From 09c9efcfa5a58a89e3a43af738d99ca1d4d48a8d Mon Sep 17 00:00:00 2001 From: Luke Curley Date: Fri, 6 Nov 2026 17:56:16 -0800 Subject: [PATCH 1/4] chore(quest): claim quest/m1/bench-apple-m4.md Quest-Claim: 5c6ac16208b97925 From 8b41e14cfa90b7fc62662dd6be5fd78fccf5134a Mon Sep 17 00:00:00 2001 From: Luke Curley Date: Fri, 6 Nov 2026 20:20:29 -0800 Subject: [PATCH 2/4] feat(bench): measure Apple M4 natively in the bench report Adds kixtop (Apple M4, macOS) to BENCHMARKS.md from its quiet run at 93f91f48, and records why rind trails on short messages there: the M4 has DIT, which rind toggles around every call that handles a secret. A probe with DIT denied puts all but two of those rows within 10%. Rewrites the quest to the quiet desktop re-collect and kixtop's build cost, which both wait on the maintainer's hosts going quiet. Co-Authored-By: Claude Opus 5.5 --- BENCHMARKS.md | 91 +- README.md | 6 +- admin/bench-report | 8 +- benchmarks/data/kixtop.json | 3991 ++++++++++++++++++++++++++++++ benchmarks/gaps.toml | 30 + benchmarks/headline-dark.svg | 72 +- benchmarks/headline.svg | 72 +- benchmarks/kixtop-dark.svg | 819 ++++++ benchmarks/kixtop.svg | 819 ++++++ benchmarks/overview-dark.svg | 3681 +++++++++++++++------------ benchmarks/overview.svg | 3685 +++++++++++++++------------ quest/m1/README.md | 2 +- quest/m1/bench-apple-m4.md | 18 +- quest/m3/bench-report-refresh.md | 2 +- 14 files changed, 9906 insertions(+), 3390 deletions(-) create mode 100644 benchmarks/data/kixtop.json create mode 100644 benchmarks/kixtop-dark.svg create mode 100644 benchmarks/kixtop.svg diff --git a/BENCHMARKS.md b/BENCHMARKS.md index 351cff794..7d54e6971 100644 --- a/BENCHMARKS.md +++ b/BENCHMARKS.md @@ -2,7 +2,7 @@ -How long rind and the usual Rust crypto libraries take for the same operations, on five machines, and what each costs to build. Every library runs its native path on each host. A ✓ marks an operation whose whole computation a published formal proof covers, as [Verified code](#verified-code) lists. +How long rind and the usual Rust crypto libraries take for the same operations, on six machines, and what each costs to build. Every library runs its native path on each host. A ✓ marks an operation whose whole computation a published formal proof covers, as [Verified code](#verified-code) lists. ## Hosts @@ -11,12 +11,11 @@ How long rind and the usual Rust crypto libraries take for the same operations, | `nixos` | AMD Ryzen 9 5900XT 16-Core Processor | NixOS 26.11 (Zokor) (Linux 6.18.56) | 2026-11-06 at [`f95b91da`](https://github.com/moq-dev/rind/commit/f95b91da886bee265dbd836192a7ade2f9158c47), noisy | | `desktop` | Intel(R) Core(TM) Ultra 7 270K Plus | Ubuntu 26.04.1 LTS (Linux 7.0.0-42-generic) | 2026-11-06 at [`f95b91da`](https://github.com/moq-dev/rind/commit/f95b91da886bee265dbd836192a7ade2f9158c47), noisy | | `nixos2` | Intel(R) Core(TM) i7-8700 CPU @ 3.20GHz | NixOS 26.11 (Zokor) (Linux 6.18.56) | 2026-11-06 at [`f95b91da`](https://github.com/moq-dev/rind/commit/f95b91da886bee265dbd836192a7ade2f9158c47) | +| `kixtop` | Apple M4 | macOS 26.6.2 (25.6.0) | 2026-11-07 at [`93f91f48`](https://github.com/moq-dev/rind/commit/93f91f48c9b742890a34bb3485071da6f2d241ab) | | `ovh-iad` | Intel Core Processor (Haswell, no TSX) | NixOS 26.11 (Zokor) (Linux 6.18.40) | 2026-11-06 at [`6b185382`](https://github.com/moq-dev/rind/commit/6b185382a621d6ffe630db4118adc464bc4d158a) | | `ovh-sea` | Intel Core Processor (Haswell, no TSX) | NixOS 26.11 (Zokor) (Linux 6.18.40) | 2026-11-06 at [`6b185382`](https://github.com/moq-dev/rind/commit/6b185382a621d6ffe630db4118adc464bc4d158a) | -Not measured yet: `kixtop`. - -Each host builds with the pinned toolchain, in the Nix dev shell on Linux, and runs `admin/bench-report` only when idle. Times are criterion's estimates. +Each host builds with the pinned toolchain in the Nix dev shell, and runs `admin/bench-report` only when idle. Times are criterion's estimates. ## Speed @@ -255,6 +254,84 @@ Measured 2026-11-06 at [`f95b91da`](https://github.com/moq-dev/rind/commit/f95b9 +### `kixtop`: Apple M4 + +Measured 2026-11-07 at [`93f91f48`](https://github.com/moq-dev/rind/commit/93f91f48c9b742890a34bb3485071da6f2d241ab), on macOS 26.6.2 (25.6.0) with rustc 1.98.1 (48a229cea 2026-09-01). + +The maintainer's MacBook, in daily use. Its cores have DIT, which rind sets around each call that handles a secret and the other libraries never set; Known gaps gives its cost. + + + + Times on kixtop + + +
+Times on kixtop + +| Operation | rind | aws-lc-rs | ring | RustCrypto + dalek | graviola | libcrux | OpenSSL | +|---|---|---|---|---|---|---|---| +| full handshake, X25519MLKEM768 | 177.98 µs | 214.67 µs | - | - | 180.42 µs | - | 459.07 µs | +| full handshake, X25519 | 155.39 µs | 184.86 µs | 184.65 µs | - | 159.19 µs | - | 374.65 µs | +| full handshake, P-256 | 176.20 µs | 206.73 µs | 201.44 µs | - | 191.72 µs | - | 400.48 µs | +| full handshake, Ed25519 certificate | 127.23 µs | 150.93 µs | 155.04 µs | - | 124.12 µs | - | 383.83 µs | +| full handshake, RSA-2048 certificate | 371.35 µs | 406.71 µs | 446.94 µs | - | 683.15 µs | - | 643.30 µs | +| resumed handshake, X25519 | 66.29 µs | 92.46 µs | 88.29 µs | - | 61.75 µs | - | 255.12 µs | +| 1 MB transfer, AES-128-GCM | 308.57 µs | 310.78 µs | 372.59 µs | - | 327.11 µs | - | 338.35 µs | +| 1 MB transfer, AES-256-GCM | 343.96 µs | 341.91 µs | 380.26 µs | - | 397.41 µs | - | 371.49 µs | +| 1 MB transfer, ChaCha20-Poly1305 | 1.12 ms | 1.12 ms | 1.11 ms | - | 1.79 ms | - | 1.11 ms | +| AES-128-GCM seal, 32 B | 57 ns | 50 ns | 42 ns | 24 ns | 80 ns | 53 ns | 69 ns | +| AES-128-GCM seal, 1350 B | 212 ns | 180 ns | 212 ns | 213 ns | 215 ns | 619 ns | 197 ns | +| AES-128-GCM seal, 16 KB | 1.49 µs | 1.45 µs | 1.97 µs | 2.36 µs | 1.60 µs | 7.15 µs | 1.52 µs | +| AES-128-GCM open, 32 B | 47 ns | 47 ns | 39 ns | 28 ns | 85 ns | 64 ns | 65 ns | +| AES-128-GCM open, 1350 B | 214 ns | 193 ns | 247 ns | 237 ns | 226 ns | 647 ns | 199 ns | +| AES-128-GCM open, 16 KB | 1.61 µs | 1.57 µs | 2.18 µs | 2.46 µs | 1.71 µs | 6.97 µs | 1.66 µs | +| AES-256-GCM seal, 32 B | 61 ns | 54 ns | 45 ns | 25 ns | 79 ns | 53 ns | 67 ns | +| AES-256-GCM seal, 1350 B | 237 ns | 205 ns | 220 ns | 246 ns | 262 ns | 650 ns | 222 ns | +| AES-256-GCM seal, 16 KB | 1.75 µs | 1.72 µs | 2.04 µs | 2.72 µs | 2.16 µs | 7.20 µs | 1.79 µs | +| AES-256-GCM open, 32 B | 49 ns | 49 ns | 40 ns | 41 ns | 85 ns | 67 ns | 68 ns | +| AES-256-GCM open, 1350 B | 233 ns | 218 ns | 252 ns | 267 ns | 263 ns | 674 ns | 225 ns | +| AES-256-GCM open, 16 KB | 1.86 µs | 1.83 µs | 2.25 µs | 2.89 µs | 2.18 µs | 7.35 µs | 1.94 µs | +| ChaCha20-Poly1305 seal, 32 B | 185 ns | 163 ns | 148 ns | 344 ns | 196 ns | 171 ns ✓ | 215 ns | +| ChaCha20-Poly1305 seal, 1350 B | 792 ns | 771 ns | 755 ns | 1.78 µs | 1.25 µs | 1.98 µs ✓ | 842 ns | +| ChaCha20-Poly1305 seal, 16 KB | 7.70 µs | 7.65 µs | 7.67 µs | 15.21 µs | 12.85 µs | 22.07 µs ✓ | 7.45 µs | +| XChaCha20-Poly1305 seal, 32 B | 1.19 µs | 943 ns | - | 1.53 µs | 1.11 µs | 1.11 µs | - | +| XChaCha20-Poly1305 seal, 1350 B | 2.02 µs | 1.89 µs | - | 3.19 µs | 2.85 µs | 3.80 µs | - | +| XChaCha20-Poly1305 seal, 16 KB | 11.36 µs | 11.43 µs | - | 22.76 µs | 19.24 µs | 34.20 µs | - | +| AES-128 header protection | 35 ns | 3 ns | 3 ns | - | - | - | - | +| AES-256 header protection | 38 ns | 3 ns | 4 ns | - | - | - | - | +| ChaCha20 header protection | 89 ns ✓ | 73 ns | 68 ns | - | - | - | - | +| X25519 | 16.71 µs ✓ | 17.85 µs | 24.48 µs | 29.71 µs | 17.74 µs | 37.77 µs ✓ | 35.77 µs | +| P-256 ECDH | 26.27 µs ✓ | 28.51 µs | 32.31 µs | 180.62 µs | 31.56 µs | 183.72 µs ✓ | 49.96 µs | +| Ed25519 sign | 3.95 µs | 4.06 µs | 7.07 µs | 8.66 µs | 4.17 µs | 22.12 µs ✓ | 16.42 µs | +| Ed25519 verify | 18.66 µs | 18.52 µs | 19.94 µs | 18.42 µs | 18.69 µs | 29.57 µs ✓ | 41.08 µs | +| P-256 ECDSA sign | 7.11 µs ✓ | 11.27 µs | 11.01 µs | 44.33 µs | 8.83 µs | 67.38 µs ✓ | 12.62 µs | +| P-256 ECDSA verify | 27.15 µs ✓ | 27.15 µs | 29.35 µs | 157.87 µs | 28.60 µs | 156.54 µs ✓ | 41.90 µs | +| SHA-256, 64 B | 93 ns | 71 ns | 45 ns | 37 ns | 36 ns | 232 ns ✓ | 162 ns | +| SHA-256, 1350 B | 484 ns | 440 ns | 414 ns | 475 ns | 472 ns | 2.52 µs ✓ | 531 ns | +| SHA-256, 16 KB | 4.94 µs | 4.87 µs | 4.90 µs | 5.69 µs | 5.76 µs | 29.13 µs ✓ | 5.17 µs | +| SHA-512, 64 B | 113 ns | 108 ns | 88 ns | 79 ns | 177 ns | 141 ns ✓ | 211 ns | +| SHA-512, 1350 B | 827 ns | 775 ns | 737 ns | 722 ns | 1.88 µs | 1.58 µs ✓ | 878 ns | +| SHA-512, 16 KB | 8.77 µs | 8.70 µs | 8.69 µs | 8.50 µs | 22.11 µs | 18.41 µs ✓ | 8.88 µs | +| HMAC-SHA256, 64 B | 191 ns | 248 ns | 137 ns | 102 ns | 115 ns | 568 ns ✓ | 2.06 µs | +| HMAC-SHA256, 1350 B | 559 ns | 620 ns | 502 ns | 542 ns | 557 ns | 2.86 µs ✓ | 2.43 µs | +| HKDF-SHA256 extract and expand | 343 ns | 330 ns | 274 ns | 218 ns | - | 942 ns ✓ | 2.14 µs | +| HKDF-SHA256 expand | 109 ns | 154 ns | 94 ns | 70 ns | - | 481 ns ✓ | 1.54 µs | +| RSA-2048 PKCS#1 sign | 275.12 µs | 285.95 µs | 322.84 µs | 586.34 µs | 556.70 µs | - | 341.31 µs | +| RSA-2048 PKCS#1 verify | 8.38 µs | 9.48 µs | 11.05 µs | 30.77 µs | 18.51 µs | - | 16.66 µs | +| RSA-2048 PSS sign | 275.29 µs | 288.58 µs | 324.86 µs | 588.38 µs | 558.57 µs | 4.48 ms ✓ | 342.61 µs | +| RSA-2048 PSS verify | 8.71 µs | 9.84 µs | 11.48 µs | 39.26 µs | 18.79 µs | 299.96 µs ✓ | 17.44 µs | +| ML-KEM-768 key generation | 6.20 µs | 7.46 µs | - | 26.57 µs | 6.22 µs | 12.01 µs | 25.06 µs | +| ML-KEM-768 encapsulate | 6.84 µs | 8.01 µs | - | 27.77 µs | 6.40 µs | 9.39 µs | 24.07 µs | +| ML-KEM-768 decapsulate | 4.17 µs | 7.75 µs | - | 34.06 µs | 4.05 µs | 9.58 µs | 24.43 µs | +| P-384 ECDH | 91.49 µs | 105.75 µs | 412.48 µs | 494.20 µs | 153.84 µs | - | 279.51 µs | +| P-384 ECDSA sign | 22.93 µs | 49.16 µs | 223.72 µs | 112.64 µs | 81.12 µs | - | 104.84 µs | +| P-384 ECDSA verify | 88.12 µs | 111.27 µs | 396.57 µs | 426.43 µs | 151.78 µs | - | 238.33 µs | +| P-521 ECDH | 130.92 µs | 143.20 µs | - | 397.10 µs | - | - | 247.22 µs | +| P-521 ECDSA sign | 36.32 µs | 84.33 µs | - | 79.73 µs | - | - | 132.13 µs | +| P-521 ECDSA verify | 121.06 µs | 167.21 µs | - | 253.06 µs | - | - | 254.80 µs | + +
+ ### `ovh-iad`: Intel Core Processor (Haswell, no TSX) Measured 2026-11-06 at [`6b185382`](https://github.com/moq-dev/rind/commit/6b185382a621d6ffe630db4118adc464bc4d158a), on NixOS 26.11 (Zokor) (Linux 6.18.40) with rustc 1.98.1 (48a229cea 2026-09-01). @@ -446,6 +523,10 @@ Measured 2026-11-06 at [`f95b91da`](https://github.com/moq-dev/rind/commit/f95b9 | rustls + aws-lc-rs | 36.6 (36.0 to 38.2) | 89 | 4.11 | cc | 20 | | rustls + ring | 16.4 (16.2 to 16.4) | 31 | 1.94 | cc | 16 | +### `kixtop` + +Not measured: error: host is busy (6.6 of 10 CPUs busy) + ### `ovh-iad` Measured 2026-11-06 at [`6b185382`](https://github.com/moq-dev/rind/commit/6b185382a621d6ffe630db4118adc464bc4d158a), with rustc 1.98.1 (48a229cea 2026-09-01), gcc (GCC) 16.2.0, and 4 jobs. @@ -713,6 +794,8 @@ Each operation where another library is more than 10% faster than rind, on a hos | Ed25519 sign | `ovh-iad` | 1.13× (aws-lc-rs) | Noise from the VPS's other tenants: `ovh-sea`, the same virtual CPU, measured 0.92× aws-lc-rs's time, and no dedicated host shows it. The next refresh rechecks it. | | `p256-ecdsa-verify/*` | no ADX tier | 1.14× (aws-lc-rs) | CPUs older than Broadwell and Zen lack ADX, and so do virtual CPUs that hide it, as `ovh-iad`'s and `ovh-sea`'s do. There rind runs s2n-bignum's verified `_alt` routines, which trail by more than 10% only on the nightly runners: on the VPSes P-256 verification measured 1.05× aws-lc-rs's time. | | `chacha20poly1305/*/16KB`, `xchacha20poly1305/*/16KB` | no AES-NI tier | 1.17× (aws-lc-rs) | Without SSE4.1 rind runs Graviola's scalar Poly1305 rather than port BoringSSL's SSE2 `poly1305_vec.c` for CPUs older than Westmere, as ALGORITHMS.md records. | +| AES-128-GCM seal, 32 B, AES-128-GCM seal, 1350 B, AES-128-GCM open, 32 B, AES-128-GCM open, 1350 B, AES-256-GCM seal, 32 B, AES-256-GCM seal, 1350 B, AES-256-GCM open, 32 B, ChaCha20-Poly1305 seal, 32 B, AES-128 header protection, AES-256 header protection, ChaCha20 header protection, SHA-256, 64 B, SHA-256, 1350 B, SHA-512, 64 B, SHA-512, 1350 B, HMAC-SHA256, 64 B, HMAC-SHA256, 1350 B, HKDF-SHA256 extract and expand, HKDF-SHA256 expand | `kixtop` | 1.11× to 12.62× (RustCrypto + dalek, aws-lc-rs, graviola, ring) | DIT: the M4 has it, and rind turns it on and off around every call that handles a secret, which costs about 35 to 55 ns a call there; the other libraries never set it. Keeping it per call was decided with the maintainer from [#387](https://github.com/moq-dev/rind/pull/387)'s findings, and [#431](https://github.com/moq-dev/rind/pull/431)'s `rind::cpu::hold_dit()` pays it once across a batch of calls. With DIT denied (`--cfg rind_cpu_disable` and `RIND_CPU_DISABLE_dit`), the same commit measured each of these within 10% of the fastest library but AES header protection (1.2× aws-lc-rs's 2.9 ns) and HMAC-SHA-256 at 64 B (1.15× RustCrypto's 101 ns). | +| XChaCha20-Poly1305 seal, 32 B | `kixtop` | 1.26× (aws-lc-rs) | Noise: a rerun of the row on the same commit measured 1.04× aws-lc-rs's time, as did the run before this one, on a commit that changed only x86_64 code. The next refresh rechecks it. | ## Verified code diff --git a/README.md b/README.md index e8b224a1a..0a8b38e06 100644 --- a/README.md +++ b/README.md @@ -19,8 +19,10 @@ - **As fast as aws-lc-rs and ring.** rind matches or beats both on nearly every operation TLS and QUIC run, from the handshake to each packet's AEAD. Where another library is ahead, as ring and aws-lc-rs are at - RSA-2048 signing on x86_64, [Known gaps][gaps] says so, with the quest that - closes the gap or the reason it stays. + RSA-2048 signing on x86_64, and aws-lc-rs is at AES-GCM and short messages + on Apple silicon, where rind alone sets DIT around each call, + [Known gaps][gaps] says so, with the quest that closes the gap or the + reason it stays. diff --git a/admin/bench-report b/admin/bench-report index a12621888..487331365 100755 --- a/admin/bench-report +++ b/admin/bench-report @@ -62,7 +62,11 @@ HOSTS = { "nixos": {"jobs": 16}, "desktop": {"jobs": 12}, "nixos2": {"jobs": 3}, - "kixtop": {"jobs": 4}, + "kixtop": { + "jobs": 4, + "note": "The maintainer's MacBook, in daily use. Its cores have DIT, which rind sets around each call " + "that handles a secret and the other libraries never set; Known gaps gives its cost.", + }, "ovh-iad": { "jobs": 4, "ssh": "root@vps-bcb7229a.vps.ovh.us", @@ -1486,7 +1490,7 @@ def report(hosts, tiers, verified, gaps): if missing: md += [f"Not measured yet: {', '.join(missing)}.", ""] md += [ - "Each host builds with the pinned toolchain, in the Nix dev shell on Linux, and runs " + "Each host builds with the pinned toolchain in the Nix dev shell, and runs " "`admin/bench-report` only when idle. Times are criterion's estimates.", "", ] diff --git a/benchmarks/data/kixtop.json b/benchmarks/data/kixtop.json new file mode 100644 index 000000000..231b72505 --- /dev/null +++ b/benchmarks/data/kixtop.json @@ -0,0 +1,3991 @@ +{ + "schema": 1, + "host": "kixtop", + "commit": "93f91f48c9b742890a34bb3485071da6f2d241ab", + "started": "2026-11-07T02:52:36+00:00", + "cpu": { + "model": "Apple M4", + "arch": "arm64", + "logical_cpus": 10 + }, + "os": "macOS 26.6.2 (25.6.0)", + "toolchain": { + "rustc": "rustc 1.98.1 (48a229cea 2026-09-01)", + "cargo": "cargo 1.98.1 (797e8a9bc 2026-08-05)" + }, + "libraries": { + "rind": { + "rind": "0.2.0", + "rind-rustls": "0.2.0" + }, + "aws-lc-rs": { + "aws-lc-rs": "1.19.0", + "aws-lc-sys": "0.47.0" + }, + "ring": { + "ring": "0.17.14" + }, + "rustcrypto": { + "aes-gcm": "0.11.1", + "chacha20poly1305": "0.11.0", + "sha2": "0.11.1", + "sha3": "0.12.0", + "hmac": "0.13.0", + "hkdf": "0.13.0", + "p256": "0.14.0", + "p384": "0.14.0", + "p521": "0.14.0", + "rsa": "0.10.0-rc.19", + "ml-kem": "0.3.4", + "ed25519-dalek": "3.0.0", + "x25519-dalek": "3.0.0" + }, + "graviola": { + "graviola": "0.4.4", + "rustls-graviola": "0.4.0" + }, + "libcrux": { + "libcrux-aes": "0.0.10", + "libcrux-chacha20poly1305": "0.0.10", + "libcrux-ecdh": "0.0.9", + "libcrux-ecdsa": "0.0.9", + "libcrux-ed25519": "0.0.10", + "libcrux-hkdf": "0.0.9", + "libcrux-hmac": "0.0.9", + "libcrux-ml-kem": "0.0.11", + "libcrux-rsa": "0.0.9", + "libcrux-sha2": "0.0.9", + "libcrux-sha3": "0.0.11" + }, + "openssl": { + "openssl": "0.10.82", + "openssl-sys": "0.9.118", + "rustls-openssl": "0.4.2", + "linked": "OpenSSL 3.5.9 29 Sep 2026 (Library: OpenSSL 3.5.9 29 Sep 2026)" + }, + "tls": { + "rustls": "0.23.46" + } + }, + "rind_cpu": { + "cpuid": { + "aes": 1, + "dit": 1, + "neon": 1, + "pmull": 1, + "sha2": 1, + "sha3": 1 + }, + "compatible": 1 + }, + "refused": {}, + "status": "ok", + "finished": "2026-11-07T03:24:20+00:00", + "criterion_args": [ + "--noplot", + "--warm-up-time", + "1", + "--measurement-time", + "3", + "^(rustls\\-full\\-handshake\\-group/x25519mlkem768/[^/]+|rustls\\-full\\-handshake\\-group/x25519/[^/]+|rustls\\-full\\-handshake\\-group/secp256r1/[^/]+|rustls\\-full\\-handshake\\-key/ed25519/[^/]+|rustls\\-full\\-handshake\\-key/rsa\\-2048/[^/]+|rustls\\-resumed\\-handshake/x25519/[^/]+|rustls\\-bulk/aes128\\-gcm/[^/]+|rustls\\-bulk/aes256\\-gcm/[^/]+|rustls\\-bulk/chacha20poly1305/[^/]+|aes128\\-gcm/[^/]+/32B|aes128\\-gcm/[^/]+/1350B|aes128\\-gcm/[^/]+/16KB|aes128\\-gcm\\-open/[^/]+/32B|aes128\\-gcm\\-open/[^/]+/1350B|aes128\\-gcm\\-open/[^/]+/16KB|aes256\\-gcm/[^/]+/32B|aes256\\-gcm/[^/]+/1350B|aes256\\-gcm/[^/]+/16KB|aes256\\-gcm\\-open/[^/]+/32B|aes256\\-gcm\\-open/[^/]+/1350B|aes256\\-gcm\\-open/[^/]+/16KB|chacha20poly1305/[^/]+/32B|chacha20poly1305/[^/]+/1350B|chacha20poly1305/[^/]+/16KB|xchacha20poly1305/[^/]+/32B|xchacha20poly1305/[^/]+/1350B|xchacha20poly1305/[^/]+/16KB|quic\\-header\\-protection/aes128/[^/]+|quic\\-header\\-protection/aes256/[^/]+|quic\\-header\\-protection/chacha20/[^/]+|x25519\\-ecdh/[^/]+|p256\\-ecdh/[^/]+|ed25519\\-sign/[^/]+|ed25519\\-verify/[^/]+|p256\\-ecdsa\\-sign/[^/]+|p256\\-ecdsa\\-verify/[^/]+|sha256/[^/]+/64B|sha256/[^/]+/1350B|sha256/[^/]+/16KB|sha512/[^/]+/64B|sha512/[^/]+/1350B|sha512/[^/]+/16KB|hmac\\-sha256/[^/]+/64B|hmac\\-sha256/[^/]+/1350B|hkdf\\-sha256/extract\\-expand/[^/]+|hkdf\\-sha256/expand/[^/]+|rsa2048\\-pkcs1\\-sha256\\-sign/[^/]+|rsa2048\\-pkcs1\\-sha256\\-verify/[^/]+|rsa2048\\-pss\\-sha256\\-sign/[^/]+|rsa2048\\-pss\\-sha256\\-verify/[^/]+|mlkem768\\-keygen/[^/]+|mlkem768\\-encaps/[^/]+|mlkem768\\-decaps/[^/]+|p384\\-ecdh/[^/]+|p384\\-ecdsa\\-sign/[^/]+|p384\\-ecdsa\\-verify/[^/]+|p521\\-ecdh/[^/]+|p521\\-ecdsa\\-sign/[^/]+|p521\\-ecdsa\\-verify/[^/]+)$" + ], + "load": { + "limit_cpus": 1.0, + "busy_cpus_before_build": 0.51, + "busy_cpus_before_run": 0.51, + "other_busy_cpus_during_run": 0.68, + "noisy": false + }, + "results": [ + { + "operation": "rustls-full-handshake-group/x25519mlkem768/{lib}", + "library": "aws-lc-rs", + "id": "rustls-full-handshake-group/x25519mlkem768/aws-lc-rs", + "ns": 214670.70124230333, + "ns_low": 212734.53389792985, + "ns_high": 217363.39585806534, + "throughput": { + "Elements": 1 + } + }, + { + "operation": "rustls-full-handshake-group/x25519mlkem768/{lib}", + "library": "graviola", + "id": "rustls-full-handshake-group/x25519mlkem768/graviola", + "ns": 180421.9094790897, + "ns_low": 179436.06487298128, + "ns_high": 182141.3505800823, + "throughput": { + "Elements": 1 + } + }, + { + "operation": "rustls-full-handshake-group/x25519mlkem768/{lib}", + "library": "openssl", + "id": "rustls-full-handshake-group/x25519mlkem768/openssl", + "ns": 459074.77035170683, + "ns_low": 456710.50876807765, + "ns_high": 461767.6304588975, + "throughput": { + "Elements": 1 + } + }, + { + "operation": "rustls-full-handshake-group/x25519mlkem768/{lib}", + "library": "rind", + "id": "rustls-full-handshake-group/x25519mlkem768/rind", + "ns": 177977.065110832, + "ns_low": 177396.16542958558, + "ns_high": 178550.14238776732, + "throughput": { + "Elements": 1 + } + }, + { + "operation": "rustls-full-handshake-group/x25519/{lib}", + "library": "aws-lc-rs", + "id": "rustls-full-handshake-group/x25519/aws-lc-rs", + "ns": 184860.00728609427, + "ns_low": 184355.25178620394, + "ns_high": 185416.11138546062, + "throughput": { + "Elements": 1 + } + }, + { + "operation": "rustls-full-handshake-group/x25519/{lib}", + "library": "graviola", + "id": "rustls-full-handshake-group/x25519/graviola", + "ns": 159186.6617245456, + "ns_low": 158746.9183107693, + "ns_high": 159692.74606348772, + "throughput": { + "Elements": 1 + } + }, + { + "operation": "rustls-full-handshake-group/x25519/{lib}", + "library": "openssl", + "id": "rustls-full-handshake-group/x25519/openssl", + "ns": 374649.39355992316, + "ns_low": 373360.9369508007, + "ns_high": 375967.7128768089, + "throughput": { + "Elements": 1 + } + }, + { + "operation": "rustls-full-handshake-group/x25519/{lib}", + "library": "rind", + "id": "rustls-full-handshake-group/x25519/rind", + "ns": 155391.24526969114, + "ns_low": 154913.44763054716, + "ns_high": 155862.12893543203, + "throughput": { + "Elements": 1 + } + }, + { + "operation": "rustls-full-handshake-group/x25519/{lib}", + "library": "ring", + "id": "rustls-full-handshake-group/x25519/ring", + "ns": 184645.65049431063, + "ns_low": 184233.04996071558, + "ns_high": 185123.89009077605, + "throughput": { + "Elements": 1 + } + }, + { + "operation": "rustls-full-handshake-group/secp256r1/{lib}", + "library": "aws-lc-rs", + "id": "rustls-full-handshake-group/secp256r1/aws-lc-rs", + "ns": 206726.95669572928, + "ns_low": 206075.518870867, + "ns_high": 207470.49302057715, + "throughput": { + "Elements": 1 + } + }, + { + "operation": "rustls-full-handshake-group/secp256r1/{lib}", + "library": "graviola", + "id": "rustls-full-handshake-group/secp256r1/graviola", + "ns": 191723.06850746268, + "ns_low": 190605.18326785727, + "ns_high": 193280.63906046774, + "throughput": { + "Elements": 1 + } + }, + { + "operation": "rustls-full-handshake-group/secp256r1/{lib}", + "library": "openssl", + "id": "rustls-full-handshake-group/secp256r1/openssl", + "ns": 400477.21395152947, + "ns_low": 399156.9983847531, + "ns_high": 401900.89742650534, + "throughput": { + "Elements": 1 + } + }, + { + "operation": "rustls-full-handshake-group/secp256r1/{lib}", + "library": "rind", + "id": "rustls-full-handshake-group/secp256r1/rind", + "ns": 176204.12778927147, + "ns_low": 175582.40596241513, + "ns_high": 176808.97963948932, + "throughput": { + "Elements": 1 + } + }, + { + "operation": "rustls-full-handshake-group/secp256r1/{lib}", + "library": "ring", + "id": "rustls-full-handshake-group/secp256r1/ring", + "ns": 201438.41722969312, + "ns_low": 200189.0241699, + "ns_high": 203480.72583577718, + "throughput": { + "Elements": 1 + } + }, + { + "operation": "rustls-full-handshake-key/ed25519/{lib}", + "library": "aws-lc-rs", + "id": "rustls-full-handshake-key/ed25519/aws-lc-rs", + "ns": 150928.2760928033, + "ns_low": 150462.4736171076, + "ns_high": 151473.9308306628, + "throughput": { + "Elements": 1 + } + }, + { + "operation": "rustls-full-handshake-key/ed25519/{lib}", + "library": "graviola", + "id": "rustls-full-handshake-key/ed25519/graviola", + "ns": 124116.8585854884, + "ns_low": 123264.49992247345, + "ns_high": 125502.66912186865, + "throughput": { + "Elements": 1 + } + }, + { + "operation": "rustls-full-handshake-key/ed25519/{lib}", + "library": "openssl", + "id": "rustls-full-handshake-key/ed25519/openssl", + "ns": 383827.4255356879, + "ns_low": 382442.6100015725, + "ns_high": 385346.5484152613, + "throughput": { + "Elements": 1 + } + }, + { + "operation": "rustls-full-handshake-key/ed25519/{lib}", + "library": "rind", + "id": "rustls-full-handshake-key/ed25519/rind", + "ns": 127231.658463721, + "ns_low": 126632.7262351605, + "ns_high": 127956.81766263032, + "throughput": { + "Elements": 1 + } + }, + { + "operation": "rustls-full-handshake-key/ed25519/{lib}", + "library": "ring", + "id": "rustls-full-handshake-key/ed25519/ring", + "ns": 155037.62873651544, + "ns_low": 154404.35186733434, + "ns_high": 155890.27157268068, + "throughput": { + "Elements": 1 + } + }, + { + "operation": "rustls-full-handshake-key/rsa-2048/{lib}", + "library": "aws-lc-rs", + "id": "rustls-full-handshake-key/rsa-2048/aws-lc-rs", + "ns": 406706.82046844985, + "ns_low": 405513.91412015224, + "ns_high": 408108.8574283564, + "throughput": { + "Elements": 1 + } + }, + { + "operation": "rustls-full-handshake-key/rsa-2048/{lib}", + "library": "graviola", + "id": "rustls-full-handshake-key/rsa-2048/graviola", + "ns": 683150.6391990542, + "ns_low": 678767.0931289573, + "ns_high": 689638.8631377588, + "throughput": { + "Elements": 1 + } + }, + { + "operation": "rustls-full-handshake-key/rsa-2048/{lib}", + "library": "openssl", + "id": "rustls-full-handshake-key/rsa-2048/openssl", + "ns": 643300.1733293927, + "ns_low": 641098.8793215863, + "ns_high": 645786.6465499077, + "throughput": { + "Elements": 1 + } + }, + { + "operation": "rustls-full-handshake-key/rsa-2048/{lib}", + "library": "rind", + "id": "rustls-full-handshake-key/rsa-2048/rind", + "ns": 371347.6830737402, + "ns_low": 370244.45707218174, + "ns_high": 372540.66086443426, + "throughput": { + "Elements": 1 + } + }, + { + "operation": "rustls-full-handshake-key/rsa-2048/{lib}", + "library": "ring", + "id": "rustls-full-handshake-key/rsa-2048/ring", + "ns": 446944.1473666322, + "ns_low": 444562.3602969627, + "ns_high": 450852.9355564261, + "throughput": { + "Elements": 1 + } + }, + { + "operation": "rustls-resumed-handshake/x25519/{lib}", + "library": "aws-lc-rs", + "id": "rustls-resumed-handshake/x25519/aws-lc-rs", + "ns": 92464.03515168148, + "ns_low": 91918.9935288164, + "ns_high": 93037.01937360466, + "throughput": { + "Elements": 1 + } + }, + { + "operation": "rustls-resumed-handshake/x25519/{lib}", + "library": "graviola", + "id": "rustls-resumed-handshake/x25519/graviola", + "ns": 61745.54290025122, + "ns_low": 61575.55566010297, + "ns_high": 61927.65347093232, + "throughput": { + "Elements": 1 + } + }, + { + "operation": "rustls-resumed-handshake/x25519/{lib}", + "library": "openssl", + "id": "rustls-resumed-handshake/x25519/openssl", + "ns": 255116.20131225063, + "ns_low": 254226.95012841083, + "ns_high": 255982.13796536296, + "throughput": { + "Elements": 1 + } + }, + { + "operation": "rustls-resumed-handshake/x25519/{lib}", + "library": "rind", + "id": "rustls-resumed-handshake/x25519/rind", + "ns": 66291.9701870187, + "ns_low": 65917.15457747292, + "ns_high": 66698.88959008608, + "throughput": { + "Elements": 1 + } + }, + { + "operation": "rustls-resumed-handshake/x25519/{lib}", + "library": "ring", + "id": "rustls-resumed-handshake/x25519/ring", + "ns": 88286.06266376744, + "ns_low": 87572.68998420854, + "ns_high": 89325.87477820979, + "throughput": { + "Elements": 1 + } + }, + { + "operation": "rustls-bulk/aes128-gcm/{lib}", + "library": "aws-lc-rs", + "id": "rustls-bulk/aes128-gcm/aws-lc-rs", + "ns": 310775.0835436678, + "ns_low": 309355.40389215644, + "ns_high": 312358.3113820762, + "throughput": { + "Bytes": 1048576 + } + }, + { + "operation": "rustls-bulk/aes128-gcm/{lib}", + "library": "graviola", + "id": "rustls-bulk/aes128-gcm/graviola", + "ns": 327108.56207773014, + "ns_low": 325378.0377545567, + "ns_high": 329298.6325039636, + "throughput": { + "Bytes": 1048576 + } + }, + { + "operation": "rustls-bulk/aes128-gcm/{lib}", + "library": "openssl", + "id": "rustls-bulk/aes128-gcm/openssl", + "ns": 338345.2325683464, + "ns_low": 336635.71174632385, + "ns_high": 340434.94974932907, + "throughput": { + "Bytes": 1048576 + } + }, + { + "operation": "rustls-bulk/aes128-gcm/{lib}", + "library": "rind", + "id": "rustls-bulk/aes128-gcm/rind", + "ns": 308566.37457957736, + "ns_low": 307691.1531382107, + "ns_high": 309563.35437925323, + "throughput": { + "Bytes": 1048576 + } + }, + { + "operation": "rustls-bulk/aes128-gcm/{lib}", + "library": "ring", + "id": "rustls-bulk/aes128-gcm/ring", + "ns": 372585.1681690557, + "ns_low": 368853.4138997409, + "ns_high": 378195.77252326213, + "throughput": { + "Bytes": 1048576 + } + }, + { + "operation": "rustls-bulk/aes256-gcm/{lib}", + "library": "aws-lc-rs", + "id": "rustls-bulk/aes256-gcm/aws-lc-rs", + "ns": 341913.4178395153, + "ns_low": 340195.9940562084, + "ns_high": 343976.91465869854, + "throughput": { + "Bytes": 1048576 + } + }, + { + "operation": "rustls-bulk/aes256-gcm/{lib}", + "library": "graviola", + "id": "rustls-bulk/aes256-gcm/graviola", + "ns": 397408.6469395596, + "ns_low": 395530.58668117865, + "ns_high": 399629.58577679074, + "throughput": { + "Bytes": 1048576 + } + }, + { + "operation": "rustls-bulk/aes256-gcm/{lib}", + "library": "openssl", + "id": "rustls-bulk/aes256-gcm/openssl", + "ns": 371492.9850938377, + "ns_low": 369658.03424764593, + "ns_high": 374302.5408522081, + "throughput": { + "Bytes": 1048576 + } + }, + { + "operation": "rustls-bulk/aes256-gcm/{lib}", + "library": "rind", + "id": "rustls-bulk/aes256-gcm/rind", + "ns": 343959.3999689671, + "ns_low": 342369.0632123827, + "ns_high": 345616.5106875045, + "throughput": { + "Bytes": 1048576 + } + }, + { + "operation": "rustls-bulk/aes256-gcm/{lib}", + "library": "ring", + "id": "rustls-bulk/aes256-gcm/ring", + "ns": 380259.3430560071, + "ns_low": 378894.9166728107, + "ns_high": 381808.6125906871, + "throughput": { + "Bytes": 1048576 + } + }, + { + "operation": "rustls-bulk/chacha20poly1305/{lib}", + "library": "aws-lc-rs", + "id": "rustls-bulk/chacha20poly1305/aws-lc-rs", + "ns": 1117461.8769203487, + "ns_low": 1110078.8438208462, + "ns_high": 1127578.9012635201, + "throughput": { + "Bytes": 1048576 + } + }, + { + "operation": "rustls-bulk/chacha20poly1305/{lib}", + "library": "graviola", + "id": "rustls-bulk/chacha20poly1305/graviola", + "ns": 1790665.0511764705, + "ns_low": 1779622.3262058822, + "ns_high": 1805310.1971764704, + "throughput": { + "Bytes": 1048576 + } + }, + { + "operation": "rustls-bulk/chacha20poly1305/{lib}", + "library": "openssl", + "id": "rustls-bulk/chacha20poly1305/openssl", + "ns": 1106168.757029703, + "ns_low": 1102261.4972604944, + "ns_high": 1110399.5328705583, + "throughput": { + "Bytes": 1048576 + } + }, + { + "operation": "rustls-bulk/chacha20poly1305/{lib}", + "library": "rind", + "id": "rustls-bulk/chacha20poly1305/rind", + "ns": 1117213.9074981527, + "ns_low": 1112565.8847098371, + "ns_high": 1122326.4123632284, + "throughput": { + "Bytes": 1048576 + } + }, + { + "operation": "rustls-bulk/chacha20poly1305/{lib}", + "library": "ring", + "id": "rustls-bulk/chacha20poly1305/ring", + "ns": 1114476.349717748, + "ns_low": 1110091.8214222197, + "ns_high": 1119410.8848856308, + "throughput": { + "Bytes": 1048576 + } + }, + { + "operation": "aes128-gcm/{lib}/32B", + "library": "aws-lc-rs", + "id": "aes128-gcm/aws-lc-rs/32B", + "ns": 49.752491058825754, + "ns_low": 49.40787443745903, + "ns_high": 50.11237918351562, + "throughput": { + "Bytes": 32 + } + }, + { + "operation": "aes128-gcm/{lib}/32B", + "library": "graviola", + "id": "aes128-gcm/graviola/32B", + "ns": 79.86419301681406, + "ns_low": 79.14707386307197, + "ns_high": 80.87819369823305, + "throughput": { + "Bytes": 32 + } + }, + { + "operation": "aes128-gcm/{lib}/32B", + "library": "libcrux", + "id": "aes128-gcm/libcrux/32B", + "ns": 52.7669670136078, + "ns_low": 52.479199359666225, + "ns_high": 53.108609625080035, + "throughput": { + "Bytes": 32 + } + }, + { + "operation": "aes128-gcm/{lib}/32B", + "library": "openssl", + "id": "aes128-gcm/openssl/32B", + "ns": 68.89243369901709, + "ns_low": 67.46442141219333, + "ns_high": 70.80404554644977, + "throughput": { + "Bytes": 32 + } + }, + { + "operation": "aes128-gcm/{lib}/32B", + "library": "rind", + "id": "aes128-gcm/rind/32B", + "ns": 56.79981342983798, + "ns_low": 56.53159631839321, + "ns_high": 57.10649184778805, + "throughput": { + "Bytes": 32 + } + }, + { + "operation": "aes128-gcm/{lib}/32B", + "library": "ring", + "id": "aes128-gcm/ring/32B", + "ns": 41.86707629331381, + "ns_low": 41.7661558884458, + "ns_high": 41.98272897276245, + "throughput": { + "Bytes": 32 + } + }, + { + "operation": "aes128-gcm/{lib}/32B", + "library": "rustcrypto", + "id": "aes128-gcm/rustcrypto/32B", + "ns": 23.694000865523126, + "ns_low": 23.631690976704107, + "ns_high": 23.765213103922765, + "throughput": { + "Bytes": 32 + } + }, + { + "operation": "aes128-gcm/{lib}/1350B", + "library": "aws-lc-rs", + "id": "aes128-gcm/aws-lc-rs/1350B", + "ns": 180.05605907344466, + "ns_low": 179.32516371733982, + "ns_high": 180.73108775943703, + "throughput": { + "Bytes": 1350 + } + }, + { + "operation": "aes128-gcm/{lib}/1350B", + "library": "graviola", + "id": "aes128-gcm/graviola/1350B", + "ns": 215.17983429073715, + "ns_low": 214.55769102876548, + "ns_high": 215.84500149959814, + "throughput": { + "Bytes": 1350 + } + }, + { + "operation": "aes128-gcm/{lib}/1350B", + "library": "libcrux", + "id": "aes128-gcm/libcrux/1350B", + "ns": 619.2008113515918, + "ns_low": 615.8323107748063, + "ns_high": 622.7250954590972, + "throughput": { + "Bytes": 1350 + } + }, + { + "operation": "aes128-gcm/{lib}/1350B", + "library": "openssl", + "id": "aes128-gcm/openssl/1350B", + "ns": 197.02904676373842, + "ns_low": 196.31032335916984, + "ns_high": 197.84240573017374, + "throughput": { + "Bytes": 1350 + } + }, + { + "operation": "aes128-gcm/{lib}/1350B", + "library": "rind", + "id": "aes128-gcm/rind/1350B", + "ns": 211.61339714610597, + "ns_low": 211.07463150401702, + "ns_high": 212.15265995010242, + "throughput": { + "Bytes": 1350 + } + }, + { + "operation": "aes128-gcm/{lib}/1350B", + "library": "ring", + "id": "aes128-gcm/ring/1350B", + "ns": 211.93856436831143, + "ns_low": 210.65624543290076, + "ns_high": 213.53490904464246, + "throughput": { + "Bytes": 1350 + } + }, + { + "operation": "aes128-gcm/{lib}/1350B", + "library": "rustcrypto", + "id": "aes128-gcm/rustcrypto/1350B", + "ns": 213.2295573593783, + "ns_low": 212.76491051300707, + "ns_high": 213.79921008217724, + "throughput": { + "Bytes": 1350 + } + }, + { + "operation": "aes128-gcm/{lib}/16KB", + "library": "aws-lc-rs", + "id": "aes128-gcm/aws-lc-rs/16KB", + "ns": 1453.7599790465838, + "ns_low": 1446.0272270194494, + "ns_high": 1465.0639355138258, + "throughput": { + "Bytes": 16384 + } + }, + { + "operation": "aes128-gcm/{lib}/16KB", + "library": "graviola", + "id": "aes128-gcm/graviola/16KB", + "ns": 1599.8308109527695, + "ns_low": 1595.2842972278127, + "ns_high": 1604.5657889615536, + "throughput": { + "Bytes": 16384 + } + }, + { + "operation": "aes128-gcm/{lib}/16KB", + "library": "libcrux", + "id": "aes128-gcm/libcrux/16KB", + "ns": 7146.175328203396, + "ns_low": 7065.851164961102, + "ns_high": 7259.192890534237, + "throughput": { + "Bytes": 16384 + } + }, + { + "operation": "aes128-gcm/{lib}/16KB", + "library": "openssl", + "id": "aes128-gcm/openssl/16KB", + "ns": 1516.3662623083812, + "ns_low": 1512.7069457943824, + "ns_high": 1520.440330310697, + "throughput": { + "Bytes": 16384 + } + }, + { + "operation": "aes128-gcm/{lib}/16KB", + "library": "rind", + "id": "aes128-gcm/rind/16KB", + "ns": 1492.620335676252, + "ns_low": 1490.1085221676663, + "ns_high": 1495.714219846836, + "throughput": { + "Bytes": 16384 + } + }, + { + "operation": "aes128-gcm/{lib}/16KB", + "library": "ring", + "id": "aes128-gcm/ring/16KB", + "ns": 1966.1870751526164, + "ns_low": 1956.8525402806229, + "ns_high": 1976.7120596230975, + "throughput": { + "Bytes": 16384 + } + }, + { + "operation": "aes128-gcm/{lib}/16KB", + "library": "rustcrypto", + "id": "aes128-gcm/rustcrypto/16KB", + "ns": 2361.1127429031026, + "ns_low": 2339.6888776777355, + "ns_high": 2393.68806953613, + "throughput": { + "Bytes": 16384 + } + }, + { + "operation": "aes128-gcm-open/{lib}/32B", + "library": "aws-lc-rs", + "id": "aes128-gcm-open/aws-lc-rs/32B", + "ns": 47.160351043867756, + "ns_low": 46.53453281600477, + "ns_high": 47.9948695157278, + "throughput": { + "Bytes": 32 + } + }, + { + "operation": "aes128-gcm-open/{lib}/32B", + "library": "graviola", + "id": "aes128-gcm-open/graviola/32B", + "ns": 84.8415395683634, + "ns_low": 84.56979887993288, + "ns_high": 85.10201922112563, + "throughput": { + "Bytes": 32 + } + }, + { + "operation": "aes128-gcm-open/{lib}/32B", + "library": "libcrux", + "id": "aes128-gcm-open/libcrux/32B", + "ns": 63.57760146858742, + "ns_low": 63.28163260983879, + "ns_high": 63.90363650274374, + "throughput": { + "Bytes": 32 + } + }, + { + "operation": "aes128-gcm-open/{lib}/32B", + "library": "openssl", + "id": "aes128-gcm-open/openssl/32B", + "ns": 65.41951379086953, + "ns_low": 65.16798086140334, + "ns_high": 65.68159117426107, + "throughput": { + "Bytes": 32 + } + }, + { + "operation": "aes128-gcm-open/{lib}/32B", + "library": "rind", + "id": "aes128-gcm-open/rind/32B", + "ns": 47.28415879333341, + "ns_low": 47.072135238829595, + "ns_high": 47.538082893075696, + "throughput": { + "Bytes": 32 + } + }, + { + "operation": "aes128-gcm-open/{lib}/32B", + "library": "ring", + "id": "aes128-gcm-open/ring/32B", + "ns": 39.30862404832825, + "ns_low": 39.133619113582064, + "ns_high": 39.484999243610396, + "throughput": { + "Bytes": 32 + } + }, + { + "operation": "aes128-gcm-open/{lib}/32B", + "library": "rustcrypto", + "id": "aes128-gcm-open/rustcrypto/32B", + "ns": 27.695461550498976, + "ns_low": 27.44200537365188, + "ns_high": 28.128300468865426, + "throughput": { + "Bytes": 32 + } + }, + { + "operation": "aes128-gcm-open/{lib}/1350B", + "library": "aws-lc-rs", + "id": "aes128-gcm-open/aws-lc-rs/1350B", + "ns": 192.89812590225839, + "ns_low": 192.24181327085037, + "ns_high": 193.70524644989098, + "throughput": { + "Bytes": 1350 + } + }, + { + "operation": "aes128-gcm-open/{lib}/1350B", + "library": "graviola", + "id": "aes128-gcm-open/graviola/1350B", + "ns": 225.98569034369228, + "ns_low": 225.23339410601955, + "ns_high": 227.0473031861718, + "throughput": { + "Bytes": 1350 + } + }, + { + "operation": "aes128-gcm-open/{lib}/1350B", + "library": "libcrux", + "id": "aes128-gcm-open/libcrux/1350B", + "ns": 647.0519700374145, + "ns_low": 638.4202385557528, + "ns_high": 661.078828197932, + "throughput": { + "Bytes": 1350 + } + }, + { + "operation": "aes128-gcm-open/{lib}/1350B", + "library": "openssl", + "id": "aes128-gcm-open/openssl/1350B", + "ns": 198.6049704634742, + "ns_low": 197.66763347184283, + "ns_high": 199.64412161353175, + "throughput": { + "Bytes": 1350 + } + }, + { + "operation": "aes128-gcm-open/{lib}/1350B", + "library": "rind", + "id": "aes128-gcm-open/rind/1350B", + "ns": 213.99268724022429, + "ns_low": 212.81094726297584, + "ns_high": 215.59053534696707, + "throughput": { + "Bytes": 1350 + } + }, + { + "operation": "aes128-gcm-open/{lib}/1350B", + "library": "ring", + "id": "aes128-gcm-open/ring/1350B", + "ns": 246.64884894041074, + "ns_low": 245.45782975859797, + "ns_high": 248.23214710871738, + "throughput": { + "Bytes": 1350 + } + }, + { + "operation": "aes128-gcm-open/{lib}/1350B", + "library": "rustcrypto", + "id": "aes128-gcm-open/rustcrypto/1350B", + "ns": 237.0192313679129, + "ns_low": 233.57326752782674, + "ns_high": 242.81705405985684, + "throughput": { + "Bytes": 1350 + } + }, + { + "operation": "aes128-gcm-open/{lib}/16KB", + "library": "aws-lc-rs", + "id": "aes128-gcm-open/aws-lc-rs/16KB", + "ns": 1571.7503575433755, + "ns_low": 1568.2571997887076, + "ns_high": 1575.9505510008782, + "throughput": { + "Bytes": 16384 + } + }, + { + "operation": "aes128-gcm-open/{lib}/16KB", + "library": "graviola", + "id": "aes128-gcm-open/graviola/16KB", + "ns": 1706.639684318344, + "ns_low": 1697.9354538983584, + "ns_high": 1718.8901827891336, + "throughput": { + "Bytes": 16384 + } + }, + { + "operation": "aes128-gcm-open/{lib}/16KB", + "library": "libcrux", + "id": "aes128-gcm-open/libcrux/16KB", + "ns": 6974.73252357896, + "ns_low": 6941.209158798741, + "ns_high": 7008.907930653137, + "throughput": { + "Bytes": 16384 + } + }, + { + "operation": "aes128-gcm-open/{lib}/16KB", + "library": "openssl", + "id": "aes128-gcm-open/openssl/16KB", + "ns": 1661.1711458696207, + "ns_low": 1653.3933358345032, + "ns_high": 1672.2422034300425, + "throughput": { + "Bytes": 16384 + } + }, + { + "operation": "aes128-gcm-open/{lib}/16KB", + "library": "rind", + "id": "aes128-gcm-open/rind/16KB", + "ns": 1605.32326072818, + "ns_low": 1582.8704104652277, + "ns_high": 1649.1551702529205, + "throughput": { + "Bytes": 16384 + } + }, + { + "operation": "aes128-gcm-open/{lib}/16KB", + "library": "ring", + "id": "aes128-gcm-open/ring/16KB", + "ns": 2178.062625057461, + "ns_low": 2171.14108188634, + "ns_high": 2184.8545614870036, + "throughput": { + "Bytes": 16384 + } + }, + { + "operation": "aes128-gcm-open/{lib}/16KB", + "library": "rustcrypto", + "id": "aes128-gcm-open/rustcrypto/16KB", + "ns": 2460.4811221486993, + "ns_low": 2451.8852092158722, + "ns_high": 2470.8858849303756, + "throughput": { + "Bytes": 16384 + } + }, + { + "operation": "aes256-gcm/{lib}/32B", + "library": "aws-lc-rs", + "id": "aes256-gcm/aws-lc-rs/32B", + "ns": 53.961141826597405, + "ns_low": 53.567469025651945, + "ns_high": 54.36804342592058, + "throughput": { + "Bytes": 32 + } + }, + { + "operation": "aes256-gcm/{lib}/32B", + "library": "graviola", + "id": "aes256-gcm/graviola/32B", + "ns": 78.93770185385497, + "ns_low": 78.53166441816059, + "ns_high": 79.37965021614696, + "throughput": { + "Bytes": 32 + } + }, + { + "operation": "aes256-gcm/{lib}/32B", + "library": "libcrux", + "id": "aes256-gcm/libcrux/32B", + "ns": 53.3477545864119, + "ns_low": 52.97565178075652, + "ns_high": 53.909021415589564, + "throughput": { + "Bytes": 32 + } + }, + { + "operation": "aes256-gcm/{lib}/32B", + "library": "openssl", + "id": "aes256-gcm/openssl/32B", + "ns": 67.49499495663419, + "ns_low": 66.65291416053101, + "ns_high": 68.85075385850372, + "throughput": { + "Bytes": 32 + } + }, + { + "operation": "aes256-gcm/{lib}/32B", + "library": "rind", + "id": "aes256-gcm/rind/32B", + "ns": 60.57044534695226, + "ns_low": 60.359698755277385, + "ns_high": 60.83606432917204, + "throughput": { + "Bytes": 32 + } + }, + { + "operation": "aes256-gcm/{lib}/32B", + "library": "ring", + "id": "aes256-gcm/ring/32B", + "ns": 45.23535057960282, + "ns_low": 44.64820652312105, + "ns_high": 46.13312914053249, + "throughput": { + "Bytes": 32 + } + }, + { + "operation": "aes256-gcm/{lib}/32B", + "library": "rustcrypto", + "id": "aes256-gcm/rustcrypto/32B", + "ns": 24.79531539420785, + "ns_low": 24.60952177740821, + "ns_high": 25.00730494287996, + "throughput": { + "Bytes": 32 + } + }, + { + "operation": "aes256-gcm/{lib}/1350B", + "library": "aws-lc-rs", + "id": "aes256-gcm/aws-lc-rs/1350B", + "ns": 204.61603250071926, + "ns_low": 202.0211072758506, + "ns_high": 209.15067374147964, + "throughput": { + "Bytes": 1350 + } + }, + { + "operation": "aes256-gcm/{lib}/1350B", + "library": "graviola", + "id": "aes256-gcm/graviola/1350B", + "ns": 262.2793586458413, + "ns_low": 260.4394082181937, + "ns_high": 265.45177757910653, + "throughput": { + "Bytes": 1350 + } + }, + { + "operation": "aes256-gcm/{lib}/1350B", + "library": "libcrux", + "id": "aes256-gcm/libcrux/1350B", + "ns": 650.226496583791, + "ns_low": 642.5287491898015, + "ns_high": 659.7659404328737, + "throughput": { + "Bytes": 1350 + } + }, + { + "operation": "aes256-gcm/{lib}/1350B", + "library": "openssl", + "id": "aes256-gcm/openssl/1350B", + "ns": 221.6374042280511, + "ns_low": 219.60160611511267, + "ns_high": 224.68927199451645, + "throughput": { + "Bytes": 1350 + } + }, + { + "operation": "aes256-gcm/{lib}/1350B", + "library": "rind", + "id": "aes256-gcm/rind/1350B", + "ns": 236.91603802752581, + "ns_low": 236.16108750017008, + "ns_high": 237.67208841748123, + "throughput": { + "Bytes": 1350 + } + }, + { + "operation": "aes256-gcm/{lib}/1350B", + "library": "ring", + "id": "aes256-gcm/ring/1350B", + "ns": 219.60429992297867, + "ns_low": 218.5870730483345, + "ns_high": 220.5569257126271, + "throughput": { + "Bytes": 1350 + } + }, + { + "operation": "aes256-gcm/{lib}/1350B", + "library": "rustcrypto", + "id": "aes256-gcm/rustcrypto/1350B", + "ns": 245.58690692521134, + "ns_low": 244.96524730071735, + "ns_high": 246.3379041832574, + "throughput": { + "Bytes": 1350 + } + }, + { + "operation": "aes256-gcm/{lib}/16KB", + "library": "aws-lc-rs", + "id": "aes256-gcm/aws-lc-rs/16KB", + "ns": 1718.3689144309376, + "ns_low": 1707.6857450973853, + "ns_high": 1737.190104682408, + "throughput": { + "Bytes": 16384 + } + }, + { + "operation": "aes256-gcm/{lib}/16KB", + "library": "graviola", + "id": "aes256-gcm/graviola/16KB", + "ns": 2162.225192439244, + "ns_low": 2155.298096132623, + "ns_high": 2169.303902135473, + "throughput": { + "Bytes": 16384 + } + }, + { + "operation": "aes256-gcm/{lib}/16KB", + "library": "libcrux", + "id": "aes256-gcm/libcrux/16KB", + "ns": 7201.903871303152, + "ns_low": 7170.762973720663, + "ns_high": 7235.43614191704, + "throughput": { + "Bytes": 16384 + } + }, + { + "operation": "aes256-gcm/{lib}/16KB", + "library": "openssl", + "id": "aes256-gcm/openssl/16KB", + "ns": 1792.2607360386892, + "ns_low": 1773.4295183036807, + "ns_high": 1821.7433266518983, + "throughput": { + "Bytes": 16384 + } + }, + { + "operation": "aes256-gcm/{lib}/16KB", + "library": "rind", + "id": "aes256-gcm/rind/16KB", + "ns": 1746.183372561533, + "ns_low": 1741.3409231402904, + "ns_high": 1751.451577446347, + "throughput": { + "Bytes": 16384 + } + }, + { + "operation": "aes256-gcm/{lib}/16KB", + "library": "ring", + "id": "aes256-gcm/ring/16KB", + "ns": 2044.1494107651963, + "ns_low": 2037.2841570788319, + "ns_high": 2050.7608632997662, + "throughput": { + "Bytes": 16384 + } + }, + { + "operation": "aes256-gcm/{lib}/16KB", + "library": "rustcrypto", + "id": "aes256-gcm/rustcrypto/16KB", + "ns": 2723.6037731720935, + "ns_low": 2715.0950210280303, + "ns_high": 2731.85150468369, + "throughput": { + "Bytes": 16384 + } + }, + { + "operation": "aes256-gcm-open/{lib}/32B", + "library": "aws-lc-rs", + "id": "aes256-gcm-open/aws-lc-rs/32B", + "ns": 49.009109932569025, + "ns_low": 48.28592287324862, + "ns_high": 49.76166410934057, + "throughput": { + "Bytes": 32 + } + }, + { + "operation": "aes256-gcm-open/{lib}/32B", + "library": "graviola", + "id": "aes256-gcm-open/graviola/32B", + "ns": 85.1328870501833, + "ns_low": 84.78519223345278, + "ns_high": 85.51168750358875, + "throughput": { + "Bytes": 32 + } + }, + { + "operation": "aes256-gcm-open/{lib}/32B", + "library": "libcrux", + "id": "aes256-gcm-open/libcrux/32B", + "ns": 66.70972567089404, + "ns_low": 66.28657754131919, + "ns_high": 67.3058309105358, + "throughput": { + "Bytes": 32 + } + }, + { + "operation": "aes256-gcm-open/{lib}/32B", + "library": "openssl", + "id": "aes256-gcm-open/openssl/32B", + "ns": 67.52023526524894, + "ns_low": 67.15820833878212, + "ns_high": 67.87762387852909, + "throughput": { + "Bytes": 32 + } + }, + { + "operation": "aes256-gcm-open/{lib}/32B", + "library": "rind", + "id": "aes256-gcm-open/rind/32B", + "ns": 48.93616947311986, + "ns_low": 48.79872889300323, + "ns_high": 49.06152391047, + "throughput": { + "Bytes": 32 + } + }, + { + "operation": "aes256-gcm-open/{lib}/32B", + "library": "ring", + "id": "aes256-gcm-open/ring/32B", + "ns": 39.5669595271058, + "ns_low": 39.379875806742966, + "ns_high": 39.755857784868915, + "throughput": { + "Bytes": 32 + } + }, + { + "operation": "aes256-gcm-open/{lib}/32B", + "library": "rustcrypto", + "id": "aes256-gcm-open/rustcrypto/32B", + "ns": 40.96368158039554, + "ns_low": 40.85379497797888, + "ns_high": 41.091008413602175, + "throughput": { + "Bytes": 32 + } + }, + { + "operation": "aes256-gcm-open/{lib}/1350B", + "library": "aws-lc-rs", + "id": "aes256-gcm-open/aws-lc-rs/1350B", + "ns": 218.20847044658157, + "ns_low": 216.47597479444434, + "ns_high": 220.74081160246078, + "throughput": { + "Bytes": 1350 + } + }, + { + "operation": "aes256-gcm-open/{lib}/1350B", + "library": "graviola", + "id": "aes256-gcm-open/graviola/1350B", + "ns": 262.7193795854595, + "ns_low": 261.97992970465907, + "ns_high": 263.5205260155963, + "throughput": { + "Bytes": 1350 + } + }, + { + "operation": "aes256-gcm-open/{lib}/1350B", + "library": "libcrux", + "id": "aes256-gcm-open/libcrux/1350B", + "ns": 673.9022383066589, + "ns_low": 671.1638100917415, + "ns_high": 676.8636670625406, + "throughput": { + "Bytes": 1350 + } + }, + { + "operation": "aes256-gcm-open/{lib}/1350B", + "library": "openssl", + "id": "aes256-gcm-open/openssl/1350B", + "ns": 225.05885655444112, + "ns_low": 224.23257160737532, + "ns_high": 226.03353048692918, + "throughput": { + "Bytes": 1350 + } + }, + { + "operation": "aes256-gcm-open/{lib}/1350B", + "library": "rind", + "id": "aes256-gcm-open/rind/1350B", + "ns": 233.44670650900895, + "ns_low": 232.47968183642647, + "ns_high": 234.61554521437475, + "throughput": { + "Bytes": 1350 + } + }, + { + "operation": "aes256-gcm-open/{lib}/1350B", + "library": "ring", + "id": "aes256-gcm-open/ring/1350B", + "ns": 251.67222411423862, + "ns_low": 250.47859060326672, + "ns_high": 253.23893513968807, + "throughput": { + "Bytes": 1350 + } + }, + { + "operation": "aes256-gcm-open/{lib}/1350B", + "library": "rustcrypto", + "id": "aes256-gcm-open/rustcrypto/1350B", + "ns": 267.1556515169751, + "ns_low": 266.22539261437424, + "ns_high": 268.01441120301143, + "throughput": { + "Bytes": 1350 + } + }, + { + "operation": "aes256-gcm-open/{lib}/16KB", + "library": "aws-lc-rs", + "id": "aes256-gcm-open/aws-lc-rs/16KB", + "ns": 1834.376588759416, + "ns_low": 1828.7939762234041, + "ns_high": 1841.3100267646535, + "throughput": { + "Bytes": 16384 + } + }, + { + "operation": "aes256-gcm-open/{lib}/16KB", + "library": "graviola", + "id": "aes256-gcm-open/graviola/16KB", + "ns": 2175.7322785424944, + "ns_low": 2168.773680519793, + "ns_high": 2182.4291987245124, + "throughput": { + "Bytes": 16384 + } + }, + { + "operation": "aes256-gcm-open/{lib}/16KB", + "library": "libcrux", + "id": "aes256-gcm-open/libcrux/16KB", + "ns": 7352.989459340627, + "ns_low": 7318.1193231802445, + "ns_high": 7394.130570761572, + "throughput": { + "Bytes": 16384 + } + }, + { + "operation": "aes256-gcm-open/{lib}/16KB", + "library": "openssl", + "id": "aes256-gcm-open/openssl/16KB", + "ns": 1942.997508952559, + "ns_low": 1920.6352989143104, + "ns_high": 1980.7872048093539, + "throughput": { + "Bytes": 16384 + } + }, + { + "operation": "aes256-gcm-open/{lib}/16KB", + "library": "rind", + "id": "aes256-gcm-open/rind/16KB", + "ns": 1860.2439324429026, + "ns_low": 1844.876489310154, + "ns_high": 1884.1800629961758, + "throughput": { + "Bytes": 16384 + } + }, + { + "operation": "aes256-gcm-open/{lib}/16KB", + "library": "ring", + "id": "aes256-gcm-open/ring/16KB", + "ns": 2251.528392816415, + "ns_low": 2231.0530900255567, + "ns_high": 2285.926365095903, + "throughput": { + "Bytes": 16384 + } + }, + { + "operation": "aes256-gcm-open/{lib}/16KB", + "library": "rustcrypto", + "id": "aes256-gcm-open/rustcrypto/16KB", + "ns": 2893.0536353525376, + "ns_low": 2863.1643791353135, + "ns_high": 2943.819177600657, + "throughput": { + "Bytes": 16384 + } + }, + { + "operation": "chacha20poly1305/{lib}/32B", + "library": "aws-lc-rs", + "id": "chacha20poly1305/aws-lc-rs/32B", + "ns": 162.991821342259, + "ns_low": 160.72018090461313, + "ns_high": 166.03150187631948, + "throughput": { + "Bytes": 32 + } + }, + { + "operation": "chacha20poly1305/{lib}/32B", + "library": "graviola", + "id": "chacha20poly1305/graviola/32B", + "ns": 195.76796670680667, + "ns_low": 194.09893572642153, + "ns_high": 198.8834867006896, + "throughput": { + "Bytes": 32 + } + }, + { + "operation": "chacha20poly1305/{lib}/32B", + "library": "libcrux", + "id": "chacha20poly1305/libcrux/32B", + "ns": 171.2280512389261, + "ns_low": 170.56247197849504, + "ns_high": 172.0471560584482, + "throughput": { + "Bytes": 32 + } + }, + { + "operation": "chacha20poly1305/{lib}/32B", + "library": "openssl", + "id": "chacha20poly1305/openssl/32B", + "ns": 215.43670294614083, + "ns_low": 212.88037383708976, + "ns_high": 219.08203808360264, + "throughput": { + "Bytes": 32 + } + }, + { + "operation": "chacha20poly1305/{lib}/32B", + "library": "rind", + "id": "chacha20poly1305/rind/32B", + "ns": 184.67323354791637, + "ns_low": 183.36753525956223, + "ns_high": 186.1404414282724, + "throughput": { + "Bytes": 32 + } + }, + { + "operation": "chacha20poly1305/{lib}/32B", + "library": "ring", + "id": "chacha20poly1305/ring/32B", + "ns": 147.9772804291643, + "ns_low": 147.4869490640836, + "ns_high": 148.5365937793471, + "throughput": { + "Bytes": 32 + } + }, + { + "operation": "chacha20poly1305/{lib}/32B", + "library": "rustcrypto", + "id": "chacha20poly1305/rustcrypto/32B", + "ns": 344.4724409877305, + "ns_low": 343.1796064021236, + "ns_high": 346.1706944451044, + "throughput": { + "Bytes": 32 + } + }, + { + "operation": "chacha20poly1305/{lib}/1350B", + "library": "aws-lc-rs", + "id": "chacha20poly1305/aws-lc-rs/1350B", + "ns": 770.5555734432091, + "ns_low": 767.2616611538327, + "ns_high": 773.6077061185625, + "throughput": { + "Bytes": 1350 + } + }, + { + "operation": "chacha20poly1305/{lib}/1350B", + "library": "graviola", + "id": "chacha20poly1305/graviola/1350B", + "ns": 1246.4698513826538, + "ns_low": 1235.7590595286333, + "ns_high": 1262.944808761669, + "throughput": { + "Bytes": 1350 + } + }, + { + "operation": "chacha20poly1305/{lib}/1350B", + "library": "libcrux", + "id": "chacha20poly1305/libcrux/1350B", + "ns": 1978.8333837325433, + "ns_low": 1967.3678683444402, + "ns_high": 1993.8445091662231, + "throughput": { + "Bytes": 1350 + } + }, + { + "operation": "chacha20poly1305/{lib}/1350B", + "library": "openssl", + "id": "chacha20poly1305/openssl/1350B", + "ns": 841.7634158498398, + "ns_low": 836.1829051791889, + "ns_high": 849.7656090790592, + "throughput": { + "Bytes": 1350 + } + }, + { + "operation": "chacha20poly1305/{lib}/1350B", + "library": "rind", + "id": "chacha20poly1305/rind/1350B", + "ns": 791.5826534980527, + "ns_low": 788.5373590909071, + "ns_high": 794.7361943244749, + "throughput": { + "Bytes": 1350 + } + }, + { + "operation": "chacha20poly1305/{lib}/1350B", + "library": "ring", + "id": "chacha20poly1305/ring/1350B", + "ns": 754.5402989045286, + "ns_low": 751.9528401165477, + "ns_high": 757.2720823870424, + "throughput": { + "Bytes": 1350 + } + }, + { + "operation": "chacha20poly1305/{lib}/1350B", + "library": "rustcrypto", + "id": "chacha20poly1305/rustcrypto/1350B", + "ns": 1779.6406622493632, + "ns_low": 1774.4829714353882, + "ns_high": 1785.2459960639667, + "throughput": { + "Bytes": 1350 + } + }, + { + "operation": "chacha20poly1305/{lib}/16KB", + "library": "aws-lc-rs", + "id": "chacha20poly1305/aws-lc-rs/16KB", + "ns": 7650.583873928151, + "ns_low": 7625.627811457704, + "ns_high": 7676.102818337311, + "throughput": { + "Bytes": 16384 + } + }, + { + "operation": "chacha20poly1305/{lib}/16KB", + "library": "graviola", + "id": "chacha20poly1305/graviola/16KB", + "ns": 12845.190994783823, + "ns_low": 12719.588663373823, + "ns_high": 13037.736909227306, + "throughput": { + "Bytes": 16384 + } + }, + { + "operation": "chacha20poly1305/{lib}/16KB", + "library": "libcrux", + "id": "chacha20poly1305/libcrux/16KB", + "ns": 22068.70410784362, + "ns_low": 21973.64633254594, + "ns_high": 22165.31570459187, + "throughput": { + "Bytes": 16384 + } + }, + { + "operation": "chacha20poly1305/{lib}/16KB", + "library": "openssl", + "id": "chacha20poly1305/openssl/16KB", + "ns": 7453.47947479325, + "ns_low": 7421.320057537435, + "ns_high": 7491.687790423887, + "throughput": { + "Bytes": 16384 + } + }, + { + "operation": "chacha20poly1305/{lib}/16KB", + "library": "rind", + "id": "chacha20poly1305/rind/16KB", + "ns": 7704.975628436763, + "ns_low": 7675.365843622123, + "ns_high": 7732.83775930118, + "throughput": { + "Bytes": 16384 + } + }, + { + "operation": "chacha20poly1305/{lib}/16KB", + "library": "ring", + "id": "chacha20poly1305/ring/16KB", + "ns": 7671.631469871934, + "ns_low": 7625.414399023004, + "ns_high": 7721.35045969946, + "throughput": { + "Bytes": 16384 + } + }, + { + "operation": "chacha20poly1305/{lib}/16KB", + "library": "rustcrypto", + "id": "chacha20poly1305/rustcrypto/16KB", + "ns": 15207.060886201134, + "ns_low": 15137.947174247794, + "ns_high": 15294.725937935695, + "throughput": { + "Bytes": 16384 + } + }, + { + "operation": "xchacha20poly1305/{lib}/32B", + "library": "aws-lc-rs", + "id": "xchacha20poly1305/aws-lc-rs/32B", + "ns": 942.9103345922407, + "ns_low": 936.077340038374, + "ns_high": 949.8060845520748, + "throughput": { + "Bytes": 32 + } + }, + { + "operation": "xchacha20poly1305/{lib}/32B", + "library": "graviola", + "id": "xchacha20poly1305/graviola/32B", + "ns": 1107.6796025102065, + "ns_low": 1085.3427154627814, + "ns_high": 1129.706645825177, + "throughput": { + "Bytes": 32 + } + }, + { + "operation": "xchacha20poly1305/{lib}/32B", + "library": "libcrux", + "id": "xchacha20poly1305/libcrux/32B", + "ns": 1109.941822577766, + "ns_low": 1095.67119015643, + "ns_high": 1123.9262737159015, + "throughput": { + "Bytes": 32 + } + }, + { + "operation": "xchacha20poly1305/{lib}/32B", + "library": "rind", + "id": "xchacha20poly1305/rind/32B", + "ns": 1188.0896045919696, + "ns_low": 1160.3480451252874, + "ns_high": 1217.2634757672079, + "throughput": { + "Bytes": 32 + } + }, + { + "operation": "xchacha20poly1305/{lib}/32B", + "library": "rustcrypto", + "id": "xchacha20poly1305/rustcrypto/32B", + "ns": 1526.8386402342949, + "ns_low": 1493.2363498417646, + "ns_high": 1565.5073486770243, + "throughput": { + "Bytes": 32 + } + }, + { + "operation": "xchacha20poly1305/{lib}/1350B", + "library": "aws-lc-rs", + "id": "xchacha20poly1305/aws-lc-rs/1350B", + "ns": 1885.652252337613, + "ns_low": 1849.949957478523, + "ns_high": 1924.1551901428745, + "throughput": { + "Bytes": 1350 + } + }, + { + "operation": "xchacha20poly1305/{lib}/1350B", + "library": "graviola", + "id": "xchacha20poly1305/graviola/1350B", + "ns": 2848.489052326365, + "ns_low": 2791.8806743335476, + "ns_high": 2899.6627436170193, + "throughput": { + "Bytes": 1350 + } + }, + { + "operation": "xchacha20poly1305/{lib}/1350B", + "library": "libcrux", + "id": "xchacha20poly1305/libcrux/1350B", + "ns": 3801.668788786456, + "ns_low": 3708.8213345489526, + "ns_high": 3898.9822982208616, + "throughput": { + "Bytes": 1350 + } + }, + { + "operation": "xchacha20poly1305/{lib}/1350B", + "library": "rind", + "id": "xchacha20poly1305/rind/1350B", + "ns": 2021.6717667109995, + "ns_low": 1978.3296469593815, + "ns_high": 2073.6686883514026, + "throughput": { + "Bytes": 1350 + } + }, + { + "operation": "xchacha20poly1305/{lib}/1350B", + "library": "rustcrypto", + "id": "xchacha20poly1305/rustcrypto/1350B", + "ns": 3190.2587966982624, + "ns_low": 3130.8878928986965, + "ns_high": 3252.9789110618485, + "throughput": { + "Bytes": 1350 + } + }, + { + "operation": "xchacha20poly1305/{lib}/16KB", + "library": "aws-lc-rs", + "id": "xchacha20poly1305/aws-lc-rs/16KB", + "ns": 11425.678757510783, + "ns_low": 11262.969774222594, + "ns_high": 11595.033062341745, + "throughput": { + "Bytes": 16384 + } + }, + { + "operation": "xchacha20poly1305/{lib}/16KB", + "library": "graviola", + "id": "xchacha20poly1305/graviola/16KB", + "ns": 19236.636271981675, + "ns_low": 18947.374206952376, + "ns_high": 19547.948083646213, + "throughput": { + "Bytes": 16384 + } + }, + { + "operation": "xchacha20poly1305/{lib}/16KB", + "library": "libcrux", + "id": "xchacha20poly1305/libcrux/16KB", + "ns": 34196.44834852142, + "ns_low": 33397.36557085185, + "ns_high": 35016.50252914924, + "throughput": { + "Bytes": 16384 + } + }, + { + "operation": "xchacha20poly1305/{lib}/16KB", + "library": "rind", + "id": "xchacha20poly1305/rind/16KB", + "ns": 11364.070626399609, + "ns_low": 11182.935168919546, + "ns_high": 11543.348188153997, + "throughput": { + "Bytes": 16384 + } + }, + { + "operation": "xchacha20poly1305/{lib}/16KB", + "library": "rustcrypto", + "id": "xchacha20poly1305/rustcrypto/16KB", + "ns": 22757.862373623127, + "ns_low": 22259.557019573145, + "ns_high": 23248.556470185682, + "throughput": { + "Bytes": 16384 + } + }, + { + "operation": "quic-header-protection/aes128/{lib}", + "library": "aws-lc-rs", + "id": "quic-header-protection/aes128/aws-lc-rs", + "ns": 2.8422866829984748, + "ns_low": 2.8280073433085753, + "ns_high": 2.8590071276409295, + "throughput": null + }, + { + "operation": "quic-header-protection/aes128/{lib}", + "library": "rind", + "id": "quic-header-protection/aes128/rind", + "ns": 34.800469413175875, + "ns_low": 34.68926765568297, + "ns_high": 34.9184163852948, + "throughput": null + }, + { + "operation": "quic-header-protection/aes128/{lib}", + "library": "ring", + "id": "quic-header-protection/aes128/ring", + "ns": 3.27532262860637, + "ns_low": 3.2351014879907, + "ns_high": 3.3166742052765312, + "throughput": null + }, + { + "operation": "quic-header-protection/aes256/{lib}", + "library": "aws-lc-rs", + "id": "quic-header-protection/aes256/aws-lc-rs", + "ns": 2.9954737140824856, + "ns_low": 2.987108629182992, + "ns_high": 3.004566124396791, + "throughput": null + }, + { + "operation": "quic-header-protection/aes256/{lib}", + "library": "rind", + "id": "quic-header-protection/aes256/rind", + "ns": 37.81433898139269, + "ns_low": 37.69965380064352, + "ns_high": 37.939520553142565, + "throughput": null + }, + { + "operation": "quic-header-protection/aes256/{lib}", + "library": "ring", + "id": "quic-header-protection/aes256/ring", + "ns": 3.9194014562356223, + "ns_low": 3.8863814118147255, + "ns_high": 3.9506646036152944, + "throughput": null + }, + { + "operation": "quic-header-protection/chacha20/{lib}", + "library": "aws-lc-rs", + "id": "quic-header-protection/chacha20/aws-lc-rs", + "ns": 73.05233030515828, + "ns_low": 72.79720129360071, + "ns_high": 73.37888344731886, + "throughput": null + }, + { + "operation": "quic-header-protection/chacha20/{lib}", + "library": "rind", + "id": "quic-header-protection/chacha20/rind", + "ns": 88.58194004489343, + "ns_low": 87.66862240363868, + "ns_high": 90.08315150880857, + "throughput": null + }, + { + "operation": "quic-header-protection/chacha20/{lib}", + "library": "ring", + "id": "quic-header-protection/chacha20/ring", + "ns": 68.49958967736826, + "ns_low": 67.95632888927472, + "ns_high": 69.40151316801492, + "throughput": null + }, + { + "operation": "x25519-ecdh/{lib}", + "library": "aws-lc-rs", + "id": "x25519-ecdh/aws-lc-rs", + "ns": 17847.035085866795, + "ns_low": 17790.416689325495, + "ns_high": 17905.350853074175, + "throughput": { + "Elements": 1 + } + }, + { + "operation": "x25519-ecdh/{lib}", + "library": "graviola", + "id": "x25519-ecdh/graviola", + "ns": 17738.382542813983, + "ns_low": 17409.46241633493, + "ns_high": 18130.434112091734, + "throughput": { + "Elements": 1 + } + }, + { + "operation": "x25519-ecdh/{lib}", + "library": "libcrux", + "id": "x25519-ecdh/libcrux", + "ns": 37773.05962447518, + "ns_low": 37223.45567192131, + "ns_high": 38559.37230196979, + "throughput": { + "Elements": 1 + } + }, + { + "operation": "x25519-ecdh/{lib}", + "library": "openssl", + "id": "x25519-ecdh/openssl", + "ns": 35770.01568650632, + "ns_low": 35682.2067277902, + "ns_high": 35865.83904393075, + "throughput": { + "Elements": 1 + } + }, + { + "operation": "x25519-ecdh/{lib}", + "library": "rind", + "id": "x25519-ecdh/rind", + "ns": 16713.53999265114, + "ns_low": 16678.812710743678, + "ns_high": 16749.651799773434, + "throughput": { + "Elements": 1 + } + }, + { + "operation": "x25519-ecdh/{lib}", + "library": "ring", + "id": "x25519-ecdh/ring", + "ns": 24483.406164844095, + "ns_low": 24405.21458796733, + "ns_high": 24554.10698764622, + "throughput": { + "Elements": 1 + } + }, + { + "operation": "x25519-ecdh/{lib}", + "library": "rustcrypto", + "id": "x25519-ecdh/dalek", + "ns": 29713.58137594207, + "ns_low": 29605.300188465775, + "ns_high": 29821.335693935074, + "throughput": { + "Elements": 1 + } + }, + { + "operation": "p256-ecdh/{lib}", + "library": "aws-lc-rs", + "id": "p256-ecdh/aws-lc-rs", + "ns": 28513.197731849945, + "ns_low": 28431.86005362472, + "ns_high": 28604.89065710132, + "throughput": { + "Elements": 1 + } + }, + { + "operation": "p256-ecdh/{lib}", + "library": "graviola", + "id": "p256-ecdh/graviola", + "ns": 31558.947381409784, + "ns_low": 31120.53554986409, + "ns_high": 32389.889063433184, + "throughput": { + "Elements": 1 + } + }, + { + "operation": "p256-ecdh/{lib}", + "library": "libcrux", + "id": "p256-ecdh/libcrux", + "ns": 183715.65243534802, + "ns_low": 183016.99654356076, + "ns_high": 184496.52893254682, + "throughput": { + "Elements": 1 + } + }, + { + "operation": "p256-ecdh/{lib}", + "library": "openssl", + "id": "p256-ecdh/openssl", + "ns": 49960.12465346535, + "ns_low": 49847.431369262355, + "ns_high": 50099.81438854653, + "throughput": { + "Elements": 1 + } + }, + { + "operation": "p256-ecdh/{lib}", + "library": "rind", + "id": "p256-ecdh/rind", + "ns": 26267.222099703806, + "ns_low": 26183.425316072346, + "ns_high": 26347.0436547808, + "throughput": { + "Elements": 1 + } + }, + { + "operation": "p256-ecdh/{lib}", + "library": "ring", + "id": "p256-ecdh/ring", + "ns": 32314.551384349747, + "ns_low": 32208.720763317466, + "ns_high": 32415.221475054786, + "throughput": { + "Elements": 1 + } + }, + { + "operation": "p256-ecdh/{lib}", + "library": "rustcrypto", + "id": "p256-ecdh/p256-rustcrypto", + "ns": 180623.0017940003, + "ns_low": 180121.28497105194, + "ns_high": 181183.68102372086, + "throughput": { + "Elements": 1 + } + }, + { + "operation": "ed25519-sign/{lib}", + "library": "aws-lc-rs", + "id": "ed25519-sign/aws-lc-rs", + "ns": 4060.201678875777, + "ns_low": 4053.738907144377, + "ns_high": 4068.2990083484146, + "throughput": { + "Elements": 1 + } + }, + { + "operation": "ed25519-sign/{lib}", + "library": "graviola", + "id": "ed25519-sign/graviola", + "ns": 4170.564090852254, + "ns_low": 4142.753201553414, + "ns_high": 4215.177404100929, + "throughput": { + "Elements": 1 + } + }, + { + "operation": "ed25519-sign/{lib}", + "library": "libcrux", + "id": "ed25519-sign/libcrux", + "ns": 22115.205362406887, + "ns_low": 22033.719313461264, + "ns_high": 22211.563313093226, + "throughput": { + "Elements": 1 + } + }, + { + "operation": "ed25519-sign/{lib}", + "library": "openssl", + "id": "ed25519-sign/openssl", + "ns": 16419.561462982118, + "ns_low": 16339.180559057173, + "ns_high": 16523.875283630612, + "throughput": { + "Elements": 1 + } + }, + { + "operation": "ed25519-sign/{lib}", + "library": "rind", + "id": "ed25519-sign/rind", + "ns": 3946.105340098621, + "ns_low": 3935.7523700162947, + "ns_high": 3957.8310895214727, + "throughput": { + "Elements": 1 + } + }, + { + "operation": "ed25519-sign/{lib}", + "library": "ring", + "id": "ed25519-sign/ring", + "ns": 7065.520089721125, + "ns_low": 7035.104301235173, + "ns_high": 7103.374001942051, + "throughput": { + "Elements": 1 + } + }, + { + "operation": "ed25519-sign/{lib}", + "library": "rustcrypto", + "id": "ed25519-sign/dalek", + "ns": 8656.258643807752, + "ns_low": 8626.222907143729, + "ns_high": 8684.058275678832, + "throughput": { + "Elements": 1 + } + }, + { + "operation": "ed25519-verify/{lib}", + "library": "aws-lc-rs", + "id": "ed25519-verify/aws-lc-rs", + "ns": 18516.080874556672, + "ns_low": 18457.541958843027, + "ns_high": 18573.546999816394, + "throughput": { + "Elements": 1 + } + }, + { + "operation": "ed25519-verify/{lib}", + "library": "graviola", + "id": "ed25519-verify/graviola", + "ns": 18686.402625128183, + "ns_low": 18621.027223235607, + "ns_high": 18766.679464164292, + "throughput": { + "Elements": 1 + } + }, + { + "operation": "ed25519-verify/{lib}", + "library": "libcrux", + "id": "ed25519-verify/libcrux", + "ns": 29566.412671719198, + "ns_low": 29399.023987826964, + "ns_high": 29803.286294272482, + "throughput": { + "Elements": 1 + } + }, + { + "operation": "ed25519-verify/{lib}", + "library": "openssl", + "id": "ed25519-verify/openssl", + "ns": 41080.35388956209, + "ns_low": 40958.54557819315, + "ns_high": 41255.450882590194, + "throughput": { + "Elements": 1 + } + }, + { + "operation": "ed25519-verify/{lib}", + "library": "rind", + "id": "ed25519-verify/rind", + "ns": 18663.494043704744, + "ns_low": 18575.251889852956, + "ns_high": 18770.364270168222, + "throughput": { + "Elements": 1 + } + }, + { + "operation": "ed25519-verify/{lib}", + "library": "ring", + "id": "ed25519-verify/ring", + "ns": 19942.853384562335, + "ns_low": 19901.176253140955, + "ns_high": 19993.717908432463, + "throughput": { + "Elements": 1 + } + }, + { + "operation": "ed25519-verify/{lib}", + "library": "rustcrypto", + "id": "ed25519-verify/dalek", + "ns": 18416.52753648499, + "ns_low": 18379.084260125514, + "ns_high": 18462.493525059996, + "throughput": { + "Elements": 1 + } + }, + { + "operation": "p256-ecdsa-sign/{lib}", + "library": "aws-lc-rs", + "id": "p256-ecdsa-sign/aws-lc-rs", + "ns": 11268.719351012543, + "ns_low": 11240.422347770855, + "ns_high": 11299.85484433575, + "throughput": { + "Elements": 1 + } + }, + { + "operation": "p256-ecdsa-sign/{lib}", + "library": "graviola", + "id": "p256-ecdsa-sign/graviola", + "ns": 8827.71912729596, + "ns_low": 8721.32899537612, + "ns_high": 8979.714958983448, + "throughput": { + "Elements": 1 + } + }, + { + "operation": "p256-ecdsa-sign/{lib}", + "library": "libcrux", + "id": "p256-ecdsa-sign/libcrux", + "ns": 67377.40285962925, + "ns_low": 67111.4607987868, + "ns_high": 67700.55011959252, + "throughput": { + "Elements": 1 + } + }, + { + "operation": "p256-ecdsa-sign/{lib}", + "library": "openssl", + "id": "p256-ecdsa-sign/openssl", + "ns": 12617.513320218215, + "ns_low": 12484.64051093225, + "ns_high": 12842.23863122576, + "throughput": { + "Elements": 1 + } + }, + { + "operation": "p256-ecdsa-sign/{lib}", + "library": "rind", + "id": "p256-ecdsa-sign/rind", + "ns": 7114.70330430591, + "ns_low": 7101.186248652128, + "ns_high": 7131.300165060538, + "throughput": { + "Elements": 1 + } + }, + { + "operation": "p256-ecdsa-sign/{lib}", + "library": "ring", + "id": "p256-ecdsa-sign/ring", + "ns": 11013.241418594596, + "ns_low": 10978.956826522359, + "ns_high": 11046.228933939516, + "throughput": { + "Elements": 1 + } + }, + { + "operation": "p256-ecdsa-sign/{lib}", + "library": "rustcrypto", + "id": "p256-ecdsa-sign/rustcrypto", + "ns": 44328.30509995989, + "ns_low": 44164.709980550164, + "ns_high": 44480.07042907031, + "throughput": { + "Elements": 1 + } + }, + { + "operation": "p256-ecdsa-verify/{lib}", + "library": "aws-lc-rs", + "id": "p256-ecdsa-verify/aws-lc-rs", + "ns": 27150.10686862716, + "ns_low": 27081.99278985686, + "ns_high": 27238.775584954845, + "throughput": { + "Elements": 1 + } + }, + { + "operation": "p256-ecdsa-verify/{lib}", + "library": "graviola", + "id": "p256-ecdsa-verify/graviola", + "ns": 28603.44931593799, + "ns_low": 28232.034642139308, + "ns_high": 29226.623183405325, + "throughput": { + "Elements": 1 + } + }, + { + "operation": "p256-ecdsa-verify/{lib}", + "library": "libcrux", + "id": "p256-ecdsa-verify/libcrux", + "ns": 156536.36874390426, + "ns_low": 155372.09597937818, + "ns_high": 158195.85154570593, + "throughput": { + "Elements": 1 + } + }, + { + "operation": "p256-ecdsa-verify/{lib}", + "library": "openssl", + "id": "p256-ecdsa-verify/openssl", + "ns": 41899.98518043446, + "ns_low": 41777.39353692064, + "ns_high": 42034.08235534894, + "throughput": { + "Elements": 1 + } + }, + { + "operation": "p256-ecdsa-verify/{lib}", + "library": "rind", + "id": "p256-ecdsa-verify/rind", + "ns": 27147.981669734138, + "ns_low": 27062.84179290198, + "ns_high": 27254.648097906316, + "throughput": { + "Elements": 1 + } + }, + { + "operation": "p256-ecdsa-verify/{lib}", + "library": "ring", + "id": "p256-ecdsa-verify/ring", + "ns": 29354.205991260107, + "ns_low": 29175.810577174587, + "ns_high": 29613.464463181797, + "throughput": { + "Elements": 1 + } + }, + { + "operation": "p256-ecdsa-verify/{lib}", + "library": "rustcrypto", + "id": "p256-ecdsa-verify/rustcrypto", + "ns": 157868.30212206295, + "ns_low": 154440.8300658364, + "ns_high": 162191.72138299907, + "throughput": { + "Elements": 1 + } + }, + { + "operation": "sha256/{lib}/64B", + "library": "aws-lc-rs", + "id": "sha256/aws-lc-rs/64B", + "ns": 70.73842218488807, + "ns_low": 70.55410366993561, + "ns_high": 70.9476002282405, + "throughput": { + "Bytes": 64 + } + }, + { + "operation": "sha256/{lib}/64B", + "library": "graviola", + "id": "sha256/graviola/64B", + "ns": 35.98746023834901, + "ns_low": 35.504532986039706, + "ns_high": 36.772105440121706, + "throughput": { + "Bytes": 64 + } + }, + { + "operation": "sha256/{lib}/64B", + "library": "libcrux", + "id": "sha256/libcrux/64B", + "ns": 232.02830810248616, + "ns_low": 229.41240312867635, + "ns_high": 235.62489402813543, + "throughput": { + "Bytes": 64 + } + }, + { + "operation": "sha256/{lib}/64B", + "library": "openssl", + "id": "sha256/openssl/64B", + "ns": 161.9148860005248, + "ns_low": 161.1224760298243, + "ns_high": 162.74171364033646, + "throughput": { + "Bytes": 64 + } + }, + { + "operation": "sha256/{lib}/64B", + "library": "rind", + "id": "sha256/rind/64B", + "ns": 92.90723485387264, + "ns_low": 92.34609384304315, + "ns_high": 93.61863641024027, + "throughput": { + "Bytes": 64 + } + }, + { + "operation": "sha256/{lib}/64B", + "library": "ring", + "id": "sha256/ring/64B", + "ns": 44.82657034898283, + "ns_low": 44.635158959123785, + "ns_high": 45.01693409720784, + "throughput": { + "Bytes": 64 + } + }, + { + "operation": "sha256/{lib}/64B", + "library": "rustcrypto", + "id": "sha256/rustcrypto/64B", + "ns": 37.22892961515555, + "ns_low": 36.9627482743486, + "ns_high": 37.48143312959618, + "throughput": { + "Bytes": 64 + } + }, + { + "operation": "sha256/{lib}/1350B", + "library": "aws-lc-rs", + "id": "sha256/aws-lc-rs/1350B", + "ns": 439.6155401970144, + "ns_low": 435.5252037253867, + "ns_high": 445.0350395395323, + "throughput": { + "Bytes": 1350 + } + }, + { + "operation": "sha256/{lib}/1350B", + "library": "graviola", + "id": "sha256/graviola/1350B", + "ns": 471.7116786198718, + "ns_low": 471.59122607013, + "ns_high": 471.8727539724247, + "throughput": { + "Bytes": 1350 + } + }, + { + "operation": "sha256/{lib}/1350B", + "library": "libcrux", + "id": "sha256/libcrux/1350B", + "ns": 2517.1567940002956, + "ns_low": 2507.345639557344, + "ns_high": 2526.981789809229, + "throughput": { + "Bytes": 1350 + } + }, + { + "operation": "sha256/{lib}/1350B", + "library": "openssl", + "id": "sha256/openssl/1350B", + "ns": 531.0113109925707, + "ns_low": 528.5698271124846, + "ns_high": 533.8160596104116, + "throughput": { + "Bytes": 1350 + } + }, + { + "operation": "sha256/{lib}/1350B", + "library": "rind", + "id": "sha256/rind/1350B", + "ns": 484.46593281688297, + "ns_low": 483.66209286704486, + "ns_high": 485.8512072986412, + "throughput": { + "Bytes": 1350 + } + }, + { + "operation": "sha256/{lib}/1350B", + "library": "ring", + "id": "sha256/ring/1350B", + "ns": 413.8743984346498, + "ns_low": 410.6897543415085, + "ns_high": 417.61040640918173, + "throughput": { + "Bytes": 1350 + } + }, + { + "operation": "sha256/{lib}/1350B", + "library": "rustcrypto", + "id": "sha256/rustcrypto/1350B", + "ns": 475.10802624576854, + "ns_low": 471.360548066692, + "ns_high": 479.56282241880297, + "throughput": { + "Bytes": 1350 + } + }, + { + "operation": "sha256/{lib}/16KB", + "library": "aws-lc-rs", + "id": "sha256/aws-lc-rs/16KB", + "ns": 4869.595753718019, + "ns_low": 4859.454330579071, + "ns_high": 4884.663915560097, + "throughput": { + "Bytes": 16384 + } + }, + { + "operation": "sha256/{lib}/16KB", + "library": "graviola", + "id": "sha256/graviola/16KB", + "ns": 5761.664022007252, + "ns_low": 5734.466271004576, + "ns_high": 5799.414277846623, + "throughput": { + "Bytes": 16384 + } + }, + { + "operation": "sha256/{lib}/16KB", + "library": "libcrux", + "id": "sha256/libcrux/16KB", + "ns": 29126.840613059172, + "ns_low": 29027.531805713745, + "ns_high": 29238.384444108226, + "throughput": { + "Bytes": 16384 + } + }, + { + "operation": "sha256/{lib}/16KB", + "library": "openssl", + "id": "sha256/openssl/16KB", + "ns": 5165.81749706911, + "ns_low": 5049.583972514792, + "ns_high": 5310.483407316797, + "throughput": { + "Bytes": 16384 + } + }, + { + "operation": "sha256/{lib}/16KB", + "library": "rind", + "id": "sha256/rind/16KB", + "ns": 4940.518503364698, + "ns_low": 4921.861774685062, + "ns_high": 4963.539288576333, + "throughput": { + "Bytes": 16384 + } + }, + { + "operation": "sha256/{lib}/16KB", + "library": "ring", + "id": "sha256/ring/16KB", + "ns": 4904.774499658193, + "ns_low": 4845.407979014307, + "ns_high": 5011.609458257092, + "throughput": { + "Bytes": 16384 + } + }, + { + "operation": "sha256/{lib}/16KB", + "library": "rustcrypto", + "id": "sha256/rustcrypto/16KB", + "ns": 5688.402077588069, + "ns_low": 5660.937824222838, + "ns_high": 5726.894046988665, + "throughput": { + "Bytes": 16384 + } + }, + { + "operation": "sha512/{lib}/64B", + "library": "aws-lc-rs", + "id": "sha512/aws-lc-rs/64B", + "ns": 107.5604368598598, + "ns_low": 106.86602384927434, + "ns_high": 108.36983742275012, + "throughput": { + "Bytes": 64 + } + }, + { + "operation": "sha512/{lib}/64B", + "library": "graviola", + "id": "sha512/graviola/64B", + "ns": 177.3074688624344, + "ns_low": 174.32733084160586, + "ns_high": 182.32986344747243, + "throughput": { + "Bytes": 64 + } + }, + { + "operation": "sha512/{lib}/64B", + "library": "libcrux", + "id": "sha512/libcrux/64B", + "ns": 140.82650396295816, + "ns_low": 140.3540246022659, + "ns_high": 141.3168056929639, + "throughput": { + "Bytes": 64 + } + }, + { + "operation": "sha512/{lib}/64B", + "library": "openssl", + "id": "sha512/openssl/64B", + "ns": 211.16607187129716, + "ns_low": 210.30737816461894, + "ns_high": 212.13039470148584, + "throughput": { + "Bytes": 64 + } + }, + { + "operation": "sha512/{lib}/64B", + "library": "rind", + "id": "sha512/rind/64B", + "ns": 112.9258025448513, + "ns_low": 112.15216802010237, + "ns_high": 113.80593569363256, + "throughput": { + "Bytes": 64 + } + }, + { + "operation": "sha512/{lib}/64B", + "library": "ring", + "id": "sha512/ring/64B", + "ns": 87.61243301168022, + "ns_low": 86.988780864019, + "ns_high": 88.3627778317888, + "throughput": { + "Bytes": 64 + } + }, + { + "operation": "sha512/{lib}/64B", + "library": "rustcrypto", + "id": "sha512/rustcrypto/64B", + "ns": 78.67749427620619, + "ns_low": 78.20134862167947, + "ns_high": 79.31742905365255, + "throughput": { + "Bytes": 64 + } + }, + { + "operation": "sha512/{lib}/1350B", + "library": "aws-lc-rs", + "id": "sha512/aws-lc-rs/1350B", + "ns": 774.5393817897781, + "ns_low": 771.0785456514917, + "ns_high": 778.410362625961, + "throughput": { + "Bytes": 1350 + } + }, + { + "operation": "sha512/{lib}/1350B", + "library": "graviola", + "id": "sha512/graviola/1350B", + "ns": 1878.4555215870312, + "ns_low": 1859.1919452889329, + "ns_high": 1914.5879589711312, + "throughput": { + "Bytes": 1350 + } + }, + { + "operation": "sha512/{lib}/1350B", + "library": "libcrux", + "id": "sha512/libcrux/1350B", + "ns": 1575.8379452806687, + "ns_low": 1565.759702450602, + "ns_high": 1590.9967191099618, + "throughput": { + "Bytes": 1350 + } + }, + { + "operation": "sha512/{lib}/1350B", + "library": "openssl", + "id": "sha512/openssl/1350B", + "ns": 877.944340943142, + "ns_low": 872.3188981462666, + "ns_high": 885.1534700486383, + "throughput": { + "Bytes": 1350 + } + }, + { + "operation": "sha512/{lib}/1350B", + "library": "rind", + "id": "sha512/rind/1350B", + "ns": 827.2957418148532, + "ns_low": 820.1022846904131, + "ns_high": 836.8091190653689, + "throughput": { + "Bytes": 1350 + } + }, + { + "operation": "sha512/{lib}/1350B", + "library": "ring", + "id": "sha512/ring/1350B", + "ns": 737.3467728258972, + "ns_low": 734.9415057463513, + "ns_high": 740.5352592672191, + "throughput": { + "Bytes": 1350 + } + }, + { + "operation": "sha512/{lib}/1350B", + "library": "rustcrypto", + "id": "sha512/rustcrypto/1350B", + "ns": 722.377793084228, + "ns_low": 718.780445187092, + "ns_high": 727.268990685837, + "throughput": { + "Bytes": 1350 + } + }, + { + "operation": "sha512/{lib}/16KB", + "library": "aws-lc-rs", + "id": "sha512/aws-lc-rs/16KB", + "ns": 8697.930877137318, + "ns_low": 8682.354427348166, + "ns_high": 8725.963996562341, + "throughput": { + "Bytes": 16384 + } + }, + { + "operation": "sha512/{lib}/16KB", + "library": "graviola", + "id": "sha512/graviola/16KB", + "ns": 22109.755024171925, + "ns_low": 21746.091345795445, + "ns_high": 22654.90366402623, + "throughput": { + "Bytes": 16384 + } + }, + { + "operation": "sha512/{lib}/16KB", + "library": "libcrux", + "id": "sha512/libcrux/16KB", + "ns": 18405.63718948014, + "ns_low": 18337.84127494249, + "ns_high": 18488.195130571617, + "throughput": { + "Bytes": 16384 + } + }, + { + "operation": "sha512/{lib}/16KB", + "library": "openssl", + "id": "sha512/openssl/16KB", + "ns": 8875.222486243796, + "ns_low": 8809.462745530598, + "ns_high": 8960.840442221896, + "throughput": { + "Bytes": 16384 + } + }, + { + "operation": "sha512/{lib}/16KB", + "library": "rind", + "id": "sha512/rind/16KB", + "ns": 8773.953978750244, + "ns_low": 8746.268628764026, + "ns_high": 8812.294962986352, + "throughput": { + "Bytes": 16384 + } + }, + { + "operation": "sha512/{lib}/16KB", + "library": "ring", + "id": "sha512/ring/16KB", + "ns": 8691.230595879835, + "ns_low": 8658.294307084521, + "ns_high": 8736.798730234985, + "throughput": { + "Bytes": 16384 + } + }, + { + "operation": "sha512/{lib}/16KB", + "library": "rustcrypto", + "id": "sha512/rustcrypto/16KB", + "ns": 8497.22073679361, + "ns_low": 8482.306517359328, + "ns_high": 8514.053979223165, + "throughput": { + "Bytes": 16384 + } + }, + { + "operation": "hmac-sha256/{lib}/64B", + "library": "aws-lc-rs", + "id": "hmac-sha256/aws-lc-rs/64B", + "ns": 248.0592037369573, + "ns_low": 246.97378798081914, + "ns_high": 249.4091259838436, + "throughput": { + "Bytes": 64 + } + }, + { + "operation": "hmac-sha256/{lib}/64B", + "library": "graviola", + "id": "hmac-sha256/graviola/64B", + "ns": 114.5013940376956, + "ns_low": 113.97583604308919, + "ns_high": 115.08448611816421, + "throughput": { + "Bytes": 64 + } + }, + { + "operation": "hmac-sha256/{lib}/64B", + "library": "libcrux", + "id": "hmac-sha256/libcrux/64B", + "ns": 568.4098015110234, + "ns_low": 566.6169438013638, + "ns_high": 570.6382753655339, + "throughput": { + "Bytes": 64 + } + }, + { + "operation": "hmac-sha256/{lib}/64B", + "library": "openssl", + "id": "hmac-sha256/openssl/64B", + "ns": 2063.203904397272, + "ns_low": 2056.0513072769477, + "ns_high": 2071.3506726213677, + "throughput": { + "Bytes": 64 + } + }, + { + "operation": "hmac-sha256/{lib}/64B", + "library": "rind", + "id": "hmac-sha256/rind/64B", + "ns": 191.27047315275928, + "ns_low": 190.5605669980721, + "ns_high": 191.99669010850664, + "throughput": { + "Bytes": 64 + } + }, + { + "operation": "hmac-sha256/{lib}/64B", + "library": "ring", + "id": "hmac-sha256/ring/64B", + "ns": 136.61023036961836, + "ns_low": 136.0361484628694, + "ns_high": 137.20219545740505, + "throughput": { + "Bytes": 64 + } + }, + { + "operation": "hmac-sha256/{lib}/64B", + "library": "rustcrypto", + "id": "hmac-sha256/rustcrypto/64B", + "ns": 101.96073593193124, + "ns_low": 101.22911854585824, + "ns_high": 102.98123781055702, + "throughput": { + "Bytes": 64 + } + }, + { + "operation": "hmac-sha256/{lib}/1350B", + "library": "aws-lc-rs", + "id": "hmac-sha256/aws-lc-rs/1350B", + "ns": 619.8677593930101, + "ns_low": 615.1181180308747, + "ns_high": 626.0049931473964, + "throughput": { + "Bytes": 1350 + } + }, + { + "operation": "hmac-sha256/{lib}/1350B", + "library": "graviola", + "id": "hmac-sha256/graviola/1350B", + "ns": 556.9399128025182, + "ns_low": 556.2517816354638, + "ns_high": 558.0306175895508, + "throughput": { + "Bytes": 1350 + } + }, + { + "operation": "hmac-sha256/{lib}/1350B", + "library": "libcrux", + "id": "hmac-sha256/libcrux/1350B", + "ns": 2860.095617305703, + "ns_low": 2845.388963058907, + "ns_high": 2877.778805173485, + "throughput": { + "Bytes": 1350 + } + }, + { + "operation": "hmac-sha256/{lib}/1350B", + "library": "openssl", + "id": "hmac-sha256/openssl/1350B", + "ns": 2429.107230424785, + "ns_low": 2420.2395760081085, + "ns_high": 2437.7460427584438, + "throughput": { + "Bytes": 1350 + } + }, + { + "operation": "hmac-sha256/{lib}/1350B", + "library": "rind", + "id": "hmac-sha256/rind/1350B", + "ns": 559.2917610637388, + "ns_low": 557.8062459753309, + "ns_high": 560.994469786413, + "throughput": { + "Bytes": 1350 + } + }, + { + "operation": "hmac-sha256/{lib}/1350B", + "library": "ring", + "id": "hmac-sha256/ring/1350B", + "ns": 501.7380164023802, + "ns_low": 500.6948993948034, + "ns_high": 502.96348651094735, + "throughput": { + "Bytes": 1350 + } + }, + { + "operation": "hmac-sha256/{lib}/1350B", + "library": "rustcrypto", + "id": "hmac-sha256/rustcrypto/1350B", + "ns": 542.4556122106171, + "ns_low": 540.4479773047259, + "ns_high": 545.1349922047926, + "throughput": { + "Bytes": 1350 + } + }, + { + "operation": "hkdf-sha256/extract-expand/{lib}", + "library": "aws-lc-rs", + "id": "hkdf-sha256/extract-expand/aws-lc-rs", + "ns": 330.446551750792, + "ns_low": 329.4796538898032, + "ns_high": 331.51964036612264, + "throughput": null + }, + { + "operation": "hkdf-sha256/extract-expand/{lib}", + "library": "libcrux", + "id": "hkdf-sha256/extract-expand/libcrux", + "ns": 941.6692975676817, + "ns_low": 933.6641579218402, + "ns_high": 955.8046821025029, + "throughput": null + }, + { + "operation": "hkdf-sha256/extract-expand/{lib}", + "library": "openssl", + "id": "hkdf-sha256/extract-expand/openssl", + "ns": 2144.9664683196593, + "ns_low": 2135.3517076023772, + "ns_high": 2154.7072828047535, + "throughput": null + }, + { + "operation": "hkdf-sha256/extract-expand/{lib}", + "library": "rind", + "id": "hkdf-sha256/extract-expand/rind", + "ns": 343.3007871642758, + "ns_low": 341.9725822072688, + "ns_high": 344.71963882298803, + "throughput": null + }, + { + "operation": "hkdf-sha256/extract-expand/{lib}", + "library": "ring", + "id": "hkdf-sha256/extract-expand/ring", + "ns": 274.12577411478685, + "ns_low": 272.835730229773, + "ns_high": 275.5123079518952, + "throughput": null + }, + { + "operation": "hkdf-sha256/extract-expand/{lib}", + "library": "rustcrypto", + "id": "hkdf-sha256/extract-expand/rustcrypto", + "ns": 217.88432531715483, + "ns_low": 215.93869698136157, + "ns_high": 220.98532710630099, + "throughput": null + }, + { + "operation": "hkdf-sha256/expand/{lib}", + "library": "aws-lc-rs", + "id": "hkdf-sha256/expand/aws-lc-rs", + "ns": 154.3664995694114, + "ns_low": 153.76814085278428, + "ns_high": 154.98947075523293, + "throughput": null + }, + { + "operation": "hkdf-sha256/expand/{lib}", + "library": "libcrux", + "id": "hkdf-sha256/expand/libcrux", + "ns": 481.42720451325204, + "ns_low": 479.7777586734313, + "ns_high": 483.0303826275618, + "throughput": null + }, + { + "operation": "hkdf-sha256/expand/{lib}", + "library": "openssl", + "id": "hkdf-sha256/expand/openssl", + "ns": 1539.5780745791465, + "ns_low": 1535.2978824528293, + "ns_high": 1544.0068415154637, + "throughput": null + }, + { + "operation": "hkdf-sha256/expand/{lib}", + "library": "rind", + "id": "hkdf-sha256/expand/rind", + "ns": 108.716867907227, + "ns_low": 108.30569016413759, + "ns_high": 109.14323848742129, + "throughput": null + }, + { + "operation": "hkdf-sha256/expand/{lib}", + "library": "ring", + "id": "hkdf-sha256/expand/ring", + "ns": 93.71910115582627, + "ns_low": 93.34097592967879, + "ns_high": 94.12235107106738, + "throughput": null + }, + { + "operation": "hkdf-sha256/expand/{lib}", + "library": "rustcrypto", + "id": "hkdf-sha256/expand/rustcrypto", + "ns": 70.21676368182439, + "ns_low": 69.57091671667767, + "ns_high": 71.0655217807377, + "throughput": null + }, + { + "operation": "rsa2048-pkcs1-sha256-sign/{lib}", + "library": "aws-lc-rs", + "id": "rsa2048-pkcs1-sha256-sign/aws-lc-rs", + "ns": 285950.6153371755, + "ns_low": 283202.99721253844, + "ns_high": 290893.3213596697, + "throughput": { + "Elements": 1 + } + }, + { + "operation": "rsa2048-pkcs1-sha256-sign/{lib}", + "library": "graviola", + "id": "rsa2048-pkcs1-sha256-sign/graviola", + "ns": 556698.0795581498, + "ns_low": 554480.1910730707, + "ns_high": 559518.6194302478, + "throughput": { + "Elements": 1 + } + }, + { + "operation": "rsa2048-pkcs1-sha256-sign/{lib}", + "library": "openssl", + "id": "rsa2048-pkcs1-sha256-sign/openssl", + "ns": 341307.70224619476, + "ns_low": 340192.3706406857, + "ns_high": 342528.9585623864, + "throughput": { + "Elements": 1 + } + }, + { + "operation": "rsa2048-pkcs1-sha256-sign/{lib}", + "library": "rind", + "id": "rsa2048-pkcs1-sha256-sign/rind", + "ns": 275121.06581941777, + "ns_low": 273918.8167172235, + "ns_high": 276507.0447781048, + "throughput": { + "Elements": 1 + } + }, + { + "operation": "rsa2048-pkcs1-sha256-sign/{lib}", + "library": "ring", + "id": "rsa2048-pkcs1-sha256-sign/ring", + "ns": 322837.10114378604, + "ns_low": 322011.4490747814, + "ns_high": 323702.532368568, + "throughput": { + "Elements": 1 + } + }, + { + "operation": "rsa2048-pkcs1-sha256-sign/{lib}", + "library": "rustcrypto", + "id": "rsa2048-pkcs1-sha256-sign/rustcrypto", + "ns": 586341.2654617999, + "ns_low": 584217.6879383405, + "ns_high": 588993.7594862664, + "throughput": { + "Elements": 1 + } + }, + { + "operation": "rsa2048-pkcs1-sha256-verify/{lib}", + "library": "aws-lc-rs", + "id": "rsa2048-pkcs1-sha256-verify/aws-lc-rs", + "ns": 9478.200839510528, + "ns_low": 9442.946190585208, + "ns_high": 9514.595901734127, + "throughput": { + "Elements": 1 + } + }, + { + "operation": "rsa2048-pkcs1-sha256-verify/{lib}", + "library": "graviola", + "id": "rsa2048-pkcs1-sha256-verify/graviola", + "ns": 18508.133512542485, + "ns_low": 18449.619089096464, + "ns_high": 18567.509442775474, + "throughput": { + "Elements": 1 + } + }, + { + "operation": "rsa2048-pkcs1-sha256-verify/{lib}", + "library": "openssl", + "id": "rsa2048-pkcs1-sha256-verify/openssl", + "ns": 16664.569021066287, + "ns_low": 16610.411897698814, + "ns_high": 16723.099417285455, + "throughput": { + "Elements": 1 + } + }, + { + "operation": "rsa2048-pkcs1-sha256-verify/{lib}", + "library": "rind", + "id": "rsa2048-pkcs1-sha256-verify/rind", + "ns": 8379.928772802654, + "ns_low": 8358.019308119125, + "ns_high": 8404.840583992373, + "throughput": { + "Elements": 1 + } + }, + { + "operation": "rsa2048-pkcs1-sha256-verify/{lib}", + "library": "ring", + "id": "rsa2048-pkcs1-sha256-verify/ring", + "ns": 11045.785739016688, + "ns_low": 10980.541165811024, + "ns_high": 11131.069916752025, + "throughput": { + "Elements": 1 + } + }, + { + "operation": "rsa2048-pkcs1-sha256-verify/{lib}", + "library": "rustcrypto", + "id": "rsa2048-pkcs1-sha256-verify/rustcrypto", + "ns": 30773.740343431356, + "ns_low": 30652.004038836563, + "ns_high": 30890.222854332886, + "throughput": { + "Elements": 1 + } + }, + { + "operation": "rsa2048-pss-sha256-sign/{lib}", + "library": "aws-lc-rs", + "id": "rsa2048-pss-sha256-sign/aws-lc-rs", + "ns": 288576.60732180683, + "ns_low": 285134.1103280227, + "ns_high": 294179.89632405224, + "throughput": { + "Elements": 1 + } + }, + { + "operation": "rsa2048-pss-sha256-sign/{lib}", + "library": "graviola", + "id": "rsa2048-pss-sha256-sign/graviola", + "ns": 558566.9758977391, + "ns_low": 556370.2034577085, + "ns_high": 561198.5495016302, + "throughput": { + "Elements": 1 + } + }, + { + "operation": "rsa2048-pss-sha256-sign/{lib}", + "library": "libcrux", + "id": "rsa2048-pss-sha256-sign/libcrux", + "ns": 4482541.961428572, + "ns_low": 4462534.073428573, + "ns_high": 4511536.617750002, + "throughput": { + "Elements": 1 + } + }, + { + "operation": "rsa2048-pss-sha256-sign/{lib}", + "library": "openssl", + "id": "rsa2048-pss-sha256-sign/openssl", + "ns": 342610.8552135363, + "ns_low": 341230.0242431014, + "ns_high": 344182.6252258543, + "throughput": { + "Elements": 1 + } + }, + { + "operation": "rsa2048-pss-sha256-sign/{lib}", + "library": "rind", + "id": "rsa2048-pss-sha256-sign/rind", + "ns": 275288.9187931629, + "ns_low": 274552.0246351682, + "ns_high": 276118.43303847685, + "throughput": { + "Elements": 1 + } + }, + { + "operation": "rsa2048-pss-sha256-sign/{lib}", + "library": "ring", + "id": "rsa2048-pss-sha256-sign/ring", + "ns": 324862.87911925523, + "ns_low": 323721.0683300785, + "ns_high": 326061.8424778098, + "throughput": { + "Elements": 1 + } + }, + { + "operation": "rsa2048-pss-sha256-sign/{lib}", + "library": "rustcrypto", + "id": "rsa2048-pss-sha256-sign/rustcrypto", + "ns": 588377.2218235555, + "ns_low": 585895.866874921, + "ns_high": 591240.8012737636, + "throughput": { + "Elements": 1 + } + }, + { + "operation": "rsa2048-pss-sha256-verify/{lib}", + "library": "aws-lc-rs", + "id": "rsa2048-pss-sha256-verify/aws-lc-rs", + "ns": 9843.506951817766, + "ns_low": 9802.829693201791, + "ns_high": 9889.791274979469, + "throughput": { + "Elements": 1 + } + }, + { + "operation": "rsa2048-pss-sha256-verify/{lib}", + "library": "graviola", + "id": "rsa2048-pss-sha256-verify/graviola", + "ns": 18794.98291488104, + "ns_low": 18756.893026521306, + "ns_high": 18841.40453998714, + "throughput": { + "Elements": 1 + } + }, + { + "operation": "rsa2048-pss-sha256-verify/{lib}", + "library": "libcrux", + "id": "rsa2048-pss-sha256-verify/libcrux", + "ns": 299958.5162405793, + "ns_low": 298953.6751752861, + "ns_high": 300846.5470855981, + "throughput": { + "Elements": 1 + } + }, + { + "operation": "rsa2048-pss-sha256-verify/{lib}", + "library": "openssl", + "id": "rsa2048-pss-sha256-verify/openssl", + "ns": 17443.715759927378, + "ns_low": 17365.354290773226, + "ns_high": 17546.022850240366, + "throughput": { + "Elements": 1 + } + }, + { + "operation": "rsa2048-pss-sha256-verify/{lib}", + "library": "rind", + "id": "rsa2048-pss-sha256-verify/rind", + "ns": 8710.53774609518, + "ns_low": 8682.614855041722, + "ns_high": 8746.570905822502, + "throughput": { + "Elements": 1 + } + }, + { + "operation": "rsa2048-pss-sha256-verify/{lib}", + "library": "ring", + "id": "rsa2048-pss-sha256-verify/ring", + "ns": 11476.344666653655, + "ns_low": 11392.219805467827, + "ns_high": 11614.030129212984, + "throughput": { + "Elements": 1 + } + }, + { + "operation": "rsa2048-pss-sha256-verify/{lib}", + "library": "rustcrypto", + "id": "rsa2048-pss-sha256-verify/rustcrypto", + "ns": 39259.44720740357, + "ns_low": 38815.14621815398, + "ns_high": 40074.86305369196, + "throughput": { + "Elements": 1 + } + }, + { + "operation": "mlkem768-keygen/{lib}", + "library": "aws-lc-rs", + "id": "mlkem768-keygen/aws-lc-rs", + "ns": 7457.927221493735, + "ns_low": 7421.661420079343, + "ns_high": 7492.721332695631, + "throughput": { + "Elements": 1 + } + }, + { + "operation": "mlkem768-keygen/{lib}", + "library": "graviola", + "id": "mlkem768-keygen/graviola", + "ns": 6220.5500850635435, + "ns_low": 6184.892941594129, + "ns_high": 6266.431878737287, + "throughput": { + "Elements": 1 + } + }, + { + "operation": "mlkem768-keygen/{lib}", + "library": "libcrux", + "id": "mlkem768-keygen/libcrux-ml-kem", + "ns": 12014.163751677257, + "ns_low": 11976.327378212092, + "ns_high": 12053.973991708846, + "throughput": { + "Elements": 1 + } + }, + { + "operation": "mlkem768-keygen/{lib}", + "library": "openssl", + "id": "mlkem768-keygen/openssl", + "ns": 25056.32156630215, + "ns_low": 24971.88404415623, + "ns_high": 25143.794529767314, + "throughput": { + "Elements": 1 + } + }, + { + "operation": "mlkem768-keygen/{lib}", + "library": "rind", + "id": "mlkem768-keygen/rind", + "ns": 6197.6894108309125, + "ns_low": 6180.9578066060085, + "ns_high": 6216.531481057873, + "throughput": { + "Elements": 1 + } + }, + { + "operation": "mlkem768-keygen/{lib}", + "library": "rustcrypto", + "id": "mlkem768-keygen/rustcrypto", + "ns": 26572.111129072673, + "ns_low": 26490.49518979583, + "ns_high": 26649.498115009694, + "throughput": { + "Elements": 1 + } + }, + { + "operation": "mlkem768-encaps/{lib}", + "library": "aws-lc-rs", + "id": "mlkem768-encaps/aws-lc-rs", + "ns": 8012.388847529611, + "ns_low": 7966.256139688243, + "ns_high": 8061.279275310415, + "throughput": { + "Elements": 1 + } + }, + { + "operation": "mlkem768-encaps/{lib}", + "library": "graviola", + "id": "mlkem768-encaps/graviola", + "ns": 6403.783334747533, + "ns_low": 6381.5343012163985, + "ns_high": 6426.863207919315, + "throughput": { + "Elements": 1 + } + }, + { + "operation": "mlkem768-encaps/{lib}", + "library": "libcrux", + "id": "mlkem768-encaps/libcrux-ml-kem", + "ns": 9390.819004262768, + "ns_low": 9304.928661738204, + "ns_high": 9505.656573568049, + "throughput": { + "Elements": 1 + } + }, + { + "operation": "mlkem768-encaps/{lib}", + "library": "openssl", + "id": "mlkem768-encaps/openssl", + "ns": 24066.242088842915, + "ns_low": 23936.541831654744, + "ns_high": 24192.555684437535, + "throughput": { + "Elements": 1 + } + }, + { + "operation": "mlkem768-encaps/{lib}", + "library": "rind", + "id": "mlkem768-encaps/rind", + "ns": 6838.6622822724885, + "ns_low": 6812.49359523521, + "ns_high": 6864.277414423983, + "throughput": { + "Elements": 1 + } + }, + { + "operation": "mlkem768-encaps/{lib}", + "library": "rustcrypto", + "id": "mlkem768-encaps/rustcrypto", + "ns": 27770.834500584388, + "ns_low": 27672.787948311412, + "ns_high": 27878.807727590618, + "throughput": { + "Elements": 1 + } + }, + { + "operation": "mlkem768-decaps/{lib}", + "library": "aws-lc-rs", + "id": "mlkem768-decaps/aws-lc-rs", + "ns": 7745.985914154142, + "ns_low": 7692.910427478518, + "ns_high": 7808.770122283336, + "throughput": { + "Elements": 1 + } + }, + { + "operation": "mlkem768-decaps/{lib}", + "library": "graviola", + "id": "mlkem768-decaps/graviola", + "ns": 4050.658025881906, + "ns_low": 4034.6711827487366, + "ns_high": 4064.936531610453, + "throughput": { + "Elements": 1 + } + }, + { + "operation": "mlkem768-decaps/{lib}", + "library": "libcrux", + "id": "mlkem768-decaps/libcrux-ml-kem", + "ns": 9576.993598814039, + "ns_low": 9500.988628355055, + "ns_high": 9696.350724455313, + "throughput": { + "Elements": 1 + } + }, + { + "operation": "mlkem768-decaps/{lib}", + "library": "openssl", + "id": "mlkem768-decaps/openssl", + "ns": 24432.869558386286, + "ns_low": 24350.496095511426, + "ns_high": 24507.49955721615, + "throughput": { + "Elements": 1 + } + }, + { + "operation": "mlkem768-decaps/{lib}", + "library": "rind", + "id": "mlkem768-decaps/rind", + "ns": 4169.226445091035, + "ns_low": 4130.954574093383, + "ns_high": 4233.961221928273, + "throughput": { + "Elements": 1 + } + }, + { + "operation": "mlkem768-decaps/{lib}", + "library": "rustcrypto", + "id": "mlkem768-decaps/rustcrypto", + "ns": 34060.834756251745, + "ns_low": 33930.88137777045, + "ns_high": 34204.93643357876, + "throughput": { + "Elements": 1 + } + }, + { + "operation": "p384-ecdh/{lib}", + "library": "aws-lc-rs", + "id": "p384-ecdh/aws-lc-rs", + "ns": 105754.00631545244, + "ns_low": 104347.55400001715, + "ns_high": 107708.61881157817, + "throughput": { + "Elements": 1 + } + }, + { + "operation": "p384-ecdh/{lib}", + "library": "graviola", + "id": "p384-ecdh/graviola", + "ns": 153839.92527560217, + "ns_low": 152975.71711449782, + "ns_high": 155007.51852600605, + "throughput": { + "Elements": 1 + } + }, + { + "operation": "p384-ecdh/{lib}", + "library": "openssl", + "id": "p384-ecdh/openssl", + "ns": 279510.5114831782, + "ns_low": 278538.1455098878, + "ns_high": 280838.90272988396, + "throughput": { + "Elements": 1 + } + }, + { + "operation": "p384-ecdh/{lib}", + "library": "rind", + "id": "p384-ecdh/rind", + "ns": 91485.10000379995, + "ns_low": 91193.37463666798, + "ns_high": 91813.40340843369, + "throughput": { + "Elements": 1 + } + }, + { + "operation": "p384-ecdh/{lib}", + "library": "ring", + "id": "p384-ecdh/ring", + "ns": 412476.9824131816, + "ns_low": 411188.45212049613, + "ns_high": 413785.10743395216, + "throughput": { + "Elements": 1 + } + }, + { + "operation": "p384-ecdh/{lib}", + "library": "rustcrypto", + "id": "p384-ecdh/p384-rustcrypto", + "ns": 494197.38824146596, + "ns_low": 491904.6824259468, + "ns_high": 497302.6938056767, + "throughput": { + "Elements": 1 + } + }, + { + "operation": "p384-ecdsa-sign/{lib}", + "library": "aws-lc-rs", + "id": "p384-ecdsa-sign/aws-lc-rs", + "ns": 49161.94829091405, + "ns_low": 49032.724861964714, + "ns_high": 49331.94745446585, + "throughput": { + "Elements": 1 + } + }, + { + "operation": "p384-ecdsa-sign/{lib}", + "library": "graviola", + "id": "p384-ecdsa-sign/graviola", + "ns": 81121.9397048175, + "ns_low": 80843.90970870088, + "ns_high": 81457.56729956761, + "throughput": { + "Elements": 1 + } + }, + { + "operation": "p384-ecdsa-sign/{lib}", + "library": "openssl", + "id": "p384-ecdsa-sign/openssl", + "ns": 104841.90729914783, + "ns_low": 103906.085870834, + "ns_high": 106272.62094814128, + "throughput": { + "Elements": 1 + } + }, + { + "operation": "p384-ecdsa-sign/{lib}", + "library": "rind", + "id": "p384-ecdsa-sign/rind", + "ns": 22933.01759056962, + "ns_low": 22855.733097120577, + "ns_high": 23010.107238523364, + "throughput": { + "Elements": 1 + } + }, + { + "operation": "p384-ecdsa-sign/{lib}", + "library": "ring", + "id": "p384-ecdsa-sign/ring", + "ns": 223717.99831830943, + "ns_low": 222962.20921053775, + "ns_high": 224502.32340723136, + "throughput": { + "Elements": 1 + } + }, + { + "operation": "p384-ecdsa-sign/{lib}", + "library": "rustcrypto", + "id": "p384-ecdsa-sign/rustcrypto", + "ns": 112641.95977341017, + "ns_low": 112280.1661165374, + "ns_high": 113075.93404289242, + "throughput": { + "Elements": 1 + } + }, + { + "operation": "p384-ecdsa-verify/{lib}", + "library": "aws-lc-rs", + "id": "p384-ecdsa-verify/aws-lc-rs", + "ns": 111268.97887296192, + "ns_low": 110697.03408650003, + "ns_high": 112119.56362455184, + "throughput": { + "Elements": 1 + } + }, + { + "operation": "p384-ecdsa-verify/{lib}", + "library": "graviola", + "id": "p384-ecdsa-verify/graviola", + "ns": 151781.94423895376, + "ns_low": 151202.09958415775, + "ns_high": 152451.38142722612, + "throughput": { + "Elements": 1 + } + }, + { + "operation": "p384-ecdsa-verify/{lib}", + "library": "openssl", + "id": "p384-ecdsa-verify/openssl", + "ns": 238325.14094872173, + "ns_low": 236751.47366189587, + "ns_high": 240317.24791323702, + "throughput": { + "Elements": 1 + } + }, + { + "operation": "p384-ecdsa-verify/{lib}", + "library": "rind", + "id": "p384-ecdsa-verify/rind", + "ns": 88121.62098503241, + "ns_low": 87218.64451691655, + "ns_high": 89690.14557320211, + "throughput": { + "Elements": 1 + } + }, + { + "operation": "p384-ecdsa-verify/{lib}", + "library": "ring", + "id": "p384-ecdsa-verify/ring", + "ns": 396568.4749475395, + "ns_low": 395289.2973696234, + "ns_high": 398093.7629589674, + "throughput": { + "Elements": 1 + } + }, + { + "operation": "p384-ecdsa-verify/{lib}", + "library": "rustcrypto", + "id": "p384-ecdsa-verify/rustcrypto", + "ns": 426431.690873356, + "ns_low": 425171.9479945168, + "ns_high": 427740.85670219787, + "throughput": { + "Elements": 1 + } + }, + { + "operation": "p521-ecdh/{lib}", + "library": "aws-lc-rs", + "id": "p521-ecdh/aws-lc-rs", + "ns": 143202.77908970002, + "ns_low": 142539.35000848284, + "ns_high": 143977.10288909034, + "throughput": { + "Elements": 1 + } + }, + { + "operation": "p521-ecdh/{lib}", + "library": "openssl", + "id": "p521-ecdh/openssl", + "ns": 247223.86034284026, + "ns_low": 246289.21111287762, + "ns_high": 248344.46338666652, + "throughput": { + "Elements": 1 + } + }, + { + "operation": "p521-ecdh/{lib}", + "library": "rind", + "id": "p521-ecdh/rind", + "ns": 130918.80929156199, + "ns_low": 129810.35198514564, + "ns_high": 132732.68484097364, + "throughput": { + "Elements": 1 + } + }, + { + "operation": "p521-ecdh/{lib}", + "library": "rustcrypto", + "id": "p521-ecdh/rustcrypto", + "ns": 397101.2647125757, + "ns_low": 394464.76814599073, + "ns_high": 399726.03525750426, + "throughput": { + "Elements": 1 + } + }, + { + "operation": "p521-ecdsa-sign/{lib}", + "library": "aws-lc-rs", + "id": "p521-ecdsa-sign/aws-lc-rs", + "ns": 84325.9635141126, + "ns_low": 83924.29574493854, + "ns_high": 84779.64494621879, + "throughput": { + "Elements": 1 + } + }, + { + "operation": "p521-ecdsa-sign/{lib}", + "library": "openssl", + "id": "p521-ecdsa-sign/openssl", + "ns": 132130.129325846, + "ns_low": 131823.93921538335, + "ns_high": 132474.9777185792, + "throughput": { + "Elements": 1 + } + }, + { + "operation": "p521-ecdsa-sign/{lib}", + "library": "rind", + "id": "p521-ecdsa-sign/rind", + "ns": 36321.745301332594, + "ns_low": 36233.11610419715, + "ns_high": 36422.178459927716, + "throughput": { + "Elements": 1 + } + }, + { + "operation": "p521-ecdsa-sign/{lib}", + "library": "rustcrypto", + "id": "p521-ecdsa-sign/rustcrypto", + "ns": 79728.57842766366, + "ns_low": 79466.38934803421, + "ns_high": 79971.82040938266, + "throughput": { + "Elements": 1 + } + }, + { + "operation": "p521-ecdsa-verify/{lib}", + "library": "aws-lc-rs", + "id": "p521-ecdsa-verify/aws-lc-rs", + "ns": 167213.53114526378, + "ns_low": 166194.61368345196, + "ns_high": 168683.6492850656, + "throughput": { + "Elements": 1 + } + }, + { + "operation": "p521-ecdsa-verify/{lib}", + "library": "openssl", + "id": "p521-ecdsa-verify/openssl", + "ns": 254801.01109896065, + "ns_low": 253525.0858063459, + "ns_high": 256285.80829784332, + "throughput": { + "Elements": 1 + } + }, + { + "operation": "p521-ecdsa-verify/{lib}", + "library": "rind", + "id": "p521-ecdsa-verify/rind", + "ns": 121063.00617644451, + "ns_low": 120375.05570057791, + "ns_high": 121918.86988025444, + "throughput": { + "Elements": 1 + } + }, + { + "operation": "p521-ecdsa-verify/{lib}", + "library": "rustcrypto", + "id": "p521-ecdsa-verify/rustcrypto", + "ns": 253061.37536279002, + "ns_low": 251200.85690792042, + "ns_high": 255881.20026495843, + "throughput": { + "Elements": 1 + } + } + ], + "build_cost": { + "status": "failed", + "started": "2026-11-07T03:24:20+00:00", + "reason": "error: host is busy (6.6 of 10 CPUs busy)" + } +} diff --git a/benchmarks/gaps.toml b/benchmarks/gaps.toml index 7c083f13b..c867860fb 100644 --- a/benchmarks/gaps.toml +++ b/benchmarks/gaps.toml @@ -47,3 +47,33 @@ reason = "CPUs older than Broadwell and Zen lack ADX, and so do virtual CPUs tha operations = ["chacha20poly1305/*/16KB", "xchacha20poly1305/*/16KB"] on = ["no AES-NI"] reason = "Without SSE4.1 rind runs Graviola's scalar Poly1305 rather than port BoringSSL's SSE2 `poly1305_vec.c` for CPUs older than Westmere, as ALGORITHMS.md records." + +[[gap]] +operations = [ + "aes128-gcm/32B", + "aes128-gcm/1350B", + "aes128-gcm-open/32B", + "aes128-gcm-open/1350B", + "aes256-gcm/32B", + "aes256-gcm/1350B", + "aes256-gcm-open/32B", + "chacha20poly1305/32B", + "quic-header-protection/aes128", + "quic-header-protection/aes256", + "quic-header-protection/chacha20", + "sha256/64B", + "sha256/1350B", + "sha512/64B", + "sha512/1350B", + "hmac-sha256/64B", + "hmac-sha256/1350B", + "hkdf-sha256/extract-expand", + "hkdf-sha256/expand", +] +on = ["kixtop"] +reason = "DIT: the M4 has it, and rind turns it on and off around every call that handles a secret, which costs about 35 to 55 ns a call there; the other libraries never set it. Keeping it per call was decided with the maintainer from [#387](https://github.com/moq-dev/rind/pull/387)'s findings, and [#431](https://github.com/moq-dev/rind/pull/431)'s `rind::cpu::hold_dit()` pays it once across a batch of calls. With DIT denied (`--cfg rind_cpu_disable` and `RIND_CPU_DISABLE_dit`), the same commit measured each of these within 10% of the fastest library but AES header protection (1.2× aws-lc-rs's 2.9 ns) and HMAC-SHA-256 at 64 B (1.15× RustCrypto's 101 ns)." + +[[gap]] +operations = ["xchacha20poly1305/32B"] +on = ["kixtop"] +reason = "Noise: a rerun of the row on the same commit measured 1.04× aws-lc-rs's time, as did the run before this one, on a commit that changed only x86_64 code. The next refresh rechecks it." diff --git a/benchmarks/headline-dark.svg b/benchmarks/headline-dark.svg index 9ba096078..1330f8a7c 100644 --- a/benchmarks/headline-dark.svg +++ b/benchmarks/headline-dark.svg @@ -1,105 +1,105 @@ Time over rind's for common TLS and QUIC operations and a rustls client's build Time over rind's: shorter is faster -The geometric mean over nixos, desktop, nixos2, ovh-iad, and ovh-sea (x86_64), with a whisker across them. BENCHMARKS.md has every time. +The geometric mean over nixos, desktop, nixos2, kixtop, ovh-iad, and ovh-sea (aarch64 and x86_64), with a whisker across them. BENCHMARKS.md has every time. full handshake, X25519MLKEM768 rind -full handshake, X25519MLKEM768, rind: nixos 260.78 µs, 1.00× rind's; desktop 174.97 µs, 1.00× rind's; nixos2 302.43 µs, 1.00× rind's; ovh-iad 625.81 µs, 1.00× rind's; ovh-sea 580.07 µs, 1.00× rind's +full handshake, X25519MLKEM768, rind: nixos 260.78 µs, 1.00× rind's; desktop 174.97 µs, 1.00× rind's; nixos2 302.43 µs, 1.00× rind's; kixtop 177.98 µs, 1.00× rind's; ovh-iad 625.81 µs, 1.00× rind's; ovh-sea 580.07 µs, 1.00× rind's 1× aws-lc-rs -full handshake, X25519MLKEM768, aws-lc-rs: nixos 331.87 µs, 1.27× rind's; desktop 235.60 µs, 1.35× rind's; nixos2 458.06 µs, 1.51× rind's; ovh-iad 731.87 µs, 1.17× rind's; ovh-sea 697.59 µs, 1.20× rind's +full handshake, X25519MLKEM768, aws-lc-rs: nixos 331.87 µs, 1.27× rind's; desktop 235.60 µs, 1.35× rind's; nixos2 458.06 µs, 1.51× rind's; kixtop 214.67 µs, 1.21× rind's; ovh-iad 731.87 µs, 1.17× rind's; ovh-sea 697.59 µs, 1.20× rind's -1.30× +1.28× ring not offered AES-128-GCM seal, 1350 B rind -AES-128-GCM seal, 1350 B, rind: nixos 165 ns, 1.00× rind's; desktop 94 ns, 1.00× rind's; nixos2 246 ns, 1.00× rind's; ovh-iad 398 ns, 1.00× rind's; ovh-sea 380 ns, 1.00× rind's +AES-128-GCM seal, 1350 B, rind: nixos 165 ns, 1.00× rind's; desktop 94 ns, 1.00× rind's; nixos2 246 ns, 1.00× rind's; kixtop 212 ns, 1.00× rind's; ovh-iad 398 ns, 1.00× rind's; ovh-sea 380 ns, 1.00× rind's 1× aws-lc-rs -AES-128-GCM seal, 1350 B, aws-lc-rs: nixos 291 ns, 1.77× rind's; desktop 149 ns, 1.59× rind's; nixos2 285 ns, 1.16× rind's; ovh-iad 460 ns, 1.15× rind's; ovh-sea 439 ns, 1.15× rind's - - +AES-128-GCM seal, 1350 B, aws-lc-rs: nixos 291 ns, 1.77× rind's; desktop 149 ns, 1.59× rind's; nixos2 285 ns, 1.16× rind's; kixtop 180 ns, 0.85× rind's; ovh-iad 460 ns, 1.15× rind's; ovh-sea 439 ns, 1.15× rind's + + -1.34× +1.24× ring -AES-128-GCM seal, 1350 B, ring: nixos 191 ns, 1.16× rind's; desktop 118 ns, 1.26× rind's; nixos2 277 ns, 1.13× rind's; ovh-iad 475 ns, 1.19× rind's; ovh-sea 438 ns, 1.15× rind's - - +AES-128-GCM seal, 1350 B, ring: nixos 191 ns, 1.16× rind's; desktop 118 ns, 1.26× rind's; nixos2 277 ns, 1.13× rind's; kixtop 212 ns, 1.00× rind's; ovh-iad 475 ns, 1.19× rind's; ovh-sea 438 ns, 1.15× rind's + + -1.18× +1.15× ChaCha20-Poly1305 seal, 1350 B rind -ChaCha20-Poly1305 seal, 1350 B, rind: nixos 533 ns, 1.00× rind's; desktop 441 ns, 1.00× rind's; nixos2 718 ns, 1.00× rind's; ovh-iad 1.07 µs, 1.00× rind's; ovh-sea 1.04 µs, 1.00× rind's +ChaCha20-Poly1305 seal, 1350 B, rind: nixos 533 ns, 1.00× rind's; desktop 441 ns, 1.00× rind's; nixos2 718 ns, 1.00× rind's; kixtop 792 ns, 1.00× rind's; ovh-iad 1.07 µs, 1.00× rind's; ovh-sea 1.04 µs, 1.00× rind's 1× aws-lc-rs -ChaCha20-Poly1305 seal, 1350 B, aws-lc-rs: nixos 532 ns, 1.00× rind's; desktop 453 ns, 1.03× rind's; nixos2 755 ns, 1.05× rind's; ovh-iad 1.10 µs, 1.03× rind's; ovh-sea 1.05 µs, 1.02× rind's - - +ChaCha20-Poly1305 seal, 1350 B, aws-lc-rs: nixos 532 ns, 1.00× rind's; desktop 453 ns, 1.03× rind's; nixos2 755 ns, 1.05× rind's; kixtop 771 ns, 0.97× rind's; ovh-iad 1.10 µs, 1.03× rind's; ovh-sea 1.05 µs, 1.02× rind's + + 1.02× ring -ChaCha20-Poly1305 seal, 1350 B, ring: nixos 527 ns, 0.99× rind's; desktop 447 ns, 1.01× rind's; nixos2 714 ns, 1.00× rind's; ovh-iad 1.08 µs, 1.00× rind's; ovh-sea 1.04 µs, 1.00× rind's - - +ChaCha20-Poly1305 seal, 1350 B, ring: nixos 527 ns, 0.99× rind's; desktop 447 ns, 1.01× rind's; nixos2 714 ns, 1.00× rind's; kixtop 755 ns, 0.95× rind's; ovh-iad 1.08 µs, 1.00× rind's; ovh-sea 1.04 µs, 1.00× rind's + + -1.00× +0.99× X25519 rind -X25519, rind: nixos 23.97 µs, 1.00× rind's; desktop 19.68 µs, 1.00× rind's; nixos2 25.00 µs, 1.00× rind's; ovh-iad 51.79 µs, 1.00× rind's; ovh-sea 51.10 µs, 1.00× rind's +X25519, rind: nixos 23.97 µs, 1.00× rind's; desktop 19.68 µs, 1.00× rind's; nixos2 25.00 µs, 1.00× rind's; kixtop 16.71 µs, 1.00× rind's; ovh-iad 51.79 µs, 1.00× rind's; ovh-sea 51.10 µs, 1.00× rind's 1× aws-lc-rs -X25519, aws-lc-rs: nixos 24.61 µs, 1.03× rind's; desktop 19.54 µs, 0.99× rind's; nixos2 30.89 µs, 1.24× rind's; ovh-iad 55.09 µs, 1.06× rind's; ovh-sea 51.15 µs, 1.00× rind's +X25519, aws-lc-rs: nixos 24.61 µs, 1.03× rind's; desktop 19.54 µs, 0.99× rind's; nixos2 30.89 µs, 1.24× rind's; kixtop 17.85 µs, 1.07× rind's; ovh-iad 55.09 µs, 1.06× rind's; ovh-sea 51.15 µs, 1.00× rind's 1.06× ring -X25519, ring: nixos 46.72 µs, 1.95× rind's; desktop 35.63 µs, 1.81× rind's; nixos2 53.60 µs, 2.14× rind's; ovh-iad 79.18 µs, 1.53× rind's; ovh-sea 76.22 µs, 1.49× rind's - - +X25519, ring: nixos 46.72 µs, 1.95× rind's; desktop 35.63 µs, 1.81× rind's; nixos2 53.60 µs, 2.14× rind's; kixtop 24.48 µs, 1.46× rind's; ovh-iad 79.18 µs, 1.53× rind's; ovh-sea 76.22 µs, 1.49× rind's + + -1.77× +1.71× P-256 ECDSA sign rind -P-256 ECDSA sign, rind: nixos 9.62 µs, 1.00× rind's; desktop 6.84 µs, 1.00× rind's; nixos2 13.11 µs, 1.00× rind's; ovh-iad 22.42 µs, 1.00× rind's; ovh-sea 21.44 µs, 1.00× rind's +P-256 ECDSA sign, rind: nixos 9.62 µs, 1.00× rind's; desktop 6.84 µs, 1.00× rind's; nixos2 13.11 µs, 1.00× rind's; kixtop 7.11 µs, 1.00× rind's; ovh-iad 22.42 µs, 1.00× rind's; ovh-sea 21.44 µs, 1.00× rind's 1× aws-lc-rs -P-256 ECDSA sign, aws-lc-rs: nixos 12.66 µs, 1.32× rind's; desktop 12.33 µs, 1.80× rind's; nixos2 19.80 µs, 1.51× rind's; ovh-iad 24.53 µs, 1.09× rind's; ovh-sea 23.93 µs, 1.12× rind's +P-256 ECDSA sign, aws-lc-rs: nixos 12.66 µs, 1.32× rind's; desktop 12.33 µs, 1.80× rind's; nixos2 19.80 µs, 1.51× rind's; kixtop 11.27 µs, 1.58× rind's; ovh-iad 24.53 µs, 1.09× rind's; ovh-sea 23.93 µs, 1.12× rind's -1.34× +1.38× ring -P-256 ECDSA sign, ring: nixos 13.68 µs, 1.42× rind's; desktop 12.24 µs, 1.79× rind's; nixos2 14.86 µs, 1.13× rind's; ovh-iad 26.21 µs, 1.17× rind's; ovh-sea 24.84 µs, 1.16× rind's +P-256 ECDSA sign, ring: nixos 13.68 µs, 1.42× rind's; desktop 12.24 µs, 1.79× rind's; nixos2 14.86 µs, 1.13× rind's; kixtop 11.01 µs, 1.55× rind's; ovh-iad 26.21 µs, 1.17× rind's; ovh-sea 24.84 µs, 1.16× rind's -1.31× +1.35× RSA-2048 PSS sign rind -RSA-2048 PSS sign, rind: nixos 424.30 µs, 1.00× rind's; desktop 346.52 µs, 1.00× rind's; nixos2 445.92 µs, 1.00× rind's; ovh-iad 819.13 µs, 1.00× rind's; ovh-sea 743.95 µs, 1.00× rind's +RSA-2048 PSS sign, rind: nixos 424.30 µs, 1.00× rind's; desktop 346.52 µs, 1.00× rind's; nixos2 445.92 µs, 1.00× rind's; kixtop 275.29 µs, 1.00× rind's; ovh-iad 819.13 µs, 1.00× rind's; ovh-sea 743.95 µs, 1.00× rind's 1× aws-lc-rs -RSA-2048 PSS sign, aws-lc-rs: nixos 481.00 µs, 1.13× rind's; desktop 350.45 µs, 1.01× rind's; nixos2 461.87 µs, 1.04× rind's; ovh-iad 807.21 µs, 0.99× rind's; ovh-sea 772.15 µs, 1.04× rind's +RSA-2048 PSS sign, aws-lc-rs: nixos 481.00 µs, 1.13× rind's; desktop 350.45 µs, 1.01× rind's; nixos2 461.87 µs, 1.04× rind's; kixtop 288.58 µs, 1.05× rind's; ovh-iad 807.21 µs, 0.99× rind's; ovh-sea 772.15 µs, 1.04× rind's 1.04× ring -RSA-2048 PSS sign, ring: nixos 471.53 µs, 1.11× rind's; desktop 341.45 µs, 0.99× rind's; nixos2 437.28 µs, 0.98× rind's; ovh-iad 1.04 ms, 1.27× rind's; ovh-sea 987.95 µs, 1.33× rind's +RSA-2048 PSS sign, ring: nixos 471.53 µs, 1.11× rind's; desktop 341.45 µs, 0.99× rind's; nixos2 437.28 µs, 0.98× rind's; kixtop 324.86 µs, 1.18× rind's; ovh-iad 1.04 ms, 1.27× rind's; ovh-sea 987.95 µs, 1.33× rind's -1.13× +1.14× cold build of a rustls client rind diff --git a/benchmarks/headline.svg b/benchmarks/headline.svg index f02203dc7..c21b79d35 100644 --- a/benchmarks/headline.svg +++ b/benchmarks/headline.svg @@ -1,105 +1,105 @@ Time over rind's for common TLS and QUIC operations and a rustls client's build Time over rind's: shorter is faster -The geometric mean over nixos, desktop, nixos2, ovh-iad, and ovh-sea (x86_64), with a whisker across them. BENCHMARKS.md has every time. +The geometric mean over nixos, desktop, nixos2, kixtop, ovh-iad, and ovh-sea (aarch64 and x86_64), with a whisker across them. BENCHMARKS.md has every time. full handshake, X25519MLKEM768 rind -full handshake, X25519MLKEM768, rind: nixos 260.78 µs, 1.00× rind's; desktop 174.97 µs, 1.00× rind's; nixos2 302.43 µs, 1.00× rind's; ovh-iad 625.81 µs, 1.00× rind's; ovh-sea 580.07 µs, 1.00× rind's +full handshake, X25519MLKEM768, rind: nixos 260.78 µs, 1.00× rind's; desktop 174.97 µs, 1.00× rind's; nixos2 302.43 µs, 1.00× rind's; kixtop 177.98 µs, 1.00× rind's; ovh-iad 625.81 µs, 1.00× rind's; ovh-sea 580.07 µs, 1.00× rind's 1× aws-lc-rs -full handshake, X25519MLKEM768, aws-lc-rs: nixos 331.87 µs, 1.27× rind's; desktop 235.60 µs, 1.35× rind's; nixos2 458.06 µs, 1.51× rind's; ovh-iad 731.87 µs, 1.17× rind's; ovh-sea 697.59 µs, 1.20× rind's +full handshake, X25519MLKEM768, aws-lc-rs: nixos 331.87 µs, 1.27× rind's; desktop 235.60 µs, 1.35× rind's; nixos2 458.06 µs, 1.51× rind's; kixtop 214.67 µs, 1.21× rind's; ovh-iad 731.87 µs, 1.17× rind's; ovh-sea 697.59 µs, 1.20× rind's -1.30× +1.28× ring not offered AES-128-GCM seal, 1350 B rind -AES-128-GCM seal, 1350 B, rind: nixos 165 ns, 1.00× rind's; desktop 94 ns, 1.00× rind's; nixos2 246 ns, 1.00× rind's; ovh-iad 398 ns, 1.00× rind's; ovh-sea 380 ns, 1.00× rind's +AES-128-GCM seal, 1350 B, rind: nixos 165 ns, 1.00× rind's; desktop 94 ns, 1.00× rind's; nixos2 246 ns, 1.00× rind's; kixtop 212 ns, 1.00× rind's; ovh-iad 398 ns, 1.00× rind's; ovh-sea 380 ns, 1.00× rind's 1× aws-lc-rs -AES-128-GCM seal, 1350 B, aws-lc-rs: nixos 291 ns, 1.77× rind's; desktop 149 ns, 1.59× rind's; nixos2 285 ns, 1.16× rind's; ovh-iad 460 ns, 1.15× rind's; ovh-sea 439 ns, 1.15× rind's - - +AES-128-GCM seal, 1350 B, aws-lc-rs: nixos 291 ns, 1.77× rind's; desktop 149 ns, 1.59× rind's; nixos2 285 ns, 1.16× rind's; kixtop 180 ns, 0.85× rind's; ovh-iad 460 ns, 1.15× rind's; ovh-sea 439 ns, 1.15× rind's + + -1.34× +1.24× ring -AES-128-GCM seal, 1350 B, ring: nixos 191 ns, 1.16× rind's; desktop 118 ns, 1.26× rind's; nixos2 277 ns, 1.13× rind's; ovh-iad 475 ns, 1.19× rind's; ovh-sea 438 ns, 1.15× rind's - - +AES-128-GCM seal, 1350 B, ring: nixos 191 ns, 1.16× rind's; desktop 118 ns, 1.26× rind's; nixos2 277 ns, 1.13× rind's; kixtop 212 ns, 1.00× rind's; ovh-iad 475 ns, 1.19× rind's; ovh-sea 438 ns, 1.15× rind's + + -1.18× +1.15× ChaCha20-Poly1305 seal, 1350 B rind -ChaCha20-Poly1305 seal, 1350 B, rind: nixos 533 ns, 1.00× rind's; desktop 441 ns, 1.00× rind's; nixos2 718 ns, 1.00× rind's; ovh-iad 1.07 µs, 1.00× rind's; ovh-sea 1.04 µs, 1.00× rind's +ChaCha20-Poly1305 seal, 1350 B, rind: nixos 533 ns, 1.00× rind's; desktop 441 ns, 1.00× rind's; nixos2 718 ns, 1.00× rind's; kixtop 792 ns, 1.00× rind's; ovh-iad 1.07 µs, 1.00× rind's; ovh-sea 1.04 µs, 1.00× rind's 1× aws-lc-rs -ChaCha20-Poly1305 seal, 1350 B, aws-lc-rs: nixos 532 ns, 1.00× rind's; desktop 453 ns, 1.03× rind's; nixos2 755 ns, 1.05× rind's; ovh-iad 1.10 µs, 1.03× rind's; ovh-sea 1.05 µs, 1.02× rind's - - +ChaCha20-Poly1305 seal, 1350 B, aws-lc-rs: nixos 532 ns, 1.00× rind's; desktop 453 ns, 1.03× rind's; nixos2 755 ns, 1.05× rind's; kixtop 771 ns, 0.97× rind's; ovh-iad 1.10 µs, 1.03× rind's; ovh-sea 1.05 µs, 1.02× rind's + + 1.02× ring -ChaCha20-Poly1305 seal, 1350 B, ring: nixos 527 ns, 0.99× rind's; desktop 447 ns, 1.01× rind's; nixos2 714 ns, 1.00× rind's; ovh-iad 1.08 µs, 1.00× rind's; ovh-sea 1.04 µs, 1.00× rind's - - +ChaCha20-Poly1305 seal, 1350 B, ring: nixos 527 ns, 0.99× rind's; desktop 447 ns, 1.01× rind's; nixos2 714 ns, 1.00× rind's; kixtop 755 ns, 0.95× rind's; ovh-iad 1.08 µs, 1.00× rind's; ovh-sea 1.04 µs, 1.00× rind's + + -1.00× +0.99× X25519 rind -X25519, rind: nixos 23.97 µs, 1.00× rind's; desktop 19.68 µs, 1.00× rind's; nixos2 25.00 µs, 1.00× rind's; ovh-iad 51.79 µs, 1.00× rind's; ovh-sea 51.10 µs, 1.00× rind's +X25519, rind: nixos 23.97 µs, 1.00× rind's; desktop 19.68 µs, 1.00× rind's; nixos2 25.00 µs, 1.00× rind's; kixtop 16.71 µs, 1.00× rind's; ovh-iad 51.79 µs, 1.00× rind's; ovh-sea 51.10 µs, 1.00× rind's 1× aws-lc-rs -X25519, aws-lc-rs: nixos 24.61 µs, 1.03× rind's; desktop 19.54 µs, 0.99× rind's; nixos2 30.89 µs, 1.24× rind's; ovh-iad 55.09 µs, 1.06× rind's; ovh-sea 51.15 µs, 1.00× rind's +X25519, aws-lc-rs: nixos 24.61 µs, 1.03× rind's; desktop 19.54 µs, 0.99× rind's; nixos2 30.89 µs, 1.24× rind's; kixtop 17.85 µs, 1.07× rind's; ovh-iad 55.09 µs, 1.06× rind's; ovh-sea 51.15 µs, 1.00× rind's 1.06× ring -X25519, ring: nixos 46.72 µs, 1.95× rind's; desktop 35.63 µs, 1.81× rind's; nixos2 53.60 µs, 2.14× rind's; ovh-iad 79.18 µs, 1.53× rind's; ovh-sea 76.22 µs, 1.49× rind's - - +X25519, ring: nixos 46.72 µs, 1.95× rind's; desktop 35.63 µs, 1.81× rind's; nixos2 53.60 µs, 2.14× rind's; kixtop 24.48 µs, 1.46× rind's; ovh-iad 79.18 µs, 1.53× rind's; ovh-sea 76.22 µs, 1.49× rind's + + -1.77× +1.71× P-256 ECDSA sign rind -P-256 ECDSA sign, rind: nixos 9.62 µs, 1.00× rind's; desktop 6.84 µs, 1.00× rind's; nixos2 13.11 µs, 1.00× rind's; ovh-iad 22.42 µs, 1.00× rind's; ovh-sea 21.44 µs, 1.00× rind's +P-256 ECDSA sign, rind: nixos 9.62 µs, 1.00× rind's; desktop 6.84 µs, 1.00× rind's; nixos2 13.11 µs, 1.00× rind's; kixtop 7.11 µs, 1.00× rind's; ovh-iad 22.42 µs, 1.00× rind's; ovh-sea 21.44 µs, 1.00× rind's 1× aws-lc-rs -P-256 ECDSA sign, aws-lc-rs: nixos 12.66 µs, 1.32× rind's; desktop 12.33 µs, 1.80× rind's; nixos2 19.80 µs, 1.51× rind's; ovh-iad 24.53 µs, 1.09× rind's; ovh-sea 23.93 µs, 1.12× rind's +P-256 ECDSA sign, aws-lc-rs: nixos 12.66 µs, 1.32× rind's; desktop 12.33 µs, 1.80× rind's; nixos2 19.80 µs, 1.51× rind's; kixtop 11.27 µs, 1.58× rind's; ovh-iad 24.53 µs, 1.09× rind's; ovh-sea 23.93 µs, 1.12× rind's -1.34× +1.38× ring -P-256 ECDSA sign, ring: nixos 13.68 µs, 1.42× rind's; desktop 12.24 µs, 1.79× rind's; nixos2 14.86 µs, 1.13× rind's; ovh-iad 26.21 µs, 1.17× rind's; ovh-sea 24.84 µs, 1.16× rind's +P-256 ECDSA sign, ring: nixos 13.68 µs, 1.42× rind's; desktop 12.24 µs, 1.79× rind's; nixos2 14.86 µs, 1.13× rind's; kixtop 11.01 µs, 1.55× rind's; ovh-iad 26.21 µs, 1.17× rind's; ovh-sea 24.84 µs, 1.16× rind's -1.31× +1.35× RSA-2048 PSS sign rind -RSA-2048 PSS sign, rind: nixos 424.30 µs, 1.00× rind's; desktop 346.52 µs, 1.00× rind's; nixos2 445.92 µs, 1.00× rind's; ovh-iad 819.13 µs, 1.00× rind's; ovh-sea 743.95 µs, 1.00× rind's +RSA-2048 PSS sign, rind: nixos 424.30 µs, 1.00× rind's; desktop 346.52 µs, 1.00× rind's; nixos2 445.92 µs, 1.00× rind's; kixtop 275.29 µs, 1.00× rind's; ovh-iad 819.13 µs, 1.00× rind's; ovh-sea 743.95 µs, 1.00× rind's 1× aws-lc-rs -RSA-2048 PSS sign, aws-lc-rs: nixos 481.00 µs, 1.13× rind's; desktop 350.45 µs, 1.01× rind's; nixos2 461.87 µs, 1.04× rind's; ovh-iad 807.21 µs, 0.99× rind's; ovh-sea 772.15 µs, 1.04× rind's +RSA-2048 PSS sign, aws-lc-rs: nixos 481.00 µs, 1.13× rind's; desktop 350.45 µs, 1.01× rind's; nixos2 461.87 µs, 1.04× rind's; kixtop 288.58 µs, 1.05× rind's; ovh-iad 807.21 µs, 0.99× rind's; ovh-sea 772.15 µs, 1.04× rind's 1.04× ring -RSA-2048 PSS sign, ring: nixos 471.53 µs, 1.11× rind's; desktop 341.45 µs, 0.99× rind's; nixos2 437.28 µs, 0.98× rind's; ovh-iad 1.04 ms, 1.27× rind's; ovh-sea 987.95 µs, 1.33× rind's +RSA-2048 PSS sign, ring: nixos 471.53 µs, 1.11× rind's; desktop 341.45 µs, 0.99× rind's; nixos2 437.28 µs, 0.98× rind's; kixtop 324.86 µs, 1.18× rind's; ovh-iad 1.04 ms, 1.27× rind's; ovh-sea 987.95 µs, 1.33× rind's -1.13× +1.14× cold build of a rustls client rind diff --git a/benchmarks/kixtop-dark.svg b/benchmarks/kixtop-dark.svg new file mode 100644 index 000000000..1ae10ca99 --- /dev/null +++ b/benchmarks/kixtop-dark.svg @@ -0,0 +1,819 @@ + +Times on kixtop, by operation and library + +fastest, or within 10% + +to 1.25× + +to 1.5× + +to 2× + +to 4× + +to 8× + +over 8× +✓ +verified code +kixtop: Apple M4 +rind +aws-lc-rs +ring +RustCrypto ++ dalek +graviola +libcrux +OpenSSL +TLS 1.3 with rustls + +full handshake, X25519MLKEM768 +full handshake, X25519MLKEM768, rind: 177.98 µs, 1.00× the fastest +177.98 µs +full handshake, X25519MLKEM768, aws-lc-rs: 214.67 µs, 1.21× the fastest +214.67 µs +full handshake, X25519MLKEM768, graviola: 180.42 µs, 1.01× the fastest +180.42 µs +full handshake, X25519MLKEM768, OpenSSL: 459.07 µs, 2.58× the fastest +459.07 µs +full handshake, X25519 +full handshake, X25519, rind: 155.39 µs, 1.00× the fastest +155.39 µs +full handshake, X25519, aws-lc-rs: 184.86 µs, 1.19× the fastest +184.86 µs +full handshake, X25519, ring: 184.65 µs, 1.19× the fastest +184.65 µs +full handshake, X25519, graviola: 159.19 µs, 1.02× the fastest +159.19 µs +full handshake, X25519, OpenSSL: 374.65 µs, 2.41× the fastest +374.65 µs +full handshake, P-256 +full handshake, P-256, rind: 176.20 µs, 1.00× the fastest +176.20 µs +full handshake, P-256, aws-lc-rs: 206.73 µs, 1.17× the fastest +206.73 µs +full handshake, P-256, ring: 201.44 µs, 1.14× the fastest +201.44 µs +full handshake, P-256, graviola: 191.72 µs, 1.09× the fastest +191.72 µs +full handshake, P-256, OpenSSL: 400.48 µs, 2.27× the fastest +400.48 µs +full handshake, Ed25519 certificate +full handshake, Ed25519 certificate, rind: 127.23 µs, 1.03× the fastest +127.23 µs +full handshake, Ed25519 certificate, aws-lc-rs: 150.93 µs, 1.22× the fastest +150.93 µs +full handshake, Ed25519 certificate, ring: 155.04 µs, 1.25× the fastest +155.04 µs +full handshake, Ed25519 certificate, graviola: 124.12 µs, 1.00× the fastest +124.12 µs +full handshake, Ed25519 certificate, OpenSSL: 383.83 µs, 3.09× the fastest +383.83 µs +full handshake, RSA-2048 certificate +full handshake, RSA-2048 certificate, rind: 371.35 µs, 1.00× the fastest +371.35 µs +full handshake, RSA-2048 certificate, aws-lc-rs: 406.71 µs, 1.10× the fastest +406.71 µs +full handshake, RSA-2048 certificate, ring: 446.94 µs, 1.20× the fastest +446.94 µs +full handshake, RSA-2048 certificate, graviola: 683.15 µs, 1.84× the fastest +683.15 µs +full handshake, RSA-2048 certificate, OpenSSL: 643.30 µs, 1.73× the fastest +643.30 µs +resumed handshake, X25519 +resumed handshake, X25519, rind: 66.29 µs, 1.07× the fastest +66.29 µs +resumed handshake, X25519, aws-lc-rs: 92.46 µs, 1.50× the fastest +92.46 µs +resumed handshake, X25519, ring: 88.29 µs, 1.43× the fastest +88.29 µs +resumed handshake, X25519, graviola: 61.75 µs, 1.00× the fastest +61.75 µs +resumed handshake, X25519, OpenSSL: 255.12 µs, 4.13× the fastest +255.12 µs +1 MB transfer, AES-128-GCM +1 MB transfer, AES-128-GCM, rind: 308.57 µs, 1.00× the fastest +308.57 µs +1 MB transfer, AES-128-GCM, aws-lc-rs: 310.78 µs, 1.01× the fastest +310.78 µs +1 MB transfer, AES-128-GCM, ring: 372.59 µs, 1.21× the fastest +372.59 µs +1 MB transfer, AES-128-GCM, graviola: 327.11 µs, 1.06× the fastest +327.11 µs +1 MB transfer, AES-128-GCM, OpenSSL: 338.35 µs, 1.10× the fastest +338.35 µs +1 MB transfer, AES-256-GCM +1 MB transfer, AES-256-GCM, rind: 343.96 µs, 1.01× the fastest +343.96 µs +1 MB transfer, AES-256-GCM, aws-lc-rs: 341.91 µs, 1.00× the fastest +341.91 µs +1 MB transfer, AES-256-GCM, ring: 380.26 µs, 1.11× the fastest +380.26 µs +1 MB transfer, AES-256-GCM, graviola: 397.41 µs, 1.16× the fastest +397.41 µs +1 MB transfer, AES-256-GCM, OpenSSL: 371.49 µs, 1.09× the fastest +371.49 µs +1 MB transfer, ChaCha20-Poly1305 +1 MB transfer, ChaCha20-Poly1305, rind: 1.12 ms, 1.01× the fastest +1.12 ms +1 MB transfer, ChaCha20-Poly1305, aws-lc-rs: 1.12 ms, 1.01× the fastest +1.12 ms +1 MB transfer, ChaCha20-Poly1305, ring: 1.11 ms, 1.01× the fastest +1.11 ms +1 MB transfer, ChaCha20-Poly1305, graviola: 1.79 ms, 1.62× the fastest +1.79 ms +1 MB transfer, ChaCha20-Poly1305, OpenSSL: 1.11 ms, 1.00× the fastest +1.11 ms +AEADs + +AES-128-GCM seal, 32 B +AES-128-GCM seal, 32 B, rind: 57 ns, 2.40× the fastest +57 ns +AES-128-GCM seal, 32 B, aws-lc-rs: 50 ns, 2.10× the fastest +50 ns +AES-128-GCM seal, 32 B, ring: 42 ns, 1.77× the fastest +42 ns +AES-128-GCM seal, 32 B, RustCrypto + dalek: 24 ns, 1.00× the fastest +24 ns +AES-128-GCM seal, 32 B, graviola: 80 ns, 3.37× the fastest +80 ns +AES-128-GCM seal, 32 B, libcrux: 53 ns, 2.23× the fastest +53 ns +AES-128-GCM seal, 32 B, OpenSSL: 69 ns, 2.91× the fastest +69 ns +AES-128-GCM seal, 1350 B +AES-128-GCM seal, 1350 B, rind: 212 ns, 1.18× the fastest +212 ns +AES-128-GCM seal, 1350 B, aws-lc-rs: 180 ns, 1.00× the fastest +180 ns +AES-128-GCM seal, 1350 B, ring: 212 ns, 1.18× the fastest +212 ns +AES-128-GCM seal, 1350 B, RustCrypto + dalek: 213 ns, 1.18× the fastest +213 ns +AES-128-GCM seal, 1350 B, graviola: 215 ns, 1.20× the fastest +215 ns +AES-128-GCM seal, 1350 B, libcrux: 619 ns, 3.44× the fastest +619 ns +AES-128-GCM seal, 1350 B, OpenSSL: 197 ns, 1.09× the fastest +197 ns +AES-128-GCM seal, 16 KB +AES-128-GCM seal, 16 KB, rind: 1.49 µs, 1.03× the fastest +1.49 µs +AES-128-GCM seal, 16 KB, aws-lc-rs: 1.45 µs, 1.00× the fastest +1.45 µs +AES-128-GCM seal, 16 KB, ring: 1.97 µs, 1.35× the fastest +1.97 µs +AES-128-GCM seal, 16 KB, RustCrypto + dalek: 2.36 µs, 1.62× the fastest +2.36 µs +AES-128-GCM seal, 16 KB, graviola: 1.60 µs, 1.10× the fastest +1.60 µs +AES-128-GCM seal, 16 KB, libcrux: 7.15 µs, 4.92× the fastest +7.15 µs +AES-128-GCM seal, 16 KB, OpenSSL: 1.52 µs, 1.04× the fastest +1.52 µs +AES-128-GCM open, 32 B +AES-128-GCM open, 32 B, rind: 47 ns, 1.71× the fastest +47 ns +AES-128-GCM open, 32 B, aws-lc-rs: 47 ns, 1.70× the fastest +47 ns +AES-128-GCM open, 32 B, ring: 39 ns, 1.42× the fastest +39 ns +AES-128-GCM open, 32 B, RustCrypto + dalek: 28 ns, 1.00× the fastest +28 ns +AES-128-GCM open, 32 B, graviola: 85 ns, 3.06× the fastest +85 ns +AES-128-GCM open, 32 B, libcrux: 64 ns, 2.30× the fastest +64 ns +AES-128-GCM open, 32 B, OpenSSL: 65 ns, 2.36× the fastest +65 ns +AES-128-GCM open, 1350 B +AES-128-GCM open, 1350 B, rind: 214 ns, 1.11× the fastest +214 ns +AES-128-GCM open, 1350 B, aws-lc-rs: 193 ns, 1.00× the fastest +193 ns +AES-128-GCM open, 1350 B, ring: 247 ns, 1.28× the fastest +247 ns +AES-128-GCM open, 1350 B, RustCrypto + dalek: 237 ns, 1.23× the fastest +237 ns +AES-128-GCM open, 1350 B, graviola: 226 ns, 1.17× the fastest +226 ns +AES-128-GCM open, 1350 B, libcrux: 647 ns, 3.35× the fastest +647 ns +AES-128-GCM open, 1350 B, OpenSSL: 199 ns, 1.03× the fastest +199 ns +AES-128-GCM open, 16 KB +AES-128-GCM open, 16 KB, rind: 1.61 µs, 1.02× the fastest +1.61 µs +AES-128-GCM open, 16 KB, aws-lc-rs: 1.57 µs, 1.00× the fastest +1.57 µs +AES-128-GCM open, 16 KB, ring: 2.18 µs, 1.39× the fastest +2.18 µs +AES-128-GCM open, 16 KB, RustCrypto + dalek: 2.46 µs, 1.57× the fastest +2.46 µs +AES-128-GCM open, 16 KB, graviola: 1.71 µs, 1.09× the fastest +1.71 µs +AES-128-GCM open, 16 KB, libcrux: 6.97 µs, 4.44× the fastest +6.97 µs +AES-128-GCM open, 16 KB, OpenSSL: 1.66 µs, 1.06× the fastest +1.66 µs +AES-256-GCM seal, 32 B +AES-256-GCM seal, 32 B, rind: 61 ns, 2.44× the fastest +61 ns +AES-256-GCM seal, 32 B, aws-lc-rs: 54 ns, 2.18× the fastest +54 ns +AES-256-GCM seal, 32 B, ring: 45 ns, 1.82× the fastest +45 ns +AES-256-GCM seal, 32 B, RustCrypto + dalek: 25 ns, 1.00× the fastest +25 ns +AES-256-GCM seal, 32 B, graviola: 79 ns, 3.18× the fastest +79 ns +AES-256-GCM seal, 32 B, libcrux: 53 ns, 2.15× the fastest +53 ns +AES-256-GCM seal, 32 B, OpenSSL: 67 ns, 2.72× the fastest +67 ns +AES-256-GCM seal, 1350 B +AES-256-GCM seal, 1350 B, rind: 237 ns, 1.16× the fastest +237 ns +AES-256-GCM seal, 1350 B, aws-lc-rs: 205 ns, 1.00× the fastest +205 ns +AES-256-GCM seal, 1350 B, ring: 220 ns, 1.07× the fastest +220 ns +AES-256-GCM seal, 1350 B, RustCrypto + dalek: 246 ns, 1.20× the fastest +246 ns +AES-256-GCM seal, 1350 B, graviola: 262 ns, 1.28× the fastest +262 ns +AES-256-GCM seal, 1350 B, libcrux: 650 ns, 3.18× the fastest +650 ns +AES-256-GCM seal, 1350 B, OpenSSL: 222 ns, 1.08× the fastest +222 ns +AES-256-GCM seal, 16 KB +AES-256-GCM seal, 16 KB, rind: 1.75 µs, 1.02× the fastest +1.75 µs +AES-256-GCM seal, 16 KB, aws-lc-rs: 1.72 µs, 1.00× the fastest +1.72 µs +AES-256-GCM seal, 16 KB, ring: 2.04 µs, 1.19× the fastest +2.04 µs +AES-256-GCM seal, 16 KB, RustCrypto + dalek: 2.72 µs, 1.58× the fastest +2.72 µs +AES-256-GCM seal, 16 KB, graviola: 2.16 µs, 1.26× the fastest +2.16 µs +AES-256-GCM seal, 16 KB, libcrux: 7.20 µs, 4.19× the fastest +7.20 µs +AES-256-GCM seal, 16 KB, OpenSSL: 1.79 µs, 1.04× the fastest +1.79 µs +AES-256-GCM open, 32 B +AES-256-GCM open, 32 B, rind: 49 ns, 1.24× the fastest +49 ns +AES-256-GCM open, 32 B, aws-lc-rs: 49 ns, 1.24× the fastest +49 ns +AES-256-GCM open, 32 B, ring: 40 ns, 1.00× the fastest +40 ns +AES-256-GCM open, 32 B, RustCrypto + dalek: 41 ns, 1.04× the fastest +41 ns +AES-256-GCM open, 32 B, graviola: 85 ns, 2.15× the fastest +85 ns +AES-256-GCM open, 32 B, libcrux: 67 ns, 1.69× the fastest +67 ns +AES-256-GCM open, 32 B, OpenSSL: 68 ns, 1.71× the fastest +68 ns +AES-256-GCM open, 1350 B +AES-256-GCM open, 1350 B, rind: 233 ns, 1.07× the fastest +233 ns +AES-256-GCM open, 1350 B, aws-lc-rs: 218 ns, 1.00× the fastest +218 ns +AES-256-GCM open, 1350 B, ring: 252 ns, 1.15× the fastest +252 ns +AES-256-GCM open, 1350 B, RustCrypto + dalek: 267 ns, 1.22× the fastest +267 ns +AES-256-GCM open, 1350 B, graviola: 263 ns, 1.20× the fastest +263 ns +AES-256-GCM open, 1350 B, libcrux: 674 ns, 3.09× the fastest +674 ns +AES-256-GCM open, 1350 B, OpenSSL: 225 ns, 1.03× the fastest +225 ns +AES-256-GCM open, 16 KB +AES-256-GCM open, 16 KB, rind: 1.86 µs, 1.01× the fastest +1.86 µs +AES-256-GCM open, 16 KB, aws-lc-rs: 1.83 µs, 1.00× the fastest +1.83 µs +AES-256-GCM open, 16 KB, ring: 2.25 µs, 1.23× the fastest +2.25 µs +AES-256-GCM open, 16 KB, RustCrypto + dalek: 2.89 µs, 1.58× the fastest +2.89 µs +AES-256-GCM open, 16 KB, graviola: 2.18 µs, 1.19× the fastest +2.18 µs +AES-256-GCM open, 16 KB, libcrux: 7.35 µs, 4.01× the fastest +7.35 µs +AES-256-GCM open, 16 KB, OpenSSL: 1.94 µs, 1.06× the fastest +1.94 µs +ChaCha20-Poly1305 seal, 32 B +ChaCha20-Poly1305 seal, 32 B, rind: 185 ns, 1.25× the fastest +185 ns +ChaCha20-Poly1305 seal, 32 B, aws-lc-rs: 163 ns, 1.10× the fastest +163 ns +ChaCha20-Poly1305 seal, 32 B, ring: 148 ns, 1.00× the fastest +148 ns +ChaCha20-Poly1305 seal, 32 B, RustCrypto + dalek: 344 ns, 2.33× the fastest +344 ns +ChaCha20-Poly1305 seal, 32 B, graviola: 196 ns, 1.32× the fastest +196 ns +ChaCha20-Poly1305 seal, 32 B, libcrux: 171 ns, 1.16× the fastest; verified: HACL*'s F* proof of Hacl.Chacha20Poly1305_32, compiled to Rust by an unverified step +171 ns ✓ +ChaCha20-Poly1305 seal, 32 B, OpenSSL: 215 ns, 1.46× the fastest +215 ns +ChaCha20-Poly1305 seal, 1350 B +ChaCha20-Poly1305 seal, 1350 B, rind: 792 ns, 1.05× the fastest +792 ns +ChaCha20-Poly1305 seal, 1350 B, aws-lc-rs: 771 ns, 1.02× the fastest +771 ns +ChaCha20-Poly1305 seal, 1350 B, ring: 755 ns, 1.00× the fastest +755 ns +ChaCha20-Poly1305 seal, 1350 B, RustCrypto + dalek: 1.78 µs, 2.36× the fastest +1.78 µs +ChaCha20-Poly1305 seal, 1350 B, graviola: 1.25 µs, 1.65× the fastest +1.25 µs +ChaCha20-Poly1305 seal, 1350 B, libcrux: 1.98 µs, 2.62× the fastest; verified: HACL*'s F* proof of Hacl.Chacha20Poly1305_32, compiled to Rust by an unverified step +1.98 µs ✓ +ChaCha20-Poly1305 seal, 1350 B, OpenSSL: 842 ns, 1.12× the fastest +842 ns +ChaCha20-Poly1305 seal, 16 KB +ChaCha20-Poly1305 seal, 16 KB, rind: 7.70 µs, 1.03× the fastest +7.70 µs +ChaCha20-Poly1305 seal, 16 KB, aws-lc-rs: 7.65 µs, 1.03× the fastest +7.65 µs +ChaCha20-Poly1305 seal, 16 KB, ring: 7.67 µs, 1.03× the fastest +7.67 µs +ChaCha20-Poly1305 seal, 16 KB, RustCrypto + dalek: 15.21 µs, 2.04× the fastest +15.21 µs +ChaCha20-Poly1305 seal, 16 KB, graviola: 12.85 µs, 1.72× the fastest +12.85 µs +ChaCha20-Poly1305 seal, 16 KB, libcrux: 22.07 µs, 2.96× the fastest; verified: HACL*'s F* proof of Hacl.Chacha20Poly1305_32, compiled to Rust by an unverified step +22.07 µs ✓ +ChaCha20-Poly1305 seal, 16 KB, OpenSSL: 7.45 µs, 1.00× the fastest +7.45 µs +XChaCha20-Poly1305 seal, 32 B +XChaCha20-Poly1305 seal, 32 B, rind: 1.19 µs, 1.26× the fastest +1.19 µs +XChaCha20-Poly1305 seal, 32 B, aws-lc-rs: 943 ns, 1.00× the fastest +943 ns +XChaCha20-Poly1305 seal, 32 B, RustCrypto + dalek: 1.53 µs, 1.62× the fastest +1.53 µs +XChaCha20-Poly1305 seal, 32 B, graviola: 1.11 µs, 1.17× the fastest +1.11 µs +XChaCha20-Poly1305 seal, 32 B, libcrux: 1.11 µs, 1.18× the fastest +1.11 µs +XChaCha20-Poly1305 seal, 1350 B +XChaCha20-Poly1305 seal, 1350 B, rind: 2.02 µs, 1.07× the fastest +2.02 µs +XChaCha20-Poly1305 seal, 1350 B, aws-lc-rs: 1.89 µs, 1.00× the fastest +1.89 µs +XChaCha20-Poly1305 seal, 1350 B, RustCrypto + dalek: 3.19 µs, 1.69× the fastest +3.19 µs +XChaCha20-Poly1305 seal, 1350 B, graviola: 2.85 µs, 1.51× the fastest +2.85 µs +XChaCha20-Poly1305 seal, 1350 B, libcrux: 3.80 µs, 2.02× the fastest +3.80 µs +XChaCha20-Poly1305 seal, 16 KB +XChaCha20-Poly1305 seal, 16 KB, rind: 11.36 µs, 1.00× the fastest +11.36 µs +XChaCha20-Poly1305 seal, 16 KB, aws-lc-rs: 11.43 µs, 1.01× the fastest +11.43 µs +XChaCha20-Poly1305 seal, 16 KB, RustCrypto + dalek: 22.76 µs, 2.00× the fastest +22.76 µs +XChaCha20-Poly1305 seal, 16 KB, graviola: 19.24 µs, 1.69× the fastest +19.24 µs +XChaCha20-Poly1305 seal, 16 KB, libcrux: 34.20 µs, 3.01× the fastest +34.20 µs +QUIC header protection + +AES-128 header protection +AES-128 header protection, rind: 35 ns, 12.24× the fastest +35 ns +AES-128 header protection, aws-lc-rs: 3 ns, 1.00× the fastest +3 ns +AES-128 header protection, ring: 3 ns, 1.15× the fastest +3 ns +AES-256 header protection +AES-256 header protection, rind: 38 ns, 12.62× the fastest +38 ns +AES-256 header protection, aws-lc-rs: 3 ns, 1.00× the fastest +3 ns +AES-256 header protection, ring: 4 ns, 1.31× the fastest +4 ns +ChaCha20 header protection +ChaCha20 header protection, rind: 89 ns, 1.29× the fastest; verified: rind's Lean proof, through Aeneas and a hand model of the function-pointer dispatch Aeneas cannot translate, which assumes each key's mask is its own cipher's, the only one rind builds, of its header-protection API's ChaCha20 against RFC 9001 and RFC 8439, HACL*'s rounds included +89 ns ✓ +ChaCha20 header protection, aws-lc-rs: 73 ns, 1.07× the fastest +73 ns +ChaCha20 header protection, ring: 68 ns, 1.00× the fastest +68 ns +Key agreement + +X25519 +X25519, rind: 16.71 µs, 1.00× the fastest; verified: rind's Lean proof, through Aeneas and a hand model of the function-pointer dispatch Aeneas cannot translate, which assumes each key's dispatch table holds its own curve's functions, the only table rind builds, of its agreement API's X25519 down to s2n-bignum's routines, composed with s2n-bignum's HOL Light proofs of curve25519_x25519_alt, curve25519_x25519base_alt, and bignum_eq, of s2n-bignum's own object code, which rind transliterates +16.71 µs ✓ +X25519, aws-lc-rs: 17.85 µs, 1.07× the fastest +17.85 µs +X25519, ring: 24.48 µs, 1.46× the fastest +24.48 µs +X25519, RustCrypto + dalek: 29.71 µs, 1.78× the fastest +29.71 µs +X25519, graviola: 17.74 µs, 1.06× the fastest +17.74 µs +X25519, libcrux: 37.77 µs, 2.26× the fastest; verified: HACL*'s F* proof of Hacl.Curve25519_51's secret_to_public and ecdh, compiled to Rust by an unverified step +37.77 µs ✓ +X25519, OpenSSL: 35.77 µs, 2.14× the fastest +35.77 µs +P-256 ECDH +P-256 ECDH, rind: 26.27 µs, 1.00× the fastest; verified: rind's Lean proof, through Aeneas and hand models of the function-pointer dispatch and of key generation's draws through a dyn RandomSource, which Aeneas cannot translate, of its agreement API's P-256 key generation, public key, and agreement down to s2n-bignum's routines, composed with s2n-bignum's HOL Light proofs of p256_scalarmulbase_alt, p256_scalarmul_alt, bignum_tomont_p256, bignum_demont_p256, bignum_add_p256, bignum_montmul_p256, bignum_montsqr_p256, bignum_mod_n256_4, and bignum_eq, of s2n-bignum's own object code, which rind transliterates, with rind's generator table proven to hold the multiples of G that s2n-bignum's proof assumes +26.27 µs ✓ +P-256 ECDH, aws-lc-rs: 28.51 µs, 1.09× the fastest +28.51 µs +P-256 ECDH, ring: 32.31 µs, 1.23× the fastest +32.31 µs +P-256 ECDH, RustCrypto + dalek: 180.62 µs, 6.88× the fastest +180.62 µs +P-256 ECDH, graviola: 31.56 µs, 1.20× the fastest +31.56 µs +P-256 ECDH, libcrux: 183.72 µs, 6.99× the fastest; verified: HACL*'s F* proof of Hacl.P256's dh_initiator, dh_responder, ecdsa_sign_p256_sha2, and ecdsa_verif_p256_sha2, compiled to Rust by an unverified step +183.72 µs ✓ +P-256 ECDH, OpenSSL: 49.96 µs, 1.90× the fastest +49.96 µs +Signatures + +Ed25519 sign +Ed25519 sign, rind: 3.95 µs, 1.00× the fastest +3.95 µs +Ed25519 sign, aws-lc-rs: 4.06 µs, 1.03× the fastest +4.06 µs +Ed25519 sign, ring: 7.07 µs, 1.79× the fastest +7.07 µs +Ed25519 sign, RustCrypto + dalek: 8.66 µs, 2.19× the fastest +8.66 µs +Ed25519 sign, graviola: 4.17 µs, 1.06× the fastest +4.17 µs +Ed25519 sign, libcrux: 22.12 µs, 5.60× the fastest; verified: HACL*'s F* proof of Hacl.Ed25519's sign and verify, compiled to Rust by an unverified step +22.12 µs ✓ +Ed25519 sign, OpenSSL: 16.42 µs, 4.16× the fastest +16.42 µs +Ed25519 verify +Ed25519 verify, rind: 18.66 µs, 1.01× the fastest +18.66 µs +Ed25519 verify, aws-lc-rs: 18.52 µs, 1.01× the fastest +18.52 µs +Ed25519 verify, ring: 19.94 µs, 1.08× the fastest +19.94 µs +Ed25519 verify, RustCrypto + dalek: 18.42 µs, 1.00× the fastest +18.42 µs +Ed25519 verify, graviola: 18.69 µs, 1.01× the fastest +18.69 µs +Ed25519 verify, libcrux: 29.57 µs, 1.61× the fastest; verified: HACL*'s F* proof of Hacl.Ed25519's sign and verify, compiled to Rust by an unverified step +29.57 µs ✓ +Ed25519 verify, OpenSSL: 41.08 µs, 2.23× the fastest +41.08 µs +P-256 ECDSA sign +P-256 ECDSA sign, rind: 7.11 µs, 1.00× the fastest; verified: rind's Lean proof, through Aeneas and hand models of the function-pointer dispatch and of the nonces' draws through a dyn RandomSource, which Aeneas cannot translate, of its signature API's P-256 ECDSA with SHA-256 and fixed-length signatures, key generation and loading, signing, and verification, down to s2n-bignum's routines, composed with s2n-bignum's HOL Light proofs of p256_scalarmulbase_alt, p256_montjadd_alt, p256_montjdouble_alt, p256_montjmixadd_alt, bignum_inv_p256, bignum_neg_p256, bignum_tomont_p256, bignum_demont_p256, bignum_add_p256, bignum_montmul_p256, bignum_montsqr_p256, bignum_mod_n256_4, bignum_modadd, bignum_montmul, bignum_demont, bignum_modinv, and bignum_eq, of s2n-bignum's own object code, which rind transliterates, with the group laws its twin multiplication relies on proven from Mathlib's and the generator's order n proven, assuming HOL Light's P256_GROUP_ELEMENT_ORDER, that a point has order n, only for verification with a parsed public key, and proving a signature right when signing returns, as its nonce loop has no bound +7.11 µs ✓ +P-256 ECDSA sign, aws-lc-rs: 11.27 µs, 1.58× the fastest +11.27 µs +P-256 ECDSA sign, ring: 11.01 µs, 1.55× the fastest +11.01 µs +P-256 ECDSA sign, RustCrypto + dalek: 44.33 µs, 6.23× the fastest +44.33 µs +P-256 ECDSA sign, graviola: 8.83 µs, 1.24× the fastest +8.83 µs +P-256 ECDSA sign, libcrux: 67.38 µs, 9.47× the fastest; verified: HACL*'s F* proof of Hacl.P256's dh_initiator, dh_responder, ecdsa_sign_p256_sha2, and ecdsa_verif_p256_sha2, compiled to Rust by an unverified step +67.38 µs ✓ +P-256 ECDSA sign, OpenSSL: 12.62 µs, 1.77× the fastest +12.62 µs +P-256 ECDSA verify +P-256 ECDSA verify, rind: 27.15 µs, 1.00× the fastest; verified: rind's Lean proof, through Aeneas and hand models of the function-pointer dispatch and of the nonces' draws through a dyn RandomSource, which Aeneas cannot translate, of its signature API's P-256 ECDSA with SHA-256 and fixed-length signatures, key generation and loading, signing, and verification, down to s2n-bignum's routines, composed with s2n-bignum's HOL Light proofs of p256_scalarmulbase_alt, p256_montjadd_alt, p256_montjdouble_alt, p256_montjmixadd_alt, bignum_inv_p256, bignum_neg_p256, bignum_tomont_p256, bignum_demont_p256, bignum_add_p256, bignum_montmul_p256, bignum_montsqr_p256, bignum_mod_n256_4, bignum_modadd, bignum_montmul, bignum_demont, bignum_modinv, and bignum_eq, of s2n-bignum's own object code, which rind transliterates, with the group laws its twin multiplication relies on proven from Mathlib's and the generator's order n proven, assuming HOL Light's P256_GROUP_ELEMENT_ORDER, that a point has order n, only for verification with a parsed public key, and proving a signature right when signing returns, as its nonce loop has no bound +27.15 µs ✓ +P-256 ECDSA verify, aws-lc-rs: 27.15 µs, 1.00× the fastest +27.15 µs +P-256 ECDSA verify, ring: 29.35 µs, 1.08× the fastest +29.35 µs +P-256 ECDSA verify, RustCrypto + dalek: 157.87 µs, 5.82× the fastest +157.87 µs +P-256 ECDSA verify, graviola: 28.60 µs, 1.05× the fastest +28.60 µs +P-256 ECDSA verify, libcrux: 156.54 µs, 5.77× the fastest; verified: HACL*'s F* proof of Hacl.P256's dh_initiator, dh_responder, ecdsa_sign_p256_sha2, and ecdsa_verif_p256_sha2, compiled to Rust by an unverified step +156.54 µs ✓ +P-256 ECDSA verify, OpenSSL: 41.90 µs, 1.54× the fastest +41.90 µs +Hashes and KDFs + +SHA-256, 64 B +SHA-256, 64 B, rind: 93 ns, 2.58× the fastest +93 ns +SHA-256, 64 B, aws-lc-rs: 71 ns, 1.97× the fastest +71 ns +SHA-256, 64 B, ring: 45 ns, 1.25× the fastest +45 ns +SHA-256, 64 B, RustCrypto + dalek: 37 ns, 1.03× the fastest +37 ns +SHA-256, 64 B, graviola: 36 ns, 1.00× the fastest +36 ns +SHA-256, 64 B, libcrux: 232 ns, 6.45× the fastest; verified: HACL*'s F* proof of Hacl.Streaming.SHA2's hash_256 and hash_512, compiled to Rust by an unverified step +232 ns ✓ +SHA-256, 64 B, OpenSSL: 162 ns, 4.50× the fastest +162 ns +SHA-256, 1350 B +SHA-256, 1350 B, rind: 484 ns, 1.17× the fastest +484 ns +SHA-256, 1350 B, aws-lc-rs: 440 ns, 1.06× the fastest +440 ns +SHA-256, 1350 B, ring: 414 ns, 1.00× the fastest +414 ns +SHA-256, 1350 B, RustCrypto + dalek: 475 ns, 1.15× the fastest +475 ns +SHA-256, 1350 B, graviola: 472 ns, 1.14× the fastest +472 ns +SHA-256, 1350 B, libcrux: 2.52 µs, 6.08× the fastest; verified: HACL*'s F* proof of Hacl.Streaming.SHA2's hash_256 and hash_512, compiled to Rust by an unverified step +2.52 µs ✓ +SHA-256, 1350 B, OpenSSL: 531 ns, 1.28× the fastest +531 ns +SHA-256, 16 KB +SHA-256, 16 KB, rind: 4.94 µs, 1.01× the fastest +4.94 µs +SHA-256, 16 KB, aws-lc-rs: 4.87 µs, 1.00× the fastest +4.87 µs +SHA-256, 16 KB, ring: 4.90 µs, 1.01× the fastest +4.90 µs +SHA-256, 16 KB, RustCrypto + dalek: 5.69 µs, 1.17× the fastest +5.69 µs +SHA-256, 16 KB, graviola: 5.76 µs, 1.18× the fastest +5.76 µs +SHA-256, 16 KB, libcrux: 29.13 µs, 5.98× the fastest; verified: HACL*'s F* proof of Hacl.Streaming.SHA2's hash_256 and hash_512, compiled to Rust by an unverified step +29.13 µs ✓ +SHA-256, 16 KB, OpenSSL: 5.17 µs, 1.06× the fastest +5.17 µs +SHA-512, 64 B +SHA-512, 64 B, rind: 113 ns, 1.44× the fastest +113 ns +SHA-512, 64 B, aws-lc-rs: 108 ns, 1.37× the fastest +108 ns +SHA-512, 64 B, ring: 88 ns, 1.11× the fastest +88 ns +SHA-512, 64 B, RustCrypto + dalek: 79 ns, 1.00× the fastest +79 ns +SHA-512, 64 B, graviola: 177 ns, 2.25× the fastest +177 ns +SHA-512, 64 B, libcrux: 141 ns, 1.79× the fastest; verified: HACL*'s F* proof of Hacl.Streaming.SHA2's hash_256 and hash_512, compiled to Rust by an unverified step +141 ns ✓ +SHA-512, 64 B, OpenSSL: 211 ns, 2.68× the fastest +211 ns +SHA-512, 1350 B +SHA-512, 1350 B, rind: 827 ns, 1.15× the fastest +827 ns +SHA-512, 1350 B, aws-lc-rs: 775 ns, 1.07× the fastest +775 ns +SHA-512, 1350 B, ring: 737 ns, 1.02× the fastest +737 ns +SHA-512, 1350 B, RustCrypto + dalek: 722 ns, 1.00× the fastest +722 ns +SHA-512, 1350 B, graviola: 1.88 µs, 2.60× the fastest +1.88 µs +SHA-512, 1350 B, libcrux: 1.58 µs, 2.18× the fastest; verified: HACL*'s F* proof of Hacl.Streaming.SHA2's hash_256 and hash_512, compiled to Rust by an unverified step +1.58 µs ✓ +SHA-512, 1350 B, OpenSSL: 878 ns, 1.22× the fastest +878 ns +SHA-512, 16 KB +SHA-512, 16 KB, rind: 8.77 µs, 1.03× the fastest +8.77 µs +SHA-512, 16 KB, aws-lc-rs: 8.70 µs, 1.02× the fastest +8.70 µs +SHA-512, 16 KB, ring: 8.69 µs, 1.02× the fastest +8.69 µs +SHA-512, 16 KB, RustCrypto + dalek: 8.50 µs, 1.00× the fastest +8.50 µs +SHA-512, 16 KB, graviola: 22.11 µs, 2.60× the fastest +22.11 µs +SHA-512, 16 KB, libcrux: 18.41 µs, 2.17× the fastest; verified: HACL*'s F* proof of Hacl.Streaming.SHA2's hash_256 and hash_512, compiled to Rust by an unverified step +18.41 µs ✓ +SHA-512, 16 KB, OpenSSL: 8.88 µs, 1.04× the fastest +8.88 µs +HMAC-SHA256, 64 B +HMAC-SHA256, 64 B, rind: 191 ns, 1.88× the fastest +191 ns +HMAC-SHA256, 64 B, aws-lc-rs: 248 ns, 2.43× the fastest +248 ns +HMAC-SHA256, 64 B, ring: 137 ns, 1.34× the fastest +137 ns +HMAC-SHA256, 64 B, RustCrypto + dalek: 102 ns, 1.00× the fastest +102 ns +HMAC-SHA256, 64 B, graviola: 115 ns, 1.12× the fastest +115 ns +HMAC-SHA256, 64 B, libcrux: 568 ns, 5.57× the fastest; verified: HACL*'s F* proof of Hacl.HMAC's compute_sha2_256, compiled to Rust by an unverified step +568 ns ✓ +HMAC-SHA256, 64 B, OpenSSL: 2.06 µs, 20.24× the fastest +2.06 µs +HMAC-SHA256, 1350 B +HMAC-SHA256, 1350 B, rind: 559 ns, 1.11× the fastest +559 ns +HMAC-SHA256, 1350 B, aws-lc-rs: 620 ns, 1.24× the fastest +620 ns +HMAC-SHA256, 1350 B, ring: 502 ns, 1.00× the fastest +502 ns +HMAC-SHA256, 1350 B, RustCrypto + dalek: 542 ns, 1.08× the fastest +542 ns +HMAC-SHA256, 1350 B, graviola: 557 ns, 1.11× the fastest +557 ns +HMAC-SHA256, 1350 B, libcrux: 2.86 µs, 5.70× the fastest; verified: HACL*'s F* proof of Hacl.HMAC's compute_sha2_256, compiled to Rust by an unverified step +2.86 µs ✓ +HMAC-SHA256, 1350 B, OpenSSL: 2.43 µs, 4.84× the fastest +2.43 µs +HKDF-SHA256 extract and expand +HKDF-SHA256 extract and expand, rind: 343 ns, 1.58× the fastest +343 ns +HKDF-SHA256 extract and expand, aws-lc-rs: 330 ns, 1.52× the fastest +330 ns +HKDF-SHA256 extract and expand, ring: 274 ns, 1.26× the fastest +274 ns +HKDF-SHA256 extract and expand, RustCrypto + dalek: 218 ns, 1.00× the fastest +218 ns +HKDF-SHA256 extract and expand, libcrux: 942 ns, 4.32× the fastest; verified: HACL*'s F* proof of Hacl.HKDF's extract_sha2_256 and expand_sha2_256, compiled to Rust by an unverified step +942 ns ✓ +HKDF-SHA256 extract and expand, OpenSSL: 2.14 µs, 9.84× the fastest +2.14 µs +HKDF-SHA256 expand +HKDF-SHA256 expand, rind: 109 ns, 1.55× the fastest +109 ns +HKDF-SHA256 expand, aws-lc-rs: 154 ns, 2.20× the fastest +154 ns +HKDF-SHA256 expand, ring: 94 ns, 1.33× the fastest +94 ns +HKDF-SHA256 expand, RustCrypto + dalek: 70 ns, 1.00× the fastest +70 ns +HKDF-SHA256 expand, libcrux: 481 ns, 6.86× the fastest; verified: HACL*'s F* proof of Hacl.HKDF's extract_sha2_256 and expand_sha2_256, compiled to Rust by an unverified step +481 ns ✓ +HKDF-SHA256 expand, OpenSSL: 1.54 µs, 21.93× the fastest +1.54 µs +RSA + +RSA-2048 PKCS#1 sign +RSA-2048 PKCS#1 sign, rind: 275.12 µs, 1.00× the fastest +275.12 µs +RSA-2048 PKCS#1 sign, aws-lc-rs: 285.95 µs, 1.04× the fastest +285.95 µs +RSA-2048 PKCS#1 sign, ring: 322.84 µs, 1.17× the fastest +322.84 µs +RSA-2048 PKCS#1 sign, RustCrypto + dalek: 586.34 µs, 2.13× the fastest +586.34 µs +RSA-2048 PKCS#1 sign, graviola: 556.70 µs, 2.02× the fastest +556.70 µs +RSA-2048 PKCS#1 sign, OpenSSL: 341.31 µs, 1.24× the fastest +341.31 µs +RSA-2048 PKCS#1 verify +RSA-2048 PKCS#1 verify, rind: 8.38 µs, 1.00× the fastest +8.38 µs +RSA-2048 PKCS#1 verify, aws-lc-rs: 9.48 µs, 1.13× the fastest +9.48 µs +RSA-2048 PKCS#1 verify, ring: 11.05 µs, 1.32× the fastest +11.05 µs +RSA-2048 PKCS#1 verify, RustCrypto + dalek: 30.77 µs, 3.67× the fastest +30.77 µs +RSA-2048 PKCS#1 verify, graviola: 18.51 µs, 2.21× the fastest +18.51 µs +RSA-2048 PKCS#1 verify, OpenSSL: 16.66 µs, 