3-256f	256-bit	64	44,906	44,970	298.49 ms	8.04 ms	Hash-based

Phoenix	Symmetric	NGCC R1	Phoenix-SM3-384s	384-bit	96	54,726	54,822	4.45 s	28.50 ms	Hash-based

Phoenix	Symmetric	NGCC R1	Phoenix-SM3-384f	384-bit	96	88,442	88,538	947.17 ms	17.97 ms	Hash-based

Phoenix	Symmetric	NGCC R1	Phoenix-SM3-512s	512-bit	128	98,476	98,604	6.50 s	11.51 ms	Hash-based

Phoenix	Symmetric	NGCC R1	Phoenix-SM3-512f	512-bit	128	138,454	138,582	1.57 s	35.79 ms	Hash-based

Qing Luan	MPCitH	NGCC R1	QingLuan-128	128-bit	77	18,720	18,797	4.11 ms	1.85 ms	Restricted Synd. Dec.
Qing Luan	MPCitH	NGCC R1	QingLuan-256	256-bit	153	74,248	74,401	26.65 ms	12.06 ms	Restricted Synd. Dec.
Qing Luan	MPCitH	NGCC R1	QingLuan-384	384-bit	227	164,940	165,167	66.33 ms	30.88 ms	Restricted Synd. Dec.

Qing Luan	MPCitH	NGCC R1	QingLuan-512	512-bit	302	292,816	293,118	160.79 ms	74.19 ms	Restricted Synd. Dec.

QR-UOV	Multivariate	On-ramp R3	I-(127 156 54 3)	1	24,256	200	24,456	139.4 µs	77.5 µs	UOV
QR-UOV	Multivariate	On-ramp R3	I-(127 540 60 10)	1	11,041	541	11,582	665.3 µs	217.4 µs	UOV
QR-UOV	Multivariate	On-ramp R3	III-(127 228 78 3)	3	71,884	292	72,176	376.4 µs	218.7 µs	UOV
QR-UOV	Multivariate	On-ramp R3	III-(127 820 90 10)	3	35,454	821	36,275	2.16 ms	713.4 µs	UOV
QR-UOV	Multivariate	On-ramp R3	V-(127 306 105 3)	5	173,660	392	174,052	885.8 µs	523.4 µs	UOV
QR-UOV	Multivariate	On-ramp R3	V-(127 1040 110 10)	5	63,541	1,039	64,580	3.82 ms	1.33 ms	UOV
ReSolveD-ɑ	MPCitH	NGCC R1	ReSolveD-alpha-160s	128-bit	121	5,307	5,428	21.96 ms	17.18 ms	Regular Synd. Dec.
ReSolveD-ɑ	MPCitH	NGCC R1	ReSolveD-alpha-160f	128-bit	121	6,851	6,972	4.42 ms	2.33 ms	Regular Synd. Dec.
ReSolveD-ɑ	MPCitH	NGCC R1	ReSolveD-alpha-256s	256-bit	194	13,973	14,167	59.90 ms	44.39 ms	Regular Synd. Dec.

ReSolveD-ɑ	MPCitH	NGCC R1	ReSolveD-alpha-256f	256-bit	194	17,932	18,126	10.00 ms	5.09 ms	Regular Synd. Dec.

ReSolveD-ɑ	MPCitH	NGCC R1	ReSolveD-alpha-384s	384-bit	288	31,575	31,863	237.94 ms	143.44 ms	Regular Synd. Dec.

ReSolveD-ɑ	MPCitH	NGCC R1	ReSolveD-alpha-384f	384-bit	288	40,469	40,757	31.29 ms	18.07 ms	Regular Synd. Dec.

ReSolveD-ɑ	MPCitH	NGCC R1	ReSolveD-alpha-512s	512-bit	385	56,239	56,624	7.52 s	6.84 s	Regular Synd. Dec.

ReSolveD-ɑ	MPCitH	NGCC R1	ReSolveD-alpha-512f	512-bit	385	72,611	72,996	765.93 ms	676.14 ms	Regular Synd. Dec.

Rhyme	Lattices	NGCC R1	Rhyme-SM3-128	128-bit	800	5,156	5,956	933.2 µs	119.6 µs	GA-MLWE/MSIS

Rhyme	Lattices	NGCC R1	Rhyme-SM3-256	256-bit	1,824	10,308	12,132	1.84 ms	192.9 µs	GA-MLWE/MSIS

Rhyme	Lattices	NGCC R1	Rhyme-SM3-384	384-bit	2,720	14,436	17,156	3.96 ms	374.5 µs	GA-MLWE/MSIS

Rhyme	Lattices	NGCC R1	Rhyme-SM3-512	512-bit	3,872	20,612	24,484	2.15 ms	406.1 µs	GA-MLWE/MSIS

