libntruprime: Speed

In the following speed table, smaller keypair/enc/dec numbers are better. The numbers are interquartile means of single-core cycle counts on various microarchitectures. Overclocking is disabled.

μarch | KEM | keypair | enc | dec
--- | --- | --- | --- | ---
AMD Zen 4 (2022) | sntrup653 | 472498 | 43724 | 44631
| sntrup761 | 608120 | 48639 | 46445
| sntrup857 | 784562 | 57332 | 57644
| sntrup953 | 939743 | 61808 | 61349
| sntrup1013 | 1043922 | 64861 | 62977
| sntrup1277 | 1617255 | 81657 | 78140
Intel Golden Cove (2021) | sntrup653 | 594917 | 46239 | 46367
| sntrup761 | 771216 | 51385 | 47701
| sntrup857 | 969718 | 61253 | 61278
| sntrup953 | 1161906 | 65659 | 64860
| sntrup1013 | 1311768 | 68702 | 65903
| sntrup1277 | 1998523 | 87186 | 82694
AMD Zen 3 (2020) | sntrup653 | 600658 | 33212 | 47310
| sntrup761 | 845401 | 35836 | 49834
| sntrup857 | 1046895 | 43526 | 63892
| sntrup953 | 1314800 | 46219 | 66291
| sntrup1013 | 1360689 | 48195 | 70045
| sntrup1277 | 2280261 | 60056 | 85755
AMD Zen 2 (2019) | sntrup653 | 942426 | 38838 | 62292
| sntrup761 | 1273658 | 41695 | 65703
| sntrup857 | 1606572 | 51807 | 85816
| sntrup953 | 1959064 | 55008 | 89553
| sntrup1013 | 2201203 | 56717 | 92402
| sntrup1277 | 3457022 | 71125 | 113944
ARM Cortex-A72 (2016) | sntrup653 | 10996127 | 591430 | 1065501
| sntrup761 | 14495715 | 776809 | 1473851
| sntrup857 | 18303406 | 952167 | 1810466
| sntrup953 | 22735272 | 1142719 | 2225182
| sntrup1013 | 25426626 | 1246530 | 2457552
| sntrup1277 | 40968862 | 2041696 | 4202939
Intel Skylake (2015) | sntrup653 | 639907 | 37271 | 58228
| sntrup761 | 840180 | 41311 | 60983
| sntrup857 | 1073742 | 51265 | 79972
| sntrup953 | 1308756 | 54176 | 84599
| sntrup1013 | 1437568 | 56207 | 86531
| sntrup1277 | 2247072 | 69997 | 106453
Intel Haswell (2013) | sntrup653 | 754581 | 44675 | 68364
| sntrup761 | 949559 | 48431 | 70484
| sntrup857 | 1212954 | 60079 | 92129
| sntrup953 | 1560476 | 64166 | 96758
| sntrup1013 | 1610182 | 66102 | 100144
| sntrup1277 | 2685981 | 84125 | 126213

Microarchitectures are listed in reverse chronological order of when they were introduced.

In the libntruprime distribution, `command/ntruprime-speed.c` measures libntruprime; `benchmarks/*-*` is the output of `ntruprime-speed` on various machines; and `autogen/md-speed` extracts the table from those measurements.

The table reports only interquartile means of cycle counts, not the full distribution of cycle counts. See the full output files for differences between multiple measurements and the interquartile mean.

### Faster `sntrup` software

There has been extensive further work on `sntrup` software speeds beyond the current libntruprime speeds. libntruprime has a policy of limiting code size, but if there are applications that need these speedups then they can still be considered for inclusion in libntruprime:

- `mult3sntrup761/avx2unsigned` in SUPERCOP from Ming-Shing Chen: faster multiplications on Intel/AMD.

- `invsntrup761/jumpdivsteps` in SUPERCOP from Daniel J. Bernstein, Ming-Shing Chen, Gregor Seiler, and Bo-Yin Yang: faster inversions on Intel/AMD.

- "OpenSSLNTRU: Faster post-quantum TLS key exchange" from Daniel J. Bernstein, Billy Bob Brumley, Ming-Shing Chen, and Nicola Tuveri: faster inversions for batch operations.

- "Multi-Parameter Support with NTTs for NTRU and NTRU Prime on Cortex-M4" from Erdem Alkim, Vincent Hwang, and Bo-Yin Yang: faster multiplications on 32-bit ARM.

- "Algorithmic Views of Vectorized Polynomial Multipliers for NTRU and NTRU Prime" from Han-Ting Chen, Yi-Hua Chung, Vincent Hwang, Chi-Ting Liu, and Bo-Yin Yang: faster multiplications on 64-bit ARM.

- "Pushing the Limit of Vectorized Polynomial Multiplication for NTRU Prime" from Vincent Hwang: faster multiplications on 64-bit ARM and Intel/AMD.

- "Algorithmic Views of Vectorized Polynomial Multipliers – NTRU Prime" from Vincent Hwang, Chi-Ting Liu, and Bo-Yin Yang: faster multiplications on 64-bit ARM.

- "A Survey of Polynomial Multiplications for Lattice-Based Cryptosystems" from Vincent Hwang: faster multiplications on Intel/AMD.

- "Jumping for Bernstein-Yang Inversion" from Li-Jie Jian, Ting-Yuan Wang, Bo-Yin Yang, and Ming-Shing Chen: faster inversions on 64-bit ARM.

Version: This is version 2026.07.17 of the "Speed" web page.