1.99× the fastest +16.66 µs +RSA-2048 PSS sign +RSA-2048 PSS sign, rind: 275.29 µs, 1.00× the fastest +275.29 µs +RSA-2048 PSS sign, aws-lc-rs: 288.58 µs, 1.05× the fastest +288.58 µs +RSA-2048 PSS sign, ring: 324.86 µs, 1.18× the fastest +324.86 µs +RSA-2048 PSS sign, RustCrypto + dalek: 588.38 µs, 2.14× the fastest +588.38 µs +RSA-2048 PSS sign, graviola: 558.57 µs, 2.03× the fastest +558.57 µs +RSA-2048 PSS sign, libcrux: 4.48 ms, 16.28× the fastest; verified: HACL*'s F* proof of Hacl.RSAPSS's rsapss_skey_sign and rsapss_pkey_verify, signing without the CRT, compiled to Rust by an unverified step +4.48 ms ✓ +RSA-2048 PSS sign, OpenSSL: 342.61 µs, 1.24× the fastest +342.61 µs +RSA-2048 PSS verify +RSA-2048 PSS verify, rind: 8.71 µs, 1.00× the fastest +8.71 µs +RSA-2048 PSS verify, aws-lc-rs: 9.84 µs, 1.13× the fastest +9.84 µs +RSA-2048 PSS verify, ring: 11.48 µs, 1.32× the fastest +11.48 µs +RSA-2048 PSS verify, RustCrypto + dalek: 39.26 µs, 4.51× the fastest +39.26 µs +RSA-2048 PSS verify, graviola: 18.79 µs, 2.16× the fastest +18.79 µs +RSA-2048 PSS verify, libcrux: 299.96 µs, 34.44× the fastest; verified: HACL*'s F* proof of Hacl.RSAPSS's rsapss_skey_sign and rsapss_pkey_verify, signing without the CRT, compiled to Rust by an unverified step +299.96 µs ✓ +RSA-2048 PSS verify, OpenSSL: 17.44 µs, 2.00× the fastest +17.44 µs +ML-KEM + +ML-KEM-768 key generation +ML-KEM-768 key generation, rind: 6.20 µs, 1.00× the fastest +6.20 µs +ML-KEM-768 key generation, aws-lc-rs: 7.46 µs, 1.20× the fastest +7.46 µs +ML-KEM-768 key generation, RustCrypto + dalek: 26.57 µs, 4.29× the fastest +26.57 µs +ML-KEM-768 key generation, graviola: 6.22 µs, 1.00× the fastest +6.22 µs +ML-KEM-768 key generation, libcrux: 12.01 µs, 1.94× the fastest +12.01 µs +ML-KEM-768 key generation, OpenSSL: 25.06 µs, 4.04× the fastest +25.06 µs +ML-KEM-768 encapsulate +ML-KEM-768 encapsulate, rind: 6.84 µs, 1.07× the fastest +6.84 µs +ML-KEM-768 encapsulate, aws-lc-rs: 8.01 µs, 1.25× the fastest +8.01 µs +ML-KEM-768 encapsulate, RustCrypto + dalek: 27.77 µs, 4.34× the fastest +27.77 µs +ML-KEM-768 encapsulate, graviola: 6.40 µs, 1.00× the fastest +6.40 µs +ML-KEM-768 encapsulate, libcrux: 9.39 µs, 1.47× the fastest +9.39 µs +ML-KEM-768 encapsulate, OpenSSL: 24.07 µs, 3.76× the fastest +24.07 µs +ML-KEM-768 decapsulate +ML-KEM-768 decapsulate, rind: 4.17 µs, 1.03× the fastest +4.17 µs +ML-KEM-768 decapsulate, aws-lc-rs: 7.75 µs, 1.91× the fastest +7.75 µs +ML-KEM-768 decapsulate, RustCrypto + dalek: 34.06 µs, 8.41× the fastest +34.06 µs +ML-KEM-768 decapsulate, graviola: 4.05 µs, 1.00× the fastest +4.05 µs +ML-KEM-768 decapsulate, libcrux: 9.58 µs, 2.36× the fastest +9.58 µs +ML-KEM-768 decapsulate, OpenSSL: 24.43 µs, 6.03× the fastest +24.43 µs +P-384 and P-521 + +P-384 ECDH +P-384 ECDH, rind: 91.49 µs, 1.00× the fastest +91.49 µs +P-384 ECDH, aws-lc-rs: 105.75 µs, 1.16× the fastest +105.75 µs +P-384 ECDH, ring: 412.48 µs, 4.51× the fastest +412.48 µs +P-384 ECDH, RustCrypto + dalek: 494.20 µs, 5.40× the fastest +494.20 µs +P-384 ECDH, graviola: 153.84 µs, 1.68× the fastest +153.84 µs +P-384 ECDH, OpenSSL: 279.51 µs, 3.06× the fastest +279.51 µs +P-384 ECDSA sign +P-384 ECDSA sign, rind: 22.93 µs, 1.00× the fastest +22.93 µs +P-384 ECDSA sign, aws-lc-rs: 49.16 µs, 2.14× the fastest +49.16 µs +P-384 ECDSA sign, ring: 223.72 µs, 9.76× the fastest +223.72 µs +P-384 ECDSA sign, RustCrypto + dalek: 112.64 µs, 4.91× the fastest +112.64 µs +P-384 ECDSA sign, graviola: 81.12 µs, 3.54× the fastest +81.12 µs +P-384 ECDSA sign, OpenSSL: 104.84 µs, 4.57× the fastest +104.84 µs +P-384 ECDSA verify +P-384 ECDSA verify, rind: 88.12 µs, 1.00× the fastest +88.12 µs +P-384 ECDSA verify, aws-lc-rs: 111.27 µs, 1.26× the fastest +111.27 µs +P-384 ECDSA verify, ring: 396.57 µs, 4.50× the fastest +396.57 µs +P-384 ECDSA verify, RustCrypto + dalek: 426.43 µs, 4.84× the fastest +426.43 µs +P-384 ECDSA verify, graviola: 151.78 µs, 1.72× the fastest +151.78 µs +P-384 ECDSA verify, OpenSSL: 238.33 µs, 2.70× the fastest +238.33 µs +P-521 ECDH +P-521 ECDH, rind: 130.92 µs, 1.00× the fastest +130.92 µs +P-521 ECDH, aws-lc-rs: 143.20 µs, 1.09× the fastest +143.20 µs +P-521 ECDH, RustCrypto + dalek: 397.10 µs, 3.03× the fastest +397.10 µs +P-521 ECDH, OpenSSL: 247.22 µs, 1.89× the fastest +247.22 µs +P-521 ECDSA sign +P-521 ECDSA sign, rind: 36.32 µs, 1.00× the fastest +36.32 µs +P-521 ECDSA sign, aws-lc-rs: 84.33 µs, 2.32× the fastest +84.33 µs +P-521 ECDSA sign, RustCrypto + dalek: 79.73 µs, 2.20× the fastest +79.73 µs +P-521 ECDSA sign, OpenSSL: 132.13 µs, 3.64× the fastest +132.13 µs +P-521 ECDSA verify +P-521 ECDSA verify, rind: 121.06 µs, 1.00× the fastest +121.06 µs +P-521 ECDSA verify, aws-lc-rs: 167.21 µs, 1.38× the fastest +167.21 µs +P-521 ECDSA verify, RustCrypto + dalek: 253.06 µs, 2.09× the fastest +253.06 µs +P-521 ECDSA verify, OpenSSL: 254.80 µs, 2.10× the fastest +254.80 µs + diff --git a/benchmarks/kixtop.svg b/benchmarks/kixtop.svg new file mode 100644 index 000000000..de08e3493 --- /dev/null +++ b/benchmarks/kixtop.svg @@ -0,0 +1,819 @@ + +Times on kixtop, by operation and library + +fastest, or within 10% + +to 1.25× + +to 1.5× + +to 2× + +to 4× + +to 8× + +over 8× +✓ +verified code +kixtop: Apple M4 +rind +aws-lc-rs +ring +RustCrypto ++ dalek +graviola +libcrux +OpenSSL +TLS 1.3 with rustls + +full handshake, X25519MLKEM768 +full handshake, X25519MLKEM768, rind: 177.98 µs, 1.00× the fastest +177.98 µs +full handshake, X25519MLKEM768, aws-lc-rs: 214.67 µs, 1.21× the fastest +214.67 µs +full handshake, X25519MLKEM768, graviola: 180.42 µs, 1.01× the fastest +180.42 µs +full handshake, X25519MLKEM768, OpenSSL: 459.07 µs, 2.58× the fastest +459.07 µs +full handshake, X25519 +full handshake, X25519, rind: 155.39 µs, 1.00× the fastest +155.39 µs +full handshake, X25519, aws-lc-rs: 184.86 µs, 1.19× the fastest +184.86 µs +full handshake, X25519, ring: 184.65 µs, 1.19× the fastest +184.65 µs +full handshake, X25519, graviola: 159.19 µs, 1.02× the fastest +159.19 µs +full handshake, X25519, OpenSSL: 374.65 µs, 2.41× the fastest +374.65 µs +full handshake, P-256 +full handshake, P-256, rind: 176.20 µs, 1.00× the fastest +176.20 µs +full handshake, P-256, aws-lc-rs: 206.73 µs, 1.17× the fastest +206.73 µs +full handshake, P-256, ring: 201.44 µs, 1.14× the fastest +201.44 µs +full handshake, P-256, graviola: 191.72 µs, 1.09× the fastest +191.72 µs +full handshake, P-256, OpenSSL: 400.48 µs, 2.27× the fastest +400.48 µs +full handshake, Ed25519 certificate +full handshake, Ed25519 certificate, rind: 127.23 µs, 1.03× the fastest +127.23 µs +full handshake, Ed25519 certificate, aws-lc-rs: 150.93 µs, 1.22× the fastest +150.93 µs +full handshake, Ed25519 certificate, ring: 155.04 µs, 1.25× the fastest +155.04 µs +full handshake, Ed25519 certificate, graviola: 124.12 µs, 1.00× the fastest +124.12 µs +full handshake, Ed25519 certificate, OpenSSL: 383.83 µs, 3.09× the fastest +383.83 µs +full handshake, RSA-2048 certificate +full handshake, RSA-2048 certificate, rind: 371.35 µs, 1.00× the fastest +371.35 µs +full handshake, RSA-2048 certificate, aws-lc-rs: 406.71 µs, 1.10× the fastest +406.71 µs +full handshake, RSA-2048 certificate, ring: 446.94 µs, 1.20× the fastest +446.94 µs +full handshake, RSA-2048 certificate, graviola: 683.15 µs, 1.84× the fastest +683.15 µs +full handshake, RSA-2048 certificate, OpenSSL: 643.30 µs, 1.73× the fastest +643.30 µs +resumed handshake, X25519 +resumed handshake, X25519, rind: 66.29 µs, 1.07× the fastest +66.29 µs +resumed handshake, X25519, aws-lc-rs: 92.46 µs, 1.50× the fastest +92.46 µs +resumed handshake, X25519, ring: 88.29 µs, 1.43× the fastest +88.29 µs +resumed handshake, X25519, graviola: 61.75 µs, 1.00× the fastest +61.75 µs +resumed handshake, X25519, OpenSSL: 255.12 µs, 4.13× the fastest +255.12 µs +1 MB transfer, AES-128-GCM +1 MB transfer, AES-128-GCM, rind: 308.57 µs, 1.00× the fastest +308.57 µs +1 MB transfer, AES-128-GCM, aws-lc-rs: 310.78 µs, 1.01× the fastest +310.78 µs +1 MB transfer, AES-128-GCM, ring: 372.59 µs, 1.21× the fastest +372.59 µs +1 MB transfer, AES-128-GCM, graviola: 327.11 µs, 1.06× the fastest +327.11 µs +1 MB transfer, AES-128-GCM, OpenSSL: 338.35 µs, 1.10× the fastest +338.35 µs +1 MB transfer, AES-256-GCM +1 MB transfer, AES-256-GCM, rind: 343.96 µs, 1.01× the fastest +343.96 µs +1 MB transfer, AES-256-GCM, aws-lc-rs: 341.91 µs, 1.00× the fastest +341.91 µs +1 MB transfer, AES-256-GCM, ring: 380.26 µs, 1.11× the fastest +380.26 µs +1 MB transfer, AES-256-GCM, graviola: 397.41 µs, 1.16× the fastest +397.41 µs +1 MB transfer, AES-256-GCM, OpenSSL: 371.49 µs, 1.09× the fastest +371.49 µs +1 MB transfer, ChaCha20-Poly1305 +1 MB transfer, ChaCha20-Poly1305, rind: 1.12 ms, 1.01× the fastest +1.12 ms +1 MB transfer, ChaCha20-Poly1305, aws-lc-rs: 1.12 ms, 1.01× the fastest +1.12 ms +1 MB transfer, ChaCha20-Poly1305, ring: 1.11 ms, 1.01× the fastest +1.11 ms +1 MB transfer, ChaCha20-Poly1305, graviola: 1.79 ms, 1.62× the fastest +1.79 ms +1 MB transfer, ChaCha20-Poly1305, OpenSSL: 1.11 ms, 1.00× the fastest +1.11 ms +AEADs + +AES-128-GCM seal, 32 B +AES-128-GCM seal, 32 B, rind: 57 ns, 2.40× the fastest +57 ns +AES-128-GCM seal, 32 B, aws-lc-rs: 50 ns, 2.10× the fastest +50 ns +AES-128-GCM seal, 32 B, ring: 42 ns, 1.77× the fastest +42 ns +AES-128-GCM seal, 32 B, RustCrypto + dalek: 24 ns, 1.00× the fastest +24 ns +AES-128-GCM seal, 32 B, graviola: 80 ns, 3.37× the fastest +80 ns +AES-128-GCM seal, 32 B, libcrux: 53 ns, 2.23× the fastest +53 ns +AES-128-GCM seal, 32 B, OpenSSL: 69 ns, 2.91× the fastest +69 ns +AES-128-GCM seal, 1350 B +AES-128-GCM seal, 1350 B, rind: 212 ns, 1.18× the fastest +212 ns +AES-128-GCM seal, 1350 B, aws-lc-rs: 180 ns, 1.00× the fastest +180 ns +AES-128-GCM seal, 1350 B, ring: 212 ns, 1.18× the fastest +212 ns +AES-128-GCM seal, 1350 B, RustCrypto + dalek: 213 ns, 1.18× the fastest +213 ns +AES-128-GCM seal, 1350 B, graviola: 215 ns, 1.20× the fastest +215 ns +AES-128-GCM seal, 1350 B, libcrux: 619 ns, 3.44× the fastest +619 ns +AES-128-GCM seal, 1350 B, OpenSSL: 197 ns, 1.09× the fastest +197 ns +AES-128-GCM seal, 16 KB +AES-128-GCM seal, 16 KB, rind: 1.49 µs, 1.03× the fastest +1.49 µs +AES-128-GCM seal, 16 KB, aws-lc-rs: 1.45 µs, 1.00× the fastest +1.45 µs +AES-128-GCM seal, 16 KB, ring: 1.97 µs, 1.35× the fastest +1.97 µs +AES-128-GCM seal, 16 KB, RustCrypto + dalek: 2.36 µs, 1.62× the fastest +2.36 µs +AES-128-GCM seal, 16 KB, graviola: 1.60 µs, 1.10× the fastest +1.60 µs +AES-128-GCM seal, 16 KB, libcrux: 7.15 µs, 4.92× the fastest +7.15 µs +AES-128-GCM seal, 16 KB, OpenSSL: 1.52 µs, 1.04× the fastest +1.52 µs +AES-128-GCM open, 32 B +AES-128-GCM open, 32 B, rind: 47 ns, 1.71× the fastest +47 ns +AES-128-GCM open, 32 B, aws-lc-rs: 47 ns, 1.70× the fastest +47 ns +AES-128-GCM open, 32 B, ring: 39 ns, 1.42× the fastest +39 ns +AES-128-GCM open, 32 B, RustCrypto + dalek: 28 ns, 1.00× the fastest +28 ns +AES-128-GCM open, 32 B, graviola: 85 ns, 3.06× the fastest +85 ns +AES-128-GCM open, 32 B, libcrux: 64 ns, 2.30× the fastest +64 ns +AES-128-GCM open, 32 B, OpenSSL: 65 ns, 2.36× the fastest +65 ns +AES-128-GCM open, 1350 B +AES-128-GCM open, 1350 B, rind: 214 ns, 1.11× the fastest +214 ns +AES-128-GCM open, 1350 B, aws-lc-rs: 193 ns, 1.00× the fastest +193 ns +AES-128-GCM open, 1350 B, ring: 247 ns, 1.28× the fastest +247 ns +AES-128-GCM open, 1350 B, RustCrypto + dalek: 237 ns, 1.23× the fastest +237 ns +AES-128-GCM open, 1350 B, graviola: 226 ns, 1.17× the fastest +226 ns +AES-128-GCM open, 1350 B, libcrux: 647 ns, 3.35× the fastest +647 ns +AES-128-GCM open, 1350 B, OpenSSL: 199 ns, 1.03× the fastest +199 ns +AES-128-GCM open, 16 KB +AES-128-GCM open, 16 KB, rind: 1.61 µs, 1.02× the fastest +1.61 µs +AES-128-GCM open, 16 KB, aws-lc-rs: 1.57 µs, 1.00× the fastest +1.57 µs +AES-128-GCM open, 16 KB, ring: 2.18 µs, 1.39× the fastest +2.18 µs +AES-128-GCM open, 16 KB, RustCrypto + dalek: 2.46 µs, 1.57× the fastest +2.46 µs +AES-128-GCM open, 16 KB, graviola: 1.71 µs, 1.09× the fastest +1.71 µs +AES-128-GCM open, 16 KB, libcrux: 6.97 µs, 4.44× the fastest +6.97 µs +AES-128-GCM open, 16 KB, OpenSSL: 1.66 µs, 1.06× the fastest +1.66 µs +AES-256-GCM seal, 32 B +AES-256-GCM seal, 32 B, rind: 61 ns, 2.44× the fastest +61 ns +AES-256-GCM seal, 32 B, aws-lc-rs: 54 ns, 2.18× the fastest +54 ns +AES-256-GCM seal, 32 B, ring: 45 ns, 1.82× the fastest +45 ns +AES-256-GCM seal, 32 B, RustCrypto + dalek: 25 ns, 1.00× the fastest +25 ns +AES-256-GCM seal, 32 B, graviola: 79 ns, 3.18× the fastest +79 ns +AES-256-GCM seal, 32 B, libcrux: 53 ns, 2.15× the fastest +53 ns +AES-256-GCM seal, 32 B, OpenSSL: 67 ns, 2.72× the fastest +67 ns +AES-256-GCM seal, 1350 B +AES-256-GCM seal, 1350 B, rind: 237 ns, 1.16× the fastest +237 ns +AES-256-GCM seal, 1350 B, aws-lc-rs: 205 ns, 1.00× the fastest +205 ns +AES-256-GCM seal, 1350 B, ring: 220 ns, 1.07× the fastest +220 ns +AES-256-GCM seal, 1350 B, RustCrypto + dalek: 246 ns, 1.20× the fastest +246 ns +AES-256-GCM seal, 1350 B, graviola: 262 ns, 1.28× the fastest +262 ns +AES-256-GCM seal, 1350 B, libcrux: 650 ns, 3.18× the fastest +650 ns +AES-256-GCM seal, 1350 B, OpenSSL: 222 ns, 1.08× the fastest +222 ns +AES-256-GCM seal, 16 KB +AES-256-GCM seal, 16 KB, rind: 1.75 µs, 1.02× the fastest +1.75 µs +AES-256-GCM seal, 16 KB, aws-lc-rs: 1.72 µs, 1.00× the fastest +1.72 µs +AES-256-GCM seal, 16 KB, ring: 2.04 µs, 1.19× the fastest +2.04 µs +AES-256-GCM seal, 16 KB, RustCrypto + dalek: 2.72 µs, 1.58× the fastest +2.72 µs +AES-256-GCM seal, 16 KB, graviola: 2.16 µs, 1.26× the fastest +2.16 µs +AES-256-GCM seal, 16 KB, libcrux: 7.20 µs, 4.19× the fastest +7.20 µs +AES-256-GCM seal, 16 KB, OpenSSL: 1.79 µs, 1.04× the fastest +1.79 µs +AES-256-GCM open, 32 B +AES-256-GCM open, 32 B, rind: 49 ns, 1.24× the fastest +49 ns +AES-256-GCM open, 32 B, aws-lc-rs: 49 ns, 1.24× the fastest +49 ns +AES-256-GCM open, 32 B, ring: 40 ns, 1.00× the fastest +40 ns +AES-256-GCM open, 32 B, RustCrypto + dalek: 41 ns, 1.04× the fastest +41 ns +AES-256-GCM open, 32 B, graviola: 85 ns, 2.15× the fastest +85 ns +AES-256-GCM open, 32 B, libcrux: 67 ns, 1.69× the fastest +67 ns +AES-256-GCM open, 32 B, OpenSSL: 68 ns, 1.71× the fastest +68 ns +AES-256-GCM open, 1350 B +AES-256-GCM open, 1350 B, rind: 233 ns, 1.07× the fastest +233 ns +AES-256-GCM open, 1350 B, aws-lc-rs: 218 ns, 1.00× the fastest +218 ns +AES-256-GCM open, 1350 B, ring: 252 ns, 1.15× the fastest +252 ns +AES-256-GCM open, 1350 B, RustCrypto + dalek: 267 ns, 1.22× the fastest +267 ns +AES-256-GCM open, 1350 B, graviola: 263 ns, 1.20× the fastest +263 ns +AES-256-GCM open, 1350 B, libcrux: 674 ns, 3.09× the fastest +674 ns +AES-256-GCM open, 1350 B, OpenSSL: 225 ns, 1.03× the fastest +225 ns +AES-256-GCM open, 16 KB +AES-256-GCM open, 16 KB, rind: 1.86 µs, 1.01× the fastest +1.86 µs +AES-256-GCM open, 16 KB, aws-lc-rs: 1.83 µs, 1.00× the fastest +1.83 µs +AES-256-GCM open, 16 KB, ring: 2.25 µs, 1.23× the fastest +2.25 µs +AES-256-GCM open, 16 KB, RustCrypto + dalek: 2.89 µs, 1.58× the fastest +2.89 µs +AES-256-GCM open, 16 KB, graviola: 2.18 µs, 1.19× the fastest +2.18 µs +AES-256-GCM open, 16 KB, libcrux: 7.35 µs, 4.01× the fastest +7.35 µs +AES-256-GCM open, 16 KB, OpenSSL: 1.94 µs, 1.06× the fastest +1.94 µs +ChaCha20-Poly1305 seal, 32 B +ChaCha20-Poly1305 seal, 32 B, rind: 185 ns, 1.25× the fastest +185 ns +ChaCha20-Poly1305 seal, 32 B, aws-lc-rs: 163 ns, 1.10× the fastest +163 ns +ChaCha20-Poly1305 seal, 32 B, ring: 148 ns, 1.00× the fastest +148 ns +ChaCha20-Poly1305 seal, 32 B, RustCrypto + dalek: 344 ns, 2.33× the fastest +344 ns +ChaCha20-Poly1305 seal, 32 B, graviola: 196 ns, 1.32× the fastest +196 ns +ChaCha20-Poly1305 seal, 32 B, libcrux: 171 ns, 1.16× the fastest; verified: HACL*'s F* proof of Hacl.Chacha20Poly1305_32, compiled to Rust by an unverified step +171 ns ✓ +ChaCha20-Poly1305 seal, 32 B, OpenSSL: 215 ns, 1.46× the fastest +215 ns +ChaCha20-Poly1305 seal, 1350 B +ChaCha20-Poly1305 seal, 1350 B, rind: 792 ns, 1.05× the fastest +792 ns +ChaCha20-Poly1305 seal, 1350 B, aws-lc-rs: 771 ns, 1.02× the fastest +771 ns +ChaCha20-Poly1305 seal, 1350 B, ring: 755 ns, 1.00× the fastest +755 ns +ChaCha20-Poly1305 seal, 1350 B, RustCrypto + dalek: 1.78 µs, 2.36× the fastest +1.78 µs +ChaCha20-Poly1305 seal, 1350 B, graviola: 1.25 µs, 1.65× the fastest +1.25 µs +ChaCha20-Poly1305 seal, 1350 B, libcrux: 1.98 µs, 2.62× the fastest; verified: HACL*'s F* proof of Hacl.Chacha20Poly1305_32, compiled to Rust by an unverified step +1.98 µs ✓ +ChaCha20-Poly1305 seal, 1350 B, OpenSSL: 842 ns, 1.12× the fastest +842 ns +ChaCha20-Poly1305 seal, 16 KB +ChaCha20-Poly1305 seal, 16 KB, rind: 7.70 µs, 1.03× the fastest +7.70 µs +ChaCha20-Poly1305 seal, 16 KB, aws-lc-rs: 7.65 µs, 1.03× the fastest +7.65 µs +ChaCha20-Poly1305 seal, 16 KB, ring: 7.67 µs, 1.03× the fastest +7.67 µs +ChaCha20-Poly1305 seal, 16 KB, RustCrypto + dalek: 15.21 µs, 2.04× the fastest +15.21 µs +ChaCha20-Poly1305 seal, 16 KB, graviola: 12.85 µs, 1.72× the fastest +12.85 µs +ChaCha20-Poly1305 seal, 16 KB, libcrux: 22.07 µs, 2.96× the fastest; verified: HACL*'s F* proof of Hacl.Chacha20Poly1305_32, compiled to Rust by an unverified step +22.07 µs ✓ +ChaCha20-Poly1305 seal, 16 KB, OpenSSL: 7.45 µs, 1.00× the fastest +7.45 µs +XChaCha20-Poly1305 seal, 32 B +XChaCha20-Poly1305 seal, 32 B, rind: 1.19 µs, 1.26× the fastest +1.19 µs +XChaCha20-Poly1305 seal, 32 B, aws-lc-rs: 943 ns, 1.00× the fastest +943 ns +XChaCha20-Poly1305 seal, 32 B, RustCrypto + dalek: 1.53 µs, 1.62× the fastest +1.53 µs +XChaCha20-Poly1305 seal, 32 B, graviola: 1.11 µs, 1.17× the fastest +1.11 µs +XChaCha20-Poly1305 seal, 32 B, libcrux: 1.11 µs, 1.18× the fastest +1.11 µs +XChaCha20-Poly1305 seal, 1350 B +XChaCha20-Poly1305 seal, 1350 B, rind: 2.02 µs, 1.07× the fastest +2.02 µs +XChaCha20-Poly1305 seal, 1350 B, aws-lc-rs: 1.89 µs, 1.00× the fastest +1.89 µs +XChaCha20-Poly1305 seal, 1350 B, RustCrypto + dalek: 3.19 µs, 1.69× the fastest +3.19 µs +XChaCha20-Poly1305 seal, 1350 B, graviola: 2.85 µs, 1.51× the fastest +2.85 µs +XChaCha20-Poly1305 seal, 1350 B, libcrux: 3.80 µs, 2.02× the fastest +3.80 µs +XChaCha20-Poly1305 seal, 16 KB +XChaCha20-Poly1305 seal, 16 KB, rind: 11.36 µs, 1.00× the fastest +11.36 µs +XChaCha20-Poly1305 seal, 16 KB, aws-lc-rs: 11.43 µs, 1.01× the fastest +11.43 µs +XChaCha20-Poly1305 seal, 16 KB, RustCrypto + dalek: 22.76 µs, 2.00× the fastest +22.76 µs +XChaCha20-Poly1305 seal, 16 KB, graviola: 19.24 µs, 1.69× the fastest +19.24 µs +XChaCha20-Poly1305 seal, 16 KB, libcrux: 34.20 µs, 3.01× the fastest +34.20 µs +QUIC header protection + +AES-128 header protection +AES-128 header protection, rind: 35 ns, 12.24× the fastest +35 ns +AES-128 header protection, aws-lc-rs: 3 ns, 1.00× the fastest +3 ns +AES-128 header protection, ring: 3 ns, 1.15× the fastest +3 ns +AES-256 header protection +AES-256 header protection, rind: 38 ns, 12.62× the fastest +38 ns +AES-256 header protection, aws-lc-rs: 3 ns, 1.00× the fastest +3 ns +AES-256 header protection, ring: 4 ns, 1.31× the fastest +4 ns +ChaCha20 header protection +ChaCha20 header protection, rind: 89 ns, 1.29× the fastest; verified: rind's Lean proof, through Aeneas and a hand model of the function-pointer dispatch Aeneas cannot translate, which assumes each key's mask is its own cipher's, the only one rind builds, of its header-protection API's ChaCha20 against RFC 9001 and RFC 8439, HACL*'s rounds included +89 ns ✓ +ChaCha20 header protection, aws-lc-rs: 73 ns, 1.07× the fastest +73 ns +ChaCha20 header protection, ring: 68 ns, 1.00× the fastest +68 ns +Key agreement + +X25519 +X25519, rind: 16.71 µs, 1.00× the fastest; verified: rind's Lean proof, through Aeneas and a hand model of the function-pointer dispatch Aeneas cannot translate, which assumes each key's dispatch table holds its own curve's functions, the only table rind builds, of its agreement API's X25519 down to s2n-bignum's routines, composed with s2n-bignum's HOL Light proofs of curve25519_x25519_alt, curve25519_x25519base_alt, and bignum_eq, of s2n-bignum's own object code, which rind transliterates +16.71 µs ✓ +X25519, aws-lc-rs: 17.85 µs, 1.07× the fastest +17.85 µs +X25519, ring: 24.48 µs, 1.46× the fastest +24.48 µs +X25519, RustCrypto + dalek: 29.71 µs, 1.78× the fastest +29.71 µs +X25519, graviola: 17.74 µs, 1.06× the fastest +17.74 µs +X25519, libcrux: 37.77 µs, 2.26× the fastest; verified: HACL*'s F* proof of Hacl.Curve25519_51's secret_to_public and ecdh, compiled to Rust by an unverified step +37.77 µs ✓ +X25519, OpenSSL: 35.77 µs, 2.14× the fastest +35.77 µs +P-256 ECDH +P-256 ECDH, rind: 26.27 µs, 1.00× the fastest; verified: rind's Lean proof, through Aeneas and hand models of the function-pointer dispatch and of key generation's draws through a dyn RandomSource, which Aeneas cannot translate, of its agreement API's P-256 key generation, public key, and agreement down to s2n-bignum's routines, composed with s2n-bignum's HOL Light proofs of p256_scalarmulbase_alt, p256_scalarmul_alt, bignum_tomont_p256, bignum_demont_p256, bignum_add_p256, bignum_montmul_p256, bignum_montsqr_p256, bignum_mod_n256_4, and bignum_eq, of s2n-bignum's own object code, which rind transliterates, with rind's generator table proven to hold the multiples of G that s2n-bignum's proof assumes +26.27 µs ✓ +P-256 ECDH, aws-lc-rs: 28.51 µs, 1.09× the fastest +28.51 µs +P-256 ECDH, ring: 32.31 µs, 1.23× the fastest +32.31 µs +P-256 ECDH, RustCrypto + dalek: 180.62 µs, 6.88× the fastest +180.62 µs +P-256 ECDH, graviola: 31.56 µs, 1.20× the fastest +31.56 µs +P-256 ECDH, libcrux: 183.72 µs, 6.99× the fastest; verified: HACL*'s F* proof of Hacl.P256's dh_initiator, dh_responder, ecdsa_sign_p256_sha2, and ecdsa_verif_p256_sha2, compiled to Rust by an unverified step +183.72 µs ✓ +P-256 ECDH, OpenSSL: 49.96 µs, 1.90× the fastest +49.96 µs +Signatures + +Ed25519 sign +Ed25519 sign, rind: 3.95 µs, 1.00× the fastest +3.95 µs +Ed25519 sign, aws-lc-rs: 4.06 µs, 1.03× the fastest +4.06 µs +Ed25519 sign, ring: 7.07 µs, 1.79× the fastest +7.07 µs +Ed25519 sign, RustCrypto + dalek: 8.66 µs, 2.19× the fastest +8.66 µs +Ed25519 sign, graviola: 4.17 µs, 1.06× the fastest +4.17 µs +Ed25519 sign, libcrux: 22.12 µs, 5.60× the fastest; verified: HACL*'s F* proof of Hacl.Ed25519's sign and verify, compiled to Rust by an unverified step +22.12 µs ✓ +Ed25519 sign, OpenSSL: 16.42 µs, 4.16× the fastest +16.42 µs +Ed25519 verify +Ed25519 verify, rind: 18.66 µs, 1.01× the fastest +18.66 µs +Ed25519 verify, aws-lc-rs: 18.52 µs, 1.01× the fastest +18.52 µs +Ed25519 verify, ring: 19.94 µs, 1.08× the fastest +19.94 µs +Ed25519 verify, RustCrypto + dalek: 18.42 µs, 1.00× the fastest +18.42 µs +Ed25519 verify, graviola: 18.69 µs, 1.01× the fastest +18.69 µs +Ed25519 verify, libcrux: 29.57 µs, 1.61× the fastest; verified: HACL*'s F* proof of Hacl.Ed25519's sign and verify, compiled to Rust by an unverified step +29.57 µs ✓ +Ed25519 verify, OpenSSL: 41.08 µs, 2.23× the fastest +41.08 µs +P-256 ECDSA sign +P-256 ECDSA sign, rind: 7.11 µs, 1.00× the fastest; verified: rind's Lean proof, through Aeneas and hand models of the function-pointer dispatch and of the nonces' draws through a dyn RandomSource, which Aeneas cannot translate, of its signature API's P-256 ECDSA with SHA-256 and fixed-length signatures, key generation and loading, signing, and verification, down to s2n-bignum's routines, composed with s2n-bignum's HOL Light proofs of p256_scalarmulbase_alt, p256_montjadd_alt, p256_montjdouble_alt, p256_montjmixadd_alt, bignum_inv_p256, bignum_neg_p256, bignum_tomont_p256, bignum_demont_p256, bignum_add_p256, bignum_montmul_p256, bignum_montsqr_p256, bignum_mod_n256_4, bignum_modadd, bignum_montmul, bignum_demont, bignum_modinv, and bignum_eq, of s2n-bignum's own object code, which rind transliterates, with the group laws its twin multiplication relies on proven from Mathlib's and the generator's order n proven, assuming HOL Light's P256_GROUP_ELEMENT_ORDER, that a point has order n, only for verification with a parsed public key, and proving a signature right when signing returns, as its nonce loop has no bound +7.11 µs ✓ +P-256 ECDSA sign, aws-lc-rs: 11.27 µs, 1.58× the fastest +11.27 µs +P-256 ECDSA sign, ring: 11.01 µs, 1.55× the fastest +11.01 µs +P-256 ECDSA sign, RustCrypto + dalek: 44.33 µs, 6.23× the fastest +44.33 µs +P-256 ECDSA sign, graviola: 8.83 µs, 1.24× the fastest +8.83 µs +P-256 ECDSA sign, libcrux: 67.38 µs, 9.47× the fastest; verified: HACL*'s F* proof of Hacl.P256's dh_initiator, dh_responder, ecdsa_sign_p256_sha2, and ecdsa_verif_p256_sha2, compiled to Rust by an unverified step +67.38 µs ✓ +P-256 ECDSA sign, OpenSSL: 12.62 µs, 1.77× the fastest +12.62 µs +P-256 ECDSA verify +P-256 ECDSA verify, rind: 27.15 µs, 1.00× the fastest; verified: rind's Lean proof, through Aeneas and hand models of the function-pointer dispatch and of the nonces' draws through a dyn RandomSource, which Aeneas cannot translate, of its signature API's P-256 ECDSA with SHA-256 and fixed-length signatures, key generation and loading, signing, and verification, down to s2n-bignum's routines, composed with s2n-bignum's HOL Light proofs of p256_scalarmulbase_alt, p256_montjadd_alt, p256_montjdouble_alt, p256_montjmixadd_alt, bignum_inv_p256, bignum_neg_p256, bignum_tomont_p256, bignum_demont_p256, bignum_add_p256, bignum_montmul_p256, bignum_montsqr_p256, bignum_mod_n256_4, bignum_modadd, bignum_montmul, bignum_demont, bignum_modinv, and bignum_eq, of s2n-bignum's own object code, which rind transliterates, with the group laws its twin multiplication relies on proven from Mathlib's and the generator's order n proven, assuming HOL Light's P256_GROUP_ELEMENT_ORDER, that a point has order n, only for verification with a parsed public key, and proving a signature right when signing returns, as its nonce loop has no bound +27.15 µs ✓ +P-256 ECDSA verify, aws-lc-rs: 27.15 µs, 1.00× the fastest +27.15 µs +P-256 ECDSA verify, ring: 29.35 µs, 1.08× the fastest +29.35 µs +P-256 ECDSA verify, RustCrypto + dalek: 157.87 µs, 5.82× the fastest +157.87 µs +P-256 ECDSA verify, graviola: 28.60 µs, 1.05× the fastest +28.60 µs +P-256 ECDSA verify, libcrux: 156.54 µs, 5.77× the fastest; verified: HACL*'s F* proof of Hacl.P256's dh_initiator, dh_responder, ecdsa_sign_p256_sha2, and ecdsa_verif_p256_sha2, compiled to Rust by an unverified step +156.54 µs ✓ +P-256 ECDSA verify, OpenSSL: 41.90 µs, 1.54× the fastest +41.90 µs +Hashes and KDFs + +SHA-256, 64 B +SHA-256, 64 B, rind: 93 ns, 2.58× the fastest +93 ns +SHA-256, 64 B, aws-lc-rs: 71 ns, 1.97× the fastest +71 ns +SHA-256, 64 B, ring: 45 ns, 1.25× the fastest +45 ns +SHA-256, 64 B, RustCrypto + dalek: 37 ns, 1.03× the fastest +37 ns +SHA-256, 64 B, graviola: 36 ns, 1.00× the fastest +36 ns +SHA-256, 64 B, libcrux: 232 ns, 6.45× the fastest; verified: HACL*'s F* proof of Hacl.Streaming.SHA2's hash_256 and hash_512, compiled to Rust by an unverified step +232 ns ✓ +SHA-256, 64 B, OpenSSL: 162 ns, 4.50× the fastest +162 ns +SHA-256, 1350 B +SHA-256, 1350 B, rind: 484 ns, 1.17× the fastest +484 ns +SHA-256, 1350 B, aws-lc-rs: 440 ns, 1.06× the fastest +440 ns +SHA-256, 1350 B, ring: 414 ns, 1.00× the fastest +414 ns +SHA-256, 1350 B, RustCrypto + dalek: 475 ns, 1.15× the fastest +475 ns +SHA-256, 1350 B, graviola: 472 ns, 1.14× the fastest +472 ns +SHA-256, 1350 B, libcrux: 2.52 µs, 6.08× the fastest; verified: HACL*'s F* proof of Hacl.Streaming.SHA2's hash_256 and hash_512, compiled to Rust by an unverified step +2.52 µs ✓ +SHA-256, 1350 B, OpenSSL: 531 ns, 1.28× the fastest +531 ns +SHA-256, 16 KB +SHA-256, 16 KB, rind: 4.94 µs, 1.01× the fastest +4.94 µs +SHA-256, 16 KB, aws-lc-rs: 4.87 µs, 1.00× the fastest +4.87 µs +SHA-256, 16 KB, ring: 4.90 µs, 1.01× the fastest +4.90 µs +SHA-256, 16 KB, RustCrypto + dalek: 5.69 µs, 1.17× the fastest +5.69 µs +SHA-256, 16 KB, graviola: 5.76 µs, 1.18× the fastest +5.76 µs +SHA-256, 16 KB, libcrux: 29.13 µs, 5.98× the fastest; verified: HACL*'s F* proof of Hacl.Streaming.SHA2's hash_256 and hash_512, compiled to Rust by an unverified step +29.13 µs ✓ +SHA-256, 16 KB, OpenSSL: 5.17 µs, 1.06× the fastest +5.17 µs +SHA-512, 64 B +SHA-512, 64 B, rind: 113 ns, 1.44× the fastest +113 ns +SHA-512, 64 B, aws-lc-rs: 108 ns, 1.37× the fastest +108 ns +SHA-512, 64 B, ring: 88 ns, 1.11× the fastest +88 ns +SHA-512, 64 B, RustCrypto + dalek: 79 ns, 1.00× the fastest +79 ns +SHA-512, 64 B, graviola: 177 ns, 2.25× the fastest +177 ns +SHA-512, 64 B, libcrux: 141 ns, 1.79× the fastest; verified: HACL*'s F* proof of Hacl.Streaming.SHA2's hash_256 and hash_512, compiled to Rust by an unverified step +141 ns ✓ +SHA-512, 64 B, OpenSSL: 211 ns, 2.68× the fastest +211 ns +SHA-512, 1350 B +SHA-512, 1350 B, rind: 827 ns, 1.15× the fastest +827 ns +SHA-512, 1350 B, aws-lc-rs: 775 ns, 1.07× the fastest +775 ns +SHA-512, 1350 B, ring: 737 ns, 1.02× the fastest +737 ns +SHA-512, 1350 B, RustCrypto + dalek: 722 ns, 1.00× the fastest +722 ns +SHA-512, 1350 B, graviola: 1.88 µs, 2.60× the fastest +1.88 µs +SHA-512, 1350 B, libcrux: 1.58 µs, 2.18× the fastest; verified: HACL*'s F* proof of Hacl.Streaming.SHA2's hash_256 and hash_512, compiled to Rust by an unverified step +1.58 µs ✓ +SHA-512, 1350 B, OpenSSL: 878 ns, 1.22× the fastest +878 ns +SHA-512, 16 KB +SHA-512, 16 KB, rind: 8.77 µs, 1.03× the fastest +8.77 µs +SHA-512, 16 KB, aws-lc-rs: 8.70 µs, 1.02× the fastest +8.70 µs +SHA-512, 16 KB, ring: 8.69 µs, 1.02× the fastest +8.69 µs +SHA-512, 16 KB, RustCrypto + dalek: 8.50 µs, 1.00× the fastest +8.50 µs +SHA-512, 16 KB, graviola: 22.11 µs, 2.60× the fastest +22.11 µs +SHA-512, 16 KB, libcrux: 18.41 µs, 2.17× the fastest; verified: HACL*'s F* proof of Hacl.Streaming.SHA2's hash_256 and hash_512, compiled to Rust by an unverified step +18.41 µs ✓ +SHA-512, 16 KB, OpenSSL: 8.88 µs, 1.04× the fastest +8.88 µs +HMAC-SHA256, 64 B +HMAC-SHA256, 64 B, rind: 191 ns, 1.88× the fastest +191 ns +HMAC-SHA256, 64 B, aws-lc-rs: 248 ns, 2.43× the fastest +248 ns +HMAC-SHA256, 64 B, ring: 137 ns, 1.34× the fastest +137 ns +HMAC-SHA256, 64 B, RustCrypto + dalek: 102 ns, 1.00× the fastest +102 ns +HMAC-SHA256, 64 B, graviola: 115 ns, 1.12× the fastest +115 ns +HMAC-SHA256, 64 B, libcrux: 568 ns, 5.57× the fastest; verified: HACL*'s F* proof of Hacl.HMAC's compute_sha2_256, compiled to Rust by an unverified step +568 ns ✓ +HMAC-SHA256, 64 B, OpenSSL: 2.06 µs, 20.24× the fastest +2.06 µs +HMAC-SHA256, 1350 B +HMAC-SHA256, 1350 B, rind: 559 ns, 1.11× the fastest +559 ns +HMAC-SHA256, 1350 B, aws-lc-rs: 620 ns, 1.24× the fastest +620 ns +HMAC-SHA256, 1350 B, ring: 502 ns, 1.00× the fastest +502 ns +HMAC-SHA256, 1350 B, RustCrypto + dalek: 542 ns, 1.08× the fastest +542 ns +HMAC-SHA256, 1350 B, graviola: 557 ns, 1.11× the fastest +557 ns +HMAC-SHA256, 1350 B, libcrux: 2.86 µs, 5.70× the fastest; verified: HACL*'s F* proof of Hacl.HMAC's compute_sha2_256, compiled to Rust by an unverified step +2.86 µs ✓ +HMAC-SHA256, 1350 B, OpenSSL: 2.43 µs, 4.84× the fastest +2.43 µs +HKDF-SHA256 extract and expand +HKDF-SHA256 extract and expand, rind: 343 ns, 1.58× the fastest +343 ns +HKDF-SHA256 extract and expand, aws-lc-rs: 330 ns, 1.52× the fastest +330 ns +HKDF-SHA256 extract and expand, ring: 274 ns, 1.26× the fastest +274 ns +HKDF-SHA256 extract and expand, RustCrypto + dalek: 218 ns, 1.00× the fastest +218 ns +HKDF-SHA256 extract and expand, libcrux: 942 ns, 4.32× the fastest; verified: HACL*'s F* proof of Hacl.HKDF's extract_sha2_256 and expand_sha2_256, compiled to Rust by an unverified step +942 ns ✓ +HKDF-SHA256 extract and expand, OpenSSL: 2.14 µs, 9.84× the fastest +2.14 µs +HKDF-SHA256 expand +HKDF-SHA256 expand, rind: 109 ns, 1.55× the fastest +109 ns +HKDF-SHA256 expand, aws-lc-rs: 154 ns, 2.20× the fastest +154 ns +HKDF-SHA256 expand, ring: 94 ns, 1.33× the fastest +94 ns +HKDF-SHA256 expand, RustCrypto + dalek: 70 ns, 1.00× the fastest +70 ns +HKDF-SHA256 expand, libcrux: 481 ns, 6.86× the fastest; verified: HACL*'s F* proof of Hacl.HKDF's extract_sha2_256 and expand_sha2_256, compiled to Rust by an unverified step +481 ns ✓ +HKDF-SHA256 expand, OpenSSL: 1.54 µs, 21.93× the fastest +1.54 µs +RSA + +RSA-2048 PKCS#1 sign +RSA-2048 PKCS#1 sign, rind: 275.12 µs, 1.00× the fastest +275.12 µs +RSA-2048 PKCS#1 sign, aws-lc-rs: 285.95 µs, 1.04× the fastest +285.95 µs +RSA-2048 PKCS#1 sign, ring: 322.84 µs, 1.17× the fastest +322.84 µs +RSA-2048 PKCS#1 sign, RustCrypto + dalek: 586.34 µs, 2.13× the fastest +586.34 µs +RSA-2048 PKCS#1 sign, graviola: 556.70 µs, 2.02× the fastest +556.70 µs +RSA-2048 PKCS#1 sign, OpenSSL: 341.31 µs, 1.24× the fastest +341.31 µs +RSA-2048 PKCS#1 verify +RSA-2048 PKCS#1 verify, rind: 8.38 µs, 1.00× the fastest +8.38 µs +RSA-2048 PKCS#1 verify, aws-lc-rs: 9.48 µs, 1.13× the fastest +9.48 µs +RSA-2048 PKCS#1 verify, ring: 11.05 µs, 1.32× the fastest +11.05 µs +RSA-2048 PKCS#1 verify, RustCrypto + dalek: 30.77 µs, 3.67× the fastest +30.77 µs +RSA-2048 PKCS#1 verify, graviola: 18.51 µs, 2.21× the fastest +18.51 µs +RSA-2048 PKCS#1 verify, OpenSSL: 16.66 µs, 1.99× the fastest +16.66 µs +RSA-2048 PSS sign +RSA-2048 PSS sign, rind: 275.29 µs, 1.00× the fastest +275.29 µs +RSA-2048 PSS sign, aws-lc-rs: 288.58 µs, 1.05× the fastest +288.58 µs +RSA-2048 PSS sign, ring: 324.86 µs, 1.18× the fastest +324.86 µs +RSA-2048 PSS sign, RustCrypto + dalek: 588.38 µs, 2.14× the fastest +588.38 µs +RSA-2048 PSS sign, graviola: 558.57 µs, 2.03× the fastest +558.57 µs +RSA-2048 PSS sign, libcrux: 4.48 ms, 16.28× the fastest; verified: HACL*'s F* proof of Hacl.RSAPSS's rsapss_skey_sign and rsapss_pkey_verify, signing without the CRT, compiled to Rust by an unverified step +4.48 ms ✓ +RSA-2048 PSS sign, OpenSSL: 342.61 µs, 1.24× the fastest +342.61 µs +RSA-2048 PSS verify +RSA-2048 PSS verify, rind: 8.71 µs, 1.00× the fastest +8.71 µs +RSA-2048 PSS verify, aws-lc-rs: 9.84 µs, 1.13× the fastest +9.84 µs +RSA-2048 PSS verify, ring: 11.48 µs, 1.32× the fastest +11.48 µs +RSA-2048 PSS verify, RustCrypto + dalek: 39.26 µs, 4.51× the fastest +39.26 µs +RSA-2048 PSS verify, graviola: 18.79 µs, 2.16× the fastest +18.79 µs +RSA-2048 PSS verify, libcrux: 299.96 µs, 34.44× the fastest; verified: HACL*'s F* proof of Hacl.RSAPSS's rsapss_skey_sign and rsapss_pkey_verify, signing without the CRT, compiled to Rust by an unverified step +299.96 µs ✓ +RSA-2048 PSS verify, OpenSSL: 17.44 µs, 2.00× the fastest +17.44 µs +ML-KEM + +ML-KEM-768 key generation +ML-KEM-768 key generation, rind: 6.20 µs, 1.00× the fastest +6.20 µs +ML-KEM-768 key generation, aws-lc-rs: 7.46 µs, 1.20× the fastest +7.46 µs +ML-KEM-768 key generation, RustCrypto + dalek: 26.57 µs, 4.29× the fastest +26.57 µs +ML-KEM-768 key generation, graviola: 6.22 µs, 1.00× the fastest +6.22 µs +ML-KEM-768 key generation, libcrux: 12.01 µs, 1.94× the fastest +12.01 µs +ML-KEM-768 key generation, OpenSSL: 25.06 µs, 4.04× the fastest +25.06 µs +ML-KEM-768 encapsulate +ML-KEM-768 encapsulate, rind: 6.84 µs, 1.07× the fastest +6.84 µs +ML-KEM-768 encapsulate, aws-lc-rs: 8.01 µs, 1.25× the fastest +8.01 µs +ML-KEM-768 encapsulate, RustCrypto + dalek: 27.77 µs, 4.34× the fastest +27.77 µs +ML-KEM-768 encapsulate, graviola: 6.40 µs, 1.00× the fastest +6.40 µs +ML-KEM-768 encapsulate, libcrux: 9.39 µs, 1.47× the fastest +9.39 µs +ML-KEM-768 encapsulate, OpenSSL: 24.07 µs, 3.76× the fastest +24.07 µs +ML-KEM-768 decapsulate +ML-KEM-768 decapsulate, rind: 4.17 µs, 1.03× the fastest +4.17 µs +ML-KEM-768 decapsulate, aws-lc-rs: 7.75 µs, 1.91× the fastest +7.75 µs +ML-KEM-768 decapsulate, RustCrypto + dalek: 34.06 µs, 8.41× the fastest +34.06 µs +ML-KEM-768 decapsulate, graviola: 4.05 µs, 1.00× the fastest +4.05 µs +ML-KEM-768 decapsulate, libcrux: 9.58 µs, 2.36× the fastest +9.58 µs +ML-KEM-768 decapsulate, OpenSSL: 24.43 µs, 6.03× the fastest +24.43 µs +P-384 and P-521 + +P-384 ECDH +P-384 ECDH, rind: 91.49 µs, 1.00× the fastest +91.49 µs +P-384 ECDH, aws-lc-rs: 105.75 µs, 1.16× the fastest +105.75 µs +P-384 ECDH, ring: 412.48 µs, 4.51× the fastest +412.48 µs +P-384 ECDH, RustCrypto + dalek: 494.20 µs, 5.40× the fastest +494.20 µs +P-384 ECDH, graviola: 153.84 µs, 1.68× the fastest +153.84 µs +P-384 ECDH, OpenSSL: 279.51 µs, 3.06× the fastest +279.51 µs +P-384 ECDSA sign +P-384 ECDSA sign, rind: 22.93 µs, 1.00× the fastest +22.93 µs +P-384 ECDSA sign, aws-lc-rs: 49.16 µs, 2.14× the fastest +49.16 µs +P-384 ECDSA sign, ring: 223.72 µs, 9.76× the fastest +223.72 µs +P-384 ECDSA sign, RustCrypto + dalek: 112.64 µs, 4.91× the fastest +112.64 µs +P-384 ECDSA sign, graviola: 81.12 µs, 3.54× the fastest +81.12 µs +P-384 ECDSA sign, OpenSSL: 104.84 µs, 4.57× the fastest +104.84 µs +P-384 ECDSA verify +P-384 ECDSA verify, rind: 88.12 µs, 1.00× the fastest +88.12 µs +P-384 ECDSA verify, aws-lc-rs: 111.27 µs, 1.26× the fastest +111.27 µs +P-384 ECDSA verify, ring: 396.57 µs, 4.50× the fastest +396.57 µs +P-384 ECDSA verify, RustCrypto + dalek: 426.43 µs, 4.84× the fastest +426.43 µs +P-384 ECDSA verify, graviola: 151.78 µs, 1.72× the fastest +151.78 µs +P-384 ECDSA verify, OpenSSL: 238.33 µs, 2.70× the fastest +238.33 µs +P-521 ECDH +P-521 ECDH, rind: 130.92 µs, 1.00× the fastest +130.92 µs +P-521 ECDH, aws-lc-rs: 143.20 µs, 1.09× the fastest +143.20 µs +P-521 ECDH, RustCrypto + dalek: 397.10 µs, 3.03× the fastest +397.10 µs +P-521 ECDH, OpenSSL: 247.22 µs, 1.89× the fastest +247.22 µs +P-521 ECDSA sign +P-521 ECDSA sign, rind: 36.32 µs, 1.00× the fastest +36.32 µs +P-521 ECDSA sign, aws-lc-rs: 84.33 µs, 2.32× the fastest +84.33 µs +P-521 ECDSA sign, RustCrypto + dalek: 79.73 µs, 2.20× the fastest +79.73 µs +P-521 ECDSA sign, OpenSSL: 132.13 µs, 3.64× the fastest +132.13 µs +P-521 ECDSA verify +P-521 ECDSA verify, rind: 121.06 µs, 1.00× the fastest +121.06 µs +P-521 ECDSA verify, aws-lc-rs: 167.21 µs, 1.38× the fastest +167.21 µs +P-521 ECDSA verify, RustCrypto + dalek: 253.06 µs, 2.09× the fastest +253.06 µs +P-521 ECDSA verify, OpenSSL: 254.80 µs, 2.10× the fastest +254.80 µs + diff --git a/benchmarks/overview-dark.svg b/benchmarks/overview-dark.svg index 95e379eb6..cfe21e7d6 100644 --- a/benchmarks/overview-dark.svg +++ b/benchmarks/overview-dark.svg @@ -1,4 +1,4 @@ - + Time over the fastest library's, by operation, library, and host fastest, or within 10% @@ -16,897 +16,1070 @@ over 8× ✓ verified code -Each cell's squares, left to right: nixos, desktop, nixos2, ovh-iad, ovh-sea. -rind -aws-lc-rs -ring -RustCrypto -+ dalek -graviola -libcrux -OpenSSL +Each cell's squares, left to right: nixos, desktop, nixos2, kixtop, ovh-iad, ovh-sea. +rind +aws-lc-rs +ring +RustCrypto ++ dalek +graviola +libcrux +OpenSSL TLS 1.3 with rustls - + full handshake, X25519MLKEM768 full handshake, X25519MLKEM768, rind on nixos: 260.78 µs, 1.00× the fastest full handshake, X25519MLKEM768, rind on desktop: 174.97 µs, 1.00× the fastest full handshake, X25519MLKEM768, rind on nixos2: 302.43 µs, 1.00× the fastest -full handshake, X25519MLKEM768, rind on ovh-iad: 625.81 µs, 1.00× the fastest -full handshake, X25519MLKEM768, rind on ovh-sea: 580.07 µs, 1.00× the fastest -full handshake, X25519MLKEM768, aws-lc-rs on nixos: 331.87 µs, 1.27× the fastest -full handshake, X25519MLKEM768, aws-lc-rs on desktop: 235.60 µs, 1.35× the fastest -full handshake, X25519MLKEM768, aws-lc-rs on nixos2: 458.06 µs, 1.51× the fastest -full handshake, X25519MLKEM768, aws-lc-rs on ovh-iad: 731.87 µs, 1.17× the fastest -full handshake, X25519MLKEM768, aws-lc-rs on ovh-sea: 697.59 µs, 1.20× the fastest -full handshake, X25519MLKEM768, graviola on nixos: 342.68 µs, 1.31× the fastest -full handshake, X25519MLKEM768, graviola on desktop: 191.49 µs, 1.09× the fastest -full handshake, X25519MLKEM768, graviola on nixos2: 375.57 µs, 1.24× the fastest -full handshake, X25519MLKEM768, OpenSSL on nixos: 802.57 µs, 3.08× the fastest -full handshake, X25519MLKEM768, OpenSSL on desktop: 437.46 µs, 2.50× the fastest -full handshake, X25519MLKEM768, OpenSSL on nixos2: 830.76 µs, 2.75× the fastest -full handshake, X25519MLKEM768, OpenSSL on ovh-iad: 1.39 ms, 2.22× the fastest -full handshake, X25519MLKEM768, OpenSSL on ovh-sea: 1.30 ms, 2.25× the fastest +full handshake, X25519MLKEM768, rind on kixtop: 177.98 µs, 1.00× the fastest +full handshake, X25519MLKEM768, rind on ovh-iad: 625.81 µs, 1.00× the fastest +full handshake, X25519MLKEM768, rind on ovh-sea: 580.07 µs, 1.00× the fastest +full handshake, X25519MLKEM768, aws-lc-rs on nixos: 331.87 µs, 1.27× the fastest +full handshake, X25519MLKEM768, aws-lc-rs on desktop: 235.60 µs, 1.35× the fastest +full handshake, X25519MLKEM768, aws-lc-rs on nixos2: 458.06 µs, 1.51× the fastest +full handshake, X25519MLKEM768, aws-lc-rs on kixtop: 214.67 µs, 1.21× the fastest +full handshake, X25519MLKEM768, aws-lc-rs on ovh-iad: 731.87 µs, 1.17× the fastest +full handshake, X25519MLKEM768, aws-lc-rs on ovh-sea: 697.59 µs, 1.20× the fastest +full handshake, X25519MLKEM768, graviola on nixos: 342.68 µs, 1.31× the fastest +full handshake, X25519MLKEM768, graviola on desktop: 191.49 µs, 1.09× the fastest +full handshake, X25519MLKEM768, graviola on nixos2: 375.57 µs, 1.24× the fastest +full handshake, X25519MLKEM768, graviola on kixtop: 180.42 µs, 1.01× the fastest +full handshake, X25519MLKEM768, OpenSSL on nixos: 802.57 µs, 3.08× the fastest +full handshake, X25519MLKEM768, OpenSSL on desktop: 437.46 µs, 2.50× the fastest +full handshake, X25519MLKEM768, OpenSSL on nixos2: 830.76 µs, 2.75× the fastest +full handshake, X25519MLKEM768, OpenSSL on kixtop: 459.07 µs, 2.58× the fastest +full handshake, X25519MLKEM768, OpenSSL on ovh-iad: 1.39 ms, 2.22× the fastest +full handshake, X25519MLKEM768, OpenSSL on ovh-sea: 1.30 ms, 2.25× the fastest full handshake, X25519 full handshake, X25519, rind on nixos: 227.82 µs, 1.00× the fastest full handshake, X25519, rind on desktop: 152.75 µs, 1.00× the fastest full handshake, X25519, rind on nixos2: 260.02 µs, 1.00× the fastest -full handshake, X25519, rind on ovh-iad: 490.86 µs, 1.00× the fastest -full handshake, X25519, rind on ovh-sea: 450.00 µs, 1.00× the fastest -full handshake, X25519, aws-lc-rs on nixos: 292.13 µs, 1.28× the fastest -full handshake, X25519, aws-lc-rs on desktop: 203.62 µs, 1.33× the fastest -full handshake, X25519, aws-lc-rs on nixos2: 369.74 µs, 1.42× the fastest -full handshake, X25519, aws-lc-rs on ovh-iad: 554.00 µs, 1.13× the fastest -full handshake, X25519, aws-lc-rs on ovh-sea: 517.47 µs, 1.15× the fastest -full handshake, X25519, ring on nixos: 328.46 µs, 1.44× the fastest -full handshake, X25519, ring on desktop: 222.88 µs, 1.46× the fastest -full handshake, X25519, ring on nixos2: 337.91 µs, 1.30× the fastest -full handshake, X25519, ring on ovh-iad: 571.30 µs, 1.16× the fastest -full handshake, X25519, ring on ovh-sea: 526.35 µs, 1.17× the fastest -full handshake, X25519, graviola on nixos: 238.70 µs, 1.05× the fastest -full handshake, X25519, graviola on desktop: 162.55 µs, 1.06× the fastest -full handshake, X25519, graviola on nixos2: 315.73 µs, 1.21× the fastest -full handshake, X25519, OpenSSL on nixos: 574.28 µs, 2.52× the fastest -full handshake, X25519, OpenSSL on desktop: 367.79 µs, 2.41× the fastest -full handshake, X25519, OpenSSL on nixos2: 686.50 µs, 2.64× the fastest -full handshake, X25519, OpenSSL on ovh-iad: 1.19 ms, 2.43× the fastest -full handshake, X25519, OpenSSL on ovh-sea: 1.07 ms, 2.37× the fastest +full handshake, X25519, rind on kixtop: 155.39 µs, 1.00× the fastest +full handshake, X25519, rind on ovh-iad: 490.86 µs, 1.00× the fastest +full handshake, X25519, rind on ovh-sea: 450.00 µs, 1.00× the fastest +full handshake, X25519, aws-lc-rs on nixos: 292.13 µs, 1.28× the fastest +full handshake, X25519, aws-lc-rs on desktop: 203.62 µs, 1.33× the fastest +full handshake, X25519, aws-lc-rs on nixos2: 369.74 µs, 1.42× the fastest +full handshake, X25519, aws-lc-rs on kixtop: 184.86 µs, 1.19× the fastest +full handshake, X25519, aws-lc-rs on ovh-iad: 554.00 µs, 1.13× the fastest +full handshake, X25519, aws-lc-rs on ovh-sea: 517.47 µs, 1.15× the fastest +full handshake, X25519, ring on nixos: 328.46 µs, 1.44× the fastest +full handshake, X25519, ring on desktop: 222.88 µs, 1.46× the fastest +full handshake, X25519, ring on nixos2: 337.91 µs, 1.30× the fastest +full handshake, X25519, ring on kixtop: 184.65 µs, 1.19× the fastest +full handshake, X25519, ring on ovh-iad: 571.30 µs, 1.16× the fastest +full handshake, X25519, ring on ovh-sea: 526.35 µs, 1.17× the fastest +full handshake, X25519, graviola on nixos: 238.70 µs, 1.05× the fastest +full handshake, X25519, graviola on desktop: 162.55 µs, 1.06× the fastest +full handshake, X25519, graviola on nixos2: 315.73 µs, 1.21× the fastest +full handshake, X25519, graviola on kixtop: 159.19 µs, 1.02× the fastest +full handshake, X25519, OpenSSL on nixos: 574.28 µs, 2.52× the fastest +full handshake, X25519, OpenSSL on desktop: 367.79 µs, 2.41× the fastest +full handshake, X25519, OpenSSL on nixos2: 686.50 µs, 2.64× the fastest +full handshake, X25519, OpenSSL on kixtop: 374.65 µs, 2.41× the fastest +full handshake, X25519, OpenSSL on ovh-iad: 1.19 ms, 2.43× the fastest +full handshake, X25519, OpenSSL on ovh-sea: 1.07 ms, 2.37× the fastest full handshake, P-256 full handshake, P-256, rind on nixos: 242.76 µs, 1.00× the fastest full handshake, P-256, rind on desktop: 175.68 µs, 1.00× the fastest full handshake, P-256, rind on nixos2: 295.92 µs, 1.00× the fastest -full handshake, P-256, rind on ovh-iad: 570.01 µs, 1.00× the fastest -full handshake, P-256, rind on ovh-sea: 509.55 µs, 1.00× the fastest -full handshake, P-256, aws-lc-rs on nixos: 304.37 µs, 1.25× the fastest -full handshake, P-256, aws-lc-rs on desktop: 228.85 µs, 1.30× the fastest -full handshake, P-256, aws-lc-rs on nixos2: 417.28 µs, 1.41× the fastest -full handshake, P-256, aws-lc-rs on ovh-iad: 752.60 µs, 1.32× the fastest -full handshake, P-256, aws-lc-rs on ovh-sea: 572.32 µs, 1.12× the fastest -full handshake, P-256, ring on nixos: 281.93 µs, 1.16× the fastest -full handshake, P-256, ring on desktop: 221.72 µs, 1.26× the fastest -full handshake, P-256, ring on nixos2: 327.88 µs, 1.11× the fastest -full handshake, P-256, ring on ovh-iad: 601.35 µs, 1.05× the fastest -full handshake, P-256, ring on ovh-sea: 541.38 µs, 1.06× the fastest -full handshake, P-256, graviola on nixos: 270.05 µs, 1.11× the fastest -full handshake, P-256, graviola on desktop: 193.10 µs, 1.10× the fastest -full handshake, P-256, graviola on nixos2: 368.79 µs, 1.25× the fastest -full handshake, P-256, OpenSSL on nixos: 624.35 µs, 2.57× the fastest -full handshake, P-256, OpenSSL on desktop: 406.49 µs, 2.31× the fastest -full handshake, P-256, OpenSSL on nixos2: 760.04 µs, 2.57× the fastest -full handshake, P-256, OpenSSL on ovh-iad: 1.32 ms, 2.32× the fastest -full handshake, P-256, OpenSSL on ovh-sea: 1.15 ms, 2.26× the fastest +full handshake, P-256, rind on kixtop: 176.20 µs, 1.00× the fastest +full handshake, P-256, rind on ovh-iad: 570.01 µs, 1.00× the fastest +full handshake, P-256, rind on ovh-sea: 509.55 µs, 1.00× the fastest +full handshake, P-256, aws-lc-rs on nixos: 304.37 µs, 1.25× the fastest +full handshake, P-256, aws-lc-rs on desktop: 228.85 µs, 1.30× the fastest +full handshake, P-256, aws-lc-rs on nixos2: 417.28 µs, 1.41× the fastest +full handshake, P-256, aws-lc-rs on kixtop: 206.73 µs, 1.17× the fastest +full handshake, P-256, aws-lc-rs on ovh-iad: 752.60 µs, 1.32× the fastest +full handshake, P-256, aws-lc-rs on ovh-sea: 572.32 µs, 1.12× the fastest +full handshake, P-256, ring on nixos: 281.93 µs, 1.16× the fastest +full handshake, P-256, ring on desktop: 221.72 µs, 1.26× the fastest +full handshake, P-256, ring on nixos2: 327.88 µs, 1.11× the fastest +full handshake, P-256, ring on kixtop: 201.44 µs, 1.14× the fastest +full handshake, P-256, ring on ovh-iad: 601.35 µs, 1.05× the fastest +full handshake, P-256, ring on ovh-sea: 541.38 µs, 1.06× the fastest +full handshake, P-256, graviola on nixos: 270.05 µs, 1.11× the fastest +full handshake, P-256, graviola on desktop: 193.10 µs, 1.10× the fastest +full handshake, P-256, graviola on nixos2: 368.79 µs, 1.25× the fastest +full handshake, P-256, graviola on kixtop: 191.72 µs, 1.09× the fastest +full handshake, P-256, OpenSSL on nixos: 624.35 µs, 2.57× the fastest +full handshake, P-256, OpenSSL on desktop: 406.49 µs, 2.31× the fastest +full handshake, P-256, OpenSSL on nixos2: 760.04 µs, 2.57× the fastest +full handshake, P-256, OpenSSL on kixtop: 400.48 µs, 2.27× the fastest +full handshake, P-256, OpenSSL on ovh-iad: 1.32 ms, 2.32× the fastest +full handshake, P-256, OpenSSL on ovh-sea: 1.15 ms, 2.26× the fastest full handshake, Ed25519 certificate full handshake, Ed25519 certificate, rind on nixos: 186.73 µs, 1.00× the fastest full handshake, Ed25519 certificate, rind on desktop: 123.11 µs, 1.00× the fastest full handshake, Ed25519 certificate, rind on nixos2: 213.12 µs, 1.00× the fastest -full handshake, Ed25519 certificate, rind on ovh-iad: 400.37 µs, 1.00× the fastest -full handshake, Ed25519 certificate, rind on ovh-sea: 379.57 µs, 1.00× the fastest -full handshake, Ed25519 certificate, aws-lc-rs on nixos: 233.43 µs, 1.25× the fastest -full handshake, Ed25519 certificate, aws-lc-rs on desktop: 168.12 µs, 1.37× the fastest -full handshake, Ed25519 certificate, aws-lc-rs on nixos2: 306.11 µs, 1.44× the fastest -full handshake, Ed25519 certificate, aws-lc-rs on ovh-iad: 468.81 µs, 1.17× the fastest -full handshake, Ed25519 certificate, aws-lc-rs on ovh-sea: 437.12 µs, 1.15× the fastest -full handshake, Ed25519 certificate, ring on nixos: 292.96 µs, 1.57× the fastest -full handshake, Ed25519 certificate, ring on desktop: 205.53 µs, 1.67× the fastest -full handshake, Ed25519 certificate, ring on nixos2: 325.29 µs, 1.53× the fastest -full handshake, Ed25519 certificate, ring on ovh-iad: 507.02 µs, 1.27× the fastest -full handshake, Ed25519 certificate, ring on ovh-sea: 477.34 µs, 1.26× the fastest -full handshake, Ed25519 certificate, graviola on nixos: 186.05 µs, 1.00× the fastest -full handshake, Ed25519 certificate, graviola on desktop: 125.46 µs, 1.02× the fastest -full handshake, Ed25519 certificate, graviola on nixos2: 250.28 µs, 1.17× the fastest -full handshake, Ed25519 certificate, OpenSSL on nixos: 640.40 µs, 3.44× the fastest -full handshake, Ed25519 certificate, OpenSSL on desktop: 373.29 µs, 3.03× the fastest -full handshake, Ed25519 certificate, OpenSSL on nixos2: 747.09 µs, 3.51× the fastest -full handshake, Ed25519 certificate, OpenSSL on ovh-iad: 1.22 ms, 3.04× the fastest -full handshake, Ed25519 certificate, OpenSSL on ovh-sea: 1.15 ms, 3.04× the fastest +full handshake, Ed25519 certificate, rind on kixtop: 127.23 µs, 1.03× the fastest +full handshake, Ed25519 certificate, rind on ovh-iad: 400.37 µs, 1.00× the fastest +full handshake, Ed25519 certificate, rind on ovh-sea: 379.57 µs, 1.00× the fastest +full handshake, Ed25519 certificate, aws-lc-rs on nixos: 233.43 µs, 1.25× the fastest +full handshake, Ed25519 certificate, aws-lc-rs on desktop: 168.12 µs, 1.37× the fastest +full handshake, Ed25519 certificate, aws-lc-rs on nixos2: 306.11 µs, 1.44× the fastest +full handshake, Ed25519 certificate, aws-lc-rs on kixtop: 150.93 µs, 1.22× the fastest +full handshake, Ed25519 certificate, aws-lc-rs on ovh-iad: 468.81 µs, 1.17× the fastest +full handshake, Ed25519 certificate, aws-lc-rs on ovh-sea: 437.12 µs, 1.15× the fastest +full handshake, Ed25519 certificate, ring on nixos: 292.96 µs, 1.57× the fastest +full handshake, Ed25519 certificate, ring on desktop: 205.53 µs, 1.67× the fastest +full handshake, Ed25519 certificate, ring on nixos2: 325.29 µs, 1.53× the fastest +full handshake, Ed25519 certificate, ring on kixtop: 155.04 µs, 1.25× the fastest +full handshake, Ed25519 certificate, ring on ovh-iad: 507.02 µs, 1.27× the fastest +full handshake, Ed25519 certificate, ring on ovh-sea: 477.34 µs, 1.26× the fastest +full handshake, Ed25519 certificate, graviola on nixos: 186.05 µs, 1.00× the fastest +full handshake, Ed25519 certificate, graviola on desktop: 125.46 µs, 1.02× the fastest +full handshake, Ed25519 certificate, graviola on nixos2: 250.28 µs, 1.17× the fastest +full handshake, Ed25519 certificate, graviola on kixtop: 124.12 µs, 1.00× the fastest +full handshake, Ed25519 certificate, OpenSSL on nixos: 640.40 µs, 3.44× the fastest +full handshake, Ed25519 certificate, OpenSSL on desktop: 373.29 µs, 3.03× the fastest +full handshake, Ed25519 certificate, OpenSSL on nixos2: 747.09 µs, 3.51× the fastest +full handshake, Ed25519 certificate, OpenSSL on kixtop: 383.83 µs, 3.09× the fastest +full handshake, Ed25519 certificate, OpenSSL on ovh-iad: 1.22 ms, 3.04× the fastest +full handshake, Ed25519 certificate, OpenSSL on ovh-sea: 1.15 ms, 3.04× the fastest full handshake, RSA-2048 certificate full handshake, RSA-2048 certificate, rind on nixos: 550.14 µs, 1.00× the fastest full handshake, RSA-2048 certificate, rind on desktop: 428.67 µs, 1.00× the fastest full handshake, RSA-2048 certificate, rind on nixos2: 613.80 µs, 1.00× the fastest -full handshake, RSA-2048 certificate, rind on ovh-iad: 1.19 ms, 1.00× the fastest -full handshake, RSA-2048 certificate, rind on ovh-sea: 1.09 ms, 1.00× the fastest -full handshake, RSA-2048 certificate, aws-lc-rs on nixos: 646.28 µs, 1.17× the fastest -full handshake, RSA-2048 certificate, aws-lc-rs on desktop: 485.87 µs, 1.13× the fastest -full handshake, RSA-2048 certificate, aws-lc-rs on nixos2: 758.17 µs, 1.24× the fastest -full handshake, RSA-2048 certificate, aws-lc-rs on ovh-iad: 1.26 ms, 1.06× the fastest -full handshake, RSA-2048 certificate, aws-lc-rs on ovh-sea: 1.18 ms, 1.09× the fastest -full handshake, RSA-2048 certificate, ring on nixos: 647.36 µs, 1.18× the fastest -full handshake, RSA-2048 certificate, ring on desktop: 493.81 µs, 1.15× the fastest -full handshake, RSA-2048 certificate, ring on nixos2: 678.16 µs, 1.10× the fastest -full handshake, RSA-2048 certificate, ring on ovh-iad: 1.48 ms, 1.25× the fastest -full handshake, RSA-2048 certificate, ring on ovh-sea: 1.38 ms, 1.27× the fastest -full handshake, RSA-2048 certificate, graviola on nixos: 567.91 µs, 1.03× the fastest -full handshake, RSA-2048 certificate, graviola on desktop: 440.23 µs, 1.03× the fastest -full handshake, RSA-2048 certificate, graviola on nixos2: 687.17 µs, 1.12× the fastest -full handshake, RSA-2048 certificate, OpenSSL on nixos: 992.05 µs, 1.80× the fastest -full handshake, RSA-2048 certificate, OpenSSL on desktop: 682.29 µs, 1.59× the fastest -full handshake, RSA-2048 certificate, OpenSSL on nixos2: 1.01 ms, 1.65× the fastest -full handshake, RSA-2048 certificate, OpenSSL on ovh-iad: 1.89 ms, 1.59× the fastest -full handshake, RSA-2048 certificate, OpenSSL on ovh-sea: 1.76 ms, 1.62× the fastest +full handshake, RSA-2048 certificate, rind on kixtop: 371.35 µs, 1.00× the fastest +full handshake, RSA-2048 certificate, rind on ovh-iad: 1.19 ms, 1.00× the fastest +full handshake, RSA-2048 certificate, rind on ovh-sea: 1.09 ms, 1.00× the fastest +full handshake, RSA-2048 certificate, aws-lc-rs on nixos: 646.28 µs, 1.17× the fastest +full handshake, RSA-2048 certificate, aws-lc-rs on desktop: 485.87 µs, 1.13× the fastest +full handshake, RSA-2048 certificate, aws-lc-rs on nixos2: 758.17 µs, 1.24× the fastest +full handshake, RSA-2048 certificate, aws-lc-rs on kixtop: 406.71 µs, 1.10× the fastest +full handshake, RSA-2048 certificate, aws-lc-rs on ovh-iad: 1.26 ms, 1.06× the fastest +full handshake, RSA-2048 certificate, aws-lc-rs on ovh-sea: 1.18 ms, 1.09× the fastest +full handshake, RSA-2048 certificate, ring on nixos: 647.36 µs, 1.18× the fastest +full handshake, RSA-2048 certificate, ring on desktop: 493.81 µs, 1.15× the fastest +full handshake, RSA-2048 certificate, ring on nixos2: 678.16 µs, 1.10× the fastest +full handshake, RSA-2048 certificate, ring on kixtop: 446.94 µs, 1.20× the fastest +full handshake, RSA-2048 certificate, ring on ovh-iad: 1.48 ms, 1.25× the fastest +full handshake, RSA-2048 certificate, ring on ovh-sea: 1.38 ms, 1.27× the fastest +full handshake, RSA-2048 certificate, graviola on nixos: 567.91 µs, 1.03× the fastest +full handshake, RSA-2048 certificate, graviola on desktop: 440.23 µs, 1.03× the fastest +full handshake, RSA-2048 certificate, graviola on nixos2: 687.17 µs, 1.12× the fastest +full handshake, RSA-2048 certificate, graviola on kixtop: 683.15 µs, 1.84× the fastest +full handshake, RSA-2048 certificate, OpenSSL on nixos: 992.05 µs, 1.80× the fastest +full handshake, RSA-2048 certificate, OpenSSL on desktop: 682.29 µs, 1.59× the fastest +full handshake, RSA-2048 certificate, OpenSSL on nixos2: 1.01 ms, 1.65× the fastest +full handshake, RSA-2048 certificate, OpenSSL on kixtop: 643.30 µs, 1.73× the fastest +full handshake, RSA-2048 certificate, OpenSSL on ovh-iad: 1.89 ms, 1.59× the fastest +full handshake, RSA-2048 certificate, OpenSSL on ovh-sea: 1.76 ms, 1.62× the fastest resumed handshake, X25519 resumed handshake, X25519, rind on nixos: 77.19 µs, 1.00× the fastest resumed handshake, X25519, rind on desktop: 54.19 µs, 1.00× the fastest resumed handshake, X25519, rind on nixos2: 120.95 µs, 1.00× the fastest -resumed handshake, X25519, rind on ovh-iad: 202.07 µs, 1.00× the fastest -resumed handshake, X25519, rind on ovh-sea: 192.78 µs, 1.00× the fastest -resumed handshake, X25519, aws-lc-rs on nixos: 132.67 µs, 1.72× the fastest -resumed handshake, X25519, aws-lc-rs on desktop: 102.84 µs, 1.90× the fastest -resumed handshake, X25519, aws-lc-rs on nixos2: 229.39 µs, 1.90× the fastest -resumed handshake, X25519, aws-lc-rs on ovh-iad: 278.39 µs, 1.38× the fastest -resumed handshake, X25519, aws-lc-rs on ovh-sea: 250.87 µs, 1.30× the fastest -resumed handshake, X25519, ring on nixos: 158.11 µs, 2.05× the fastest -resumed handshake, X25519, ring on desktop: 113.00 µs, 2.09× the fastest -resumed handshake, X25519, ring on nixos2: 199.88 µs, 1.65× the fastest -resumed handshake, X25519, ring on ovh-iad: 287.08 µs, 1.42× the fastest -resumed handshake, X25519, ring on ovh-sea: 266.29 µs, 1.38× the fastest -resumed handshake, X25519, graviola on nixos: 77.33 µs, 1.00× the fastest -resumed handshake, X25519, graviola on desktop: 55.16 µs, 1.02× the fastest -resumed handshake, X25519, graviola on nixos2: 159.71 µs, 1.32× the fastest -resumed handshake, X25519, OpenSSL on nixos: 370.51 µs, 4.80× the fastest -resumed handshake, X25519, OpenSSL on desktop: 231.44 µs, 4.27× the fastest -resumed handshake, X25519, OpenSSL on nixos2: 496.91 µs, 4.11× the fastest -resumed handshake, X25519, OpenSSL on ovh-iad: 746.29 µs, 3.69× the fastest -resumed handshake, X25519, OpenSSL on ovh-sea: 704.86 µs, 3.66× the fastest +resumed handshake, X25519, rind on kixtop: 66.29 µs, 1.07× the fastest +resumed handshake, X25519, rind on ovh-iad: 202.07 µs, 1.00× the fastest +resumed handshake, X25519, rind on ovh-sea: 192.78 µs, 1.00× the fastest +resumed handshake, X25519, aws-lc-rs on nixos: 132.67 µs, 1.72× the fastest +resumed handshake, X25519, aws-lc-rs on desktop: 102.84 µs, 1.90× the fastest +resumed handshake, X25519, aws-lc-rs on nixos2: 229.39 µs, 1.90× the fastest +resumed handshake, X25519, aws-lc-rs on kixtop: 92.46 µs, 1.50× the fastest +resumed handshake, X25519, aws-lc-rs on ovh-iad: 278.39 µs, 1.38× the fastest +resumed handshake, X25519, aws-lc-rs on ovh-sea: 250.87 µs, 1.30× the fastest +resumed handshake, X25519, ring on nixos: 158.11 µs, 2.05× the fastest +resumed handshake, X25519, ring on desktop: 113.00 µs, 2.09× the fastest +resumed handshake, X25519, ring on nixos2: 199.88 µs, 1.65× the fastest +resumed handshake, X25519, ring on kixtop: 88.29 µs, 1.43× the fastest +resumed handshake, X25519, ring on ovh-iad: 287.08 µs, 1.42× the fastest +resumed handshake, X25519, ring on ovh-sea: 266.29 µs, 1.38× the fastest +resumed handshake, X25519, graviola on nixos: 77.33 µs, 1.00× the fastest +resumed handshake, X25519, graviola on desktop: 55.16 µs, 1.02× the fastest +resumed handshake, X25519, graviola on nixos2: 159.71 µs, 1.32× the fastest +resumed handshake, X25519, graviola on kixtop: 61.75 µs, 1.00× the fastest +resumed handshake, X25519, OpenSSL on nixos: 370.51 µs, 4.80× the fastest +resumed handshake, X25519, OpenSSL on desktop: 231.44 µs, 4.27× the fastest +resumed handshake, X25519, OpenSSL on nixos2: 496.91 µs, 4.11× the fastest +resumed handshake, X25519, OpenSSL on kixtop: 255.12 µs, 4.13× the fastest +resumed handshake, X25519, OpenSSL on ovh-iad: 746.29 µs, 3.69× the fastest +resumed handshake, X25519, OpenSSL on ovh-sea: 704.86 µs, 3.66× the fastest 1 MB transfer, AES-128-GCM 1 MB transfer, AES-128-GCM, rind on nixos: 289.43 µs, 1.03× the fastest 1 MB transfer, AES-128-GCM, rind on desktop: 193.36 µs, 1.11× the fastest 1 MB transfer, AES-128-GCM, rind on nixos2: 440.92 µs, 1.00× the fastest -1 MB transfer, AES-128-GCM, rind on ovh-iad: 704.59 µs, 1.01× the fastest -1 MB transfer, AES-128-GCM, rind on ovh-sea: 665.48 µs, 1.00× the fastest -1 MB transfer, AES-128-GCM, aws-lc-rs on nixos: 458.21 µs, 1.62× the fastest -1 MB transfer, AES-128-GCM, aws-lc-rs on desktop: 241.18 µs, 1.38× the fastest -1 MB transfer, AES-128-GCM, aws-lc-rs on nixos2: 442.54 µs, 1.00× the fastest -1 MB transfer, AES-128-GCM, aws-lc-rs on ovh-iad: 700.77 µs, 1.00× the fastest -1 MB transfer, AES-128-GCM, aws-lc-rs on ovh-sea: 677.99 µs, 1.02× the fastest -1 MB transfer, AES-128-GCM, ring on nixos: 282.22 µs, 1.00× the fastest -1 MB transfer, AES-128-GCM, ring on desktop: 174.96 µs, 1.00× the fastest -1 MB transfer, AES-128-GCM, ring on nixos2: 448.76 µs, 1.02× the fastest -1 MB transfer, AES-128-GCM, ring on ovh-iad: 716.03 µs, 1.02× the fastest -1 MB transfer, AES-128-GCM, ring on ovh-sea: 670.85 µs, 1.01× the fastest -1 MB transfer, AES-128-GCM, graviola on nixos: 424.38 µs, 1.50× the fastest -1 MB transfer, AES-128-GCM, graviola on desktop: 294.75 µs, 1.68× the fastest -1 MB transfer, AES-128-GCM, graviola on nixos2: 579.09 µs, 1.31× the fastest -1 MB transfer, AES-128-GCM, OpenSSL on nixos: 469.84 µs, 1.66× the fastest -1 MB transfer, AES-128-GCM, OpenSSL on desktop: 255.72 µs, 1.46× the fastest -1 MB transfer, AES-128-GCM, OpenSSL on nixos2: 491.38 µs, 1.11× the fastest -1 MB transfer, AES-128-GCM, OpenSSL on ovh-iad: 789.03 µs, 1.13× the fastest -1 MB transfer, AES-128-GCM, OpenSSL on ovh-sea: 750.68 µs, 1.13× the fastest +1 MB transfer, AES-128-GCM, rind on kixtop: 308.57 µs, 1.00× the fastest +1 MB transfer, AES-128-GCM, rind on ovh-iad: 704.59 µs, 1.01× the fastest +1 MB transfer, AES-128-GCM, rind on ovh-sea: 665.48 µs, 1.00× the fastest +1 MB transfer, AES-128-GCM, aws-lc-rs on nixos: 458.21 µs, 1.62× the fastest +1 MB transfer, AES-128-GCM, aws-lc-rs on desktop: 241.18 µs, 1.38× the fastest +1 MB transfer, AES-128-GCM, aws-lc-rs on nixos2: 442.54 µs, 1.00× the fastest +1 MB transfer, AES-128-GCM, aws-lc-rs on kixtop: 310.78 µs, 1.01× the fastest +1 MB transfer, AES-128-GCM, aws-lc-rs on ovh-iad: 700.77 µs, 1.00× the fastest +1 MB transfer, AES-128-GCM, aws-lc-rs on ovh-sea: 677.99 µs, 1.02× the fastest +1 MB transfer, AES-128-GCM, ring on nixos: 282.22 µs, 1.00× the fastest +1 MB transfer, AES-128-GCM, ring on desktop: 174.96 µs, 1.00× the fastest +1 MB transfer, AES-128-GCM, ring on nixos2: 448.76 µs, 1.02× the fastest +1 MB transfer, AES-128-GCM, ring on kixtop: 372.59 µs, 1.21× the fastest +1 MB transfer, AES-128-GCM, ring on ovh-iad: 716.03 µs, 1.02× the fastest +1 MB transfer, AES-128-GCM, ring on ovh-sea: 670.85 µs, 1.01× the fastest +1 MB transfer, AES-128-GCM, graviola on nixos: 424.38 µs, 1.50× the fastest +1 MB transfer, AES-128-GCM, graviola on desktop: 294.75 µs, 1.68× the fastest +1 MB transfer, AES-128-GCM, graviola on nixos2: 579.09 µs, 1.31× the fastest +1 MB transfer, AES-128-GCM, graviola on kixtop: 327.11 µs, 1.06× the fastest +1 MB transfer, AES-128-GCM, OpenSSL on nixos: 469.84 µs, 1.66× the fastest +1 MB transfer, AES-128-GCM, OpenSSL on desktop: 255.72 µs, 1.46× the fastest +1 MB transfer, AES-128-GCM, OpenSSL on nixos2: 491.38 µs, 1.11× the fastest +1 MB transfer, AES-128-GCM, OpenSSL on kixtop: 338.35 µs, 1.10× the fastest +1 MB transfer, AES-128-GCM, OpenSSL on ovh-iad: 789.03 µs, 1.13× the fastest +1 MB transfer, AES-128-GCM, OpenSSL on ovh-sea: 750.68 µs, 1.13× the fastest 1 MB transfer, AES-256-GCM 1 MB transfer, AES-256-GCM, rind on nixos: 292.74 µs, 1.01× the fastest 1 MB transfer, AES-256-GCM, rind on desktop: 189.84 µs, 1.00× the fastest 1 MB transfer, AES-256-GCM, rind on nixos2: 544.88 µs, 1.00× the fastest -1 MB transfer, AES-256-GCM, rind on ovh-iad: 960.61 µs, 1.07× the fastest -1 MB transfer, AES-256-GCM, rind on ovh-sea: 845.84 µs, 1.02× the fastest -1 MB transfer, AES-256-GCM, aws-lc-rs on nixos: 461.28 µs, 1.59× the fastest -1 MB transfer, AES-256-GCM, aws-lc-rs on desktop: 272.23 µs, 1.43× the fastest -1 MB transfer, AES-256-GCM, aws-lc-rs on nixos2: 557.86 µs, 1.02× the fastest -1 MB transfer, AES-256-GCM, aws-lc-rs on ovh-iad: 905.72 µs, 1.01× the fastest -1 MB transfer, AES-256-GCM, aws-lc-rs on ovh-sea: 857.11 µs, 1.03× the fastest -1 MB transfer, AES-256-GCM, ring on nixos: 289.90 µs, 1.00× the fastest -1 MB transfer, AES-256-GCM, ring on desktop: 192.15 µs, 1.01× the fastest -1 MB transfer, AES-256-GCM, ring on nixos2: 567.27 µs, 1.04× the fastest -1 MB transfer, AES-256-GCM, ring on ovh-iad: 898.87 µs, 1.00× the fastest -1 MB transfer, AES-256-GCM, ring on ovh-sea: 831.86 µs, 1.00× the fastest -1 MB transfer, AES-256-GCM, graviola on nixos: 490.29 µs, 1.69× the fastest -1 MB transfer, AES-256-GCM, graviola on desktop: 338.97 µs, 1.79× the fastest -1 MB transfer, AES-256-GCM, graviola on nixos2: 691.18 µs, 1.27× the fastest -1 MB transfer, AES-256-GCM, OpenSSL on nixos: 533.20 µs, 1.84× the fastest -1 MB transfer, AES-256-GCM, OpenSSL on desktop: 292.12 µs, 1.54× the fastest -1 MB transfer, AES-256-GCM, OpenSSL on nixos2: 596.82 µs, 1.10× the fastest -1 MB transfer, AES-256-GCM, OpenSSL on ovh-iad: 995.68 µs, 1.11× the fastest -1 MB transfer, AES-256-GCM, OpenSSL on ovh-sea: 936.99 µs, 1.13× the fastest +1 MB transfer, AES-256-GCM, rind on kixtop: 343.96 µs, 1.01× the fastest +1 MB transfer, AES-256-GCM, rind on ovh-iad: 960.61 µs, 1.07× the fastest +1 MB transfer, AES-256-GCM, rind on ovh-sea: 845.84 µs, 1.02× the fastest +1 MB transfer, AES-256-GCM, aws-lc-rs on nixos: 461.28 µs, 1.59× the fastest +1 MB transfer, AES-256-GCM, aws-lc-rs on desktop: 272.23 µs, 1.43× the fastest +1 MB transfer, AES-256-GCM, aws-lc-rs on nixos2: 557.86 µs, 1.02× the fastest +1 MB transfer, AES-256-GCM, aws-lc-rs on kixtop: 341.91 µs, 1.00× the fastest +1 MB transfer, AES-256-GCM, aws-lc-rs on ovh-iad: 905.72 µs, 1.01× the fastest +1 MB transfer, AES-256-GCM, aws-lc-rs on ovh-sea: 857.11 µs, 1.03× the fastest +1 MB transfer, AES-256-GCM, ring on nixos: 289.90 µs, 1.00× the fastest +1 MB transfer, AES-256-GCM, ring on desktop: 192.15 µs, 1.01× the fastest +1 MB transfer, AES-256-GCM, ring on nixos2: 567.27 µs, 1.04× the fastest +1 MB transfer, AES-256-GCM, ring on kixtop: 380.26 µs, 1.11× the fastest +1 MB transfer, AES-256-GCM, ring on ovh-iad: 898.87 µs, 1.00× the fastest +1 MB transfer, AES-256-GCM, ring on ovh-sea: 831.86 µs, 1.00× the fastest +1 MB transfer, AES-256-GCM, graviola on nixos: 490.29 µs, 1.69× the fastest +1 MB transfer, AES-256-GCM, graviola on desktop: 338.97 µs, 1.79× the fastest +1 MB transfer, AES-256-GCM, graviola on nixos2: 691.18 µs, 1.27× the fastest +1 MB transfer, AES-256-GCM, graviola on kixtop: 397.41 µs, 1.16× the fastest +1 MB transfer, AES-256-GCM, OpenSSL on nixos: 533.20 µs, 1.84× the fastest +1 MB transfer, AES-256-GCM, OpenSSL on desktop: 292.12 µs, 1.54× the fastest +1 MB transfer, AES-256-GCM, OpenSSL on nixos2: 596.82 µs, 1.10× the fastest +1 MB transfer, AES-256-GCM, OpenSSL on kixtop: 371.49 µs, 1.09× the fastest +1 MB transfer, AES-256-GCM, OpenSSL on ovh-iad: 995.68 µs, 1.11× the fastest +1 MB transfer, AES-256-GCM, OpenSSL on ovh-sea: 936.99 µs, 1.13× the fastest 1 MB transfer, ChaCha20-Poly1305 1 MB transfer, ChaCha20-Poly1305, rind on nixos: 688.78 µs, 1.00× the fastest 1 MB transfer, ChaCha20-Poly1305, rind on desktop: 621.49 µs, 1.04× the fastest 1 MB transfer, ChaCha20-Poly1305, rind on nixos2: 923.82 µs, 1.00× the fastest -1 MB transfer, ChaCha20-Poly1305, rind on ovh-iad: 1.47 ms, 1.00× the fastest -1 MB transfer, ChaCha20-Poly1305, rind on ovh-sea: 1.44 ms, 1.00× the fastest -1 MB transfer, ChaCha20-Poly1305, aws-lc-rs on nixos: 687.53 µs, 1.00× the fastest -1 MB transfer, ChaCha20-Poly1305, aws-lc-rs on desktop: 609.72 µs, 1.02× the fastest -1 MB transfer, ChaCha20-Poly1305, aws-lc-rs on nixos2: 928.09 µs, 1.00× the fastest -1 MB transfer, ChaCha20-Poly1305, aws-lc-rs on ovh-iad: 1.52 ms, 1.03× the fastest -1 MB transfer, ChaCha20-Poly1305, aws-lc-rs on ovh-sea: 1.43 ms, 1.00× the fastest -1 MB transfer, ChaCha20-Poly1305, ring on nixos: 693.01 µs, 1.01× the fastest -1 MB transfer, ChaCha20-Poly1305, ring on desktop: 594.88 µs, 1.00× the fastest -1 MB transfer, ChaCha20-Poly1305, ring on nixos2: 925.14 µs, 1.00× the fastest -1 MB transfer, ChaCha20-Poly1305, ring on ovh-iad: 1.53 ms, 1.04× the fastest -1 MB transfer, ChaCha20-Poly1305, ring on ovh-sea: 1.45 ms, 1.01× the fastest -1 MB transfer, ChaCha20-Poly1305, graviola on nixos: 1.37 ms, 2.00× the fastest -1 MB transfer, ChaCha20-Poly1305, graviola on desktop: 1.17 ms, 1.97× the fastest -1 MB transfer, ChaCha20-Poly1305, graviola on nixos2: 1.64 ms, 1.78× the fastest -1 MB transfer, ChaCha20-Poly1305, OpenSSL on nixos: 782.98 µs, 1.14× the fastest -1 MB transfer, ChaCha20-Poly1305, OpenSSL on desktop: 661.80 µs, 1.11× the fastest -1 MB transfer, ChaCha20-Poly1305, OpenSSL on nixos2: 983.97 µs, 1.07× the fastest -1 MB transfer, ChaCha20-Poly1305, OpenSSL on ovh-iad: 1.77 ms, 1.20× the fastest -1 MB transfer, ChaCha20-Poly1305, OpenSSL on ovh-sea: 1.71 ms, 1.19× the fastest +1 MB transfer, ChaCha20-Poly1305, rind on kixtop: 1.12 ms, 1.01× the fastest +1 MB transfer, ChaCha20-Poly1305, rind on ovh-iad: 1.47 ms, 1.00× the fastest +1 MB transfer, ChaCha20-Poly1305, rind on ovh-sea: 1.44 ms, 1.00× the fastest +1 MB transfer, ChaCha20-Poly1305, aws-lc-rs on nixos: 687.53 µs, 1.00× the fastest +1 MB transfer, ChaCha20-Poly1305, aws-lc-rs on desktop: 609.72 µs, 1.02× the fastest +1 MB transfer, ChaCha20-Poly1305, aws-lc-rs on nixos2: 928.09 µs, 1.00× the fastest +1 MB transfer, ChaCha20-Poly1305, aws-lc-rs on kixtop: 1.12 ms, 1.01× the fastest +1 MB transfer, ChaCha20-Poly1305, aws-lc-rs on ovh-iad: 1.52 ms, 1.03× the fastest +1 MB transfer, ChaCha20-Poly1305, aws-lc-rs on ovh-sea: 1.43 ms, 1.00× the fastest +1 MB transfer, ChaCha20-Poly1305, ring on nixos: 693.01 µs, 1.01× the fastest +1 MB transfer, ChaCha20-Poly1305, ring on desktop: 594.88 µs, 1.00× the fastest +1 MB transfer, ChaCha20-Poly1305, ring on nixos2: 925.14 µs, 1.00× the fastest +1 MB transfer, ChaCha20-Poly1305, ring on kixtop: 1.11 ms, 1.01× the fastest +1 MB transfer, ChaCha20-Poly1305, ring on ovh-iad: 1.53 ms, 1.04× the fastest +1 MB transfer, ChaCha20-Poly1305, ring on ovh-sea: 1.45 ms, 1.01× the fastest +1 MB transfer, ChaCha20-Poly1305, graviola on nixos: 1.37 ms, 2.00× the fastest +1 MB transfer, ChaCha20-Poly1305, graviola on desktop: 1.17 ms, 1.97× the fastest +1 MB transfer, ChaCha20-Poly1305, graviola on nixos2: 1.64 ms, 1.78× the fastest +1 MB transfer, ChaCha20-Poly1305, graviola on kixtop: 1.79 ms, 1.62× the fastest +1 MB transfer, ChaCha20-Poly1305, OpenSSL on nixos: 782.98 µs, 1.14× the fastest +1 MB transfer, ChaCha20-Poly1305, OpenSSL on desktop: 661.80 µs, 1.11× the fastest +1 MB transfer, ChaCha20-Poly1305, OpenSSL on nixos2: 983.97 µs, 1.07× the fastest +1 MB transfer, ChaCha20-Poly1305, OpenSSL on kixtop: 1.11 ms, 1.00× the fastest +1 MB transfer, ChaCha20-Poly1305, OpenSSL on ovh-iad: 1.77 ms, 1.20× the fastest +1 MB transfer, ChaCha20-Poly1305, OpenSSL on ovh-sea: 1.71 ms, 1.19× the fastest AEADs - + AES-128-GCM seal, 32 B AES-128-GCM seal, 32 B, rind on nixos: 39 ns, 1.00× the fastest AES-128-GCM seal, 32 B, rind on desktop: 18 ns, 1.00× the fastest AES-128-GCM seal, 32 B, rind on nixos2: 43 ns, 1.00× the fastest; verified: rind's Lean proof, through Aeneas and hand models of the function-pointer dispatch, of the AES-NI key expansion and block cipher's raw-pointer loads, and of the SIMD intrinsics as Intel's manual defines them, of its AEAD API's AES-GCM key setup, seal, and open, for AAD and messages under 2^32 bytes, down to HACL*'s Vale AES-GCM routines, composed with Vale's F* proofs of Gcm_blocks_stdcall, Gcm_blocks_decrypt_stdcall, and Compute_iv_stdcall, of the code Vale prints at HACL* f557259007db, which rind imports ✓ -AES-128-GCM seal, 32 B, rind on ovh-iad: 69 ns, 1.00× the fastest; verified: rind's Lean proof, through Aeneas and hand models of the function-pointer dispatch, of the AES-NI key expansion and block cipher's raw-pointer loads, and of the SIMD intrinsics as Intel's manual defines them, of its AEAD API's AES-GCM key setup, seal, and open, for AAD and messages under 2^32 bytes, down to HACL*'s Vale AES-GCM routines, composed with Vale's F* proofs of Gcm_blocks_stdcall, Gcm_blocks_decrypt_stdcall, and Compute_iv_stdcall, of the code Vale prints at HACL* f557259007db, which rind imports -✓ -AES-128-GCM seal, 32 B, rind on ovh-sea: 68 ns, 1.00× the fastest; verified: rind's Lean proof, through Aeneas and hand models of the function-pointer dispatch, of the AES-NI key expansion and block cipher's raw-pointer loads, and of the SIMD intrinsics as Intel's manual defines them, of its AEAD API's AES-GCM key setup, seal, and open, for AAD and messages under 2^32 bytes, down to HACL*'s Vale AES-GCM routines, composed with Vale's F* proofs of Gcm_blocks_stdcall, Gcm_blocks_decrypt_stdcall, and Compute_iv_stdcall, of the code Vale prints at HACL* f557259007db, which rind imports +AES-128-GCM seal, 32 B, rind on kixtop: 57 ns, 2.40× the fastest +AES-128-GCM seal, 32 B, rind on ovh-iad: 69 ns, 1.00× the fastest; verified: rind's Lean proof, through Aeneas and hand models of the function-pointer dispatch, of the AES-NI key expansion and block cipher's raw-pointer loads, and of the SIMD intrinsics as Intel's manual defines them, of its AEAD API's AES-GCM key setup, seal, and open, for AAD and messages under 2^32 bytes, down to HACL*'s Vale AES-GCM routines, composed with Vale's F* proofs of Gcm_blocks_stdcall, Gcm_blocks_decrypt_stdcall, and Compute_iv_stdcall, of the code Vale prints at HACL* f557259007db, which rind imports ✓ -AES-128-GCM seal, 32 B, aws-lc-rs on nixos: 78 ns, 2.02× the fastest -AES-128-GCM seal, 32 B, aws-lc-rs on desktop: 37 ns, 2.03× the fastest -AES-128-GCM seal, 32 B, aws-lc-rs on nixos2: 89 ns, 2.06× the fastest -AES-128-GCM seal, 32 B, aws-lc-rs on ovh-iad: 139 ns, 2.02× the fastest -AES-128-GCM seal, 32 B, aws-lc-rs on ovh-sea: 137 ns, 2.01× the fastest -AES-128-GCM seal, 32 B, ring on nixos: 56 ns, 1.45× the fastest -AES-128-GCM seal, 32 B, ring on desktop: 42 ns, 2.30× the fastest -AES-128-GCM seal, 32 B, ring on nixos2: 71 ns, 1.64× the fastest -AES-128-GCM seal, 32 B, ring on ovh-iad: 111 ns, 1.60× the fastest -AES-128-GCM seal, 32 B, ring on ovh-sea: 109 ns, 1.60× the fastest -AES-128-GCM seal, 32 B, RustCrypto + dalek on nixos: 97 ns, 2.50× the fastest -AES-128-GCM seal, 32 B, RustCrypto + dalek on desktop: 73 ns, 3.98× the fastest -AES-128-GCM seal, 32 B, RustCrypto + dalek on nixos2: 100 ns, 2.33× the fastest -AES-128-GCM seal, 32 B, RustCrypto + dalek on ovh-iad: 158 ns, 2.28× the fastest -AES-128-GCM seal, 32 B, RustCrypto + dalek on ovh-sea: 155 ns, 2.27× the fastest -AES-128-GCM seal, 32 B, graviola on nixos: 70 ns, 1.80× the fastest -AES-128-GCM seal, 32 B, graviola on desktop: 42 ns, 2.33× the fastest -AES-128-GCM seal, 32 B, graviola on nixos2: 71 ns, 1.65× the fastest -AES-128-GCM seal, 