Rhyme	Lattices	NGCC R1	Rhyme-SHAKE-128	128-bit	800	5,156	5,956	556.4 µs	49.2 µs	GA-MLWE/MSIS

Rhyme	Lattices	NGCC R1	Rhyme-SHAKE-256	256-bit	1,824	10,308	12,132	854.2 µs	188.9 µs	GA-MLWE/MSIS
Rhyme	Lattices	NGCC R1	Rhyme-SHAKE-384	384-bit	2,720	14,436	17,156	1.60 ms	240.1 µs	GA-MLWE/MSIS

Rhyme	Lattices	NGCC R1	Rhyme-SHAKE-512	512-bit	3,872	20,612	24,484	1.70 ms	323.8 µs	GA-MLWE/MSIS

RSA	Pre-Quantum	Classic	2048	Pre-quantum	272	256	528	493.5 µs	22.1 µs	Factoring

RSA	Pre-Quantum	Classic	3072	Pre-quantum	422	384	806	1.19 ms	42.8 µs	Factoring

RSA	Pre-Quantum	Classic	4096	Pre-quantum	550	512	1,062	2.24 ms	70.5 µs	Factoring

SDitH	MPCitH	On-ramp R3	SDitH3-L1-gf2-short	1	70	3,721	3,791	2.12 ms	1.92 ms	Synd. Dec.
SDitH	MPCitH	On-ramp R3	SDitH3-L1-gf2-fast	1	70	4,914	4,984	454.8 µs	399.7 µs	Synd. Dec.
SDitH	MPCitH	On-ramp R3	SDitH3-L3-gf2-short	3	98	8,484	8,582	8.96 ms	8.86 ms	Synd. Dec.
SDitH	MPCitH	On-ramp R3	SDitH3-L3-gf2-fast	3	98	10,852	10,950	2.08 ms	1.95 ms	Synd. Dec.
SDitH	MPCitH	On-ramp R3	SDitH3-L5-gf2-short	5	132	15,147	15,279	14.28 ms	14.12 ms	Synd. Dec.
SDitH	MPCitH	On-ramp R3	SDitH3-L5-gf2-fast	5	132	19,144	19,276	3.25 ms	3.07 ms	Synd. Dec.
Shuttle	Lattices	NGCC R1	SHUTTLE-128	128-bit	1,264	1,183	2,447	193.5 µs	77.7 µs	MLWE/MSIS

Shuttle	Lattices	NGCC R1	SHUTTLE-256	256-bit	1,952	2,417	4,369	303.0 µs	114.7 µs	MLWE/MSIS

Shuttle	Lattices	NGCC R1	SHUTTLE-512	512-bit	3,648	5,001	8,649	645.4 µs	197.9 µs	MLWE/MSIS

Sigurd	MPCitH	NGCC R1	Sigurd128	128-bit	112	62,868	62,980	9.77 ms	3.96 ms	Regular Synd. Dec.

Sigurd	MPCitH	NGCC R1	Sigurd256	256-bit	212	137,412	137,624	89.53 ms	32.16 ms	Regular Synd. Dec.

Sigurd	MPCitH	NGCC R1	Sigurd512	512-bit	435	494,532	494,967	824.97 ms	294.29 ms	Regular Synd. Dec.

SLH-DSA	Symmetric	FIPS 205	SHAKE-192s	3	48	16,224	16,272	1.02 s	842.4 µs	Hash-based
SLH-DSA	Symmetric	FIPS 205	SHAKE-256s	5	64	29,792	29,856	922.57 ms	1.25 ms	Hash-based
SLH-DSA	Symmetric	FIPS 205	SHAKE-128s	1	32	7,856	7,888	576.41 ms	575.6 µs	Hash-based
SLH-DSA	Symmetric	FIPS 205	SHAKE-256f	5	64	49,856	49,920	94.58 ms	2.49 ms	Hash-based
SLH-DSA	Symmetric	FIPS 205	SHAKE-192f	3	48	35,664	35,712	43.56 ms	2.32 ms	Hash-based
SLH-DSA	Symmetric	FIPS 205	SHAKE-128f	1	32	17,088	17,120	26.55 ms	1.58 ms	Hash-based
SNOVA	Multivariate	On-ramp R3	SNOVA_I_K	1	376	528	904	210.3 µs	64.9 µs	Non-comm. Ring UOV
SNOVA	Multivariate	On-ramp R3	SNOVA_I_B	1	656	388	1,044	209.7 µs	58.5 µs	Non-comm. Ring UOV
SNOVA	Multivariate	On-ramp R3	SNOVA_I_S	1	1,016	272	1,288	142.6 µs	47.6 µs	Non-comm. Ring UOV
SNOVA	Multivariate	On-ramp R3	SNOVA_III_K	3	912	688	1,600	439.4 µs	134.9 µs	Non-comm. Ring UOV
SNOVA	Multivariate	On-ramp R3	SNOVA_III_B	3	1,416	532	1,948	457.2 µs	135.6 µs	Non-comm. Ring UOV
SNOVA	Multivariate	On-ramp R3	SNOVA_III_S	3	2,032	456	2,488	515.3 µs	139.2 µs	Non-comm. Ring UOV
SNOVA	Multivariate	On-ramp R3	SNOVA_V_K	5	1,216	896	2,112	1.10 ms	261.1 µs	Non-comm. Ring UOV
SNOVA	Multivariate	On-ramp R3	SNOVA_V_B	5	1,891	691	2,582	1.10 ms	217.8 µs	Non-comm. Ring UOV
SNOVA	Multivariate	On-ramp R3	SNOVA_V_S	5	2,716	591	3,307	1.17 ms	209.0 µs	Non-comm. Ring UOV
SQIsign	Isogenies	On-ramp R3	V	5	169	406	575	208.06 ms	20.05 ms	Isogenies
SQIsign	Isogenies	On-ramp R3	III	3	129	306	435	87.30 ms	8.20 ms	Isogenies
SQIsign	Isogenies	On-ramp R3	I	1	83	200	283	24.65 ms	3.15 ms	Isogenies
SQIsign2D-push1/2	Isogenies	NGCC R1	SQIsign2D-lvl2	128-bit	96	218	314	312.83 ms	63.21 ms	Isogenies
SQIsign2D-push1/2	Isogenies	NGCC R1	SQIsign2D-lvl3	256-bit	128	293	421	714.25 ms	159.98 ms	Isogenies