32 B, libcrux on nixos: 321 ns, 8.29× the fastest -AES-128-GCM seal, 32 B, libcrux on desktop: 168 ns, 9.19× the fastest -AES-128-GCM seal, 32 B, libcrux on nixos2: 282 ns, 6.52× the fastest -AES-128-GCM seal, 32 B, libcrux on ovh-iad: 454 ns, 6.58× the fastest -AES-128-GCM seal, 32 B, libcrux on ovh-sea: 438 ns, 6.42× the fastest -AES-128-GCM seal, 32 B, OpenSSL on nixos: 115 ns, 2.97× the fastest -AES-128-GCM seal, 32 B, OpenSSL on desktop: 55 ns, 3.02× the fastest -AES-128-GCM seal, 32 B, OpenSSL on nixos2: 156 ns, 3.62× the fastest -AES-128-GCM seal, 32 B, OpenSSL on ovh-iad: 268 ns, 3.89× the fastest -AES-128-GCM seal, 32 B, OpenSSL on ovh-sea: 235 ns, 3.46× the fastest +AES-128-GCM seal, 32 B, rind on ovh-sea: 68 ns, 1.00× the fastest; verified: rind's Lean proof, through Aeneas and hand models of the function-pointer dispatch, of the AES-NI key expansion and block cipher's raw-pointer loads, and of the SIMD intrinsics as Intel's manual defines them, of its AEAD API's AES-GCM key setup, seal, and open, for AAD and messages under 2^32 bytes, down to HACL*'s Vale AES-GCM routines, composed with Vale's F* proofs of Gcm_blocks_stdcall, Gcm_blocks_decrypt_stdcall, and Compute_iv_stdcall, of the code Vale prints at HACL* f557259007db, which rind imports +✓ +AES-128-GCM seal, 32 B, aws-lc-rs on nixos: 78 ns, 2.02× the fastest +AES-128-GCM seal, 32 B, aws-lc-rs on desktop: 37 ns, 2.03× the fastest +AES-128-GCM seal, 32 B, aws-lc-rs on nixos2: 89 ns, 2.06× the fastest +AES-128-GCM seal, 32 B, aws-lc-rs on kixtop: 50 ns, 2.10× the fastest +AES-128-GCM seal, 32 B, aws-lc-rs on ovh-iad: 139 ns, 2.02× the fastest +AES-128-GCM seal, 32 B, aws-lc-rs on ovh-sea: 137 ns, 2.01× the fastest +AES-128-GCM seal, 32 B, ring on nixos: 56 ns, 1.45× the fastest +AES-128-GCM seal, 32 B, ring on desktop: 42 ns, 2.30× the fastest +AES-128-GCM seal, 32 B, ring on nixos2: 71 ns, 1.64× the fastest +AES-128-GCM seal, 32 B, ring on kixtop: 42 ns, 1.77× the fastest +AES-128-GCM seal, 32 B, ring on ovh-iad: 111 ns, 1.60× the fastest +AES-128-GCM seal, 32 B, ring on ovh-sea: 109 ns, 1.60× the fastest +AES-128-GCM seal, 32 B, RustCrypto + dalek on nixos: 97 ns, 2.50× the fastest +AES-128-GCM seal, 32 B, RustCrypto + dalek on desktop: 73 ns, 3.98× the fastest +AES-128-GCM seal, 32 B, RustCrypto + dalek on nixos2: 100 ns, 2.33× the fastest +AES-128-GCM seal, 32 B, RustCrypto + dalek on kixtop: 24 ns, 1.00× the fastest +AES-128-GCM seal, 32 B, RustCrypto + dalek on ovh-iad: 158 ns, 2.28× the fastest +AES-128-GCM seal, 32 B, RustCrypto + dalek on ovh-sea: 155 ns, 2.27× the fastest +AES-128-GCM seal, 32 B, graviola on nixos: 70 ns, 1.80× the fastest +AES-128-GCM seal, 32 B, graviola on desktop: 42 ns, 2.33× the fastest +AES-128-GCM seal, 32 B, graviola on nixos2: 71 ns, 1.65× the fastest +AES-128-GCM seal, 32 B, graviola on kixtop: 80 ns, 3.37× the fastest +AES-128-GCM seal, 32 B, libcrux on nixos: 321 ns, 8.29× the fastest +AES-128-GCM seal, 32 B, libcrux on desktop: 168 ns, 9.19× the fastest +AES-128-GCM seal, 32 B, libcrux on nixos2: 282 ns, 6.52× the fastest +AES-128-GCM seal, 32 B, libcrux on kixtop: 53 ns, 2.23× the fastest +AES-128-GCM seal, 32 B, libcrux on ovh-iad: 454 ns, 6.58× the fastest +AES-128-GCM seal, 32 B, libcrux on ovh-sea: 438 ns, 6.42× the fastest +AES-128-GCM seal, 32 B, OpenSSL on nixos: 115 ns, 2.97× the fastest +AES-128-GCM seal, 32 B, OpenSSL on desktop: 55 ns, 3.02× the fastest +AES-128-GCM seal, 32 B, OpenSSL on nixos2: 156 ns, 3.62× the fastest +AES-128-GCM seal, 32 B, OpenSSL on kixtop: 69 ns, 2.91× the fastest +AES-128-GCM seal, 32 B, OpenSSL on ovh-iad: 268 ns, 3.89× the fastest +AES-128-GCM seal, 32 B, OpenSSL on ovh-sea: 235 ns, 3.46× the fastest AES-128-GCM seal, 1350 B AES-128-GCM seal, 1350 B, rind on nixos: 165 ns, 1.00× the fastest AES-128-GCM seal, 1350 B, rind on desktop: 94 ns, 1.00× the fastest AES-128-GCM seal, 1350 B, rind on nixos2: 246 ns, 1.00× the fastest; verified: rind's Lean proof, through Aeneas and hand models of the function-pointer dispatch, of the AES-NI key expansion and block cipher's raw-pointer loads, and of the SIMD intrinsics as Intel's manual defines them, of its AEAD API's AES-GCM key setup, seal, and open, for AAD and messages under 2^32 bytes, down to HACL*'s Vale AES-GCM routines, composed with Vale's F* proofs of Gcm_blocks_stdcall, Gcm_blocks_decrypt_stdcall, and Compute_iv_stdcall, of the code Vale prints at HACL* f557259007db, which rind imports ✓ -AES-128-GCM seal, 1350 B, rind on ovh-iad: 398 ns, 1.00× the fastest; verified: rind's Lean proof, through Aeneas and hand models of the function-pointer dispatch, of the AES-NI key expansion and block cipher's raw-pointer loads, and of the SIMD intrinsics as Intel's manual defines them, of its AEAD API's AES-GCM key setup, seal, and open, for AAD and messages under 2^32 bytes, down to HACL*'s Vale AES-GCM routines, composed with Vale's F* proofs of Gcm_blocks_stdcall, Gcm_blocks_decrypt_stdcall, and Compute_iv_stdcall, of the code Vale prints at HACL* f557259007db, which rind imports -✓ -AES-128-GCM seal, 1350 B, rind on ovh-sea: 380 ns, 1.00× the fastest; verified: rind's Lean proof, through Aeneas and hand models of the function-pointer dispatch, of the AES-NI key expansion and block cipher's raw-pointer loads, and of the SIMD intrinsics as Intel's manual defines them, of its AEAD API's AES-GCM key setup, seal, and open, for AAD and messages under 2^32 bytes, down to HACL*'s Vale AES-GCM routines, composed with Vale's F* proofs of Gcm_blocks_stdcall, Gcm_blocks_decrypt_stdcall, and Compute_iv_stdcall, of the code Vale prints at HACL* f557259007db, which rind imports +AES-128-GCM seal, 1350 B, rind on kixtop: 212 ns, 1.18× the fastest +AES-128-GCM seal, 1350 B, rind on ovh-iad: 398 ns, 1.00× the fastest; verified: rind's Lean proof, through Aeneas and hand models of the function-pointer dispatch, of the AES-NI key expansion and block cipher's raw-pointer loads, and of the SIMD intrinsics as Intel's manual defines them, of its AEAD API's AES-GCM key setup, seal, and open, for AAD and messages under 2^32 bytes, down to HACL*'s Vale AES-GCM routines, composed with Vale's F* proofs of Gcm_blocks_stdcall, Gcm_blocks_decrypt_stdcall, and Compute_iv_stdcall, of the code Vale prints at HACL* f557259007db, which rind imports ✓ -AES-128-GCM seal, 1350 B, aws-lc-rs on nixos: 291 ns, 1.77× the fastest -AES-128-GCM seal, 1350 B, aws-lc-rs on desktop: 149 ns, 1.59× the fastest -AES-128-GCM seal, 1350 B, aws-lc-rs on nixos2: 285 ns, 1.16× the fastest -AES-128-GCM seal, 1350 B, aws-lc-rs on ovh-iad: 460 ns, 1.15× the fastest -AES-128-GCM seal, 1350 B, aws-lc-rs on ovh-sea: 439 ns, 1.15× the fastest -AES-128-GCM seal, 1350 B, ring on nixos: 191 ns, 1.16× the fastest -AES-128-GCM seal, 1350 B, ring on desktop: 118 ns, 1.26× the fastest -AES-128-GCM seal, 1350 B, ring on nixos2: 277 ns, 1.13× the fastest -AES-128-GCM seal, 1350 B, ring on ovh-iad: 475 ns, 1.19× the fastest -AES-128-GCM seal, 1350 B, ring on ovh-sea: 438 ns, 1.15× the fastest -AES-128-GCM seal, 1350 B, RustCrypto + dalek on nixos: 434 ns, 2.63× the fastest -AES-128-GCM seal, 1350 B, RustCrypto + dalek on desktop: 272 ns, 2.90× the fastest -AES-128-GCM seal, 1350 B, RustCrypto + dalek on nixos2: 547 ns, 2.22× the fastest -AES-128-GCM seal, 1350 B, RustCrypto + dalek on ovh-iad: 871 ns, 2.19× the fastest -AES-128-GCM seal, 1350 B, RustCrypto + dalek on ovh-sea: 846 ns, 2.23× the fastest -AES-128-GCM seal, 1350 B, graviola on nixos: 295 ns, 1.79× the fastest -AES-128-GCM seal, 1350 B, graviola on desktop: 227 ns, 2.42× the fastest -AES-128-GCM seal, 1350 B, graviola on nixos2: 400 ns, 1.63× the fastest -AES-128-GCM seal, 1350 B, libcrux on nixos: 4.72 µs, 28.63× the fastest -AES-128-GCM seal, 1350 B, libcrux on desktop: 1.94 µs, 20.74× the fastest -AES-128-GCM seal, 1350 B, libcrux on nixos2: 3.49 µs, 14.19× the fastest -AES-128-GCM seal, 1350 B, libcrux on ovh-iad: 5.46 µs, 13.70× the fastest -AES-128-GCM seal, 1350 B, libcrux on ovh-sea: 5.29 µs, 13.92× the fastest -AES-128-GCM seal, 1350 B, OpenSSL on nixos: 326 ns, 1.98× the fastest -AES-128-GCM seal, 1350 B, OpenSSL on desktop: 163 ns, 1.74× the fastest -AES-128-GCM seal, 1350 B, OpenSSL on nixos2: 352 ns, 1.43× the fastest -AES-128-GCM seal, 1350 B, OpenSSL on ovh-iad: 561 ns, 1.41× the fastest -AES-128-GCM seal, 1350 B, OpenSSL on ovh-sea: 534 ns, 1.41× the fastest +AES-128-GCM seal, 1350 B, rind on ovh-sea: 380 ns, 1.00× the fastest; verified: rind's Lean proof, through Aeneas and hand models of the function-pointer dispatch, of the AES-NI key expansion and block cipher's raw-pointer loads, and of the SIMD intrinsics as Intel's manual defines them, of its AEAD API's AES-GCM key setup, seal, and open, for AAD and messages under 2^32 bytes, down to HACL*'s Vale AES-GCM routines, composed with Vale's F* proofs of Gcm_blocks_stdcall, Gcm_blocks_decrypt_stdcall, and Compute_iv_stdcall, of the code Vale prints at HACL* f557259007db, which rind imports +✓ +AES-128-GCM seal, 1350 B, aws-lc-rs on nixos: 291 ns, 1.77× the fastest +AES-128-GCM seal, 1350 B, aws-lc-rs on desktop: 149 ns, 1.59× the fastest +AES-128-GCM seal, 1350 B, aws-lc-rs on nixos2: 285 ns, 1.16× the fastest +AES-128-GCM seal, 1350 B, aws-lc-rs on kixtop: 180 ns, 1.00× the fastest +AES-128-GCM seal, 1350 B, aws-lc-rs on ovh-iad: 460 ns, 1.15× the fastest +AES-128-GCM seal, 1350 B, aws-lc-rs on ovh-sea: 439 ns, 1.15× the fastest +AES-128-GCM seal, 1350 B, ring on nixos: 191 ns, 1.16× the fastest +AES-128-GCM seal, 1350 B, ring on desktop: 118 ns, 1.26× the fastest +AES-128-GCM seal, 1350 B, ring on nixos2: 277 ns, 1.13× the fastest +AES-128-GCM seal, 1350 B, ring on kixtop: 212 ns, 1.18× the fastest +AES-128-GCM seal, 1350 B, ring on ovh-iad: 475 ns, 1.19× the fastest +AES-128-GCM seal, 1350 B, ring on ovh-sea: 438 ns, 1.15× the fastest +AES-128-GCM seal, 1350 B, RustCrypto + dalek on nixos: 434 ns, 2.63× the fastest +AES-128-GCM seal, 1350 B, RustCrypto + dalek on desktop: 272 ns, 2.90× the fastest +AES-128-GCM seal, 1350 B, RustCrypto + dalek on nixos2: 547 ns, 2.22× the fastest +AES-128-GCM seal, 1350 B, RustCrypto + dalek on kixtop: 213 ns, 1.18× the fastest +AES-128-GCM seal, 1350 B, RustCrypto + dalek on ovh-iad: 871 ns, 2.19× the fastest +AES-128-GCM seal, 1350 B, RustCrypto + dalek on ovh-sea: 846 ns, 2.23× the fastest +AES-128-GCM seal, 1350 B, graviola on nixos: 295 ns, 1.79× the fastest +AES-128-GCM seal, 1350 B, graviola on desktop: 227 ns, 2.42× the fastest +AES-128-GCM seal, 1350 B, graviola on nixos2: 400 ns, 1.63× the fastest +AES-128-GCM seal, 1350 B, graviola on kixtop: 215 ns, 1.20× the fastest +AES-128-GCM seal, 1350 B, libcrux on nixos: 4.72 µs, 28.63× the fastest +AES-128-GCM seal, 1350 B, libcrux on desktop: 1.94 µs, 20.74× the fastest +AES-128-GCM seal, 1350 B, libcrux on nixos2: 3.49 µs, 14.19× the fastest +AES-128-GCM seal, 1350 B, libcrux on kixtop: 619 ns, 3.44× the fastest +AES-128-GCM seal, 1350 B, libcrux on ovh-iad: 5.46 µs, 13.70× the fastest +AES-128-GCM seal, 1350 B, libcrux on ovh-sea: 5.29 µs, 13.92× the fastest +AES-128-GCM seal, 1350 B, OpenSSL on nixos: 326 ns, 1.98× the fastest +AES-128-GCM seal, 1350 B, OpenSSL on desktop: 163 ns, 1.74× the fastest +AES-128-GCM seal, 1350 B, OpenSSL on nixos2: 352 ns, 1.43× the fastest +AES-128-GCM seal, 1350 B, OpenSSL on kixtop: 197 ns, 1.09× the fastest +AES-128-GCM seal, 1350 B, OpenSSL on ovh-iad: 561 ns, 1.41× the fastest +AES-128-GCM seal, 1350 B, OpenSSL on ovh-sea: 534 ns, 1.41× the fastest AES-128-GCM seal, 16 KB AES-128-GCM seal, 16 KB, rind on nixos: 1.38 µs, 1.00× the fastest AES-128-GCM seal, 16 KB, rind on desktop: 781 ns, 1.00× the fastest AES-128-GCM seal, 16 KB, rind on nixos2: 2.33 µs, 1.00× the fastest; verified: rind's Lean proof, through Aeneas and hand models of the function-pointer dispatch, of the AES-NI key expansion and block cipher's raw-pointer loads, and of the SIMD intrinsics as Intel's manual defines them, of its AEAD API's AES-GCM key setup, seal, and open, for AAD and messages under 2^32 bytes, down to HACL*'s Vale AES-GCM routines, composed with Vale's F* proofs of Gcm_blocks_stdcall, Gcm_blocks_decrypt_stdcall, and Compute_iv_stdcall, of the code Vale prints at HACL* f557259007db, which rind imports ✓ -AES-128-GCM seal, 16 KB, rind on ovh-iad: 3.83 µs, 1.01× the fastest; verified: rind's Lean proof, through Aeneas and hand models of the function-pointer dispatch, of the AES-NI key expansion and block cipher's raw-pointer loads, and of the SIMD intrinsics as Intel's manual defines them, of its AEAD API's AES-GCM key setup, seal, and open, for AAD and messages under 2^32 bytes, down to HACL*'s Vale AES-GCM routines, composed with Vale's F* proofs of Gcm_blocks_stdcall, Gcm_blocks_decrypt_stdcall, and Compute_iv_stdcall, of the code Vale prints at HACL* f557259007db, which rind imports -✓ -AES-128-GCM seal, 16 KB, rind on ovh-sea: 3.67 µs, 1.02× the fastest; verified: rind's Lean proof, through Aeneas and hand models of the function-pointer dispatch, of the AES-NI key expansion and block cipher's raw-pointer loads, and of the SIMD intrinsics as Intel's manual defines them, of its AEAD API's AES-GCM key setup, seal, and open, for AAD and messages under 2^32 bytes, down to HACL*'s Vale AES-GCM routines, composed with Vale's F* proofs of Gcm_blocks_stdcall, Gcm_blocks_decrypt_stdcall, and Compute_iv_stdcall, of the code Vale prints at HACL* f557259007db, which rind imports +AES-128-GCM seal, 16 KB, rind on kixtop: 1.49 µs, 1.03× the fastest +AES-128-GCM seal, 16 KB, rind on ovh-iad: 3.83 µs, 1.01× the fastest; verified: rind's Lean proof, through Aeneas and hand models of the function-pointer dispatch, of the AES-NI key expansion and block cipher's raw-pointer loads, and of the SIMD intrinsics as Intel's manual defines them, of its AEAD API's AES-GCM key setup, seal, and open, for AAD and messages under 2^32 bytes, down to HACL*'s Vale AES-GCM routines, composed with Vale's F* proofs of Gcm_blocks_stdcall, Gcm_blocks_decrypt_stdcall, and Compute_iv_stdcall, of the code Vale prints at HACL* f557259007db, which rind imports ✓ -AES-128-GCM seal, 16 KB, aws-lc-rs on nixos: 2.63 µs, 1.91× the fastest -AES-128-GCM seal, 16 KB, aws-lc-rs on desktop: 1.33 µs, 1.70× the fastest -AES-128-GCM seal, 16 KB, aws-lc-rs on nixos2: 2.42 µs, 1.04× the fastest -AES-128-GCM seal, 16 KB, aws-lc-rs on ovh-iad: 3.79 µs, 1.00× the fastest -AES-128-GCM seal, 16 KB, aws-lc-rs on ovh-sea: 3.70 µs, 1.02× the fastest -AES-128-GCM seal, 16 KB, ring on nixos: 1.39 µs, 1.01× the fastest -AES-128-GCM seal, 16 KB, ring on desktop: 799 ns, 1.02× the fastest -AES-128-GCM seal, 16 KB, ring on nixos2: 2.38 µs, 1.02× the fastest -AES-128-GCM seal, 16 KB, ring on ovh-iad: 3.89 µs, 1.03× the fastest -AES-128-GCM seal, 16 KB, ring on ovh-sea: 3.61 µs, 1.00× the fastest -AES-128-GCM seal, 16 KB, RustCrypto + dalek on nixos: 4.28 µs, 3.10× the fastest -AES-128-GCM seal, 16 KB, RustCrypto + dalek on desktop: 2.49 µs, 3.19× the fastest -AES-128-GCM seal, 16 KB, RustCrypto + dalek on nixos2: 5.62 µs, 2.41× the fastest -AES-128-GCM seal, 16 KB, RustCrypto + dalek on ovh-iad: 8.86 µs, 2.34× the fastest -AES-128-GCM seal, 16 KB, RustCrypto + dalek on ovh-sea: 8.62 µs, 2.39× the fastest -AES-128-GCM seal, 16 KB, graviola on nixos: 2.57 µs, 1.86× the fastest -AES-128-GCM seal, 16 KB, graviola on desktop: 2.02 µs, 2.59× the fastest -AES-128-GCM seal, 16 KB, graviola on nixos2: 3.75 µs, 1.61× the fastest -AES-128-GCM seal, 16 KB, libcrux on nixos: 53.90 µs, 39.11× the fastest -AES-128-GCM seal, 16 KB, libcrux on desktop: 22.02 µs, 28.20× the fastest -AES-128-GCM seal, 16 KB, libcrux on nixos2: 39.94 µs, 17.11× the fastest -AES-128-GCM seal, 16 KB, libcrux on ovh-iad: 61.68 µs, 16.28× the fastest -AES-128-GCM seal, 16 KB, libcrux on ovh-sea: 60.59 µs, 16.80× the fastest -AES-128-GCM seal, 16 KB, OpenSSL on nixos: 2.61 µs, 1.89× the fastest -AES-128-GCM seal, 16 KB, OpenSSL on desktop: 1.34 µs, 1.72× the fastest -AES-128-GCM seal, 16 KB, OpenSSL on nixos2: 2.45 µs, 1.05× the fastest -AES-128-GCM seal, 16 KB, OpenSSL on ovh-iad: 4.17 µs, 1.10× the fastest -AES-128-GCM seal, 16 KB, OpenSSL on ovh-sea: 3.84 µs, 1.06× the fastest +AES-128-GCM seal, 16 KB, rind on ovh-sea: 3.67 µs, 1.02× the fastest; verified: rind's Lean proof, through Aeneas and hand models of the function-pointer dispatch, of the AES-NI key expansion and block cipher's raw-pointer loads, and of the SIMD intrinsics as Intel's manual defines them, of its AEAD API's AES-GCM key setup, seal, and open, for AAD and messages under 2^32 bytes, down to HACL*'s Vale AES-GCM routines, composed with Vale's F* proofs of Gcm_blocks_stdcall, Gcm_blocks_decrypt_stdcall, and Compute_iv_stdcall, of the code Vale prints at HACL* f557259007db, which rind imports +✓ +AES-128-GCM seal, 16 KB, aws-lc-rs on nixos: 2.63 µs, 1.91× the fastest +AES-128-GCM seal, 16 KB, aws-lc-rs on desktop: 1.33 µs, 1.70× the fastest +AES-128-GCM seal, 16 KB, aws-lc-rs on nixos2: 2.42 µs, 1.04× the fastest +AES-128-GCM seal, 16 KB, aws-lc-rs on kixtop: 1.45 µs, 1.00× the fastest +AES-128-GCM seal, 16 KB, aws-lc-rs on ovh-iad: 3.79 µs, 1.00× the fastest +AES-128-GCM seal, 16 KB, aws-lc-rs on ovh-sea: 3.70 µs, 1.02× the fastest +AES-128-GCM seal, 16 KB, ring on nixos: 1.39 µs, 1.01× the fastest +AES-128-GCM seal, 16 KB, ring on desktop: 799 ns, 1.02× the fastest +AES-128-GCM seal, 16 KB, ring on nixos2: 2.38 µs, 1.02× the fastest +AES-128-GCM seal, 16 KB, ring on kixtop: 1.97 µs, 1.35× the fastest +AES-128-GCM seal, 16 KB, ring on ovh-iad: 3.89 µs, 1.03× the fastest +AES-128-GCM seal, 16 KB, ring on ovh-sea: 3.61 µs, 1.00× the fastest +AES-128-GCM seal, 16 KB, RustCrypto + dalek on nixos: 4.28 µs, 3.10× the fastest +AES-128-GCM seal, 16 KB, RustCrypto + dalek on desktop: 2.49 µs, 3.19× the fastest +AES-128-GCM seal, 16 KB, RustCrypto + dalek on nixos2: 5.62 µs, 2.41× the fastest +AES-128-GCM seal, 16 KB, RustCrypto + dalek on kixtop: 2.36 µs, 1.62× the fastest +AES-128-GCM seal, 16 KB, RustCrypto + dalek on ovh-iad: 8.86 µs, 2.34× the fastest +AES-128-GCM seal, 16 KB, RustCrypto + dalek on ovh-sea: 8.62 µs, 2.39× the fastest +AES-128-GCM seal, 16 KB, graviola on nixos: 2.57 µs, 1.86× the fastest +AES-128-GCM seal, 16 KB, graviola on desktop: 2.02 µs, 2.59× the fastest +AES-128-GCM seal, 16 KB, graviola on nixos2: 3.75 µs, 1.61× the fastest +AES-128-GCM seal, 16 KB, graviola on kixtop: 1.60 µs, 1.10× the fastest +AES-128-GCM seal, 16 KB, libcrux on nixos: 53.90 µs, 39.11× the fastest +AES-128-GCM seal, 16 KB, libcrux on desktop: 22.02 µs, 28.20× the fastest +AES-128-GCM seal, 16 KB, libcrux on nixos2: 39.94 µs, 17.11× the fastest +AES-128-GCM seal, 16 KB, libcrux on kixtop: 7.15 µs, 4.92× the fastest +AES-128-GCM seal, 16 KB, libcrux on ovh-iad: 61.68 µs, 16.28× the fastest +AES-128-GCM seal, 16 KB, libcrux on ovh-sea: 60.59 µs, 16.80× the fastest +AES-128-GCM seal, 16 KB, OpenSSL on nixos: 2.61 µs, 1.89× the fastest +AES-128-GCM seal, 16 KB, OpenSSL on desktop: 1.34 µs, 1.72× the fastest +AES-128-GCM seal, 16 KB, OpenSSL on nixos2: 2.45 µs, 1.05× the fastest +AES-128-GCM seal, 16 KB, OpenSSL on kixtop: 1.52 µs, 1.04× the fastest +AES-128-GCM seal, 16 KB, OpenSSL on ovh-iad: 4.17 µs, 1.10× the fastest +AES-128-GCM seal, 16 KB, OpenSSL on ovh-sea: 3.84 µs, 1.06× the fastest AES-128-GCM open, 32 B AES-128-GCM open, 32 B, rind on nixos: 44 ns, 1.00× the fastest AES-128-GCM open, 32 B, rind on desktop: 28 ns, 1.00× the fastest AES-128-GCM open, 32 B, rind on nixos2: 38 ns, 1.00× the fastest; verified: rind's Lean proof, through Aeneas and hand models of the function-pointer dispatch, of the AES-NI key expansion and block cipher's raw-pointer loads, and of the SIMD intrinsics as Intel's manual defines them, of its AEAD API's AES-GCM key setup, seal, and open, for AAD and messages under 2^32 bytes, down to HACL*'s Vale AES-GCM routines, composed with Vale's F* proofs of Gcm_blocks_stdcall, Gcm_blocks_decrypt_stdcall, and Compute_iv_stdcall, of the code Vale prints at HACL* f557259007db, which rind imports ✓ -AES-128-GCM open, 32 B, rind on ovh-iad: 62 ns, 1.00× the fastest; verified: rind's Lean proof, through Aeneas and hand models of the function-pointer dispatch, of the AES-NI key expansion and block cipher's raw-pointer loads, and of the SIMD intrinsics as Intel's manual defines them, of its AEAD API's AES-GCM key setup, seal, and open, for AAD and messages under 2^32 bytes, down to HACL*'s Vale AES-GCM routines, composed with Vale's F* proofs of Gcm_blocks_stdcall, Gcm_blocks_decrypt_stdcall, and Compute_iv_stdcall, of the code Vale prints at HACL* f557259007db, which rind imports -✓ -AES-128-GCM open, 32 B, rind on ovh-sea: 60 ns, 1.00× the fastest; verified: rind's Lean proof, through Aeneas and hand models of the function-pointer dispatch, of the AES-NI key expansion and block cipher's raw-pointer loads, and of the SIMD intrinsics as Intel's manual defines them, of its AEAD API's AES-GCM key setup, seal, and open, for AAD and messages under 2^32 bytes, down to HACL*'s Vale AES-GCM routines, composed with Vale's F* proofs of Gcm_blocks_stdcall, Gcm_blocks_decrypt_stdcall, and Compute_iv_stdcall, of the code Vale prints at HACL* f557259007db, which rind imports +AES-128-GCM open, 32 B, rind on kixtop: 47 ns, 1.71× the fastest +AES-128-GCM open, 32 B, rind on ovh-iad: 62 ns, 1.00× the fastest; verified: rind's Lean proof, through Aeneas and hand models of the function-pointer dispatch, of the AES-NI key expansion and block cipher's raw-pointer loads, and of the SIMD intrinsics as Intel's manual defines them, of its AEAD API's AES-GCM key setup, seal, and open, for AAD and messages under 2^32 bytes, down to HACL*'s Vale AES-GCM routines, composed with Vale's F* proofs of Gcm_blocks_stdcall, Gcm_blocks_decrypt_stdcall, and Compute_iv_stdcall, of the code Vale prints at HACL* f557259007db, which rind imports ✓ -AES-128-GCM open, 32 B, aws-lc-rs on nixos: 72 ns, 1.63× the fastest -AES-128-GCM open, 32 B, aws-lc-rs on desktop: 37 ns, 1.31× the fastest -AES-128-GCM open, 32 B, aws-lc-rs on nixos2: 90 ns, 2.41× the fastest -AES-128-GCM open, 32 B, aws-lc-rs on ovh-iad: 142 ns, 2.29× the fastest -AES-128-GCM open, 32 B, aws-lc-rs on ovh-sea: 140 ns, 2.35× the fastest -AES-128-GCM open, 32 B, ring on nixos: 58 ns, 1.30× the fastest -AES-128-GCM open, 32 B, ring on desktop: 42 ns, 1.49× the fastest -AES-128-GCM open, 32 B, ring on nixos2: 98 ns, 2.60× the fastest -AES-128-GCM open, 32 B, ring on ovh-iad: 124 ns, 2.01× the fastest -AES-128-GCM open, 32 B, ring on ovh-sea: 126 ns, 2.11× the fastest -AES-128-GCM open, 32 B, RustCrypto + dalek on nixos: 102 ns, 2.29× the fastest -AES-128-GCM open, 32 B, RustCrypto + dalek on desktop: 78 ns, 2.73× the fastest -AES-128-GCM open, 32 B, RustCrypto + dalek on nixos2: 104 ns, 2.78× the fastest -AES-128-GCM open, 32 B, RustCrypto + dalek on ovh-iad: 166 ns, 2.67× the fastest -AES-128-GCM open, 32 B, RustCrypto + dalek on ovh-sea: 161 ns, 2.70× the fastest -AES-128-GCM open, 32 B, graviola on nixos: 65 ns, 1.46× the fastest -AES-128-GCM open, 32 B, graviola on desktop: 36 ns, 1.26× the fastest -AES-128-GCM open, 32 B, graviola on nixos2: 69 ns, 1.83× the fastest -AES-128-GCM open, 32 B, libcrux on nixos: 317 ns, 7.15× the fastest -AES-128-GCM open, 32 B, libcrux on desktop: 159 ns, 5.59× the fastest -AES-128-GCM open, 32 B, libcrux on nixos2: 303 ns, 8.06× the fastest -AES-128-GCM open, 32 B, libcrux on ovh-iad: 485 ns, 7.81× the fastest -AES-128-GCM open, 32 B, libcrux on ovh-sea: 465 ns, 7.79× the fastest -AES-128-GCM open, 32 B, OpenSSL on nixos: 118 ns, 2.65× the fastest -AES-128-GCM open, 32 B, OpenSSL on desktop: 58 ns, 2.02× the fastest -AES-128-GCM open, 32 B, OpenSSL on nixos2: 159 ns, 4.24× the fastest -AES-128-GCM open, 32 B, OpenSSL on ovh-iad: 267 ns, 4.30× the fastest -AES-128-GCM open, 32 B, OpenSSL on ovh-sea: 241 ns, 4.04× the fastest +AES-128-GCM open, 32 B, rind on ovh-sea: 60 ns, 1.00× the fastest; verified: rind's Lean proof, through Aeneas and hand models of the function-pointer dispatch, of the AES-NI key expansion and block cipher's raw-pointer loads, and of the SIMD intrinsics as Intel's manual defines them, of its AEAD API's AES-GCM key setup, seal, and open, for AAD and messages under 2^32 bytes, down to HACL*'s Vale AES-GCM routines, composed with Vale's F* proofs of Gcm_blocks_stdcall, Gcm_blocks_decrypt_stdcall, and Compute_iv_stdcall, of the code Vale prints at HACL* f557259007db, which rind imports +✓ +AES-128-GCM open, 32 B, aws-lc-rs on nixos: 72 ns, 1.63× the fastest +AES-128-GCM open, 32 B, aws-lc-rs on desktop: 37 ns, 1.31× the fastest +AES-128-GCM open, 32 B, aws-lc-rs on nixos2: 90 ns, 2.41× the fastest +AES-128-GCM open, 32 B, aws-lc-rs on kixtop: 47 ns, 1.70× the fastest +AES-128-GCM open, 32 B, aws-lc-rs on ovh-iad: 142 ns, 2.29× the fastest +AES-128-GCM open, 32 B, aws-lc-rs on ovh-sea: 140 ns, 2.35× the fastest +AES-128-GCM open, 32 B, ring on nixos: 58 ns, 1.30× the fastest +AES-128-GCM open, 32 B, ring on desktop: 42 ns, 1.49× the fastest +AES-128-GCM open, 32 B, ring on nixos2: 98 ns, 2.60× the fastest +AES-128-GCM open, 32 B, ring on kixtop: 39 ns, 1.42× the fastest +AES-128-GCM open, 32 B, ring on ovh-iad: 124 ns, 2.01× the fastest +AES-128-GCM open, 32 B, ring on ovh-sea: 126 ns, 2.11× the fastest +AES-128-GCM open, 32 B, RustCrypto + dalek on nixos: 102 ns, 2.29× the fastest +AES-128-GCM open, 32 B, RustCrypto + dalek on desktop: 78 ns, 2.73× the fastest +AES-128-GCM open, 32 B, RustCrypto + dalek on nixos2: 104 ns, 2.78× the fastest +AES-128-GCM open, 32 B, RustCrypto + dalek on kixtop: 28 ns, 1.00× the fastest +AES-128-GCM open, 32 B, RustCrypto + dalek on ovh-iad: 166 ns, 2.67× the fastest +AES-128-GCM open, 32 B, RustCrypto + dalek on ovh-sea: 161 ns, 2.70× the fastest +AES-128-GCM open, 32 B, graviola on nixos: 65 ns, 1.46× the fastest +AES-128-GCM open, 32 B, graviola on desktop: 36 ns, 1.26× the fastest +AES-128-GCM open, 32 B, graviola on nixos2: 69 ns, 1.83× the fastest +AES-128-GCM open, 32 B, graviola on kixtop: 85 ns, 3.06× the fastest +AES-128-GCM open, 32 B, libcrux on nixos: 317 ns, 7.15× the fastest +AES-128-GCM open, 32 B, libcrux on desktop: 159 ns, 5.59× the fastest +AES-128-GCM open, 32 B, libcrux on nixos2: 303 ns, 8.06× the fastest +AES-128-GCM open, 32 B, libcrux on kixtop: 64 ns, 2.30× the fastest +AES-128-GCM open, 32 B, libcrux on ovh-iad: 485 ns, 7.81× the fastest +AES-128-GCM open, 32 B, libcrux on ovh-sea: 465 ns, 7.79× the fastest +AES-128-GCM open, 32 B, OpenSSL on nixos: 118 ns, 2.65× the fastest +AES-128-GCM open, 32 B, OpenSSL on desktop: 58 ns, 2.02× the fastest +AES-128-GCM open, 32 B, OpenSSL on nixos2: 159 ns, 4.24× the fastest +AES-128-GCM open, 32 B, OpenSSL on kixtop: 65 ns, 2.36× the fastest +AES-128-GCM open, 32 B, OpenSSL on ovh-iad: 267 ns, 4.30× the fastest +AES-128-GCM open, 32 B, OpenSSL on ovh-sea: 241 ns, 4.04× the fastest AES-128-GCM open, 1350 B AES-128-GCM open, 1350 B, rind on nixos: 174 ns, 1.00× the fastest AES-128-GCM open, 1350 B, rind on desktop: 99 ns, 1.00× the fastest AES-128-GCM open, 1350 B, rind on nixos2: 236 ns, 1.00× the fastest; verified: rind's Lean proof, through Aeneas and hand models of the function-pointer dispatch, of the AES-NI key expansion and block cipher's raw-pointer loads, and of the SIMD intrinsics as Intel's manual defines them, of its AEAD API's AES-GCM key setup, seal, and open, for AAD and messages under 2^32 bytes, down to HACL*'s Vale AES-GCM routines, composed with Vale's F* proofs of Gcm_blocks_stdcall, Gcm_blocks_decrypt_stdcall, and Compute_iv_stdcall, of the code Vale prints at HACL* f557259007db, which rind imports ✓ -AES-128-GCM open, 1350 B, rind on ovh-iad: 406 ns, 1.00× the fastest; verified: rind's Lean proof, through Aeneas and hand models of the function-pointer dispatch, of the AES-NI key expansion and block cipher's raw-pointer loads, and of the SIMD intrinsics as Intel's manual defines them, of its AEAD API's AES-GCM key setup, seal, and open, for AAD and messages under 2^32 bytes, down to HACL*'s Vale AES-GCM routines, composed with Vale's F* proofs of Gcm_blocks_stdcall, Gcm_blocks_decrypt_stdcall, and Compute_iv_stdcall, of the code Vale prints at HACL* f557259007db, which rind imports -✓ -AES-128-GCM open, 1350 B, rind on ovh-sea: 371 ns, 1.00× the fastest; verified: rind's Lean proof, through Aeneas and hand models of the function-pointer dispatch, of the AES-NI key expansion and block cipher's raw-pointer loads, and of the SIMD intrinsics as Intel's manual defines them, of its AEAD API's AES-GCM key setup, seal, and open, for AAD and messages under 2^32 bytes, down to HACL*'s Vale AES-GCM routines, composed with Vale's F* proofs of Gcm_blocks_stdcall, Gcm_blocks_decrypt_stdcall, and Compute_iv_stdcall, of the code Vale prints at HACL* f557259007db, which rind imports +AES-128-GCM open, 1350 B, rind on kixtop: 214 ns, 1.11× the fastest +AES-128-GCM open, 1350 B, rind on ovh-iad: 406 ns, 1.00× the fastest; verified: rind's Lean proof, through Aeneas and hand models of the function-pointer dispatch, of the AES-NI key expansion and block cipher's raw-pointer loads, and of the SIMD intrinsics as Intel's manual defines them, of its AEAD API's AES-GCM key setup, seal, and open, for AAD and messages under 2^32 bytes, down to HACL*'s Vale AES-GCM routines, composed with Vale's F* proofs of Gcm_blocks_stdcall, Gcm_blocks_decrypt_stdcall, and Compute_iv_stdcall, of the code Vale prints at HACL* f557259007db, which rind imports ✓ -AES-128-GCM open, 1350 B, aws-lc-rs on nixos: 298 ns, 1.71× the fastest -AES-128-GCM open, 1350 B, aws-lc-rs on desktop: 149 ns, 1.51× the fastest -AES-128-GCM open, 1350 B, aws-lc-rs on nixos2: 285 ns, 1.21× the fastest -AES-128-GCM open, 1350 B, aws-lc-rs on ovh-iad: 525 ns, 1.29× the fastest -AES-128-GCM open, 1350 B, aws-lc-rs on ovh-sea: 437 ns, 1.18× the fastest -AES-128-GCM open, 1350 B, ring on nixos: 185 ns, 1.06× the fastest -AES-128-GCM open, 1350 B, ring on desktop: 114 ns, 1.16× the fastest -AES-128-GCM open, 1350 B, ring on nixos2: 296 ns, 1.25× the fastest -AES-128-GCM open, 1350 B, ring on ovh-iad: 442 ns, 1.09× the fastest -AES-128-GCM open, 1350 B, ring on ovh-sea: 422 ns, 1.14× the fastest -AES-128-GCM open, 1350 B, RustCrypto + dalek on nixos: 451 ns, 2.58× the fastest -AES-128-GCM open, 1350 B, RustCrypto + dalek on desktop: 282 ns, 2.86× the fastest -AES-128-GCM open, 1350 B, RustCrypto + dalek on nixos2: 564 ns, 2.39× the fastest -AES-128-GCM open, 1350 B, RustCrypto + dalek on ovh-iad: 915 ns, 2.26× the fastest -AES-128-GCM open, 1350 B, RustCrypto + dalek on ovh-sea: 874 ns, 2.36× the fastest -AES-128-GCM open, 1350 B, graviola on nixos: 305 ns, 1.75× the fastest -AES-128-GCM open, 1350 B, graviola on desktop: 176 ns, 1.79× the fastest -AES-128-GCM open, 1350 B, graviola on nixos2: 358 ns, 1.51× the fastest -AES-128-GCM open, 1350 B, libcrux on nixos: 3.92 µs, 22.46× the fastest -AES-128-GCM open, 1350 B, libcrux on desktop: 2.00 µs, 20.29× the fastest -AES-128-GCM open, 1350 B, libcrux on nixos2: 3.48 µs, 14.75× the fastest -AES-128-GCM open, 1350 B, libcrux on ovh-iad: 5.38 µs, 13.25× the fastest -AES-128-GCM open, 1350 B, libcrux on ovh-sea: 5.32 µs, 14.33× the fastest -AES-128-GCM open, 1350 B, OpenSSL on nixos: 333 ns, 1.91× the fastest -AES-128-GCM open, 1350 B, OpenSSL on desktop: 159 ns, 1.62× the fastest -AES-128-GCM open, 1350 B, OpenSSL on nixos2: 355 ns, 1.50× the fastest -AES-128-GCM open, 1350 B, OpenSSL on ovh-iad: 565 ns, 1.39× the fastest -AES-128-GCM open, 1350 B, OpenSSL on ovh-sea: 546 ns, 1.47× the fastest +AES-128-GCM open, 1350 B, rind on ovh-sea: 371 ns, 1.00× the fastest; verified: rind's Lean proof, through Aeneas and hand models of the function-pointer dispatch, of the AES-NI key expansion and block cipher's raw-pointer loads, and of the SIMD intrinsics as Intel's manual defines them, of its AEAD API's AES-GCM key setup, seal, and open, for AAD and messages under 2^32 bytes, down to HACL*'s Vale AES-GCM routines, composed with Vale's F* proofs of Gcm_blocks_stdcall, Gcm_blocks_decrypt_stdcall, and Compute_iv_stdcall, of the code Vale prints at HACL* f557259007db, which rind imports +✓ +AES-128-GCM open, 1350 B, aws-lc-rs on nixos: 298 ns, 1.71× the fastest +AES-128-GCM open, 1350 B, aws-lc-rs on desktop: 149 ns, 1.51× the fastest +AES-128-GCM open, 1350 B, aws-lc-rs on nixos2: 285 ns, 1.21× the fastest +AES-128-GCM open, 1350 B, aws-lc-rs on kixtop: 193 ns, 1.00× the fastest +AES-128-GCM open, 1350 B, aws-lc-rs on ovh-iad: 525 ns, 1.29× the fastest +AES-128-GCM open, 1350 B, aws-lc-rs on ovh-sea: 437 ns, 1.18× the fastest +AES-128-GCM open, 1350 B, ring on nixos: 185 ns, 1.06× the fastest +AES-128-GCM open, 1350 B, ring on desktop: 114 ns, 1.16× the fastest +AES-128-GCM open, 1350 B, ring on nixos2: 296 ns, 1.25× the fastest +AES-128-GCM open, 1350 B, ring on kixtop: 247 ns, 1.28× the fastest +AES-128-GCM open, 1350 B, ring on ovh-iad: 442 ns, 1.09× the fastest +AES-128-GCM open, 1350 B, ring on ovh-sea: 422 ns, 1.14× the fastest +AES-128-GCM open, 1350 B, RustCrypto + dalek on nixos: 451 ns, 2.58× the fastest +AES-128-GCM open, 1350 B, RustCrypto + dalek on desktop: 282 ns, 2.86× the fastest +AES-128-GCM open, 1350 B, RustCrypto + dalek on nixos2: 564 ns, 2.39× the fastest +AES-128-GCM open, 1350 B, RustCrypto + dalek on kixtop: 237 ns, 1.23× the fastest +AES-128-GCM open, 1350 B, RustCrypto + dalek on ovh-iad: 915 ns, 2.26× the fastest +AES-128-GCM open, 1350 B, RustCrypto + dalek on ovh-sea: 874 ns, 2.36× the fastest +AES-128-GCM open, 1350 B, graviola on nixos: 305 ns, 1.75× the fastest +AES-128-GCM open, 1350 B, graviola on desktop: 176 ns, 1.79× the fastest +AES-128-GCM open, 1350 B, graviola on nixos2: 358 ns, 1.51× the fastest +AES-128-GCM open, 1350 B, graviola on kixtop: 226 ns, 1.17× the fastest +AES-128-GCM open, 1350 B, libcrux on nixos: 3.92 µs, 22.46× the fastest +AES-128-GCM open, 1350 B, libcrux on desktop: 2.00 µs, 20.29× the fastest +AES-128-GCM open, 1350 B, libcrux on nixos2: 3.48 µs, 14.75× the fastest +AES-128-GCM open, 1350 B, libcrux on kixtop: 647 ns, 3.35× the fastest +AES-128-GCM open, 1350 B, libcrux on ovh-iad: 5.38 µs, 13.25× the fastest +AES-128-GCM open, 1350 B, libcrux on ovh-sea: 5.32 µs, 14.33× the fastest +AES-128-GCM open, 1350 B, OpenSSL on nixos: 333 ns, 1.91× the fastest +AES-128-GCM open, 1350 B, OpenSSL on desktop: 159 ns, 1.62× the fastest +AES-128-GCM open, 1350 B, OpenSSL on nixos2: 355 ns, 1.50× the fastest +AES-128-GCM open, 1350 B, OpenSSL on kixtop: 199 ns, 1.03× the fastest +AES-128-GCM open, 1350 B, OpenSSL on ovh-iad: 565 ns, 1.39× the fastest +AES-128-GCM open, 1350 B, OpenSSL on ovh-sea: 546 ns, 1.47× the fastest AES-128-GCM open, 16 KB AES-128-GCM open, 16 KB, rind on nixos: 1.44 µs, 1.00× the fastest AES-128-GCM open, 16 KB, rind on desktop: 816 ns, 1.00× the fastest AES-128-GCM open, 16 KB, rind on nixos2: 2.52 µs, 1.00× the fastest; verified: rind's Lean proof, through Aeneas and hand models of the function-pointer dispatch, of the AES-NI key expansion and block cipher's raw-pointer loads, and of the SIMD intrinsics as Intel's manual defines them, of its AEAD API's AES-GCM key setup, seal, and open, for AAD and messages under 2^32 bytes, down to HACL*'s Vale AES-GCM routines, composed with Vale's F* proofs of Gcm_blocks_stdcall, Gcm_blocks_decrypt_stdcall, and Compute_iv_stdcall, of the code Vale prints at HACL* f557259007db, which rind imports ✓ -AES-128-GCM open, 16 KB, rind on ovh-iad: 3.99 µs, 1.03× the fastest; verified: rind's Lean proof, through Aeneas and hand models of the function-pointer dispatch, of the AES-NI key expansion and block cipher's raw-pointer loads, and of the SIMD intrinsics as Intel's manual defines them, of its AEAD API's AES-GCM key setup, seal, and open, for AAD and messages under 2^32 bytes, down to HACL*'s Vale AES-GCM routines, composed with Vale's F* proofs of Gcm_blocks_stdcall, Gcm_blocks_decrypt_stdcall, and Compute_iv_stdcall, of the code Vale prints at HACL* f557259007db, which rind imports -✓ -AES-128-GCM open, 16 KB, rind on ovh-sea: 3.76 µs, 1.00× the fastest; verified: rind's Lean proof, through Aeneas and hand models of the function-pointer dispatch, of the AES-NI key expansion and block cipher's raw-pointer loads, and of the SIMD intrinsics as Intel's manual defines them, of its AEAD API's AES-GCM key setup, seal, and open, for AAD and messages under 2^32 bytes, down to HACL*'s Vale AES-GCM routines, composed with Vale's F* proofs of Gcm_blocks_stdcall, Gcm_blocks_decrypt_stdcall, and Compute_iv_stdcall, of the code Vale prints at HACL* f557259007db, which rind imports +AES-128-GCM open, 16 KB, rind on kixtop: 1.61 µs, 1.02× the fastest +AES-128-GCM open, 16 KB, rind on ovh-iad: 3.99 µs, 1.03× the fastest; verified: rind's Lean proof, through Aeneas and hand models of the function-pointer dispatch, of the AES-NI key expansion and block cipher's raw-pointer loads, and of the SIMD intrinsics as Intel's manual defines them, of its AEAD API's AES-GCM key setup, seal, and open, for AAD and messages under 2^32 bytes, down to HACL*'s Vale AES-GCM routines, composed with Vale's F* proofs of Gcm_blocks_stdcall, Gcm_blocks_decrypt_stdcall, and Compute_iv_stdcall, of the code Vale prints at HACL* f557259007db, which rind imports ✓ -AES-128-GCM open, 16 KB, aws-lc-rs on nixos: 2.72 µs, 1.89× the fastest -AES-128-GCM open, 16 KB, aws-lc-rs on desktop: 1.28 µs, 1.56× the fastest -AES-128-GCM open, 16 KB, aws-lc-rs on nixos2: 2.60 µs, 1.03× the fastest -AES-128-GCM open, 16 KB, aws-lc-rs on ovh-iad: 3.92 µs, 1.02× the fastest -AES-128-GCM open, 16 KB, aws-lc-rs on ovh-sea: 3.81 µs, 1.02× the fastest -AES-128-GCM open, 16 KB, ring on nixos: 1.45 µs, 1.01× the fastest -AES-128-GCM open, 16 KB, ring on desktop: 829 ns, 1.02× the fastest -AES-128-GCM open, 16 KB, ring on nixos2: 2.62 µs, 1.04× the fastest -AES-128-GCM open, 16 KB, ring on ovh-iad: 3.85 µs, 1.00× the fastest -AES-128-GCM open, 16 KB, ring on ovh-sea: 3.80 µs, 1.01× the fastest -AES-128-GCM open, 16 KB, RustCrypto + dalek on nixos: 4.29 µs, 2.98× the fastest -AES-128-GCM open, 16 KB, RustCrypto + dalek on desktop: 2.54 µs, 3.12× the fastest -AES-128-GCM open, 16 KB, RustCrypto + dalek on nixos2: 5.75 µs, 2.28× the fastest -AES-128-GCM open, 16 KB, RustCrypto + dalek on ovh-iad: 8.92 µs, 2.31× the fastest -AES-128-GCM open, 16 KB, RustCrypto + dalek on ovh-sea: 8.76 µs, 2.33× the fastest -AES-128-GCM open, 16 KB, graviola on nixos: 2.65 µs, 1.84× the fastest -AES-128-GCM open, 16 KB, graviola on desktop: 1.42 µs, 1.73× the fastest -AES-128-GCM open, 16 KB, graviola on nixos2: 3.39 µs, 1.34× the fastest -AES-128-GCM open, 16 KB, libcrux on nixos: 44.29 µs, 30.79× the fastest -AES-128-GCM open, 16 KB, libcrux on desktop: 22.31 µs, 27.33× the fastest -AES-128-GCM open, 16 KB, libcrux on nixos2: 41.66 µs, 16.52× the fastest -AES-128-GCM open, 16 KB, libcrux on ovh-iad: 61.44 µs, 15.94× the fastest -AES-128-GCM open, 16 KB, libcrux on ovh-sea: 60.04 µs, 15.98× the fastest -AES-128-GCM open, 16 KB, OpenSSL on nixos: 2.77 µs, 1.93× the fastest -AES-128-GCM open, 16 KB, OpenSSL on desktop: 1.30 µs, 1.59× the fastest -AES-128-GCM open, 16 KB, OpenSSL on nixos2: 2.85 µs, 1.13× the fastest -AES-128-GCM open, 16 KB, OpenSSL on ovh-iad: 4.23 µs, 1.10× the fastest -AES-128-GCM open, 16 KB, OpenSSL on ovh-sea: 3.95 µs, 1.05× the fastest +AES-128-GCM open, 16 KB, rind on ovh-sea: 3.76 µs, 1.00× the fastest; verified: rind's Lean proof, through Aeneas and hand models of the function-pointer dispatch, of the AES-NI key expansion and block cipher's raw-pointer loads, and of the SIMD intrinsics as Intel's manual defines them, of its AEAD API's AES-GCM key setup, seal, and open, for AAD and messages under 2^32 bytes, down to HACL*'s Vale AES-GCM routines, composed with Vale's F* proofs of Gcm_blocks_stdcall, Gcm_blocks_decrypt_stdcall, and Compute_iv_stdcall, of the code Vale prints at HACL* f557259007db, which rind imports +✓ +AES-128-GCM open, 16 KB, aws-lc-rs on nixos: 2.72 µs, 1.89× the fastest +AES-128-GCM open, 16 KB, aws-lc-rs on desktop: 1.28 µs, 1.56× the fastest +AES-128-GCM open, 16 KB, aws-lc-rs on nixos2: 2.60 µs, 1.03× the fastest +AES-128-GCM open, 16 KB, aws-lc-rs on kixtop: 1.57 µs, 1.00× the fastest +AES-128-GCM open, 16 KB, aws-lc-rs on ovh-iad: 3.92 µs, 1.02× the fastest +AES-128-GCM open, 16 KB, aws-lc-rs on ovh-sea: 3.81 µs, 1.02× the fastest +AES-128-GCM open, 16 KB, ring on nixos: 1.45 µs, 1.01× the fastest +AES-128-GCM open, 16 KB, ring on desktop: 829 ns, 1.02× the fastest +AES-128-GCM open, 16 KB, ring on nixos2: 2.62 µs, 1.04× the fastest +AES-128-GCM open, 16 KB, ring on kixtop: 2.18 µs, 1.39× the fastest +AES-128-GCM open, 16 KB, ring on ovh-iad: 3.85 µs, 1.00× the fastest +AES-128-GCM open, 16 KB, ring on ovh-sea: 3.80 µs, 1.01× the fastest +AES-128-GCM open, 16 KB, RustCrypto + dalek on nixos: 4.29 µs, 2.98× the fastest +AES-128-GCM open, 16 KB, RustCrypto + dalek on desktop: 2.54 µs, 3.12× the fastest +AES-128-GCM open, 16 KB, RustCrypto + dalek on nixos2: 5.75 µs, 2.28× the fastest +AES-128-GCM open, 16 KB, RustCrypto + dalek on kixtop: 2.46 µs, 1.57× the fastest +AES-128-GCM open, 16 KB, RustCrypto + dalek on ovh-iad: 8.92 µs, 2.31× the fastest +AES-128-GCM open, 16 KB, RustCrypto + dalek on ovh-sea: 8.76 µs, 2.33× the fastest +AES-128-GCM open, 16 KB, graviola on nixos: 2.65 µs, 1.84× the fastest +AES-128-GCM open, 16 KB, graviola on desktop: 1.42 µs, 1.73× the fastest +AES-128-GCM open, 16 KB, graviola on nixos2: 3.39 µs, 1.34× the fastest +AES-128-GCM open, 16 KB, graviola on kixtop: 1.71 µs, 1.09× the fastest +AES-128-GCM open, 16 KB, libcrux on nixos: 44.29 µs, 30.79× the fastest +AES-128-GCM open, 16 KB, libcrux on desktop: 22.31 µs, 27.33× the fastest +AES-128-GCM open, 16 KB, libcrux on nixos2: 41.66 µs, 16.52× the fastest +AES-128-GCM open, 16 KB, libcrux on kixtop: 6.97 µs, 4.44× the fastest +AES-128-GCM open, 16 KB, libcrux on ovh-iad: 61.44 µs, 15.94× the fastest +AES-128-GCM open, 16 KB, libcrux on ovh-sea: 60.04 µs, 15.98× the fastest +AES-128-GCM open, 16 KB, OpenSSL on nixos: 2.77 µs, 1.93× the fastest +AES-128-GCM open, 16 KB, OpenSSL on desktop: 1.30 µs, 1.59× the fastest +AES-128-GCM open, 16 KB, OpenSSL on nixos2: 2.85 µs, 1.13× the fastest +AES-128-GCM open, 16 KB, OpenSSL on kixtop: 1.66 µs, 1.06× the fastest +AES-128-GCM open, 16 KB, OpenSSL on ovh-iad: 4.23 µs, 1.10× the fastest +AES-128-GCM open, 16 KB, OpenSSL on ovh-sea: 3.95 µs, 1.05× the fastest AES-256-GCM seal, 32 B AES-256-GCM seal, 32 B, rind on nixos: 41 ns, 1.00× the fastest AES-256-GCM seal, 32 B, rind on desktop: 20 ns, 1.00× the fastest AES-256-GCM seal, 32 B, rind on nixos2: 49 ns, 1.00× the fastest; verified: rind's Lean proof, through Aeneas and hand models of the function-pointer dispatch, of the AES-NI key expansion and block cipher's raw-pointer loads, and of the SIMD intrinsics as Intel's manual defines them, of its AEAD API's AES-GCM key setup, seal, and open, for AAD and messages under 2^32 bytes, down to HACL*'s Vale AES-GCM routines, composed with Vale's F* proofs of Gcm_blocks_stdcall, Gcm_blocks_decrypt_stdcall, and Compute_iv_stdcall, of the code Vale prints at HACL* f557259007db, which rind imports ✓ -AES-256-GCM seal, 32 B, rind on ovh-iad: 75 ns, 1.00× the fastest; verified: rind's Lean proof, through Aeneas and hand models of the function-pointer dispatch, of the AES-NI key expansion and block cipher's raw-pointer loads, and of the SIMD intrinsics as Intel's manual defines them, of its AEAD API's AES-GCM key setup, seal, and open, for AAD and messages under 2^32 bytes, down to HACL*'s Vale AES-GCM routines, composed with Vale's F* proofs of Gcm_blocks_stdcall, Gcm_blocks_decrypt_stdcall, and Compute_iv_stdcall, of the code Vale prints at HACL* f557259007db, which rind imports -✓ -AES-256-GCM seal, 32 B, rind on ovh-sea: 74 ns, 1.00× the fastest; verified: rind's Lean proof, through Aeneas and hand models of the function-pointer dispatch, of the AES-NI key expansion and block cipher's raw-pointer loads, and of the SIMD intrinsics as Intel's manual defines them, of its AEAD API's AES-GCM key setup, seal, and open, for AAD and messages under 2^32 bytes, down to HACL*'s Vale AES-GCM routines, composed with Vale's F* proofs of Gcm_blocks_stdcall, Gcm_blocks_decrypt_stdcall, and Compute_iv_stdcall, of the code Vale prints at HACL* f557259007db, which rind imports +AES-256-GCM seal, 32 B, rind on kixtop: 61 ns, 2.44× the fastest +AES-256-GCM seal, 32 B, rind on ovh-iad: 75 ns, 1.00× the fastest; verified: rind's Lean proof, through Aeneas and hand models of the function-pointer dispatch, of the AES-NI key expansion and block cipher's raw-pointer loads, and of the SIMD intrinsics as Intel's manual defines them, of its AEAD API's AES-GCM key setup, seal, and open, for AAD and messages under 2^32 bytes, down to HACL*'s Vale AES-GCM routines, composed with Vale's F* proofs of Gcm_blocks_stdcall, Gcm_blocks_decrypt_stdcall, and Compute_iv_stdcall, of the code Vale prints at HACL* f557259007db, which rind imports ✓ -AES-256-GCM seal, 32 B, aws-lc-rs on nixos: 82 ns, 1.99× the fastest -AES-256-GCM seal, 32 B, aws-lc-rs on desktop: 40 ns, 1.99× the fastest -AES-256-GCM seal, 32 B, aws-lc-rs on nixos2: 95 ns, 1.96× the fastest -AES-256-GCM seal, 32 B, aws-lc-rs on ovh-iad: 155 ns, 2.05× the fastest -AES-256-GCM seal, 32 B, aws-lc-rs on ovh-sea: 147 ns, 2.00× the fastest -AES-256-GCM seal, 32 B, ring on nixos: 57 ns, 1.38× the fastest -AES-256-GCM seal, 32 B, ring on desktop: 43 ns, 2.16× the fastest -AES-256-GCM seal, 32 B, ring on nixos2: 75 ns, 1.54× the fastest -AES-256-GCM seal, 32 B, ring on ovh-iad: 122 ns, 1.62× the fastest -AES-256-GCM seal, 32 B, ring on ovh-sea: 119 ns, 1.61× the fastest -AES-256-GCM seal, 32 B, RustCrypto + dalek on nixos: 101 ns, 2.45× the fastest -AES-256-GCM seal, 32 B, RustCrypto + dalek on desktop: 77 ns, 3.90× the fastest -AES-256-GCM seal, 32 B, RustCrypto + dalek on nixos2: 107 ns, 2.21× the fastest -AES-256-GCM seal, 32 B, RustCrypto + dalek on ovh-iad: 170 ns, 2.25× the fastest -AES-256-GCM seal, 32 B, RustCrypto + dalek on ovh-sea: 166 ns, 2.25× the fastest -AES-256-GCM seal, 32 B, graviola on nixos: 74 ns, 1.81× the fastest -AES-256-GCM seal, 32 B, graviola on desktop: 44 ns, 2.22× the fastest -AES-256-GCM seal, 32 B, graviola on nixos2: 78 ns, 1.60× the fastest -AES-256-GCM seal, 32 B, libcrux on nixos: 426 ns, 10.35× the fastest -AES-256-GCM seal, 32 B, libcrux on desktop: 216 ns, 10.88× the fastest -AES-256-GCM seal, 32 B, libcrux on nixos2: 344 ns, 7.07× the fastest -AES-256-GCM seal, 32 B, libcrux on ovh-iad: 542 ns, 7.18× the fastest -AES-256-GCM seal, 32 B, libcrux on ovh-sea: 525 ns, 7.13× the fastest -AES-256-GCM seal, 32 B, OpenSSL on nixos: 118 ns, 2.87× the fastest -AES-256-GCM seal, 32 B, OpenSSL on desktop: 58 ns, 2.93× the fastest -AES-256-GCM seal, 32 B, OpenSSL on nixos2: 161 ns, 3.32× the fastest -AES-256-GCM seal, 32 B, OpenSSL on ovh-iad: 252 ns, 3.34× the fastest -AES-256-GCM seal, 32 B, OpenSSL on ovh-sea: 245 ns, 3.32× the fastest +AES-256-GCM seal, 32 B, rind on ovh-sea: 74 ns, 1.00× the fastest; verified: rind's Lean proof, through Aeneas and hand models of the function-pointer dispatch, of the AES-NI key expansion and block cipher's raw-pointer loads, and of the SIMD intrinsics as Intel's manual defines them, of its AEAD API's AES-GCM key setup, seal, and open, for AAD and messages under 2^32 bytes, down to HACL*'s Vale AES-GCM routines, composed with Vale's F* proofs of Gcm_blocks_stdcall, Gcm_blocks_decrypt_stdcall, and Compute_iv_stdcall, of the code Vale prints at HACL* f557259007db, which rind imports +✓ +AES-256-GCM seal, 32 B, aws-lc-rs on nixos: 82 ns, 1.99× the fastest +AES-256-GCM seal, 32 B, aws-lc-rs on desktop: 40 ns, 1.99× the fastest +AES-256-GCM seal, 32 B, aws-lc-rs on nixos2: 95 ns, 1.96× the fastest +AES-256-GCM seal, 32 B, aws-lc-rs on kixtop: 54 ns, 2.18× the fastest +AES-256-GCM seal, 32 B, aws-lc-rs on ovh-iad: 155 ns, 2.05× the fastest +AES-256-GCM seal, 32 B, aws-lc-rs on ovh-sea: 147 ns, 2.00× the fastest +AES-256-GCM seal, 32 B, ring on nixos: 57 ns, 1.38× the fastest +AES-256-GCM seal, 32 B, ring on desktop: 43 ns, 2.16× the fastest +AES-256-GCM seal, 32 B, ring on nixos2: 75 ns, 1.54× the fastest +AES-256-GCM seal, 32 B, ring on kixtop: 45 ns, 1.82× the fastest +AES-256-GCM seal, 32 B, ring on ovh-iad: 122 ns, 1.62× the fastest +AES-256-GCM seal, 32 B, ring on ovh-sea: 119 ns, 1.61× the fastest +AES-256-GCM seal, 32 B, RustCrypto + dalek on nixos: 101 ns, 2.45× the fastest +AES-256-GCM seal, 32 B, RustCrypto + dalek on desktop: 77 ns, 3.90× the fastest +AES-256-GCM seal, 32 B, RustCrypto + dalek on nixos2: 107 ns, 2.21× the fastest +AES-256-GCM seal, 32 B, RustCrypto + dalek on kixtop: 25 ns, 1.00× the fastest +AES-256-GCM seal, 32 B, RustCrypto + dalek on ovh-iad: 170 ns, 2.25× the fastest +AES-256-GCM seal, 32 B, RustCrypto + dalek on ovh-sea: 166 ns, 2.25× the fastest +AES-256-GCM seal, 32 B, graviola on nixos: 74 ns, 1.81× the fastest +AES-256-GCM seal, 32 B, graviola on desktop: 44 ns, 2.22× the fastest +AES-256-GCM seal, 32 B, graviola on nixos2: 78 ns, 1.60× the fastest +AES-256-GCM seal, 32 B, graviola on kixtop: 79 ns, 3.18× the fastest +AES-256-GCM seal, 32 B, libcrux on nixos: 426 ns, 10.35× the fastest +AES-256-GCM seal, 32 B, libcrux on desktop: 216 ns, 10.88× the fastest +AES-256-GCM seal, 32 B, libcrux on nixos2: 344 ns, 7.07× the fastest +AES-256-GCM seal, 32 B, libcrux on kixtop: 53 ns, 2.15× the fastest +AES-256-GCM seal, 32 B, libcrux on ovh-iad: 542 ns, 7.18× the fastest +AES-256-GCM seal, 32 B, libcrux on ovh-sea: 525 ns, 7.13× the fastest +AES-256-GCM seal, 32 B, OpenSSL on nixos: 118 ns, 2.87× the fastest +AES-256-GCM seal, 32 B, OpenSSL on desktop: 58 ns, 2.93× the fastest +AES-256-GCM seal, 32 B, OpenSSL on nixos2: 161 ns, 3.32× the fastest +AES-256-GCM seal, 32 B, OpenSSL on kixtop: 67 ns, 2.72× the fastest +AES-256-GCM seal, 32 B, OpenSSL on ovh-iad: 252 ns, 3.34× the fastest +AES-256-GCM seal, 32 B, OpenSSL on ovh-sea: 245 ns, 3.32× the fastest AES-256-GCM seal, 1350 B AES-256-GCM seal, 1350 B, rind on nixos: 184 ns, 1.00× the fastest AES-256-GCM seal, 1350 B, rind on desktop: 106 ns, 1.00× the fastest AES-256-GCM seal, 1350 B, rind on nixos2: 325 ns, 1.00× the fastest; verified: rind's Lean proof, through Aeneas and hand models of the function-pointer dispatch, of the AES-NI key expansion and block cipher's raw-pointer loads, and of the SIMD intrinsics as Intel's manual defines them, of its AEAD API's AES-GCM key setup, seal, and open, for AAD and messages under 2^32 bytes, down to HACL*'s Vale AES-GCM routines, composed with Vale's F* proofs of Gcm_blocks_stdcall, Gcm_blocks_decrypt_stdcall, and Compute_iv_stdcall, of the code Vale prints at HACL* f557259007db, which rind imports ✓ -AES-256-GCM seal, 1350 B, rind on ovh-iad: 523 ns, 1.00× the fastest; verified: rind's Lean proof, through Aeneas and hand models of the function-pointer dispatch, of the AES-NI key expansion and block cipher's raw-pointer loads, and of the SIMD intrinsics as Intel's manual defines them, of its AEAD API's AES-GCM key setup, seal, and open, for AAD and messages under 2^32 bytes, down to HACL*'s Vale AES-GCM routines, composed with Vale's F* proofs of Gcm_blocks_stdcall, Gcm_blocks_decrypt_stdcall, and Compute_iv_stdcall, of the code Vale prints at HACL* f557259007db, which rind imports -✓ -AES-256-GCM seal, 1350 B, rind on ovh-sea: 507 ns, 1.00× the fastest; verified: rind's Lean proof, through Aeneas and hand models of the function-pointer dispatch, of the AES-NI key expansion and block cipher's raw-pointer loads, and of the SIMD intrinsics as Intel's manual defines them, of its AEAD API's AES-GCM key setup, seal, and open, for AAD and messages under 2^32 bytes, down to HACL*'s Vale AES-GCM routines, composed with Vale's F* proofs of Gcm_blocks_stdcall, Gcm_blocks_decrypt_stdcall, and Compute_iv_stdcall, of the code Vale prints at HACL* f557259007db, which rind imports +AES-256-GCM seal, 1350 B, rind on kixtop: 237 ns, 1.16× the fastest +AES-256-GCM seal, 1350 B, rind on ovh-iad: 523 ns, 1.00× the fastest; verified: rind's Lean proof, through Aeneas and hand models of the function-pointer dispatch, of the AES-NI key expansion and block cipher's raw-pointer loads, and of the SIMD intrinsics as Intel's manual defines them, of its AEAD API's AES-GCM key setup, seal, and open, for AAD and messages under 2^32 bytes, down to HACL*'s Vale AES-GCM routines, composed with Vale's F* proofs of Gcm_blocks_stdcall, Gcm_blocks_decrypt_stdcall, and Compute_iv_stdcall, of the code Vale prints at HACL* f557259007db, which rind imports ✓ -AES-256-GCM seal, 1350 B, aws-lc-rs on nixos: 311 ns, 1.69× the fastest -AES-256-GCM seal, 1350 B, aws-lc-rs on desktop: 173 ns, 1.63× the fastest -AES-256-GCM seal, 1350 B, aws-lc-rs on nixos2: 363 ns, 1.12× the fastest -AES-256-GCM seal, 1350 B, aws-lc-rs on ovh-iad: 581 ns, 1.11× the fastest -AES-256-GCM seal, 1350 B, aws-lc-rs on ovh-sea: 556 ns, 1.10× the fastest -AES-256-GCM seal, 1350 B, ring on nixos: 205 ns, 1.11× the fastest -AES-256-GCM seal, 1350 B, ring on desktop: 133 ns, 1.25× the fastest -AES-256-GCM seal, 1350 B, ring on nixos2: 353 ns, 1.09× the fastest -AES-256-GCM seal, 1350 B, ring on ovh-iad: 557 ns, 1.06× the fastest -AES-256-GCM seal, 1350 B, ring on ovh-sea: 550 ns, 1.08× the fastest -AES-256-GCM seal, 1350 B, RustCrypto + dalek on nixos: 489 ns, 2.65× the fastest -AES-256-GCM seal, 1350 B, RustCrypto + dalek on desktop: 313 ns, 2.94× the fastest -AES-256-GCM seal, 1350 B, RustCrypto + dalek on nixos2: 623 ns, 1.92× the fastest -AES-256-GCM seal, 1350 B, RustCrypto + dalek on ovh-iad: 999 ns, 1.91× the fastest -AES-256-GCM seal, 1350 B, RustCrypto + dalek on ovh-sea: 958 ns, 1.89× the fastest -AES-256-GCM seal, 1350 B, graviola on nixos: 337 ns, 1.83× the fastest -AES-256-GCM seal, 1350 B, graviola on desktop: 258 ns, 2.42× the fastest -AES-256-GCM seal, 1350 B, graviola on nixos2: 476 ns, 1.46× the fastest -AES-256-GCM seal, 1350 B, libcrux on nixos: 6.91 µs, 37.50× the fastest -AES-256-GCM seal, 1350 B, libcrux on desktop: 2.83 µs, 26.55× the fastest -AES-256-GCM seal, 1350 B, libcrux on nixos2: 4.50 µs, 13.86× the fastest -AES-256-GCM seal, 1350 B, libcrux on ovh-iad: 7.07 µs, 13.51× the fastest -AES-256-GCM seal, 1350 B, libcrux on ovh-sea: 6.92 µs, 13.63× the fastest -AES-256-GCM seal, 1350 B, OpenSSL on nixos: 345 ns, 1.87× the fastest -AES-256-GCM seal, 1350 B, OpenSSL on desktop: 186 ns, 1.75× the fastest -AES-256-GCM seal, 1350 B, OpenSSL on nixos2: 437 ns, 1.34× the fastest -AES-256-GCM seal, 1350 B, OpenSSL on ovh-iad: 707 ns, 1.35× the fastest -AES-256-GCM seal, 1350 B, OpenSSL on ovh-sea: 651 ns, 1.28× the fastest +AES-256-GCM seal, 1350 B, rind on ovh-sea: 507 ns, 1.00× the fastest; verified: rind's Lean proof, through Aeneas and hand models of the function-pointer dispatch, of the AES-NI key expansion and block cipher's raw-pointer loads, and of the SIMD intrinsics as Intel's manual defines them, of its AEAD API's AES-GCM key setup, seal, and open, for AAD and messages under 2^32 bytes, down to HACL*'s Vale AES-GCM routines, composed with Vale's F* proofs of Gcm_blocks_stdcall, Gcm_blocks_decrypt_stdcall, and Compute_iv_stdcall, of the code Vale prints at HACL* f557259007db, which rind imports +✓ +AES-256-GCM seal, 1350 B, aws-lc-rs on nixos: 311 ns, 1.69× the fastest +AES-256-GCM seal, 1350 B, aws-lc-rs on desktop: 173 ns, 1.63× the fastest +AES-256-GCM seal, 1350 B, aws-lc-rs on nixos2: 363 ns, 1.12× the fastest +AES-256-GCM seal, 1350 B, aws-lc-rs on kixtop: 205 ns, 1.00× the fastest +AES-256-GCM seal, 1350 B, aws-lc-rs on ovh-iad: 581 ns, 1.11× the fastest +AES-256-GCM seal, 1350 B, aws-lc-rs on ovh-sea: 556 ns, 1.10× the fastest +AES-256-GCM seal, 1350 B, ring on nixos: 205 ns, 1.11× the fastest +AES-256-GCM seal, 1350 B, ring on desktop: 133 ns, 1.25× the fastest +AES-256-GCM seal, 1350 B, ring on nixos2: 353 ns, 1.09× the fastest +AES-256-GCM seal, 1350 B, ring on kixtop: 220 ns, 1.07× the fastest +AES-256-GCM seal, 1350 B, ring on ovh-iad: 557 ns, 1.06× the fastest +AES-256-GCM seal, 1350 B, ring on ovh-sea: 550 ns, 1.08× the fastest +AES-256-GCM seal, 1350 B, RustCrypto + dalek on nixos: 489 ns, 2.65× the fastest +AES-256-GCM seal, 1350 B, RustCrypto + dalek on desktop: 313 ns, 2.94× the fastest +AES-256-GCM seal, 1350 B, RustCrypto + dalek on nixos2: 623 ns, 1.92× the fastest +AES-256-GCM seal, 1350 B, RustCrypto + dalek on kixtop: 246 ns, 1.20× the fastest +AES-256-GCM seal, 1350 B, RustCrypto + dalek on ovh-iad: 999 ns, 1.91× the fastest +AES-256-GCM seal, 1350 B, RustCrypto + dalek on ovh-sea: 958 ns, 1.89× the fastest +AES-256-GCM seal, 1350 B, graviola on nixos: 337 ns, 1.83× the fastest +AES-256-GCM seal, 1350 B, graviola on desktop: 258 ns, 2.42× the fastest +AES-256-GCM seal, 1350 B, graviola on nixos2: 476 ns, 1.46× the fastest +AES-256-GCM seal, 1350 B, graviola on kixtop: 262 ns, 1.28× the fastest +AES-256-GCM seal, 1350 B, libcrux on nixos: 6.91 µs, 37.50× the fastest +AES-256-GCM seal, 1350 B, libcrux on desktop: 2.83 µs, 26.55× the fastest +AES-256-GCM seal, 1350 B, libcrux on nixos2: 4.50 µs, 13.86× the fastest +AES-256-GCM seal, 1350 B, libcrux on kixtop: 650 ns, 3.18× the fastest +AES-256-GCM seal, 1350 B, libcrux on ovh-iad: 7.07 µs, 13.51× the fastest +AES-256-GCM seal, 1350 B, libcrux on ovh-sea: 6.92 µs, 13.63× the fastest +AES-256-GCM seal, 1350 B, OpenSSL on nixos: 345 ns, 1.87× the fastest +AES-256-GCM seal, 1350 B, OpenSSL on desktop: 186 ns, 1.75× the fastest +AES-256-GCM seal, 1350 B, OpenSSL on nixos2: 437 ns, 1.34× the fastest +AES-256-GCM seal, 1350 B, OpenSSL on kixtop: 222 ns, 1.08× the fastest +AES-256-GCM seal, 1350 B, OpenSSL on ovh-iad: 707 ns, 1.35× the fastest +AES-256-GCM seal, 1350 B, OpenSSL on ovh-sea: 651 ns, 1.28× the fastest AES-256-GCM seal, 16 KB AES-256-GCM seal, 16 KB, rind on nixos: 1.51 µs, 1.00× the fastest AES-256-GCM seal, 16 KB, rind on desktop: 925 ns, 1.00× the fastest AES-256-GCM seal, 16 KB, rind on nixos2: 3.22 µs, 1.00× the fastest; verified: rind's Lean proof, through Aeneas and hand models of the function-pointer dispatch, of the AES-NI key expansion and block cipher's raw-pointer loads, and of the SIMD intrinsics as Intel's manual defines them, of its AEAD API's AES-GCM key setup, seal, and open, for AAD and messages under 2^32 bytes, down to HACL*'s Vale AES-GCM routines, composed with Vale's F* proofs of Gcm_blocks_stdcall, Gcm_blocks_decrypt_stdcall, and Compute_iv_stdcall, of the code Vale prints at HACL* f557259007db, which rind imports ✓ -AES-256-GCM seal, 16 KB, rind on ovh-iad: 5.18 µs, 1.00× the fastest; verified: rind's Lean proof, through Aeneas and hand models of the function-pointer dispatch, of the AES-NI key expansion and block cipher's raw-pointer loads, and of the SIMD intrinsics as Intel's manual defines them, of its AEAD API's AES-GCM key setup, seal, and open, for AAD and messages under 2^32 bytes, down to HACL*'s Vale AES-GCM routines, composed with Vale's F* proofs of Gcm_blocks_stdcall, Gcm_blocks_decrypt_stdcall, and Compute_iv_stdcall, of the code Vale prints at HACL* f557259007db, which rind imports -✓ -AES-256-GCM seal, 16 KB, rind on ovh-sea: 4.99 µs, 1.00× the fastest; verified: rind's Lean proof, through Aeneas and hand models of the function-pointer dispatch, of the AES-NI key expansion and block cipher's raw-pointer loads, and of the SIMD intrinsics as Intel's manual defines them, of its AEAD API's AES-GCM key setup, seal, and open, for AAD and messages under 2^32 bytes, down to HACL*'s Vale AES-GCM routines, composed with Vale's F* proofs of Gcm_blocks_stdcall, Gcm_blocks_decrypt_stdcall, and Compute_iv_stdcall, of the code Vale prints at HACL* f557259007db, which rind imports +AES-256-GCM seal, 16 KB, rind on kixtop: 1.75 µs, 1.02× the fastest +AES-256-GCM seal, 16 KB, rind on ovh-iad: 5.18 µs, 1.00× the fastest; verified: rind's Lean proof, through Aeneas and hand models of the function-pointer dispatch, of the AES-NI key expansion and block cipher's raw-pointer loads, and of the SIMD intrinsics as Intel's manual defines them, of its AEAD API's AES-GCM key setup, seal, and open, for AAD and messages under 2^32 bytes, down to HACL*'s Vale AES-GCM routines, composed with Vale's F* proofs of Gcm_blocks_stdcall, Gcm_blocks_decrypt_stdcall, and Compute_iv_stdcall, of the code Vale prints at HACL* f557259007db, which rind imports ✓ -AES-256-GCM seal, 16 KB, aws-lc-rs on nixos: 2.78 µs, 1.84× the fastest -AES-256-GCM seal, 16 KB, aws-lc-rs on desktop: 1.56 µs, 1.69× the fastest -AES-256-GCM seal, 16 KB, aws-lc-rs on nixos2: 3.30 µs, 1.03× the fastest -AES-256-GCM seal, 16 KB, aws-lc-rs on ovh-iad: 5.46 µs, 1.05× the fastest -AES-256-GCM seal, 16 KB, aws-lc-rs on ovh-sea: 5.08 µs, 1.02× the fastest -AES-256-GCM seal, 16 KB, ring on nixos: 1.53 µs, 1.01× the fastest -AES-256-GCM seal, 16 KB, ring on desktop: 946 ns, 1.02× the fastest -AES-256-GCM seal, 16 KB, ring on nixos2: 3.25 µs, 1.01× the fastest -AES-256-GCM seal, 16 KB, ring on ovh-iad: 5.80 µs, 1.12× the fastest -AES-256-GCM seal, 16 KB, ring on ovh-sea: 4.97 µs, 1.00× the fastest -AES-256-GCM seal, 16 KB, RustCrypto + dalek on nixos: 4.78 µs, 3.16× the fastest -AES-256-GCM seal, 16 KB, RustCrypto + dalek on desktop: 2.91 µs, 3.14× the fastest -AES-256-GCM seal, 16 KB, RustCrypto + dalek on nixos2: 6.45 µs, 2.00× the fastest -AES-256-GCM seal, 16 KB, RustCrypto + dalek on ovh-iad: 10.56 µs, 2.04× the fastest -AES-256-GCM seal, 16 KB, RustCrypto + dalek on ovh-sea: 9.94 µs, 2.00× the fastest -AES-256-GCM seal, 16 KB, graviola on nixos: 2.98 µs, 1.97× the fastest -AES-256-GCM seal, 16 KB, graviola on desktop: 2.46 µs, 2.66× the fastest -AES-256-GCM seal, 16 KB, graviola on nixos2: 4.71 µs, 1.46× the fastest -AES-256-GCM seal, 16 KB, libcrux on nixos: 80.61 µs, 53.39× the fastest -AES-256-GCM seal, 16 KB, libcrux on desktop: 32.69 µs, 35.34× the fastest -AES-256-GCM seal, 16 KB, libcrux on nixos2: 50.92 µs, 15.81× the fastest -AES-256-GCM seal, 16 KB, libcrux on ovh-iad: 83.14 µs, 16.05× the fastest -AES-256-GCM seal, 16 KB, libcrux on ovh-sea: 78.50 µs, 15.79× the fastest -AES-256-GCM seal, 16 KB, OpenSSL on nixos: 2.82 µs, 1.87× the fastest -AES-256-GCM seal, 16 KB, OpenSSL on desktop: 1.59 µs, 1.72× the fastest -AES-256-GCM seal, 16 KB, OpenSSL on nixos2: 3.34 µs, 1.04× the fastest -AES-256-GCM seal, 16 KB, OpenSSL on ovh-iad: 5.20 µs, 1.00× the fastest -AES-256-GCM seal, 16 KB, OpenSSL on ovh-sea: 5.15 µs, 1.04× the fastest +AES-256-GCM seal, 16 KB, rind on ovh-sea: 4.99 µs, 1.00× the fastest; verified: rind's Lean proof, through Aeneas and hand models of the function-pointer dispatch, of the AES-NI key expansion and block cipher's raw-pointer loads, and of the SIMD intrinsics as Intel's manual defines them, of its AEAD API's AES-GCM key setup, seal, and open, for AAD and messages under 2^32 bytes, down to HACL*'s Vale AES-GCM routines, composed with Vale's F* proofs of Gcm_blocks_stdcall, Gcm_blocks_decrypt_stdcall, and Compute_iv_stdcall, of the code Vale prints at HACL* f557259007db, which rind imports +✓ +AES-256-GCM seal, 16 KB, aws-lc-rs on nixos: 2.78 µs, 1.84× the fastest +AES-256-GCM seal, 16 KB, aws-lc-rs on desktop: 1.56 µs, 1.69× the fastest +AES-256-GCM seal, 16 KB, aws-lc-rs on nixos2: 3.30 µs, 1.03× the fastest +AES-256-GCM seal, 16 KB, aws-lc-rs on kixtop: 1.72 µs, 1.00× the fastest +AES-256-GCM seal, 16 KB, aws-lc-rs on ovh-iad: 5.46 µs, 1.05× the fastest +AES-256-GCM seal, 16 KB, aws-lc-rs on ovh-sea: 5.08 µs, 1.02× the fastest +AES-256-GCM seal, 16 KB, ring on nixos: 1.53 µs, 1.01× the fastest +AES-256-GCM seal, 16 KB, ring on desktop: 946 ns, 1.02× the fastest +AES-256-GCM seal, 16 KB, ring on nixos2: 3.25 µs, 1.01× the fastest +AES-256-GCM seal, 16 KB, ring on kixtop: 2.04 µs, 1.19× the fastest +AES-256-GCM seal, 16 KB, ring on ovh-iad: 5.80 µs, 1.12× the fastest +AES-256-GCM seal, 16 KB, ring on ovh-sea: 4.97 µs, 1.00× the fastest +AES-256-GCM seal, 16 KB, RustCrypto + dalek on nixos: 4.78 µs, 3.16× the fastest +AES-256-GCM seal, 16 KB, RustCrypto + dalek on desktop: 2.91 µs, 3.14× the fastest +AES-256-GCM seal, 16 KB, RustCrypto + dalek on nixos2: 6.45 µs, 2.00× the fastest +AES-256-GCM seal, 16 KB, RustCrypto + dalek on kixtop: 2.72 µs, 1.58× the fastest +AES-256-GCM seal, 16 KB, RustCrypto + dalek on ovh-iad: 10.56 µs, 2.04× the fastest +AES-256-GCM seal, 16 KB, RustCrypto + dalek on ovh-sea: 9.94 µs, 2.00× the fastest +AES-256-GCM seal, 16 KB, graviola on nixos: 2.98 µs, 1.97× the fastest +AES-256-GCM seal, 16 KB, graviola on desktop: 2.46 µs, 2.66× the fastest +AES-256-GCM seal, 16 KB, graviola on nixos2: 4.71 µs, 1.46× the fastest +AES-256-GCM seal, 16 KB, graviola on kixtop: 2.16 µs, 1.26× the fastest +AES-256-GCM seal, 16 KB, libcrux on nixos: 80.61 µs, 53.39× the fastest +AES-256-GCM seal, 16 KB, libcrux on desktop: 32.69 µs, 35.34× the fastest +AES-256-GCM seal, 16 KB, libcrux on nixos2: 50.92 µs, 15.81× the fastest +AES-256-GCM seal, 16 KB, libcrux on kixtop: 7.20 µs, 4.19× the fastest +AES-256-GCM seal, 16 KB, libcrux on ovh-iad: 83.14 µs, 16.05× the fastest +AES-256-GCM seal, 16 KB, libcrux on ovh-sea: 78.50 µs, 15.79× the fastest +AES-256-GCM seal, 16 KB, OpenSSL on nixos: 2.82 µs, 1.87× the fastest +AES-256-GCM seal, 16 KB, OpenSSL on desktop: 1.59 µs, 1.72× the fastest +AES-256-GCM seal, 16 KB, OpenSSL on nixos2: 3.34 µs, 1.04× the fastest +AES-256-GCM seal, 16 KB, OpenSSL on kixtop: 1.79 µs, 1.04× the fastest +AES-256-GCM seal, 16 KB, OpenSSL on ovh-iad: 5.20 µs, 1.00× the fastest +AES-256-GCM seal, 16 KB, OpenSSL on ovh-sea: 5.15 µs, 1.04× the fastest AES-256-GCM open, 32 B AES-256-GCM open, 32 B, rind on nixos: 48 ns, 1.00× the fastest AES-256-GCM open, 32 B, rind on desktop: 28 ns, 1.00× the fastest AES-256-GCM open, 32 B, rind on nixos2: 45 ns, 1.00× the fastest; verified: rind's Lean proof, through Aeneas and hand models of the function-pointer dispatch, of the AES-NI key expansion and block cipher's raw-pointer loads, and of the SIMD intrinsics as Intel's manual defines them, of its AEAD API's AES-GCM key setup, seal, and open, for AAD and messages under 2^32 bytes, down to HACL*'s Vale AES-GCM routines, composed with Vale's F* proofs of Gcm_blocks_stdcall, Gcm_blocks_decrypt_stdcall, and Compute_iv_stdcall, of the code Vale prints at HACL* f557259007db, which rind imports ✓ -AES-256-GCM open, 32 B, rind on ovh-iad: 71 ns, 1.00× the fastest; verified: rind's Lean proof, through Aeneas and hand models of the function-pointer dispatch, of the AES-NI key expansion and block cipher's raw-pointer loads, and of the SIMD intrinsics as Intel's manual defines them, of its AEAD API's AES-GCM key setup, seal, and open, for AAD and messages under 2^32 bytes, down to HACL*'s Vale AES-GCM routines, composed with Vale's F* proofs of Gcm_blocks_stdcall, Gcm_blocks_decrypt_stdcall, and Compute_iv_stdcall, of the code Vale prints at HACL* f557259007db, which rind imports -✓ -AES-256-GCM open, 32 B, rind on ovh-sea: 69 ns, 1.00× the fastest; verified: rind's Lean proof, through Aeneas and hand models of the function-pointer dispatch, of the AES-NI key expansion and block cipher's raw-pointer loads, and of the SIMD intrinsics as Intel's manual defines them, of its AEAD API's AES-GCM key setup, seal, and open, for AAD and messages under 2^32 bytes, down to HACL*'s Vale AES-GCM routines, composed with Vale's F* proofs of Gcm_blocks_stdcall, Gcm_blocks_decrypt_stdcall, and Compute_iv_stdcall, of the code Vale prints at HACL* f557259007db, which rind imports +AES-256-GCM open, 32 B, rind on kixtop: 49 ns, 1.24× the fastest +AES-256-GCM open, 32 B, rind on ovh-iad: 71 ns, 1.00× the fastest; verified: rind's Lean proof, through Aeneas and hand models of the function-pointer dispatch, of the AES-NI key expansion and block cipher's raw-pointer loads, and of the SIMD intrinsics as Intel's manual defines them, of its AEAD API's AES-GCM key setup, seal, and open, for AAD and messages under 2^32 bytes, down to HACL*'s Vale AES-GCM routines, composed with Vale's F* proofs of Gcm_blocks_stdcall, Gcm_blocks_decrypt_stdcall, and Compute_iv_stdcall, of the code Vale prints at HACL* f557259007db, which rind imports ✓ -AES-256-GCM open, 32 B, aws-lc-rs on nixos: 79 ns, 1.62× the fastest -AES-256-GCM open, 32 B, aws-lc-rs on desktop: 38 ns, 1.37× the fastest -AES-256-GCM open, 32 B, aws-lc-rs on nixos2: 101 ns, 2.26× the fastest -AES-256-GCM open, 32 B, aws-lc-rs on ovh-iad: 150 ns, 2.10× the fastest -AES-256-GCM open, 32 B, aws-lc-rs on ovh-sea: 147 ns, 2.14× the fastest -AES-256-GCM open, 32 B, ring on nixos: 61 ns, 1.25× the fastest -AES-256-GCM open, 32 B, ring on desktop: 45 ns, 1.61× the fastest -AES-256-GCM open, 32 B, ring on nixos2: 107 ns, 2.39× the fastest -AES-256-GCM open, 32 B, ring on ovh-iad: 129 ns, 1.82× the fastest -AES-256-GCM open, 32 B, ring on ovh-sea: 126 ns, 1.83× the fastest -AES-256-GCM open, 32 B, RustCrypto + dalek on nixos: 109 ns, 2.24× the fastest -AES-256-GCM open, 32 B, RustCrypto + dalek on desktop: 82 ns, 2.98× the fastest -AES-256-GCM open, 32 B, RustCrypto + dalek on nixos2: 118 ns, 2.65× the fastest -AES-256-GCM open, 32 B, RustCrypto + dalek on ovh-iad: 177 ns, 2.49× the fastest -AES-256-GCM open, 32 B, RustCrypto + dalek on ovh-sea: 172 ns, 2.50× the fastest -AES-256-GCM open, 32 B, graviola on nixos: 68 ns, 1.39× the fastest -AES-256-GCM open, 32 B, graviola on desktop: 38 ns, 1.37× the fastest -AES-256-GCM open, 32 B, graviola on nixos2: 73 ns, 1.64× the fastest -AES-256-GCM open, 32 B, libcrux on nixos: 441 ns, 9.10× the fastest -AES-256-GCM open, 32 B, libcrux on desktop: 218 ns, 7.86× the fastest -AES-256-GCM open, 32 B, libcrux on nixos2: 363 ns, 8.12× the fastest -AES-256-GCM open, 32 B, libcrux on ovh-iad: 576 ns, 8.08× the fastest -AES-256-GCM open, 32 B, libcrux on ovh-sea: 563 ns, 8.16× the fastest -AES-256-GCM open, 32 B, OpenSSL on nixos: 122 ns, 2.52× the fastest -AES-256-GCM open, 32 B, OpenSSL on desktop: 62 ns, 2.22× the fastest -AES-256-GCM open, 32 B, OpenSSL on nixos2: 172 ns, 3.84× the fastest -AES-256-GCM open, 32 B, OpenSSL on ovh-iad: 269 ns, 3.78× the fastest -AES-256-GCM open, 32 B, OpenSSL on ovh-sea: 248 ns, 3.60× the fastest +AES-256-GCM open, 32 B, rind on ovh-sea: 69 ns, 1.00× the fastest; verified: rind's Lean proof, through Aeneas and hand models of the function-pointer dispatch, of the AES-NI key expansion and block cipher's raw-pointer loads, and of the SIMD intrinsics as Intel's manual defines them, of its AEAD API's AES-GCM key setup, seal, and open, for AAD and messages under 2^32 bytes, down to HACL*'s Vale AES-GCM routines, composed with Vale's F* proofs of Gcm_blocks_stdcall, Gcm_blocks_decrypt_stdcall, and Compute_iv_stdcall, of the code Vale prints at HACL* f557259007db, which rind imports +✓ +AES-256-GCM open, 32 B, aws-lc-rs on nixos: 79 ns, 1.62× the fastest +AES-256-GCM open, 32 B, aws-lc-rs on desktop: 38 ns, 1.37× the fastest +AES-256-GCM open, 32 B, aws-lc-rs on nixos2: 101 ns, 2.26× the fastest +AES-256-GCM open, 32 B, aws-lc-rs on kixtop: 49 ns, 1.24× the fastest +AES-256-GCM open, 32 B, aws-lc-rs on ovh-iad: 150 ns, 2.10× the fastest +AES-256-GCM open, 32 B, aws-lc-rs on ovh-sea: 147 ns, 2.14× the fastest +AES-256-GCM open, 32 B, ring on nixos: 61 ns, 1.25× the fastest +AES-256-GCM open, 32 B, ring on desktop: 45 ns, 1.61× the fastest +AES-256-GCM open, 32 B, ring on nixos2: 107 ns, 2.39× the fastest +AES-256-GCM open, 32 B, ring on kixtop: 40 ns, 1.00× the fastest +AES-256-GCM open, 32 B, ring on ovh-iad: 129 ns, 1.82× the fastest +AES-256-GCM open, 32 B, ring on ovh-sea: 126 ns, 1.83× the fastest +AES-256-GCM open, 32 B, RustCrypto + dalek on nixos: 109 ns, 2.24× the fastest +AES-256-GCM open, 32 B, RustCrypto + dalek on desktop: 82 ns, 2.98× the fastest +AES-256-GCM open, 32 B, RustCrypto + dalek on nixos2: 118 ns, 2.65× the fastest +AES-256-GCM open, 32 B, RustCrypto + dalek on kixtop: 41 ns, 1.04× the fastest +AES-256-GCM open, 32 B, RustCrypto + dalek on ovh-iad: 177 ns, 2.49× the fastest +AES-256-GCM open, 32 B, RustCrypto + dalek on ovh-sea: 172 ns, 2.50× the fastest +AES-256-GCM open, 32 B, graviola on nixos: 68 ns, 1.39× the fastest +AES-256-GCM open, 32 B, graviola on desktop: 38 ns, 1.37× the fastest +AES-256-GCM open, 32 B, graviola on nixos2: 73 ns, 1.64× the fastest +AES-256-GCM open, 32 B, graviola on kixtop: 85 ns, 2.15× the fastest +AES-256-GCM open, 32 B, libcrux on nixos: 441 ns, 9.10× the fastest +AES-256-GCM open, 32 B, libcrux on desktop: 218 ns, 7.86× the fastest +AES-256-GCM open, 32 B, libcrux on nixos2: 363 ns, 8.12× the fastest +AES-256-GCM open, 32 B, libcrux on kixtop: 67 ns, 1.69× the fastest +AES-256-GCM open, 32 B, libcrux on ovh-iad: 576 ns, 8.08× the fastest +AES-256-GCM open, 32 B, libcrux on ovh-sea: 563 ns, 8.16× the fastest +AES-256-GCM open, 32 B, OpenSSL on nixos: 122 ns, 2.52× the fastest +AES-256-GCM open, 32 B, OpenSSL on desktop: 62 ns, 2.22× the fastest +AES-256-GCM open, 32 B, OpenSSL on nixos2: 172 ns, 3.84× the fastest +AES-256-GCM open, 32 B, OpenSSL on kixtop: 68 ns, 1.71× the fastest +AES-256-GCM open, 32 B, OpenSSL on ovh-iad: 269 ns, 3.78× the fastest +AES-256-GCM open, 32 B, OpenSSL on ovh-sea: 248 ns, 3.60× the fastest AES-256-GCM open, 1350 B AES-256-GCM open, 1350 B, rind on nixos: 192 ns, 1.00× the fastest AES-256-GCM open, 1350 B, rind on desktop: 107 ns, 1.00× the fastest AES-256-GCM open, 1350 B, rind on nixos2: 328 ns, 1.00× the fastest; verified: rind's Lean proof, through Aeneas and hand models of the function-pointer dispatch, of the AES-NI key expansion and block cipher's raw-pointer loads, and of the SIMD intrinsics as Intel's manual defines them, of its AEAD API's AES-GCM key setup, seal, and open, for AAD and messages under 2^32 bytes, down to HACL*'s Vale AES-GCM routines, composed with Vale's F* proofs of Gcm_blocks_stdcall, Gcm_blocks_decrypt_stdcall, and Compute_iv_stdcall, of the code Vale prints at HACL* f557259007db, which rind imports ✓ -AES-256-GCM open, 1350 B, rind on ovh-iad: 497 ns, 1.00× the fastest; verified: rind's Lean proof, through Aeneas and hand models of the function-pointer dispatch, of the AES-NI key expansion and block cipher's raw-pointer loads, and of the SIMD intrinsics as Intel's manual defines them, of its AEAD API's AES-GCM key setup, seal, and open, for AAD and messages under 2^32 bytes, down to HACL*'s Vale AES-GCM routines, composed with Vale's F* proofs of Gcm_blocks_stdcall, Gcm_blocks_decrypt_stdcall, and Compute_iv_stdcall, of the code Vale prints at HACL* f557259007db, which rind imports -✓ -AES-256-GCM open, 1350 B, rind on ovh-sea: 482 ns, 1.00× the fastest; verified: rind's Lean proof, through Aeneas and hand models of the function-pointer dispatch, of the AES-NI key expansion and block cipher's raw-pointer loads, and of the SIMD intrinsics as Intel's manual defines them, of its AEAD API's AES-GCM key setup, seal, and open, for AAD and messages under 2^32 bytes, down to HACL*'s Vale AES-GCM routines, composed with Vale's F* proofs of Gcm_blocks_stdcall, Gcm_blocks_decrypt_stdcall, and Compute_iv_stdcall, of the code Vale prints at HACL* f557259007db, which rind imports +AES-256-GCM open, 1350 B, rind on kixtop: 233 ns, 1.07× the fastest +AES-256-GCM open, 1350 B, rind on ovh-iad: 497 ns, 1.00× the fastest; verified: rind's Lean proof, through Aeneas and hand models of the function-pointer dispatch, of the AES-NI key expansion and block cipher's raw-pointer loads, and of the SIMD intrinsics as Intel's manual defines them, of its AEAD API's AES-GCM key setup, seal, and open, for AAD and messages under 2^32 bytes, down to HACL*'s Vale AES-GCM routines, composed with Vale's F* proofs of Gcm_blocks_stdcall, Gcm_blocks_decrypt_stdcall, and Compute_iv_stdcall, of the code Vale prints at HACL* f557259007db, which rind imports ✓ -AES-256-GCM open, 1350 B, aws-lc-rs on nixos: 322 ns, 1.68× the fastest -AES-256-GCM open, 1350 B, aws-lc-rs on desktop: 173 ns, 1.62× the fastest -AES-256-GCM open, 1350 B, aws-lc-rs on nixos2: 422 ns, 1.29× the fastest -AES-256-GCM open, 1350 B, aws-lc-rs on ovh-iad: 581 ns, 1.17× the fastest -AES-256-GCM open, 1350 B, aws-lc-rs on ovh-sea: 566 ns, 1.17× the fastest -AES-256-GCM open, 1350 B, ring on nixos: 204 ns, 1.06× the fastest -AES-256-GCM open, 1350 B, ring on desktop: 124 ns, 1.16× the fastest -AES-256-GCM open, 1350 B, ring on nixos2: 388 ns, 1.18× the fastest -AES-256-GCM open, 1350 B, ring on ovh-iad: 566 ns, 1.14× the fastest -AES-256-GCM open, 1350 B, ring on ovh-sea: 544 ns, 1.13× the fastest -AES-256-GCM open, 1350 B, RustCrypto + dalek on nixos: 508 ns, 2.65× the fastest -AES-256-GCM open, 1350 B, RustCrypto + dalek on desktop: 322 ns, 3.01× the fastest -AES-256-GCM open, 1350 B, RustCrypto + dalek on nixos2: 677 ns, 2.06× the fastest -AES-256-GCM open, 1350 B, RustCrypto + dalek on ovh-iad: 1.01 µs, 2.03× the fastest -AES-256-GCM open, 1350 B, RustCrypto + dalek on ovh-sea: 1000 ns, 2.07× the fastest -AES-256-GCM open, 1350 B, graviola on nixos: 341 ns, 1.78× the fastest -AES-256-GCM open, 1350 B, graviola on desktop: 203 ns, 1.90× the fastest -AES-256-GCM open, 1350 B, graviola on nixos2: 510 ns, 1.56× the fastest -AES-256-GCM open, 1350 B, libcrux on nixos: 6.79 µs, 35.42× the fastest -AES-256-GCM open, 1350 B, libcrux on desktop: 2.85 µs, 26.66× the fastest -AES-256-GCM open, 1350 B, libcrux on nixos2: 4.74 µs, 14.46× the fastest -AES-256-GCM open, 1350 B, libcrux on ovh-iad: 6.90 µs, 13.90× the fastest -AES-256-GCM open, 1350 B, libcrux on ovh-sea: 6.91 µs, 14.32× the fastest -AES-256-GCM open, 1350 B, OpenSSL on nixos: 354 ns, 1.85× the fastest -AES-256-GCM open, 1350 B, OpenSSL on desktop: 189 ns, 1.77× the fastest -AES-256-GCM open, 1350 B, OpenSSL on nixos2: 643 ns, 1.96× the fastest -AES-256-GCM open, 1350 B, OpenSSL on ovh-iad: 673 ns, 1.35× the fastest -AES-256-GCM open, 1350 B, OpenSSL on ovh-sea: 661 ns, 1.37× the fastest +AES-256-GCM open, 1350 B, rind on ovh-sea: 482 ns, 1.00× the fastest; verified: rind's Lean proof, through Aeneas and hand models of the function-pointer dispatch, of the AES-NI key expansion and block cipher's raw-pointer loads, and of the SIMD intrinsics as Intel's manual defines them, of its AEAD API's AES-GCM key setup, seal, and open, for AAD and messages under 2^32 bytes, down to HACL*'s Vale AES-GCM routines, composed with Vale's F* proofs of Gcm_blocks_stdcall, Gcm_blocks_decrypt_stdcall, and Compute_iv_stdcall, of the code Vale prints at HACL* f557259007db, which rind imports +✓ +AES-256-GCM open, 1350 B, aws-lc-rs on nixos: 322 ns, 1.68× the fastest +AES-256-GCM open, 1350 B, aws-lc-rs on desktop: 173 ns, 1.62× the fastest +AES-256-GCM open, 1350 B, aws-lc-rs on nixos2: 422 ns, 1.29× the fastest +AES-256-GCM open, 1350 B, aws-lc-rs on kixtop: 218 ns, 1.00× the fastest +AES-256-GCM open, 1350 B, aws-lc-rs on ovh-iad: 581 ns, 1.17× the fastest +AES-256-GCM open, 1350 B, aws-lc-rs on ovh-sea: 566 ns, 1.17× the fastest +AES-256-GCM open, 1350 B, ring on nixos: 204 ns, 1.06× the fastest +AES-256-GCM open, 1350 B, ring on desktop: 124 ns, 1.16× the fastest +AES-256-GCM open, 1350 B, ring on nixos2: 388 ns, 1.18× the fastest +AES-256-GCM open, 1350 B, ring on kixtop: 252 ns, 1.15× the fastest +AES-256-GCM open, 1350 B, ring on ovh-iad: 566 ns, 1.14× the fastest +AES-256-GCM open, 1350 B, ring on ovh-sea: 544 ns, 1.13× the fastest +AES-256-GCM open, 1350 B, RustCrypto + dalek on nixos: 508 ns, 2.65× the fastest +AES-256-GCM open, 1350 B, RustCrypto + dalek on desktop: 322 ns, 3.01× the fastest +AES-256-GCM open, 1350 B, RustCrypto + dalek on nixos2: 677 ns, 2.06× the fastest +AES-256-GCM open, 1350 B, RustCrypto + dalek on kixtop: 267 ns, 1.22× the fastest +AES-256-GCM open, 1350 B, RustCrypto + dalek on ovh-iad: 1.01 µs, 2.03× the fastest +AES-256-GCM open, 1350 B, RustCrypto + dalek on ovh-sea: 1000 ns, 2.07× the fastest +AES-256-GCM open, 1350 B, graviola on nixos: 341 ns, 1.78× the fastest +AES-256-GCM open, 1350 B, graviola on desktop: 203 ns, 1.90× the fastest +AES-256-GCM open, 1350 B, graviola on nixos2: 510 ns, 1.56× the fastest +AES-256-GCM open, 1350 B, graviola on kixtop: 263 ns, 1.20× the fastest +AES-256-GCM open, 1350 B, libcrux on nixos: 6.79 µs, 35.42× the fastest +AES-256-GCM open, 1350 B, libcrux on desktop: 2.85 µs, 26.66× the fastest +AES-256-GCM open, 1350 B, libcrux on nixos2: 4.74 µs, 14.46× the fastest +AES-256-GCM open, 1350 B, libcrux on kixtop: 674 ns, 3.09× the fastest +AES-256-GCM open, 1350 B, libcrux on ovh-iad: 6.90 µs, 13.90× the fastest +AES-256-GCM open, 1350 B, libcrux on ovh-sea: 6.91 µs, 14.32× the fastest +AES-256-GCM open, 1350 B, OpenSSL on nixos: 354 ns, 1.85× the fastest +AES-256-GCM open, 1350 B, OpenSSL on desktop: 189 ns, 1.77× the fastest +AES-256-GCM open, 1350 B, OpenSSL on nixos2: 643 ns, 1.96× the fastest +AES-256-GCM open, 1350 B, OpenSSL on kixtop: 225 ns, 1.03× the fastest +AES-256-GCM open, 1350 B, OpenSSL on ovh-iad: 673 ns, 1.35× the fastest +AES-256-GCM open, 1350 B, OpenSSL on ovh-sea: 661 ns, 1.37× the fastest AES-256-GCM open, 16 KB AES-256-GCM open, 16 KB, rind on nixos: 1.60 µs, 1.00× the fastest AES-256-GCM open, 16 KB, rind on desktop: 917 ns, 1.00× the fastest AES-256-GCM open, 16 KB, rind on nixos2: 3.62 µs, 1.00× the fastest; verified: rind's Lean proof, through Aeneas and hand models of the function-pointer dispatch, of the AES-NI key expansion and block cipher's raw-pointer loads, and of the SIMD intrinsics as Intel's manual defines them, of its AEAD API's AES-GCM key setup, seal, and open, for AAD and messages under 2^32 bytes, down to HACL*'s Vale AES-GCM routines, composed with Vale's F* proofs of Gcm_blocks_stdcall, Gcm_blocks_decrypt_stdcall, and Compute_iv_stdcall, of the code Vale prints at HACL* f557259007db, which rind imports ✓ -AES-256-GCM open, 16 KB, rind on ovh-iad: 5.26 µs, 1.00× the fastest; verified: rind's Lean proof, through Aeneas and hand models of the function-pointer dispatch, of the AES-NI key expansion and block cipher's raw-pointer loads, and of the SIMD intrinsics as Intel's manual defines them, of its AEAD API's AES-GCM key setup, seal, and open, for AAD and messages under 2^32 bytes, down to HACL*'s Vale AES-GCM routines, composed with Vale's F* proofs of Gcm_blocks_stdcall, Gcm_blocks_decrypt_stdcall, and Compute_iv_stdcall, of the code Vale prints at HACL* f557259007db, which rind imports -✓ -AES-256-GCM open, 16 KB, rind on ovh-sea: 5.13 µs, 1.00× the fastest; verified: rind's Lean proof, through Aeneas and hand models of the function-pointer dispatch, of the AES-NI key expansion and block cipher's raw-pointer loads, and of the SIMD intrinsics as Intel's manual defines them, of its AEAD API's AES-GCM key setup, seal, and open, for AAD and messages under 2^32 bytes, down to HACL*'s Vale AES-GCM routines, composed with Vale's F* proofs of Gcm_blocks_stdcall, Gcm_blocks_decrypt_stdcall, and Compute_iv_stdcall, of the code Vale prints at HACL* f557259007db, which rind imports +AES-256-GCM open, 16 KB, rind on kixtop: 1.86 µs, 1.01× the fastest +AES-256-GCM open, 16 KB, rind on ovh-iad: 5.26 µs, 1.00× the fastest; verified: rind's Lean proof, through Aeneas and hand models of the function-pointer dispatch, of the AES-NI key expansion and block cipher's raw-pointer loads, and of the SIMD intrinsics as Intel's manual defines them, of its AEAD API's AES-GCM key setup, seal, and open, for AAD and messages under 2^32 bytes, down to HACL*'s Vale AES-GCM routines, composed with Vale's F* proofs of Gcm_blocks_stdcall, Gcm_blocks_decrypt_stdcall, and Compute_iv_stdcall, of the code Vale prints at HACL* f557259007db, which rind imports ✓ -AES-256-GCM open, 16 KB, aws-lc-rs on nixos: 2.92 µs, 1.82× the fastest -AES-256-GCM open, 16 KB, aws-lc-rs on desktop: 1.57 µs, 1.71× the fastest -AES-256-GCM open, 16 KB, aws-lc-rs on nixos2: 3.69 µs, 1.02× the fastest -AES-256-GCM open, 16 KB, aws-lc-rs on ovh-iad: 5.35 µs, 1.02× the fastest -AES-256-GCM open, 16 KB, aws-lc-rs on ovh-sea: 5.25 µs, 1.02× the fastest -AES-256-GCM open, 16 KB, ring on nixos: 1.62 µs, 1.01× the fastest -AES-256-GCM open, 16 KB, ring on desktop: 921 ns, 1.00× the fastest -AES-256-GCM open, 16 KB, ring on nixos2: 3.70 µs, 1.02× the fastest -AES-256-GCM open, 16 KB, ring on ovh-iad: 5.38 µs, 1.02× the fastest -AES-256-GCM open, 16 KB, ring on ovh-sea: 5.23 µs, 1.02× the fastest -AES-256-GCM open, 16 KB, RustCrypto + dalek on nixos: 4.93 µs, 3.08× the fastest -AES-256-GCM open, 16 KB, RustCrypto + dalek on desktop: 2.96 µs, 3.23× the fastest -AES-256-GCM open, 16 KB, RustCrypto + dalek on nixos2: 7.23 µs, 2.00× the fastest -AES-256-GCM open, 16 KB, RustCrypto + dalek on ovh-iad: 10.17 µs, 1.93× the fastest -AES-256-GCM open, 16 KB, RustCrypto + dalek on ovh-sea: 10.04 µs, 1.96× the fastest -AES-256-GCM open, 16 KB, graviola on nixos: 3.04 µs, 1.90× the fastest -AES-256-GCM open, 16 KB, graviola on desktop: 1.74 µs, 1.90× the fastest -AES-256-GCM open, 16 KB, graviola on nixos2: 4.54 µs, 1.25× the fastest -AES-256-GCM open, 16 KB, libcrux on nixos: 79.19 µs, 49.38× the fastest -AES-256-GCM open, 16 KB, libcrux on desktop: 32.51 µs, 35.44× the fastest -AES-256-GCM open, 16 KB, libcrux on nixos2: 53.96 µs, 14.91× the fastest -AES-256-GCM open, 16 KB, libcrux on ovh-iad: 82.11 µs, 15.61× the fastest -AES-256-GCM open, 16 KB, libcrux on ovh-sea: 78.36 µs, 15.27× the fastest -AES-256-GCM open, 16 KB, OpenSSL on nixos: 2.98 µs, 1.86× the fastest -AES-256-GCM open, 16 KB, OpenSSL on desktop: 1.60 µs, 1.75× the fastest -AES-256-GCM open, 16 KB, OpenSSL on nixos2: 3.87 µs, 1.07× the fastest -AES-256-GCM open, 16 KB, OpenSSL on ovh-iad: 5.83 µs, 1.11× the fastest -AES-256-GCM open, 16 KB, OpenSSL on ovh-sea: 5.43 µs, 1.06× the fastest +AES-256-GCM open, 16 KB, rind on ovh-sea: 5.13 µs, 1.00× the fastest; verified: rind's Lean proof, through Aeneas and hand models of the function-pointer dispatch, of the AES-NI key expansion and block cipher's raw-pointer loads, and of the SIMD intrinsics as Intel's manual defines them, of its AEAD API's AES-GCM key setup, seal, and open, for AAD and messages under 2^32 bytes, down to HACL*'s Vale AES-GCM routines, composed with Vale's F* proofs of Gcm_blocks_stdcall, Gcm_blocks_decrypt_stdcall, and Compute_iv_stdcall, of the code Vale prints at HACL* f557259007db, which rind imports +✓ +AES-256-GCM open, 16 KB, aws-lc-rs on nixos: 2.92 µs, 1.82× the fastest +AES-256-GCM open, 16 KB, aws-lc-rs on desktop: 1.57 µs, 1.71× the fastest +AES-256-GCM open, 16 KB, aws-lc-rs on nixos2: 3.69 µs, 1.02× the fastest +AES-256-GCM open, 16 KB, aws-lc-rs on kixtop: 1.83 µs, 1.00× the fastest +AES-256-GCM open, 16 KB, aws-lc-rs on ovh-iad: 5.35 µs, 1.02× the fastest +AES-256-GCM open, 16 KB, aws-lc-rs on ovh-sea: 5.25 µs, 1.02× the fastest +AES-256-GCM open, 16 KB, ring on nixos: 1.62 µs, 1.01× the fastest +AES-256-GCM open, 16 KB, ring on desktop: 921 ns, 1.00× the fastest +AES-256-GCM open, 16 KB, ring on nixos2: 3.70 µs, 1.02× the fastest +AES-256-GCM open, 16 KB, ring on kixtop: 2.25 µs, 1.23× the fastest +AES-256-GCM open, 16 KB, ring on ovh-iad: 5.38 µs, 1.02× the fastest +AES-256-GCM open, 16 KB, ring on ovh-sea: 5.23 µs, 1.02× the fastest +AES-256-GCM open, 16 KB, RustCrypto + dalek on nixos: 4.93 µs, 3.08× the fastest +AES-256-GCM open, 16 KB, RustCrypto + dalek on desktop: 2.96 µs, 3.23× the fastest +AES-256-GCM open, 16 KB, RustCrypto + dalek on nixos2: 7.23 µs, 2.00× the fastest +AES-256-GCM open, 16 KB, RustCrypto + dalek on kixtop: 2.89 µs, 1.58× the fastest +AES-256-GCM open, 16 KB, RustCrypto + dalek on ovh-iad: 10.17 µs, 1.93× the fastest +AES-256-GCM open, 16 KB, RustCrypto + dalek on ovh-sea: 10.04 µs, 1.96× the fastest +AES-256-GCM open, 16 KB, graviola on nixos: 3.04 µs, 1.90× the fastest +AES-256-GCM open, 16 KB, graviola on desktop: 1.74 µs, 1.90× the fastest +AES-256-GCM open, 16 KB, graviola on nixos2: 4.54 µs, 1.25× the fastest +AES-256-GCM open, 16 KB, graviola on kixtop: 2.18 µs, 1.19× the fastest +AES-256-GCM open, 16 KB, libcrux on nixos: 79.19 µs, 49.38× the fastest +AES-256-GCM open, 16 KB, libcrux on desktop: 32.51 µs, 35.44× the fastest +AES-256-GCM open, 16 KB, libcrux on nixos2: 53.96 µs, 14.91× the fastest +AES-256-GCM open, 16 KB, libcrux on kixtop: 7.35 µs, 4.01× the fastest +AES-256-GCM open, 16 KB, libcrux on ovh-iad: 82.11 µs, 15.61× the fastest +AES-256-GCM open, 16 KB, libcrux on ovh-sea: 78.36 µs, 15.27× the fastest +AES-256-GCM open, 16 KB, OpenSSL on nixos: 2.98 µs, 1.86× the fastest +AES-256-GCM open, 16 KB, OpenSSL on desktop: 1.60 µs, 1.75× the fastest +AES-256-GCM open, 16 KB, OpenSSL on nixos2: 3.87 µs, 1.07× the fastest +AES-256-GCM open, 16 KB, OpenSSL on kixtop: 1.94 µs, 1.06× the fastest +AES-256-GCM open, 16 KB, OpenSSL on ovh-iad: 5.83 µs, 1.11× the fastest +AES-256-GCM open, 16 KB, OpenSSL on ovh-sea: 5.43 µs, 1.06× the fastest ChaCha20-Poly1305 seal, 32 B ChaCha20-Poly1305 seal, 32 B, rind on nixos: 114 ns, 1.01× the fastest ChaCha20-Poly1305 seal, 32 B, rind on desktop: 100 ns, 1.00× the fastest ChaCha20-Poly1305 seal, 32 B, rind on nixos2: 129 ns, 1.00× the fastest -ChaCha20-Poly1305 seal, 32 B, rind on ovh-iad: 192 ns, 1.00× the fastest -ChaCha20-Poly1305 seal, 32 B, rind on ovh-sea: 188 ns, 1.00× the fastest -ChaCha20-Poly1305 seal, 32 B, aws-lc-rs on nixos: 119 ns, 1.06× the fastest -ChaCha20-Poly1305 seal, 32 B, aws-lc-rs on desktop: 105 ns, 1.05× the fastest -ChaCha20-Poly1305 seal, 32 B, aws-lc-rs on nixos2: 149 ns, 1.15× the fastest -ChaCha20-Poly1305 seal, 32 B, aws-lc-rs on ovh-iad: 215 ns, 1.12× the fastest -ChaCha20-Poly1305 seal, 32 B, aws-lc-rs on ovh-sea: 210 ns, 1.11× the fastest -ChaCha20-Poly1305 seal, 32 B, ring on nixos: 113 ns, 1.00× the fastest -ChaCha20-Poly1305 seal, 32 B, ring on desktop: 101 ns, 1.01× the fastest -ChaCha20-Poly1305 seal, 32 B, ring on nixos2: 130 ns, 1.01× the fastest -ChaCha20-Poly1305 seal, 32 B, ring on ovh-iad: 196 ns, 1.02× the fastest -ChaCha20-Poly1305 seal, 32 B, ring on ovh-sea: 189 ns, 1.00× the fastest -ChaCha20-Poly1305 seal, 32 B, RustCrypto + dalek on nixos: 1.18 µs, 10.48× the fastest -ChaCha20-Poly1305 seal, 32 B, RustCrypto + dalek on desktop: 1.07 µs, 10.75× the fastest -ChaCha20-Poly1305 seal, 32 B, RustCrypto + dalek on nixos2: 1.21 µs, 9.37× the fastest -ChaCha20-Poly1305 seal, 32 B, RustCrypto + dalek on ovh-iad: 1.84 µs, 9.54× the fastest -ChaCha20-Poly1305 seal, 32 B, RustCrypto + dalek on ovh-sea: 1.75 µs, 9.29× the fastest -ChaCha20-Poly1305 seal, 32 B, graviola on nixos: 216 ns, 1.92× the fastest -ChaCha20-Poly1305 seal, 32 B, graviola on desktop: 180 ns, 1.80× the fastest -ChaCha20-Poly1305 seal, 32 B, graviola on nixos2: 232 ns, 1.80× the fastest -ChaCha20-Poly1305 seal, 32 B, libcrux on nixos: 220 ns, 1.96× the fastest; verified: HACL*'s F* proof of Hacl.Chacha20Poly1305_32, compiled to Rust by an unverified step -✓ -ChaCha20-Poly1305 seal, 32 B, libcrux on desktop: 157 ns, 1.57× the fastest; verified: HACL*'s F* proof of Hacl.Chacha20Poly1305_32, compiled to Rust by an unverified step -✓ -ChaCha20-Poly1305 seal, 32 B, libcrux on nixos2: 301 ns, 2.33× the fastest; verified: HACL*'s F* proof of Hacl.Chacha20Poly1305_32, compiled to Rust by an unverified step -✓ -ChaCha20-Poly1305 seal, 32 B, libcrux on ovh-iad: 428 ns, 2.22× the fastest; verified: HACL*'s F* proof of Hacl.Chacha20Poly1305_32, compiled to Rust by an unverified step -✓ -ChaCha20-Poly1305 seal, 32 B, libcrux on ovh-sea: 416 ns, 2.21× the fastest; verified: HACL*'s F* proof of Hacl.Chacha20Poly1305_32, compiled to Rust by an unverified step -✓ -ChaCha20-Poly1305 seal, 32 B, OpenSSL on nixos: 257 ns, 2.29× the fastest -ChaCha20-Poly1305 seal, 32 B, OpenSSL on desktop: 177 ns, 1.77× the fastest -ChaCha20-Poly1305 seal, 32 B, OpenSSL on nixos2: 337 ns, 2.61× the fastest -ChaCha20-Poly1305 seal, 32 B, OpenSSL on ovh-iad: 526 ns, 2.73× the fastest -ChaCha20-Poly1305 seal, 32 B, OpenSSL on ovh-sea: 489 ns, 2.59× the fastest +ChaCha20-Poly1305 seal, 32 B, rind on kixtop: 185 ns, 1.25× the fastest +ChaCha20-Poly1305 seal, 32 B, rind on ovh-iad: 192 ns, 1.00× the fastest +ChaCha20-Poly1305 seal, 32 B, rind on ovh-sea: 188 ns, 1.00× the fastest +ChaCha20-Poly1305 seal, 32 B, aws-lc-rs on nixos: 119 ns, 1.06× the fastest +ChaCha20-Poly1305 seal, 32 B, aws-lc-rs on desktop: 105 ns, 1.05× the fastest +ChaCha20-Poly1305 seal, 32 B, aws-lc-rs on nixos2: 149 ns, 1.15× the fastest +ChaCha20-Poly1305 seal, 32 B, aws-lc-rs on kixtop: 163 ns, 1.10× the fastest +ChaCha20-Poly1305 seal, 32 B, aws-lc-rs on ovh-iad: 215 ns, 1.12× the fastest +ChaCha20-Poly1305 seal, 32 B, aws-lc-rs on ovh-sea: 210 ns, 1.11× the fastest +ChaCha20-Poly1305 seal, 32 B, ring on nixos: 113 ns, 1.00× the fastest +ChaCha20-Poly1305 seal, 32 B, ring on desktop: 101 ns, 1.01× the fastest +ChaCha20-Poly1305 seal, 32 B, ring on nixos2: 130 ns, 1.01× the fastest +ChaCha20-Poly1305 seal, 32 B, ring on kixtop: 148 ns, 1.00× the fastest +ChaCha20-Poly1305 seal, 32 B, ring on ovh-iad: 196 ns, 1.02× the fastest +ChaCha20-Poly1305 seal, 32 B, ring on ovh-sea: 189 ns, 1.00× the fastest +ChaCha20-Poly1305 seal, 32 B, RustCrypto + dalek on nixos: 1.18 µs, 10.48× the fastest +ChaCha20-Poly1305 seal, 32 B, RustCrypto + dalek on desktop: 1.07 µs, 10.75× the fastest +ChaCha20-Poly1305 seal, 32 B, RustCrypto + dalek on nixos2: 1.21 µs, 9.37× the fastest +ChaCha20-Poly1305 seal, 32 B, RustCrypto + dalek on kixtop: 344 ns, 2.33× the fastest +ChaCha20-Poly1305 seal, 32 B, RustCrypto + dalek on ovh-iad: 1.84 µs, 9.54× the fastest +ChaCha20-Poly1305 seal, 32 B, RustCrypto + dalek on ovh-sea: 1.75 µs, 9.29× the fastest +ChaCha20-Poly1305 seal, 32 B, graviola on nixos: 216 ns, 1.92× the fastest +ChaCha20-Poly1305 seal, 32 B, graviola on desktop: 180 ns, 1.80× the fastest +ChaCha20-Poly1305 seal, 32 B, graviola on nixos2: 232 ns, 1.80× the fastest +ChaCha20-Poly1305 seal, 32 B, graviola on kixtop: 196 ns, 1.32× the fastest +ChaCha20-Poly1305 seal, 32 B, libcrux on nixos: 220 ns, 1.96× the fastest; verified: HACL*'s F* proof of Hacl.Chacha20Poly1305_32, compiled to Rust by an unverified step +✓ +ChaCha20-Poly1305 seal, 32 B, libcrux on desktop: 157 ns, 1.57× the fastest; verified: HACL*'s F* proof of Hacl.Chacha20Poly1305_32, compiled to Rust by an unverified step +✓ +ChaCha20-Poly1305 seal, 32 B, libcrux on nixos2: 301 ns, 2.33× the fastest; verified: HACL*'s F* proof of Hacl.Chacha20Poly1305_32, compiled to Rust by an unverified step +✓ +ChaCha20-Poly1305 seal, 32 B, libcrux on kixtop: 171 ns, 1.16× the fastest; verified: HACL*'s F* proof of Hacl.Chacha20Poly1305_32, compiled to Rust by an unverified step +✓ +ChaCha20-Poly1305 seal, 32 B, libcrux on ovh-iad: 428 ns, 2.22× the fastest; verified: HACL*'s F* proof of Hacl.Chacha20Poly1305_32, compiled to Rust by an unverified step +✓ +ChaCha20-Poly1305 seal, 32 B, libcrux on ovh-sea: 416 ns, 2.21× the fastest; verified: HACL*'s F* proof of Hacl.Chacha20Poly1305_32, compiled to Rust by an unverified step +✓ +ChaCha20-Poly1305 seal, 32 B, OpenSSL on nixos: 257 ns, 2.29× the fastest +ChaCha20-Poly1305 seal, 32 B, OpenSSL on desktop: 177 ns, 1.77× the fastest +ChaCha20-Poly1305 seal, 32 B, OpenSSL on nixos2: 337 ns, 2.61× the fastest +ChaCha20-Poly1305 seal, 32 B, OpenSSL on kixtop: 215 ns, 1.46× the fastest +ChaCha20-Poly1305 seal, 32 B, OpenSSL on ovh-iad: 526 ns, 2.73× the fastest +ChaCha20-Poly1305 seal, 32 B, OpenSSL on ovh-sea: 489 ns, 2.59× the fastest ChaCha20-Poly1305 seal, 1350 B ChaCha20-Poly1305 seal, 1350 B, rind on nixos: 533 ns, 1.01× the fastest ChaCha20-Poly1305 seal, 1350 B, rind on desktop: 441 ns, 1.00× the fastest ChaCha20-Poly1305 seal, 1350 B, rind on nixos2: 718 ns, 1.00× the fastest -ChaCha20-Poly1305 seal, 1350 B, rind on ovh-iad: 1.07 µs, 1.00× the fastest -ChaCha20-Poly1305 seal, 1350 B, rind on ovh-sea: 1.04 µs, 1.00× the fastest -ChaCha20-Poly1305 seal, 1350 B, aws-lc-rs on nixos: 532 ns, 1.01× the fastest -ChaCha20-Poly1305 seal, 1350 B, aws-lc-rs on desktop: 453 ns, 1.03× the fastest -ChaCha20-Poly1305 seal, 1350 B, aws-lc-rs on nixos2: 755 ns, 1.06× the fastest -ChaCha20-Poly1305 seal, 1350 B, aws-lc-rs on ovh-iad: 1.10 µs, 1.03× the fastest -ChaCha20-Poly1305 seal, 1350 B, aws-lc-rs on ovh-sea: 1.05 µs, 1.02× the fastest -ChaCha20-Poly1305 seal, 1350 B, ring on nixos: 527 ns, 1.00× the fastest -ChaCha20-Poly1305 seal, 1350 B, ring on desktop: 447 ns, 1.01× the fastest -ChaCha20-Poly1305 seal, 1350 B, ring on nixos2: 714 ns, 1.00× the fastest -ChaCha20-Poly1305 seal, 1350 B, ring on ovh-iad: 1.08 µs, 1.00× the fastest -ChaCha20-Poly1305 seal, 1350 B, ring on ovh-sea: 1.04 µs, 1.00× the fastest -ChaCha20-Poly1305 seal, 1350 B, RustCrypto + dalek on nixos: 1.93 µs, 3.65× the fastest -ChaCha20-Poly1305 seal, 1350 B, RustCrypto + dalek on desktop: 1.67 µs, 3.79× the fastest -ChaCha20-Poly1305 seal, 1350 B, RustCrypto + dalek on nixos2: 2.18 µs, 3.05× the fastest -ChaCha20-Poly1305 seal, 1350 B, RustCrypto + dalek on ovh-iad: 3.26 µs, 3.04× the fastest -ChaCha20-Poly1305 seal, 1350 B, RustCrypto + dalek on ovh-sea: 3.15 µs, 3.04× the fastest -ChaCha20-Poly1305 seal, 1350 B, graviola on nixos: 1.08 µs, 2.05× the fastest -ChaCha20-Poly1305 seal, 1350 B, graviola on desktop: 905 ns, 2.05× the fastest -ChaCha20-Poly1305 seal, 1350 B, graviola on nixos2: 1.29 µs, 1.81× the fastest -ChaCha20-Poly1305 seal, 1350 B, libcrux on nixos: 2.34 µs, 4.43× the fastest; verified: HACL*'s F* proof of Hacl.Chacha20Poly1305_32, compiled to Rust by an unverified step -✓ -ChaCha20-Poly1305 seal, 1350 B, libcrux on desktop: 1.78 µs, 4.03× the fastest; verified: HACL*'s F* proof of Hacl.Chacha20Poly1305_32, compiled to Rust by an unverified step -✓ -ChaCha20-Poly1305 seal, 1350 B, libcrux on nixos2: 3.16 µs, 4.43× the fastest; verified: HACL*'s F* proof of Hacl.Chacha20Poly1305_32, compiled to Rust by an unverified step -✓ -ChaCha20-Poly1305 seal, 1350 B, libcrux on ovh-iad: 4.73 µs, 4.40× the fastest; verified: HACL*'s F* proof of Hacl.Chacha20Poly1305_32, compiled to Rust by an unverified step -✓ -ChaCha20-Poly1305 seal, 1350 B, libcrux on ovh-sea: 4.60 µs, 4.43× the fastest; verified: HACL*'s F* proof of Hacl.Chacha20Poly1305_32, compiled to Rust by an unverified step -✓ -ChaCha20-Poly1305 seal, 1350 B, OpenSSL on nixos: 745 ns, 1.41× the fastest -ChaCha20-Poly1305 seal, 1350 B, OpenSSL on desktop: 590 ns, 1.34× the fastest -ChaCha20-Poly1305 seal, 1350 B, OpenSSL on nixos2: 971 ns, 1.36× the fastest -ChaCha20-Poly1305 seal, 1350 B, OpenSSL on ovh-iad: 1.68 µs, 1.57× the fastest -ChaCha20-Poly1305 seal, 1350 B, OpenSSL on ovh-sea: 1.58 µs, 1.53× the fastest +ChaCha20-Poly1305 seal, 1350 B, rind on kixtop: 792 ns, 1.05× the fastest +ChaCha20-Poly1305 seal, 1350 B, rind on ovh-iad: 1.07 µs, 1.00× the fastest +ChaCha20-Poly1305 seal, 1350 B, rind on ovh-sea: 1.04 µs, 1.00× the fastest +ChaCha20-Poly1305 seal, 1350 B, aws-lc-rs on nixos: 532 ns, 1.01× the fastest +ChaCha20-Poly1305 seal, 1350 B, aws-lc-rs on desktop: 453 ns, 1.03× the fastest +ChaCha20-Poly1305 seal, 1350 B, aws-lc-rs on nixos2: 755 ns, 1.06× the fastest +ChaCha20-Poly1305 seal, 1350 B, aws-lc-rs on kixtop: 771 ns, 1.02× the fastest +ChaCha20-Poly1305 seal, 1350 B, aws-lc-rs on ovh-iad: 1.10 µs, 1.03× the fastest +ChaCha20-Poly1305 seal, 1350 B, aws-lc-rs on ovh-sea: 1.05 µs, 1.02× the fastest +ChaCha20-Poly1305 seal, 1350 B, ring on nixos: 527 ns, 1.00× the fastest +ChaCha20-Poly1305 seal, 1350 B, ring on desktop: 447 ns, 1.01× the fastest +ChaCha20-Poly1305 seal, 1350 B, ring on nixos2: 714 ns, 1.00× the fastest +ChaCha20-Poly1305 seal, 1350 B, ring on kixtop: 755 ns, 1.00× the fastest +ChaCha20-Poly1305 seal, 1350 B, ring on ovh-iad: 1.08 µs, 1.00× the fastest +ChaCha20-Poly1305 seal, 1350 B, ring on ovh-sea: 1.04 µs, 1.00× the fastest +ChaCha20-Poly1305 seal, 1350 B, RustCrypto + dalek on nixos: 1.93 µs, 3.65× the fastest +ChaCha20-Poly1305 seal, 1350 B, RustCrypto + dalek on desktop: 1.67 µs, 3.79× the fastest +ChaCha20-Poly1305 seal, 1350 B, RustCrypto + dalek on nixos2: 2.18 µs, 3.05× the fastest +ChaCha20-Poly1305 seal, 1350 B, RustCrypto + dalek on kixtop: 1.78 µs, 2.36× the fastest +ChaCha20-Poly1305 seal, 1350 B, RustCrypto + dalek on ovh-iad: 3.26 µs, 3.04× the fastest +ChaCha20-Poly1305 seal, 1350 B, RustCrypto + dalek on ovh-sea: 3.15 µs, 3.04× the fastest +ChaCha20-Poly1305 seal, 1350 B, graviola on nixos: 1.08 µs, 2.05× the fastest +ChaCha20-Poly1305 seal, 1350 B, graviola on desktop: 905 ns, 2.05× the fastest +ChaCha20-Poly1305 seal, 1350 B, graviola on nixos2: 1.29 µs, 1.81× the fastest +ChaCha20-Poly1305 seal, 1350 B, graviola on kixtop: 1.25 µs, 1.65× the fastest +ChaCha20-Poly1305 seal, 1350 B, libcrux on nixos: 2.34 µs, 4.43× the fastest; verified: HACL*'s F* proof of Hacl.Chacha20Poly1305_32, compiled to Rust by an unverified step +✓ +ChaCha20-Poly1305 seal, 1350 B, libcrux on desktop: 1.78 µs, 4.03× the fastest; verified: HACL*'s F* proof of Hacl.Chacha20Poly1305_32, compiled to Rust by an unverified step +✓ +ChaCha20-Poly1305 seal, 1350 B, libcrux on nixos2: 3.16 µs, 4.43× the fastest; verified: HACL*'s F* proof of Hacl.Chacha20Poly1305_32, compiled to Rust by an unverified step +✓ +ChaCha20-Poly1305 seal, 1350 B, libcrux on kixtop: 1.98 µs, 2.62× the fastest; verified: HACL*'s F* proof of Hacl.Chacha20Poly1305_32, compiled to Rust by an unverified step +✓ +ChaCha20-Poly1305 seal, 1350 B, libcrux on ovh-iad: 4.73 µs, 4.40× the fastest; verified: HACL*'s F* proof of Hacl.Chacha20Poly1305_32, compiled to Rust by an unverified step +✓ +ChaCha20-Poly1305 seal, 1350 B, libcrux on ovh-sea: 4.60 µs, 4.43× the fastest; verified: HACL*'s F* proof of Hacl.Chacha20Poly1305_32, compiled to Rust by an unverified step +✓ +ChaCha20-Poly1305 seal, 1350 B, OpenSSL on nixos: 745 ns, 1.41× the fastest +ChaCha20-Poly1305 seal, 1350 B, OpenSSL on desktop: 590 ns, 1.34× the fastest +ChaCha20-Poly1305 seal, 1350 B, OpenSSL on nixos2: 971 ns, 1.36× the fastest +ChaCha20-Poly1305 seal, 1350 B, OpenSSL on kixtop: 842 ns, 1.12× the fastest +ChaCha20-Poly1305 seal, 1350 B, OpenSSL on ovh-iad: 1.68 µs, 1.57× the fastest +ChaCha20-Poly1305 seal, 1350 B, OpenSSL on ovh-sea: 1.58 µs, 1.53× the fastest ChaCha20-Poly1305 seal, 16 KB ChaCha20-Poly1305 seal, 16 KB, rind on nixos: 4.68 µs, 1.00× the fastest ChaCha20-Poly1305 seal, 16 KB, rind on desktop: 4.17 µs, 1.01× the fastest ChaCha20-Poly1305 seal, 16 KB, rind on nixos2: 6.81 µs, 1.03× the fastest -ChaCha20-Poly1305 seal, 16 KB, rind on ovh-iad: 9.85 µs, 1.00× the fastest -ChaCha20-Poly1305 seal, 16 KB, rind on ovh-sea: 9.56 µs, 1.00× the fastest -ChaCha20-Poly1305 seal, 16 KB, aws-lc-rs on nixos: 4.78 µs, 1.02× the fastest -ChaCha20-Poly1305 seal, 16 KB, aws-lc-rs on desktop: 4.15 µs, 1.00× the fastest -ChaCha20-Poly1305 seal, 16 KB, aws-lc-rs on nixos2: 6.63 µs, 1.00× the fastest -ChaCha20-Poly1305 seal, 16 KB, aws-lc-rs on ovh-iad: 9.91 µs, 1.01× the fastest -ChaCha20-Poly1305 seal, 16 KB, aws-lc-rs on ovh-sea: 9.69 µs, 1.01× the fastest -ChaCha20-Poly1305 seal, 16 KB, ring on nixos: 4.68 µs, 1.00× the fastest -ChaCha20-Poly1305 seal, 16 KB, ring on desktop: 4.14 µs, 1.00× the fastest -ChaCha20-Poly1305 seal, 16 KB, ring on nixos2: 6.60 µs, 1.00× the fastest -ChaCha20-Poly1305 seal, 16 KB, ring on ovh-iad: 10.42 µs, 1.06× the fastest -ChaCha20-Poly1305 seal, 16 KB, ring on ovh-sea: 9.93 µs, 1.04× the fastest -ChaCha20-Poly1305 seal, 16 KB, RustCrypto + dalek on nixos: 10.09 µs, 2.16× the fastest -ChaCha20-Poly1305 seal, 16 KB, RustCrypto + dalek on desktop: 8.14 µs, 1.97× the fastest -ChaCha20-Poly1305 seal, 16 KB, RustCrypto + dalek on nixos2: 12.61 µs, 1.91× the fastest -ChaCha20-Poly1305 seal, 16 KB, RustCrypto + dalek on ovh-iad: 18.84 µs, 1.91× the fastest -ChaCha20-Poly1305 seal, 16 KB, RustCrypto + dalek on ovh-sea: 18.34 µs, 1.92× the fastest -ChaCha20-Poly1305 seal, 16 KB, graviola on nixos: 10.15 µs, 2.17× the fastest -ChaCha20-Poly1305 seal, 16 KB, graviola on desktop: 8.30 µs, 2.01× the fastest -ChaCha20-Poly1305 seal, 16 KB, graviola on nixos2: 12.52 µs, 1.90× the fastest -ChaCha20-Poly1305 seal, 16 KB, libcrux on nixos: 26.70 µs, 5.71× the fastest; verified: HACL*'s F* proof of Hacl.Chacha20Poly1305_32, compiled to Rust by an unverified step -✓ -ChaCha20-Poly1305 seal, 16 KB, libcrux on desktop: 19.63 µs, 4.74× the fastest; verified: HACL*'s F* proof of Hacl.Chacha20Poly1305_32, compiled to Rust by an unverified step -✓ -ChaCha20-Poly1305 seal, 16 KB, libcrux on nixos2: 35.52 µs, 5.38× the fastest; verified: HACL*'s F* proof of Hacl.Chacha20Poly1305_32, compiled to Rust by an unverified step -✓ -ChaCha20-Poly1305 seal, 16 KB, libcrux on ovh-iad: 54.85 µs, 5.57× the fastest; verified: HACL*'s F* proof of Hacl.Chacha20Poly1305_32, compiled to Rust by an unverified step -✓ -ChaCha20-Poly1305 seal, 16 KB, libcrux on ovh-sea: 51.63 µs, 5.40× the fastest; verified: HACL*'s F* proof of Hacl.Chacha20Poly1305_32, compiled to Rust by an unverified step -✓ -ChaCha20-Poly1305 seal, 16 KB, OpenSSL on nixos: 5.14 µs, 1.10× the fastest -ChaCha20-Poly1305 seal, 16 KB, OpenSSL on desktop: 4.41 µs, 1.07× the fastest -ChaCha20-Poly1305 seal, 16 KB, OpenSSL on nixos2: 6.64 µs, 1.01× the fastest -ChaCha20-Poly1305 seal, 16 KB, OpenSSL on ovh-iad: 11.10 µs, 1.13× the fastest -ChaCha20-Poly1305 seal, 16 KB, OpenSSL on ovh-sea: 10.83 µs, 1.13× the fastest +ChaCha20-Poly1305 seal, 16 KB, rind on kixtop: 7.70 µs, 1.03× the fastest +ChaCha20-Poly1305 seal, 16 KB, rind on ovh-iad: 9.85 µs, 1.00× the fastest +ChaCha20-Poly1305 seal, 16 KB, rind on ovh-sea: 9.56 µs, 1.00× the fastest +ChaCha20-Poly1305 seal, 16 KB, aws-lc-rs on nixos: 4.78 µs, 1.02× the fastest +ChaCha20-Poly1305 seal, 16 KB, aws-lc-rs on desktop: 4.15 µs, 1.00× the fastest +ChaCha20-Poly1305 seal, 16 KB, aws-lc-rs on nixos2: 6.63 µs, 1.00× the fastest +ChaCha20-Poly1305 seal, 16 KB, aws-lc-rs on kixtop: 7.65 µs, 1.03× the fastest +ChaCha20-Poly1305 seal, 16 KB, aws-lc-rs on ovh-iad: 9.91 µs, 1.01× the fastest +ChaCha20-Poly1305 seal, 16 KB, aws-lc-rs on ovh-sea: 9.69 µs, 1.01× the fastest +ChaCha20-Poly1305 seal, 16 KB, ring on nixos: 4.68 µs, 1.00× the fastest +ChaCha20-Poly1305 seal, 16 KB, ring on desktop: 4.14 µs, 1.00× the fastest +ChaCha20-Poly1305 seal, 16 KB, ring on nixos2: 6.60 µs, 1.00× the fastest +ChaCha20-Poly1305 seal, 16 KB, ring on kixtop: 7.67 µs, 1.03× the fastest +ChaCha20-Poly1305 seal, 16 KB, ring on ovh-iad: 10.42 µs, 1.06× the fastest +ChaCha20-Poly1305 seal, 16 KB, ring on ovh-sea: 9.93 µs, 1.04× the fastest +ChaCha20-Poly1305 seal, 16 KB, RustCrypto + dalek on nixos: 10.09 µs, 2.16× the fastest +ChaCha20-Poly1305 seal, 16 KB, RustCrypto + dalek on desktop: 8.14 µs, 1.97× the fastest +ChaCha20-Poly1305 seal, 16 KB, RustCrypto + dalek on nixos2: 12.61 µs, 1.91× the fastest +ChaCha20-Poly1305 seal, 16 KB, RustCrypto + dalek on kixtop: 15.21 µs, 2.04× the fastest +ChaCha20-Poly1305 seal, 16 KB, RustCrypto + dalek on ovh-iad: 18.84 µs, 1.91× the fastest +ChaCha20-Poly1305 seal, 16 KB, RustCrypto + dalek on ovh-sea: 18.34 µs, 1.92× the fastest +ChaCha20-Poly1305 seal, 16 KB, graviola on nixos: 10.15 µs, 2.17× the fastest +ChaCha20-Poly1305 seal, 16 KB, graviola on desktop: 8.30 µs, 2.01× the fastest +ChaCha20-Poly1305 seal, 16 KB, graviola on nixos2: 12.52 µs, 1.90× the fastest +ChaCha20-Poly1305 seal, 16 KB, graviola on kixtop: 12.85 µs, 1.72× the fastest +ChaCha20-Poly1305 seal, 16 KB, libcrux on nixos: 26.70 µs, 5.71× the fastest; verified: HACL*'s F* proof of Hacl.Chacha20Poly1305_32, compiled to Rust by an unverified step +✓ +ChaCha20-Poly1305 seal, 16 KB, libcrux on desktop: 19.63 µs, 4.74× the fastest; verified: HACL*'s F* proof of Hacl.Chacha20Poly1305_32, compiled to Rust by an unverified step +✓ +ChaCha20-Poly1305 seal, 16 KB, libcrux on nixos2: 35.52 µs, 5.38× the fastest; verified: HACL*'s F* proof of Hacl.Chacha20Poly1305_32, compiled to Rust by an unverified step +✓ +ChaCha20-Poly1305 seal, 16 KB, libcrux on kixtop: 22.07 µs, 2.96× the fastest; verified: HACL*'s F* proof of Hacl.Chacha20Poly1305_32, compiled to Rust by an unverified step +✓ +ChaCha20-Poly1305 seal, 16 KB, libcrux on ovh-iad: 54.85 µs, 5.57× the fastest; verified: HACL*'s F* proof of Hacl.Chacha20Poly1305_32, compiled to Rust by an unverified step +✓ +ChaCha20-Poly1305 seal, 16 KB, libcrux on ovh-sea: 51.63 µs, 5.40× the fastest; verified: HACL*'s F* proof of Hacl.Chacha20Poly1305_32, compiled to Rust by an unverified step +✓ +ChaCha20-Poly1305 seal, 16 KB, OpenSSL on nixos: 5.14 µs, 1.10× the fastest +ChaCha20-Poly1305 seal, 16 KB, OpenSSL on desktop: 4.41 µs, 1.07× the fastest +ChaCha20-Poly1305 seal, 16 KB, OpenSSL on nixos2: 6.64 µs, 1.01× the fastest +ChaCha20-Poly1305 seal, 16 KB, OpenSSL on kixtop: 7.45 µs, 1.00× the fastest +ChaCha20-Poly1305 seal, 16 KB, OpenSSL on ovh-iad: 11.10 µs, 1.13× the fastest +ChaCha20-Poly1305 seal, 16 KB, OpenSSL on ovh-sea: 10.83 µs, 1.13× the fastest XChaCha20-Poly1305 seal, 32 B XChaCha20-Poly1305 seal, 32 B, rind on nixos: 243 ns, 1.00× the fastest XChaCha20-Poly1305 seal, 32 B, rind on desktop: 188 ns, 1.00× the fastest XChaCha20-Poly1305 seal, 32 B, rind on nixos2: 256 ns, 1.00× the fastest -XChaCha20-Poly1305 seal, 32 B, rind on ovh-iad: 419 ns, 1.00× the fastest -XChaCha20-Poly1305 seal, 32 B, rind on ovh-sea: 402 ns, 1.00× the fastest -XChaCha20-Poly1305 seal, 32 B, aws-lc-rs on nixos: 267 ns, 1.10× the fastest -XChaCha20-Poly1305 seal, 32 B, aws-lc-rs on desktop: 199 ns, 1.06× the fastest -XChaCha20-Poly1305 seal, 32 B, aws-lc-rs on nixos2: 278 ns, 1.09× the fastest -XChaCha20-Poly1305 seal, 32 B, aws-lc-rs on ovh-iad: 440 ns, 1.05× the fastest -XChaCha20-Poly1305 seal, 32 B, aws-lc-rs on ovh-sea: 434 ns, 1.08× the fastest -XChaCha20-Poly1305 seal, 32 B, RustCrypto + dalek on nixos: 1.36 µs, 5.60× the fastest -XChaCha20-Poly1305 seal, 32 B, RustCrypto + dalek on desktop: 889 ns, 4.72× the fastest -XChaCha20-Poly1305 seal, 32 B, RustCrypto + dalek on nixos2: 1.27 µs, 4.95× the fastest -XChaCha20-Poly1305 seal, 32 B, RustCrypto + dalek on ovh-iad: 2.02 µs, 4.82× the fastest -XChaCha20-Poly1305 seal, 32 B, RustCrypto + dalek on ovh-sea: 1.98 µs, 4.93× the fastest -XChaCha20-Poly1305 seal, 32 B, graviola on nixos: 357 ns, 1.47× the fastest -XChaCha20-Poly1305 seal, 32 B, graviola on desktop: 259 ns, 1.38× the fastest -XChaCha20-Poly1305 seal, 32 B, graviola on nixos2: 335 ns, 1.31× the fastest -XChaCha20-Poly1305 seal, 32 B, libcrux on nixos: 351 ns, 1.45× the fastest -XChaCha20-Poly1305 seal, 32 B, libcrux on desktop: 248 ns, 1.32× the fastest -XChaCha20-Poly1305 seal, 32 B, libcrux on nixos2: 400 ns, 1.56× the fastest -XChaCha20-Poly1305 seal, 32 B, libcrux on ovh-iad: 685 ns, 1.63× the fastest -XChaCha20-Poly1305 seal, 32 B, libcrux on ovh-sea: 640 ns, 1.59× the fastest +XChaCha20-Poly1305 seal, 32 B, rind on kixtop: 1.19 µs, 1.26× the fastest +XChaCha20-Poly1305 seal, 32 B, rind on ovh-iad: 419 ns, 1.00× the fastest +XChaCha20-Poly1305 seal, 32 B, rind on ovh-sea: 402 ns, 1.00× the fastest +XChaCha20-Poly1305 seal, 32 B, aws-lc-rs on nixos: 267 ns, 1.10× the fastest +XChaCha20-Poly1305 seal, 32 B, aws-lc-rs on desktop: 199 ns, 1.06× the fastest +XChaCha20-Poly1305 seal, 32 B, aws-lc-rs on nixos2: 278 ns, 1.09× the fastest +XChaCha20-Poly1305 seal, 32 B, aws-lc-rs on kixtop: 943 ns, 1.00× the fastest +XChaCha20-Poly1305 seal, 32 B, aws-lc-rs on ovh-iad: 440 ns, 1.05× the fastest +XChaCha20-Poly1305 seal, 32 B, aws-lc-rs on ovh-sea: 434 ns, 1.08× the fastest +XChaCha20-Poly1305 seal, 32 B, RustCrypto + dalek on nixos: 1.36 µs, 5.60× the fastest +XChaCha20-Poly1305 seal, 32 B, RustCrypto + dalek on desktop: 889 ns, 4.72× the fastest +XChaCha20-Poly1305 seal, 32 B, RustCrypto + dalek on nixos2: 1.27 µs, 4.95× the fastest +XChaCha20-Poly1305 seal, 32 B, RustCrypto + dalek on kixtop: 1.53 µs, 1.62× the fastest +XChaCha20-Poly1305 seal, 32 B, RustCrypto + dalek on ovh-iad: 2.02 µs, 4.82× the fastest +XChaCha20-Poly1305 seal, 32 B, RustCrypto + dalek on ovh-sea: 1.98 µs, 4.93× the fastest +XChaCha20-Poly1305 seal, 32 B, graviola on nixos: 357 ns, 1.47× the fastest +XChaCha20-Poly1305 seal, 32 B, graviola on desktop: 259 ns, 1.38× the fastest +XChaCha20-Poly1305 seal, 32 B, graviola on nixos2: 335 ns, 1.31× the fastest +XChaCha20-Poly1305 seal, 32 B, graviola on kixtop: 1.11 µs, 1.17× the fastest +XChaCha20-Poly1305 seal, 32 B, libcrux on nixos: 351 ns, 1.45× the fastest +XChaCha20-Poly1305 seal, 32 B, libcrux on desktop: 248 ns, 1.32× the fastest +XChaCha20-Poly1305 seal, 32 B, libcrux on nixos2: 400 ns, 1.56× the fastest +XChaCha20-Poly1305 seal, 32 B, libcrux on kixtop: 1.11 µs, 1.18× the fastest +XChaCha20-Poly1305 seal, 32 B, libcrux on ovh-iad: 685 ns, 1.63× the fastest +XChaCha20-Poly1305 seal, 32 B, libcrux on ovh-sea: 640 ns, 1.59× the fastest XChaCha20-Poly1305 seal, 1350 B XChaCha20-Poly1305 seal, 1350 B, rind on nixos: 775 ns, 1.07× the fastest XChaCha20-Poly1305 seal, 1350 B, rind on desktop: 838 ns, 1.22× the fastest XChaCha20-Poly1305 seal, 1350 B, rind on nixos2: 804 ns, 1.00× the fastest -XChaCha20-Poly1305 seal, 1350 B, rind on ovh-iad: 1.34 µs, 1.00× the fastest -XChaCha20-Poly1305 seal, 1350 B, rind on ovh-sea: 1.26 µs, 1.00× the fastest -XChaCha20-Poly1305 seal, 1350 B, aws-lc-rs on nixos: 723 ns, 1.00× the fastest -XChaCha20-Poly1305 seal, 1350 B, aws-lc-rs on desktop: 687 ns, 1.00× the fastest -XChaCha20-Poly1305 seal, 1350 B, aws-lc-rs on nixos2: 831 ns, 1.03× the fastest -XChaCha20-Poly1305 seal, 1350 B, aws-lc-rs on ovh-iad: 1.37 µs, 1.02× the fastest -XChaCha20-Poly1305 seal, 1350 B, aws-lc-rs on ovh-sea: 1.29 µs, 1.02× the fastest -XChaCha20-Poly1305 seal, 1350 B, RustCrypto + dalek on nixos: 2.18 µs, 3.01× the fastest -XChaCha20-Poly1305 seal, 1350 B, RustCrypto + dalek on desktop: 1.74 µs, 2.54× the fastest -XChaCha20-Poly1305 seal, 1350 B, RustCrypto + dalek on nixos2: 2.20 µs, 2.74× the fastest -XChaCha20-Poly1305 seal, 1350 B, RustCrypto + dalek on ovh-iad: 3.59 µs, 2.69× the fastest -XChaCha20-Poly1305 seal, 1350 B, RustCrypto + dalek on ovh-sea: 3.40 µs, 2.69× the fastest -XChaCha20-Poly1305 seal, 1350 B, graviola on nixos: 1.31 µs, 1.81× the fastest -XChaCha20-Poly1305 seal, 1350 B, graviola on desktop: 1.35 µs, 1.97× the fastest -XChaCha20-Poly1305 seal, 1350 B, graviola on nixos2: 1.32 µs, 1.64× the fastest -XChaCha20-Poly1305 seal, 1350 B, libcrux on nixos: 2.70 µs, 3.73× the fastest -XChaCha20-Poly1305 seal, 1350 B, libcrux on desktop: 2.56 µs, 3.73× the fastest -XChaCha20-Poly1305 seal, 1350 B, libcrux on nixos2: 3.16 µs, 3.92× the fastest -XChaCha20-Poly1305 seal, 1350 B, libcrux on ovh-iad: 5.18 µs, 3.88× the fastest -XChaCha20-Poly1305 seal, 1350 B, libcrux on ovh-sea: 4.82 µs, 3.81× the fastest +XChaCha20-Poly1305 seal, 1350 B, rind on kixtop: 2.02 µs, 1.07× the fastest +XChaCha20-Poly1305 seal, 1350 B, rind on ovh-iad: 1.34 µs, 1.00× the fastest +XChaCha20-Poly1305 seal, 1350 B, rind on ovh-sea: 1.26 µs, 1.00× the fastest +XChaCha20-Poly1305 seal, 1350 B, aws-lc-rs on nixos: 723 ns, 1.00× the fastest +XChaCha20-Poly1305 seal, 1350 B, aws-lc-rs on desktop: 687 ns, 1.00× the fastest +XChaCha20-Poly1305 seal, 1350 B, aws-lc-rs on nixos2: 831 ns, 1.03× the fastest +XChaCha20-Poly1305 seal, 1350 B, aws-lc-rs on kixtop: 1.89 µs, 1.00× the fastest +XChaCha20-Poly1305 seal, 1350 B, aws-lc-rs on ovh-iad: 1.37 µs, 1.02× the fastest +XChaCha20-Poly1305 seal, 1350 B, aws-lc-rs on ovh-sea: 1.29 µs, 1.02× the fastest +XChaCha20-Poly1305 seal, 1350 B, RustCrypto + dalek on nixos: 2.18 µs, 3.01× the fastest +XChaCha20-Poly1305 seal, 1350 B, RustCrypto + dalek on desktop: 1.74 µs, 2.54× the fastest +XChaCha20-Poly1305 seal, 1350 B, RustCrypto + dalek on nixos2: 2.20 µs, 2.74× the fastest +XChaCha20-Poly1305 seal, 1350 B, RustCrypto + dalek on kixtop: 3.19 µs, 1.69× the fastest +XChaCha20-Poly1305 seal, 1350 B, RustCrypto + dalek on ovh-iad: 3.59 µs, 2.69× the fastest +XChaCha20-Poly1305 seal, 1350 B, RustCrypto + dalek on ovh-sea: 3.40 µs, 2.69× the fastest +XChaCha20-Poly1305 seal, 1350 B, graviola on nixos: 1.31 µs, 1.81× the fastest +XChaCha20-Poly1305 seal, 1350 B, graviola on desktop: 1.35 µs, 1.97× the fastest +XChaCha20-Poly1305 seal, 1350 B, graviola on nixos2: 1.32 µs, 1.64× the fastest +XChaCha20-Poly1305 seal, 1350 B, graviola on kixtop: 2.85 µs, 1.51× the fastest +XChaCha20-Poly1305 seal, 1350 B, libcrux on nixos: 2.70 µs, 3.73× the fastest +XChaCha20-Poly1305 seal, 1350 B, libcrux on desktop: 2.56 µs, 3.73× the fastest +XChaCha20-Poly1305 seal, 1350 B, libcrux on nixos2: 3.16 µs, 3.92× the fastest +XChaCha20-Poly1305 seal, 1350 B, libcrux on kixtop: 3.80 µs, 2.02× the fastest +XChaCha20-Poly1305 seal, 1350 B, libcrux on ovh-iad: 5.18 µs, 3.88× the fastest +XChaCha20-Poly1305 seal, 1350 B, libcrux on ovh-sea: 4.82 µs, 3.81× the fastest XChaCha20-Poly1305 seal, 16 KB XChaCha20-Poly1305 seal, 16 KB, rind on nixos: 5.23 µs, 1.00× the fastest XChaCha20-Poly1305 seal, 16 KB, rind on desktop: 6.26 µs, 1.00× the fastest XChaCha20-Poly1305 seal, 16 KB, rind on nixos2: 6.38 µs, 1.00× the fastest -XChaCha20-Poly1305 seal, 16 KB, rind on ovh-iad: 10.26 µs, 1.00× the fastest -XChaCha20-Poly1305 seal, 16 KB, rind on ovh-sea: 10.02 µs, 1.01× the fastest -XChaCha20-Poly1305 seal, 16 KB, aws-lc-rs on nixos: 5.37 µs, 1.03× the fastest -XChaCha20-Poly1305 seal, 16 KB, aws-lc-rs on desktop: 6.27 µs, 1.00× the fastest -XChaCha20-Poly1305 seal, 16 KB, aws-lc-rs on nixos2: 6.44 µs, 1.01× the fastest -XChaCha20-Poly1305 seal, 16 KB, aws-lc-rs on ovh-iad: 10.47 µs, 1.02× the fastest -XChaCha20-Poly1305 seal, 16 KB, aws-lc-rs on ovh-sea: 9.94 µs, 1.00× the fastest -XChaCha20-Poly1305 seal, 16 KB, RustCrypto + dalek on nixos: 11.38 µs, 2.17× the fastest -XChaCha20-Poly1305 seal, 16 KB, RustCrypto + dalek on desktop: 12.28 µs, 1.96× the fastest -XChaCha20-Poly1305 seal, 16 KB, RustCrypto + dalek on nixos2: 12.04 µs, 1.89× the fastest -XChaCha20-Poly1305 seal, 16 KB, RustCrypto + dalek on ovh-iad: 18.84 µs, 1.84× the fastest -XChaCha20-Poly1305 seal, 16 KB, RustCrypto + dalek on ovh-sea: 18.77 µs, 1.89× the fastest -XChaCha20-Poly1305 seal, 16 KB, graviola on nixos: 10.80 µs, 2.06× the fastest -XChaCha20-Poly1305 seal, 16 KB, graviola on desktop: 12.79 µs, 2.04× the fastest -XChaCha20-Poly1305 seal, 16 KB, graviola on nixos2: 11.86 µs, 1.86× the fastest -XChaCha20-Poly1305 seal, 16 KB, libcrux on nixos: 28.66 µs, 5.48× the fastest -XChaCha20-Poly1305 seal, 16 KB, libcrux on desktop: 27.40 µs, 4.37× the fastest -XChaCha20-Poly1305 seal, 16 KB, libcrux on nixos2: 33.42 µs, 5.23× the fastest -XChaCha20-Poly1305 seal, 16 KB, libcrux on ovh-iad: 54.13 µs, 5.28× the fastest -XChaCha20-Poly1305 seal, 16 KB, libcrux on ovh-sea: 52.01 µs, 5.23× the fastest +XChaCha20-Poly1305 seal, 16 KB, rind on kixtop: 11.36 µs, 1.00× the fastest +XChaCha20-Poly1305 seal, 16 KB, rind on ovh-iad: 10.26 µs, 1.00× the fastest +XChaCha20-Poly1305 seal, 16 KB, rind on ovh-sea: 10.02 µs, 1.01× the fastest +XChaCha20-Poly1305 seal, 16 KB, aws-lc-rs on nixos: 5.37 µs, 1.03× the fastest +XChaCha20-Poly1305 seal, 16 KB, aws-lc-rs on desktop: 6.27 µs, 1.00× the fastest +XChaCha20-Poly1305 seal, 16 KB, aws-lc-rs on nixos2: 6.44 µs, 1.01× the fastest +XChaCha20-Poly1305 seal, 16 KB, aws-lc-rs on kixtop: 11.43 µs, 1.01× the fastest +XChaCha20-Poly1305 seal, 16 KB, aws-lc-rs on ovh-iad: 10.47 µs, 1.02× the fastest +XChaCha20-Poly1305 seal, 16 KB, aws-lc-rs on ovh-sea: 9.94 µs, 1.00× the fastest +XChaCha20-Poly1305 seal, 16 KB, RustCrypto + dalek on nixos: 11.38 µs, 2.17× the fastest +XChaCha20-Poly1305 seal, 16 KB, RustCrypto + dalek on desktop: 12.28 µs, 1.96× the fastest +XChaCha20-Poly1305 seal, 16 KB, RustCrypto + dalek on nixos2: 12.04 µs, 1.89× the fastest +XChaCha20-Poly1305 seal, 16 KB, RustCrypto + dalek on kixtop: 22.76 µs, 2.00× the fastest +XChaCha20-Poly1305 seal, 16 KB, RustCrypto + dalek on ovh-iad: 18.84 µs, 1.84× the fastest +XChaCha20-Poly1305 seal, 16 KB, RustCrypto + dalek on ovh-sea: 18.77 µs, 1.89× the fastest +XChaCha20-Poly1305 seal, 16 KB, graviola on nixos: 10.80 µs, 2.06× the fastest +XChaCha20-Poly1305 seal, 16 KB, graviola on desktop: 12.79 µs, 2.04× the fastest +XChaCha20-Poly1305 seal, 16 KB, graviola on nixos2: 11.86 µs, 1.86× the fastest +XChaCha20-Poly1305 seal, 16 KB, graviola on kixtop: 19.24 µs, 1.69× the fastest +XChaCha20-Poly1305 seal, 16 KB, libcrux on nixos: 28.66 µs, 5.48× the fastest +XChaCha20-Poly1305 seal, 16 KB, libcrux on desktop: 27.40 µs, 4.37× the fastest +XChaCha20-Poly1305 seal, 16 KB, libcrux on nixos2: 33.42 µs, 5.23× the fastest +XChaCha20-Poly1305 seal, 16 KB, libcrux on kixtop: 34.20 µs, 3.01× the fastest +XChaCha20-Poly1305 seal, 16 KB, libcrux on ovh-iad: 54.13 µs, 5.28× the fastest +XChaCha20-Poly1305 seal, 16 KB, libcrux on ovh-sea: 52.01 µs, 5.23× the fastest QUIC header protection - + AES-128 header protection AES-128 header protection, rind on nixos: 4 ns, 1.00× the fastest AES-128 header protection, rind on desktop: 2 ns, 1.00× the fastest AES-128 header protection, rind on nixos2: 5 ns, 1.00× the fastest -AES-128 header protection, rind on ovh-iad: 7 ns, 1.00× the fastest -AES-128 header protection, rind on ovh-sea: 7 ns, 1.00× the fastest -AES-128 header protection, aws-lc-rs on nixos: 6 ns, 1.45× the fastest -AES-128 header protection, aws-lc-rs on desktop: 3 ns, 1.59× the fastest -AES-128 header protection, aws-lc-rs on nixos2: 9 ns, 1.95× the fastest -AES-128 header protection, aws-lc-rs on ovh-iad: 12 ns, 1.66× the fastest -AES-128 header protection, aws-lc-rs on ovh-sea: 11 ns, 1.66× the fastest -AES-128 header protection, ring on nixos: 7 ns, 1.74× the fastest -AES-128 header protection, ring on desktop: 3 ns, 1.68× the fastest -AES-128 header protection, ring on nixos2: 8 ns, 1.73× the fastest -AES-128 header protection, ring on ovh-iad: 13 ns, 1.74× the fastest -AES-128 header protection, ring on ovh-sea: 12 ns, 1.70× the fastest +AES-128 header protection, rind on kixtop: 35 ns, 12.24× the fastest +AES-128 header protection, rind on ovh-iad: 7 ns, 1.00× the fastest +AES-128 header protection, rind on ovh-sea: 7 ns, 1.00× the fastest +AES-128 header protection, aws-lc-rs on nixos: 6 ns, 1.45× the fastest +AES-128 header protection, aws-lc-rs on desktop: 3 ns, 1.59× the fastest +AES-128 header protection, aws-lc-rs on nixos2: 9 ns, 1.95× the fastest +AES-128 header protection, aws-lc-rs on kixtop: 3 ns, 1.00× the fastest +AES-128 header protection, aws-lc-rs on ovh-iad: 12 ns, 1.66× the fastest +AES-128 header protection, aws-lc-rs on ovh-sea: 11 ns, 1.66× the fastest +AES-128 header protection, ring on nixos: 7 ns, 1.74× the fastest +AES-128 header protection, ring on desktop: 3 ns, 1.68× the fastest +AES-128 header protection, ring on nixos2: 8 ns, 1.73× the fastest +AES-128 header protection, ring on kixtop: 3 ns, 1.15× the fastest +AES-128 header protection, ring on ovh-iad: 13 ns, 1.74× the fastest +AES-128 header protection, ring on ovh-sea: 12 ns, 1.70× the fastest AES-256 header protection AES-256 header protection, rind on nixos: 6 ns, 1.00× the fastest AES-256 header protection, rind on desktop: 2 ns, 1.00× the fastest AES-256 header protection, rind on nixos2: 8 ns, 1.00× the fastest -AES-256 header protection, rind on ovh-iad: 10 ns, 1.00× the fastest -AES-256 header protection, rind on ovh-sea: 9 ns, 1.00× the fastest -AES-256 header protection, aws-lc-rs on nixos: 8 ns, 1.32× the fastest -AES-256 header protection, aws-lc-rs on desktop: 5 ns, 2.06× the fastest -AES-256 header protection, aws-lc-rs on nixos2: 10 ns, 1.25× the fastest -AES-256 header protection, aws-lc-rs on ovh-iad: 16 ns, 1.62× the fastest -AES-256 header protection, aws-lc-rs on ovh-sea: 15 ns, 1.58× the fastest -AES-256 header protection, ring on nixos: 10 ns, 1.64× the fastest -AES-256 header protection, ring on desktop: 5 ns, 2.16× the fastest -AES-256 header protection, ring on nixos2: 10 ns, 1.24× the fastest -AES-256 header protection, ring on ovh-iad: 15 ns, 1.59× the fastest -AES-256 header protection, ring on ovh-sea: 15 ns, 1.56× the fastest +AES-256 header protection, rind on kixtop: 38 ns, 12.62× the fastest +AES-256 header protection, rind on ovh-iad: 10 ns, 1.00× the fastest +AES-256 header protection, rind on ovh-sea: 9 ns, 1.00× the fastest +AES-256 header protection, aws-lc-rs on nixos: 8 ns, 1.32× the fastest +AES-256 header protection, aws-lc-rs on desktop: 5 ns, 2.06× the fastest +AES-256 header protection, aws-lc-rs on nixos2: 10 ns, 1.25× the fastest +AES-256 header protection, aws-lc-rs on kixtop: 3 ns, 1.00× the fastest +AES-256 header protection, aws-lc-rs on ovh-iad: 16 ns, 1.62× the fastest +AES-256 header protection, aws-lc-rs on ovh-sea: 15 ns, 1.58× the fastest +AES-256 header protection, ring on nixos: 10 ns, 1.64× the fastest +AES-256 header protection, ring on desktop: 5 ns, 2.16× the fastest +AES-256 header protection, ring on nixos2: 10 ns, 1.24× the fastest +AES-256 header protection, ring on kixtop: 4 ns, 1.31× the fastest +AES-256 header protection, ring on ovh-iad: 15 ns, 1.59× the fastest +AES-256 header protection, ring on ovh-sea: 15 ns, 1.56× the fastest ChaCha20 header protection ChaCha20 header protection, rind on nixos: 61 ns, 1.00× the fastest; verified: rind's Lean proof, through Aeneas and a hand model of the function-pointer dispatch Aeneas cannot translate, which assumes each key's mask is its own cipher's, the only one rind builds, of its header-protection API's ChaCha20 against RFC 9001 and RFC 8439, HACL*'s rounds included ✓ @@ -914,22 +1087,26 @@ ✓ ChaCha20 header protection, rind on nixos2: 84 ns, 1.00× the fastest; verified: rind's Lean proof, through Aeneas and a hand model of the function-pointer dispatch Aeneas cannot translate, which assumes each key's mask is its own cipher's, the only one rind builds, of its header-protection API's ChaCha20 against RFC 9001 and RFC 8439, HACL*'s rounds included ✓ -ChaCha20 header protection, rind on ovh-iad: 126 ns, 1.00× the fastest; verified: rind's Lean proof, through Aeneas and a hand model of the function-pointer dispatch Aeneas cannot translate, which assumes each key's mask is its own cipher's, the only one rind builds, of its header-protection API's ChaCha20 against RFC 9001 and RFC 8439, HACL*'s rounds included +ChaCha20 header protection, rind on kixtop: 89 ns, 1.29× the fastest; verified: rind's Lean proof, through Aeneas and a hand model of the function-pointer dispatch Aeneas cannot translate, which assumes each key's mask is its own cipher's, the only one rind builds, of its header-protection API's ChaCha20 against RFC 9001 and RFC 8439, HACL*'s rounds included ✓ -ChaCha20 header protection, rind on ovh-sea: 122 ns, 1.00× the fastest; verified: rind's Lean proof, through Aeneas and a hand model of the function-pointer dispatch Aeneas cannot translate, which assumes each key's mask is its own cipher's, the only one rind builds, of its header-protection API's ChaCha20 against RFC 9001 and RFC 8439, HACL*'s rounds included +ChaCha20 header protection, rind on ovh-iad: 126 ns, 1.00× the fastest; verified: rind's Lean proof, through Aeneas and a hand model of the function-pointer dispatch Aeneas cannot translate, which assumes each key's mask is its own cipher's, the only one rind builds, of its header-protection API's ChaCha20 against RFC 9001 and RFC 8439, HACL*'s rounds included ✓ -ChaCha20 header protection, aws-lc-rs on nixos: 82 ns, 1.34× the fastest -ChaCha20 header protection, aws-lc-rs on desktop: 69 ns, 1.28× the fastest -ChaCha20 header protection, aws-lc-rs on nixos2: 104 ns, 1.24× the fastest -ChaCha20 header protection, aws-lc-rs on ovh-iad: 160 ns, 1.27× the fastest -ChaCha20 header protection, aws-lc-rs on ovh-sea: 152 ns, 1.25× the fastest -ChaCha20 header protection, ring on nixos: 74 ns, 1.22× the fastest -ChaCha20 header protection, ring on desktop: 61 ns, 1.14× the fastest -ChaCha20 header protection, ring on nixos2: 98 ns, 1.17× the fastest -ChaCha20 header protection, ring on ovh-iad: 145 ns, 1.15× the fastest -ChaCha20 header protection, ring on ovh-sea: 139 ns, 1.14× the fastest +ChaCha20 header protection, rind on ovh-sea: 122 ns, 1.00× the fastest; verified: rind's Lean proof, through Aeneas and a hand model of the function-pointer dispatch Aeneas cannot translate, which assumes each key's mask is its own cipher's, the only one rind builds, of its header-protection API's ChaCha20 against RFC 9001 and RFC 8439, HACL*'s rounds included +✓ +ChaCha20 header protection, aws-lc-rs on nixos: 82 ns, 1.34× the fastest +ChaCha20 header protection, aws-lc-rs on desktop: 69 ns, 1.28× the fastest +ChaCha20 header protection, aws-lc-rs on nixos2: 104 ns, 1.24× the fastest +ChaCha20 header protection, aws-lc-rs on kixtop: 73 ns, 1.07× the fastest +ChaCha20 header protection, aws-lc-rs on ovh-iad: 160 ns, 1.27× the fastest +ChaCha20 header protection, aws-lc-rs on ovh-sea: 152 ns, 1.25× the fastest +ChaCha20 header protection, ring on nixos: 74 ns, 1.22× the fastest +ChaCha20 header protection, ring on desktop: 61 ns, 1.14× the fastest +ChaCha20 header protection, ring on nixos2: 98 ns, 1.17× the fastest +ChaCha20 header protection, ring on kixtop: 68 ns, 1.00× the fastest +ChaCha20 header protection, ring on ovh-iad: 145 ns, 1.15× the fastest +ChaCha20 header protection, ring on ovh-sea: 139 ns, 1.14× the fastest Key agreement - + X25519 X25519, rind on nixos: 23.97 µs, 1.00× the fastest; verified: rind's Lean proof, through Aeneas and a hand model of the function-pointer dispatch Aeneas cannot translate, which assumes each key's dispatch table holds its own curve's functions, the only table rind builds, of its agreement API's X25519 down to s2n-bignum's routines, composed with s2n-bignum's HOL Light proofs of curve25519_x25519, curve25519_x25519base, their _alt forms without BMI2 and ADX, and bignum_eq, of s2n-bignum's own object code, which rind transliterates ✓ @@ -937,1015 +1114,1221 @@ ✓ X25519, rind on nixos2: 25.00 µs, 1.00× the fastest; verified: rind's Lean proof, through Aeneas and a hand model of the function-pointer dispatch Aeneas cannot translate, which assumes each key's dispatch table holds its own curve's functions, the only table rind builds, of its agreement API's X25519 down to s2n-bignum's routines, composed with s2n-bignum's HOL Light proofs of curve25519_x25519, curve25519_x25519base, their _alt forms without BMI2 and ADX, and bignum_eq, of s2n-bignum's own object code, which rind transliterates ✓ -X25519, rind on ovh-iad: 51.79 µs, 1.00× the fastest; verified: rind's Lean proof, through Aeneas and a hand model of the function-pointer dispatch Aeneas cannot translate, which assumes each key's dispatch table holds its own curve's functions, the only table rind builds, of its agreement API's X25519 down to s2n-bignum's routines, composed with s2n-bignum's HOL Light proofs of curve25519_x25519, curve25519_x25519base, their _alt forms without BMI2 and ADX, and bignum_eq, of s2n-bignum's own object code, which rind transliterates +X25519, rind on kixtop: 16.71 µs, 1.00× the fastest; verified: rind's Lean proof, through Aeneas and a hand model of the function-pointer dispatch Aeneas cannot translate, which assumes each key's dispatch table holds its own curve's functions, the only table rind builds, of its agreement API's X25519 down to s2n-bignum's routines, composed with s2n-bignum's HOL Light proofs of curve25519_x25519_alt, curve25519_x25519base_alt, and bignum_eq, of s2n-bignum's own object code, which rind transliterates ✓ -X25519, rind on ovh-sea: 51.10 µs, 1.00× the fastest; verified: rind's Lean proof, through Aeneas and a hand model of the function-pointer dispatch Aeneas cannot translate, which assumes each key's dispatch table holds its own curve's functions, the only table rind builds, of its agreement API's X25519 down to s2n-bignum's routines, composed with s2n-bignum's HOL Light proofs of curve25519_x25519, curve25519_x25519base, their _alt forms without BMI2 and ADX, and bignum_eq, of s2n-bignum's own object code, which rind transliterates +X25519, rind on ovh-iad: 51.79 µs, 1.00× the fastest; verified: rind's Lean proof, through Aeneas and a hand model of the function-pointer dispatch Aeneas cannot translate, which assumes each key's dispatch table holds its own curve's functions, the only table rind builds, of its agreement API's X25519 down to s2n-bignum's routines, composed with s2n-bignum's HOL Light proofs of curve25519_x25519, curve25519_x25519base, their _alt forms without BMI2 and ADX, and bignum_eq, of s2n-bignum's own object code, which rind transliterates ✓ -X25519, aws-lc-rs on nixos: 24.61 µs, 1.03× the fastest -X25519, aws-lc-rs on desktop: 19.54 µs, 1.06× the fastest -X25519, aws-lc-rs on nixos2: 30.89 µs, 1.24× the fastest -X25519, aws-lc-rs on ovh-iad: 55.09 µs, 1.06× the fastest -X25519, aws-lc-rs on ovh-sea: 51.15 µs, 1.00× the fastest -X25519, ring on nixos: 46.72 µs, 1.95× the fastest -X25519, ring on desktop: 35.63 µs, 1.93× the fastest -X25519, ring on nixos2: 53.60 µs, 2.15× the fastest -X25519, ring on ovh-iad: 79.18 µs, 1.53× the fastest -X25519, ring on ovh-sea: 76.22 µs, 1.49× the fastest -X25519, RustCrypto + dalek on nixos: 52.09 µs, 2.18× the fastest -X25519, RustCrypto + dalek on desktop: 36.52 µs, 1.97× the fastest -X25519, RustCrypto + dalek on nixos2: 56.59 µs, 2.27× the fastest -X25519, RustCrypto + dalek on ovh-iad: 92.76 µs, 1.79× the fastest -X25519, RustCrypto + dalek on ovh-sea: 87.59 µs, 1.71× the fastest -X25519, graviola on nixos: 23.94 µs, 1.00× the fastest -X25519, graviola on desktop: 18.50 µs, 1.00× the fastest -X25519, graviola on nixos2: 24.95 µs, 1.00× the fastest -X25519, libcrux on nixos: 64.60 µs, 2.70× the fastest; verified: HACL*'s F* proof of Hacl.Curve25519_51's secret_to_public and ecdh, compiled to Rust by an unverified step -✓ -X25519, libcrux on desktop: 43.11 µs, 2.33× the fastest; verified: HACL*'s F* proof of Hacl.Curve25519_51's secret_to_public and ecdh, compiled to Rust by an unverified step -✓ -X25519, libcrux on nixos2: 72.34 µs, 2.90× the fastest; verified: HACL*'s F* proof of Hacl.Curve25519_51's secret_to_public and ecdh, compiled to Rust by an unverified step -✓ -X25519, libcrux on ovh-iad: 118.60 µs, 2.29× the fastest; verified: HACL*'s F* proof of Hacl.Curve25519_51's secret_to_public and ecdh, compiled to Rust by an unverified step -✓ -X25519, libcrux on ovh-sea: 113.85 µs, 2.23× the fastest; verified: HACL*'s F* proof of Hacl.Curve25519_51's secret_to_public and ecdh, compiled to Rust by an unverified step -✓ -X25519, OpenSSL on nixos: 49.70 µs, 2.08× the fastest -X25519, OpenSSL on desktop: 34.02 µs, 1.84× the fastest -X25519, OpenSSL on nixos2: 55.20 µs, 2.21× the fastest -X25519, OpenSSL on ovh-iad: 108.87 µs, 2.10× the fastest -X25519, OpenSSL on ovh-sea: 94.95 µs, 1.86× the fastest +X25519, rind on ovh-sea: 51.10 µs, 1.00× the fastest; verified: rind's Lean proof, through Aeneas and a hand model of the function-pointer dispatch Aeneas cannot translate, which assumes each key's dispatch table holds its own curve's functions, the only table rind builds, of its agreement API's X25519 down to s2n-bignum's routines, composed with s2n-bignum's HOL Light proofs of curve25519_x25519, curve25519_x25519base, their _alt forms without BMI2 and ADX, and bignum_eq, of s2n-bignum's own object code, which rind transliterates +✓ +X25519, aws-lc-rs on nixos: 24.61 µs, 1.03× the fastest +X25519, aws-lc-rs on desktop: 19.54 µs, 1.06× the fastest +X25519, aws-lc-rs on nixos2: 30.89 µs, 1.24× the fastest +X25519, aws-lc-rs on kixtop: 17.85 µs, 1.07× the fastest +X25519, aws-lc-rs on ovh-iad: 55.09 µs, 1.06× the fastest +X25519, aws-lc-rs on ovh-sea: 51.15 µs, 1.00× the fastest +X25519, ring on nixos: 46.72 µs, 1.95× the fastest +X25519, ring on desktop: 35.63 µs, 1.93× the fastest +X25519, ring on nixos2: 53.60 µs, 2.15× the fastest +X25519, ring on kixtop: 24.48 µs, 1.46× the fastest +X25519, ring on ovh-iad: 79.18 µs, 1.53× the fastest +X25519, ring on ovh-sea: 76.22 µs, 1.49× the fastest +X25519, RustCrypto + dalek on nixos: 52.09 µs, 2.18× the fastest +X25519, RustCrypto + dalek on desktop: 36.52 µs, 1.97× the fastest +X25519, RustCrypto + dalek on nixos2: 56.59 µs, 2.27× the fastest +X25519, RustCrypto + dalek on kixtop: 29.71 µs, 1.78× the fastest +X25519, RustCrypto + dalek on ovh-iad: 92.76 µs, 1.79× the fastest +X25519, RustCrypto + dalek on ovh-sea: 87.59 µs, 1.71× the fastest +X25519, graviola on nixos: 23.94 µs, 1.00× the fastest +X25519, graviola on desktop: 18.50 µs, 1.00× the fastest +X25519, graviola on nixos2: 24.95 µs, 1.00× the fastest +X25519, graviola on kixtop: 17.74 µs, 1.06× the fastest +X25519, libcrux on nixos: 64.60 µs, 2.70× the fastest; verified: HACL*'s F* proof of Hacl.Curve25519_51's secret_to_public and ecdh, compiled to Rust by an unverified step +✓ +X25519, libcrux on desktop: 43.11 µs, 2.33× the fastest; verified: HACL*'s F* proof of Hacl.Curve25519_51's secret_to_public and ecdh, compiled to Rust by an unverified step +✓ +X25519, libcrux on nixos2: 72.34 µs, 2.90× the fastest; verified: HACL*'s F* proof of Hacl.Curve25519_51's secret_to_public and ecdh, compiled to Rust by an unverified step +✓ +X25519, libcrux on kixtop: 37.77 µs, 2.26× the fastest; verified: HACL*'s F* proof of Hacl.Curve25519_51's secret_to_public and ecdh, compiled to Rust by an unverified step +✓ +X25519, libcrux on ovh-iad: 118.60 µs, 2.29× the fastest; verified: HACL*'s F* proof of Hacl.Curve25519_51's secret_to_public and ecdh, compiled to Rust by an unverified step +✓ +X25519, libcrux on ovh-sea: 113.85 µs, 2.23× the fastest; verified: HACL*'s F* proof of Hacl.Curve25519_51's secret_to_public and ecdh, compiled to Rust by an unverified step +✓ +X25519, OpenSSL on nixos: 49.70 µs, 2.08× the fastest +X25519, OpenSSL on desktop: 34.02 µs, 1.84× the fastest +X25519, OpenSSL on nixos2: 55.20 µs, 2.21× the fastest +X25519, OpenSSL on kixtop: 35.77 µs, 2.14× the fastest +X25519, OpenSSL on ovh-iad: 108.87 µs, 2.10× the fastest +X25519, OpenSSL on ovh-sea: 94.95 µs, 1.86× the fastest P-256 ECDH P-256 ECDH, rind on nixos: 42.82 µs, 1.01× the fastest P-256 ECDH, rind on desktop: 29.85 µs, 1.00× the fastest P-256 ECDH, rind on nixos2: 42.80 µs, 1.00× the fastest -P-256 ECDH, rind on ovh-iad: 80.93 µs, 1.00× the fastest -P-256 ECDH, rind on ovh-sea: 78.75 µs, 1.00× the fastest -P-256 ECDH, aws-lc-rs on nixos: 42.60 µs, 1.00× the fastest -P-256 ECDH, aws-lc-rs on desktop: 32.27 µs, 1.08× the fastest -P-256 ECDH, aws-lc-rs on nixos2: 51.71 µs, 1.21× the fastest -P-256 ECDH, aws-lc-rs on ovh-iad: 90.86 µs, 1.12× the fastest -P-256 ECDH, aws-lc-rs on ovh-sea: 83.71 µs, 1.06× the fastest -P-256 ECDH, ring on nixos: 46.05 µs, 1.08× the fastest -P-256 ECDH, ring on desktop: 34.14 µs, 1.14× the fastest -P-256 ECDH, ring on nixos2: 47.10 µs, 1.10× the fastest -P-256 ECDH, ring on ovh-iad: 86.47 µs, 1.07× the fastest -P-256 ECDH, ring on ovh-sea: 83.41 µs, 1.06× the fastest -P-256 ECDH, RustCrypto + dalek on nixos: 268.62 µs, 6.31× the fastest -P-256 ECDH, RustCrypto + dalek on desktop: 123.01 µs, 4.12× the fastest -P-256 ECDH, RustCrypto + dalek on nixos2: 233.70 µs, 5.46× the fastest -P-256 ECDH, RustCrypto + dalek on ovh-iad: 379.56 µs, 4.69× the fastest -P-256 ECDH, RustCrypto + dalek on ovh-sea: 363.81 µs, 4.62× the fastest -P-256 ECDH, graviola on nixos: 47.87 µs, 1.12× the fastest -P-256 ECDH, graviola on desktop: 33.46 µs, 1.12× the fastest -P-256 ECDH, graviola on nixos2: 46.44 µs, 1.08× the fastest -P-256 ECDH, libcrux on nixos: 268.70 µs, 6.31× the fastest; verified: HACL*'s F* proof of Hacl.P256's dh_initiator, dh_responder, ecdsa_sign_p256_sha2, and ecdsa_verif_p256_sha2, compiled to Rust by an unverified step -✓ -P-256 ECDH, libcrux on desktop: 169.87 µs, 5.69× the fastest; verified: HACL*'s F* proof of Hacl.P256's dh_initiator, dh_responder, ecdsa_sign_p256_sha2, and ecdsa_verif_p256_sha2, compiled to Rust by an unverified step -✓ -P-256 ECDH, libcrux on nixos2: 280.52 µs, 6.55× the fastest; verified: HACL*'s F* proof of Hacl.P256's dh_initiator, dh_responder, ecdsa_sign_p256_sha2, and ecdsa_verif_p256_sha2, compiled to Rust by an unverified step -✓ -P-256 ECDH, libcrux on ovh-iad: 448.99 µs, 5.55× the fastest; verified: HACL*'s F* proof of Hacl.P256's dh_initiator, dh_responder, ecdsa_sign_p256_sha2, and ecdsa_verif_p256_sha2, compiled to Rust by an unverified step -✓ -P-256 ECDH, libcrux on ovh-sea: 431.73 µs, 5.48× the fastest; verified: HACL*'s F* proof of Hacl.P256's dh_initiator, dh_responder, ecdsa_sign_p256_sha2, and ecdsa_verif_p256_sha2, compiled to Rust by an unverified step -✓ -P-256 ECDH, OpenSSL on nixos: 71.25 µs, 1.67× the fastest -P-256 ECDH, OpenSSL on desktop: 52.91 µs, 1.77× the fastest -P-256 ECDH, OpenSSL on nixos2: 81.68 µs, 1.91× the fastest -P-256 ECDH, OpenSSL on ovh-iad: 144.90 µs, 1.79× the fastest -P-256 ECDH, OpenSSL on ovh-sea: 135.76 µs, 1.72× the fastest +P-256 ECDH, rind on kixtop: 26.27 µs, 1.00× the fastest; verified: rind's Lean proof, through Aeneas and hand models of the function-pointer dispatch and of key generation's draws through a dyn RandomSource, which Aeneas cannot translate, of its agreement API's P-256 key generation, public key, and agreement down to s2n-bignum's routines, composed with s2n-bignum's HOL Light proofs of p256_scalarmulbase_alt, p256_scalarmul_alt, bignum_tomont_p256, bignum_demont_p256, bignum_add_p256, bignum_montmul_p256, bignum_montsqr_p256, bignum_mod_n256_4, and bignum_eq, of s2n-bignum's own object code, which rind transliterates, with rind's generator table proven to hold the multiples of G that s2n-bignum's proof assumes +✓ +P-256 ECDH, rind on ovh-iad: 80.93 µs, 1.00× the fastest +P-256 ECDH, rind on ovh-sea: 78.75 µs, 1.00× the fastest +P-256 ECDH, aws-lc-rs on nixos: 42.60 µs, 1.00× the fastest +P-256 ECDH, aws-lc-rs on desktop: 32.27 µs, 1.08× the fastest +P-256 ECDH, aws-lc-rs on nixos2: 51.71 µs, 1.21× the fastest +P-256 ECDH, aws-lc-rs on kixtop: 28.51 µs, 1.09× the fastest +P-256 ECDH, aws-lc-rs on ovh-iad: 90.86 µs, 1.12× the fastest +P-256 ECDH, aws-lc-rs on ovh-sea: 83.71 µs, 1.06× the fastest +P-256 ECDH, ring on nixos: 46.05 µs, 1.08× the fastest +P-256 ECDH, ring on desktop: 34.14 µs, 1.14× the fastest +P-256 ECDH, ring on nixos2: 47.10 µs, 1.10× the fastest +P-256 ECDH, ring on kixtop: 32.31 µs, 1.23× the fastest +P-256 ECDH, ring on ovh-iad: 86.47 µs, 1.07× the fastest +P-256 ECDH, ring on ovh-sea: 83.41 µs, 1.06× the fastest +P-256 ECDH, RustCrypto + dalek on nixos: 268.62 µs, 6.31× the fastest +P-256 ECDH, RustCrypto + dalek on desktop: 123.01 µs, 4.12× the fastest +P-256 ECDH, RustCrypto + dalek on nixos2: 233.70 µs, 5.46× the fastest +P-256 ECDH, RustCrypto + dalek on kixtop: 180.62 µs, 6.88× the fastest +P-256 ECDH, RustCrypto + dalek on ovh-iad: 379.56 µs, 4.69× the fastest +P-256 ECDH, RustCrypto + dalek on ovh-sea: 363.81 µs, 4.62× the fastest +P-256 ECDH, graviola on nixos: 47.87 µs, 1.12× the fastest +P-256 ECDH, graviola on desktop: 33.46 µs, 1.12× the fastest +P-256 ECDH, graviola on nixos2: 46.44 µs, 1.08× the fastest +P-256 ECDH, graviola on kixtop: 31.56 µs, 1.20× the fastest +P-256 ECDH, libcrux on nixos: 268.70 µs, 6.31× the fastest; verified: HACL*'s F* proof of Hacl.P256's dh_initiator, dh_responder, ecdsa_sign_p256_sha2, and ecdsa_verif_p256_sha2, compiled to Rust by an unverified step +✓ +P-256 ECDH, libcrux on desktop: 169.87 µs, 5.69× the fastest; verified: HACL*'s F* proof of Hacl.P256's dh_initiator, dh_responder, ecdsa_sign_p256_sha2, and ecdsa_verif_p256_sha2, compiled to Rust by an unverified step +✓ +P-256 ECDH, libcrux on nixos2: 280.52 µs, 6.55× the fastest; verified: HACL*'s F* proof of Hacl.P256's dh_initiator, dh_responder, ecdsa_sign_p256_sha2, and ecdsa_verif_p256_sha2, compiled to Rust by an unverified step +✓ +P-256 ECDH, libcrux on kixtop: 183.72 µs, 6.99× the fastest; verified: HACL*'s F* proof of Hacl.P256's dh_initiator, dh_responder, ecdsa_sign_p256_sha2, and ecdsa_verif_p256_sha2, compiled to Rust by an unverified step +✓ +P-256 ECDH, libcrux on ovh-iad: 448.99 µs, 5.55× the fastest; verified: HACL*'s F* proof of Hacl.P256's dh_initiator, dh_responder, ecdsa_sign_p256_sha2, and ecdsa_verif_p256_sha2, compiled to Rust by an unverified step +✓ +P-256 ECDH, libcrux on ovh-sea: 431.73 µs, 5.48× the fastest; verified: HACL*'s F* proof of Hacl.P256's dh_initiator, dh_responder, ecdsa_sign_p256_sha2, and ecdsa_verif_p256_sha2, compiled to Rust by an unverified step +✓ +P-256 ECDH, OpenSSL on nixos: 71.25 µs, 1.67× the fastest +P-256 ECDH, OpenSSL on desktop: 52.91 µs, 1.77× the fastest +P-256 ECDH, OpenSSL on nixos2: 81.68 µs, 1.91× the fastest +P-256 ECDH, OpenSSL on kixtop: 49.96 µs, 1.90× the fastest +P-256 ECDH, OpenSSL on ovh-iad: 144.90 µs, 1.79× the fastest +P-256 ECDH, OpenSSL on ovh-sea: 135.76 µs, 1.72× the fastest Signatures - + Ed25519 sign Ed25519 sign, rind on nixos: 5.72 µs, 1.00× the fastest Ed25519 sign, rind on desktop: 4.15 µs, 1.00× the fastest Ed25519 sign, rind on nixos2: 7.13 µs, 1.00× the fastest -Ed25519 sign, rind on ovh-iad: 14.51 µs, 1.13× the fastest -Ed25519 sign, rind on ovh-sea: 11.68 µs, 1.00× the fastest -Ed25519 sign, aws-lc-rs on nixos: 6.13 µs, 1.07× the fastest -Ed25519 sign, aws-lc-rs on desktop: 4.56 µs, 1.10× the fastest -Ed25519 sign, aws-lc-rs on nixos2: 7.81 µs, 1.10× the fastest -Ed25519 sign, aws-lc-rs on ovh-iad: 12.85 µs, 1.00× the fastest -Ed25519 sign, aws-lc-rs on ovh-sea: 12.65 µs, 1.08× the fastest -Ed25519 sign, ring on nixos: 17.23 µs, 3.01× the fastest -Ed25519 sign, ring on desktop: 13.14 µs, 3.16× the fastest -Ed25519 sign, ring on nixos2: 22.26 µs, 3.12× the fastest -Ed25519 sign, ring on ovh-iad: 29.90 µs, 2.33× the fastest -Ed25519 sign, ring on ovh-sea: 28.95 µs, 2.48× the fastest -Ed25519 sign, RustCrypto + dalek on nixos: 13.30 µs, 2.33× the fastest -Ed25519 sign, RustCrypto + dalek on desktop: 9.61 µs, 2.31× the fastest -Ed25519 sign, RustCrypto + dalek on nixos2: 17.40 µs, 2.44× the fastest -Ed25519 sign, RustCrypto + dalek on ovh-iad: 25.23 µs, 1.96× the fastest -Ed25519 sign, RustCrypto + dalek on ovh-sea: 23.74 µs, 2.03× the fastest -Ed25519 sign, graviola on nixos: 5.83 µs, 1.02× the fastest -Ed25519 sign, graviola on desktop: 4.39 µs, 1.06× the fastest -Ed25519 sign, graviola on nixos2: 7.22 µs, 1.01× the fastest -Ed25519 sign, libcrux on nixos: 41.37 µs, 7.24× the fastest; verified: HACL*'s F* proof of Hacl.Ed25519's sign and verify, compiled to Rust by an unverified step -✓ -Ed25519 sign, libcrux on desktop: 28.97 µs, 6.97× the fastest; verified: HACL*'s F* proof of Hacl.Ed25519's sign and verify, compiled to Rust by an unverified step -✓ -Ed25519 sign, libcrux on nixos2: 53.66 µs, 7.52× the fastest; verified: HACL*'s F* proof of Hacl.Ed25519's sign and verify, compiled to Rust by an unverified step -✓ -Ed25519 sign, libcrux on ovh-iad: 92.43 µs, 7.19× the fastest; verified: HACL*'s F* proof of Hacl.Ed25519's sign and verify, compiled to Rust by an unverified step -✓ -Ed25519 sign, libcrux on ovh-sea: 73.35 µs, 6.28× the fastest; verified: HACL*'s F* proof of Hacl.Ed25519's sign and verify, compiled to Rust by an unverified step -✓ -Ed25519 sign, OpenSSL on nixos: 23.38 µs, 4.09× the fastest -Ed25519 sign, OpenSSL on desktop: 13.69 µs, 3.30× the fastest -Ed25519 sign, OpenSSL on nixos2: 31.01 µs, 4.35× the fastest -Ed25519 sign, OpenSSL on ovh-iad: 49.77 µs, 3.87× the fastest -Ed25519 sign, OpenSSL on ovh-sea: 41.96 µs, 3.59× the fastest +Ed25519 sign, rind on kixtop: 3.95 µs, 1.00× the fastest +Ed25519 sign, rind on ovh-iad: 14.51 µs, 1.13× the fastest +Ed25519 sign, rind on ovh-sea: 11.68 µs, 1.00× the fastest +Ed25519 sign, aws-lc-rs on nixos: 6.13 µs, 1.07× the fastest +Ed25519 sign, aws-lc-rs on desktop: 4.56 µs, 1.10× the fastest +Ed25519 sign, aws-lc-rs on nixos2: 7.81 µs, 1.10× the fastest +Ed25519 sign, aws-lc-rs on kixtop: 4.06 µs, 1.03× the fastest +Ed25519 sign, aws-lc-rs on ovh-iad: 12.85 µs, 1.00× the fastest +Ed25519 sign, aws-lc-rs on ovh-sea: 12.65 µs, 1.08× the fastest +Ed25519 sign, ring on nixos: 17.23 µs, 3.01× the fastest +Ed25519 sign, ring on desktop: 13.14 µs, 3.16× the fastest +Ed25519 sign, ring on nixos2: 22.26 µs, 3.12× the fastest +Ed25519 sign, ring on kixtop: 7.07 µs, 1.79× the fastest +Ed25519 sign, ring on ovh-iad: 29.90 µs, 2.33× the fastest +Ed25519 sign, ring on ovh-sea: 28.95 µs, 2.48× the fastest +Ed25519 sign, RustCrypto + dalek on nixos: 13.30 µs, 2.33× the fastest +Ed25519 sign, RustCrypto + dalek on desktop: 9.61 µs, 2.31× the fastest +Ed25519 sign, RustCrypto + dalek on nixos2: 17.40 µs, 2.44× the fastest +Ed25519 sign, RustCrypto + dalek on kixtop: 8.66 µs, 2.19× the fastest +Ed25519 sign, RustCrypto + dalek on ovh-iad: 25.23 µs, 1.96× the fastest +Ed25519 sign, RustCrypto + dalek on ovh-sea: 23.74 µs, 2.03× the fastest +Ed25519 sign, graviola on nixos: 5.83 µs, 1.02× the fastest +Ed25519 sign, graviola on desktop: 4.39 µs, 1.06× the fastest +Ed25519 sign, graviola on nixos2: 7.22 µs, 1.01× the fastest +Ed25519 sign, graviola on kixtop: 4.17 µs, 1.06× the fastest +Ed25519 sign, libcrux on nixos: 41.37 µs, 7.24× the fastest; verified: HACL*'s F* proof of Hacl.Ed25519's sign and verify, compiled to Rust by an unverified step +✓ +Ed25519 sign, libcrux on desktop: 28.97 µs, 6.97× the fastest; verified: HACL*'s F* proof of Hacl.Ed25519's sign and verify, compiled to Rust by an unverified step +✓ +Ed25519 sign, libcrux on nixos2: 53.66 µs, 7.52× the fastest; verified: HACL*'s F* proof of Hacl.Ed25519's sign and verify, compiled to Rust by an unverified step +✓ +Ed25519 sign, libcrux on kixtop: 22.12 µs, 5.60× the fastest; verified: HACL*'s F* proof of Hacl.Ed25519's sign and verify, compiled to Rust by an unverified step +✓ +Ed25519 sign, libcrux on ovh-iad: 92.43 µs, 7.19× the fastest; verified: HACL*'s F* proof of Hacl.Ed25519's sign and verify, compiled to Rust by an unverified step +✓ +Ed25519 sign, libcrux on ovh-sea: 73.35 µs, 6.28× the fastest; verified: HACL*'s F* proof of Hacl.Ed25519's sign and verify, compiled to Rust by an unverified step +✓ +Ed25519 sign, OpenSSL on nixos: 23.38 µs, 4.09× the fastest +Ed25519 sign, OpenSSL on desktop: 13.69 µs, 3.30× the fastest +Ed25519 sign, OpenSSL on nixos2: 31.01 µs, 4.35× the fastest +Ed25519 sign, OpenSSL on kixtop: 16.42 µs, 4.16× the fastest +Ed25519 sign, OpenSSL on ovh-iad: 49.77 µs, 3.87× the fastest +Ed25519 sign, OpenSSL on ovh-sea: 41.96 µs, 3.59× the fastest Ed25519 verify Ed25519 verify, rind on nixos: 27.15 µs, 1.09× the fastest Ed25519 verify, rind on desktop: 21.75 µs, 1.01× the fastest Ed25519 verify, rind on nixos2: 31.81 µs, 1.06× the fastest -Ed25519 verify, rind on ovh-iad: 60.71 µs, 1.30× the fastest -Ed25519 verify, rind on ovh-sea: 58.97 µs, 1.29× the fastest -Ed25519 verify, aws-lc-rs on nixos: 27.03 µs, 1.09× the fastest -Ed25519 verify, aws-lc-rs on desktop: 21.56 µs, 1.00× the fastest -Ed25519 verify, aws-lc-rs on nixos2: 31.62 µs, 1.06× the fastest -Ed25519 verify, aws-lc-rs on ovh-iad: 60.32 µs, 1.30× the fastest -Ed25519 verify, aws-lc-rs on ovh-sea: 57.63 µs, 1.26× the fastest -Ed25519 verify, ring on nixos: 34.76 µs, 1.40× the fastest -Ed25519 verify, ring on desktop: 26.22 µs, 1.22× the fastest -Ed25519 verify, ring on nixos2: 42.48 µs, 1.42× the fastest -Ed25519 verify, ring on ovh-iad: 61.26 µs, 1.32× the fastest -Ed25519 verify, ring on ovh-sea: 59.24 µs, 1.29× the fastest -Ed25519 verify, RustCrypto + dalek on nixos: 24.83 µs, 1.00× the fastest -Ed25519 verify, RustCrypto + dalek on desktop: 21.88 µs, 1.02× the fastest -Ed25519 