SQIsign2D-push1/2	Isogenies	NGCC R1	SQIsign2D-lvl4	512-bit	262	593	855	7.32 s	1.73 s	Isogenies
SQIsign2D2	Isogenies	NGCC R1	SQISign2Dsquare-Level2-eff	128-bit	80	248	328	31.24 ms	6.30 ms	Isogenies

SQIsign2D2	Isogenies	NGCC R1	SQISign2Dsquare-Level2-sec	128-bit	84	260	344	37.50 ms	7.24 ms	Isogenies

SQIsign2D2	Isogenies	NGCC R1	SQISign2Dsquare-Level3-eff	256-bit	128	392	520	99.89 ms	20.58 ms	Isogenies

SQIsign2D2	Isogenies	NGCC R1	SQISign2Dsquare-Level3-sec	256-bit	132	404	536	119.66 ms	22.99 ms	Isogenies

SQIsign2D2	Isogenies	NGCC R1	SQISign2Dsquare-Level5-eff	512-bit	256	776	1,032	715.75 ms	124.86 ms	Isogenies

SQIsign2D2	Isogenies	NGCC R1	SQISign2Dsquare-Level5-sec	512-bit	268	812	1,080	782.47 ms	145.90 ms	Isogenies

SQIsignTriangle	Isogenies	NGCC R1	SQIsignTriangle_lvl2	128-bit	81	255	336	54.85 ms	11.76 ms	Isogenies

SQIsignTriangle	Isogenies	NGCC R1	SQIsignTriangle_lvl5	256-bit	129	408	537	214.99 ms	56.12 ms	Isogenies

SQIsignTriangle	Isogenies	NGCC R1	SQIsignTriangle_lvl6	512-bit	257	816	1,073	1.82 s	352.67 ms	Isogenies

SYDO	MPCitH	NGCC R1	sydo_160s	128-bit	80	5,428	5,508	21.39 ms	18.98 ms	Regular Synd. Dec.
SYDO	MPCitH	NGCC R1	sydo_160f	128-bit	80	6,724	6,804	4.14 ms	3.97 ms	Regular Synd. Dec.
SYDO	MPCitH	NGCC R1	sydo_256s	256-bit	128	14,444	14,572	47.08 ms	46.59 ms	Regular Synd. Dec.
SYDO	MPCitH	NGCC R1	sydo_256f	256-bit	128	17,604	17,732	9.64 ms	9.36 ms	Regular Synd. Dec.
SYDO	MPCitH	NGCC R1	sydo_512s	512-bit	246	56,672	56,918	360.77 ms	336.80 ms	Regular Synd. Dec.
SYDO	MPCitH	NGCC R1	sydo_512f	512-bit	246	67,716	67,962	69.12 ms	68.53 ms	Regular Synd. Dec.
Tins	MPCitH	NGCC R1	Tins128	128-bit	55	3,896	3,951	DNF(Benchmark did not finish (valid signature rejected))	DNF(Benchmark did not finish (valid signature rejected))	NSBC

Tins	MPCitH	NGCC R1	Tins256	256-bit	98	13,012	13,110	DNF(Benchmark did not finish (tampered signature accepted))	DNF(Benchmark did not finish (tampered signature accepted))	NSBC

Tins	MPCitH	NGCC R1	Tins512	512-bit	195	51,187	51,382	DNF(Benchmark did not finish (tampered signature accepted))	DNF(Benchmark did not finish (tampered signature accepted))	NSBC

TRINE	Other	NGCC R1	TRINE-128-Balanced	128-bit	16,004	3,156	19,160	7.84 s	5.28 s	Trilinear Form Equiv.