verify, RustCrypto + dalek on nixos2: 29.88 µs, 1.00× the fastest -Ed25519 verify, RustCrypto + dalek on ovh-iad: 46.55 µs, 1.00× the fastest -Ed25519 verify, RustCrypto + dalek on ovh-sea: 45.80 µs, 1.00× the fastest -Ed25519 verify, graviola on nixos: 27.08 µs, 1.09× the fastest -Ed25519 verify, graviola on desktop: 21.61 µs, 1.00× the fastest -Ed25519 verify, graviola on nixos2: 32.22 µs, 1.08× the fastest -Ed25519 verify, libcrux on nixos: 54.52 µs, 2.20× the fastest; verified: HACL*'s F* proof of Hacl.Ed25519's sign and verify, compiled to Rust by an unverified step -✓ -Ed25519 verify, libcrux on desktop: 42.16 µs, 1.96× the fastest; verified: HACL*'s F* proof of Hacl.Ed25519's sign and verify, compiled to Rust by an unverified step -✓ -Ed25519 verify, libcrux on nixos2: 69.12 µs, 2.31× the fastest; verified: HACL*'s F* proof of Hacl.Ed25519's sign and verify, compiled to Rust by an unverified step -✓ -Ed25519 verify, libcrux on ovh-iad: 98.92 µs, 2.13× the fastest; verified: HACL*'s F* proof of Hacl.Ed25519's sign and verify, compiled to Rust by an unverified step -✓ -Ed25519 verify, libcrux on ovh-sea: 93.99 µs, 2.05× the fastest; verified: HACL*'s F* proof of Hacl.Ed25519's sign and verify, compiled to Rust by an unverified step -✓ -Ed25519 verify, OpenSSL on nixos: 79.25 µs, 3.19× the fastest -Ed25519 verify, OpenSSL on desktop: 45.59 µs, 2.11× the fastest -Ed25519 verify, OpenSSL on nixos2: 93.09 µs, 3.12× the fastest -Ed25519 verify, OpenSSL on ovh-iad: 140.95 µs, 3.03× the fastest -Ed25519 verify, OpenSSL on ovh-sea: 136.50 µs, 2.98× the fastest +Ed25519 verify, rind on kixtop: 18.66 µs, 1.01× the fastest +Ed25519 verify, rind on ovh-iad: 60.71 µs, 1.30× the fastest +Ed25519 verify, rind on ovh-sea: 58.97 µs, 1.29× the fastest +Ed25519 verify, aws-lc-rs on nixos: 27.03 µs, 1.09× the fastest +Ed25519 verify, aws-lc-rs on desktop: 21.56 µs, 1.00× the fastest +Ed25519 verify, aws-lc-rs on nixos2: 31.62 µs, 1.06× the fastest +Ed25519 verify, aws-lc-rs on kixtop: 18.52 µs, 1.01× the fastest +Ed25519 verify, aws-lc-rs on ovh-iad: 60.32 µs, 1.30× the fastest +Ed25519 verify, aws-lc-rs on ovh-sea: 57.63 µs, 1.26× the fastest +Ed25519 verify, ring on nixos: 34.76 µs, 1.40× the fastest +Ed25519 verify, ring on desktop: 26.22 µs, 1.22× the fastest +Ed25519 verify, ring on nixos2: 42.48 µs, 1.42× the fastest +Ed25519 verify, ring on kixtop: 19.94 µs, 1.08× the fastest +Ed25519 verify, ring on ovh-iad: 61.26 µs, 1.32× the fastest +Ed25519 verify, ring on ovh-sea: 59.24 µs, 1.29× the fastest +Ed25519 verify, RustCrypto + dalek on nixos: 24.83 µs, 1.00× the fastest +Ed25519 verify, RustCrypto + dalek on desktop: 21.88 µs, 1.02× the fastest +Ed25519 verify, RustCrypto + dalek on nixos2: 29.88 µs, 1.00× the fastest +Ed25519 verify, RustCrypto + dalek on kixtop: 18.42 µs, 1.00× the fastest +Ed25519 verify, RustCrypto + dalek on ovh-iad: 46.55 µs, 1.00× the fastest +Ed25519 verify, RustCrypto + dalek on ovh-sea: 45.80 µs, 1.00× the fastest +Ed25519 verify, graviola on nixos: 27.08 µs, 1.09× the fastest +Ed25519 verify, graviola on desktop: 21.61 µs, 1.00× the fastest +Ed25519 verify, graviola on nixos2: 32.22 µs, 1.08× the fastest +Ed25519 verify, graviola on kixtop: 18.69 µs, 1.01× the fastest +Ed25519 verify, libcrux on nixos: 54.52 µs, 2.20× the fastest; verified: HACL*'s F* proof of Hacl.Ed25519's sign and verify, compiled to Rust by an unverified step +✓ +Ed25519 verify, libcrux on desktop: 42.16 µs, 1.96× the fastest; verified: HACL*'s F* proof of Hacl.Ed25519's sign and verify, compiled to Rust by an unverified step +✓ +Ed25519 verify, libcrux on nixos2: 69.12 µs, 2.31× the fastest; verified: HACL*'s F* proof of Hacl.Ed25519's sign and verify, compiled to Rust by an unverified step +✓ +Ed25519 verify, libcrux on kixtop: 29.57 µs, 1.61× the fastest; verified: HACL*'s F* proof of Hacl.Ed25519's sign and verify, compiled to Rust by an unverified step +✓ +Ed25519 verify, libcrux on ovh-iad: 98.92 µs, 2.13× the fastest; verified: HACL*'s F* proof of Hacl.Ed25519's sign and verify, compiled to Rust by an unverified step +✓ +Ed25519 verify, libcrux on ovh-sea: 93.99 µs, 2.05× the fastest; verified: HACL*'s F* proof of Hacl.Ed25519's sign and verify, compiled to Rust by an unverified step +✓ +Ed25519 verify, OpenSSL on nixos: 79.25 µs, 3.19× the fastest +Ed25519 verify, OpenSSL on desktop: 45.59 µs, 2.11× the fastest +Ed25519 verify, OpenSSL on nixos2: 93.09 µs, 3.12× the fastest +Ed25519 verify, OpenSSL on kixtop: 41.08 µs, 2.23× the fastest +Ed25519 verify, OpenSSL on ovh-iad: 140.95 µs, 3.03× the fastest +Ed25519 verify, OpenSSL on ovh-sea: 136.50 µs, 2.98× the fastest P-256 ECDSA sign P-256 ECDSA sign, rind on nixos: 9.62 µs, 1.00× the fastest P-256 ECDSA sign, rind on desktop: 6.84 µs, 1.00× the fastest P-256 ECDSA sign, rind on nixos2: 13.11 µs, 1.00× the fastest -P-256 ECDSA sign, rind on ovh-iad: 22.42 µs, 1.00× the fastest -P-256 ECDSA sign, rind on ovh-sea: 21.44 µs, 1.00× the fastest -P-256 ECDSA sign, aws-lc-rs on nixos: 12.66 µs, 1.32× the fastest -P-256 ECDSA sign, aws-lc-rs on desktop: 12.33 µs, 1.80× the fastest -P-256 ECDSA sign, aws-lc-rs on nixos2: 19.80 µs, 1.51× the fastest -P-256 ECDSA sign, aws-lc-rs on ovh-iad: 24.53 µs, 1.09× the fastest -P-256 ECDSA sign, aws-lc-rs on ovh-sea: 23.93 µs, 1.12× the fastest -P-256 ECDSA sign, ring on nixos: 13.68 µs, 1.42× the fastest -P-256 ECDSA sign, ring on desktop: 12.24 µs, 1.79× the fastest -P-256 ECDSA sign, ring on nixos2: 14.86 µs, 1.13× the fastest -P-256 ECDSA sign, ring on ovh-iad: 26.21 µs, 1.17× the fastest -P-256 ECDSA sign, ring on ovh-sea: 24.84 µs, 1.16× the fastest -P-256 ECDSA sign, RustCrypto + dalek on nixos: 70.62 µs, 7.34× the fastest -P-256 ECDSA sign, RustCrypto + dalek on desktop: 31.65 µs, 4.63× the fastest -P-256 ECDSA sign, RustCrypto + dalek on nixos2: 69.11 µs, 5.27× the fastest -P-256 ECDSA sign, RustCrypto + dalek on ovh-iad: 107.76 µs, 4.81× the fastest -P-256 ECDSA sign, RustCrypto + dalek on ovh-sea: 107.39 µs, 5.01× the fastest -P-256 ECDSA sign, graviola on nixos: 11.49 µs, 1.19× the fastest -P-256 ECDSA sign, graviola on desktop: 9.26 µs, 1.35× the fastest -P-256 ECDSA sign, graviola on nixos2: 19.89 µs, 1.52× the fastest -P-256 ECDSA sign, libcrux on nixos: 95.47 µs, 9.92× the fastest; verified: HACL*'s F* proof of Hacl.P256's dh_initiator, dh_responder, ecdsa_sign_p256_sha2, and ecdsa_verif_p256_sha2, compiled to Rust by an unverified step -✓ -P-256 ECDSA sign, libcrux on desktop: 61.34 µs, 8.97× the fastest; verified: HACL*'s F* proof of Hacl.P256's dh_initiator, dh_responder, ecdsa_sign_p256_sha2, and ecdsa_verif_p256_sha2, compiled to Rust by an unverified step -✓ -P-256 ECDSA sign, libcrux on nixos2: 102.03 µs, 7.78× the fastest; verified: HACL*'s F* proof of Hacl.P256's dh_initiator, dh_responder, ecdsa_sign_p256_sha2, and ecdsa_verif_p256_sha2, compiled to Rust by an unverified step -✓ -P-256 ECDSA sign, libcrux on ovh-iad: 163.02 µs, 7.27× the fastest; verified: HACL*'s F* proof of Hacl.P256's dh_initiator, dh_responder, ecdsa_sign_p256_sha2, and ecdsa_verif_p256_sha2, compiled to Rust by an unverified step -✓ -P-256 ECDSA sign, libcrux on ovh-sea: 156.95 µs, 7.32× the fastest; verified: HACL*'s F* proof of Hacl.P256's dh_initiator, dh_responder, ecdsa_sign_p256_sha2, and ecdsa_verif_p256_sha2, compiled to Rust by an unverified step -✓ -P-256 ECDSA sign, OpenSSL on nixos: 18.04 µs, 1.88× the fastest -P-256 ECDSA sign, OpenSSL on desktop: 14.33 µs, 2.09× the fastest -P-256 ECDSA sign, OpenSSL on nixos2: 20.35 µs, 1.55× the fastest -P-256 ECDSA sign, OpenSSL on ovh-iad: 32.70 µs, 1.46× the fastest -P-256 ECDSA sign, OpenSSL on ovh-sea: 31.82 µs, 1.48× the fastest +P-256 ECDSA sign, rind on kixtop: 7.11 µs, 1.00× the fastest; verified: rind's Lean proof, through Aeneas and hand models of the function-pointer dispatch and of the nonces' draws through a dyn RandomSource, which Aeneas cannot translate, of its signature API's P-256 ECDSA with SHA-256 and fixed-length signatures, key generation and loading, signing, and verification, down to s2n-bignum's routines, composed with s2n-bignum's HOL Light proofs of p256_scalarmulbase_alt, p256_montjadd_alt, p256_montjdouble_alt, p256_montjmixadd_alt, bignum_inv_p256, bignum_neg_p256, bignum_tomont_p256, bignum_demont_p256, bignum_add_p256, bignum_montmul_p256, bignum_montsqr_p256, bignum_mod_n256_4, bignum_modadd, bignum_montmul, bignum_demont, bignum_modinv, and bignum_eq, of s2n-bignum's own object code, which rind transliterates, with the group laws its twin multiplication relies on proven from Mathlib's and the generator's order n proven, assuming HOL Light's P256_GROUP_ELEMENT_ORDER, that a point has order n, only for verification with a parsed public key, and proving a signature right when signing returns, as its nonce loop has no bound +✓ +P-256 ECDSA sign, rind on ovh-iad: 22.42 µs, 1.00× the fastest +P-256 ECDSA sign, rind on ovh-sea: 21.44 µs, 1.00× the fastest +P-256 ECDSA sign, aws-lc-rs on nixos: 12.66 µs, 1.32× the fastest +P-256 ECDSA sign, aws-lc-rs on desktop: 12.33 µs, 1.80× the fastest +P-256 ECDSA sign, aws-lc-rs on nixos2: 19.80 µs, 1.51× the fastest +P-256 ECDSA sign, aws-lc-rs on kixtop: 11.27 µs, 1.58× the fastest +P-256 ECDSA sign, aws-lc-rs on ovh-iad: 24.53 µs, 1.09× the fastest +P-256 ECDSA sign, aws-lc-rs on ovh-sea: 23.93 µs, 1.12× the fastest +P-256 ECDSA sign, ring on nixos: 13.68 µs, 1.42× the fastest +P-256 ECDSA sign, ring on desktop: 12.24 µs, 1.79× the fastest +P-256 ECDSA sign, ring on nixos2: 14.86 µs, 1.13× the fastest +P-256 ECDSA sign, ring on kixtop: 11.01 µs, 1.55× the fastest +P-256 ECDSA sign, ring on ovh-iad: 26.21 µs, 1.17× the fastest +P-256 ECDSA sign, ring on ovh-sea: 24.84 µs, 1.16× the fastest +P-256 ECDSA sign, RustCrypto + dalek on nixos: 70.62 µs, 7.34× the fastest +P-256 ECDSA sign, RustCrypto + dalek on desktop: 31.65 µs, 4.63× the fastest +P-256 ECDSA sign, RustCrypto + dalek on nixos2: 69.11 µs, 5.27× the fastest +P-256 ECDSA sign, RustCrypto + dalek on kixtop: 44.33 µs, 6.23× the fastest +P-256 ECDSA sign, RustCrypto + dalek on ovh-iad: 107.76 µs, 4.81× the fastest +P-256 ECDSA sign, RustCrypto + dalek on ovh-sea: 107.39 µs, 5.01× the fastest +P-256 ECDSA sign, graviola on nixos: 11.49 µs, 1.19× the fastest +P-256 ECDSA sign, graviola on desktop: 9.26 µs, 1.35× the fastest +P-256 ECDSA sign, graviola on nixos2: 19.89 µs, 1.52× the fastest +P-256 ECDSA sign, graviola on kixtop: 8.83 µs, 1.24× the fastest +P-256 ECDSA sign, libcrux on nixos: 95.47 µs, 9.92× the fastest; verified: HACL*'s F* proof of Hacl.P256's dh_initiator, dh_responder, ecdsa_sign_p256_sha2, and ecdsa_verif_p256_sha2, compiled to Rust by an unverified step +✓ +P-256 ECDSA sign, libcrux on desktop: 61.34 µs, 8.97× the fastest; verified: HACL*'s F* proof of Hacl.P256's dh_initiator, dh_responder, ecdsa_sign_p256_sha2, and ecdsa_verif_p256_sha2, compiled to Rust by an unverified step +✓ +P-256 ECDSA sign, libcrux on nixos2: 102.03 µs, 7.78× the fastest; verified: HACL*'s F* proof of Hacl.P256's dh_initiator, dh_responder, ecdsa_sign_p256_sha2, and ecdsa_verif_p256_sha2, compiled to Rust by an unverified step +✓ +P-256 ECDSA sign, libcrux on kixtop: 67.38 µs, 9.47× the fastest; verified: HACL*'s F* proof of Hacl.P256's dh_initiator, dh_responder, ecdsa_sign_p256_sha2, and ecdsa_verif_p256_sha2, compiled to Rust by an unverified step +✓ +P-256 ECDSA sign, libcrux on ovh-iad: 163.02 µs, 7.27× the fastest; verified: HACL*'s F* proof of Hacl.P256's dh_initiator, dh_responder, ecdsa_sign_p256_sha2, and ecdsa_verif_p256_sha2, compiled to Rust by an unverified step +✓ +P-256 ECDSA sign, libcrux on ovh-sea: 156.95 µs, 7.32× the fastest; verified: HACL*'s F* proof of Hacl.P256's dh_initiator, dh_responder, ecdsa_sign_p256_sha2, and ecdsa_verif_p256_sha2, compiled to Rust by an unverified step +✓ +P-256 ECDSA sign, OpenSSL on nixos: 18.04 µs, 1.88× the fastest +P-256 ECDSA sign, OpenSSL on desktop: 14.33 µs, 2.09× the fastest +P-256 ECDSA sign, OpenSSL on nixos2: 20.35 µs, 1.55× the fastest +P-256 ECDSA sign, OpenSSL on kixtop: 12.62 µs, 1.77× the fastest +P-256 ECDSA sign, OpenSSL on ovh-iad: 32.70 µs, 1.46× the fastest +P-256 ECDSA sign, OpenSSL on ovh-sea: 31.82 µs, 1.48× the fastest P-256 ECDSA verify P-256 ECDSA verify, rind on nixos: 39.25 µs, 1.00× the fastest P-256 ECDSA verify, rind on desktop: 30.95 µs, 1.03× the fastest P-256 ECDSA verify, rind on nixos2: 41.56 µs, 1.00× the fastest -P-256 ECDSA verify, rind on ovh-iad: 81.50 µs, 1.05× the fastest -P-256 ECDSA verify, rind on ovh-sea: 77.75 µs, 1.04× the fastest -P-256 ECDSA verify, aws-lc-rs on nixos: 40.24 µs, 1.03× the fastest -P-256 ECDSA verify, aws-lc-rs on desktop: 30.08 µs, 1.00× the fastest -P-256 ECDSA verify, aws-lc-rs on nixos2: 43.27 µs, 1.04× the fastest -P-256 ECDSA verify, aws-lc-rs on ovh-iad: 77.59 µs, 1.00× the fastest -P-256 ECDSA verify, aws-lc-rs on ovh-sea: 74.54 µs, 1.00× the fastest -P-256 ECDSA verify, ring on nixos: 41.25 µs, 1.05× the fastest -P-256 ECDSA verify, ring on desktop: 33.74 µs, 1.12× the fastest -P-256 ECDSA verify, ring on nixos2: 43.93 µs, 1.06× the fastest -P-256 ECDSA verify, ring on ovh-iad: 79.97 µs, 1.03× the fastest -P-256 ECDSA verify, ring on ovh-sea: 78.73 µs, 1.06× the fastest -P-256 ECDSA verify, RustCrypto + dalek on nixos: 226.27 µs, 5.77× the fastest -P-256 ECDSA verify, RustCrypto + dalek on desktop: 104.58 µs, 3.48× the fastest -P-256 ECDSA verify, RustCrypto + dalek on nixos2: 197.15 µs, 4.74× the fastest -P-256 ECDSA verify, RustCrypto + dalek on ovh-iad: 324.89 µs, 4.19× the fastest -P-256 ECDSA verify, RustCrypto + dalek on ovh-sea: 305.79 µs, 4.10× the fastest -P-256 ECDSA verify, graviola on nixos: 41.92 µs, 1.07× the fastest -P-256 ECDSA verify, graviola on desktop: 32.89 µs, 1.09× the fastest -P-256 ECDSA verify, graviola on nixos2: 44.30 µs, 1.07× the fastest -P-256 ECDSA verify, libcrux on nixos: 215.83 µs, 5.50× the fastest; verified: HACL*'s F* proof of Hacl.P256's dh_initiator, dh_responder, ecdsa_sign_p256_sha2, and ecdsa_verif_p256_sha2, compiled to Rust by an unverified step -✓ -P-256 ECDSA verify, libcrux on desktop: 147.11 µs, 4.89× the fastest; verified: HACL*'s F* proof of Hacl.P256's dh_initiator, dh_responder, ecdsa_sign_p256_sha2, and ecdsa_verif_p256_sha2, compiled to Rust by an unverified step -✓ -P-256 ECDSA verify, libcrux on nixos2: 236.87 µs, 5.70× the fastest; verified: HACL*'s F* proof of Hacl.P256's dh_initiator, dh_responder, ecdsa_sign_p256_sha2, and ecdsa_verif_p256_sha2, compiled to Rust by an unverified step -✓ -P-256 ECDSA verify, libcrux on ovh-iad: 389.47 µs, 5.02× the fastest; verified: HACL*'s F* proof of Hacl.P256's dh_initiator, dh_responder, ecdsa_sign_p256_sha2, and ecdsa_verif_p256_sha2, compiled to Rust by an unverified step -✓ -P-256 ECDSA verify, libcrux on ovh-sea: 363.17 µs, 4.87× the fastest; verified: HACL*'s F* proof of Hacl.P256's dh_initiator, dh_responder, ecdsa_sign_p256_sha2, and ecdsa_verif_p256_sha2, compiled to Rust by an unverified step -✓ -P-256 ECDSA verify, OpenSSL on nixos: 60.27 µs, 1.54× the fastest -P-256 ECDSA verify, OpenSSL on desktop: 46.41 µs, 1.54× the fastest -P-256 ECDSA verify, OpenSSL on nixos2: 68.34 µs, 1.64× the fastest -P-256 ECDSA verify, OpenSSL on ovh-iad: 115.24 µs, 1.49× the fastest -P-256 ECDSA verify, OpenSSL on ovh-sea: 111.98 µs, 1.50× the fastest +P-256 ECDSA verify, rind on kixtop: 27.15 µs, 1.00× the fastest; verified: rind's Lean proof, through Aeneas and hand models of the function-pointer dispatch and of the nonces' draws through a dyn RandomSource, which Aeneas cannot translate, of its signature API's P-256 ECDSA with SHA-256 and fixed-length signatures, key generation and loading, signing, and verification, down to s2n-bignum's routines, composed with s2n-bignum's HOL Light proofs of p256_scalarmulbase_alt, p256_montjadd_alt, p256_montjdouble_alt, p256_montjmixadd_alt, bignum_inv_p256, bignum_neg_p256, bignum_tomont_p256, bignum_demont_p256, bignum_add_p256, bignum_montmul_p256, bignum_montsqr_p256, bignum_mod_n256_4, bignum_modadd, bignum_montmul, bignum_demont, bignum_modinv, and bignum_eq, of s2n-bignum's own object code, which rind transliterates, with the group laws its twin multiplication relies on proven from Mathlib's and the generator's order n proven, assuming HOL Light's P256_GROUP_ELEMENT_ORDER, that a point has order n, only for verification with a parsed public key, and proving a signature right when signing returns, as its nonce loop has no bound +✓ +P-256 ECDSA verify, rind on ovh-iad: 81.50 µs, 1.05× the fastest +P-256 ECDSA verify, rind on ovh-sea: 77.75 µs, 1.04× the fastest +P-256 ECDSA verify, aws-lc-rs on nixos: 40.24 µs, 1.03× the fastest +P-256 ECDSA verify, aws-lc-rs on desktop: 30.08 µs, 1.00× the fastest +P-256 ECDSA verify, aws-lc-rs on nixos2: 43.27 µs, 1.04× the fastest +P-256 ECDSA verify, aws-lc-rs on kixtop: 27.15 µs, 1.00× the fastest +P-256 ECDSA verify, aws-lc-rs on ovh-iad: 77.59 µs, 1.00× the fastest +P-256 ECDSA verify, aws-lc-rs on ovh-sea: 74.54 µs, 1.00× the fastest +P-256 ECDSA verify, ring on nixos: 41.25 µs, 1.05× the fastest +P-256 ECDSA verify, ring on desktop: 33.74 µs, 1.12× the fastest +P-256 ECDSA verify, ring on nixos2: 43.93 µs, 1.06× the fastest +P-256 ECDSA verify, ring on kixtop: 29.35 µs, 1.08× the fastest +P-256 ECDSA verify, ring on ovh-iad: 79.97 µs, 1.03× the fastest +P-256 ECDSA verify, ring on ovh-sea: 78.73 µs, 1.06× the fastest +P-256 ECDSA verify, RustCrypto + dalek on nixos: 226.27 µs, 5.77× the fastest +P-256 ECDSA verify, RustCrypto + dalek on desktop: 104.58 µs, 3.48× the fastest +P-256 ECDSA verify, RustCrypto + dalek on nixos2: 197.15 µs, 4.74× the fastest +P-256 ECDSA verify, RustCrypto + dalek on kixtop: 157.87 µs, 5.82× the fastest +P-256 ECDSA verify, RustCrypto + dalek on ovh-iad: 324.89 µs, 4.19× the fastest +P-256 ECDSA verify, RustCrypto + dalek on ovh-sea: 305.79 µs, 4.10× the fastest +P-256 ECDSA verify, graviola on nixos: 41.92 µs, 1.07× the fastest +P-256 ECDSA verify, graviola on desktop: 32.89 µs, 1.09× the fastest +P-256 ECDSA verify, graviola on nixos2: 44.30 µs, 1.07× the fastest +P-256 ECDSA verify, graviola on kixtop: 28.60 µs, 1.05× the fastest +P-256 ECDSA verify, libcrux on nixos: 215.83 µs, 5.50× the fastest; verified: HACL*'s F* proof of Hacl.P256's dh_initiator, dh_responder, ecdsa_sign_p256_sha2, and ecdsa_verif_p256_sha2, compiled to Rust by an unverified step +✓ +P-256 ECDSA verify, libcrux on desktop: 147.11 µs, 4.89× the fastest; verified: HACL*'s F* proof of Hacl.P256's dh_initiator, dh_responder, ecdsa_sign_p256_sha2, and ecdsa_verif_p256_sha2, compiled to Rust by an unverified step +✓ +P-256 ECDSA verify, libcrux on nixos2: 236.87 µs, 5.70× the fastest; verified: HACL*'s F* proof of Hacl.P256's dh_initiator, dh_responder, ecdsa_sign_p256_sha2, and ecdsa_verif_p256_sha2, compiled to Rust by an unverified step +✓ +P-256 ECDSA verify, libcrux on kixtop: 156.54 µs, 5.77× the fastest; verified: HACL*'s F* proof of Hacl.P256's dh_initiator, dh_responder, ecdsa_sign_p256_sha2, and ecdsa_verif_p256_sha2, compiled to Rust by an unverified step +✓ +P-256 ECDSA verify, libcrux on ovh-iad: 389.47 µs, 5.02× the fastest; verified: HACL*'s F* proof of Hacl.P256's dh_initiator, dh_responder, ecdsa_sign_p256_sha2, and ecdsa_verif_p256_sha2, compiled to Rust by an unverified step +✓ +P-256 ECDSA verify, libcrux on ovh-sea: 363.17 µs, 4.87× the fastest; verified: HACL*'s F* proof of Hacl.P256's dh_initiator, dh_responder, ecdsa_sign_p256_sha2, and ecdsa_verif_p256_sha2, compiled to Rust by an unverified step +✓ +P-256 ECDSA verify, OpenSSL on nixos: 60.27 µs, 1.54× the fastest +P-256 ECDSA verify, OpenSSL on desktop: 46.41 µs, 1.54× the fastest +P-256 ECDSA verify, OpenSSL on nixos2: 68.34 µs, 1.64× the fastest +P-256 ECDSA verify, OpenSSL on kixtop: 41.90 µs, 1.54× the fastest +P-256 ECDSA verify, OpenSSL on ovh-iad: 115.24 µs, 1.49× the fastest +P-256 ECDSA verify, OpenSSL on ovh-sea: 111.98 µs, 1.50× the fastest Hashes and KDFs - + SHA-256, 64 B SHA-256, 64 B, rind on nixos: 69 ns, 1.17× the fastest SHA-256, 64 B, rind on desktop: 28 ns, 1.00× the fastest SHA-256, 64 B, rind on nixos2: 244 ns, 1.00× the fastest -SHA-256, 64 B, rind on ovh-iad: 399 ns, 1.00× the fastest -SHA-256, 64 B, rind on ovh-sea: 386 ns, 1.00× the fastest -SHA-256, 64 B, aws-lc-rs on nixos: 96 ns, 1.63× the fastest -SHA-256, 64 B, aws-lc-rs on desktop: 57 ns, 2.02× the fastest -SHA-256, 64 B, aws-lc-rs on nixos2: 307 ns, 1.26× the fastest -SHA-256, 64 B, aws-lc-rs on ovh-iad: 491 ns, 1.23× the fastest -SHA-256, 64 B, aws-lc-rs on ovh-sea: 481 ns, 1.24× the fastest -SHA-256, 64 B, ring on nixos: 78 ns, 1.34× the fastest -SHA-256, 64 B, ring on desktop: 58 ns, 2.04× the fastest -SHA-256, 64 B, ring on nixos2: 277 ns, 1.13× the fastest -SHA-256, 64 B, ring on ovh-iad: 449 ns, 1.13× the fastest -SHA-256, 64 B, ring on ovh-sea: 432 ns, 1.12× the fastest -SHA-256, 64 B, RustCrypto + dalek on nixos: 59 ns, 1.00× the fastest -SHA-256, 64 B, RustCrypto + dalek on desktop: 40 ns, 1.41× the fastest -SHA-256, 64 B, RustCrypto + dalek on nixos2: 473 ns, 1.94× the fastest -SHA-256, 64 B, RustCrypto + dalek on ovh-iad: 762 ns, 1.91× the fastest -SHA-256, 64 B, RustCrypto + dalek on ovh-sea: 734 ns, 1.90× the fastest -SHA-256, 64 B, graviola on nixos: 67 ns, 1.15× the fastest -SHA-256, 64 B, graviola on desktop: 41 ns, 1.45× the fastest -SHA-256, 64 B, graviola on nixos2: 576 ns, 2.37× the fastest -SHA-256, 64 B, libcrux on nixos: 385 ns, 6.56× the fastest; verified: HACL*'s F* proof of Hacl.Streaming.SHA2's hash_256 and hash_512, compiled to Rust by an unverified step -✓ -SHA-256, 64 B, libcrux on desktop: 211 ns, 7.50× the fastest; verified: HACL*'s F* proof of Hacl.Streaming.SHA2's hash_256 and hash_512, compiled to Rust by an unverified step -✓ -SHA-256, 64 B, libcrux on nixos2: 485 ns, 1.99× the fastest; verified: HACL*'s F* proof of Hacl.Streaming.SHA2's hash_256 and hash_512, compiled to Rust by an unverified step -✓ -SHA-256, 64 B, libcrux on ovh-iad: 764 ns, 1.92× the fastest; verified: HACL*'s F* proof of Hacl.Streaming.SHA2's hash_256 and hash_512, compiled to Rust by an unverified step -✓ -SHA-256, 64 B, libcrux on ovh-sea: 760 ns, 1.97× the fastest; verified: HACL*'s F* proof of Hacl.Streaming.SHA2's hash_256 and hash_512, compiled to Rust by an unverified step -✓ -SHA-256, 64 B, OpenSSL on nixos: 244 ns, 4.15× the fastest -SHA-256, 64 B, OpenSSL on desktop: 161 ns, 5.72× the fastest -SHA-256, 64 B, OpenSSL on nixos2: 505 ns, 2.07× the fastest -SHA-256, 64 B, OpenSSL on ovh-iad: 813 ns, 2.04× the fastest -SHA-256, 64 B, OpenSSL on ovh-sea: 801 ns, 2.07× the fastest +SHA-256, 64 B, rind on kixtop: 93 ns, 2.58× the fastest +SHA-256, 64 B, rind on ovh-iad: 399 ns, 1.00× the fastest +SHA-256, 64 B, rind on ovh-sea: 386 ns, 1.00× the fastest +SHA-256, 64 B, aws-lc-rs on nixos: 96 ns, 1.63× the fastest +SHA-256, 64 B, aws-lc-rs on desktop: 57 ns, 2.02× the fastest +SHA-256, 64 B, aws-lc-rs on nixos2: 307 ns, 1.26× the fastest +SHA-256, 64 B, aws-lc-rs on kixtop: 71 ns, 1.97× the fastest +SHA-256, 64 B, aws-lc-rs on ovh-iad: 491 ns, 1.23× the fastest +SHA-256, 64 B, aws-lc-rs on ovh-sea: 481 ns, 1.24× the fastest +SHA-256, 64 B, ring on nixos: 78 ns, 1.34× the fastest +SHA-256, 64 B, ring on desktop: 58 ns, 2.04× the fastest +SHA-256, 64 B, ring on nixos2: 277 ns, 1.13× the fastest +SHA-256, 64 B, ring on kixtop: 45 ns, 1.25× the fastest +SHA-256, 64 B, ring on ovh-iad: 449 ns, 1.13× the fastest +SHA-256, 64 B, ring on ovh-sea: 432 ns, 1.12× the fastest +SHA-256, 64 B, RustCrypto + dalek on nixos: 59 ns, 1.00× the fastest +SHA-256, 64 B, RustCrypto + dalek on desktop: 40 ns, 1.41× the fastest +SHA-256, 64 B, RustCrypto + dalek on nixos2: 473 ns, 1.94× the fastest +SHA-256, 64 B, RustCrypto + dalek on kixtop: 37 ns, 1.03× the fastest +SHA-256, 64 B, RustCrypto + dalek on ovh-iad: 762 ns, 1.91× the fastest +SHA-256, 64 B, RustCrypto + dalek on ovh-sea: 734 ns, 1.90× the fastest +SHA-256, 64 B, graviola on nixos: 67 ns, 1.15× the fastest +SHA-256, 64 B, graviola on desktop: 41 ns, 1.45× the fastest +SHA-256, 64 B, graviola on nixos2: 576 ns, 2.37× the fastest +SHA-256, 64 B, graviola on kixtop: 36 ns, 1.00× the fastest +SHA-256, 64 B, libcrux on nixos: 385 ns, 6.56× the fastest; verified: HACL*'s F* proof of Hacl.Streaming.SHA2's hash_256 and hash_512, compiled to Rust by an unverified step +✓ +SHA-256, 64 B, libcrux on desktop: 211 ns, 7.50× the fastest; verified: HACL*'s F* proof of Hacl.Streaming.SHA2's hash_256 and hash_512, compiled to Rust by an unverified step +✓ +SHA-256, 64 B, libcrux on nixos2: 485 ns, 1.99× the fastest; verified: HACL*'s F* proof of Hacl.Streaming.SHA2's hash_256 and hash_512, compiled to Rust by an unverified step +✓ +SHA-256, 64 B, libcrux on kixtop: 232 ns, 6.45× the fastest; verified: HACL*'s F* proof of Hacl.Streaming.SHA2's hash_256 and hash_512, compiled to Rust by an unverified step +✓ +SHA-256, 64 B, libcrux on ovh-iad: 764 ns, 1.92× the fastest; verified: HACL*'s F* proof of Hacl.Streaming.SHA2's hash_256 and hash_512, compiled to Rust by an unverified step +✓ +SHA-256, 64 B, libcrux on ovh-sea: 760 ns, 1.97× the fastest; verified: HACL*'s F* proof of Hacl.Streaming.SHA2's hash_256 and hash_512, compiled to Rust by an unverified step +✓ +SHA-256, 64 B, OpenSSL on nixos: 244 ns, 4.15× the fastest +SHA-256, 64 B, OpenSSL on desktop: 161 ns, 5.72× the fastest +SHA-256, 64 B, OpenSSL on nixos2: 505 ns, 2.07× the fastest +SHA-256, 64 B, OpenSSL on kixtop: 162 ns, 4.50× the fastest +SHA-256, 64 B, OpenSSL on ovh-iad: 813 ns, 2.04× the fastest +SHA-256, 64 B, OpenSSL on ovh-sea: 801 ns, 2.07× the fastest SHA-256, 1350 B SHA-256, 1350 B, rind on nixos: 620 ns, 1.00× the fastest SHA-256, 1350 B, rind on desktop: 279 ns, 1.00× the fastest SHA-256, 1350 B, rind on nixos2: 2.46 µs, 1.00× the fastest -SHA-256, 1350 B, rind on ovh-iad: 3.87 µs, 1.00× the fastest -SHA-256, 1350 B, rind on ovh-sea: 3.85 µs, 1.00× the fastest -SHA-256, 1350 B, aws-lc-rs on nixos: 740 ns, 1.20× the fastest -SHA-256, 1350 B, aws-lc-rs on desktop: 312 ns, 1.12× the fastest -SHA-256, 1350 B, aws-lc-rs on nixos2: 2.79 µs, 1.14× the fastest -SHA-256, 1350 B, aws-lc-rs on ovh-iad: 4.74 µs, 1.22× the fastest -SHA-256, 1350 B, aws-lc-rs on ovh-sea: 4.75 µs, 1.23× the fastest -SHA-256, 1350 B, ring on nixos: 637 ns, 1.03× the fastest -SHA-256, 1350 B, ring on desktop: 304 ns, 1.09× the fastest -SHA-256, 1350 B, ring on nixos2: 2.82 µs, 1.15× the fastest -SHA-256, 1350 B, ring on ovh-iad: 4.47 µs, 1.15× the fastest -SHA-256, 1350 B, ring on ovh-sea: 4.31 µs, 1.12× the fastest -SHA-256, 1350 B, RustCrypto + dalek on nixos: 618 ns, 1.00× the fastest -SHA-256, 1350 B, RustCrypto + dalek on desktop: 296 ns, 1.06× the fastest -SHA-256, 1350 B, RustCrypto + dalek on nixos2: 5.11 µs, 2.08× the fastest -SHA-256, 1350 B, RustCrypto + dalek on ovh-iad: 8.13 µs, 2.10× the fastest -SHA-256, 1350 B, RustCrypto + dalek on ovh-sea: 8.29 µs, 2.15× the fastest -SHA-256, 1350 B, graviola on nixos: 637 ns, 1.03× the fastest -SHA-256, 1350 B, graviola on desktop: 297 ns, 1.06× the fastest -SHA-256, 1350 B, graviola on nixos2: 6.07 µs, 2.47× the fastest -SHA-256, 1350 B, libcrux on nixos: 3.71 µs, 6.00× the fastest; verified: HACL*'s F* proof of Hacl.Streaming.SHA2's hash_256 and hash_512, compiled to Rust by an unverified step -✓ -SHA-256, 1350 B, libcrux on desktop: 2.31 µs, 8.25× the fastest; verified: HACL*'s F* proof of Hacl.Streaming.SHA2's hash_256 and hash_512, compiled to Rust by an unverified step -✓ -SHA-256, 1350 B, libcrux on nixos2: 5.23 µs, 2.13× the fastest; verified: HACL*'s F* proof of Hacl.Streaming.SHA2's hash_256 and hash_512, compiled to Rust by an unverified step -✓ -SHA-256, 1350 B, libcrux on ovh-iad: 8.43 µs, 2.18× the fastest; verified: HACL*'s F* proof of Hacl.Streaming.SHA2's hash_256 and hash_512, compiled to Rust by an unverified step -✓ -SHA-256, 1350 B, libcrux on ovh-sea: 8.24 µs, 2.14× the fastest; verified: HACL*'s F* proof of Hacl.Streaming.SHA2's hash_256 and hash_512, compiled to Rust by an unverified step -✓ -SHA-256, 1350 B, OpenSSL on nixos: 815 ns, 1.32× the fastest -SHA-256, 1350 B, OpenSSL on desktop: 415 ns, 1.48× the fastest -SHA-256, 1350 B, OpenSSL on nixos2: 2.68 µs, 1.09× the fastest -SHA-256, 1350 B, OpenSSL on ovh-iad: 4.34 µs, 1.12× the fastest -SHA-256, 1350 B, OpenSSL on ovh-sea: 4.22 µs, 1.10× the fastest +SHA-256, 1350 B, rind on kixtop: 484 ns, 1.17× the fastest +SHA-256, 1350 B, rind on ovh-iad: 3.87 µs, 1.00× the fastest +SHA-256, 1350 B, rind on ovh-sea: 3.85 µs, 1.00× the fastest +SHA-256, 1350 B, aws-lc-rs on nixos: 740 ns, 1.20× the fastest +SHA-256, 1350 B, aws-lc-rs on desktop: 312 ns, 1.12× the fastest +SHA-256, 1350 B, aws-lc-rs on nixos2: 2.79 µs, 1.14× the fastest +SHA-256, 1350 B, aws-lc-rs on kixtop: 440 ns, 1.06× the fastest +SHA-256, 1350 B, aws-lc-rs on ovh-iad: 4.74 µs, 1.22× the fastest +SHA-256, 1350 B, aws-lc-rs on ovh-sea: 4.75 µs, 1.23× the fastest +SHA-256, 1350 B, ring on nixos: 637 ns, 1.03× the fastest +SHA-256, 1350 B, ring on desktop: 304 ns, 1.09× the fastest +SHA-256, 1350 B, ring on nixos2: 2.82 µs, 1.15× the fastest +SHA-256, 1350 B, ring on kixtop: 414 ns, 1.00× the fastest +SHA-256, 1350 B, ring on ovh-iad: 4.47 µs, 1.15× the fastest +SHA-256, 1350 B, ring on ovh-sea: 4.31 µs, 1.12× the fastest +SHA-256, 1350 B, RustCrypto + dalek on nixos: 618 ns, 1.00× the fastest +SHA-256, 1350 B, RustCrypto + dalek on desktop: 296 ns, 1.06× the fastest +SHA-256, 1350 B, RustCrypto + dalek on nixos2: 5.11 µs, 2.08× the fastest +SHA-256, 1350 B, RustCrypto + dalek on kixtop: 475 ns, 1.15× the fastest +SHA-256, 1350 B, RustCrypto + dalek on ovh-iad: 8.13 µs, 2.10× the fastest +SHA-256, 1350 B, RustCrypto + dalek on ovh-sea: 8.29 µs, 2.15× the fastest +SHA-256, 1350 B, graviola on nixos: 637 ns, 1.03× the fastest +SHA-256, 1350 B, graviola on desktop: 297 ns, 1.06× the fastest +SHA-256, 1350 B, graviola on nixos2: 6.07 µs, 2.47× the fastest +SHA-256, 1350 B, graviola on kixtop: 472 ns, 1.14× the fastest +SHA-256, 1350 B, libcrux on nixos: 3.71 µs, 6.00× the fastest; verified: HACL*'s F* proof of Hacl.Streaming.SHA2's hash_256 and hash_512, compiled to Rust by an unverified step +✓ +SHA-256, 1350 B, libcrux on desktop: 2.31 µs, 8.25× the fastest; verified: HACL*'s F* proof of Hacl.Streaming.SHA2's hash_256 and hash_512, compiled to Rust by an unverified step +✓ +SHA-256, 1350 B, libcrux on nixos2: 5.23 µs, 2.13× the fastest; verified: HACL*'s F* proof of Hacl.Streaming.SHA2's hash_256 and hash_512, compiled to Rust by an unverified step +✓ +SHA-256, 1350 B, libcrux on kixtop: 2.52 µs, 6.08× the fastest; verified: HACL*'s F* proof of Hacl.Streaming.SHA2's hash_256 and hash_512, compiled to Rust by an unverified step +✓ +SHA-256, 1350 B, libcrux on ovh-iad: 8.43 µs, 2.18× the fastest; verified: HACL*'s F* proof of Hacl.Streaming.SHA2's hash_256 and hash_512, compiled to Rust by an unverified step +✓ +SHA-256, 1350 B, libcrux on ovh-sea: 8.24 µs, 2.14× the fastest; verified: HACL*'s F* proof of Hacl.Streaming.SHA2's hash_256 and hash_512, compiled to Rust by an unverified step +✓ +SHA-256, 1350 B, OpenSSL on nixos: 815 ns, 1.32× the fastest +SHA-256, 1350 B, OpenSSL on desktop: 415 ns, 1.48× the fastest +SHA-256, 1350 B, OpenSSL on nixos2: 2.68 µs, 1.09× the fastest +SHA-256, 1350 B, OpenSSL on kixtop: 531 ns, 1.28× the fastest +SHA-256, 1350 B, OpenSSL on ovh-iad: 4.34 µs, 1.12× the fastest +SHA-256, 1350 B, OpenSSL on ovh-sea: 4.22 µs, 1.10× the fastest SHA-256, 16 KB SHA-256, 16 KB, rind on nixos: 6.86 µs, 1.00× the fastest SHA-256, 16 KB, rind on desktop: 3.24 µs, 1.00× the fastest SHA-256, 16 KB, rind on nixos2: 28.06 µs, 1.00× the fastest -SHA-256, 16 KB, rind on ovh-iad: 45.11 µs, 1.00× the fastest -SHA-256, 16 KB, rind on ovh-sea: 43.51 µs, 1.00× the fastest -SHA-256, 16 KB, aws-lc-rs on nixos: 6.88 µs, 1.00× the fastest -SHA-256, 16 KB, aws-lc-rs on desktop: 3.28 µs, 1.01× the fastest -SHA-256, 16 KB, aws-lc-rs on nixos2: 31.46 µs, 1.12× the fastest -SHA-256, 16 KB, aws-lc-rs on ovh-iad: 50.68 µs, 1.12× the fastest -SHA-256, 16 KB, aws-lc-rs on ovh-sea: 49.41 µs, 1.14× the fastest -SHA-256, 16 KB, ring on nixos: 6.97 µs, 1.01× the fastest -SHA-256, 16 KB, ring on desktop: 3.28 µs, 1.01× the fastest -SHA-256, 16 KB, ring on nixos2: 32.37 µs, 1.15× the fastest -SHA-256, 16 KB, ring on ovh-iad: 50.70 µs, 1.12× the fastest -SHA-256, 16 KB, ring on ovh-sea: 51.35 µs, 1.18× the fastest -SHA-256, 16 KB, RustCrypto + dalek on nixos: 7.22 µs, 1.05× the fastest -SHA-256, 16 KB, RustCrypto + dalek on desktop: 3.26 µs, 1.01× the fastest -SHA-256, 16 KB, RustCrypto + dalek on nixos2: 58.17 µs, 2.07× the fastest -SHA-256, 16 KB, RustCrypto + dalek on ovh-iad: 93.30 µs, 2.07× the fastest -SHA-256, 16 KB, RustCrypto + dalek on ovh-sea: 92.84 µs, 2.13× the fastest -SHA-256, 16 KB, graviola on nixos: 7.08 µs, 1.03× the fastest -SHA-256, 16 KB, graviola on desktop: 3.27 µs, 1.01× the fastest -SHA-256, 16 KB, graviola on nixos2: 69.84 µs, 2.49× the fastest -SHA-256, 16 KB, libcrux on nixos: 43.12 µs, 6.28× the fastest; verified: HACL*'s F* proof of Hacl.Streaming.SHA2's hash_256 and hash_512, compiled to Rust by an unverified step -✓ -SHA-256, 16 KB, libcrux on desktop: 26.81 µs, 8.27× the fastest; verified: HACL*'s F* proof of Hacl.Streaming.SHA2's hash_256 and hash_512, compiled to Rust by an unverified step -✓ -SHA-256, 16 KB, libcrux on nixos2: 61.68 µs, 2.20× the fastest; verified: HACL*'s F* proof of Hacl.Streaming.SHA2's hash_256 and hash_512, compiled to Rust by an unverified step -✓ -SHA-256, 16 KB, libcrux on ovh-iad: 96.58 µs, 2.14× the fastest; verified: HACL*'s F* proof of Hacl.Streaming.SHA2's hash_256 and hash_512, compiled to Rust by an unverified step -✓ -SHA-256, 16 KB, libcrux on ovh-sea: 97.66 µs, 2.24× the fastest; verified: HACL*'s F* proof of Hacl.Streaming.SHA2's hash_256 and hash_512, compiled to Rust by an unverified step -✓ -SHA-256, 16 KB, OpenSSL on nixos: 7.37 µs, 1.07× the fastest -SHA-256, 16 KB, OpenSSL on desktop: 3.39 µs, 1.05× the fastest -SHA-256, 16 KB, OpenSSL on nixos2: 28.83 µs, 1.03× the fastest -SHA-256, 16 KB, OpenSSL on ovh-iad: 45.56 µs, 1.01× the fastest -SHA-256, 16 KB, OpenSSL on ovh-sea: 43.72 µs, 1.00× the fastest +SHA-256, 16 KB, rind on kixtop: 4.94 µs, 1.01× the fastest +SHA-256, 16 KB, rind on ovh-iad: 45.11 µs, 1.00× the fastest +SHA-256, 16 KB, rind on ovh-sea: 43.51 µs, 1.00× the fastest +SHA-256, 16 KB, aws-lc-rs on nixos: 6.88 µs, 1.00× the fastest +SHA-256, 16 KB, aws-lc-rs on desktop: 3.28 µs, 1.01× the fastest +SHA-256, 16 KB, aws-lc-rs on nixos2: 31.46 µs, 1.12× the fastest +SHA-256, 16 KB, aws-lc-rs on kixtop: 4.87 µs, 1.00× the fastest +SHA-256, 16 KB, aws-lc-rs on ovh-iad: 50.68 µs, 1.12× the fastest +SHA-256, 16 KB, aws-lc-rs on ovh-sea: 49.41 µs, 1.14× the fastest +SHA-256, 16 KB, ring on nixos: 6.97 µs, 1.01× the fastest +SHA-256, 16 KB, ring on desktop: 3.28 µs, 1.01× the fastest +SHA-256, 16 KB, ring on nixos2: 32.37 µs, 1.15× the fastest +SHA-256, 16 KB, ring on kixtop: 4.90 µs, 1.01× the fastest +SHA-256, 16 KB, ring on ovh-iad: 50.70 µs, 1.12× the fastest +SHA-256, 16 KB, ring on ovh-sea: 51.35 µs, 1.18× the fastest +SHA-256, 16 KB, RustCrypto + dalek on nixos: 7.22 µs, 1.05× the fastest +SHA-256, 16 KB, RustCrypto + dalek on desktop: 3.26 µs, 1.01× the fastest +SHA-256, 16 KB, RustCrypto + dalek on nixos2: 58.17 µs, 2.07× the fastest +SHA-256, 16 KB, RustCrypto + dalek on kixtop: 5.69 µs, 1.17× the fastest +SHA-256, 16 KB, RustCrypto + dalek on ovh-iad: 93.30 µs, 2.07× the fastest +SHA-256, 16 KB, RustCrypto + dalek on ovh-sea: 92.84 µs, 2.13× the fastest +SHA-256, 16 KB, graviola on nixos: 7.08 µs, 1.03× the fastest +SHA-256, 16 KB, graviola on desktop: 3.27 µs, 1.01× the fastest +SHA-256, 16 KB, graviola on nixos2: 69.84 µs, 2.49× the fastest +SHA-256, 16 KB, graviola on kixtop: 5.76 µs, 1.18× the fastest +SHA-256, 16 KB, libcrux on nixos: 43.12 µs, 6.28× the fastest; verified: HACL*'s F* proof of Hacl.Streaming.SHA2's hash_256 and hash_512, compiled to Rust by an unverified step +✓ +SHA-256, 16 KB, libcrux on desktop: 26.81 µs, 8.27× the fastest; verified: HACL*'s F* proof of Hacl.Streaming.SHA2's hash_256 and hash_512, compiled to Rust by an unverified step +✓ +SHA-256, 16 KB, libcrux on nixos2: 61.68 µs, 2.20× the fastest; verified: HACL*'s F* proof of Hacl.Streaming.SHA2's hash_256 and hash_512, compiled to Rust by an unverified step +✓ +SHA-256, 16 KB, libcrux on kixtop: 29.13 µs, 5.98× the fastest; verified: HACL*'s F* proof of Hacl.Streaming.SHA2's hash_256 and hash_512, compiled to Rust by an unverified step +✓ +SHA-256, 16 KB, libcrux on ovh-iad: 96.58 µs, 2.14× the fastest; verified: HACL*'s F* proof of Hacl.Streaming.SHA2's hash_256 and hash_512, compiled to Rust by an unverified step +✓ +SHA-256, 16 KB, libcrux on ovh-sea: 97.66 µs, 2.24× the fastest; verified: HACL*'s F* proof of Hacl.Streaming.SHA2's hash_256 and hash_512, compiled to Rust by an unverified step +✓ +SHA-256, 16 KB, OpenSSL on nixos: 7.37 µs, 1.07× the fastest +SHA-256, 16 KB, OpenSSL on desktop: 3.39 µs, 1.05× the fastest +SHA-256, 16 KB, OpenSSL on nixos2: 28.83 µs, 1.03× the fastest +SHA-256, 16 KB, OpenSSL on kixtop: 5.17 µs, 1.06× the fastest +SHA-256, 16 KB, OpenSSL on ovh-iad: 45.56 µs, 1.01× the fastest +SHA-256, 16 KB, OpenSSL on ovh-sea: 43.72 µs, 1.00× the fastest SHA-512, 64 B SHA-512, 64 B, rind on nixos: 138 ns, 1.00× the fastest SHA-512, 64 B, rind on desktop: 60 ns, 1.00× the fastest SHA-512, 64 B, rind on nixos2: 198 ns, 1.00× the fastest -SHA-512, 64 B, rind on ovh-iad: 321 ns, 1.00× the fastest -SHA-512, 64 B, rind on ovh-sea: 304 ns, 1.00× the fastest -SHA-512, 64 B, aws-lc-rs on nixos: 224 ns, 1.62× the fastest -SHA-512, 64 B, aws-lc-rs on desktop: 136 ns, 2.27× the fastest; verified: aws-lc-verification's SAW proof of SHA-512 through EVP_Digest, padding included, over sha512_block_data_order_avx, which aws-lc runs only on Intel; of aws-lc c21d40da, whose SHA-512 code 5.12.0 keeps -✓ -SHA-512, 64 B, aws-lc-rs on nixos2: 228 ns, 1.15× the fastest; verified: aws-lc-verification's SAW proof of SHA-512 through EVP_Digest, padding included, over sha512_block_data_order_avx, which aws-lc runs only on Intel; of aws-lc c21d40da, whose SHA-512 code 5.12.0 keeps +SHA-512, 64 B, rind on kixtop: 113 ns, 1.44× the fastest +SHA-512, 64 B, rind on ovh-iad: 321 ns, 1.00× the fastest +SHA-512, 64 B, rind on ovh-sea: 304 ns, 1.00× the fastest +SHA-512, 64 B, aws-lc-rs on nixos: 224 ns, 1.62× the fastest +SHA-512, 64 B, aws-lc-rs on desktop: 136 ns, 2.27× the fastest; verified: aws-lc-verification's SAW proof of SHA-512 through EVP_Digest, padding included, over sha512_block_data_order_avx, which aws-lc runs only on Intel; of aws-lc c21d40da, whose SHA-512 code 5.12.0 keeps ✓ -SHA-512, 64 B, aws-lc-rs on ovh-iad: 389 ns, 1.21× the fastest; verified: aws-lc-verification's SAW proof of SHA-512 through EVP_Digest, padding included, over sha512_block_data_order_avx, which aws-lc runs only on Intel; of aws-lc c21d40da, whose SHA-512 code 5.12.0 keeps +SHA-512, 64 B, aws-lc-rs on nixos2: 228 ns, 1.15× the fastest; verified: aws-lc-verification's SAW proof of SHA-512 through EVP_Digest, padding included, over sha512_block_data_order_avx, which aws-lc runs only on Intel; of aws-lc c21d40da, whose SHA-512 code 5.12.0 keeps ✓ -SHA-512, 64 B, aws-lc-rs on ovh-sea: 362 ns, 1.19× the fastest; verified: aws-lc-verification's SAW proof of SHA-512 through EVP_Digest, padding included, over sha512_block_data_order_avx, which aws-lc runs only on Intel; of aws-lc c21d40da, whose SHA-512 code 5.12.0 keeps -✓ -SHA-512, 64 B, ring on nixos: 198 ns, 1.43× the fastest -SHA-512, 64 B, ring on desktop: 142 ns, 2.36× the fastest -SHA-512, 64 B, ring on nixos2: 203 ns, 1.02× the fastest -SHA-512, 64 B, ring on ovh-iad: 321 ns, 1.00× the fastest -SHA-512, 64 B, ring on ovh-sea: 331 ns, 1.09× the fastest -SHA-512, 64 B, RustCrypto + dalek on nixos: 192 ns, 1.39× the fastest -SHA-512, 64 B, RustCrypto + dalek on desktop: 120 ns, 1.99× the fastest -SHA-512, 64 B, RustCrypto + dalek on nixos2: 270 ns, 1.36× the fastest -SHA-512, 64 B, RustCrypto + dalek on ovh-iad: 435 ns, 1.35× the fastest -SHA-512, 64 B, RustCrypto + dalek on ovh-sea: 424 ns, 1.40× the fastest -SHA-512, 64 B, graviola on nixos: 206 ns, 1.49× the fastest -SHA-512, 64 B, graviola on desktop: 150 ns, 2.49× the fastest -SHA-512, 64 B, graviola on nixos2: 236 ns, 1.19× the fastest -SHA-512, 64 B, libcrux on nixos: 246 ns, 1.78× the fastest; verified: HACL*'s F* proof of Hacl.Streaming.SHA2's hash_256 and hash_512, compiled to Rust by an unverified step -✓ -SHA-512, 64 B, libcrux on desktop: 167 ns, 2.78× the fastest; verified: HACL*'s F* proof of Hacl.Streaming.SHA2's hash_256 and hash_512, compiled to Rust by an unverified step -✓ -SHA-512, 64 B, libcrux on nixos2: 289 ns, 1.45× the fastest; verified: HACL*'s F* proof of Hacl.Streaming.SHA2's hash_256 and hash_512, compiled to Rust by an unverified step -✓ -SHA-512, 64 B, libcrux on ovh-iad: 462 ns, 1.44× the fastest; verified: HACL*'s F* proof of Hacl.Streaming.SHA2's hash_256 and hash_512, compiled to Rust by an unverified step -✓ -SHA-512, 64 B, libcrux on ovh-sea: 443 ns, 1.46× the fastest; verified: HACL*'s F* proof of Hacl.Streaming.SHA2's hash_256 and hash_512, compiled to Rust by an unverified step -✓ -SHA-512, 64 B, OpenSSL on nixos: 355 ns, 2.57× the fastest -SHA-512, 64 B, OpenSSL on desktop: 233 ns, 3.87× the fastest -SHA-512, 64 B, OpenSSL on nixos2: 430 ns, 2.17× the fastest -SHA-512, 64 B, OpenSSL on ovh-iad: 699 ns, 2.18× the fastest -SHA-512, 64 B, OpenSSL on ovh-sea: 682 ns, 2.25× the fastest +SHA-512, 64 B, aws-lc-rs on kixtop: 108 ns, 1.37× the fastest +SHA-512, 64 B, aws-lc-rs on ovh-iad: 389 ns, 1.21× the fastest; verified: aws-lc-verification's SAW proof of SHA-512 through EVP_Digest, padding included, over sha512_block_data_order_avx, which aws-lc runs only on Intel; of aws-lc c21d40da, whose SHA-512 code 5.12.0 keeps +✓ +SHA-512, 64 B, aws-lc-rs on ovh-sea: 362 ns, 1.19× the fastest; verified: aws-lc-verification's SAW proof of SHA-512 through EVP_Digest, padding included, over sha512_block_data_order_avx, which aws-lc runs only on Intel; of aws-lc c21d40da, whose SHA-512 code 5.12.0 keeps +✓ +SHA-512, 64 B, ring on nixos: 198 ns, 1.43× the fastest +SHA-512, 64 B, ring on desktop: 142 ns, 2.36× the fastest +SHA-512, 64 B, ring on nixos2: 203 ns, 1.02× the fastest +SHA-512, 64 B, ring on kixtop: 88 ns, 1.11× the fastest +SHA-512, 64 B, ring on ovh-iad: 321 ns, 1.00× the fastest +SHA-512, 64 B, ring on ovh-sea: 331 ns, 1.09× the fastest +SHA-512, 64 B, RustCrypto + dalek on nixos: 192 ns, 1.39× the fastest +SHA-512, 64 B, RustCrypto + dalek on desktop: 120 ns, 1.99× the fastest +SHA-512, 64 B, RustCrypto + dalek on nixos2: 270 ns, 1.36× the fastest +SHA-512, 64 B, RustCrypto + dalek on kixtop: 79 ns, 1.00× the fastest +SHA-512, 64 B, RustCrypto + dalek on ovh-iad: 435 ns, 1.35× the fastest +SHA-512, 64 B, RustCrypto + dalek on ovh-sea: 424 ns, 1.40× the fastest +SHA-512, 64 B, graviola on nixos: 206 ns, 1.49× the fastest +SHA-512, 64 B, graviola on desktop: 150 ns, 2.49× the fastest +SHA-512, 64 B, graviola on nixos2: 236 ns, 1.19× the fastest +SHA-512, 64 B, graviola on kixtop: 177 ns, 2.25× the fastest +SHA-512, 64 B, libcrux on nixos: 246 ns, 1.78× the fastest; verified: HACL*'s F* proof of Hacl.Streaming.SHA2's hash_256 and hash_512, compiled to Rust by an unverified step +✓ +SHA-512, 64 B, libcrux on desktop: 167 ns, 2.78× the fastest; verified: HACL*'s F* proof of Hacl.Streaming.SHA2's hash_256 and hash_512, compiled to Rust by an unverified step +✓ +SHA-512, 64 B, libcrux on nixos2: 289 ns, 1.45× the fastest; verified: HACL*'s F* proof of Hacl.Streaming.SHA2's hash_256 and hash_512, compiled to Rust by an unverified step +✓ +SHA-512, 64 B, libcrux on kixtop: 141 ns, 1.79× the fastest; verified: HACL*'s F* proof of Hacl.Streaming.SHA2's hash_256 and hash_512, compiled to Rust by an unverified step +✓ +SHA-512, 64 B, libcrux on ovh-iad: 462 ns, 1.44× the fastest; verified: HACL*'s F* proof of Hacl.Streaming.SHA2's hash_256 and hash_512, compiled to Rust by an unverified step +✓ +SHA-512, 64 B, libcrux on ovh-sea: 443 ns, 1.46× the fastest; verified: HACL*'s F* proof of Hacl.Streaming.SHA2's hash_256 and hash_512, compiled to Rust by an unverified step +✓ +SHA-512, 64 B, OpenSSL on nixos: 355 ns, 2.57× the fastest +SHA-512, 64 B, OpenSSL on desktop: 233 ns, 3.87× the fastest +SHA-512, 64 B, OpenSSL on nixos2: 430 ns, 2.17× the fastest +SHA-512, 64 B, OpenSSL on kixtop: 211 ns, 2.68× the fastest +SHA-512, 64 B, OpenSSL on ovh-iad: 699 ns, 2.18× the fastest +SHA-512, 64 B, OpenSSL on ovh-sea: 682 ns, 2.25× the fastest SHA-512, 1350 B SHA-512, 1350 B, rind on nixos: 1.77 µs, 1.01× the fastest SHA-512, 1350 B, rind on desktop: 470 ns, 1.00× the fastest SHA-512, 1350 B, rind on nixos2: 1.65 µs, 1.00× the fastest -SHA-512, 1350 B, rind on ovh-iad: 2.60 µs, 1.00× the fastest -SHA-512, 1350 B, rind on ovh-sea: 2.54 µs, 1.00× the fastest -SHA-512, 1350 B, aws-lc-rs on nixos: 1.90 µs, 1.08× the fastest -SHA-512, 1350 B, aws-lc-rs on desktop: 1.27 µs, 2.69× the fastest; verified: aws-lc-verification's SAW proof of SHA-512 through EVP_Digest, padding included, over sha512_block_data_order_avx, which aws-lc runs only on Intel; of aws-lc c21d40da, whose SHA-512 code 5.12.0 keeps -✓ -SHA-512, 1350 B, aws-lc-rs on nixos2: 1.97 µs, 1.19× the fastest; verified: aws-lc-verification's SAW proof of SHA-512 through EVP_Digest, padding included, over sha512_block_data_order_avx, which aws-lc runs only on Intel; of aws-lc c21d40da, whose SHA-512 code 5.12.0 keeps +SHA-512, 1350 B, rind on kixtop: 827 ns, 1.15× the fastest +SHA-512, 1350 B, rind on ovh-iad: 2.60 µs, 1.00× the fastest +SHA-512, 1350 B, rind on ovh-sea: 2.54 µs, 1.00× the fastest +SHA-512, 1350 B, aws-lc-rs on nixos: 1.90 µs, 1.08× the fastest +SHA-512, 1350 B, aws-lc-rs on desktop: 1.27 µs, 2.69× the fastest; verified: aws-lc-verification's SAW proof of SHA-512 through EVP_Digest, padding included, over sha512_block_data_order_avx, which aws-lc runs only on Intel; of aws-lc c21d40da, whose SHA-512 code 5.12.0 keeps ✓ -SHA-512, 1350 B, aws-lc-rs on ovh-iad: 3.12 µs, 1.20× the fastest; verified: aws-lc-verification's SAW proof of SHA-512 through EVP_Digest, padding included, over sha512_block_data_order_avx, which aws-lc runs only on Intel; of aws-lc c21d40da, whose SHA-512 code 5.12.0 keeps +SHA-512, 1350 B, aws-lc-rs on nixos2: 1.97 µs, 1.19× the fastest; verified: aws-lc-verification's SAW proof of SHA-512 through EVP_Digest, padding included, over sha512_block_data_order_avx, which aws-lc runs only on Intel; of aws-lc c21d40da, whose SHA-512 code 5.12.0 keeps ✓ -SHA-512, 1350 B, aws-lc-rs on ovh-sea: 3.04 µs, 1.19× the fastest; verified: aws-lc-verification's SAW proof of SHA-512 through EVP_Digest, padding included, over sha512_block_data_order_avx, which aws-lc runs only on Intel; of aws-lc c21d40da, whose SHA-512 code 5.12.0 keeps -✓ -SHA-512, 1350 B, ring on nixos: 1.87 µs, 1.06× the fastest -SHA-512, 1350 B, ring on desktop: 1.26 µs, 2.69× the fastest -SHA-512, 1350 B, ring on nixos2: 1.93 µs, 1.17× the fastest -SHA-512, 1350 B, ring on ovh-iad: 3.02 µs, 1.16× the fastest -SHA-512, 1350 B, ring on ovh-sea: 2.97 µs, 1.17× the fastest -SHA-512, 1350 B, RustCrypto + dalek on nixos: 1.92 µs, 1.09× the fastest -SHA-512, 1350 B, RustCrypto + dalek on desktop: 1.18 µs, 2.50× the fastest -SHA-512, 1350 B, RustCrypto + dalek on nixos2: 2.67 µs, 1.61× the fastest -SHA-512, 1350 B, RustCrypto + dalek on ovh-iad: 4.26 µs, 1.64× the fastest -SHA-512, 1350 B, RustCrypto + dalek on ovh-sea: 4.17 µs, 1.64× the fastest -SHA-512, 1350 B, graviola on nixos: 1.98 µs, 1.13× the fastest -SHA-512, 1350 B, graviola on desktop: 1.51 µs, 3.21× the fastest -SHA-512, 1350 B, graviola on nixos2: 2.35 µs, 1.42× the fastest -SHA-512, 1350 B, libcrux on nixos: 2.94 µs, 1.67× the fastest; verified: HACL*'s F* proof of Hacl.Streaming.SHA2's hash_256 and hash_512, compiled to Rust by an unverified step -✓ -SHA-512, 1350 B, libcrux on desktop: 1.69 µs, 3.59× the fastest; verified: HACL*'s F* proof of Hacl.Streaming.SHA2's hash_256 and hash_512, compiled to Rust by an unverified step -✓ -SHA-512, 1350 B, libcrux on nixos2: 3.08 µs, 1.86× the fastest; verified: HACL*'s F* proof of Hacl.Streaming.SHA2's hash_256 and hash_512, compiled to Rust by an unverified step -✓ -SHA-512, 1350 B, libcrux on ovh-iad: 4.91 µs, 1.88× the fastest; verified: HACL*'s F* proof of Hacl.Streaming.SHA2's hash_256 and hash_512, compiled to Rust by an unverified step -✓ -SHA-512, 1350 B, libcrux on ovh-sea: 4.66 µs, 1.83× the fastest; verified: HACL*'s F* proof of Hacl.Streaming.SHA2's hash_256 and hash_512, compiled to Rust by an unverified step -✓ -SHA-512, 1350 B, OpenSSL on nixos: 1.76 µs, 1.00× the fastest -SHA-512, 1350 B, OpenSSL on desktop: 1.20 µs, 2.55× the fastest -SHA-512, 1350 B, OpenSSL on nixos2: 1.90 µs, 1.15× the fastest -SHA-512, 1350 B, OpenSSL on ovh-iad: 3.10 µs, 1.19× the fastest -SHA-512, 1350 B, OpenSSL on ovh-sea: 2.99 µs, 1.18× the fastest +SHA-512, 1350 B, aws-lc-rs on kixtop: 775 ns, 1.07× the fastest +SHA-512, 1350 B, aws-lc-rs on ovh-iad: 3.12 µs, 1.20× the fastest; verified: aws-lc-verification's SAW proof of SHA-512 through EVP_Digest, padding included, over sha512_block_data_order_avx, which aws-lc runs only on Intel; of aws-lc c21d40da, whose SHA-512 code 5.12.0 keeps +✓ +SHA-512, 1350 B, aws-lc-rs on ovh-sea: 3.04 µs, 1.19× the fastest; verified: aws-lc-verification's SAW proof of SHA-512 through EVP_Digest, padding included, over sha512_block_data_order_avx, which aws-lc runs only on Intel; of aws-lc c21d40da, whose SHA-512 code 5.12.0 keeps +✓ +SHA-512, 1350 B, ring on nixos: 1.87 µs, 1.06× the fastest +SHA-512, 1350 B, ring on desktop: 1.26 µs, 2.69× the fastest +SHA-512, 1350 B, ring on nixos2: 1.93 µs, 1.17× the fastest +SHA-512, 1350 B, ring on kixtop: 737 ns, 1.02× the fastest +SHA-512, 1350 B, ring on ovh-iad: 3.02 µs, 1.16× the fastest +SHA-512, 1350 B, ring on ovh-sea: 2.97 µs, 1.17× the fastest +SHA-512, 1350 B, RustCrypto + dalek on nixos: 1.92 µs, 1.09× the fastest +SHA-512, 1350 B, RustCrypto + dalek on desktop: 1.18 µs, 2.50× the fastest +SHA-512, 1350 B, RustCrypto + dalek on nixos2: 2.67 µs, 1.61× the fastest +SHA-512, 1350 B, RustCrypto + dalek on kixtop: 722 ns, 1.00× the fastest +SHA-512, 1350 B, RustCrypto + dalek on ovh-iad: 4.26 µs, 1.64× the fastest +SHA-512, 1350 B, RustCrypto + dalek on ovh-sea: 4.17 µs, 1.64× the fastest +SHA-512, 1350 B, graviola on nixos: 1.98 µs, 1.13× the fastest +SHA-512, 1350 B, graviola on desktop: 1.51 µs, 3.21× the fastest +SHA-512, 1350 B, graviola on nixos2: 2.35 µs, 1.42× the fastest +SHA-512, 1350 B, graviola on kixtop: 1.88 µs, 2.60× the fastest +SHA-512, 1350 B, libcrux on nixos: 2.94 µs, 1.67× the fastest; verified: HACL*'s F* proof of Hacl.Streaming.SHA2's hash_256 and hash_512, compiled to Rust by an unverified step +✓ +SHA-512, 1350 B, libcrux on desktop: 1.69 µs, 3.59× the fastest; verified: HACL*'s F* proof of Hacl.Streaming.SHA2's hash_256 and hash_512, compiled to Rust by an unverified step +✓ +SHA-512, 1350 B, libcrux on nixos2: 3.08 µs, 1.86× the fastest; verified: HACL*'s F* proof of Hacl.Streaming.SHA2's hash_256 and hash_512, compiled to Rust by an unverified step +✓ +SHA-512, 1350 B, libcrux on kixtop: 1.58 µs, 2.18× the fastest; verified: HACL*'s F* proof of Hacl.Streaming.SHA2's hash_256 and hash_512, compiled to Rust by an unverified step +✓ +SHA-512, 1350 B, libcrux on ovh-iad: 4.91 µs, 1.88× the fastest; verified: HACL*'s F* proof of Hacl.Streaming.SHA2's hash_256 and hash_512, compiled to Rust by an unverified step +✓ +SHA-512, 1350 B, libcrux on ovh-sea: 4.66 µs, 1.83× the fastest; verified: HACL*'s F* proof of Hacl.Streaming.SHA2's hash_256 and hash_512, compiled to Rust by an unverified step +✓ +SHA-512, 1350 B, OpenSSL on nixos: 1.76 µs, 1.00× the fastest +SHA-512, 1350 B, OpenSSL on desktop: 1.20 µs, 2.55× the fastest +SHA-512, 1350 B, OpenSSL on nixos2: 1.90 µs, 1.15× the fastest +SHA-512, 1350 B, OpenSSL on kixtop: 878 ns, 1.22× the fastest +SHA-512, 1350 B, OpenSSL on ovh-iad: 3.10 µs, 1.19× the fastest +SHA-512, 1350 B, OpenSSL on ovh-sea: 2.99 µs, 1.18× the fastest SHA-512, 16 KB SHA-512, 16 KB, rind on nixos: 16.28 µs, 1.07× the fastest SHA-512, 16 KB, rind on desktop: 2.68 µs, 1.00× the fastest SHA-512, 16 KB, rind on nixos2: 18.53 µs, 1.00× the fastest -SHA-512, 16 KB, rind on ovh-iad: 33.08 µs, 1.03× the fastest -SHA-512, 16 KB, rind on ovh-sea: 29.12 µs, 1.00× the fastest -SHA-512, 16 KB, aws-lc-rs on nixos: 25.17 µs, 1.66× the fastest -SHA-512, 16 KB, aws-lc-rs on desktop: 14.32 µs, 5.34× the fastest; verified: aws-lc-verification's SAW proof of SHA-512 through EVP_Digest, padding included, over sha512_block_data_order_avx, which aws-lc runs only on Intel; of aws-lc c21d40da, whose SHA-512 code 5.12.0 keeps -✓ -SHA-512, 16 KB, aws-lc-rs on nixos2: 21.92 µs, 1.18× the fastest; verified: aws-lc-verification's SAW proof of SHA-512 through EVP_Digest, padding included, over sha512_block_data_order_avx, which aws-lc runs only on Intel; of aws-lc c21d40da, whose SHA-512 code 5.12.0 keeps -✓ -SHA-512, 16 KB, aws-lc-rs on ovh-iad: 35.17 µs, 1.09× the fastest; verified: aws-lc-verification's SAW proof of SHA-512 through EVP_Digest, padding included, over sha512_block_data_order_avx, which aws-lc runs only on Intel; of aws-lc c21d40da, whose SHA-512 code 5.12.0 keeps +SHA-512, 16 KB, rind on kixtop: 8.77 µs, 1.03× the fastest +SHA-512, 16 KB, rind on ovh-iad: 33.08 µs, 1.03× the fastest +SHA-512, 16 KB, rind on ovh-sea: 29.12 µs, 1.00× the fastest +SHA-512, 16 KB, aws-lc-rs on nixos: 25.17 µs, 1.66× the fastest +SHA-512, 16 KB, aws-lc-rs on desktop: 14.32 µs, 5.34× the fastest; verified: aws-lc-verification's SAW proof of SHA-512 through EVP_Digest, padding included, over sha512_block_data_order_avx, which aws-lc runs only on Intel; of aws-lc c21d40da, whose SHA-512 code 5.12.0 keeps +✓ +SHA-512, 16 KB, aws-lc-rs on nixos2: 21.92 µs, 1.18× the fastest; verified: aws-lc-verification's SAW proof of SHA-512 through EVP_Digest, padding included, over sha512_block_data_order_avx, which aws-lc runs only on Intel; of aws-lc c21d40da, whose SHA-512 code 5.12.0 keeps ✓ -SHA-512, 16 KB, aws-lc-rs on ovh-sea: 34.42 µs, 1.18× the fastest; verified: aws-lc-verification's SAW proof of SHA-512 through EVP_Digest, padding included, over sha512_block_data_order_avx, which aws-lc runs only on Intel; of aws-lc c21d40da, whose SHA-512 code 5.12.0 keeps -✓ -SHA-512, 16 KB, ring on nixos: 25.38 µs, 1.68× the fastest -SHA-512, 16 KB, ring on desktop: 14.36 µs, 5.35× the fastest -SHA-512, 16 KB, ring on nixos2: 21.75 µs, 1.17× the fastest -SHA-512, 16 KB, ring on ovh-iad: 35.28 µs, 1.09× the fastest -SHA-512, 16 KB, ring on ovh-sea: 33.89 µs, 1.16× the fastest -SHA-512, 16 KB, RustCrypto + dalek on nixos: 24.12 µs, 1.59× the fastest -SHA-512, 16 KB, RustCrypto + dalek on desktop: 13.55 µs, 5.05× the fastest -SHA-512, 16 KB, RustCrypto + dalek on nixos2: 30.73 µs, 1.66× the fastest -SHA-512, 16 KB, RustCrypto + dalek on ovh-iad: 53.82 µs, 1.67× the fastest -SHA-512, 16 KB, RustCrypto + dalek on ovh-sea: 47.69 µs, 1.64× the fastest -SHA-512, 16 KB, graviola on nixos: 21.04 µs, 1.39× the fastest -SHA-512, 16 KB, graviola on desktop: 17.96 µs, 6.70× the fastest -SHA-512, 16 KB, graviola on nixos2: 27.16 µs, 1.47× the fastest -SHA-512, 16 KB, libcrux on nixos: 29.75 µs, 1.96× the fastest; verified: HACL*'s F* proof of Hacl.Streaming.SHA2's hash_256 and hash_512, compiled to Rust by an unverified step -✓ -SHA-512, 16 KB, libcrux on desktop: 20.01 µs, 7.46× the fastest; verified: HACL*'s F* proof of Hacl.Streaming.SHA2's hash_256 and hash_512, compiled to Rust by an unverified step -✓ -SHA-512, 16 KB, libcrux on nixos2: 35.45 µs, 1.91× the fastest; verified: HACL*'s F* proof of Hacl.Streaming.SHA2's hash_256 and hash_512, compiled to Rust by an unverified step -✓ -SHA-512, 16 KB, libcrux on ovh-iad: 59.59 µs, 1.85× the fastest; verified: HACL*'s F* proof of Hacl.Streaming.SHA2's hash_256 and hash_512, compiled to Rust by an unverified step -✓ -SHA-512, 16 KB, libcrux on ovh-sea: 54.80 µs, 1.88× the fastest; verified: HACL*'s F* proof of Hacl.Streaming.SHA2's hash_256 and hash_512, compiled to Rust by an unverified step -✓ -SHA-512, 16 KB, OpenSSL on nixos: 15.14 µs, 1.00× the fastest -SHA-512, 16 KB, OpenSSL on desktop: 12.51 µs, 4.66× the fastest -SHA-512, 16 KB, OpenSSL on nixos2: 18.99 µs, 1.02× the fastest -SHA-512, 16 KB, OpenSSL on ovh-iad: 32.22 µs, 1.00× the fastest -SHA-512, 16 KB, OpenSSL on ovh-sea: 29.59 µs, 1.02× the fastest +SHA-512, 16 KB, aws-lc-rs on kixtop: 8.70 µs, 1.02× the fastest +SHA-512, 16 KB, aws-lc-rs on ovh-iad: 35.17 µs, 1.09× the fastest; verified: aws-lc-verification's SAW proof of SHA-512 through EVP_Digest, padding included, over sha512_block_data_order_avx, which aws-lc runs only on Intel; of aws-lc c21d40da, whose SHA-512 code 5.12.0 keeps +✓ +SHA-512, 16 KB, aws-lc-rs on ovh-sea: 34.42 µs, 1.18× the fastest; verified: aws-lc-verification's SAW proof of SHA-512 through EVP_Digest, padding included, over sha512_block_data_order_avx, which aws-lc runs only on Intel; of aws-lc c21d40da, whose SHA-512 code 5.12.0 keeps +✓ +SHA-512, 16 KB, ring on nixos: 25.38 µs, 1.68× the fastest +SHA-512, 16 KB, ring on desktop: 14.36 µs, 5.35× the fastest +SHA-512, 16 KB, ring on nixos2: 21.75 µs, 1.17× the fastest +SHA-512, 16 KB, ring on kixtop: 8.69 µs, 1.02× the fastest +SHA-512, 16 KB, ring on ovh-iad: 35.28 µs, 1.09× the fastest +SHA-512, 16 KB, ring on ovh-sea: 33.89 µs, 1.16× the fastest +SHA-512, 16 KB, RustCrypto + dalek on nixos: 24.12 µs, 1.59× the fastest +SHA-512, 16 KB, RustCrypto + dalek on desktop: 13.55 µs, 5.05× the fastest +SHA-512, 16 KB, RustCrypto + dalek on nixos2: 30.73 µs, 1.66× the fastest +SHA-512, 16 KB, RustCrypto + dalek on kixtop: 8.50 µs, 1.00× the fastest +SHA-512, 16 KB, RustCrypto + dalek on ovh-iad: 53.82 µs, 1.67× the fastest +SHA-512, 16 KB, RustCrypto + dalek on ovh-sea: 47.69 µs, 1.64× the fastest +SHA-512, 16 KB, graviola on nixos: 21.04 µs, 1.39× the fastest +SHA-512, 16 KB, graviola on desktop: 17.96 µs, 6.70× the fastest +SHA-512, 16 KB, graviola on nixos2: 27.16 µs, 1.47× the fastest +SHA-512, 16 KB, graviola on kixtop: 22.11 µs, 2.60× the fastest +SHA-512, 16 KB, libcrux on nixos: 29.75 µs, 1.96× the fastest; verified: HACL*'s F* proof of Hacl.Streaming.SHA2's hash_256 and hash_512, compiled to Rust by an unverified step +✓ +SHA-512, 16 KB, libcrux on desktop: 20.01 µs, 7.46× the fastest; verified: HACL*'s F* proof of Hacl.Streaming.SHA2's hash_256 and hash_512, compiled to Rust by an unverified step +✓ +SHA-512, 16 KB, libcrux on nixos2: 35.45 µs, 1.91× the fastest; verified: HACL*'s F* proof of Hacl.Streaming.SHA2's hash_256 and hash_512, compiled to Rust by an unverified step +✓ +SHA-512, 16 KB, libcrux on kixtop: 18.41 µs, 2.17× the fastest; verified: HACL*'s F* proof of Hacl.Streaming.SHA2's hash_256 and hash_512, compiled to Rust by an unverified step +✓ +SHA-512, 16 KB, libcrux on ovh-iad: 59.59 µs, 1.85× the fastest; verified: HACL*'s F* proof of Hacl.Streaming.SHA2's hash_256 and hash_512, compiled to Rust by an unverified step +✓ +SHA-512, 16 KB, libcrux on ovh-sea: 54.80 µs, 1.88× the fastest; verified: HACL*'s F* proof of Hacl.Streaming.SHA2's hash_256 and hash_512, compiled to Rust by an unverified step +✓ +SHA-512, 16 KB, OpenSSL on nixos: 15.14 µs, 1.00× the fastest +SHA-512, 16 KB, OpenSSL on desktop: 12.51 µs, 4.66× the fastest +SHA-512, 16 KB, OpenSSL on nixos2: 18.99 µs, 1.02× the fastest +SHA-512, 16 KB, OpenSSL on kixtop: 8.88 µs, 1.04× the fastest +SHA-512, 16 KB, OpenSSL on ovh-iad: 32.22 µs, 1.00× the fastest +SHA-512, 16 KB, OpenSSL on ovh-sea: 29.59 µs, 1.02× the fastest HMAC-SHA256, 64 B HMAC-SHA256, 64 B, rind on nixos: 147 ns, 1.00× the fastest HMAC-SHA256, 64 B, rind on desktop: 75 ns, 1.00× the fastest HMAC-SHA256, 64 B, rind on nixos2: 628 ns, 1.00× the fastest -HMAC-SHA256, 64 B, rind on ovh-iad: 1.16 µs, 1.00× the fastest -HMAC-SHA256, 64 B, rind on ovh-sea: 963 ns, 1.00× the fastest -HMAC-SHA256, 64 B, aws-lc-rs on nixos: 264 ns, 1.80× the fastest -HMAC-SHA256, 64 B, aws-lc-rs on desktop: 180 ns, 2.38× the fastest -HMAC-SHA256, 64 B, aws-lc-rs on nixos2: 811 ns, 1.29× the fastest -HMAC-SHA256, 64 B, aws-lc-rs on ovh-iad: 1.60 µs, 1.38× the fastest -HMAC-SHA256, 64 B, aws-lc-rs on ovh-sea: 1.24 µs, 1.29× the fastest -HMAC-SHA256, 64 B, ring on nixos: 214 ns, 1.45× the fastest -HMAC-SHA256, 64 B, ring on desktop: 145 ns, 1.93× the fastest -HMAC-SHA256, 64 B, ring on nixos2: 707 ns, 1.13× the fastest -HMAC-SHA256, 64 B, ring on ovh-iad: 1.64 µs, 1.42× the fastest -HMAC-SHA256, 64 B, ring on ovh-sea: 1.09 µs, 1.13× the fastest -HMAC-SHA256, 64 B, RustCrypto + dalek on nixos: 155 ns, 1.06× the fastest -HMAC-SHA256, 64 B, RustCrypto + dalek on desktop: 104 ns, 1.39× the fastest -HMAC-SHA256, 64 B, RustCrypto + dalek on nixos2: 1.19 µs, 1.89× the fastest -HMAC-SHA256, 64 B, RustCrypto + dalek on ovh-iad: 2.13 µs, 1.84× the fastest -HMAC-SHA256, 64 B, RustCrypto + dalek on ovh-sea: 1.82 µs, 1.89× the fastest -HMAC-SHA256, 64 B, graviola on nixos: 172 ns, 1.17× the fastest -HMAC-SHA256, 64 B, graviola on desktop: 115 ns, 1.52× the fastest -HMAC-SHA256, 64 B, graviola on nixos2: 1.44 µs, 2.30× the fastest -HMAC-SHA256, 64 B, libcrux on nixos: 851 ns, 5.79× the fastest; verified: HACL*'s F* proof of Hacl.HMAC's compute_sha2_256, compiled to Rust by an unverified step -✓ -HMAC-SHA256, 64 B, libcrux on desktop: 536 ns, 7.12× the fastest; verified: HACL*'s F* proof of Hacl.HMAC's compute_sha2_256, compiled to Rust by an unverified step -✓ -HMAC-SHA256, 64 B, libcrux on nixos2: 1.20 µs, 1.92× the fastest; verified: HACL*'s F* proof of Hacl.HMAC's compute_sha2_256, compiled to Rust by an unverified step -✓ -HMAC-SHA256, 64 B, libcrux on ovh-iad: 2.36 µs, 2.03× the fastest; verified: HACL*'s F* proof of Hacl.HMAC's compute_sha2_256, compiled to Rust by an unverified step -✓ -HMAC-SHA256, 64 B, libcrux on ovh-sea: 1.83 µs, 1.90× the fastest; verified: HACL*'s F* proof of Hacl.HMAC's compute_sha2_256, compiled to Rust by an unverified step -✓ -HMAC-SHA256, 64 B, OpenSSL on nixos: 2.57 µs, 17.50× the fastest -HMAC-SHA256, 64 B, OpenSSL on desktop: 1.56 µs, 20.76× the fastest -HMAC-SHA256, 64 B, OpenSSL on nixos2: 3.69 µs, 5.88× the fastest -HMAC-SHA256, 64 B, OpenSSL on ovh-iad: 6.68 µs, 5.76× the fastest -HMAC-SHA256, 64 B, OpenSSL on ovh-sea: 5.66 µs, 5.88× the fastest +HMAC-SHA256, 64 B, rind on kixtop: 191 ns, 1.88× the fastest +HMAC-SHA256, 64 B, rind on ovh-iad: 1.16 µs, 1.00× the fastest +HMAC-SHA256, 64 B, rind on ovh-sea: 963 ns, 1.00× the fastest +HMAC-SHA256, 64 B, aws-lc-rs on nixos: 264 ns, 1.80× the fastest +HMAC-SHA256, 64 B, aws-lc-rs on desktop: 180 ns, 2.38× the fastest +HMAC-SHA256, 64 B, aws-lc-rs on nixos2: 811 ns, 1.29× the fastest +HMAC-SHA256, 64 B, aws-lc-rs on kixtop: 248 ns, 2.43× the fastest +HMAC-SHA256, 64 B, aws-lc-rs on ovh-iad: 1.60 µs, 1.38× the fastest +HMAC-SHA256, 64 B, aws-lc-rs on ovh-sea: 1.24 µs, 1.29× the fastest +HMAC-SHA256, 64 B, ring on nixos: 214 ns, 1.45× the fastest +HMAC-SHA256, 64 B, ring on desktop: 145 ns, 1.93× the fastest +HMAC-SHA256, 64 B, ring on nixos2: 707 ns, 1.13× the fastest +HMAC-SHA256, 64 B, ring on kixtop: 137 ns, 1.34× the fastest +HMAC-SHA256, 64 B, ring on ovh-iad: 1.64 µs, 1.42× the fastest +HMAC-SHA256, 64 B, ring on ovh-sea: 1.09 µs, 1.13× the fastest +HMAC-SHA256, 64 B, RustCrypto + dalek on nixos: 155 ns, 1.06× the fastest +HMAC-SHA256, 64 B, RustCrypto + dalek on desktop: 104 ns, 1.39× the fastest +HMAC-SHA256, 64 B, RustCrypto + dalek on nixos2: 1.19 µs, 1.89× the fastest +HMAC-SHA256, 64 B, RustCrypto + dalek on kixtop: 102 ns, 1.00× the fastest +HMAC-SHA256, 64 B, RustCrypto + dalek on ovh-iad: 2.13 µs, 1.84× the fastest +HMAC-SHA256, 64 B, RustCrypto + dalek on ovh-sea: 1.82 µs, 1.89× the fastest +HMAC-SHA256, 64 B, graviola on nixos: 172 ns, 1.17× the fastest +HMAC-SHA256, 64 B, graviola on desktop: 115 ns, 1.52× the fastest +HMAC-SHA256, 64 B, graviola on nixos2: 1.44 µs, 2.30× the fastest +HMAC-SHA256, 64 B, graviola on kixtop: 115 ns, 1.12× the fastest +HMAC-SHA256, 64 B, libcrux on nixos: 851 ns, 5.79× the fastest; verified: HACL*'s F* proof of Hacl.HMAC's compute_sha2_256, compiled to Rust by an unverified step +✓ +HMAC-SHA256, 64 B, libcrux on desktop: 536 ns, 7.12× the fastest; verified: HACL*'s F* proof of Hacl.HMAC's compute_sha2_256, compiled to Rust by an unverified step +✓ +HMAC-SHA256, 64 B, libcrux on nixos2: 1.20 µs, 1.92× the fastest; verified: HACL*'s F* proof of Hacl.HMAC's compute_sha2_256, compiled to Rust by an unverified step +✓ +HMAC-SHA256, 64 B, libcrux on kixtop: 568 ns, 5.57× the fastest; verified: HACL*'s F* proof of Hacl.HMAC's compute_sha2_256, compiled to Rust by an unverified step +✓ +HMAC-SHA256, 64 B, libcrux on ovh-iad: 2.36 µs, 2.03× the fastest; verified: HACL*'s F* proof of Hacl.HMAC's compute_sha2_256, compiled to Rust by an unverified step +✓ +HMAC-SHA256, 64 B, libcrux on ovh-sea: 1.83 µs, 1.90× the fastest; verified: HACL*'s F* proof of Hacl.HMAC's compute_sha2_256, compiled to Rust by an unverified step +✓ +HMAC-SHA256, 64 B, OpenSSL on nixos: 2.57 µs, 17.50× the fastest +HMAC-SHA256, 64 B, OpenSSL on desktop: 1.56 µs, 20.76× the fastest +HMAC-SHA256, 64 B, OpenSSL on nixos2: 3.69 µs, 5.88× the fastest +HMAC-SHA256, 64 B, OpenSSL on kixtop: 2.06 µs, 20.24× the fastest +HMAC-SHA256, 64 B, OpenSSL on ovh-iad: 6.68 µs, 5.76× the fastest +HMAC-SHA256, 64 B, OpenSSL on ovh-sea: 5.66 µs, 5.88× the fastest HMAC-SHA256, 1350 B HMAC-SHA256, 1350 B, rind on nixos: 692 ns, 1.00× the fastest HMAC-SHA256, 1350 B, rind on desktop: 327 ns, 1.00× the fastest HMAC-SHA256, 1350 B, rind on nixos2: 2.79 µs, 1.00× the fastest -HMAC-SHA256, 1350 B, rind on ovh-iad: 4.82 µs, 1.00× the fastest -HMAC-SHA256, 1350 B, rind on ovh-sea: 4.31 µs, 1.00× the fastest -HMAC-SHA256, 1350 B, aws-lc-rs on nixos: 853 ns, 1.23× the fastest -HMAC-SHA256, 1350 B, aws-lc-rs on desktop: 434 ns, 1.33× the fastest -HMAC-SHA256, 1350 B, aws-lc-rs on nixos2: 3.30 µs, 1.18× the fastest -HMAC-SHA256, 1350 B, aws-lc-rs on ovh-iad: 5.59 µs, 1.16× the fastest -HMAC-SHA256, 1350 B, aws-lc-rs on ovh-sea: 5.11 µs, 1.19× the fastest -HMAC-SHA256, 1350 B, ring on nixos: 791 ns, 1.14× the fastest -HMAC-SHA256, 1350 B, ring on desktop: 399 ns, 1.22× the fastest -HMAC-SHA256, 1350 B, ring on nixos2: 3.19 µs, 1.14× the fastest -HMAC-SHA256, 1350 B, ring on ovh-iad: 5.16 µs, 1.07× the fastest -HMAC-SHA256, 1350 B, ring on ovh-sea: 4.97 µs, 1.15× the fastest -HMAC-SHA256, 1350 B, RustCrypto + dalek on nixos: 728 ns, 1.05× the fastest -HMAC-SHA256, 1350 B, RustCrypto + dalek on desktop: 358 ns, 1.09× the fastest -HMAC-SHA256, 1350 B, RustCrypto + dalek on nixos2: 5.80 µs, 2.08× the fastest -HMAC-SHA256, 1350 B, RustCrypto + dalek on ovh-iad: 9.61 µs, 1.99× the fastest -HMAC-SHA256, 1350 B, RustCrypto + dalek on ovh-sea: 8.95 µs, 2.08× the fastest -HMAC-SHA256, 1350 B, graviola on nixos: 731 ns, 1.06× the fastest -HMAC-SHA256, 1350 B, graviola on desktop: 363 ns, 1.11× the fastest -HMAC-SHA256, 1350 B, graviola on nixos2: 7.05 µs, 2.53× the fastest -HMAC-SHA256, 1350 B, libcrux on nixos: 4.39 µs, 6.34× the fastest; verified: HACL*'s F* proof of Hacl.HMAC's compute_sha2_256, compiled to Rust by an unverified step -✓ -HMAC-SHA256, 1350 B, libcrux on desktop: 2.66 µs, 8.15× the fastest; verified: HACL*'s F* proof of Hacl.HMAC's compute_sha2_256, compiled to Rust by an unverified step -✓ -HMAC-SHA256, 1350 B, libcrux on nixos2: 6.02 µs, 2.16× the fastest; verified: HACL*'s F* proof of Hacl.HMAC's compute_sha2_256, compiled to Rust by an unverified step -✓ -HMAC-SHA256, 1350 B, libcrux on ovh-iad: 9.65 µs, 2.00× the fastest; verified: HACL*'s F* proof of Hacl.HMAC's compute_sha2_256, compiled to Rust by an unverified step -✓ -HMAC-SHA256, 1350 B, libcrux on ovh-sea: 9.24 µs, 2.14× the fastest; verified: HACL*'s F* proof of Hacl.HMAC's compute_sha2_256, compiled to Rust by an unverified step -✓ -HMAC-SHA256, 1350 B, OpenSSL on nixos: 3.11 µs, 4.50× the fastest -HMAC-SHA256, 1350 B, OpenSSL on desktop: 1.83 µs, 5.60× the fastest -HMAC-SHA256, 1350 B, OpenSSL on nixos2: 5.94 µs, 2.13× the fastest -HMAC-SHA256, 1350 B, OpenSSL on ovh-iad: 9.44 µs, 1.96× the fastest -HMAC-SHA256, 1350 B, OpenSSL on ovh-sea: 9.08 µs, 2.11× the fastest +HMAC-SHA256, 1350 B, rind on kixtop: 559 ns, 1.11× the fastest +HMAC-SHA256, 1350 B, rind on ovh-iad: 4.82 µs, 1.00× the fastest +HMAC-SHA256, 1350 B, rind on ovh-sea: 4.31 µs, 1.00× the fastest +HMAC-SHA256, 1350 B, aws-lc-rs on nixos: 853 ns, 1.23× the fastest +HMAC-SHA256, 1350 B, aws-lc-rs on desktop: 434 ns, 1.33× the fastest +HMAC-SHA256, 1350 B, aws-lc-rs on nixos2: 3.30 µs, 1.18× the fastest +HMAC-SHA256, 1350 B, aws-lc-rs on kixtop: 620 ns, 1.24× the fastest +HMAC-SHA256, 1350 B, aws-lc-rs on ovh-iad: 5.59 µs, 1.16× the fastest +HMAC-SHA256, 1350 B, aws-lc-rs on ovh-sea: 5.11 µs, 1.19× the fastest +HMAC-SHA256, 1350 B, ring on nixos: 791 ns, 1.14× the fastest +HMAC-SHA256, 1350 B, ring on desktop: 399 ns, 1.22× the fastest +HMAC-SHA256, 1350 B, ring on nixos2: 3.19 µs, 1.14× the fastest +HMAC-SHA256, 1350 B, ring on kixtop: 502 ns, 1.00× the fastest +HMAC-SHA256, 1350 B, ring on ovh-iad: 5.16 µs, 1.07× the fastest +HMAC-SHA256, 1350 B, ring on ovh-sea: 4.97 µs, 1.15× the fastest +HMAC-SHA256, 1350 B, RustCrypto + dalek on nixos: 728 ns, 1.05× the fastest +HMAC-SHA256, 1350 B, RustCrypto + dalek on desktop: 358 ns, 1.09× the fastest +HMAC-SHA256, 1350 B, RustCrypto + dalek on nixos2: 5.80 µs, 2.08× the fastest +HMAC-SHA256, 1350 B, RustCrypto + dalek on kixtop: 542 ns, 1.08× the fastest +HMAC-SHA256, 1350 B, RustCrypto + dalek on ovh-iad: 9.61 µs, 1.99× the fastest +HMAC-SHA256, 1350 B, RustCrypto + dalek on ovh-sea: 8.95 µs, 2.08× the fastest +HMAC-SHA256, 1350 B, graviola on nixos: 731 ns, 1.06× the fastest +HMAC-SHA256, 1350 B, graviola on desktop: 363 ns, 1.11× the fastest +HMAC-SHA256, 1350 B, graviola on nixos2: 7.05 µs, 2.53× the fastest +HMAC-SHA256, 1350 B, graviola on kixtop: 557 ns, 1.11× the fastest +HMAC-SHA256, 1350 B, libcrux on nixos: 4.39 µs, 6.34× the fastest; verified: HACL*'s F* proof of Hacl.HMAC's compute_sha2_256, compiled to Rust by an unverified step +✓ +HMAC-SHA256, 1350 B, libcrux on desktop: 2.66 µs, 8.15× the fastest; verified: HACL*'s F* proof of Hacl.HMAC's compute_sha2_256, compiled to Rust by an unverified step +✓ +HMAC-SHA256, 1350 B, libcrux on nixos2: 6.02 µs, 2.16× the fastest; verified: HACL*'s F* proof of Hacl.HMAC's compute_sha2_256, compiled to Rust by an unverified step +✓ +HMAC-SHA256, 1350 B, libcrux on kixtop: 2.86 µs, 5.70× the fastest; verified: HACL*'s F* proof of Hacl.HMAC's compute_sha2_256, compiled to Rust by an unverified step +✓ +HMAC-SHA256, 1350 B, libcrux on ovh-iad: 9.65 µs, 2.00× the fastest; verified: HACL*'s F* proof of Hacl.HMAC's compute_sha2_256, compiled to Rust by an unverified step +✓ +HMAC-SHA256, 1350 B, libcrux on ovh-sea: 9.24 µs, 2.14× the fastest; verified: HACL*'s F* proof of Hacl.HMAC's compute_sha2_256, compiled to Rust by an unverified step +✓ +HMAC-SHA256, 1350 B, OpenSSL on nixos: 3.11 µs, 4.50× the fastest +HMAC-SHA256, 1350 B, OpenSSL on desktop: 1.83 µs, 5.60× the fastest +HMAC-SHA256, 1350 B, OpenSSL on nixos2: 5.94 µs, 2.13× the fastest +HMAC-SHA256, 1350 B, OpenSSL on kixtop: 2.43 µs, 4.84× the fastest +HMAC-SHA256, 1350 B, OpenSSL on ovh-iad: 9.44 µs, 1.96× the fastest +HMAC-SHA256, 1350 B, OpenSSL on ovh-sea: 9.08 µs, 2.11× the fastest HKDF-SHA256 extract and expand HKDF-SHA256 extract and expand, rind on nixos: 257 ns, 1.00× the fastest HKDF-SHA256 extract and expand, rind on desktop: 152 ns, 1.00× the fastest HKDF-SHA256 extract and expand, rind on nixos2: 1.15 µs, 1.00× the fastest -HKDF-SHA256 extract and expand, rind on ovh-iad: 2.10 µs, 1.01× the fastest -HKDF-SHA256 extract and expand, rind on ovh-sea: 1.70 µs, 1.00× the fastest -HKDF-SHA256 extract and expand, aws-lc-rs on nixos: 369 ns, 1.44× the fastest -HKDF-SHA256 extract and expand, aws-lc-rs on desktop: 288 ns, 1.90× the fastest -HKDF-SHA256 extract and expand, aws-lc-rs on nixos2: 1.44 µs, 1.25× the fastest -HKDF-SHA256 extract and expand, aws-lc-rs on ovh-iad: 2.36 µs, 1.13× the fastest -HKDF-SHA256 extract and expand, aws-lc-rs on ovh-sea: 2.01 µs, 1.18× the fastest -HKDF-SHA256 extract and expand, ring on nixos: 399 ns, 1.55× the fastest -HKDF-SHA256 extract and expand, ring on desktop: 305 ns, 2.01× the fastest -HKDF-SHA256 extract and expand, ring on nixos2: 1.31 µs, 1.14× the fastest -HKDF-SHA256 extract and expand, ring on ovh-iad: 2.08 µs, 1.00× the fastest -HKDF-SHA256 extract and expand, ring on ovh-sea: 1.85 µs, 1.09× the fastest -HKDF-SHA256 extract and expand, RustCrypto + dalek on nixos: 309 ns, 1.20× the fastest -HKDF-SHA256 extract and expand, RustCrypto + dalek on desktop: 223 ns, 1.47× the fastest -HKDF-SHA256 extract and expand, RustCrypto + dalek on nixos2: 1.98 µs, 1.72× the fastest -HKDF-SHA256 extract and expand, RustCrypto + dalek on ovh-iad: 3.39 µs, 1.63× the fastest -HKDF-SHA256 extract and expand, RustCrypto + dalek on ovh-sea: 3.01 µs, 1.77× the fastest -HKDF-SHA256 extract and expand, libcrux on nixos: 1.37 µs, 5.34× the fastest; verified: HACL*'s F* proof of Hacl.HKDF's extract_sha2_256 and expand_sha2_256, compiled to Rust by an unverified step -✓ -HKDF-SHA256 extract and expand, libcrux on desktop: 965 ns, 6.36× the fastest; verified: HACL*'s F* proof of Hacl.HKDF's extract_sha2_256 and expand_sha2_256, compiled to Rust by an unverified step -✓ -HKDF-SHA256 extract and expand, libcrux on nixos2: 2.04 µs, 1.77× the fastest; verified: HACL*'s F* proof of Hacl.HKDF's extract_sha2_256 and expand_sha2_256, compiled to Rust by an unverified step -✓ -HKDF-SHA256 extract and expand, libcrux on ovh-iad: 3.73 µs, 1.80× the fastest; verified: HACL*'s F* proof of Hacl.HKDF's extract_sha2_256 and expand_sha2_256, compiled to Rust by an unverified step -✓ -HKDF-SHA256 extract and expand, libcrux on ovh-sea: 3.08 µs, 1.81× the fastest; verified: HACL*'s F* proof of Hacl.HKDF's extract_sha2_256 and expand_sha2_256, compiled to Rust by an unverified step -✓ -HKDF-SHA256 extract and expand, OpenSSL on nixos: 2.72 µs, 10.57× the fastest -HKDF-SHA256 extract and expand, OpenSSL on desktop: 1.76 µs, 11.57× the fastest -HKDF-SHA256 extract and expand, OpenSSL on nixos2: 4.33 µs, 3.76× the fastest -HKDF-SHA256 extract and expand, OpenSSL on ovh-iad: 10.10 µs, 4.86× the fastest -HKDF-SHA256 extract and expand, OpenSSL on ovh-sea: 6.80 µs, 3.99× the fastest +HKDF-SHA256 extract and expand, rind on kixtop: 343 ns, 1.58× the fastest +HKDF-SHA256 extract and expand, rind on ovh-iad: 2.10 µs, 1.01× the fastest +HKDF-SHA256 extract and expand, rind on ovh-sea: 1.70 µs, 1.00× the fastest +HKDF-SHA256 extract and expand, aws-lc-rs on nixos: 369 ns, 1.44× the fastest +HKDF-SHA256 extract and expand, aws-lc-rs on desktop: 288 ns, 1.90× the fastest +HKDF-SHA256 extract and expand, aws-lc-rs on nixos2: 1.44 µs, 1.25× the fastest +HKDF-SHA256 extract and expand, aws-lc-rs on kixtop: 330 ns, 1.52× the fastest +HKDF-SHA256 extract and expand, aws-lc-rs on ovh-iad: 2.36 µs, 1.13× the fastest +HKDF-SHA256 extract and expand, aws-lc-rs on ovh-sea: 2.01 µs, 1.18× the fastest +HKDF-SHA256 extract and expand, ring on nixos: 399 ns, 1.55× the fastest +HKDF-SHA256 extract and expand, ring on desktop: 305 ns, 2.01× the fastest +HKDF-SHA256 extract and expand, ring on nixos2: 1.31 µs, 1.14× the fastest +HKDF-SHA256 extract and expand, ring on kixtop: 274 ns, 1.26× the fastest +HKDF-SHA256 extract and expand, ring on ovh-iad: 2.08 µs, 1.00× the fastest +HKDF-SHA256 extract and expand, ring on ovh-sea: 1.85 µs, 1.09× the fastest +HKDF-SHA256 extract and expand, RustCrypto + dalek on nixos: 309 ns, 1.20× the fastest +HKDF-SHA256 extract and expand, RustCrypto + dalek on desktop: 223 ns, 1.47× the fastest +HKDF-SHA256 extract and expand, RustCrypto + dalek on nixos2: 1.98 µs, 1.72× the fastest +HKDF-SHA256 extract and expand, RustCrypto + dalek on kixtop: 218 ns, 1.00× the fastest +HKDF-SHA256 extract and expand, RustCrypto + dalek on ovh-iad: 3.39 µs, 1.63× the fastest +HKDF-SHA256 extract and expand, RustCrypto + dalek on ovh-sea: 3.01 µs, 1.77× the fastest +HKDF-SHA256 extract and expand, libcrux on nixos: 1.37 µs, 5.34× the fastest; verified: HACL*'s F* proof of Hacl.HKDF's extract_sha2_256 and expand_sha2_256, compiled to Rust by an unverified step +✓ +HKDF-SHA256 extract and expand, libcrux on desktop: 965 ns, 6.36× the fastest; verified: HACL*'s F* proof of Hacl.HKDF's extract_sha2_256 and expand_sha2_256, compiled to Rust by an unverified step +✓ +HKDF-SHA256 extract and expand, libcrux on nixos2: 2.04 µs, 1.77× the fastest; verified: HACL*'s F* proof of Hacl.HKDF's extract_sha2_256 and expand_sha2_256, compiled to Rust by an unverified step +✓ +HKDF-SHA256 extract and expand, libcrux on kixtop: 942 ns, 4.32× the fastest; verified: HACL*'s F* proof of Hacl.HKDF's extract_sha2_256 and expand_sha2_256, compiled to Rust by an unverified step +✓ +HKDF-SHA256 extract and expand, libcrux on ovh-iad: 3.73 µs, 1.80× the fastest; verified: HACL*'s F* proof of Hacl.HKDF's extract_sha2_256 and expand_sha2_256, compiled to Rust by an unverified step +✓ +HKDF-SHA256 extract and expand, libcrux on ovh-sea: 3.08 µs, 1.81× the fastest; verified: HACL*'s F* proof of Hacl.HKDF's extract_sha2_256 and expand_sha2_256, compiled to Rust by an unverified step +✓ +HKDF-SHA256 extract and expand, OpenSSL on nixos: 2.72 µs, 10.57× the fastest +HKDF-SHA256 extract and expand, OpenSSL on desktop: 1.76 µs, 11.57× the fastest +HKDF-SHA256 extract and expand, OpenSSL on nixos2: 4.33 µs, 3.76× the fastest +HKDF-SHA256 extract and expand, OpenSSL on kixtop: 2.14 µs, 9.84× the fastest +HKDF-SHA256 extract and expand, OpenSSL on ovh-iad: 10.10 µs, 4.86× the fastest +HKDF-SHA256 extract and expand, OpenSSL on ovh-sea: 6.80 µs, 3.99× the fastest HKDF-SHA256 expand HKDF-SHA256 expand, rind on nixos: 89 ns, 1.00× the fastest HKDF-SHA256 expand, rind on desktop: 47 ns, 1.00× the fastest HKDF-SHA256 expand, rind on nixos2: 300 ns, 1.00× the fastest -HKDF-SHA256 expand, rind on ovh-iad: 540 ns, 1.00× the fastest -HKDF-SHA256 expand, rind on ovh-sea: 464 ns, 1.00× the fastest -HKDF-SHA256 expand, aws-lc-rs on nixos: 179 ns, 2.02× the fastest -HKDF-SHA256 expand, aws-lc-rs on desktop: 126 ns, 2.70× the fastest -HKDF-SHA256 expand, aws-lc-rs on nixos2: 636 ns, 2.12× the fastest -HKDF-SHA256 expand, aws-lc-rs on ovh-iad: 1.23 µs, 2.29× the fastest -HKDF-SHA256 expand, aws-lc-rs on ovh-sea: 973 ns, 2.10× the fastest -HKDF-SHA256 expand, ring on nixos: 142 ns, 1.60× the fastest -HKDF-SHA256 expand, ring on desktop: 122 ns, 2.63× the fastest -HKDF-SHA256 expand, ring on nixos2: 337 ns, 1.12× the fastest -HKDF-SHA256 expand, ring on ovh-iad: 651 ns, 1.21× the fastest -HKDF-SHA256 expand, ring on ovh-sea: 508 ns, 1.09× the fastest -HKDF-SHA256 expand, RustCrypto + dalek on nixos: 103 ns, 1.16× the fastest -HKDF-SHA256 expand, RustCrypto + dalek on desktop: 85 ns, 1.83× the fastest -HKDF-SHA256 expand, RustCrypto + dalek on nixos2: 512 ns, 1.71× the fastest -HKDF-SHA256 expand, RustCrypto + dalek on ovh-iad: 887 ns, 1.64× the fastest -HKDF-SHA256 expand, RustCrypto + dalek on ovh-sea: 773 ns, 1.67× the fastest -HKDF-SHA256 expand, libcrux on nixos: 714 ns, 8.06× the fastest; verified: HACL*'s F* proof of Hacl.HKDF's extract_sha2_256 and expand_sha2_256, compiled to Rust by an unverified step -✓ -HKDF-SHA256 expand, libcrux on desktop: 484 ns, 10.38× the fastest; verified: HACL*'s F* proof of Hacl.HKDF's extract_sha2_256 and expand_sha2_256, compiled to Rust by an unverified step -✓ -HKDF-SHA256 expand, libcrux on nixos2: 1.01 µs, 3.37× the fastest; verified: HACL*'s F* proof of Hacl.HKDF's extract_sha2_256 and expand_sha2_256, compiled to Rust by an unverified step -✓ -HKDF-SHA256 expand, libcrux on ovh-iad: 1.77 µs, 3.28× the fastest; verified: HACL*'s F* proof of Hacl.HKDF's extract_sha2_256 and expand_sha2_256, compiled to Rust by an unverified step -✓ -HKDF-SHA256 expand, libcrux on ovh-sea: 1.58 µs, 3.41× the fastest; verified: HACL*'s F* proof of Hacl.HKDF's extract_sha2_256 and expand_sha2_256, compiled to Rust by an unverified step -✓ -HKDF-SHA256 expand, OpenSSL on nixos: 2.00 µs, 22.59× the fastest -HKDF-SHA256 expand, OpenSSL on desktop: 1.25 µs, 26.79× the fastest -HKDF-SHA256 expand, OpenSSL on nixos2: 2.87 µs, 9.58× the fastest -HKDF-SHA256 expand, OpenSSL on ovh-iad: 6.74 µs, 12.48× the fastest -HKDF-SHA256 expand, OpenSSL on ovh-sea: 4.62 µs, 9.94× the fastest +HKDF-SHA256 expand, rind on kixtop: 109 ns, 1.55× the fastest +HKDF-SHA256 expand, rind on ovh-iad: 540 ns, 1.00× the fastest +HKDF-SHA256 expand, rind on ovh-sea: 464 ns, 1.00× the fastest +HKDF-SHA256 expand, aws-lc-rs on nixos: 179 ns, 2.02× the fastest +HKDF-SHA256 expand, aws-lc-rs on desktop: 126 ns, 2.70× the fastest +HKDF-SHA256 expand, aws-lc-rs on nixos2: 636 ns, 2.12× the fastest +HKDF-SHA256 expand, aws-lc-rs on kixtop: 154 ns, 2.20× the fastest +HKDF-SHA256 expand, aws-lc-rs on ovh-iad: 1.23 µs, 2.29× the fastest +HKDF-SHA256 expand, aws-lc-rs on ovh-sea: 973 ns, 2.10× the fastest +HKDF-SHA256 expand, ring on nixos: 142 ns, 1.60× the fastest +HKDF-SHA256 expand, ring on desktop: 122 ns, 2.63× the fastest +HKDF-SHA256 expand, ring on nixos2: 337 ns, 1.12× the fastest +HKDF-SHA256 expand, ring on kixtop: 94 ns, 1.33× the fastest +HKDF-SHA256 expand, ring on ovh-iad: 651 ns, 1.21× the fastest +HKDF-SHA256 expand, ring on ovh-sea: 508 ns, 1.09× the fastest +HKDF-SHA256 expand, RustCrypto + dalek on nixos: 103 ns, 1.16× the fastest +HKDF-SHA256 expand, RustCrypto + dalek on desktop: 85 ns, 1.83× the fastest +HKDF-SHA256 expand, RustCrypto + dalek on nixos2: 512 ns, 1.71× the fastest +HKDF-SHA256 expand, RustCrypto + dalek on kixtop: 70 ns, 1.00× the fastest +HKDF-SHA256 expand, RustCrypto + dalek on ovh-iad: 887 ns, 1.64× the fastest +HKDF-SHA256 expand, RustCrypto + dalek on ovh-sea: 773 ns, 1.67× the fastest +HKDF-SHA256 expand, libcrux on nixos: 714 ns, 8.06× the fastest; verified: HACL*'s F* proof of Hacl.HKDF's extract_sha2_256 and expand_sha2_256, compiled to Rust by an unverified step +✓ +HKDF-SHA256 expand, libcrux on desktop: 484 ns, 10.38× the fastest; verified: HACL*'s F* proof of Hacl.HKDF's extract_sha2_256 and expand_sha2_256, compiled to Rust by an unverified step +✓ +HKDF-SHA256 expand, libcrux on nixos2: 1.01 µs, 3.37× the fastest; verified: HACL*'s F* proof of Hacl.HKDF's extract_sha2_256 and expand_sha2_256, compiled to Rust by an unverified step +✓ +HKDF-SHA256 expand, libcrux on kixtop: 481 ns, 6.86× the fastest; verified: HACL*'s F* proof of Hacl.HKDF's extract_sha2_256 and expand_sha2_256, compiled to Rust by an unverified step +✓ +HKDF-SHA256 expand, libcrux on ovh-iad: 1.77 µs, 3.28× the fastest; verified: HACL*'s F* proof of Hacl.HKDF's extract_sha2_256 and expand_sha2_256, compiled to Rust by an unverified step +✓ +HKDF-SHA256 expand, libcrux on ovh-sea: 1.58 µs, 3.41× the fastest; verified: HACL*'s F* proof of Hacl.HKDF's extract_sha2_256 and expand_sha2_256, compiled to Rust by an unverified step +✓ +HKDF-SHA256 expand, OpenSSL on nixos: 2.00 µs, 22.59× the fastest +HKDF-SHA256 expand, OpenSSL on desktop: 1.25 µs, 26.79× the fastest +HKDF-SHA256 expand, OpenSSL on nixos2: 2.87 µs, 9.58× the fastest +HKDF-SHA256 expand, OpenSSL on kixtop: 1.54 µs, 21.93× the fastest +HKDF-SHA256 expand, OpenSSL on ovh-iad: 6.74 µs, 12.48× the fastest +HKDF-SHA256 expand, OpenSSL on ovh-sea: 4.62 µs, 9.94× the fastest RSA - + RSA-2048 PKCS#1 sign RSA-2048 PKCS#1 sign, rind on nixos: 523.17 µs, 1.10× the fastest RSA-2048 PKCS#1 sign, rind on desktop: 348.43 µs, 1.02× the fastest RSA-2048 PKCS#1 sign, rind on nixos2: 447.43 µs, 1.03× the fastest -RSA-2048 PKCS#1 sign, rind on ovh-iad: 762.79 µs, 1.00× the fastest -RSA-2048 PKCS#1 sign, rind on ovh-sea: 740.76 µs, 1.00× the fastest -RSA-2048 PKCS#1 sign, aws-lc-rs on nixos: 532.39 µs, 1.12× the fastest -RSA-2048 PKCS#1 sign, aws-lc-rs on desktop: 349.47 µs, 1.02× the fastest -RSA-2048 PKCS#1 sign, aws-lc-rs on nixos2: 448.68 µs, 1.03× the fastest -RSA-2048 PKCS#1 sign, aws-lc-rs on ovh-iad: 796.90 µs, 1.04× the fastest -RSA-2048 PKCS#1 sign, aws-lc-rs on ovh-sea: 779.05 µs, 1.05× the fastest -RSA-2048 PKCS#1 sign, ring on nixos: 523.12 µs, 1.10× the fastest -RSA-2048 PKCS#1 sign, ring on desktop: 341.11 µs, 1.00× the fastest -RSA-2048 PKCS#1 sign, ring on nixos2: 434.47 µs, 1.00× the fastest -RSA-2048 PKCS#1 sign, ring on ovh-iad: 1.05 ms, 1.38× the fastest -RSA-2048 PKCS#1 sign, ring on ovh-sea: 982.45 µs, 1.33× the fastest -RSA-2048 PKCS#1 sign, RustCrypto + dalek on nixos: 1.26 ms, 2.66× the fastest -RSA-2048 PKCS#1 sign, RustCrypto + dalek on desktop: 588.67 µs, 1.73× the fastest -RSA-2048 PKCS#1 sign, RustCrypto + dalek on nixos2: 1.14 ms, 2.63× the fastest -RSA-2048 PKCS#1 sign, RustCrypto + dalek on ovh-iad: 1.83 ms, 2.40× the fastest -RSA-2048 PKCS#1 sign, RustCrypto + dalek on ovh-sea: 1.78 ms, 2.40× the fastest -RSA-2048 PKCS#1 sign, graviola on nixos: 474.44 µs, 1.00× the fastest -RSA-2048 PKCS#1 sign, graviola on desktop: 343.91 µs, 1.01× the fastest -RSA-2048 PKCS#1 sign, graviola on nixos2: 445.92 µs, 1.03× the fastest -RSA-2048 PKCS#1 sign, OpenSSL on nixos: 520.25 µs, 1.10× the fastest -RSA-2048 PKCS#1 sign, OpenSSL on desktop: 397.72 µs, 1.17× the fastest -RSA-2048 PKCS#1 sign, OpenSSL on nixos2: 453.81 µs, 1.04× the fastest -RSA-2048 PKCS#1 sign, OpenSSL on ovh-iad: 846.94 µs, 1.11× the fastest -RSA-2048 PKCS#1 sign, OpenSSL on ovh-sea: 777.23 µs, 1.05× the fastest +RSA-2048 PKCS#1 sign, rind on kixtop: 275.12 µs, 1.00× the fastest +RSA-2048 PKCS#1 sign, rind on ovh-iad: 762.79 µs, 1.00× the fastest +RSA-2048 PKCS#1 sign, rind on ovh-sea: 740.76 µs, 1.00× the fastest +RSA-2048 PKCS#1 sign, aws-lc-rs on nixos: 532.39 µs, 1.12× the fastest +RSA-2048 PKCS#1 sign, aws-lc-rs on desktop: 349.47 µs, 1.02× the fastest +RSA-2048 PKCS#1 sign, aws-lc-rs on nixos2: 448.68 µs, 1.03× the fastest +RSA-2048 PKCS#1 sign, aws-lc-rs on kixtop: 285.95 µs, 1.04× the fastest +RSA-2048 PKCS#1 sign, aws-lc-rs on ovh-iad: 796.90 µs, 1.04× the fastest +RSA-2048 PKCS#1 sign, aws-lc-rs on ovh-sea: 779.05 µs, 1.05× the fastest +RSA-2048 PKCS#1 sign, ring on nixos: 523.12 µs, 1.10× the fastest +RSA-2048 PKCS#1 sign, ring on desktop: 341.11 µs, 1.00× the fastest +RSA-2048 PKCS#1 sign, ring on nixos2: 434.47 µs, 1.00× the fastest +RSA-2048 PKCS#1 sign, ring on kixtop: 322.84 µs, 1.17× the fastest +RSA-2048 PKCS#1 sign, ring on ovh-iad: 1.05 ms, 1.38× the fastest +RSA-2048 PKCS#1 sign, ring on ovh-sea: 982.45 µs, 1.33× the fastest +RSA-2048 PKCS#1 sign, RustCrypto + dalek on nixos: 1.26 ms, 2.66× the fastest +RSA-2048 PKCS#1 sign, RustCrypto + dalek on desktop: 588.67 µs, 1.73× the fastest +RSA-2048 PKCS#1 sign, RustCrypto + dalek on nixos2: 1.14 ms, 2.63× the fastest +RSA-2048 PKCS#1 sign, RustCrypto + dalek on kixtop: 586.34 µs, 2.13× the fastest +RSA-2048 PKCS#1 sign, RustCrypto + dalek on ovh-iad: 1.83 ms, 2.40× the fastest +RSA-2048 PKCS#1 sign, RustCrypto + dalek on ovh-sea: 1.78 ms, 2.40× the fastest +RSA-2048 PKCS#1 sign, graviola on nixos: 474.44 µs, 1.00× the fastest +RSA-2048 PKCS#1 sign, graviola on desktop: 343.91 µs, 1.01× the fastest +RSA-2048 PKCS#1 sign, graviola on nixos2: 445.92 µs, 1.03× the fastest +RSA-2048 PKCS#1 sign, graviola on kixtop: 556.70 µs, 2.02× the fastest +RSA-2048 PKCS#1 sign, OpenSSL on nixos: 520.25 µs, 1.10× the fastest +RSA-2048 PKCS#1 sign, OpenSSL on desktop: 397.72 µs, 1.17× the fastest +RSA-2048 PKCS#1 sign, OpenSSL on nixos2: 453.81 µs, 1.04× the fastest +RSA-2048 PKCS#1 sign, OpenSSL on kixtop: 341.31 µs, 1.24× the fastest +RSA-2048 PKCS#1 sign, OpenSSL on ovh-iad: 846.94 µs, 1.11× the fastest +RSA-2048 PKCS#1 sign, OpenSSL on ovh-sea: 777.23 µs, 1.05× the fastest RSA-2048 PKCS#1 verify RSA-2048 PKCS#1 verify, rind on nixos: 12.28 µs, 1.00× the fastest RSA-2048 PKCS#1 verify, rind on desktop: 8.97 µs, 1.00× the fastest RSA-2048 PKCS#1 verify, rind on nixos2: 12.88 µs, 1.00× the fastest -RSA-2048 PKCS#1 verify, rind on ovh-iad: 30.35 µs, 1.00× the fastest -RSA-2048 PKCS#1 verify, rind on ovh-sea: 29.50 µs, 1.00× the fastest -RSA-2048 PKCS#1 verify, aws-lc-rs on nixos: 14.60 µs, 1.19× the fastest -RSA-2048 PKCS#1 verify, aws-lc-rs on desktop: 10.86 µs, 1.21× the fastest -RSA-2048 PKCS#1 verify, aws-lc-rs on nixos2: 15.88 µs, 1.23× the fastest -RSA-2048 PKCS#1 verify, aws-lc-rs on ovh-iad: 35.39 µs, 1.17× the fastest -RSA-2048 PKCS#1 verify, aws-lc-rs on ovh-sea: 32.95 µs, 1.12× the fastest -RSA-2048 PKCS#1 verify, ring on nixos: 16.56 µs, 1.35× the fastest -RSA-2048 PKCS#1 verify, ring on desktop: 12.70 µs, 1.41× the fastest -RSA-2048 PKCS#1 verify, ring on nixos2: 16.51 µs, 1.28× the fastest -RSA-2048 PKCS#1 verify, ring on ovh-iad: 39.13 µs, 1.29× the fastest -RSA-2048 PKCS#1 verify, ring on ovh-sea: 37.72 µs, 1.28× the fastest -RSA-2048 PKCS#1 verify, RustCrypto + dalek on nixos: 54.06 µs, 4.40× the fastest -RSA-2048 PKCS#1 verify, RustCrypto + dalek on desktop: 29.41 µs, 3.28× the fastest -RSA-2048 PKCS#1 verify, RustCrypto + dalek on nixos2: 57.81 µs, 4.49× the fastest -RSA-2048 PKCS#1 verify, RustCrypto + dalek on ovh-iad: 92.51 µs, 3.05× the fastest -RSA-2048 PKCS#1 verify, RustCrypto + dalek on ovh-sea: 88.47 µs, 3.00× the fastest -RSA-2048 PKCS#1 verify, graviola on nixos: 19.25 µs, 1.57× the fastest -RSA-2048 PKCS#1 verify, graviola on desktop: 14.06 µs, 1.57× the fastest -RSA-2048 PKCS#1 verify, graviola on nixos2: 19.05 µs, 1.48× the fastest -RSA-2048 PKCS#1 verify, OpenSSL on nixos: 23.59 µs, 1.92× the fastest -RSA-2048 PKCS#1 verify, OpenSSL on desktop: 15.59 µs, 1.74× the fastest -RSA-2048 PKCS#1 verify, OpenSSL on nixos2: 24.54 µs, 1.91× the fastest -RSA-2048 PKCS#1 verify, OpenSSL on ovh-iad: 50.31 µs, 1.66× the fastest -RSA-2048 PKCS#1 verify, OpenSSL on ovh-sea: 47.30 µs, 1.60× the fastest +RSA-2048 PKCS#1 verify, rind on kixtop: 8.38 µs, 1.00× the fastest +RSA-2048 PKCS#1 verify, rind on ovh-iad: 30.35 µs, 1.00× the fastest +RSA-2048 PKCS#1 verify, rind on ovh-sea: 29.50 µs, 1.00× the fastest +RSA-2048 PKCS#1 verify, aws-lc-rs on nixos: 14.60 µs, 1.19× the fastest +RSA-2048 PKCS#1 verify, aws-lc-rs on desktop: 10.86 µs, 1.21× the fastest +RSA-2048 PKCS#1 verify, aws-lc-rs on nixos2: 15.88 µs, 1.23× the fastest +RSA-2048 PKCS#1 verify, aws-lc-rs on kixtop: 9.48 µs, 1.13× the fastest +RSA-2048 PKCS#1 verify, aws-lc-rs on ovh-iad: 35.39 µs, 1.17× the fastest +RSA-2048 PKCS#1 verify, aws-lc-rs on ovh-sea: 32.95 µs, 1.12× the fastest +RSA-2048 PKCS#1 verify, ring on nixos: 16.56 µs, 1.35× the fastest +RSA-2048 PKCS#1 verify, ring on desktop: 12.70 µs, 1.41× the fastest +RSA-2048 PKCS#1 verify, ring on nixos2: 16.51 µs, 1.28× the fastest +RSA-2048 PKCS#1 verify, ring on kixtop: 11.05 µs, 1.32× the fastest +RSA-2048 PKCS#1 verify, ring on ovh-iad: 39.13 µs, 1.29× the fastest +RSA-2048 PKCS#1 verify, ring on ovh-sea: 37.72 µs, 1.28× the fastest +RSA-2048 PKCS#1 verify, RustCrypto + dalek on nixos: 54.06 µs, 4.40× the fastest +RSA-2048 PKCS#1 verify, RustCrypto + dalek on desktop: 29.41 µs, 3.28× the fastest +RSA-2048 PKCS#1 verify, RustCrypto + dalek on nixos2: 57.81 µs, 4.49× the fastest +RSA-2048 PKCS#1 verify, RustCrypto + dalek on kixtop: 30.77 µs, 3.67× the fastest +RSA-2048 PKCS#1 verify, RustCrypto + dalek on ovh-iad: 92.51 µs, 3.05× the fastest +RSA-2048 PKCS#1 verify, RustCrypto + dalek on ovh-sea: 88.47 µs, 3.00× the fastest +RSA-2048 PKCS#1 verify, graviola on nixos: 19.25 µs, 1.57× the fastest +RSA-2048 PKCS#1 verify, graviola on desktop: 14.06 µs, 1.57× the fastest +RSA-2048 PKCS#1 verify, graviola on nixos2: 19.05 µs, 1.48× the fastest +RSA-2048 PKCS#1 verify, graviola on kixtop: 18.51 µs, 2.21× the fastest +RSA-2048 PKCS#1 verify, OpenSSL on nixos: 23.59 µs, 1.92× the fastest +RSA-2048 PKCS#1 verify, OpenSSL on desktop: 15.59 µs, 1.74× the fastest +RSA-2048 PKCS#1 verify, OpenSSL on nixos2: 24.54 µs, 1.91× the fastest +RSA-2048 PKCS#1 verify, OpenSSL on kixtop: 16.66 µs, 1.99× the fastest +RSA-2048 PKCS#1 verify, OpenSSL on ovh-iad: 50.31 µs, 1.66× the fastest +RSA-2048 PKCS#1 verify, OpenSSL on ovh-sea: 47.30 µs, 1.60× the fastest RSA-2048 PSS sign RSA-2048 PSS sign, rind on nixos: 424.30 µs, 1.00× the fastest RSA-2048 PSS sign, rind on desktop: 346.52 µs, 1.01× the fastest RSA-2048 PSS sign, rind on nixos2: 445.92 µs, 1.02× the fastest -RSA-2048 PSS sign, rind on ovh-iad: 819.13 µs, 1.01× the fastest -RSA-2048 PSS sign, rind on ovh-sea: 743.95 µs, 1.00× the fastest -RSA-2048 PSS sign, aws-lc-rs on nixos: 481.00 µs, 1.13× the fastest -RSA-2048 PSS sign, aws-lc-rs on desktop: 350.45 µs, 1.03× the fastest -RSA-2048 PSS sign, aws-lc-rs on nixos2: 461.87 µs, 1.06× the fastest -RSA-2048 PSS sign, aws-lc-rs on ovh-iad: 807.21 µs, 1.00× the fastest -RSA-2048 PSS sign, aws-lc-rs on ovh-sea: 772.15 µs, 1.04× the fastest -RSA-2048 PSS sign, ring on nixos: 471.53 µs, 1.11× the fastest -RSA-2048 PSS sign, ring on desktop: 341.45 µs, 1.00× the fastest -RSA-2048 PSS sign, ring on nixos2: 437.28 µs, 1.00× the fastest -RSA-2048 PSS sign, ring on ovh-iad: 1.04 ms, 1.29× the fastest -RSA-2048 PSS sign, ring on ovh-sea: 987.95 µs, 1.33× the fastest -RSA-2048 PSS sign, RustCrypto + dalek on nixos: 1.06 ms, 2.50× the fastest -RSA-2048 PSS sign, RustCrypto + dalek on desktop: 588.33 µs, 1.72× the fastest -RSA-2048 PSS sign, RustCrypto + dalek on nixos2: 1.15 ms, 2.63× the fastest -RSA-2048 PSS sign, RustCrypto + dalek on ovh-iad: 1.91 ms, 2.36× the fastest -RSA-2048 PSS sign, RustCrypto + dalek on ovh-sea: 1.81 ms, 2.44× the fastest -RSA-2048 PSS sign, graviola on nixos: 448.54 µs, 1.06× the fastest -RSA-2048 PSS sign, graviola on desktop: 342.67 µs, 1.00× the fastest -RSA-2048 PSS sign, graviola on nixos2: 450.24 µs, 1.03× the fastest -RSA-2048 PSS sign, libcrux on nixos: 5.86 ms, 13.81× the fastest; verified: HACL*'s F* proof of Hacl.RSAPSS's rsapss_skey_sign and rsapss_pkey_verify, signing without the CRT, compiled to Rust by an unverified step -✓ -RSA-2048 PSS sign, libcrux on desktop: 4.10 ms, 12.00× the fastest; verified: HACL*'s F* proof of Hacl.RSAPSS's rsapss_skey_sign and rsapss_pkey_verify, signing without the CRT, compiled to Rust by an unverified step -✓ -RSA-2048 PSS sign, libcrux on nixos2: 7.22 ms, 16.51× the fastest; verified: HACL*'s F* proof of Hacl.RSAPSS's rsapss_skey_sign and rsapss_pkey_verify, signing without the CRT, compiled to Rust by an unverified step -✓ -RSA-2048 PSS sign, libcrux on ovh-iad: 11.56 ms, 14.33× the fastest; verified: HACL*'s F* proof of Hacl.RSAPSS's rsapss_skey_sign and rsapss_pkey_verify, signing without the CRT, compiled to Rust by an unverified step -✓ -RSA-2048 PSS sign, libcrux on ovh-sea: 10.86 ms, 14.60× the fastest; verified: HACL*'s F* proof of Hacl.RSAPSS's rsapss_skey_sign and rsapss_pkey_verify, signing without the CRT, compiled to Rust by an unverified step -✓ -RSA-2048 PSS sign, OpenSSL on nixos: 474.99 µs, 1.12× the fastest -RSA-2048 PSS sign, OpenSSL on desktop: 395.81 µs, 1.16× the fastest -RSA-2048 PSS sign, OpenSSL on nixos2: 456.55 µs, 1.04× the fastest -RSA-2048 PSS sign, OpenSSL on ovh-iad: 830.22 µs, 1.03× the fastest -RSA-2048 PSS sign, OpenSSL on ovh-sea: 796.27 µs, 1.07× the fastest +RSA-2048 PSS sign, rind on kixtop: 275.29 µs, 1.00× the fastest +RSA-2048 PSS sign, rind on ovh-iad: 819.13 µs, 1.01× the fastest +RSA-2048 PSS sign, rind on ovh-sea: 743.95 µs, 1.00× the fastest +RSA-2048 PSS sign, aws-lc-rs on nixos: 481.00 µs, 1.13× the fastest +RSA-2048 PSS sign, aws-lc-rs on desktop: 350.45 µs, 1.03× the fastest +RSA-2048 PSS sign, aws-lc-rs on nixos2: 461.87 µs, 1.06× the fastest +RSA-2048 PSS sign, aws-lc-rs on kixtop: 288.58 µs, 1.05× the fastest +RSA-2048 PSS sign, aws-lc-rs on ovh-iad: 807.21 µs, 1.00× the fastest +RSA-2048 PSS sign, aws-lc-rs on ovh-sea: 772.15 µs, 1.04× the fastest +RSA-2048 PSS sign, ring on nixos: 471.53 µs, 1.11× the fastest +RSA-2048 PSS sign, ring on desktop: 341.45 µs, 1.00× the fastest +RSA-2048 PSS sign, ring on nixos2: 437.28 µs, 1.00× the fastest +RSA-2048 PSS sign, ring on kixtop: 324.86 µs, 1.18× the fastest +RSA-2048 PSS sign, ring on ovh-iad: 1.04 ms, 1.29× the fastest +RSA-2048 PSS sign, ring on ovh-sea: 987.95 µs, 1.33× the fastest +RSA-2048 PSS sign, RustCrypto + dalek on nixos: 1.06 ms, 2.50× the fastest +RSA-2048 PSS sign, RustCrypto + dalek on desktop: 588.33 µs, 1.72× the fastest +RSA-2048 PSS sign, RustCrypto + dalek on nixos2: 1.15 ms, 2.63× the fastest +RSA-2048 PSS sign, RustCrypto + dalek on kixtop: 588.38 µs, 2.14× the fastest +RSA-2048 PSS sign, RustCrypto + dalek on ovh-iad: 1.91 ms, 2.36× the fastest +RSA-2048 PSS sign, RustCrypto + dalek on ovh-sea: 1.81 ms, 2.44× the fastest +RSA-2048 PSS sign, graviola on nixos: 448.54 µs, 1.06× the fastest +RSA-2048 PSS sign, graviola on desktop: 342.67 µs, 1.00× the fastest +RSA-2048 PSS sign, graviola on nixos2: 450.24 µs, 1.03× the fastest +RSA-2048 PSS sign, graviola on kixtop: 558.57 µs, 2.03× the fastest +RSA-2048 PSS sign, libcrux on nixos: 5.86 ms, 13.81× the fastest; verified: HACL*'s F* proof of Hacl.RSAPSS's rsapss_skey_sign and rsapss_pkey_verify, signing without the CRT, compiled to Rust by an unverified step +✓ +RSA-2048 PSS sign, libcrux on desktop: 4.10 ms, 12.00× the fastest; verified: HACL*'s F* proof of Hacl.RSAPSS's rsapss_skey_sign and rsapss_pkey_verify, signing without the CRT, compiled to Rust by an unverified step +✓ +RSA-2048 PSS sign, libcrux on nixos2: 7.22 ms, 16.51× the fastest; verified: HACL*'s F* proof of Hacl.RSAPSS's rsapss_skey_sign and rsapss_pkey_verify, signing without the CRT, compiled to Rust by an unverified step +✓ +RSA-2048 PSS sign, libcrux on kixtop: 4.48 ms, 16.28× the fastest; verified: HACL*'s F* proof of Hacl.RSAPSS's rsapss_skey_sign and rsapss_pkey_verify, signing without the CRT, compiled to Rust by an unverified step +✓ +RSA-2048 PSS sign, libcrux on ovh-iad: 11.56 ms, 14.33× the fastest; verified: HACL*'s F* proof of Hacl.RSAPSS's rsapss_skey_sign and rsapss_pkey_verify, signing without the CRT, compiled to Rust by an unverified step +✓ +RSA-2048 PSS sign, libcrux on ovh-sea: 10.86 ms, 14.60× the fastest; verified: HACL*'s F* proof of Hacl.RSAPSS's rsapss_skey_sign and rsapss_pkey_verify, signing without the CRT, compiled to Rust by an unverified step +✓ +RSA-2048 PSS sign, OpenSSL on nixos: 474.99 µs, 1.12× the fastest +RSA-2048 PSS sign, OpenSSL on desktop: 395.81 µs, 1.16× the fastest +RSA-2048 PSS sign, OpenSSL on nixos2: 456.55 µs, 1.04× the fastest +RSA-2048 PSS sign, OpenSSL on kixtop: 342.61 µs, 1.24× the fastest +RSA-2048 PSS sign, OpenSSL on ovh-iad: 830.22 µs, 1.03× the fastest +RSA-2048 PSS sign, OpenSSL on ovh-sea: 796.27 µs, 1.07× the fastest RSA-2048 PSS verify RSA-2048 PSS verify, rind on nixos: 12.67 µs, 1.00× the fastest RSA-2048 PSS verify, rind on desktop: 9.18 µs, 1.00× the fastest RSA-2048 PSS verify, rind on nixos2: 14.36 µs, 1.00× the fastest -RSA-2048 PSS verify, rind on ovh-iad: 35.06 µs, 1.00× the fastest -RSA-2048 PSS verify, rind on ovh-sea: 31.99 µs, 1.00× the fastest -RSA-2048 PSS verify, aws-lc-rs on nixos: 15.94 µs, 1.26× the fastest -RSA-2048 PSS verify, aws-lc-rs on desktop: 11.17 µs, 1.22× the fastest -RSA-2048 PSS verify, aws-lc-rs on nixos2: 17.01 µs, 1.18× the fastest -RSA-2048 PSS verify, aws-lc-rs on ovh-iad: 36.78 µs, 1.05× the fastest -RSA-2048 PSS verify, aws-lc-rs on ovh-sea: 35.48 µs, 1.11× the fastest -RSA-2048 PSS verify, ring on nixos: 18.03 µs, 1.42× the fastest -RSA-2048 PSS verify, ring on desktop: 13.31 µs, 1.45× the fastest -RSA-2048 PSS verify, ring on nixos2: 18.22 µs, 1.27× the fastest -RSA-2048 PSS verify, ring on ovh-iad: 42.45 µs, 1.21× the fastest -RSA-2048 PSS verify, ring on ovh-sea: 40.12 µs, 1.25× the fastest -RSA-2048 PSS verify, RustCrypto + dalek on nixos: 64.70 µs, 5.11× the fastest -RSA-2048 PSS verify, RustCrypto + dalek on desktop: 35.62 µs, 3.88× the fastest -RSA-2048 PSS verify, RustCrypto + dalek on nixos2: 70.02 µs, 4.88× the fastest -RSA-2048 PSS verify, RustCrypto + dalek on ovh-iad: 117.27 µs, 3.35× the fastest -RSA-2048 PSS verify, RustCrypto + dalek on ovh-sea: 106.80 µs, 3.34× the fastest -RSA-2048 PSS verify, graviola on nixos: 19.63 µs, 1.55× the fastest -RSA-2048 PSS verify, graviola on desktop: 14.44 µs, 1.57× the fastest -RSA-2048 PSS verify, graviola on nixos2: 21.85 µs, 1.52× the fastest -RSA-2048 PSS verify, libcrux on nixos: 312.23 µs, 24.64× the fastest; verified: HACL*'s F* proof of Hacl.RSAPSS's rsapss_skey_sign and rsapss_pkey_verify, signing without the CRT, compiled to Rust by an unverified step -✓ -RSA-2048 PSS verify, libcrux on desktop: 252.13 µs, 27.46× the fastest; verified: HACL*'s F* proof of Hacl.RSAPSS's rsapss_skey_sign and rsapss_pkey_verify, signing without the CRT, compiled to Rust by an unverified step -✓ -RSA-2048 PSS verify, libcrux on nixos2: 377.87 µs, 26.32× the fastest; verified: HACL*'s F* proof of Hacl.RSAPSS's rsapss_skey_sign and rsapss_pkey_verify, signing without the CRT, compiled to Rust by an unverified step -✓ -RSA-2048 PSS verify, libcrux on ovh-iad: 636.67 µs, 18.16× the fastest; verified: HACL*'s F* proof of Hacl.RSAPSS's rsapss_skey_sign and rsapss_pkey_verify, signing without the CRT, compiled to Rust by an unverified step -✓ -RSA-2048 PSS verify, libcrux on ovh-sea: 583.13 µs, 18.23× the fastest; verified: HACL*'s F* proof of Hacl.RSAPSS's rsapss_skey_sign and rsapss_pkey_verify, signing without the CRT, compiled to Rust by an unverified step -✓ -RSA-2048 PSS verify, OpenSSL on nixos: 23.60 µs, 1.86× the fastest -RSA-2048 PSS verify, OpenSSL on desktop: 16.36 µs, 1.78× the fastest -RSA-2048 PSS verify, OpenSSL on nixos2: 27.16 µs, 1.89× the fastest -RSA-2048 PSS verify, OpenSSL on ovh-iad: 55.18 µs, 1.57× the fastest -RSA-2048 PSS verify, OpenSSL on ovh-sea: 50.44 µs, 1.58× the fastest +RSA-2048 PSS verify, rind on kixtop: 8.71 µs, 1.00× the fastest +RSA-2048 PSS verify, rind on ovh-iad: 35.06 µs, 1.00× the fastest +RSA-2048 PSS verify, rind on ovh-sea: 31.99 µs, 1.00× the fastest +RSA-2048 PSS verify, aws-lc-rs on nixos: 15.94 µs, 1.26× the fastest +RSA-2048 PSS verify, aws-lc-rs on desktop: 11.17 µs, 1.22× the fastest +RSA-2048 PSS verify, aws-lc-rs on nixos2: 17.01 µs, 1.18× the fastest +RSA-2048 PSS verify, aws-lc-rs on kixtop: 9.84 µs, 1.13× the fastest +RSA-2048 PSS verify, aws-lc-rs on ovh-iad: 36.78 µs, 1.05× the fastest +RSA-2048 PSS verify, aws-lc-rs on ovh-sea: 35.48 µs, 1.11× the fastest +RSA-2048 PSS verify, ring on nixos: 18.03 µs, 1.42× the fastest +RSA-2048 PSS verify, ring on desktop: 13.31 µs, 1.45× the fastest +RSA-2048 PSS verify, ring on nixos2: 18.22 µs, 1.27× the fastest +RSA-2048 PSS verify, ring on kixtop: 11.48 µs, 1.32× the fastest +RSA-2048 PSS verify, ring on ovh-iad: 42.45 µs, 1.21× the fastest +RSA-2048 PSS verify, ring on ovh-sea: 40.12 µs, 1.25× the fastest +RSA-2048 PSS verify, RustCrypto + dalek on nixos: 64.70 µs, 5.11× the fastest +RSA-2048 PSS verify, RustCrypto + dalek on desktop: 35.62 µs, 3.88× the fastest +RSA-2048 PSS verify, RustCrypto + dalek on nixos2: 70.02 µs, 4.88× the fastest +RSA-2048 PSS verify, RustCrypto + dalek on kixtop: 39.26 µs, 4.51× the fastest +RSA-2048 PSS verify, RustCrypto + dalek on ovh-iad: 117.27 µs, 3.35× the fastest +RSA-2048 PSS verify, RustCrypto + dalek on ovh-sea: 106.80 µs, 3.34× the fastest +RSA-2048 PSS verify, graviola on nixos: 19.63 µs, 1.55× the fastest +RSA-2048 PSS verify, graviola on desktop: 14.44 µs, 1.57× the fastest +RSA-2048 PSS verify, graviola on nixos2: 21.85 µs, 1.52× the fastest +RSA-2048 PSS verify, graviola on kixtop: 18.79 µs, 2.16× the fastest +RSA-2048 PSS verify, libcrux on nixos: 312.23 µs, 24.64× the fastest; verified: HACL*'s F* proof of Hacl.RSAPSS's rsapss_skey_sign and rsapss_pkey_verify, signing without the CRT, compiled to Rust by an unverified step +✓ +RSA-2048 PSS verify, libcrux on desktop: 252.13 µs, 27.46× the fastest; verified: HACL*'s F* proof of Hacl.RSAPSS's rsapss_skey_sign and rsapss_pkey_verify, signing without the CRT, compiled to Rust by an unverified step +✓ +RSA-2048 PSS verify, libcrux on nixos2: 377.87 µs, 26.32× the fastest; verified: HACL*'s F* proof of Hacl.RSAPSS's rsapss_skey_sign and rsapss_pkey_verify, signing without the CRT, compiled to Rust by an unverified step +✓ +RSA-2048 PSS verify, libcrux on kixtop: 299.96 µs, 34.44× the fastest; verified: HACL*'s F* proof of Hacl.RSAPSS's rsapss_skey_sign and rsapss_pkey_verify, signing without the CRT, compiled to Rust by an unverified step +✓ +RSA-2048 PSS verify, libcrux on ovh-iad: 636.67 µs, 18.16× the fastest; verified: HACL*'s F* proof of Hacl.RSAPSS's rsapss_skey_sign and rsapss_pkey_verify, signing without the CRT, compiled to Rust by an unverified step +✓ +RSA-2048 PSS verify, libcrux on ovh-sea: 583.13 µs, 18.23× the fastest; verified: HACL*'s F* proof of Hacl.RSAPSS's rsapss_skey_sign and rsapss_pkey_verify, signing without the CRT, compiled to Rust by an unverified step +✓ +RSA-2048 PSS verify, OpenSSL on nixos: 23.60 µs, 1.86× the fastest +RSA-2048 PSS verify, OpenSSL on desktop: 16.36 µs, 1.78× the fastest +RSA-2048 PSS verify, OpenSSL on nixos2: 27.16 µs, 1.89× the fastest +RSA-2048 PSS verify, OpenSSL on kixtop: 17.44 µs, 2.00× the fastest +RSA-2048 PSS verify, OpenSSL on ovh-iad: 55.18 µs, 1.57× the fastest +RSA-2048 PSS verify, OpenSSL on ovh-sea: 50.44 µs, 1.58× the fastest ML-KEM - + ML-KEM-768 key generation ML-KEM-768 key generation, rind on nixos: 8.43 µs, 1.00× the fastest ML-KEM-768 key generation, rind on desktop: 6.45 µs, 1.00× the fastest ML-KEM-768 key generation, rind on nixos2: 10.24 µs, 1.00× the fastest -ML-KEM-768 key generation, rind on ovh-iad: 18.79 µs, 1.00× the fastest -ML-KEM-768 key generation, rind on ovh-sea: 17.44 µs, 1.00× the fastest -ML-KEM-768 key generation, aws-lc-rs on nixos: 9.41 µs, 1.12× the fastest -ML-KEM-768 key generation, aws-lc-rs on desktop: 8.27 µs, 1.28× the fastest -ML-KEM-768 key generation, aws-lc-rs on nixos2: 18.44 µs, 1.80× the fastest -ML-KEM-768 key generation, aws-lc-rs on ovh-iad: 25.06 µs, 1.33× the fastest -ML-KEM-768 key generation, aws-lc-rs on ovh-sea: 23.21 µs, 1.33× the fastest -ML-KEM-768 key generation, RustCrypto + dalek on nixos: 60.18 µs, 7.14× the fastest -ML-KEM-768 key generation, RustCrypto + dalek on desktop: 40.26 µs, 6.24× the fastest -ML-KEM-768 key generation, RustCrypto + dalek on nixos2: 59.97 µs, 5.86× the fastest -ML-KEM-768 key generation, RustCrypto + dalek on ovh-iad: 100.59 µs, 5.35× the fastest -ML-KEM-768 key generation, RustCrypto + dalek on ovh-sea: 92.84 µs, 5.32× the fastest -ML-KEM-768 key generation, graviola on nixos: 9.28 µs, 1.10× the fastest -ML-KEM-768 key generation, graviola on desktop: 7.67 µs, 1.19× the fastest -ML-KEM-768 key generation, graviola on nixos2: 10.41 µs, 1.02× the fastest -ML-KEM-768 key generation, libcrux on nixos: 18.15 µs, 2.15× the fastest -ML-KEM-768 key generation, libcrux on desktop: 15.15 µs, 2.35× the fastest -ML-KEM-768 key generation, libcrux on nixos2: 20.05 µs, 1.96× the fastest -ML-KEM-768 key generation, libcrux on ovh-iad: 36.95 µs, 1.97× the fastest -ML-KEM-768 key generation, libcrux on ovh-sea: 34.54 µs, 1.98× the fastest -ML-KEM-768 key generation, OpenSSL on nixos: 26.82 µs, 3.18× the fastest -ML-KEM-768 key generation, OpenSSL on desktop: 19.80 µs, 3.07× the fastest -ML-KEM-768 key generation, OpenSSL on nixos2: 40.63 µs, 3.97× the fastest -ML-KEM-768 key generation, OpenSSL on ovh-iad: 69.54 µs, 3.70× the fastest -ML-KEM-768 key generation, OpenSSL on ovh-sea: 62.78 µs, 3.60× the fastest +ML-KEM-768 key generation, rind on kixtop: 6.20 µs, 1.00× the fastest +ML-KEM-768 key generation, rind on ovh-iad: 18.79 µs, 1.00× the fastest +ML-KEM-768 key generation, rind on ovh-sea: 17.44 µs, 1.00× the fastest +ML-KEM-768 key generation, aws-lc-rs on nixos: 9.41 µs, 1.12× the fastest +ML-KEM-768 key generation, aws-lc-rs on desktop: 8.27 µs, 1.28× the fastest +ML-KEM-768 key generation, aws-lc-rs on nixos2: 18.44 µs, 1.80× the fastest +ML-KEM-768 key generation, aws-lc-rs on kixtop: 7.46 µs, 1.20× the fastest +ML-KEM-768 key generation, aws-lc-rs on ovh-iad: 25.06 µs, 1.33× the fastest +ML-KEM-768 key generation, aws-lc-rs on ovh-sea: 23.21 µs, 1.33× the fastest +ML-KEM-768 key generation, RustCrypto + dalek on nixos: 60.18 µs, 7.14× the fastest +ML-KEM-768 key generation, RustCrypto + dalek on desktop: 40.26 µs, 6.24× the fastest +ML-KEM-768 key generation, RustCrypto + dalek on nixos2: 59.97 µs, 5.86× the fastest +ML-KEM-768 key generation, RustCrypto + dalek on kixtop: 26.57 µs, 4.29× the fastest +ML-KEM-768 key generation, RustCrypto + dalek on ovh-iad: 100.59 µs, 5.35× the fastest +ML-KEM-768 key generation, RustCrypto + dalek on ovh-sea: 92.84 µs, 5.32× the fastest +ML-KEM-768 key generation, graviola on nixos: 9.28 µs, 1.10× the fastest +ML-KEM-768 key generation, graviola on desktop: 7.67 µs, 1.19× the fastest +ML-KEM-768 key generation, graviola on nixos2: 10.41 µs, 1.02× the fastest +ML-KEM-768 key generation, graviola on kixtop: 6.22 µs, 1.00× the fastest +ML-KEM-768 key generation, libcrux on nixos: 18.15 µs, 2.15× the fastest +ML-KEM-768 key generation, libcrux on desktop: 15.15 µs, 2.35× the fastest +ML-KEM-768 key generation, libcrux on nixos2: 20.05 µs, 1.96× the fastest +ML-KEM-768 key generation, libcrux on kixtop: 12.01 µs, 1.94× the fastest +ML-KEM-768 key generation, libcrux on ovh-iad: 36.95 µs, 1.97× the fastest +ML-KEM-768 key generation, libcrux on ovh-sea: 34.54 µs, 1.98× the fastest +ML-KEM-768 key generation, OpenSSL on nixos: 26.82 µs, 3.18× the fastest +ML-KEM-768 key generation, OpenSSL on desktop: 19.80 µs, 3.07× the fastest +ML-KEM-768 key generation, OpenSSL on nixos2: 40.63 µs, 3.97× the fastest +ML-KEM-768 key generation, OpenSSL on kixtop: 25.06 µs, 4.04× the fastest +ML-KEM-768 key generation, OpenSSL on ovh-iad: 69.54 µs, 3.70× the fastest +ML-KEM-768 key generation, OpenSSL on ovh-sea: 62.78 µs, 3.60× the fastest ML-KEM-768 encapsulate ML-KEM-768 encapsulate, rind on nixos: 8.53 µs, 1.00× the fastest ML-KEM-768 encapsulate, rind on desktop: 6.65 µs, 1.00× the fastest ML-KEM-768 encapsulate, rind on nixos2: 10.61 µs, 1.00× the fastest -ML-KEM-768 encapsulate, rind on ovh-iad: 18.94 µs, 1.00× the fastest -ML-KEM-768 encapsulate, rind on ovh-sea: 18.36 µs, 1.00× the fastest -ML-KEM-768 encapsulate, aws-lc-rs on nixos: 10.41 µs, 1.22× the fastest -ML-KEM-768 encapsulate, aws-lc-rs on desktop: 8.68 µs, 1.31× the fastest -ML-KEM-768 encapsulate, aws-lc-rs on nixos2: 18.73 µs, 1.76× the fastest -ML-KEM-768 encapsulate, aws-lc-rs on ovh-iad: 25.08 µs, 1.32× the fastest -ML-KEM-768 encapsulate, aws-lc-rs on ovh-sea: 23.94 µs, 1.30× the fastest -ML-KEM-768 encapsulate, RustCrypto + dalek on nixos: 72.03 µs, 8.44× the fastest -ML-KEM-768 encapsulate, RustCrypto + dalek on desktop: 41.71 µs, 6.27× the fastest -ML-KEM-768 encapsulate, RustCrypto + dalek on nixos2: 67.03 µs, 6.31× the fastest -ML-KEM-768 encapsulate, RustCrypto + dalek on ovh-iad: 104.24 µs, 5.50× the fastest -ML-KEM-768 encapsulate, RustCrypto + dalek on ovh-sea: 101.88 µs, 5.55× the fastest -ML-KEM-768 encapsulate, graviola on nixos: 10.95 µs, 1.28× the fastest -ML-KEM-768 encapsulate, graviola on desktop: 9.11 µs, 1.37× the fastest -ML-KEM-768 encapsulate, graviola on nixos2: 11.12 µs, 1.05× the fastest -ML-KEM-768 encapsulate, libcrux on nixos: 16.03 µs, 1.88× the fastest -ML-KEM-768 encapsulate, libcrux on desktop: 12.94 µs, 1.94× the fastest -ML-KEM-768 encapsulate, libcrux on nixos2: 18.13 µs, 1.71× the fastest -ML-KEM-768 encapsulate, libcrux on ovh-iad: 32.18 µs, 1.70× the fastest -ML-KEM-768 encapsulate, libcrux on ovh-sea: 31.26 µs, 1.70× the fastest -ML-KEM-768 encapsulate, OpenSSL on nixos: 30.02 µs, 3.52× the fastest -ML-KEM-768 encapsulate, OpenSSL on desktop: 18.77 µs, 2.82× the fastest -ML-KEM-768 encapsulate, OpenSSL on nixos2: 41.18 µs, 3.88× the fastest -ML-KEM-768 encapsulate, OpenSSL on ovh-iad: 66.54 µs, 3.51× the fastest -ML-KEM-768 encapsulate, OpenSSL on ovh-sea: 63.41 µs, 3.45× the fastest +ML-KEM-768 encapsulate, rind on kixtop: 6.84 µs, 1.07× the fastest +ML-KEM-768 encapsulate, rind on ovh-iad: 18.94 µs, 1.00× the fastest +ML-KEM-768 encapsulate, rind on ovh-sea: 18.36 µs, 1.00× the fastest +ML-KEM-768 encapsulate, aws-lc-rs on nixos: 10.41 µs, 1.22× the fastest +ML-KEM-768 encapsulate, aws-lc-rs on desktop: 8.68 µs, 1.31× the fastest +ML-KEM-768 encapsulate, aws-lc-rs on nixos2: 18.73 µs, 1.76× the fastest +ML-KEM-768 encapsulate, aws-lc-rs on kixtop: 8.01 µs, 1.25× the fastest +ML-KEM-768 encapsulate, aws-lc-rs on ovh-iad: 25.08 µs, 1.32× the fastest +ML-KEM-768 encapsulate, aws-lc-rs on ovh-sea: 23.94 µs, 1.30× the fastest +ML-KEM-768 encapsulate, RustCrypto + dalek on nixos: 72.03 µs, 8.44× the fastest +ML-KEM-768 encapsulate, RustCrypto + dalek on desktop: 41.71 µs, 6.27× the fastest +ML-KEM-768 encapsulate, RustCrypto + dalek on nixos2: 67.03 µs, 6.31× the fastest +ML-KEM-768 encapsulate, RustCrypto + dalek on kixtop: 27.77 µs, 4.34× the fastest +ML-KEM-768 encapsulate, RustCrypto + dalek on ovh-iad: 104.24 µs, 5.50× the fastest +ML-KEM-768 encapsulate, RustCrypto + dalek on ovh-sea: 101.88 µs, 5.55× the fastest +ML-KEM-768 encapsulate, graviola on nixos: 10.95 µs, 1.28× the fastest +ML-KEM-768 encapsulate, graviola on desktop: 9.11 µs, 1.37× the fastest +ML-KEM-768 encapsulate, graviola on nixos2: 11.12 µs, 1.05× the fastest +ML-KEM-768 encapsulate, graviola on kixtop: 6.40 µs, 1.00× the fastest +ML-KEM-768 encapsulate, libcrux on nixos: 16.03 µs, 1.88× the fastest +ML-KEM-768 encapsulate, libcrux on desktop: 12.94 µs, 1.94× the fastest +ML-KEM-768 encapsulate, libcrux on nixos2: 18.13 µs, 1.71× the fastest +ML-KEM-768 encapsulate, libcrux on kixtop: 9.39 µs, 1.47× the fastest +ML-KEM-768 encapsulate, libcrux on ovh-iad: 32.18 µs, 1.70× the fastest +ML-KEM-768 encapsulate, libcrux on ovh-sea: 31.26 µs, 1.70× the fastest +ML-KEM-768 encapsulate, OpenSSL on nixos: 30.02 µs, 3.52× the fastest +ML-KEM-768 encapsulate, OpenSSL on desktop: 18.77 µs, 2.82× the fastest +ML-KEM-768 encapsulate, OpenSSL on nixos2: 41.18 µs, 3.88× the fastest +ML-KEM-768 encapsulate, OpenSSL on kixtop: 24.07 µs, 3.76× the fastest +ML-KEM-768 encapsulate, OpenSSL on ovh-iad: 66.54 µs, 3.51× the fastest +ML-KEM-768 encapsulate, OpenSSL on ovh-sea: 63.41 µs, 3.45× the fastest ML-KEM-768 decapsulate ML-KEM-768 decapsulate, rind on nixos: 6.07 µs, 1.00× the fastest ML-KEM-768 decapsulate, rind on desktop: 4.69 µs, 1.00× the fastest ML-KEM-768 decapsulate, rind on nixos2: 7.07 µs, 1.00× the fastest -ML-KEM-768 decapsulate, rind on ovh-iad: 12.89 µs, 1.00× the fastest -ML-KEM-768 decapsulate, rind on ovh-sea: 12.15 µs, 1.00× the fastest -ML-KEM-768 decapsulate, aws-lc-rs on nixos: 11.96 µs, 1.97× the fastest -ML-KEM-768 decapsulate, aws-lc-rs on desktop: 9.02 µs, 1.92× the fastest -ML-KEM-768 decapsulate, aws-lc-rs on nixos2: 16.01 µs, 2.26× the fastest -ML-KEM-768 decapsulate, aws-lc-rs on ovh-iad: 28.78 µs, 2.23× the fastest -ML-KEM-768 decapsulate, aws-lc-rs on ovh-sea: 27.57 µs, 2.27× the fastest -ML-KEM-768 decapsulate, RustCrypto + dalek on nixos: 95.17 µs, 15.68× the fastest -ML-KEM-768 decapsulate, RustCrypto + dalek on desktop: 54.19 µs, 11.55× the fastest -ML-KEM-768 decapsulate, RustCrypto + dalek on nixos2: 84.37 µs, 11.93× the fastest -ML-KEM-768 decapsulate, RustCrypto + dalek on ovh-iad: 148.48 µs, 11.52× the fastest -ML-KEM-768 decapsulate, RustCrypto + dalek on ovh-sea: 130.57 µs, 10.75× the fastest -ML-KEM-768 decapsulate, graviola on nixos: 7.72 µs, 1.27× the fastest -ML-KEM-768 decapsulate, graviola on desktop: 6.59 µs, 1.41× the fastest -ML-KEM-768 decapsulate, graviola on nixos2: 7.42 µs, 1.05× the fastest -ML-KEM-768 decapsulate, libcrux on nixos: 16.22 µs, 2.67× the fastest -ML-KEM-768 decapsulate, libcrux on desktop: 13.44 µs, 2.87× the fastest -ML-KEM-768 decapsulate, libcrux on nixos2: 19.04 µs, 2.69× the fastest -ML-KEM-768 decapsulate, libcrux on ovh-iad: 35.04 µs, 2.72× the fastest -ML-KEM-768 decapsulate, libcrux on ovh-sea: 33.12 µs, 2.73× the fastest -ML-KEM-768 decapsulate, OpenSSL on nixos: 24.64 µs, 4.06× the fastest -ML-KEM-768 decapsulate, OpenSSL on desktop: 16.05 µs, 3.42× the fastest -ML-KEM-768 decapsulate, OpenSSL on nixos2: 31.67 µs, 4.48× the fastest -ML-KEM-768 decapsulate, OpenSSL on ovh-iad: 49.78 µs, 3.86× the fastest -ML-KEM-768 decapsulate, OpenSSL on ovh-sea: 48.94 µs, 4.03× the fastest +ML-KEM-768 decapsulate, rind on kixtop: 4.17 µs, 1.03× the fastest +ML-KEM-768 decapsulate, rind on ovh-iad: 12.89 µs, 1.00× the fastest +ML-KEM-768 decapsulate, rind on ovh-sea: 12.15 µs, 1.00× the fastest +ML-KEM-768 decapsulate, aws-lc-rs on nixos: 11.96 µs, 1.97× the fastest +ML-KEM-768 decapsulate, aws-lc-rs on desktop: 9.02 µs, 1.92× the fastest +ML-KEM-768 decapsulate, aws-lc-rs on nixos2: 16.01 µs, 2.26× the fastest +ML-KEM-768 decapsulate, aws-lc-rs on kixtop: 7.75 µs, 1.91× the fastest +ML-KEM-768 decapsulate, aws-lc-rs on ovh-iad: 28.78 µs, 2.23× the fastest +ML-KEM-768 decapsulate, aws-lc-rs on ovh-sea: 27.57 µs, 2.27× the fastest +ML-KEM-768 decapsulate, RustCrypto + dalek on nixos: 95.17 µs, 15.68× the fastest +ML-KEM-768 decapsulate, RustCrypto + dalek on desktop: 54.19 µs, 11.55× the fastest +ML-KEM-768 decapsulate, RustCrypto + dalek on nixos2: 84.37 µs, 11.93× the fastest +ML-KEM-768 decapsulate, RustCrypto + dalek on kixtop: 34.06 µs, 8.41× the fastest +ML-KEM-768 decapsulate, RustCrypto + dalek on ovh-iad: 148.48 µs, 11.52× the fastest +ML-KEM-768 decapsulate, RustCrypto + dalek on ovh-sea: 130.57 µs, 10.75× the fastest +ML-KEM-768 decapsulate, graviola on nixos: 7.72 µs, 1.27× the fastest +ML-KEM-768 decapsulate, graviola on desktop: 6.59 µs, 1.41× the fastest +ML-KEM-768 decapsulate, graviola on nixos2: 7.42 µs, 1.05× the fastest +ML-KEM-768 decapsulate, graviola on kixtop: 4.05 µs, 1.00× the fastest +ML-KEM-768 decapsulate, libcrux on nixos: 16.22 µs, 2.67× the fastest +ML-KEM-768 decapsulate, libcrux on desktop: 13.44 µs, 2.87× the fastest +ML-KEM-768 decapsulate, libcrux on nixos2: 19.04 µs, 2.69× the fastest +ML-KEM-768 decapsulate, libcrux on kixtop: 9.58 µs, 2.36× the fastest +ML-KEM-768 decapsulate, libcrux on ovh-iad: 35.04 µs, 2.72× the fastest +ML-KEM-768 decapsulate, libcrux on ovh-sea: 33.12 µs, 2.73× the fastest +ML-KEM-768 decapsulate, OpenSSL on nixos: 24.64 µs, 4.06× the fastest +ML-KEM-768 decapsulate, OpenSSL on desktop: 16.05 µs, 3.42× the fastest +ML-KEM-768 decapsulate, OpenSSL on nixos2: 31.67 µs, 4.48× the fastest +ML-KEM-768 decapsulate, OpenSSL on kixtop: 24.43 µs, 6.03× the fastest +ML-KEM-768 decapsulate, OpenSSL on ovh-iad: 49.78 µs, 3.86× the fastest +ML-KEM-768 decapsulate, OpenSSL on ovh-sea: 48.94 µs, 4.03× the fastest P-384 and P-521 - + P-384 ECDH P-384 ECDH, rind on nixos: 179.71 µs, 1.00× the fastest P-384 ECDH, rind on desktop: 100.08 µs, 1.00× the fastest P-384 ECDH, rind on nixos2: 150.97 µs, 1.00× the fastest -P-384 ECDH, rind on ovh-iad: 295.16 µs, 1.00× the fastest -P-384 ECDH, rind on ovh-sea: 264.09 µs, 1.00× the fastest -P-384 ECDH, aws-lc-rs on nixos: 180.49 µs, 1.00× the fastest -P-384 ECDH, aws-lc-rs on desktop: 111.11 µs, 1.11× the fastest -P-384 ECDH, aws-lc-rs on nixos2: 174.62 µs, 1.16× the fastest -P-384 ECDH, aws-lc-rs on ovh-iad: 310.31 µs, 1.05× the fastest -P-384 ECDH, aws-lc-rs on ovh-sea: 291.94 µs, 1.11× the fastest -P-384 ECDH, ring on nixos: 601.49 µs, 3.35× the fastest -P-384 ECDH, ring on desktop: 369.71 µs, 3.69× the fastest -P-384 ECDH, ring on nixos2: 645.54 µs, 4.28× the fastest -P-384 ECDH, ring on ovh-iad: 1.02 ms, 3.45× the fastest -P-384 ECDH, ring on ovh-sea: 980.96 µs, 3.71× the fastest -P-384 ECDH, RustCrypto + dalek on nixos: 1.04 ms, 5.80× the fastest -P-384 ECDH, RustCrypto + dalek on desktop: 401.25 µs, 4.01× the fastest -P-384 ECDH, RustCrypto + dalek on nixos2: 769.61 µs, 5.10× the fastest -P-384 ECDH, RustCrypto + dalek on ovh-iad: 1.23 ms, 4.16× the fastest -P-384 ECDH, RustCrypto + dalek on ovh-sea: 1.20 ms, 4.56× the fastest -P-384 ECDH, graviola on nixos: 302.57 µs, 1.68× the fastest -P-384 ECDH, graviola on desktop: 170.94 µs, 1.71× the fastest -P-384 ECDH, graviola on nixos2: 245.24 µs, 1.62× the fastest -P-384 ECDH, OpenSSL on nixos: 656.67 µs, 3.65× the fastest -P-384 ECDH, OpenSSL on desktop: 264.84 µs, 2.65× the fastest -P-384 ECDH, OpenSSL on nixos2: 483.50 µs, 3.20× the fastest -P-384 ECDH, OpenSSL on ovh-iad: 860.17 µs, 2.91× the fastest -P-384 ECDH, OpenSSL on ovh-sea: 765.55 µs, 2.90× the fastest +P-384 ECDH, rind on kixtop: 91.49 µs, 1.00× the fastest +P-384 ECDH, rind on ovh-iad: 295.16 µs, 1.00× the fastest +P-384 ECDH, rind on ovh-sea: 264.09 µs, 1.00× the fastest +P-384 ECDH, aws-lc-rs on nixos: 180.49 µs, 1.00× the fastest +P-384 ECDH, aws-lc-rs on desktop: 111.11 µs, 1.11× the fastest +P-384 ECDH, aws-lc-rs on nixos2: 174.62 µs, 1.16× the fastest +P-384 ECDH, aws-lc-rs on kixtop: 105.75 µs, 1.16× the fastest +P-384 ECDH, aws-lc-rs on ovh-iad: 310.31 µs, 1.05× the fastest +P-384 ECDH, aws-lc-rs on ovh-sea: 291.94 µs, 1.11× the fastest +P-384 ECDH, ring on nixos: 601.49 µs, 3.35× the fastest +P-384 ECDH, ring on desktop: 369.71 µs, 3.69× the fastest +P-384 ECDH, ring on nixos2: 645.54 µs, 4.28× the fastest +P-384 ECDH, ring on kixtop: 412.48 µs, 4.51× the fastest +P-384 ECDH, ring on ovh-iad: 1.02 ms, 3.45× the fastest +P-384 ECDH, ring on ovh-sea: 980.96 µs, 3.71× the fastest +P-384 ECDH, RustCrypto + dalek on nixos: 1.04 ms, 5.80× the fastest +P-384 ECDH, RustCrypto + dalek on desktop: 401.25 µs, 4.01× the fastest +P-384 ECDH, RustCrypto + dalek on nixos2: 769.61 µs, 5.10× the fastest +P-384 ECDH, RustCrypto + dalek on kixtop: 494.20 µs, 5.40× the fastest +P-384 ECDH, RustCrypto + dalek on ovh-iad: 1.23 ms, 4.16× the fastest +P-384 ECDH, RustCrypto + dalek on ovh-sea: 1.20 ms, 4.56× the fastest +P-384 ECDH, graviola on nixos: 302.57 µs, 1.68× the fastest +P-384 ECDH, graviola on desktop: 170.94 µs, 1.71× the fastest +P-384 ECDH, graviola on nixos2: 245.24 µs, 1.62× the fastest +P-384 ECDH, graviola on kixtop: 153.84 µs, 1.68× the fastest +P-384 ECDH, OpenSSL on nixos: 656.67 µs, 3.65× the fastest +P-384 ECDH, OpenSSL on desktop: 264.84 µs, 2.65× the fastest +P-384 ECDH, OpenSSL on nixos2: 483.50 µs, 3.20× the fastest +P-384 ECDH, OpenSSL on kixtop: 279.51 µs, 3.06× the fastest +P-384 ECDH, OpenSSL on ovh-iad: 860.17 µs, 2.91× the fastest +P-384 ECDH, OpenSSL on ovh-sea: 765.55 µs, 2.90× the fastest P-384 ECDSA sign P-384 ECDSA sign, rind on nixos: 53.07 µs, 1.00× the fastest P-384 ECDSA sign, rind on desktop: 23.53 µs, 1.00× the fastest P-384 ECDSA sign, rind on nixos2: 39.62 µs, 1.00× the fastest -P-384 ECDSA sign, rind on ovh-iad: 71.60 µs, 1.00× the fastest -P-384 ECDSA sign, rind on ovh-sea: 67.08 µs, 1.00× the fastest -P-384 ECDSA sign, aws-lc-rs on nixos: 97.47 µs, 1.84× the fastest -P-384 ECDSA sign, aws-lc-rs on desktop: 46.52 µs, 1.98× the fastest -P-384 ECDSA sign, aws-lc-rs on nixos2: 82.65 µs, 2.09× the fastest -P-384 ECDSA sign, aws-lc-rs on ovh-iad: 127.99 µs, 1.79× the fastest -P-384 ECDSA sign, aws-lc-rs on ovh-sea: 126.33 µs, 1.88× the fastest -P-384 ECDSA sign, ring on nixos: 474.64 µs, 8.94× the fastest -P-384 ECDSA sign, ring on desktop: 200.86 µs, 8.54× the fastest -P-384 ECDSA sign, ring on nixos2: 343.16 µs, 8.66× the fastest -P-384 ECDSA sign, ring on ovh-iad: 549.99 µs, 7.68× the fastest -P-384 ECDSA sign, ring on ovh-sea: 534.87 µs, 7.97× the fastest -P-384 ECDSA sign, RustCrypto + dalek on nixos: 238.31 µs, 4.49× the fastest -P-384 ECDSA sign, RustCrypto + dalek on desktop: 86.86 µs, 3.69× the fastest -P-384 ECDSA sign, RustCrypto + dalek on nixos2: 170.64 µs, 4.31× the fastest -P-384 ECDSA sign, RustCrypto + dalek on ovh-iad: 268.38 µs, 3.75× the fastest -P-384 ECDSA sign, RustCrypto + dalek on ovh-sea: 262.54 µs, 3.91× the fastest -P-384 ECDSA sign, graviola on nixos: 185.15 µs, 3.49× the fastest -P-384 ECDSA sign, graviola on desktop: 90.69 µs, 3.85× the fastest -P-384 ECDSA sign, graviola on nixos2: 128.64 µs, 3.25× the fastest -P-384 ECDSA sign, OpenSSL on nixos: 235.52 µs, 4.44× the fastest -P-384 ECDSA sign, OpenSSL on desktop: 89.64 µs, 3.81× the fastest -P-384 ECDSA sign, OpenSSL on nixos2: 164.53 µs, 4.15× the fastest -P-384 ECDSA sign, OpenSSL on ovh-iad: 272.00 µs, 3.80× the fastest -P-384 ECDSA sign, OpenSSL on ovh-sea: 253.00 µs, 3.77× the fastest +P-384 ECDSA sign, rind on kixtop: 22.93 µs, 1.00× the fastest +P-384 ECDSA sign, rind on ovh-iad: 71.60 µs, 1.00× the fastest +P-384 ECDSA sign, rind on ovh-sea: 67.08 µs, 1.00× the fastest +P-384 ECDSA sign, aws-lc-rs on nixos: 97.47 µs, 1.84× the fastest +P-384 ECDSA sign, aws-lc-rs on desktop: 46.52 µs, 1.98× the fastest +P-384 ECDSA sign, aws-lc-rs on nixos2: 82.65 µs, 2.09× the fastest +P-384 ECDSA sign, aws-lc-rs on kixtop: 49.16 µs, 2.14× the fastest +P-384 ECDSA sign, aws-lc-rs on ovh-iad: 127.99 µs, 1.79× the fastest +P-384 ECDSA sign, aws-lc-rs on ovh-sea: 126.33 µs, 1.88× the fastest +P-384 ECDSA sign, ring on nixos: 474.64 µs, 8.94× the fastest +P-384 ECDSA sign, ring on desktop: 200.86 µs, 8.54× the fastest +P-384 ECDSA sign, ring on nixos2: 343.16 µs, 8.66× the fastest +P-384 ECDSA sign, ring on kixtop: 223.72 µs, 9.76× the fastest +P-384 ECDSA sign, ring on ovh-iad: 549.99 µs, 7.68× the fastest +P-384 ECDSA sign, ring on ovh-sea: 534.87 µs, 7.97× the fastest +P-384 ECDSA sign, RustCrypto + dalek on nixos: 238.31 µs, 4.49× the fastest +P-384 ECDSA sign, RustCrypto + dalek on desktop: 86.86 µs, 3.69× the fastest +P-384 ECDSA sign, RustCrypto + dalek on nixos2: 170.64 µs, 4.31× the fastest +P-384 ECDSA sign, RustCrypto + dalek on kixtop: 112.64 µs, 4.91× the fastest +P-384 ECDSA sign, RustCrypto + dalek on ovh-iad: 268.38 µs, 3.75× the fastest +P-384 ECDSA sign, RustCrypto + dalek on ovh-sea: 262.54 µs, 3.91× the fastest +P-384 ECDSA sign, graviola on nixos: 185.15 µs, 3.49× the fastest +P-384 ECDSA sign, graviola on desktop: 90.69 µs, 3.85× the fastest +P-384 ECDSA sign, graviola on nixos2: 128.64 µs, 3.25× the fastest +P-384 ECDSA sign, graviola on kixtop: 81.12 µs, 3.54× the fastest +P-384 ECDSA sign, OpenSSL on nixos: 235.52 µs, 4.44× the fastest +P-384 ECDSA sign, OpenSSL on desktop: 89.64 µs, 3.81× the fastest +P-384 ECDSA sign, OpenSSL on nixos2: 164.53 µs, 4.15× the fastest +P-384 ECDSA sign, OpenSSL on kixtop: 104.84 µs, 4.57× the fastest +P-384 ECDSA sign, OpenSSL on ovh-iad: 272.00 µs, 3.80× the fastest +P-384 ECDSA sign, OpenSSL on ovh-sea: 253.00 µs, 3.77× the fastest P-384 ECDSA verify P-384 ECDSA verify, rind on nixos: 157.33 µs, 1.00× the fastest P-384 ECDSA verify, rind on desktop: 98.87 µs, 1.00× the fastest P-384 ECDSA verify, rind on nixos2: 141.44 µs, 1.00× the fastest -P-384 ECDSA verify, rind on ovh-iad: 255.43 µs, 1.00× the fastest -P-384 ECDSA verify, rind on ovh-sea: 247.76 µs, 1.00× the fastest -P-384 ECDSA verify, aws-lc-rs on nixos: 199.21 µs, 1.27× the fastest -P-384 ECDSA verify, aws-lc-rs on desktop: 116.66 µs, 1.18× the fastest -P-384 ECDSA verify, aws-lc-rs on nixos2: 175.92 µs, 1.24× the fastest -P-384 ECDSA verify, aws-lc-rs on ovh-iad: 316.06 µs, 1.24× the fastest -P-384 ECDSA verify, aws-lc-rs on ovh-sea: 299.75 µs, 1.21× the fastest -P-384 ECDSA verify, ring on nixos: 727.10 µs, 4.62× the fastest -P-384 ECDSA verify, ring on desktop: 360.29 µs, 3.64× the fastest -P-384 ECDSA verify, ring on nixos2: 622.90 µs, 4.40× the fastest -P-384 ECDSA verify, ring on ovh-iad: 1.00 ms, 3.92× the fastest -P-384 ECDSA verify, ring on ovh-sea: 951.59 µs, 3.84× the fastest -P-384 ECDSA verify, RustCrypto + dalek on nixos: 872.06 µs, 5.54× the fastest -P-384 ECDSA verify, RustCrypto + dalek on desktop: 360.21 µs, 3.64× the fastest -P-384 ECDSA verify, RustCrypto + dalek on nixos2: 695.04 µs, 4.91× the fastest -P-384 ECDSA verify, RustCrypto + dalek on ovh-iad: 1.08 ms, 4.21× the fastest -P-384 ECDSA verify, RustCrypto + dalek on ovh-sea: 1.05 ms, 4.23× the fastest -P-384 ECDSA verify, graviola on nixos: 315.99 µs, 2.01× the fastest -P-384 ECDSA verify, graviola on desktop: 167.40 µs, 1.69× the fastest -P-384 ECDSA verify, graviola on nixos2: 239.41 µs, 1.69× the fastest -P-384 ECDSA verify, OpenSSL on nixos: 551.89 µs, 3.51× the fastest -P-384 ECDSA verify, OpenSSL on desktop: 215.86 µs, 2.18× the fastest -P-384 ECDSA verify, OpenSSL on nixos2: 399.63 µs, 2.83× the fastest -P-384 ECDSA verify, OpenSSL on ovh-iad: 652.34 µs, 2.55× the fastest -P-384 ECDSA verify, OpenSSL on ovh-sea: 612.24 µs, 2.47× the fastest +P-384 ECDSA verify, rind on kixtop: 88.12 µs, 1.00× the fastest +P-384 ECDSA verify, rind on ovh-iad: 255.43 µs, 1.00× the fastest +P-384 ECDSA verify, rind on ovh-sea: 247.76 µs, 1.00× the fastest +P-384 ECDSA verify, aws-lc-rs on nixos: 199.21 µs, 1.27× the fastest +P-384 ECDSA verify, aws-lc-rs on desktop: 116.66 µs, 1.18× the fastest +P-384 ECDSA verify, aws-lc-rs on nixos2: 175.92 µs, 1.24× the fastest +P-384 ECDSA verify, aws-lc-rs on kixtop: 111.27 µs, 1.26× the fastest +P-384 ECDSA verify, aws-lc-rs on ovh-iad: 316.06 µs, 1.24× the fastest +P-384 ECDSA verify, aws-lc-rs on ovh-sea: 299.75 µs, 1.21× the fastest +P-384 ECDSA verify, ring on nixos: 727.10 µs, 4.62× the fastest +P-384 ECDSA verify, ring on desktop: 360.29 µs, 3.64× the fastest +P-384 ECDSA verify, ring on nixos2: 622.90 µs, 4.40× the fastest +P-384 ECDSA verify, ring on kixtop: 396.57 µs, 4.50× the fastest +P-384 ECDSA verify, ring on ovh-iad: 1.00 ms, 3.92× the fastest +P-384 ECDSA verify, ring on ovh-sea: 951.59 µs, 3.84× the fastest +P-384 ECDSA verify, RustCrypto + dalek on nixos: 872.06 µs, 5.54× the fastest +P-384 ECDSA verify, RustCrypto + dalek on desktop: 360.21 µs, 3.64× the fastest +P-384 ECDSA verify, RustCrypto + dalek on nixos2: 695.04 µs, 4.91× the fastest +P-384 ECDSA verify, RustCrypto + dalek on kixtop: 426.43 µs, 4.84× the fastest +P-384 ECDSA verify, RustCrypto + dalek on ovh-iad: 1.08 ms, 4.21× the fastest +P-384 ECDSA verify, RustCrypto + dalek on ovh-sea: 1.05 ms, 4.23× the fastest +P-384 ECDSA verify, graviola on nixos: 315.99 µs, 2.01× the fastest +P-384 ECDSA verify, graviola on desktop: 167.40 µs, 1.69× the fastest +P-384 ECDSA verify, graviola on nixos2: 239.41 µs, 1.69× the fastest +P-384 ECDSA verify, graviola on kixtop: 151.78 µs, 1.72× the fastest +P-384 ECDSA verify, OpenSSL on nixos: 551.89 µs, 3.51× the fastest +P-384 ECDSA verify, OpenSSL on desktop: 215.86 µs, 2.18× the fastest +P-384 ECDSA verify, OpenSSL on nixos2: 399.63 µs, 2.83× the fastest +P-384 ECDSA verify, OpenSSL on kixtop: 238.33 µs, 2.70× the fastest +P-384 ECDSA verify, OpenSSL on ovh-iad: 652.34 µs, 2.55× the fastest +P-384 ECDSA verify, OpenSSL on ovh-sea: 612.24 µs, 2.47× the fastest P-521 ECDH P-521 ECDH, rind on nixos: 283.91 µs, 1.00× the fastest P-521 ECDH, rind on desktop: 160.77 µs, 1.00× the fastest P-521 ECDH, rind on nixos2: 233.76 µs, 1.00× the fastest -P-521 ECDH, rind on ovh-iad: 467.34 µs, 1.00× the fastest -P-521 ECDH, rind on ovh-sea: 442.81 µs, 1.00× the fastest -P-521 ECDH, aws-lc-rs on nixos: 288.17 µs, 1.01× the fastest -P-521 ECDH, aws-lc-rs on desktop: 170.98 µs, 1.06× the fastest -P-521 ECDH, aws-lc-rs on nixos2: 262.34 µs, 1.12× the fastest -P-521 ECDH, aws-lc-rs on ovh-iad: 510.81 µs, 1.09× the fastest -P-521 ECDH, aws-lc-rs on ovh-sea: 479.78 µs, 1.08× the fastest -P-521 ECDH, RustCrypto + dalek on nixos: 868.41 µs, 3.06× the fastest -P-521 ECDH, RustCrypto + dalek on desktop: 431.17 µs, 2.68× the fastest -P-521 ECDH, RustCrypto + dalek on nixos2: 841.50 µs, 3.60× the fastest -P-521 ECDH, RustCrypto + dalek on ovh-iad: 1.39 ms, 2.97× the fastest -P-521 ECDH, RustCrypto + dalek on ovh-sea: 1.19 ms, 2.68× the fastest -P-521 ECDH, OpenSSL on nixos: 505.62 µs, 1.78× the fastest -P-521 ECDH, OpenSSL on desktop: 276.21 µs, 1.72× the fastest -P-521 ECDH, OpenSSL on nixos2: 497.39 µs, 2.13× the fastest -P-521 ECDH, OpenSSL on ovh-iad: 750.80 µs, 1.61× the fastest -P-521 ECDH, OpenSSL on ovh-sea: 722.01 µs, 1.63× the fastest +P-521 ECDH, rind on kixtop: 130.92 µs, 1.00× the fastest +P-521 ECDH, rind on ovh-iad: 467.34 µs, 1.00× the fastest +P-521 ECDH, rind on ovh-sea: 442.81 µs, 1.00× the fastest +P-521 ECDH, aws-lc-rs on nixos: 288.17 µs, 1.01× the fastest +P-521 ECDH, aws-lc-rs on desktop: 170.98 µs, 1.06× the fastest +P-521 ECDH, aws-lc-rs on nixos2: 262.34 µs, 1.12× the fastest +P-521 ECDH, aws-lc-rs on kixtop: 143.20 µs, 1.09× the fastest +P-521 ECDH, aws-lc-rs on ovh-iad: 510.81 µs, 1.09× the fastest +P-521 ECDH, aws-lc-rs on ovh-sea: 479.78 µs, 1.08× the fastest +P-521 ECDH, RustCrypto + dalek on nixos: 868.41 µs, 3.06× the fastest +P-521 ECDH, RustCrypto + dalek on desktop: 431.17 µs, 2.68× the fastest +P-521 ECDH, RustCrypto + dalek on nixos2: 841.50 µs, 3.60× the fastest +P-521 ECDH, RustCrypto + dalek on kixtop: 397.10 µs, 3.03× the fastest +P-521 ECDH, RustCrypto + dalek on ovh-iad: 1.39 ms, 2.97× the fastest +P-521 ECDH, RustCrypto + dalek on ovh-sea: 1.19 ms, 2.68× the fastest +P-521 ECDH, OpenSSL on nixos: 505.62 µs, 1.78× the fastest +P-521 ECDH, OpenSSL on desktop: 276.21 µs, 1.72× the fastest +P-521 ECDH, OpenSSL on nixos2: 497.39 µs, 2.13× the fastest +P-521 ECDH, OpenSSL on kixtop: 247.22 µs, 1.89× the fastest +P-521 ECDH, OpenSSL on ovh-iad: 750.80 µs, 1.61× the fastest +P-521 ECDH, OpenSSL on ovh-sea: 722.01 µs, 1.63× the fastest P-521 ECDSA sign P-521 ECDSA sign, rind on nixos: 58.32 µs, 1.00× the fastest P-521 ECDSA sign, rind on desktop: 40.56 µs, 1.00× the fastest P-521 ECDSA sign, rind on nixos2: 64.26 µs, 1.00× the fastest -P-521 ECDSA sign, rind on ovh-iad: 132.36 µs, 1.00× the fastest -P-521 ECDSA sign, rind on ovh-sea: 116.50 µs, 1.00× the fastest -P-521 ECDSA sign, aws-lc-rs on nixos: 152.35 µs, 2.61× the fastest -P-521 ECDSA sign, aws-lc-rs on desktop: 89.64 µs, 2.21× the fastest -P-521 ECDSA sign, aws-lc-rs on nixos2: 158.67 µs, 2.47× the fastest -P-521 ECDSA sign, aws-lc-rs on ovh-iad: 279.63 µs, 2.11× the fastest -P-521 ECDSA sign, aws-lc-rs on ovh-sea: 256.02 µs, 2.20× the fastest -P-521 ECDSA sign, RustCrypto + dalek on nixos: 177.47 µs, 3.04× the fastest -P-521 ECDSA sign, RustCrypto + dalek on desktop: 95.29 µs, 2.35× the fastest -P-521 ECDSA sign, RustCrypto + dalek on nixos2: 185.93 µs, 2.89× the fastest -P-521 ECDSA sign, RustCrypto + dalek on ovh-iad: 302.65 µs, 2.29× the fastest -P-521 ECDSA sign, RustCrypto + dalek on ovh-sea: 287.24 µs, 2.47× the fastest -P-521 ECDSA sign, OpenSSL on nixos: 219.60 µs, 3.77× the fastest -P-521 ECDSA sign, OpenSSL on desktop: 129.20 µs, 3.19× the fastest -P-521 ECDSA sign, OpenSSL on nixos2: 221.00 µs, 3.44× the fastest -P-521 ECDSA sign, OpenSSL on ovh-iad: 359.52 µs, 2.72× the fastest -P-521 ECDSA sign, OpenSSL on ovh-sea: 344.79 µs, 2.96× the fastest +P-521 ECDSA sign, rind on kixtop: 36.32 µs, 1.00× the fastest +P-521 ECDSA sign, rind on ovh-iad: 132.36 µs, 1.00× the fastest +P-521 ECDSA sign, rind on ovh-sea: 116.50 µs, 1.00× the fastest +P-521 ECDSA sign, aws-lc-rs on nixos: 152.35 µs, 2.61× the fastest +P-521 ECDSA sign, aws-lc-rs on desktop: 89.64 µs, 2.21× the fastest +P-521 ECDSA sign, aws-lc-rs on nixos2: 158.67 µs, 2.47× the fastest +P-521 ECDSA sign, aws-lc-rs on kixtop: 84.33 µs, 2.32× the fastest +P-521 ECDSA sign, aws-lc-rs on ovh-iad: 279.63 µs, 2.11× the fastest +P-521 ECDSA sign, aws-lc-rs on ovh-sea: 256.02 µs, 2.20× the fastest +P-521 ECDSA sign, RustCrypto + dalek on nixos: 177.47 µs, 3.04× the fastest +P-521 ECDSA sign, RustCrypto + dalek on desktop: 95.29 µs, 2.35× the fastest +P-521 ECDSA sign, RustCrypto + dalek on nixos2: 185.93 µs, 2.89× the fastest +P-521 ECDSA sign, RustCrypto + dalek on kixtop: 79.73 µs, 2.20× the fastest +P-521 ECDSA sign, RustCrypto + dalek on ovh-iad: 302.65 µs, 2.29× the fastest +P-521 ECDSA sign, RustCrypto + dalek on ovh-sea: 287.24 µs, 2.47× the fastest +P-521 ECDSA sign, OpenSSL on nixos: 219.60 µs, 3.77× the fastest +P-521 ECDSA sign, OpenSSL on desktop: 129.20 µs, 3.19× the fastest +P-521 ECDSA sign, OpenSSL on nixos2: 221.00 µs, 3.44× the fastest +P-521 ECDSA sign, OpenSSL on kixtop: 132.13 µs, 3.64× the fastest +P-521 ECDSA sign, OpenSSL on ovh-iad: 359.52 µs, 2.72× the fastest +P-521 ECDSA sign, OpenSSL on ovh-sea: 344.79 µs, 2.96× the fastest P-521 ECDSA verify P-521 ECDSA verify, rind on nixos: 222.28 µs, 1.00× the fastest P-521 ECDSA verify, rind on desktop: 147.09 µs, 1.00× the fastest P-521 ECDSA verify, rind on nixos2: 214.43 µs, 1.00× the fastest -P-521 ECDSA verify, rind on ovh-iad: 423.15 µs, 1.00× the fastest -P-521 ECDSA verify, rind on ovh-sea: 402.02 µs, 1.00× the fastest -P-521 ECDSA verify, aws-lc-rs on nixos: 327.35 µs, 1.47× the fastest -P-521 ECDSA verify, aws-lc-rs on desktop: 186.61 µs, 1.27× the fastest -P-521 ECDSA verify, aws-lc-rs on nixos2: 303.23 µs, 1.41× the fastest -P-521 ECDSA verify, aws-lc-rs on ovh-iad: 547.94 µs, 1.29× the fastest -P-521 ECDSA verify, aws-lc-rs on ovh-sea: 519.35 µs, 1.29× the fastest -P-521 ECDSA verify, RustCrypto + dalek on nixos: 610.17 µs, 2.75× the fastest -P-521 ECDSA verify, RustCrypto + dalek on desktop: 359.57 µs, 2.44× the fastest -P-521 ECDSA verify, RustCrypto + dalek on nixos2: 636.37 µs, 2.97× the fastest -P-521 ECDSA verify, RustCrypto + dalek on ovh-iad: 1.01 ms, 2.38× the fastest -P-521 ECDSA verify, RustCrypto + dalek on ovh-sea: 975.40 µs, 2.43× the fastest -P-521 ECDSA verify, OpenSSL on nixos: 473.66 µs, 2.13× the fastest -P-521 ECDSA verify, OpenSSL on desktop: 267.51 µs, 1.82× the fastest -P-521 ECDSA verify, OpenSSL on nixos2: 460.02 µs, 2.15× the fastest -P-521 ECDSA verify, OpenSSL on ovh-iad: 740.33 µs, 1.75× the fastest -P-521 ECDSA verify, OpenSSL on ovh-sea: 699.48 µs, 1.74× the fastest +P-521 ECDSA verify, rind on kixtop: 121.06 µs, 1.00× the fastest +P-521 ECDSA verify, rind on ovh-iad: 423.15 µs, 1.00× the fastest +P-521 ECDSA verify, rind on ovh-sea: 402.02 µs, 1.00× the fastest +P-521 ECDSA verify, aws-lc-rs on nixos: 327.35 µs, 1.47× the fastest +P-521 ECDSA verify, aws-lc-rs on desktop: 186.61 µs, 1.27× the fastest +P-521 ECDSA verify, aws-lc-rs on nixos2: 303.23 µs, 1.41× the fastest +P-521 ECDSA verify, aws-lc-rs on kixtop: 167.21 µs, 1.38× the fastest +P-521 ECDSA verify, aws-lc-rs on ovh-iad: 547.94 µs, 1.29× the fastest +P-521 ECDSA verify, aws-lc-rs on ovh-sea: 519.35 µs, 1.29× the fastest +P-521 ECDSA verify, RustCrypto + dalek on nixos: 610.17 µs, 2.75× the fastest +P-521 ECDSA verify, RustCrypto + dalek on desktop: 359.57 µs, 2.44× the fastest +P-521 ECDSA verify, RustCrypto + dalek on nixos2: 636.37 µs, 2.97× the fastest +P-521 ECDSA verify, RustCrypto + dalek on kixtop: 253.06 µs, 2.09× the fastest +P-521 ECDSA verify, RustCrypto + dalek on ovh-iad: 1.01 ms, 2.38× the fastest +P-521 ECDSA verify, RustCrypto + dalek on ovh-sea: 975.40 µs, 2.43× the fastest +P-521 ECDSA verify, OpenSSL on nixos: 473.66 µs, 2.13× the fastest +P-521 ECDSA verify, OpenSSL on desktop: 267.51 µs, 1.82× the fastest +P-521 ECDSA verify, OpenSSL on nixos2: 460.02 µs, 2.15× the fastest +P-521 ECDSA verify, OpenSSL on kixtop: 254.80 µs, 2.10× the fastest +P-521 ECDSA verify, OpenSSL on ovh-iad: 740.33 µs, 1.75× the fastest +P-521 ECDSA verify, OpenSSL on ovh-sea: 699.48 µs, 1.74× the fastest diff --git a/benchmarks/overview.svg b/benchmarks/overview.svg index 63dc7f38b..e8ef3c9f0 100644 --- a/benchmarks/overview.svg +++ b/benchmarks/overview.svg @@ -1,4 +1,4 @@ - + Time over the fastest library's, by operation, library, and host fastest, or within 10% @@ -16,897 +16,1070 @@ over 8× ✓ verified code -Each cell's squares, left to right: nixos, desktop, nixos2, ovh-iad, ovh-sea. -rind -aws-lc-rs -ring -RustCrypto -+ dalek -graviola -libcrux -OpenSSL +Each cell's squares, left to right: nixos, desktop, nixos2, kixtop, ovh-iad, ovh-sea. +rind +aws-lc-rs +ring +RustCrypto ++ dalek +graviola +libcrux +OpenSSL TLS 1.3 with rustls - + full handshake, X25519MLKEM768 full handshake, X25519MLKEM768, rind on nixos: 260.78 µs, 1.00× the fastest full handshake, X25519MLKEM768, rind on desktop: 174.97 µs, 1.00× the fastest full handshake, X25519MLKEM768, rind on nixos2: 302.43 µs, 1.00× the fastest -full handshake, X25519MLKEM768, rind on ovh-iad: 625.81 µs, 1.00× the fastest -full handshake, X25519MLKEM768, rind on ovh-sea: 580.07 µs, 1.00× the fastest -full handshake, X25519MLKEM768, aws-lc-rs on nixos: 331.87 µs, 1.27× the fastest -full handshake, X25519MLKEM768, aws-lc-rs on desktop: 235.60 µs, 1.35× the fastest -full handshake, X25519MLKEM768, aws-lc-rs on nixos2: 458.06 µs, 1.51× the fastest -full handshake, X25519MLKEM768, aws-lc-rs on ovh-iad: 731.87 µs, 1.17× the fastest -full handshake, X25519MLKEM768, aws-lc-rs on ovh-sea: 697.59 µs, 1.20× the fastest -full handshake, X25519MLKEM768, graviola on nixos: 342.68 µs, 1.31× the fastest -full handshake, X25519MLKEM768, graviola on desktop: 191.49 µs, 1.09× the fastest -full handshake, X25519MLKEM768, graviola on nixos2: 375.57 µs, 1.24× the fastest -full handshake, X25519MLKEM768, OpenSSL on nixos: 802.57 µs, 3.08× the fastest -full handshake, X25519MLKEM768, OpenSSL on desktop: 437.46 µs, 2.50× the fastest -full handshake, X25519MLKEM768, OpenSSL on nixos2: 830.76 µs, 2.75× the fastest -full handshake, X25519MLKEM768, OpenSSL on ovh-iad: 1.39 ms, 2.22× the fastest -full handshake, X25519MLKEM768, OpenSSL on ovh-sea: 1.30 ms, 2.25× the fastest +full handshake, X25519MLKEM768, rind on kixtop: 177.98 µs, 1.00× the fastest +full handshake, X25519MLKEM768, rind on ovh-iad: 625.81 µs, 1.00× the fastest +full handshake, X25519MLKEM768, rind on ovh-sea: 580.07 µs, 1.00× the fastest +full handshake, X25519MLKEM768, aws-lc-rs on nixos: 331.87 µs, 1.27× the fastest +full handshake, X25519MLKEM768, aws-lc-rs on desktop: 235.60 µs, 1.35× the fastest +full handshake, X25519MLKEM768, aws-lc-rs on nixos2: 458.06 µs, 1.51× the fastest +full handshake, X25519MLKEM768, aws-lc-rs on kixtop: 214.67 µs, 1.21× the fastest +full handshake, X25519MLKEM768, aws-lc-rs on ovh-iad: 731.87 µs, 1.17× the fastest +full handshake, X25519MLKEM768, aws-lc-rs on ovh-sea: 697.59 µs, 1.20× the fastest +full handshake, X25519MLKEM768, graviola on nixos: 342.68 µs, 1.31× the fastest +full handshake, X25519MLKEM768, graviola on desktop: 191.49 µs, 1.09× the fastest +full handshake, X25519MLKEM768, graviola on nixos2: 375.57 µs, 1.24× the fastest +full handshake, X25519MLKEM768, graviola on kixtop: 180.42 µs, 1.01× the fastest +full handshake, X25519MLKEM768, OpenSSL on nixos: 802.57 µs, 3.08× the fastest +full handshake, X25519MLKEM768, OpenSSL on desktop: 437.46 µs, 2.50× the fastest +full handshake, X25519MLKEM768, OpenSSL on nixos2: 830.76 µs, 2.75× the fastest +full handshake, X25519MLKEM768, OpenSSL on kixtop: 459.07 µs, 2.58× the fastest +full handshake, X25519MLKEM768, OpenSSL on ovh-iad: 1.39 ms, 2.22× the fastest +full handshake, X25519MLKEM768, OpenSSL on ovh-sea: 1.30 ms, 2.25× the fastest full handshake, X25519 full handshake, X25519, rind on nixos: 227.82 µs, 1.00× the fastest full handshake, X25519, rind on desktop: 152.75 µs, 1.00× the fastest full handshake, X25519, rind on nixos2: 260.02 µs, 1.00× the fastest -full handshake, X25519, rind on ovh-iad: 490.86 µs, 1.00× the fastest -full handshake, X25519, rind on ovh-sea: 450.00 µs, 1.00× the fastest -full handshake, X25519, aws-lc-rs on nixos: 292.13 µs, 1.28× the fastest -full handshake, X25519, aws-lc-rs on desktop: 203.62 µs, 1.33× the fastest -full handshake, X25519, aws-lc-rs on nixos2: 369.74 µs, 1.42× the fastest -full handshake, X25519, aws-lc-rs on ovh-iad: 554.00 µs, 1.13× the fastest -full handshake, X25519, aws-lc-rs on ovh-sea: 517.47 µs, 1.15× the fastest -full handshake, X25519, ring on nixos: 328.46 µs, 1.44× the fastest -full handshake, X25519, ring on desktop: 222.88 µs, 1.46× the fastest -full handshake, X25519, ring on nixos2: 337.91 µs, 1.30× the fastest -full handshake, X25519, ring on ovh-iad: 571.30 µs, 1.16× the fastest -full handshake, X25519, ring on ovh-sea: 526.35 µs, 1.17× the fastest -full handshake, X25519, graviola on nixos: 238.70 µs, 1.05× the fastest -full handshake, X25519, graviola on desktop: 162.55 µs, 1.06× the fastest -full handshake, X25519, graviola on nixos2: 315.73 µs, 1.21× the fastest -full handshake, X25519, OpenSSL on nixos: 574.28 µs, 2.52× the fastest -full handshake, X25519, OpenSSL on desktop: 367.79 µs, 2.41× the fastest -full handshake, X25519, OpenSSL on nixos2: 686.50 µs, 2.64× the fastest -full handshake, X25519, OpenSSL on ovh-iad: 1.19 ms, 2.43× the fastest -full handshake, X25519, OpenSSL on ovh-sea: 1.07 ms, 2.37× the fastest +full handshake, X25519, rind on kixtop: 155.39 µs, 1.00× the fastest +full handshake, X25519, rind on ovh-iad: 490.86 µs, 1.00× the fastest +full handshake, X25519, rind on ovh-sea: 450.00 µs, 1.00× the fastest +full handshake, X25519, aws-lc-rs on nixos: 292.13 µs, 1.28× the fastest +full handshake, X25519, aws-lc-rs on desktop: 203.62 µs, 1.33× the fastest +full handshake, X25519, aws-lc-rs on nixos2: 369.74 µs, 1.42× the fastest +full handshake, X25519, aws-lc-rs on kixtop: 184.86 µs, 1.19× the fastest +full handshake, X25519, aws-lc-rs on ovh-iad: 554.00 µs, 1.13× the fastest +full handshake, X25519, aws-lc-rs on ovh-sea: 517.47 µs, 1.15× the fastest +full handshake, X25519, ring on nixos: 328.46 µs, 1.44× the fastest +full handshake, X25519, ring on desktop: 222.88 µs, 1.46× the fastest +full handshake, X25519, ring on nixos2: 337.91 µs, 1.30× the fastest +full handshake, X25519, ring on kixtop: 184.65 µs, 1.19× the fastest +full handshake, X25519, ring on ovh-iad: 571.30 µs, 1.16× the fastest +full handshake, X25519, ring on ovh-sea: 526.35 µs, 1.17× the fastest +full handshake, X25519, graviola on nixos: 238.70 µs, 1.05× the fastest +full handshake, X25519, graviola on desktop: 162.55 µs, 1.06× the fastest +full handshake, X25519, graviola on nixos2: 315.73 µs, 1.21× the fastest +full handshake, X25519, graviola on kixtop: 159.19 µs, 1.02× the fastest +full handshake, X25519, OpenSSL on nixos: 574.28 µs, 2.52× the fastest +full handshake, X25519, OpenSSL on desktop: 367.79 µs, 2.41× the fastest +full handshake, X25519, OpenSSL on nixos2: 686.50 µs, 2.64× the fastest +full handshake, X25519, OpenSSL on kixtop: 374.65 µs, 2.41× the fastest +full handshake, X25519, OpenSSL on ovh-iad: 1.19 ms, 2.43× the fastest +full handshake, X25519, OpenSSL on ovh-sea: 1.07 ms, 2.37× the fastest full handshake, P-256 full handshake, P-256, rind on nixos: 242.76 µs, 1.00× the fastest full handshake, P-256, rind on desktop: 175.68 µs, 1.00× the fastest full handshake, P-256, rind on nixos2: 295.92 µs, 1.00× the fastest -full handshake, P-256, rind on ovh-iad: 570.01 µs, 1.00× the fastest -full handshake, P-256, rind on ovh-sea: 509.55 µs, 1.00× the fastest -full handshake, P-256, aws-lc-rs on nixos: 304.37 µs, 1.25× the fastest -full handshake, P-256, aws-lc-rs on desktop: 228.85 µs, 1.30× the fastest -full handshake, P-256, aws-lc-rs on nixos2: 417.28 µs, 1.41× the fastest -full handshake, P-256, aws-lc-rs on ovh-iad: 752.60 µs, 1.32× the fastest -full handshake, P-256, aws-lc-rs on ovh-sea: 572.32 µs, 1.12× the fastest -full handshake, P-256, ring on nixos: 281.93 µs, 1.16× the fastest -full handshake, P-256, ring on desktop: 221.72 µs, 1.26× the fastest -full handshake, P-256, ring on nixos2: 327.88 µs, 1.11× the fastest -full handshake, P-256, ring on ovh-iad: 601.35 µs, 1.05× the fastest -full handshake, P-256, ring on ovh-sea: 541.38 µs, 1.06× the fastest -full handshake, P-256, graviola on nixos: 270.05 µs, 1.11× the fastest -full handshake, P-256, graviola on desktop: 193.10 µs, 1.10× the fastest -full handshake, P-256, graviola on nixos2: 368.79 µs, 1.25× the fastest -full handshake, P-256, OpenSSL on nixos: 624.35 µs, 2.57× the fastest -full handshake, P-256, OpenSSL on desktop: 406.49 µs, 2.31× the fastest -full handshake, P-256, OpenSSL on nixos2: 760.04 µs, 2.57× the fastest -full handshake, P-256, OpenSSL on ovh-iad: 1.32 ms, 2.32× the fastest -full handshake, P-256, OpenSSL on ovh-sea: 1.15 ms, 2.26× the fastest +full handshake, P-256, rind on kixtop: 176.20 µs, 1.00× the fastest +full handshake, P-256, rind on ovh-iad: 570.01 µs, 1.00× the fastest +full handshake, P-256, rind on ovh-sea: 509.55 µs, 1.00× the fastest +full handshake, P-256, aws-lc-rs on nixos: 304.37 µs, 1.25× the fastest +full handshake, P-256, aws-lc-rs on desktop: 228.85 µs, 1.30× the fastest +full handshake, P-256, aws-lc-rs on nixos2: 417.28 µs, 1.41× the fastest +full handshake, P-256, aws-lc-rs on kixtop: 206.73 µs, 1.17× the fastest +full handshake, P-256, aws-lc-rs on ovh-iad: 752.60 µs, 1.32× the fastest +full handshake, P-256, aws-lc-rs on ovh-sea: 572.32 µs, 1.12× the fastest +full handshake, P-256, ring on nixos: 281.93 µs, 1.16× the fastest +full handshake, P-256, ring on desktop: 221.72 µs, 1.26× the fastest +full handshake, P-256, ring on nixos2: 327.88 µs, 1.11× the fastest +full handshake, P-256, ring on kixtop: 201.44 µs, 1.14× the fastest +full handshake, P-256, ring on ovh-iad: 601.35 µs, 1.05× the fastest +full handshake, P-256, ring on ovh-sea: 541.38 µs, 1.06× the fastest +full handshake, P-256, graviola on nixos: 270.05 µs, 1.11× the fastest +full handshake, P-256, graviola on desktop: 193.10 µs, 1.10× the fastest +full handshake, P-256, graviola on nixos2: 368.79 µs, 1.25× the fastest +full handshake, P-256, graviola on kixtop: 191.72 µs, 1.09× the fastest +full handshake, P-256, OpenSSL on nixos: 624.35 µs, 2.57× the fastest +full handshake, P-256, OpenSSL on desktop: 406.49 µs, 2.31× the fastest +full handshake, P-256, OpenSSL on nixos2: 760.04 µs, 2.57× the fastest +full handshake, P-256, OpenSSL on kixtop: 400.48 µs, 2.27× the fastest +full handshake, P-256, OpenSSL on ovh-iad: 1.32 ms, 2.32× the fastest +full handshake, P-256, OpenSSL on ovh-sea: 1.15 ms, 2.26× the fastest full handshake, Ed25519 certificate full handshake, Ed25519 certificate, rind on nixos: 186.73 µs, 1.00× the fastest full handshake, Ed25519 certificate, rind on desktop: 123.11 µs, 1.00× the fastest full handshake, Ed25519 certificate, rind on nixos2: 213.12 µs, 1.00× the fastest -full handshake, Ed25519 certificate, rind on ovh-iad: 400.37 µs, 1.00× the fastest -full handshake, Ed25519 certificate, rind on ovh-sea: 379.57 µs, 1.00× the fastest -full handshake, Ed25519 certificate, aws-lc-rs on nixos: 233.43 µs, 1.25× the fastest -full handshake, Ed25519 certificate, aws-lc-rs on desktop: 168.12 µs, 1.37× the fastest -full handshake, Ed25519 certificate, aws-lc-rs on nixos2: 306.11 µs, 1.44× the fastest -full handshake, Ed25519 certificate, aws-lc-rs on ovh-iad: 468.81 µs, 1.17× the fastest -full handshake, Ed25519 certificate, aws-lc-rs on ovh-sea: 437.12 µs, 1.15× the fastest -full handshake, Ed25519 certificate, ring on nixos: 292.96 µs, 1.57× the fastest -full handshake, Ed25519 certificate, ring on desktop: 205.53 µs, 1.67× the fastest -full handshake, Ed25519 certificate, ring on nixos2: 325.29 µs, 1.53× the fastest -full handshake, Ed25519 certificate, ring on ovh-iad: 507.02 µs, 1.27× the fastest -full handshake, Ed25519 certificate, ring on ovh-sea: 477.34 µs, 1.26× the fastest -full handshake, Ed25519 certificate, graviola on nixos: 186.05 µs, 