TRINE	Other	NGCC R1	TRINE-128-ShortSig	128-bit	63,920	1,652	65,572	3.83 s	1.55 s	Trilinear Form Equiv.

TRINE	Other	NGCC R1	TRINE-256-Balanced	256-bit	96,064	11,712	107,776	73.62 s	44.08 s	Trilinear Form Equiv.

TRINE	Other	NGCC R1	TRINE-256-ShortSig	256-bit	384,064	5,968	390,032	30.18 s	12.58 s	Trilinear Form Equiv.

TRINE	Other	NGCC R1	TRINE-512-Balanced	512-bit	797,290	46,565	843,855	timeout(Benchmark did not finish (operation over 600s))	timeout(Benchmark did not finish (operation over 600s))	Trilinear Form Equiv.

TRINE	Other	NGCC R1	TRINE-512-ShortSig	512-bit	3,188,776	23,672	3,212,448	488.76 s	196.96 s	Trilinear Form Equiv.

TSUOV	Multivariate	NGCC R1	TSUOV_128	128-bit	779	896	1,675	3.07 ms	2.91 ms	UOV

TSUOV	Multivariate	NGCC R1	TSUOV_256	256-bit	2,170	2,412	4,582	18.43 ms	17.98 ms	UOV

TSUOV	Multivariate	NGCC R1	TSUOV_512	512-bit	21,319	2,939	24,258	215.44 ms	227.93 ms	UOV

UOV	Multivariate	On-ramp R3	V-pkc	5	446,992	275	447,267	114.0 µs	408.9 µs	UOV
UOV	Multivariate	On-ramp R3	V-classic	5	3,232,320	275	3,232,595	113.8 µs	130.2 µs	UOV
UOV	Multivariate	On-ramp R3	III-pkc	3	189,232	209	189,441	39.7 µs	173.6 µs	UOV
UOV	Multivariate	On-ramp R3	III-classic	3	1,347,912	209	1,348,121	40.1 µs	58.1 µs	UOV
UOV	Multivariate	On-ramp R3	Is-pkc	1	66,576	96	66,672	17.5 µs	48.3 µs	UOV
UOV	Multivariate	On-ramp R3	Is-classic	1	412,160	96	412,256	17.3 µs	12.5 µs	UOV
UOV	Multivariate	On-ramp R3	Ip-pkc	1	46,591	135	46,726	14.2 µs	43.8 µs	UOV
UOV	Multivariate	On-ramp R3	Ip-classic	1	321,300	135	321,435	14.2 µs	16.7 µs	UOV
UVW signature	Code-based	NGCC R1	UVW-128	128-bit	5,897,612	1,244	5,898,856	2.83 s	94.18 ms	Synd. Dec. over F3

UVW signature	Code-based	NGCC R1	UVW-256	256-bit	23,040,012	2,444	23,042,456	32.87 s	588.83 ms	Synd. Dec. over F3

UVW signature	Code-based	NGCC R1	UVW-512	512-bit	95,160,012	4,956	95,164,968	timeout(Benchmark did not finish (timeout))	timeout(Benchmark did not finish (timeout))	Synd. Dec. over F3

VDOO	Multivariate	NGCC R1	VDOO-128	128-bit	330,855	85	330,940	51.19 ms	628.7 µs	UOV-type MQ

VDOO	Multivariate	NGCC R1	VDOO-256	256-bit	4,289,250	316	4,289,566	60.92 ms	840.2 µs	UOV-type MQ

VDOO	Multivariate	NGCC R1	VDOO-512	512-bit	20,229,300	471	20,229,771	327.67 ms	1.78 ms	UOV-type MQ

YuanYang.DSA	Lattices	NGCC R1	yuanyang-512	128-bit	738	561	1,299	1.29 ms	53.7 µs	NTRU/NTRU-SIS

YuanYang.DSA	Lattices	NGCC R1	yuanyang-1024	256-bit	1,570	1,150	2,720	2.43 ms	119.5 µs	NTRU/NTRU-SIS

YuanYang.DSA	Lattices	NGCC R1	yuanyang-2048	512-bit	3,330	2,364	5,694	4.93 ms	239.6 µs	NTRU/NTRU-SIS

270 parameter sets

Legend pre-quantumbroken schemeimplementation findingssecurity warningnote value estimated from cycle counts at 2.5 GHz — not yet benchmarked timeout / DNF benchmark did not finish (too slow / failed) no code: no implementation to benchmark Select an icon for details