1.00× the fastest -full handshake, Ed25519 certificate, graviola on desktop: 125.46 µs, 1.02× the fastest -full handshake, Ed25519 certificate, graviola on nixos2: 250.28 µs, 1.17× the fastest -full handshake, Ed25519 certificate, OpenSSL on nixos: 640.40 µs, 3.44× the fastest -full handshake, Ed25519 certificate, OpenSSL on desktop: 373.29 µs, 3.03× the fastest -full handshake, Ed25519 certificate, OpenSSL on nixos2: 747.09 µs, 3.51× the fastest -full handshake, Ed25519 certificate, OpenSSL on ovh-iad: 1.22 ms, 3.04× the fastest -full handshake, Ed25519 certificate, OpenSSL on ovh-sea: 1.15 ms, 3.04× the fastest +full handshake, Ed25519 certificate, rind on kixtop: 127.23 µs, 1.03× the fastest +full handshake, Ed25519 certificate, rind on ovh-iad: 400.37 µs, 1.00× the fastest +full handshake, Ed25519 certificate, rind on ovh-sea: 379.57 µs, 1.00× the fastest +full handshake, Ed25519 certificate, aws-lc-rs on nixos: 233.43 µs, 1.25× the fastest +full handshake, Ed25519 certificate, aws-lc-rs on desktop: 168.12 µs, 1.37× the fastest +full handshake, Ed25519 certificate, aws-lc-rs on nixos2: 306.11 µs, 1.44× the fastest +full handshake, Ed25519 certificate, aws-lc-rs on kixtop: 150.93 µs, 1.22× the fastest +full handshake, Ed25519 certificate, aws-lc-rs on ovh-iad: 468.81 µs, 1.17× the fastest +full handshake, Ed25519 certificate, aws-lc-rs on ovh-sea: 437.12 µs, 1.15× the fastest +full handshake, Ed25519 certificate, ring on nixos: 292.96 µs, 1.57× the fastest +full handshake, Ed25519 certificate, ring on desktop: 205.53 µs, 1.67× the fastest +full handshake, Ed25519 certificate, ring on nixos2: 325.29 µs, 1.53× the fastest +full handshake, Ed25519 certificate, ring on kixtop: 155.04 µs, 1.25× the fastest +full handshake, Ed25519 certificate, ring on ovh-iad: 507.02 µs, 1.27× the fastest +full handshake, Ed25519 certificate, ring on ovh-sea: 477.34 µs, 1.26× the fastest +full handshake, Ed25519 certificate, graviola on nixos: 186.05 µs, 1.00× the fastest +full handshake, Ed25519 certificate, graviola on desktop: 125.46 µs, 1.02× the fastest +full handshake, Ed25519 certificate, graviola on nixos2: 250.28 µs, 1.17× the fastest +full handshake, Ed25519 certificate, graviola on kixtop: 124.12 µs, 1.00× the fastest +full handshake, Ed25519 certificate, OpenSSL on nixos: 640.40 µs, 3.44× the fastest +full handshake, Ed25519 certificate, OpenSSL on desktop: 373.29 µs, 3.03× the fastest +full handshake, Ed25519 certificate, OpenSSL on nixos2: 747.09 µs, 3.51× the fastest +full handshake, Ed25519 certificate, OpenSSL on kixtop: 383.83 µs, 3.09× the fastest +full handshake, Ed25519 certificate, OpenSSL on ovh-iad: 1.22 ms, 3.04× the fastest +full handshake, Ed25519 certificate, OpenSSL on ovh-sea: 1.15 ms, 3.04× the fastest full handshake, RSA-2048 certificate full handshake, RSA-2048 certificate, rind on nixos: 550.14 µs, 1.00× the fastest full handshake, RSA-2048 certificate, rind on desktop: 428.67 µs, 1.00× the fastest full handshake, RSA-2048 certificate, rind on nixos2: 613.80 µs, 1.00× the fastest -full handshake, RSA-2048 certificate, rind on ovh-iad: 1.19 ms, 1.00× the fastest -full handshake, RSA-2048 certificate, rind on ovh-sea: 1.09 ms, 1.00× the fastest -full handshake, RSA-2048 certificate, aws-lc-rs on nixos: 646.28 µs, 1.17× the fastest -full handshake, RSA-2048 certificate, aws-lc-rs on desktop: 485.87 µs, 1.13× the fastest -full handshake, RSA-2048 certificate, aws-lc-rs on nixos2: 758.17 µs, 1.24× the fastest -full handshake, RSA-2048 certificate, aws-lc-rs on ovh-iad: 1.26 ms, 1.06× the fastest -full handshake, RSA-2048 certificate, aws-lc-rs on ovh-sea: 1.18 ms, 1.09× the fastest -full handshake, RSA-2048 certificate, ring on nixos: 647.36 µs, 1.18× the fastest -full handshake, RSA-2048 certificate, ring on desktop: 493.81 µs, 1.15× the fastest -full handshake, RSA-2048 certificate, ring on nixos2: 678.16 µs, 1.10× the fastest -full handshake, RSA-2048 certificate, ring on ovh-iad: 1.48 ms, 1.25× the fastest -full handshake, RSA-2048 certificate, ring on ovh-sea: 1.38 ms, 1.27× the fastest -full handshake, RSA-2048 certificate, graviola on nixos: 567.91 µs, 1.03× the fastest -full handshake, RSA-2048 certificate, graviola on desktop: 440.23 µs, 1.03× the fastest -full handshake, RSA-2048 certificate, graviola on nixos2: 687.17 µs, 1.12× the fastest -full handshake, RSA-2048 certificate, OpenSSL on nixos: 992.05 µs, 1.80× the fastest -full handshake, RSA-2048 certificate, OpenSSL on desktop: 682.29 µs, 1.59× the fastest -full handshake, RSA-2048 certificate, OpenSSL on nixos2: 1.01 ms, 1.65× the fastest -full handshake, RSA-2048 certificate, OpenSSL on ovh-iad: 1.89 ms, 1.59× the fastest -full handshake, RSA-2048 certificate, OpenSSL on ovh-sea: 1.76 ms, 1.62× the fastest +full handshake, RSA-2048 certificate, rind on kixtop: 371.35 µs, 1.00× the fastest +full handshake, RSA-2048 certificate, rind on ovh-iad: 1.19 ms, 1.00× the fastest +full handshake, RSA-2048 certificate, rind on ovh-sea: 1.09 ms, 1.00× the fastest +full handshake, RSA-2048 certificate, aws-lc-rs on nixos: 646.28 µs, 1.17× the fastest +full handshake, RSA-2048 certificate, aws-lc-rs on desktop: 485.87 µs, 1.13× the fastest +full handshake, RSA-2048 certificate, aws-lc-rs on nixos2: 758.17 µs, 1.24× the fastest +full handshake, RSA-2048 certificate, aws-lc-rs on kixtop: 406.71 µs, 1.10× the fastest +full handshake, RSA-2048 certificate, aws-lc-rs on ovh-iad: 1.26 ms, 1.06× the fastest +full handshake, RSA-2048 certificate, aws-lc-rs on ovh-sea: 1.18 ms, 1.09× the fastest +full handshake, RSA-2048 certificate, ring on nixos: 647.36 µs, 1.18× the fastest +full handshake, RSA-2048 certificate, ring on desktop: 493.81 µs, 1.15× the fastest +full handshake, RSA-2048 certificate, ring on nixos2: 678.16 µs, 1.10× the fastest +full handshake, RSA-2048 certificate, ring on kixtop: 446.94 µs, 1.20× the fastest +full handshake, RSA-2048 certificate, ring on ovh-iad: 1.48 ms, 1.25× the fastest +full handshake, RSA-2048 certificate, ring on ovh-sea: 1.38 ms, 1.27× the fastest +full handshake, RSA-2048 certificate, graviola on nixos: 567.91 µs, 1.03× the fastest +full handshake, RSA-2048 certificate, graviola on desktop: 440.23 µs, 1.03× the fastest +full handshake, RSA-2048 certificate, graviola on nixos2: 687.17 µs, 1.12× the fastest +full handshake, RSA-2048 certificate, graviola on kixtop: 683.15 µs, 1.84× the fastest +full handshake, RSA-2048 certificate, OpenSSL on nixos: 992.05 µs, 1.80× the fastest +full handshake, RSA-2048 certificate, OpenSSL on desktop: 682.29 µs, 1.59× the fastest +full handshake, RSA-2048 certificate, OpenSSL on nixos2: 1.01 ms, 1.65× the fastest +full handshake, RSA-2048 certificate, OpenSSL on kixtop: 643.30 µs, 1.73× the fastest +full handshake, RSA-2048 certificate, OpenSSL on ovh-iad: 1.89 ms, 1.59× the fastest +full handshake, RSA-2048 certificate, OpenSSL on ovh-sea: 1.76 ms, 1.62× the fastest resumed handshake, X25519 resumed handshake, X25519, rind on nixos: 77.19 µs, 1.00× the fastest resumed handshake, X25519, rind on desktop: 54.19 µs, 1.00× the fastest resumed handshake, X25519, rind on nixos2: 120.95 µs, 1.00× the fastest -resumed handshake, X25519, rind on ovh-iad: 202.07 µs, 1.00× the fastest -resumed handshake, X25519, rind on ovh-sea: 192.78 µs, 1.00× the fastest -resumed handshake, X25519, aws-lc-rs on nixos: 132.67 µs, 1.72× the fastest -resumed handshake, X25519, aws-lc-rs on desktop: 102.84 µs, 1.90× the fastest -resumed handshake, X25519, aws-lc-rs on nixos2: 229.39 µs, 1.90× the fastest -resumed handshake, X25519, aws-lc-rs on ovh-iad: 278.39 µs, 1.38× the fastest -resumed handshake, X25519, aws-lc-rs on ovh-sea: 250.87 µs, 1.30× the fastest -resumed handshake, X25519, ring on nixos: 158.11 µs, 2.05× the fastest -resumed handshake, X25519, ring on desktop: 113.00 µs, 2.09× the fastest -resumed handshake, X25519, ring on nixos2: 199.88 µs, 1.65× the fastest -resumed handshake, X25519, ring on ovh-iad: 287.08 µs, 1.42× the fastest -resumed handshake, X25519, ring on ovh-sea: 266.29 µs, 1.38× the fastest -resumed handshake, X25519, graviola on nixos: 77.33 µs, 1.00× the fastest -resumed handshake, X25519, graviola on desktop: 55.16 µs, 1.02× the fastest -resumed handshake, X25519, graviola on nixos2: 159.71 µs, 1.32× the fastest -resumed handshake, X25519, OpenSSL on nixos: 370.51 µs, 4.80× the fastest -resumed handshake, X25519, OpenSSL on desktop: 231.44 µs, 4.27× the fastest -resumed handshake, X25519, OpenSSL on nixos2: 496.91 µs, 4.11× the fastest -resumed handshake, X25519, OpenSSL on ovh-iad: 746.29 µs, 3.69× the fastest -resumed handshake, X25519, OpenSSL on ovh-sea: 704.86 µs, 3.66× the fastest +resumed handshake, X25519, rind on kixtop: 66.29 µs, 1.07× the fastest +resumed handshake, X25519, rind on ovh-iad: 202.07 µs, 1.00× the fastest +resumed handshake, X25519, rind on ovh-sea: 192.78 µs, 1.00× the fastest +resumed handshake, X25519, aws-lc-rs on nixos: 132.67 µs, 1.72× the fastest +resumed handshake, X25519, aws-lc-rs on desktop: 102.84 µs, 1.90× the fastest +resumed handshake, X25519, aws-lc-rs on nixos2: 229.39 µs, 1.90× the fastest +resumed handshake, X25519, aws-lc-rs on kixtop: 92.46 µs, 1.50× the fastest +resumed handshake, X25519, aws-lc-rs on ovh-iad: 278.39 µs, 1.38× the fastest +resumed handshake, X25519, aws-lc-rs on ovh-sea: 250.87 µs, 1.30× the fastest +resumed handshake, X25519, ring on nixos: 158.11 µs, 2.05× the fastest +resumed handshake, X25519, ring on desktop: 113.00 µs, 2.09× the fastest +resumed handshake, X25519, ring on nixos2: 199.88 µs, 1.65× the fastest +resumed handshake, X25519, ring on kixtop: 88.29 µs, 1.43× the fastest +resumed handshake, X25519, ring on ovh-iad: 287.08 µs, 1.42× the fastest +resumed handshake, X25519, ring on ovh-sea: 266.29 µs, 1.38× the fastest +resumed handshake, X25519, graviola on nixos: 77.33 µs, 1.00× the fastest +resumed handshake, X25519, graviola on desktop: 55.16 µs, 1.02× the fastest +resumed handshake, X25519, graviola on nixos2: 159.71 µs, 1.32× the fastest +resumed handshake, X25519, graviola on kixtop: 61.75 µs, 1.00× the fastest +resumed handshake, X25519, OpenSSL on nixos: 370.51 µs, 4.80× the fastest +resumed handshake, X25519, OpenSSL on desktop: 231.44 µs, 4.27× the fastest +resumed handshake, X25519, OpenSSL on nixos2: 496.91 µs, 4.11× the fastest +resumed handshake, X25519, OpenSSL on kixtop: 255.12 µs, 4.13× the fastest +resumed handshake, X25519, OpenSSL on ovh-iad: 746.29 µs, 3.69× the fastest +resumed handshake, X25519, OpenSSL on ovh-sea: 704.86 µs, 3.66× the fastest 1 MB transfer, AES-128-GCM 1 MB transfer, AES-128-GCM, rind on nixos: 289.43 µs, 1.03× the fastest 1 MB transfer, AES-128-GCM, rind on desktop: 193.36 µs, 1.11× the fastest 1 MB transfer, AES-128-GCM, rind on nixos2: 440.92 µs, 1.00× the fastest -1 MB transfer, AES-128-GCM, rind on ovh-iad: 704.59 µs, 1.01× the fastest -1 MB transfer, AES-128-GCM, rind on ovh-sea: 665.48 µs, 1.00× the fastest -1 MB transfer, AES-128-GCM, aws-lc-rs on nixos: 458.21 µs, 1.62× the fastest -1 MB transfer, AES-128-GCM, aws-lc-rs on desktop: 241.18 µs, 1.38× the fastest -1 MB transfer, AES-128-GCM, aws-lc-rs on nixos2: 442.54 µs, 1.00× the fastest -1 MB transfer, AES-128-GCM, aws-lc-rs on ovh-iad: 700.77 µs, 1.00× the fastest -1 MB transfer, AES-128-GCM, aws-lc-rs on ovh-sea: 677.99 µs, 1.02× the fastest -1 MB transfer, AES-128-GCM, ring on nixos: 282.22 µs, 1.00× the fastest -1 MB transfer, AES-128-GCM, ring on desktop: 174.96 µs, 1.00× the fastest -1 MB transfer, AES-128-GCM, ring on nixos2: 448.76 µs, 1.02× the fastest -1 MB transfer, AES-128-GCM, ring on ovh-iad: 716.03 µs, 1.02× the fastest -1 MB transfer, AES-128-GCM, ring on ovh-sea: 670.85 µs, 1.01× the fastest -1 MB transfer, AES-128-GCM, graviola on nixos: 424.38 µs, 1.50× the fastest -1 MB transfer, AES-128-GCM, graviola on desktop: 294.75 µs, 1.68× the fastest -1 MB transfer, AES-128-GCM, graviola on nixos2: 579.09 µs, 1.31× the fastest -1 MB transfer, AES-128-GCM, OpenSSL on nixos: 469.84 µs, 1.66× the fastest -1 MB transfer, AES-128-GCM, OpenSSL on desktop: 255.72 µs, 1.46× the fastest -1 MB transfer, AES-128-GCM, OpenSSL on nixos2: 491.38 µs, 1.11× the fastest -1 MB transfer, AES-128-GCM, OpenSSL on ovh-iad: 789.03 µs, 1.13× the fastest -1 MB transfer, AES-128-GCM, OpenSSL on ovh-sea: 750.68 µs, 1.13× the fastest +1 MB transfer, AES-128-GCM, rind on kixtop: 308.57 µs, 1.00× the fastest +1 MB transfer, AES-128-GCM, rind on ovh-iad: 704.59 µs, 1.01× the fastest +1 MB transfer, AES-128-GCM, rind on ovh-sea: 665.48 µs, 1.00× the fastest +1 MB transfer, AES-128-GCM, aws-lc-rs on nixos: 458.21 µs, 1.62× the fastest +1 MB transfer, AES-128-GCM, aws-lc-rs on desktop: 241.18 µs, 1.38× the fastest +1 MB transfer, AES-128-GCM, aws-lc-rs on nixos2: 442.54 µs, 1.00× the fastest +1 MB transfer, AES-128-GCM, aws-lc-rs on kixtop: 310.78 µs, 1.01× the fastest +1 MB transfer, AES-128-GCM, aws-lc-rs on ovh-iad: 700.77 µs, 1.00× the fastest +1 MB transfer, AES-128-GCM, aws-lc-rs on ovh-sea: 677.99 µs, 1.02× the fastest +1 MB transfer, AES-128-GCM, ring on nixos: 282.22 µs, 1.00× the fastest +1 MB transfer, AES-128-GCM, ring on desktop: 174.96 µs, 1.00× the fastest +1 MB transfer, AES-128-GCM, ring on nixos2: 448.76 µs, 1.02× the fastest +1 MB transfer, AES-128-GCM, ring on kixtop: 372.59 µs, 1.21× the fastest +1 MB transfer, AES-128-GCM, ring on ovh-iad: 716.03 µs, 1.02× the fastest +1 MB transfer, AES-128-GCM, ring on ovh-sea: 670.85 µs, 1.01× the fastest +1 MB transfer, AES-128-GCM, graviola on nixos: 424.38 µs, 1.50× the fastest +1 MB transfer, AES-128-GCM, graviola on desktop: 294.75 µs, 1.68× the fastest +1 MB transfer, AES-128-GCM, graviola on nixos2: 579.09 µs, 1.31× the fastest +1 MB transfer, AES-128-GCM, graviola on kixtop: 327.11 µs, 1.06× the fastest +1 MB transfer, AES-128-GCM, OpenSSL on nixos: 469.84 µs, 1.66× the fastest +1 MB transfer, AES-128-GCM, OpenSSL on desktop: 255.72 µs, 1.46× the fastest +1 MB transfer, AES-128-GCM, OpenSSL on nixos2: 491.38 µs, 1.11× the fastest +1 MB transfer, AES-128-GCM, OpenSSL on kixtop: 338.35 µs, 1.10× the fastest +1 MB transfer, AES-128-GCM, OpenSSL on ovh-iad: 789.03 µs, 1.13× the fastest +1 MB transfer, AES-128-GCM, OpenSSL on ovh-sea: 750.68 µs, 1.13× the fastest 1 MB transfer, AES-256-GCM 1 MB transfer, AES-256-GCM, rind on nixos: 292.74 µs, 1.01× the fastest 1 MB transfer, AES-256-GCM, rind on desktop: 189.84 µs, 1.00× the fastest 1 MB transfer, AES-256-GCM, rind on nixos2: 544.88 µs, 1.00× the fastest -1 MB transfer, AES-256-GCM, rind on ovh-iad: 960.61 µs, 1.07× the fastest -1 MB transfer, AES-256-GCM, rind on ovh-sea: 845.84 µs, 1.02× the fastest -1 MB transfer, AES-256-GCM, aws-lc-rs on nixos: 461.28 µs, 1.59× the fastest -1 MB transfer, AES-256-GCM, aws-lc-rs on desktop: 272.23 µs, 1.43× the fastest -1 MB transfer, AES-256-GCM, aws-lc-rs on nixos2: 557.86 µs, 1.02× the fastest -1 MB transfer, AES-256-GCM, aws-lc-rs on ovh-iad: 905.72 µs, 1.01× the fastest -1 MB transfer, AES-256-GCM, aws-lc-rs on ovh-sea: 857.11 µs, 1.03× the fastest -1 MB transfer, AES-256-GCM, ring on nixos: 289.90 µs, 1.00× the fastest -1 MB transfer, AES-256-GCM, ring on desktop: 192.15 µs, 1.01× the fastest -1 MB transfer, AES-256-GCM, ring on nixos2: 567.27 µs, 1.04× the fastest -1 MB transfer, AES-256-GCM, ring on ovh-iad: 898.87 µs, 1.00× the fastest -1 MB transfer, AES-256-GCM, ring on ovh-sea: 831.86 µs, 1.00× the fastest -1 MB transfer, AES-256-GCM, graviola on nixos: 490.29 µs, 1.69× the fastest -1 MB transfer, AES-256-GCM, graviola on desktop: 338.97 µs, 1.79× the fastest -1 MB transfer, AES-256-GCM, graviola on nixos2: 691.18 µs, 1.27× the fastest -1 MB transfer, AES-256-GCM, OpenSSL on nixos: 533.20 µs, 1.84× the fastest -1 MB transfer, AES-256-GCM, OpenSSL on desktop: 292.12 µs, 1.54× the fastest -1 MB transfer, AES-256-GCM, OpenSSL on nixos2: 596.82 µs, 1.10× the fastest -1 MB transfer, AES-256-GCM, OpenSSL on ovh-iad: 995.68 µs, 1.11× the fastest -1 MB transfer, AES-256-GCM, OpenSSL on ovh-sea: 936.99 µs, 1.13× the fastest +1 MB transfer, AES-256-GCM, rind on kixtop: 343.96 µs, 1.01× the fastest +1 MB transfer, AES-256-GCM, rind on ovh-iad: 960.61 µs, 1.07× the fastest +1 MB transfer, AES-256-GCM, rind on ovh-sea: 845.84 µs, 1.02× the fastest +1 MB transfer, AES-256-GCM, aws-lc-rs on nixos: 461.28 µs, 1.59× the fastest +1 MB transfer, AES-256-GCM, aws-lc-rs on desktop: 272.23 µs, 1.43× the fastest +1 MB transfer, AES-256-GCM, aws-lc-rs on nixos2: 557.86 µs, 1.02× the fastest +1 MB transfer, AES-256-GCM, aws-lc-rs on kixtop: 341.91 µs, 1.00× the fastest +1 MB transfer, AES-256-GCM, aws-lc-rs on ovh-iad: 905.72 µs, 1.01× the fastest +1 MB transfer, AES-256-GCM, aws-lc-rs on ovh-sea: 857.11 µs, 1.03× the fastest +1 MB transfer, AES-256-GCM, ring on nixos: 289.90 µs, 1.00× the fastest +1 MB transfer, AES-256-GCM, ring on desktop: 192.15 µs, 1.01× the fastest +1 MB transfer, AES-256-GCM, ring on nixos2: 567.27 µs, 1.04× the fastest +1 MB transfer, AES-256-GCM, ring on kixtop: 380.26 µs, 1.11× the fastest +1 MB transfer, AES-256-GCM, ring on ovh-iad: 898.87 µs, 1.00× the fastest +1 MB transfer, AES-256-GCM, ring on ovh-sea: 831.86 µs, 1.00× the fastest +1 MB transfer, AES-256-GCM, graviola on nixos: 490.29 µs, 1.69× the fastest +1 MB transfer, AES-256-GCM, graviola on desktop: 338.97 µs, 1.79× the fastest +1 MB transfer, AES-256-GCM, graviola on nixos2: 691.18 µs, 1.27× the fastest +1 MB transfer, AES-256-GCM, graviola on kixtop: 397.41 µs, 1.16× the fastest +1 MB transfer, AES-256-GCM, OpenSSL on nixos: 533.20 µs, 1.84× the fastest +1 MB transfer, AES-256-GCM, OpenSSL on desktop: 292.12 µs, 1.54× the fastest +1 MB transfer, AES-256-GCM, OpenSSL on nixos2: 596.82 µs, 1.10× the fastest +1 MB transfer, AES-256-GCM, OpenSSL on kixtop: 371.49 µs, 1.09× the fastest +1 MB transfer, AES-256-GCM, OpenSSL on ovh-iad: 995.68 µs, 1.11× the fastest +1 MB transfer, AES-256-GCM, OpenSSL on ovh-sea: 936.99 µs, 1.13× the fastest 1 MB transfer, ChaCha20-Poly1305 1 MB transfer, ChaCha20-Poly1305, rind on nixos: 688.78 µs, 1.00× the fastest 1 MB transfer, ChaCha20-Poly1305, rind on desktop: 621.49 µs, 1.04× the fastest 1 MB transfer, ChaCha20-Poly1305, rind on nixos2: 923.82 µs, 1.00× the fastest -1 MB transfer, ChaCha20-Poly1305, rind on ovh-iad: 1.47 ms, 1.00× the fastest -1 MB transfer, ChaCha20-Poly1305, rind on ovh-sea: 1.44 ms, 1.00× the fastest -1 MB transfer, ChaCha20-Poly1305, aws-lc-rs on nixos: 687.53 µs, 1.00× the fastest -1 MB transfer, ChaCha20-Poly1305, aws-lc-rs on desktop: 609.72 µs, 1.02× the fastest -1 MB transfer, ChaCha20-Poly1305, aws-lc-rs on nixos2: 928.09 µs, 1.00× the fastest -1 MB transfer, ChaCha20-Poly1305, aws-lc-rs on ovh-iad: 1.52 ms, 1.03× the fastest -1 MB transfer, ChaCha20-Poly1305, aws-lc-rs on ovh-sea: 1.43 ms, 1.00× the fastest -1 MB transfer, ChaCha20-Poly1305, ring on nixos: 693.01 µs, 1.01× the fastest -1 MB transfer, ChaCha20-Poly1305, ring on desktop: 594.88 µs, 1.00× the fastest -1 MB transfer, ChaCha20-Poly1305, ring on nixos2: 925.14 µs, 1.00× the fastest -1 MB transfer, ChaCha20-Poly1305, ring on ovh-iad: 1.53 ms, 1.04× the fastest -1 MB transfer, ChaCha20-Poly1305, ring on ovh-sea: 1.45 ms, 1.01× the fastest -1 MB transfer, ChaCha20-Poly1305, graviola on nixos: 1.37 ms, 2.00× the fastest -1 MB transfer, ChaCha20-Poly1305, graviola on desktop: 1.17 ms, 1.97× the fastest -1 MB transfer, ChaCha20-Poly1305, graviola on nixos2: 1.64 ms, 1.78× the fastest -1 MB transfer, ChaCha20-Poly1305, OpenSSL on nixos: 782.98 µs, 1.14× the fastest -1 MB transfer, ChaCha20-Poly1305, OpenSSL on desktop: 661.80 µs, 1.11× the fastest -1 MB transfer, ChaCha20-Poly1305, OpenSSL on nixos2: 983.97 µs, 1.07× the fastest -1 MB transfer, ChaCha20-Poly1305, OpenSSL on ovh-iad: 1.77 ms, 1.20× the fastest -1 MB transfer, ChaCha20-Poly1305, OpenSSL on ovh-sea: 1.71 ms, 1.19× the fastest +1 MB transfer, ChaCha20-Poly1305, rind on kixtop: 1.12 ms, 1.01× the fastest +1 MB transfer, ChaCha20-Poly1305, rind on ovh-iad: 1.47 ms, 1.00× the fastest +1 MB transfer, ChaCha20-Poly1305, rind on ovh-sea: 1.44 ms, 1.00× the fastest +1 MB transfer, ChaCha20-Poly1305, aws-lc-rs on nixos: 687.53 µs, 1.00× the fastest +1 MB transfer, ChaCha20-Poly1305, aws-lc-rs on desktop: 609.72 µs, 1.02× the fastest +1 MB transfer, ChaCha20-Poly1305, aws-lc-rs on nixos2: 928.09 µs, 1.00× the fastest +1 MB transfer, ChaCha20-Poly1305, aws-lc-rs on kixtop: 1.12 ms, 1.01× the fastest +1 MB transfer, ChaCha20-Poly1305, aws-lc-rs on ovh-iad: 1.52 ms, 1.03× the fastest +1 MB transfer, ChaCha20-Poly1305, aws-lc-rs on ovh-sea: 1.43 ms, 1.00× the fastest +1 MB transfer, ChaCha20-Poly1305, ring on nixos: 693.01 µs, 1.01× the fastest +1 MB transfer, ChaCha20-Poly1305, ring on desktop: 594.88 µs, 1.00× the fastest +1 MB transfer, ChaCha20-Poly1305, ring on nixos2: 925.14 µs, 1.00× the fastest +1 MB transfer, ChaCha20-Poly1305, ring on kixtop: 1.11 ms, 1.01× the fastest +1 MB transfer, ChaCha20-Poly1305, ring on ovh-iad: 1.53 ms, 1.04× the fastest +1 MB transfer, ChaCha20-Poly1305, ring on ovh-sea: 1.45 ms, 1.01× the fastest +1 MB transfer, ChaCha20-Poly1305, graviola on nixos: 1.37 ms, 2.00× the fastest +1 MB transfer, ChaCha20-Poly1305, graviola on desktop: 1.17 ms, 1.97× the fastest +1 MB transfer, ChaCha20-Poly1305, graviola on nixos2: 1.64 ms, 1.78× the fastest +1 MB transfer, ChaCha20-Poly1305, graviola on kixtop: 1.79 ms, 1.62× the fastest +1 MB transfer, ChaCha20-Poly1305, OpenSSL on nixos: 782.98 µs, 1.14× the fastest +1 MB transfer, ChaCha20-Poly1305, OpenSSL on desktop: 661.80 µs, 1.11× the fastest +1 MB transfer, ChaCha20-Poly1305, OpenSSL on nixos2: 983.97 µs, 1.07× the fastest +1 MB transfer, ChaCha20-Poly1305, OpenSSL on kixtop: 1.11 ms, 1.00× the fastest +1 MB transfer, ChaCha20-Poly1305, OpenSSL on ovh-iad: 1.77 ms, 1.20× the fastest +1 MB transfer, ChaCha20-Poly1305, OpenSSL on ovh-sea: 1.71 ms, 1.19× the fastest AEADs - + AES-128-GCM seal, 32 B AES-128-GCM seal, 32 B, rind on nixos: 39 ns, 1.00× the fastest AES-128-GCM seal, 32 B, rind on desktop: 18 ns, 1.00× the fastest AES-128-GCM seal, 32 B, rind on nixos2: 43 ns, 1.00× the fastest; verified: rind's Lean proof, through Aeneas and hand models of the function-pointer dispatch, of the AES-NI key expansion and block cipher's raw-pointer loads, and of the SIMD intrinsics as Intel's manual defines them, of its AEAD API's AES-GCM key setup, seal, and open, for AAD and messages under 2^32 bytes, down to HACL*'s Vale AES-GCM routines, composed with Vale's F* proofs of Gcm_blocks_stdcall, Gcm_blocks_decrypt_stdcall, and Compute_iv_stdcall, of the code Vale prints at HACL* f557259007db, which rind imports ✓ -AES-128-GCM seal, 32 B, rind on ovh-iad: 69 ns, 1.00× the fastest; verified: rind's Lean proof, through Aeneas and hand models of the function-pointer dispatch, of the AES-NI key expansion and block cipher's raw-pointer loads, and of the SIMD intrinsics as Intel's manual defines them, of its AEAD API's AES-GCM key setup, seal, and open, for AAD and messages under 2^32 bytes, down to HACL*'s Vale AES-GCM routines, composed with Vale's F* proofs of Gcm_blocks_stdcall, Gcm_blocks_decrypt_stdcall, and Compute_iv_stdcall, of the code Vale prints at HACL* f557259007db, which rind imports -✓ -AES-128-GCM seal, 32 B, rind on ovh-sea: 68 ns, 1.00× the fastest; verified: rind's Lean proof, through Aeneas and hand models of the function-pointer dispatch, of the AES-NI key expansion and block cipher's raw-pointer loads, and of the SIMD intrinsics as Intel's manual defines them, of its AEAD API's AES-GCM key setup, seal, and open, for AAD and messages under 2^32 bytes, down to HACL*'s Vale AES-GCM routines, composed with Vale's F* proofs of Gcm_blocks_stdcall, Gcm_blocks_decrypt_stdcall, and Compute_iv_stdcall, of the code Vale prints at HACL* f557259007db, which rind imports +AES-128-GCM seal, 32 B, rind on kixtop: 57 ns, 2.40× the fastest +AES-128-GCM seal, 32 B, rind on ovh-iad: 69 ns, 1.00× the fastest; verified: rind's Lean proof, through Aeneas and hand models of the function-pointer dispatch, of the AES-NI key expansion and block cipher's raw-pointer loads, and of the SIMD intrinsics as Intel's manual defines them, of its AEAD API's AES-GCM key setup, seal, and open, for AAD and messages under 2^32 bytes, down to HACL*'s Vale AES-GCM routines, composed with Vale's F* proofs of Gcm_blocks_stdcall, Gcm_blocks_decrypt_stdcall, and Compute_iv_stdcall, of the code Vale prints at HACL* f557259007db, which rind imports ✓ -AES-128-GCM seal, 32 B, aws-lc-rs on nixos: 78 ns, 2.02× the fastest -AES-128-GCM seal, 32 B, aws-lc-rs on desktop: 37 ns, 2.03× the fastest -AES-128-GCM seal, 32 B, aws-lc-rs on nixos2: 89 ns, 2.06× the fastest -AES-128-GCM seal, 32 B, aws-lc-rs on ovh-iad: 139 ns, 2.02× the fastest -AES-128-GCM seal, 32 B, aws-lc-rs on ovh-sea: 137 ns, 2.01× the fastest -AES-128-GCM seal, 32 B, ring on nixos: 56 ns, 1.45× the fastest -AES-128-GCM seal, 32 B, ring on desktop: 42 ns, 2.30× the fastest -AES-128-GCM seal, 32 B, ring on nixos2: 71 ns, 1.64× the fastest -AES-128-GCM seal, 32 B, ring on ovh-iad: 111 ns, 1.60× the fastest -AES-128-GCM seal, 32 B, ring on ovh-sea: 109 ns, 1.60× the fastest -AES-128-GCM seal, 32 B, RustCrypto + dalek on nixos: 97 ns, 2.50× the fastest -AES-128-GCM seal, 32 B, RustCrypto + dalek on desktop: 73 ns, 3.98× the fastest -AES-128-GCM seal, 32 B, RustCrypto + dalek on nixos2: 100 ns, 2.33× the fastest -AES-128-GCM seal, 32 B, RustCrypto + dalek on ovh-iad: 158 ns, 2.28× the fastest -AES-128-GCM seal, 32 B, RustCrypto + dalek on ovh-sea: 155 ns, 2.27× the fastest -AES-128-GCM seal, 32 B, graviola on nixos: 70 ns, 1.80× the fastest -AES-128-GCM seal, 32 B, graviola on desktop: 42 ns, 2.33× the fastest -AES-128-GCM seal, 32 B, graviola on nixos2: 71 ns, 1.65× the fastest -AES-128-GCM seal, 32 B, libcrux on nixos: 321 ns, 8.29× the fastest -AES-128-GCM seal, 32 B, libcrux on desktop: 168 ns, 9.19× the fastest -AES-128-GCM seal, 32 B, libcrux on nixos2: 282 ns, 6.52× the fastest -AES-128-GCM seal, 32 B, libcrux on ovh-iad: 454 ns, 6.58× the fastest -AES-128-GCM seal, 32 B, libcrux on ovh-sea: 438 ns, 6.42× the fastest -AES-128-GCM seal, 32 B, OpenSSL on nixos: 115 ns, 2.97× the fastest -AES-128-GCM seal, 32 B, OpenSSL on desktop: 55 ns, 3.02× the fastest -AES-128-GCM seal, 32 B, OpenSSL on nixos2: 156 ns, 3.62× the fastest -AES-128-GCM seal, 32 B, OpenSSL on ovh-iad: 268 ns, 3.89× the fastest -AES-128-GCM seal, 32 B, OpenSSL on ovh-sea: 235 ns, 3.46× the fastest +AES-128-GCM seal, 32 B, rind on ovh-sea: 68 ns, 1.00× the fastest; verified: rind's Lean proof, through Aeneas and hand models of the function-pointer dispatch, of the AES-NI key expansion and block cipher's raw-pointer loads, and of the SIMD intrinsics as Intel's manual defines them, of its AEAD API's AES-GCM key setup, seal, and open, for AAD and messages under 2^32 bytes, down to HACL*'s Vale AES-GCM routines, composed with Vale's F* proofs of Gcm_blocks_stdcall, Gcm_blocks_decrypt_stdcall, and Compute_iv_stdcall, of the code Vale prints at HACL* f557259007db, which rind imports +✓ +AES-128-GCM seal, 32 B, aws-lc-rs on nixos: 78 ns, 2.02× the fastest +AES-128-GCM seal, 32 B, aws-lc-rs on desktop: 37 ns, 2.03× the fastest +AES-128-GCM seal, 32 B, aws-lc-rs on nixos2: 89 ns, 2.06× the fastest +AES-128-GCM seal, 32 B, aws-lc-rs on kixtop: 50 ns, 2.10× the fastest +AES-128-GCM seal, 32 B, aws-lc-rs on ovh-iad: 139 ns, 2.02× the fastest +AES-128-GCM seal, 32 B, aws-lc-rs on ovh-sea: 137 ns, 2.01× the fastest +AES-128-GCM seal, 32 B, ring on nixos: 56 ns, 1.45× the fastest +AES-128-GCM seal, 32 B, ring on desktop: 42 ns, 2.30× the fastest +AES-128-GCM seal, 32 B, ring on nixos2: 71 ns, 1.64× the fastest +AES-128-GCM seal, 32 B, ring on kixtop: 42 ns, 1.77× the fastest +AES-128-GCM seal, 32 B, ring on ovh-iad: 111 ns, 1.60× the fastest +AES-128-GCM seal, 32 B, ring on ovh-sea: 109 ns, 1.60× the fastest +AES-128-GCM seal, 32 B, RustCrypto + dalek on nixos: 97 ns, 2.50× the fastest +AES-128-GCM seal, 32 B, RustCrypto + dalek on desktop: 73 ns, 3.98× the fastest +AES-128-GCM seal, 32 B, RustCrypto + dalek on nixos2: 100 ns, 2.33× the fastest +AES-128-GCM seal, 32 B, RustCrypto + dalek on kixtop: 24 ns, 1.00× the fastest +AES-128-GCM seal, 32 B, RustCrypto + dalek on ovh-iad: 158 ns, 2.28× the fastest +AES-128-GCM seal, 32 B, RustCrypto + dalek on ovh-sea: 155 ns, 2.27× the fastest +AES-128-GCM seal, 32 B, graviola on nixos: 70 ns, 1.80× the fastest +AES-128-GCM seal, 32 B, graviola on desktop: 42 ns, 2.33× the fastest +AES-128-GCM seal, 32 B, graviola on nixos2: 71 ns, 1.65× the fastest +AES-128-GCM seal, 32 B, graviola on kixtop: 80 ns, 3.37× the fastest +AES-128-GCM seal, 32 B, libcrux on nixos: 321 ns, 8.29× the fastest +AES-128-GCM seal, 32 B, libcrux on desktop: 168 ns, 9.19× the fastest +AES-128-GCM seal, 32 B, libcrux on nixos2: 282 ns, 6.52× the fastest +AES-128-GCM seal, 32 B, libcrux on kixtop: 53 ns, 2.23× the fastest +AES-128-GCM seal, 32 B, libcrux on ovh-iad: 454 ns, 6.58× the fastest +AES-128-GCM seal, 32 B, libcrux on ovh-sea: 438 ns, 6.42× the fastest +AES-128-GCM seal, 32 B, OpenSSL on nixos: 115 ns, 2.97× the fastest +AES-128-GCM seal, 32 B, OpenSSL on desktop: 55 ns, 3.02× the fastest +AES-128-GCM seal, 32 B, OpenSSL on nixos2: 156 ns, 3.62× the fastest +AES-128-GCM seal, 32 B, OpenSSL on kixtop: 69 ns, 2.91× the fastest +AES-128-GCM seal, 32 B, OpenSSL on ovh-iad: 268 ns, 3.89× the fastest +AES-128-GCM seal, 32 B, OpenSSL on ovh-sea: 235 ns, 3.46× the fastest AES-128-GCM seal, 1350 B AES-128-GCM seal, 1350 B, rind on nixos: 165 ns, 1.00× the fastest AES-128-GCM seal, 1350 B, rind on desktop: 94 ns, 1.00× the fastest AES-128-GCM seal, 1350 B, rind on nixos2: 246 ns, 1.00× the fastest; verified: rind's Lean proof, through Aeneas and hand models of the function-pointer dispatch, of the AES-NI key expansion and block cipher's raw-pointer loads, and of the SIMD intrinsics as Intel's manual defines them, of its AEAD API's AES-GCM key setup, seal, and open, for AAD and messages under 2^32 bytes, down to HACL*'s Vale AES-GCM routines, composed with Vale's F* proofs of Gcm_blocks_stdcall, Gcm_blocks_decrypt_stdcall, and Compute_iv_stdcall, of the code Vale prints at HACL* f557259007db, which rind imports ✓ -AES-128-GCM seal, 1350 B, rind on ovh-iad: 398 ns, 1.00× the fastest; verified: rind's Lean proof, through Aeneas and hand models of the function-pointer dispatch, of the AES-NI key expansion and block cipher's raw-pointer loads, and of the SIMD intrinsics as Intel's manual defines them, of its AEAD API's AES-GCM key setup, seal, and open, for AAD and messages under 2^32 bytes, down to HACL*'s Vale AES-GCM routines, composed with Vale's F* proofs of Gcm_blocks_stdcall, Gcm_blocks_decrypt_stdcall, and Compute_iv_stdcall, of the code Vale prints at HACL* f557259007db, which rind imports -✓ -AES-128-GCM seal, 1350 B, rind on ovh-sea: 380 ns, 1.00× the fastest; verified: rind's Lean proof, through Aeneas and hand models of the function-pointer dispatch, of the AES-NI key expansion and block cipher's raw-pointer loads, and of the SIMD intrinsics as Intel's manual defines them, of its AEAD API's AES-GCM key setup, seal, and open, for AAD and messages under 2^32 bytes, down to HACL*'s Vale AES-GCM routines, composed with Vale's F* proofs of Gcm_blocks_stdcall, Gcm_blocks_decrypt_stdcall, and Compute_iv_stdcall, of the code Vale prints at HACL* f557259007db, which rind imports +AES-128-GCM seal, 1350 B, rind on kixtop: 212 ns, 1.18× the fastest +AES-128-GCM seal, 1350 B, rind on ovh-iad: 398 ns, 1.00× the fastest; verified: rind's Lean proof, through Aeneas and hand models of the function-pointer dispatch, of the AES-NI key expansion and block cipher's raw-pointer loads, and of the SIMD intrinsics as Intel's manual defines them, of its AEAD API's AES-GCM key setup, seal, and open, for AAD and messages under 2^32 bytes, down to HACL*'s Vale AES-GCM routines, composed with Vale's F* proofs of Gcm_blocks_stdcall, Gcm_blocks_decrypt_stdcall, and Compute_iv_stdcall, of the code Vale prints at HACL* f557259007db, which rind imports ✓ -AES-128-GCM seal, 1350 B, aws-lc-rs on nixos: 291 ns, 1.77× the fastest -AES-128-GCM seal, 1350 B, aws-lc-rs on desktop: 149 ns, 1.59× the fastest -AES-128-GCM seal, 1350 B, aws-lc-rs on nixos2: 285 ns, 1.16× the fastest -AES-128-GCM seal, 1350 B, aws-lc-rs on ovh-iad: 460 ns, 1.15× the fastest -AES-128-GCM seal, 1350 B, aws-lc-rs on ovh-sea: 439 ns, 1.15× the fastest -AES-128-GCM seal, 1350 B, ring on nixos: 191 ns, 1.16× the fastest -AES-128-GCM seal, 1350 B, ring on desktop: 118 ns, 1.26× the fastest -AES-128-GCM seal, 1350 B, ring on nixos2: 277 ns, 1.13× the fastest -AES-128-GCM seal, 1350 B, ring on ovh-iad: 475 ns, 1.19× the fastest -AES-128-GCM seal, 1350 B, ring on ovh-sea: 438 ns, 1.15× the fastest -AES-128-GCM seal, 1350 B, RustCrypto + dalek on nixos: 434 ns, 2.63× the fastest -AES-128-GCM seal, 1350 B, RustCrypto + dalek on desktop: 272 ns, 2.90× the fastest -AES-128-GCM seal, 1350 B, RustCrypto + dalek on nixos2: 547 ns, 2.22× the fastest -AES-128-GCM seal, 1350 B, RustCrypto + dalek on ovh-iad: 871 ns, 2.19× the fastest -AES-128-GCM seal, 1350 B, RustCrypto + dalek on ovh-sea: 846 ns, 2.23× the fastest -AES-128-GCM seal, 1350 B, graviola on nixos: 295 ns, 1.79× the fastest -AES-128-GCM seal, 1350 B, graviola on desktop: 227 ns, 2.42× the fastest -AES-128-GCM seal, 1350 B, graviola on nixos2: 400 ns, 1.63× the fastest -AES-128-GCM seal, 1350 B, libcrux on nixos: 4.72 µs, 28.63× the fastest -AES-128-GCM seal, 1350 B, libcrux on desktop: 1.94 µs, 20.74× the fastest -AES-128-GCM seal, 1350 B, libcrux on nixos2: 3.49 µs, 14.19× the fastest -AES-128-GCM seal, 1350 B, libcrux on ovh-iad: 5.46 µs, 13.70× the fastest -AES-128-GCM seal, 1350 B, libcrux on ovh-sea: 5.29 µs, 13.92× the fastest -AES-128-GCM seal, 1350 B, OpenSSL on nixos: 326 ns, 1.98× the fastest -AES-128-GCM seal, 1350 B, OpenSSL on desktop: 163 ns, 1.74× the fastest -AES-128-GCM seal, 1350 B, OpenSSL on nixos2: 352 ns, 1.43× the fastest -AES-128-GCM seal, 1350 B, OpenSSL on ovh-iad: 561 ns, 1.41× the fastest -AES-128-GCM seal, 1350 B, OpenSSL on ovh-sea: 534 ns, 1.41× the fastest +AES-128-GCM seal, 1350 B, rind on ovh-sea: 380 ns, 1.00× the fastest; verified: rind's Lean proof, through Aeneas and hand models of the function-pointer dispatch, of the AES-NI key expansion and block cipher's raw-pointer loads, and of the SIMD intrinsics as Intel's manual defines them, of its AEAD API's AES-GCM key setup, seal, and open, for AAD and messages under 2^32 bytes, down to HACL*'s Vale AES-GCM routines, composed with Vale's F* proofs of Gcm_blocks_stdcall, Gcm_blocks_decrypt_stdcall, and Compute_iv_stdcall, of the code Vale prints at HACL* f557259007db, which rind imports +✓ +AES-128-GCM seal, 1350 B, aws-lc-rs on nixos: 291 ns, 1.77× the fastest +AES-128-GCM seal, 1350 B, aws-lc-rs on desktop: 149 ns, 1.59× the fastest +AES-128-GCM seal, 1350 B, aws-lc-rs on nixos2: 285 ns, 1.16× the fastest +AES-128-GCM seal, 1350 B, aws-lc-rs on kixtop: 180 ns, 1.00× the fastest +AES-128-GCM seal, 1350 B, aws-lc-rs on ovh-iad: 460 ns, 1.15× the fastest +AES-128-GCM seal, 1350 B, aws-lc-rs on ovh-sea: 439 ns, 1.15× the fastest +AES-128-GCM seal, 1350 B, ring on nixos: 191 ns, 1.16× the fastest +AES-128-GCM seal, 1350 B, ring on desktop: 118 ns, 1.26× the fastest +AES-128-GCM seal, 1350 B, ring on nixos2: 277 ns, 1.13× the fastest +AES-128-GCM seal, 1350 B, ring on kixtop: 212 ns, 1.18× the fastest +AES-128-GCM seal, 1350 B, ring on ovh-iad: 475 ns, 1.19× the fastest +AES-128-GCM seal, 1350 B, ring on ovh-sea: 438 ns, 1.15× the fastest +AES-128-GCM seal, 1350 B, RustCrypto + dalek on nixos: 434 ns, 2.63× the fastest +AES-128-GCM seal, 1350 B, RustCrypto + dalek on desktop: 272 ns, 2.90× the fastest +AES-128-GCM seal, 1350 B, RustCrypto + dalek on nixos2: 547 ns, 2.22× the fastest +AES-128-GCM seal, 1350 B, RustCrypto + dalek on kixtop: 213 ns, 1.18× the fastest +AES-128-GCM seal, 1350 B, RustCrypto + dalek on ovh-iad: 871 ns, 2.19× the fastest +AES-128-GCM seal, 1350 B, RustCrypto + dalek on ovh-sea: 846 ns, 2.23× the fastest +AES-128-GCM seal, 1350 B, graviola on nixos: 295 ns, 1.79× the fastest +AES-128-GCM seal, 1350 B, graviola on desktop: 227 ns, 2.42× the fastest +AES-128-GCM seal, 1350 B, graviola on nixos2: 400 ns, 1.63× the fastest +AES-128-GCM seal, 1350 B, graviola on kixtop: 215 ns, 1.20× the fastest +AES-128-GCM seal, 1350 B, libcrux on nixos: 4.72 µs, 28.63× the fastest +AES-128-GCM seal, 1350 B, libcrux on desktop: 1.94 µs, 20.74× the fastest +AES-128-GCM seal, 1350 B, libcrux on nixos2: 3.49 µs, 14.19× the fastest +AES-128-GCM seal, 1350 B, libcrux on kixtop: 619 ns, 3.44× the fastest +AES-128-GCM seal, 1350 B, libcrux on ovh-iad: 5.46 µs, 13.70× the fastest +AES-128-GCM seal, 1350 B, libcrux on ovh-sea: 5.29 µs, 13.92× the fastest +AES-128-GCM seal, 1350 B, OpenSSL on nixos: 326 ns, 1.98× the fastest +AES-128-GCM seal, 1350 B, OpenSSL on desktop: 163 ns, 1.74× the fastest +AES-128-GCM seal, 1350 B, OpenSSL on nixos2: 352 ns, 1.43× the fastest +AES-128-GCM seal, 1350 B, OpenSSL on kixtop: 197 ns, 1.09× the fastest +AES-128-GCM seal, 1350 B, OpenSSL on ovh-iad: 561 ns, 1.41× the fastest +AES-128-GCM seal, 1350 B, OpenSSL on ovh-sea: 534 ns, 1.41× the fastest AES-128-GCM seal, 16 KB AES-128-GCM seal, 16 KB, rind on nixos: 1.38 µs, 1.00× the fastest AES-128-GCM seal, 16 KB, rind on desktop: 781 ns, 1.00× the fastest AES-128-GCM seal, 16 KB, rind on nixos2: 2.33 µs, 1.00× the fastest; verified: rind's Lean proof, through Aeneas and hand models of the function-pointer dispatch, of the AES-NI key expansion and block cipher's raw-pointer loads, and of the SIMD intrinsics as Intel's manual defines them, of its AEAD API's AES-GCM key setup, seal, and open, for AAD and messages under 2^32 bytes, down to HACL*'s Vale AES-GCM routines, composed with Vale's F* proofs of Gcm_blocks_stdcall, Gcm_blocks_decrypt_stdcall, and Compute_iv_stdcall, of the code Vale prints at HACL* f557259007db, which rind imports ✓ -AES-128-GCM seal, 16 KB, rind on ovh-iad: 3.83 µs, 1.01× the fastest; verified: rind's Lean proof, through Aeneas and hand models of the function-pointer dispatch, of the AES-NI key expansion and block cipher's raw-pointer loads, and of the SIMD intrinsics as Intel's manual defines them, of its AEAD API's AES-GCM key setup, seal, and open, for AAD and messages under 2^32 bytes, down to HACL*'s Vale AES-GCM routines, composed with Vale's F* proofs of Gcm_blocks_stdcall, Gcm_blocks_decrypt_stdcall, and Compute_iv_stdcall, of the code Vale prints at HACL* f557259007db, which rind imports -✓ -AES-128-GCM seal, 16 KB, rind on ovh-sea: 3.67 µs, 1.02× the fastest; verified: rind's Lean proof, through Aeneas and hand models of the function-pointer dispatch, of the AES-NI key expansion and block cipher's raw-pointer loads, and of the SIMD intrinsics as Intel's manual defines them, of its AEAD API's AES-GCM key setup, seal, and open, for AAD and messages under 2^32 bytes, down to HACL*'s Vale AES-GCM routines, composed with Vale's F* proofs of Gcm_blocks_stdcall, Gcm_blocks_decrypt_stdcall, and Compute_iv_stdcall, of the code Vale prints at HACL* f557259007db, which rind imports +AES-128-GCM seal, 16 KB, rind on kixtop: 1.49 µs, 1.03× the fastest +AES-128-GCM seal, 16 KB, rind on ovh-iad: 3.83 µs, 1.01× the fastest; verified: rind's Lean proof, through Aeneas and hand models of the function-pointer dispatch, of the AES-NI key expansion and block cipher's raw-pointer loads, and of the SIMD intrinsics as Intel's manual defines them, of its AEAD API's AES-GCM key setup, seal, and open, for AAD and messages under 2^32 bytes, down to HACL*'s Vale AES-GCM routines, composed with Vale's F* proofs of Gcm_blocks_stdcall, Gcm_blocks_decrypt_stdcall, and Compute_iv_stdcall, of the code Vale prints at HACL* f557259007db, which rind imports ✓ -AES-128-GCM seal, 16 KB, aws-lc-rs on nixos: 2.63 µs, 1.91× the fastest -AES-128-GCM seal, 16 KB, aws-lc-rs on desktop: 1.33 µs, 1.70× the fastest -AES-128-GCM seal, 16 KB, aws-lc-rs on nixos2: 2.42 µs, 1.04× the fastest -AES-128-GCM seal, 16 KB, aws-lc-rs on ovh-iad: 3.79 µs, 1.00× the fastest -AES-128-GCM seal, 16 KB, aws-lc-rs on ovh-sea: 3.70 µs, 1.02× the fastest -AES-128-GCM seal, 16 KB, ring on nixos: 1.39 µs, 1.01× the fastest -AES-128-GCM seal, 16 KB, ring on desktop: 799 ns, 1.02× the fastest -AES-128-GCM seal, 16 KB, ring on nixos2: 2.38 µs, 1.02× the fastest -AES-128-GCM seal, 16 KB, ring on ovh-iad: 3.89 µs, 1.03× the fastest -AES-128-GCM seal, 16 KB, ring on ovh-sea: 3.61 µs, 1.00× the fastest -AES-128-GCM seal, 16 KB, RustCrypto + dalek on nixos: 4.28 µs, 3.10× the fastest -AES-128-GCM seal, 16 KB, RustCrypto + dalek on desktop: 2.49 µs, 3.19× the fastest -AES-128-GCM seal, 16 KB, RustCrypto + dalek on nixos2: 5.62 µs, 2.41× the fastest -AES-128-GCM seal, 16 KB, RustCrypto + dalek on ovh-iad: 8.86 µs, 2.34× the fastest -AES-128-GCM seal, 16 KB, RustCrypto + dalek on ovh-sea: 8.62 µs, 2.39× the fastest -AES-128-GCM seal, 16 KB, graviola on nixos: 2.57 µs, 1.86× the fastest -AES-128-GCM seal, 16 KB, graviola on desktop: 2.02 µs, 2.59× the fastest -AES-128-GCM seal, 16 KB, graviola on nixos2: 3.75 µs, 1.61× the fastest -AES-128-GCM seal, 16 KB, libcrux on nixos: 53.90 µs, 39.11× the fastest -AES-128-GCM seal, 16 KB, libcrux on desktop: 22.02 µs, 28.20× the fastest -AES-128-GCM seal, 16 KB, libcrux on nixos2: 39.94 µs, 17.11× the fastest -AES-128-GCM seal, 16 KB, libcrux on ovh-iad: 61.68 µs, 16.28× the fastest -AES-128-GCM seal, 16 KB, libcrux on ovh-sea: 60.59 µs, 16.80× the fastest -AES-128-GCM seal, 16 KB, OpenSSL on nixos: 2.61 µs, 1.89× the fastest -AES-128-GCM seal, 16 KB, OpenSSL on desktop: 1.34 µs, 1.72× the fastest -AES-128-GCM seal, 16 KB, OpenSSL on nixos2: 2.45 µs, 1.05× the fastest -AES-128-GCM seal, 16 KB, OpenSSL on ovh-iad: 4.17 µs, 1.10× the fastest -AES-128-GCM seal, 16 KB, OpenSSL on ovh-sea: 3.84 µs, 1.06× the fastest +AES-128-GCM seal, 16 KB, rind on ovh-sea: 3.67 µs, 1.02× the fastest; verified: rind's Lean proof, through Aeneas and hand models of the function-pointer dispatch, of the AES-NI key expansion and block cipher's raw-pointer loads, and of the SIMD intrinsics as Intel's manual defines them, of its AEAD API's AES-GCM key setup, seal, and open, for AAD and messages under 2^32 bytes, down to HACL*'s Vale AES-GCM routines, composed with Vale's F* proofs of Gcm_blocks_stdcall, Gcm_blocks_decrypt_stdcall, and Compute_iv_stdcall, of the code Vale prints at HACL* f557259007db, which rind imports +✓ +AES-128-GCM seal, 16 KB, aws-lc-rs on nixos: 2.63 µs, 1.91× the fastest +AES-128-GCM seal, 16 KB, aws-lc-rs on desktop: 1.33 µs, 1.70× the fastest +AES-128-GCM seal, 16 KB, aws-lc-rs on nixos2: 2.42 µs, 1.04× the fastest +AES-128-GCM seal, 16 KB, aws-lc-rs on kixtop: 1.45 µs, 1.00× the fastest +AES-128-GCM seal, 16 KB, aws-lc-rs on ovh-iad: 3.79 µs, 1.00× the fastest +AES-128-GCM seal, 16 KB, aws-lc-rs on ovh-sea: 3.70 µs, 1.02× the fastest +AES-128-GCM seal, 16 KB, ring on nixos: 1.39 µs, 1.01× the fastest +AES-128-GCM seal, 16 KB, ring on desktop: 799 ns, 1.02× the fastest +AES-128-GCM seal, 16 KB, ring on nixos2: 2.38 µs, 1.02× the fastest +AES-128-GCM seal, 16 KB, ring on kixtop: 1.97 µs, 1.35× the fastest +AES-128-GCM seal, 16 KB, ring on ovh-iad: 3.89 µs, 1.03× the fastest +AES-128-GCM seal, 16 KB, ring on ovh-sea: 3.61 µs, 1.00× the fastest +AES-128-GCM seal, 16 KB, RustCrypto + dalek on nixos: 4.28 µs, 3.10× the fastest +AES-128-GCM seal, 16 KB, RustCrypto + dalek on desktop: 2.49 µs, 3.19× the fastest +AES-128-GCM seal, 16 KB, RustCrypto + dalek on nixos2: 5.62 µs, 2.41× the fastest +AES-128-GCM seal, 16 KB, RustCrypto + dalek on kixtop: 2.36 µs, 1.62× the fastest +AES-128-GCM seal, 16 KB, RustCrypto + dalek on ovh-iad: 8.86 µs, 2.34× the fastest +AES-128-GCM seal, 16 KB, RustCrypto + dalek on ovh-sea: 8.62 µs, 2.39× the fastest +AES-128-GCM seal, 16 KB, graviola on nixos: 2.57 µs, 1.86× the fastest +AES-128-GCM seal, 16 KB, graviola on desktop: 2.02 µs, 2.59× the fastest +AES-128-GCM seal, 16 KB, graviola on nixos2: 3.75 µs, 1.61× the fastest +AES-128-GCM seal, 16 KB, graviola on kixtop: 1.60 µs, 1.10× the fastest +AES-128-GCM seal, 16 KB, libcrux on nixos: 53.90 µs, 39.11× the fastest +AES-128-GCM seal, 16 KB, libcrux on desktop: 22.02 µs, 28.20× the fastest +AES-128-GCM seal, 16 KB, libcrux on nixos2: 39.94 µs, 17.11× the fastest +AES-128-GCM seal, 16 KB, libcrux on kixtop: 7.15 µs, 4.92× the fastest +AES-128-GCM seal, 16 KB, libcrux on ovh-iad: 61.68 µs, 16.28× the fastest +AES-128-GCM seal, 16 KB, libcrux on ovh-sea: 60.59 µs, 16.80× the fastest +AES-128-GCM seal, 16 KB, OpenSSL on nixos: 2.61 µs, 1.89× the fastest +AES-128-GCM seal, 16 KB, OpenSSL on desktop: 1.34 µs, 1.72× the fastest +AES-128-GCM seal, 16 KB, OpenSSL on nixos2: 2.45 µs, 1.05× the fastest +AES-128-GCM seal, 16 KB, OpenSSL on kixtop: 1.52 µs, 1.04× the fastest +AES-128-GCM seal, 16 KB, OpenSSL on ovh-iad: 4.17 µs, 1.10× the fastest +AES-128-GCM seal, 16 KB, OpenSSL on ovh-sea: 3.84 µs, 1.06× the fastest AES-128-GCM open, 32 B AES-128-GCM open, 32 B, rind on nixos: 44 ns, 1.00× the fastest AES-128-GCM open, 32 B, rind on desktop: 28 ns, 1.00× the fastest AES-128-GCM open, 32 B, rind on nixos2: 38 ns, 1.00× the fastest; verified: rind's Lean proof, through Aeneas and hand models of the function-pointer dispatch, of the AES-NI key expansion and block cipher's raw-pointer loads, and of the SIMD intrinsics as Intel's manual defines them, of its AEAD API's AES-GCM key setup, seal, and open, for AAD and messages under 2^32 bytes, down to HACL*'s Vale AES-GCM routines, composed with Vale's F* proofs of Gcm_blocks_stdcall, Gcm_blocks_decrypt_stdcall, and Compute_iv_stdcall, of the code Vale prints at HACL* f557259007db, which rind imports ✓ -AES-128-GCM open, 32 B, rind on ovh-iad: 62 ns, 1.00× the fastest; verified: rind's Lean proof, through Aeneas and hand models of the function-pointer dispatch, of the AES-NI key expansion and block cipher's raw-pointer loads, and of the SIMD intrinsics as Intel's manual defines them, of its AEAD API's AES-GCM key setup, seal, and open, for AAD and messages under 2^32 bytes, down to HACL*'s Vale AES-GCM routines, composed with Vale's F* proofs of Gcm_blocks_stdcall, Gcm_blocks_decrypt_stdcall, and Compute_iv_stdcall, of the code Vale prints at HACL* f557259007db, which rind imports -✓ -AES-128-GCM open, 32 B, rind on ovh-sea: 60 ns, 1.00× the fastest; verified: rind's Lean proof, through Aeneas and hand models of the function-pointer dispatch, of the AES-NI key expansion and block cipher's raw-pointer loads, and of the SIMD intrinsics as Intel's manual defines them, of its AEAD API's AES-GCM key setup, seal, and open, for AAD and messages under 2^32 bytes, down to HACL*'s Vale AES-GCM routines, composed with Vale's F* proofs of Gcm_blocks_stdcall, Gcm_blocks_decrypt_stdcall, and Compute_iv_stdcall, of the code Vale prints at HACL* f557259007db, which rind imports +AES-128-GCM open, 32 B, rind on kixtop: 47 ns, 1.71× the fastest +AES-128-GCM open, 32 B, rind on ovh-iad: 62 ns, 1.00× the fastest; verified: rind's Lean proof, through Aeneas and hand models of the function-pointer dispatch, of the AES-NI key expansion and block cipher's raw-pointer loads, and of the SIMD intrinsics as Intel's manual defines them, of its AEAD API's AES-GCM key setup, seal, and open, for AAD and messages under 2^32 bytes, down to HACL*'s Vale AES-GCM routines, composed with Vale's F* proofs of Gcm_blocks_stdcall, Gcm_blocks_decrypt_stdcall, and Compute_iv_stdcall, of the code Vale prints at HACL* f557259007db, which rind imports ✓ -AES-128-GCM open, 32 B, aws-lc-rs on nixos: 72 ns, 1.63× the fastest -AES-128-GCM open, 32 B, aws-lc-rs on desktop: 37 ns, 1.31× the fastest -AES-128-GCM open, 32 B, aws-lc-rs on nixos2: 90 ns, 2.41× the fastest -AES-128-GCM open, 32 B, aws-lc-rs on ovh-iad: 142 ns, 2.29× the fastest -AES-128-GCM open, 32 B, aws-lc-rs on ovh-sea: 140 ns, 2.35× the fastest -AES-128-GCM open, 32 B, ring on nixos: 58 ns, 1.30× the fastest -AES-128-GCM open, 32 B, ring on desktop: 42 ns, 1.49× the fastest -AES-128-GCM open, 32 B, ring on nixos2: 98 ns, 2.60× the fastest -AES-128-GCM open, 32 B, ring on ovh-iad: 124 ns, 2.01× the fastest -AES-128-GCM open, 32 B, ring on ovh-sea: 126 ns, 2.11× the fastest -AES-128-GCM open, 32 B, RustCrypto + dalek on nixos: 102 ns, 2.29× the fastest -AES-128-GCM open, 32 B, RustCrypto + dalek on desktop: 78 ns, 2.73× the fastest -AES-128-GCM open, 32 B, RustCrypto + dalek on nixos2: 104 ns, 2.78× the fastest -AES-128-GCM open, 32 B, RustCrypto + dalek on ovh-iad: 166 ns, 2.67× the fastest -AES-128-GCM open, 32 B, RustCrypto + dalek on ovh-sea: 161 ns, 2.70× the fastest -AES-128-GCM open, 32 B, graviola on nixos: 65 ns, 1.46× the fastest -AES-128-GCM open, 32 B, graviola on desktop: 36 ns, 1.26× the fastest -AES-128-GCM open, 32 B, graviola on nixos2: 69 ns, 1.83× the fastest -AES-128-GCM open, 32 B, libcrux on nixos: 317 ns, 7.15× the fastest -AES-128-GCM open, 32 B, libcrux on desktop: 159 ns, 5.59× the fastest -AES-128-GCM open, 32 B, libcrux on nixos2: 303 ns, 8.06× the fastest -AES-128-GCM open, 32 B, libcrux on ovh-iad: 485 ns, 7.81× the fastest -AES-128-GCM open, 32 B, libcrux on ovh-sea: 465 ns, 7.79× the fastest -AES-128-GCM open, 32 B, OpenSSL on nixos: 118 ns, 2.65× the fastest -AES-128-GCM open, 32 B, OpenSSL on desktop: 58 ns, 2.02× the fastest -AES-128-GCM open, 32 B, OpenSSL on nixos2: 159 ns, 4.24× the fastest -AES-128-GCM open, 32 B, OpenSSL on ovh-iad: 267 ns, 4.30× the fastest -AES-128-GCM open, 32 B, OpenSSL on ovh-sea: 241 ns, 4.04× the fastest +AES-128-GCM open, 32 B, rind on ovh-sea: 60 ns, 1.00× the fastest; verified: rind's Lean proof, through Aeneas and hand models of the function-pointer dispatch, of the AES-NI key expansion and block cipher's raw-pointer loads, and of the SIMD intrinsics as Intel's manual defines them, of its AEAD API's AES-GCM key setup, seal, and open, for AAD and messages under 2^32 bytes, down to HACL*'s Vale AES-GCM routines, composed with Vale's F* proofs of Gcm_blocks_stdcall, Gcm_blocks_decrypt_stdcall, and Compute_iv_stdcall, of the code Vale prints at HACL* f557259007db, which rind imports +✓ +AES-128-GCM open, 32 B, aws-lc-rs on nixos: 72 ns, 1.63× the fastest +AES-128-GCM open, 32 B, aws-lc-rs on desktop: 37 ns, 1.31× the fastest +AES-128-GCM open, 32 B, aws-lc-rs on nixos2: 90 ns, 2.41× the fastest +AES-128-GCM open, 32 B, aws-lc-rs on kixtop: 47 ns, 1.70× the fastest +AES-128-GCM open, 32 B, aws-lc-rs on ovh-iad: 142 ns, 2.29× the fastest +AES-128-GCM open, 32 B, aws-lc-rs on ovh-sea: 140 ns, 2.35× the fastest +AES-128-GCM open, 32 B, ring on nixos: 58 ns, 1.30× the fastest +AES-128-GCM open, 32 B, ring on desktop: 42 ns, 1.49× the fastest +AES-128-GCM open, 32 B, ring on nixos2: 98 ns, 2.60× the fastest +AES-128-GCM open, 32 B, ring on kixtop: 39 ns, 1.42× the fastest +AES-128-GCM open, 32 B, ring on ovh-iad: 124 ns, 2.01× the fastest +AES-128-GCM open, 32 B, ring on ovh-sea: 126 ns, 2.11× the fastest +AES-128-GCM open, 32 B, RustCrypto + dalek on nixos: 102 ns, 2.29× the fastest +AES-128-GCM open, 32 B, RustCrypto + dalek on desktop: 78 ns, 2.73× the fastest +AES-128-GCM open, 32 B, RustCrypto + dalek on nixos2: 104 ns, 2.78× the fastest +AES-128-GCM open, 32 B, RustCrypto + dalek on kixtop: 28 ns, 1.00× the fastest +AES-128-GCM open, 32 B, RustCrypto + dalek on ovh-iad: 166 ns, 2.67× the fastest +AES-128-GCM open, 32 B, RustCrypto + dalek on ovh-sea: 161 ns, 2.70× the fastest +AES-128-GCM open, 32 B, graviola on nixos: 65 ns, 1.46× the fastest +AES-128-GCM open, 32 B, graviola on desktop: 36 ns, 1.26× the fastest +AES-128-GCM open, 32 B, graviola on nixos2: 69 ns, 1.83× the fastest +AES-128-GCM open, 32 B, graviola on kixtop: 85 ns, 3.06× the fastest +AES-128-GCM open, 32 B, libcrux on nixos: 317 ns, 7.15× the fastest +AES-128-GCM open, 32 B, libcrux on desktop: 159 ns, 5.59× the fastest +AES-128-GCM open, 32 B, libcrux on nixos2: 303 ns, 8.06× the fastest +AES-128-GCM open, 32 B, libcrux on kixtop: 64 ns, 2.30× the fastest +AES-128-GCM open, 32 B, libcrux on ovh-iad: 485 ns, 7.81× the fastest +AES-128-GCM open, 32 B, libcrux on ovh-sea: 465 ns, 7.79× the fastest +AES-128-GCM open, 32 B, OpenSSL on nixos: 118 ns, 2.65× the fastest +AES-128-GCM open, 32 B, OpenSSL on desktop: 58 ns, 2.02× the fastest +AES-128-GCM open, 32 B, OpenSSL on nixos2: 159 ns, 4.24× the fastest +AES-128-GCM open, 32 B, OpenSSL on kixtop: 65 ns, 2.36× the fastest +AES-128-GCM open, 32 B, OpenSSL on ovh-iad: 267 ns, 4.30× the fastest +AES-128-GCM open, 32 B, OpenSSL on ovh-sea: 241 ns, 4.04× the fastest AES-128-GCM open, 1350 B AES-128-GCM open, 1350 B, rind on nixos: 174 ns, 1.00× the fastest AES-128-GCM open, 1350 B, rind on desktop: 99 ns, 1.00× the fastest AES-128-GCM open, 1350 B, rind on nixos2: 236 ns, 1.00× the fastest; verified: rind's Lean proof, through Aeneas and hand models of the function-pointer dispatch, of the AES-NI key expansion and block cipher's raw-pointer loads, and of the SIMD intrinsics as Intel's manual defines them, of its AEAD API's AES-GCM key setup, seal, and open, for AAD and messages under 2^32 bytes, down to HACL*'s Vale AES-GCM routines, composed with Vale's F* proofs of Gcm_blocks_stdcall, Gcm_blocks_decrypt_stdcall, and Compute_iv_stdcall, of the code Vale prints at HACL* f557259007db, which rind imports ✓ -AES-128-GCM open, 1350 B, rind on ovh-iad: 406 ns, 1.00× the fastest; verified: rind's Lean proof, through Aeneas and hand models of the function-pointer dispatch, of the AES-NI key expansion and block cipher's raw-pointer loads, and of the SIMD intrinsics as Intel's manual defines them, of its AEAD API's AES-GCM key setup, seal, and open, for AAD and messages under 2^32 bytes, down to HACL*'s Vale AES-GCM routines, composed with Vale's F* proofs of Gcm_blocks_stdcall, Gcm_blocks_decrypt_stdcall, and Compute_iv_stdcall, of the code Vale prints at HACL* f557259007db, which rind imports -✓ -AES-128-GCM open, 1350 B, rind on ovh-sea: 371 ns, 1.00× the fastest; verified: rind's Lean proof, through Aeneas and hand models of the function-pointer dispatch, of the AES-NI key expansion and block cipher's raw-pointer loads, and of the SIMD intrinsics as Intel's manual defines them, of its AEAD API's AES-GCM key setup, seal, and open, for AAD and messages under 2^32 bytes, down to HACL*'s Vale AES-GCM routines, composed with Vale's F* proofs of Gcm_blocks_stdcall, Gcm_blocks_decrypt_stdcall, and Compute_iv_stdcall, of the code Vale prints at HACL* f557259007db, which rind imports +AES-128-GCM open, 1350 B, rind on kixtop: 214 ns, 1.11× the fastest +AES-128-GCM open, 1350 B, rind on ovh-iad: 406 ns, 1.00× the fastest; verified: rind's Lean proof, through Aeneas and hand models of the function-pointer dispatch, of the AES-NI key expansion and block cipher's raw-pointer loads, and of the SIMD intrinsics as Intel's manual defines them, of its AEAD API's AES-GCM key setup, seal, and open, for AAD and messages under 2^32 bytes, down to HACL*'s Vale AES-GCM routines, composed with Vale's F* proofs of Gcm_blocks_stdcall, Gcm_blocks_decrypt_stdcall, and Compute_iv_stdcall, of the code Vale prints at HACL* f557259007db, which rind imports ✓ -AES-128-GCM open, 1350 B, aws-lc-rs on nixos: 298 ns, 1.71× the fastest -AES-128-GCM open, 1350 B, aws-lc-rs on desktop: 149 ns, 1.51× the fastest -AES-128-GCM open, 1350 B, aws-lc-rs on nixos2: 285 ns, 1.21× the fastest -AES-128-GCM open, 1350 B, aws-lc-rs on ovh-iad: 525 ns, 1.29× the fastest -AES-128-GCM open, 1350 B, aws-lc-rs on ovh-sea: 437 ns, 1.18× the fastest -AES-128-GCM open, 1350 B, ring on nixos: 185 ns, 1.06× the fastest -AES-128-GCM open, 1350 B, ring on desktop: 114 ns, 1.16× the fastest -AES-128-GCM open, 1350 B, ring on nixos2: 296 ns, 1.25× the fastest -AES-128-GCM open, 1350 B, ring on ovh-iad: 442 ns, 1.09× the fastest -AES-128-GCM open, 1350 B, ring on ovh-sea: 422 ns, 1.14× the fastest -AES-128-GCM open, 1350 B, RustCrypto + dalek on nixos: 451 ns, 2.58× the fastest -AES-128-GCM open, 1350 B, RustCrypto + dalek on desktop: 282 ns, 2.86× the fastest -AES-128-GCM open, 1350 B, RustCrypto + dalek on nixos2: 564 ns, 2.39× the fastest -AES-128-GCM open, 1350 B, RustCrypto + dalek on ovh-iad: 915 ns, 2.26× the fastest -AES-128-GCM open, 1350 B, RustCrypto + dalek on ovh-sea: 874 ns, 2.36× the fastest -AES-128-GCM open, 1350 B, graviola on nixos: 305 ns, 1.75× the fastest -AES-128-GCM open, 1350 B, graviola on desktop: 176 ns, 1.79× the fastest -AES-128-GCM open, 1350 B, graviola on nixos2: 358 ns, 1.51× the fastest -AES-128-GCM open, 1350 B, libcrux on nixos: 3.92 µs, 22.46× the fastest -AES-128-GCM open, 1350 B, libcrux on desktop: 2.00 µs, 20.29× the fastest -AES-128-GCM open, 1350 B, libcrux on nixos2: 3.48 µs, 14.75× the fastest -AES-128-GCM open, 1350 B, libcrux on ovh-iad: 5.38 µs, 13.25× the fastest -AES-128-GCM open, 1350 B, libcrux on ovh-sea: 5.32 µs, 14.33× the fastest -AES-128-GCM open, 1350 B, OpenSSL on nixos: 333 ns, 1.91× the fastest -AES-128-GCM open, 1350 B, OpenSSL on desktop: 159 ns, 1.62× the fastest -AES-128-GCM open, 1350 B, OpenSSL on nixos2: 355 ns, 1.50× the fastest -AES-128-GCM open, 1350 B, OpenSSL on ovh-iad: 565 ns, 1.39× the fastest -AES-128-GCM open, 1350 B, OpenSSL on ovh-sea: 546 ns, 1.47× the fastest +AES-128-GCM open, 1350 B, rind on ovh-sea: 371 ns, 1.00× the fastest; verified: rind's Lean proof, through Aeneas and hand models of the function-pointer dispatch, of the AES-NI key expansion and block cipher's raw-pointer loads, and of the SIMD intrinsics as Intel's manual defines them, of its AEAD API's AES-GCM key setup, seal, and open, for AAD and messages under 2^32 bytes, down to HACL*'s Vale AES-GCM routines, composed with Vale's F* proofs of Gcm_blocks_stdcall, Gcm_blocks_decrypt_stdcall, and Compute_iv_stdcall, of the code Vale prints at HACL* f557259007db, which rind imports +✓ +AES-128-GCM open, 1350 B, aws-lc-rs on nixos: 298 ns, 1.71× the fastest +AES-128-GCM open, 1350 B, aws-lc-rs on desktop: 149 ns, 1.51× the fastest +AES-128-GCM open, 1350 B, aws-lc-rs on nixos2: 285 ns, 1.21× the fastest +AES-128-GCM open, 1350 B, aws-lc-rs on kixtop: 193 ns, 1.00× the fastest +AES-128-GCM open, 1350 B, aws-lc-rs on ovh-iad: 525 ns, 1.29× the fastest +AES-128-GCM open, 1350 B, aws-lc-rs on ovh-sea: 437 ns, 1.18× the fastest +AES-128-GCM open, 1350 B, ring on nixos: 185 ns, 1.06× the fastest +AES-128-GCM open, 1350 B, ring on desktop: 114 ns, 1.16× the fastest +AES-128-GCM open, 1350 B, ring on nixos2: 296 ns, 1.25× the fastest +AES-128-GCM open, 1350 B, ring on kixtop: 247 ns, 1.28× the fastest +AES-128-GCM open, 1350 B, ring on ovh-iad: 442 ns, 1.09× the fastest +AES-128-GCM open, 1350 B, ring on ovh-sea: 422 ns, 1.14× the fastest +AES-128-GCM open, 1350 B, RustCrypto + dalek on nixos: 451 ns, 2.58× the fastest +AES-128-GCM open, 1350 B, RustCrypto + dalek on desktop: 282 ns, 2.86× the fastest +AES-128-GCM open, 1350 B, RustCrypto + dalek on nixos2: 564 ns, 2.39× the fastest +AES-128-GCM open, 1350 B, RustCrypto + dalek on kixtop: 237 ns, 1.23× the fastest +AES-128-GCM open, 1350 B, RustCrypto + dalek on ovh-iad: 915 ns, 2.26× the fastest +AES-128-GCM open, 1350 B, RustCrypto + dalek on ovh-sea: 874 ns, 2.36× the fastest +AES-128-GCM open, 1350 B, graviola on nixos: 305 ns, 1.75× the fastest +AES-128-GCM open, 1350 B, graviola on desktop: 176 ns, 1.79× the fastest +AES-128-GCM open, 1350 B, graviola on nixos2: 358 ns, 1.51× the fastest +AES-128-GCM open, 1350 B, graviola on kixtop: 226 ns, 1.17× the fastest +AES-128-GCM open, 1350 B, libcrux on nixos: 3.92 µs, 22.46× the fastest +AES-128-GCM open, 1350 B, libcrux on desktop: 2.00 µs, 20.29× the fastest +AES-128-GCM open, 1350 B, libcrux on nixos2: 3.48 µs, 14.75× the fastest +AES-128-GCM open, 1350 B, libcrux on kixtop: 647 ns, 3.35× the fastest +AES-128-GCM open, 1350 B, libcrux on ovh-iad: 5.38 µs, 13.25× the fastest +AES-128-GCM open, 1350 B, libcrux on ovh-sea: 5.32 µs, 14.33× the fastest +AES-128-GCM open, 1350 B, OpenSSL on nixos: 333 ns, 1.91× the fastest +AES-128-GCM open, 1350 B, OpenSSL on desktop: 159 ns, 1.62× the fastest +AES-128-GCM open, 1350 B, OpenSSL on nixos2: 355 ns, 1.50× the fastest +AES-128-GCM open, 1350 B, OpenSSL on kixtop: 199 ns, 1.03× the fastest +AES-128-GCM open, 1350 B, OpenSSL on ovh-iad: 565 ns, 1.39× the fastest +AES-128-GCM open, 1350 B, OpenSSL on ovh-sea: 546 ns, 1.47× the fastest AES-128-GCM open, 16 KB AES-128-GCM open, 16 KB, rind on nixos: 1.44 µs, 1.00× the fastest AES-128-GCM open, 16 KB, rind on desktop: 816 ns, 1.00× the fastest AES-128-GCM open, 16 KB, rind on nixos2: 2.52 µs, 1.00× the fastest; verified: rind's Lean proof, through Aeneas and hand models of the function-pointer dispatch, of the AES-NI key expansion and block cipher's raw-pointer loads, and of the SIMD intrinsics as Intel's manual defines them, of its AEAD API's AES-GCM key setup, seal, and open, for AAD and messages under 2^32 bytes, down to HACL*'s Vale AES-GCM routines, composed with Vale's F* proofs of Gcm_blocks_stdcall, Gcm_blocks_decrypt_stdcall, and Compute_iv_stdcall, of the code Vale prints at HACL* f557259007db, which rind imports ✓ -AES-128-GCM open, 16 KB, rind on ovh-iad: 3.99 µs, 1.03× the fastest; verified: rind's Lean proof, through Aeneas and hand models of the function-pointer dispatch, of the AES-NI key expansion and block cipher's raw-pointer loads, and of the SIMD intrinsics as Intel's manual defines them, of its AEAD API's AES-GCM key setup, seal, and open, for AAD and messages under 2^32 bytes, down to HACL*'s Vale AES-GCM routines, composed with Vale's F* proofs of Gcm_blocks_stdcall, Gcm_blocks_decrypt_stdcall, and Compute_iv_stdcall, of the code Vale prints at HACL* f557259007db, which rind imports -✓ -AES-128-GCM open, 16 KB, rind on ovh-sea: 3.76 µs, 1.00× the fastest; verified: rind's Lean proof, through Aeneas and hand models of the function-pointer dispatch, of the AES-NI key expansion and block cipher's raw-pointer loads, and of the SIMD intrinsics as Intel's manual defines them, of its AEAD API's AES-GCM key setup, seal, and open, for AAD and messages under 2^32 bytes, down to HACL*'s Vale AES-GCM routines, composed with Vale's F* proofs of Gcm_blocks_stdcall, Gcm_blocks_decrypt_stdcall, and Compute_iv_stdcall, of the code Vale prints at HACL* f557259007db, which rind imports +AES-128-GCM open, 16 KB, rind on kixtop: 1.61 µs, 1.02× the fastest +AES-128-GCM open, 16 KB, rind on ovh-iad: 3.99 µs, 1.03× the fastest; verified: rind's Lean proof, through Aeneas and hand models of the function-pointer dispatch, of the AES-NI key expansion and block cipher's raw-pointer loads, and of the SIMD intrinsics as Intel's manual defines them, of its AEAD API's AES-GCM key setup, seal, and open, for AAD and messages under 2^32 bytes, down to HACL*'s Vale AES-GCM routines, composed with Vale's F* proofs of Gcm_blocks_stdcall, Gcm_blocks_decrypt_stdcall, and Compute_iv_stdcall, of the code Vale prints at HACL* f557259007db, which rind imports ✓ -AES-128-GCM open, 16 KB, aws-lc-rs on nixos: 2.72 µs, 1.89× the fastest -AES-128-GCM open, 16 KB, aws-lc-rs on desktop: 1.28 µs, 1.56× the fastest -AES-128-GCM open, 16 KB, aws-lc-rs on nixos2: 2.60 µs, 1.03× the fastest -AES-128-GCM open, 16 KB, aws-lc-rs on ovh-iad: 3.92 µs, 1.02× the fastest -AES-128-GCM open, 16 KB, aws-lc-rs on ovh-sea: 3.81 µs, 1.02× the fastest -AES-128-GCM open, 16 KB, ring on nixos: 1.45 µs, 1.01× the fastest -AES-128-GCM open, 16 KB, ring on desktop: 829 ns, 1.02× the fastest -AES-128-GCM open, 16 KB, ring on nixos2: 2.62 µs, 1.04× the fastest -AES-128-GCM open, 16 KB, ring on ovh-iad: 3.85 µs, 1.00× the fastest -AES-128-GCM open, 16 KB, ring on ovh-sea: 3.80 µs, 1.01× the fastest -AES-128-GCM open, 16 KB, RustCrypto + dalek on nixos: 4.29 µs, 2.98× the fastest -AES-128-GCM open, 16 KB, RustCrypto + dalek on desktop: 2.54 µs, 3.12× the fastest -AES-128-GCM open, 16 KB, RustCrypto + dalek on nixos2: 5.75 µs, 2.28× the fastest -AES-128-GCM open, 16 KB, RustCrypto + dalek on ovh-iad: 8.92 µs, 2.31× the fastest -AES-128-GCM open, 16 KB, RustCrypto + dalek on ovh-sea: 8.76 µs, 2.33× the fastest -AES-128-GCM open, 16 KB, graviola on nixos: 2.65 µs, 1.84× the fastest -AES-128-GCM open, 16 KB, graviola on desktop: 1.42 µs, 1.73× the fastest -AES-128-GCM open, 16 KB, graviola on nixos2: 3.39 µs, 1.34× the fastest -AES-128-GCM open, 16 KB, libcrux on nixos: 44.29 µs, 30.79× the fastest -AES-128-GCM open, 16 KB, libcrux on desktop: 22.31 µs, 27.33× the fastest -AES-128-GCM open, 16 KB, libcrux on nixos2: 41.66 µs, 16.52× the fastest -AES-128-GCM open, 16 KB, libcrux on ovh-iad: 61.44 µs, 15.94× the fastest -AES-128-GCM open, 16 KB, libcrux on ovh-sea: 60.04 µs, 15.98× the fastest -AES-128-GCM open, 16 KB, OpenSSL on nixos: 2.77 µs, 1.93× the fastest -AES-128-GCM open, 16 KB, OpenSSL on desktop: 1.30 µs, 1.59× the fastest -AES-128-GCM open, 16 KB, OpenSSL on nixos2: 2.85 µs, 1.13× the fastest -AES-128-GCM open, 16 KB, OpenSSL on ovh-iad: 4.23 µs, 1.10× the fastest -AES-128-GCM open, 16 KB, OpenSSL on ovh-sea: 3.95 µs, 1.05× the fastest +AES-128-GCM open, 16 KB, rind on ovh-sea: 3.76 µs, 1.00× the fastest; verified: rind's Lean proof, through Aeneas and hand models of the function-pointer dispatch, of the AES-NI key expansion and block cipher's raw-pointer loads, and of the SIMD intrinsics as Intel's manual defines them, of its AEAD API's AES-GCM key setup, seal, and open, for AAD and messages under 2^32 bytes, down to HACL*'s Vale AES-GCM routines, composed with Vale's F* proofs of Gcm_blocks_stdcall, Gcm_blocks_decrypt_stdcall, and Compute_iv_stdcall, of the code Vale prints at HACL* f557259007db, which rind imports +✓ +AES-128-GCM open, 16 KB, aws-lc-rs on nixos: 2.72 µs, 1.89× the fastest +AES-128-GCM open, 16 KB, aws-lc-rs on desktop: 1.28 µs, 1.56× the fastest +AES-128-GCM open, 16 KB, aws-lc-rs on nixos2: 2.60 µs, 1.03× the fastest +AES-128-GCM open, 16 KB, aws-lc-rs on kixtop: 1.57 µs, 1.00× the fastest +AES-128-GCM open, 16 KB, aws-lc-rs on ovh-iad: 3.92 µs, 1.02× the fastest +AES-128-GCM open, 16 KB, aws-lc-rs on ovh-sea: 3.81 µs, 1.02× the fastest +AES-128-GCM open, 16 KB, ring on nixos: 1.45 µs, 1.01× the fastest +AES-128-GCM open, 16 KB, ring on desktop: 829 ns, 1.02× the fastest +AES-128-GCM open, 16 KB, ring on nixos2: 2.62 µs, 1.04× the fastest +AES-128-GCM open, 16 KB, ring on kixtop: 2.18 µs, 1.39× the fastest +AES-128-GCM open, 16 KB, ring on ovh-iad: 3.85 µs, 1.00× the fastest +AES-128-GCM open, 16 KB, ring on ovh-sea: 3.80 µs, 1.01× the fastest +AES-128-GCM open, 16 KB, RustCrypto + dalek on nixos: 4.29 µs, 2.98× the fastest +AES-128-GCM open, 16 KB, RustCrypto + dalek on desktop: 2.54 µs, 3.12× the fastest +AES-128-GCM open, 16 KB, RustCrypto + dalek on nixos2: 5.75 µs, 2.28× the fastest +AES-128-GCM open, 16 KB, RustCrypto + dalek on kixtop: 2.46 µs, 1.57× the fastest +AES-128-GCM open, 16 KB, RustCrypto + dalek on ovh-iad: 8.92 µs, 2.31× the fastest +AES-128-GCM open, 16 KB, RustCrypto + dalek on ovh-sea: 8.76 µs, 2.33× the fastest +AES-128-GCM open, 16 KB, graviola on nixos: 2.65 µs, 1.84× the fastest +AES-128-GCM open, 16 KB, graviola on desktop: 1.42 µs, 1.73× the fastest +AES-128-GCM open, 16 KB, graviola on nixos2: 3.39 µs, 1.34× the fastest +AES-128-GCM open, 16 KB, graviola on kixtop: 1.71 µs, 1.09× the fastest +AES-128-GCM open, 16 KB, libcrux on nixos: 44.29 µs, 30.79× the fastest +AES-128-GCM open, 16 KB, libcrux on desktop: 22.31 µs, 27.33× the fastest +AES-128-GCM open, 16 KB, libcrux on nixos2: 41.66 µs, 16.52× the fastest +AES-128-GCM open, 16 KB, libcrux on kixtop: 6.97 µs, 4.44× the fastest +AES-128-GCM open, 16 KB, libcrux on ovh-iad: 61.44 µs, 15.94× the fastest +AES-128-GCM open, 16 KB, libcrux on ovh-sea: 60.04 µs, 15.98× the fastest +AES-128-GCM open, 16 KB, OpenSSL on nixos: 2.77 µs, 1.93× the fastest +AES-128-GCM open, 16 KB, OpenSSL on desktop: 1.30 µs, 1.59× the fastest +AES-128-GCM open, 16 KB, OpenSSL on nixos2: 2.85 µs, 1.13× the fastest +AES-128-GCM open, 16 KB, OpenSSL on kixtop: 1.66 µs, 1.06× the fastest +AES-128-GCM open, 16 KB, OpenSSL on ovh-iad: 4.23 µs, 1.10× the fastest +AES-128-GCM open, 16 KB, OpenSSL on ovh-sea: 3.95 µs, 1.05× the fastest AES-256-GCM seal, 32 B AES-256-GCM seal, 32 B, rind on nixos: 41 ns, 1.00× the fastest AES-256-GCM seal, 32 B, rind on desktop: 20 ns, 1.00× the fastest AES-256-GCM seal, 32 B, rind on nixos2: 49 ns, 1.00× the fastest; verified: rind's Lean proof, through Aeneas and hand models of the function-pointer dispatch, of the AES-NI key expansion and block cipher's raw-pointer loads, and of the SIMD intrinsics as Intel's manual defines them, of its AEAD API's AES-GCM key setup, seal, and open, for AAD and messages under 2^32 bytes, down to HACL*'s Vale AES-GCM routines, composed with Vale's F* proofs of Gcm_blocks_stdcall, Gcm_blocks_decrypt_stdcall, and Compute_iv_stdcall, of the code Vale prints at HACL* f557259007db, which rind imports ✓ -AES-256-GCM seal, 32 B, rind on ovh-iad: 75 ns, 1.00× the fastest; verified: rind's Lean proof, through Aeneas and hand models of the function-pointer dispatch, of the AES-NI key expansion and block cipher's raw-pointer loads, and of the SIMD intrinsics as Intel's manual defines them, of its AEAD API's AES-GCM key setup, seal, and open, for AAD and messages under 2^32 bytes, down to HACL*'s Vale AES-GCM routines, composed with Vale's F* proofs of Gcm_blocks_stdcall, Gcm_blocks_decrypt_stdcall, and Compute_iv_stdcall, of the code Vale prints at HACL* f557259007db, which rind imports -✓ -AES-256-GCM seal, 32 B, rind on ovh-sea: 74 ns, 1.00× the fastest; verified: rind's Lean proof, through Aeneas and hand models of the function-pointer dispatch, of the AES-NI key expansion and block cipher's raw-pointer loads, and of the SIMD intrinsics as Intel's manual defines them, of its AEAD API's AES-GCM key setup, seal, and open, for AAD and messages under 2^32 bytes, down to HACL*'s Vale AES-GCM routines, composed with Vale's F* proofs of Gcm_blocks_stdcall, Gcm_blocks_decrypt_stdcall, and Compute_iv_stdcall, of the code Vale prints at HACL* f557259007db, which rind imports +AES-256-GCM seal, 32 B, rind on kixtop: 61 ns, 2.44× the fastest +AES-256-GCM seal, 32 B, rind on ovh-iad: 75 ns, 1.00× the fastest; verified: rind's Lean proof, through Aeneas and hand models of the function-pointer dispatch, of the AES-NI key expansion and block cipher's raw-pointer loads, and of the SIMD intrinsics as Intel's manual defines them, of its AEAD API's AES-GCM key setup, seal, and open, for AAD and messages under 2^32 bytes, down to HACL*'s Vale AES-GCM routines, composed with Vale's F* proofs of Gcm_blocks_stdcall, Gcm_blocks_decrypt_stdcall, and Compute_iv_stdcall, of the code Vale prints at HACL* f557259007db, which rind imports ✓ -AES-256-GCM seal, 32 B, aws-lc-rs on nixos: 82 ns, 1.99× the fastest -AES-256-GCM seal, 32 B, aws-lc-rs on desktop: 40 ns, 1.99× the fastest -AES-256-GCM seal, 32 B, aws-lc-rs on nixos2: 95 ns, 1.96× the fastest -AES-256-GCM seal, 32 B, aws-lc-rs on ovh-iad: 155 ns, 2.05× the fastest -AES-256-GCM seal, 32 B, aws-lc-rs on ovh-sea: 147 ns, 2.00× the fastest -AES-256-GCM seal, 32 B, ring on nixos: 57 ns, 1.38× the fastest -AES-256-GCM seal, 32 B, ring on desktop: 43 ns, 2.16× the fastest -AES-256-GCM seal, 32 B, ring on nixos2: 75 ns, 1.54× the fastest -AES-256-GCM seal, 32 B, ring on ovh-iad: 122 ns, 1.62× the fastest -AES-256-GCM seal, 32 B, ring on ovh-sea: 119 ns, 1.61× the fastest -AES-256-GCM seal, 32 B, RustCrypto + dalek on nixos: 101 ns, 2.45× the fastest -AES-256-GCM seal, 32 B, RustCrypto + dalek on desktop: 77 ns, 3.90× the fastest -AES-256-GCM seal, 32 B, RustCrypto + dalek on nixos2: 107 ns, 2.21× the fastest -AES-256-GCM seal, 32 B, RustCrypto + dalek on ovh-iad: 170 ns, 2.25× the fastest -AES-256-GCM seal, 32 B, RustCrypto + dalek on ovh-sea: 166 ns, 2.25× the fastest -AES-256-GCM seal, 32 B, graviola on nixos: 74 ns, 1.81× the fastest -AES-256-GCM seal, 32 B, graviola on desktop: 44 ns, 2.22× the fastest -AES-256-GCM seal, 32 B, graviola on nixos2: 78 ns, 1.60× the fastest -AES-256-GCM seal, 32 B, libcrux on nixos: 426 ns, 10.35× the fastest -AES-256-GCM seal, 32 B, libcrux on desktop: 216 ns, 10.88× the fastest -AES-256-GCM seal, 32 B, libcrux on nixos2: 344 ns, 7.07× the fastest -AES-256-GCM seal, 32 B, libcrux on ovh-iad: 542 ns, 7.18× the fastest -AES-256-GCM seal, 32 B, libcrux on ovh-sea: 525 ns, 7.13× the fastest -AES-256-GCM seal, 32 B, OpenSSL on nixos: 118 ns, 2.87× the fastest -AES-256-GCM seal, 32 B, OpenSSL on desktop: 58 ns, 2.93× the fastest -AES-256-GCM seal, 32 B, OpenSSL on nixos2: 161 ns, 3.32× the fastest -AES-256-GCM seal, 32 B, OpenSSL on ovh-iad: 252 ns, 3.34× the fastest -AES-256-GCM seal, 32 B, OpenSSL on ovh-sea: 245 ns, 3.32× the fastest +AES-256-GCM seal, 32 B, rind on ovh-sea: 74 ns, 1.00× the fastest; verified: rind's Lean proof, through Aeneas and hand models of the function-pointer dispatch, of the AES-NI key expansion and block cipher's raw-pointer loads, and of the SIMD intrinsics as Intel's manual defines them, of its AEAD API's AES-GCM key setup, seal, and open, for AAD and messages under 2^32 bytes, down to HACL*'s Vale AES-GCM routines, composed with Vale's F* proofs of Gcm_blocks_stdcall, Gcm_blocks_decrypt_stdcall, and Compute_iv_stdcall, of the code Vale prints at HACL* f557259007db, which rind imports +✓ +AES-256-GCM seal, 32 B, aws-lc-rs on nixos: 82 ns, 1.99× the fastest +AES-256-GCM seal, 32 B, aws-lc-rs on desktop: 40 ns, 1.99× the fastest +AES-256-GCM seal, 32 B, aws-lc-rs on nixos2: 95 ns, 1.96× the fastest +AES-256-GCM seal, 32 B, aws-lc-rs on kixtop: 54 ns, 2.18× the fastest +AES-256-GCM seal, 32 B, aws-lc-rs on ovh-iad: 155 ns, 2.05× the fastest +AES-256-GCM seal, 32 B, aws-lc-rs on ovh-sea: 147 ns, 2.00× the fastest +AES-256-GCM seal, 32 B, ring on nixos: 57 ns, 1.38× the fastest +AES-256-GCM seal, 32 B, ring on desktop: 43 ns, 2.16× the fastest +AES-256-GCM seal, 32 B, ring on nixos2: 75 ns, 1.54× the fastest +AES-256-GCM seal, 32 B, ring on kixtop: 45 ns, 1.82× the fastest +AES-256-GCM seal, 32 B, ring on ovh-iad: 122 ns, 1.62× the fastest +AES-256-GCM seal, 32 B, ring on ovh-sea: 119 ns, 1.61× the fastest +AES-256-GCM seal, 32 B, RustCrypto + dalek on nixos: 101 ns, 2.45× the fastest +AES-256-GCM seal, 32 B, RustCrypto + dalek on desktop: 77 ns, 3.90× the fastest +AES-256-GCM seal, 32 B, RustCrypto + dalek on nixos2: 107 ns, 2.21× the fastest +AES-256-GCM seal, 32 B, RustCrypto + dalek on kixtop: 25 ns, 1.00× the fastest +AES-256-GCM seal, 32 B, RustCrypto + dalek on ovh-iad: 170 ns, 2.25× the fastest +AES-256-GCM seal, 32 B, RustCrypto + dalek on ovh-sea: 166 ns, 2.25× the fastest +AES-256-GCM seal, 32 B, graviola on nixos: 74 ns, 1.81× the fastest +AES-256-GCM seal, 32 B, graviola on desktop: 44 ns, 2.22× the fastest +AES-256-GCM seal, 32 B, graviola on nixos2: 78 ns, 1.60× the fastest +AES-256-GCM seal, 32 B, graviola on kixtop: 79 ns, 3.18× the fastest +AES-256-GCM seal, 32 B, libcrux on nixos: 426 ns, 10.35× the fastest +AES-256-GCM seal, 32 B, libcrux on desktop: 216 ns, 10.88× the fastest +AES-256-GCM seal, 32 B, libcrux on nixos2: 344 ns, 7.07× the fastest +AES-256-GCM seal, 32 B, libcrux on kixtop: 53 ns, 2.15× the fastest +AES-256-GCM seal, 32 B, libcrux on ovh-iad: 542 ns, 7.18× the fastest +AES-256-GCM seal, 32 B, libcrux on ovh-sea: 525 ns, 7.13× the fastest +AES-256-GCM seal, 32 B, OpenSSL on nixos: 118 ns, 2.87× the fastest +AES-256-GCM seal, 32 B, OpenSSL on desktop: 58 ns, 2.93× the fastest +AES-256-GCM seal, 32 B, OpenSSL on nixos2: 161 ns, 3.32× the fastest +AES-256-GCM seal, 32 B, OpenSSL on kixtop: 67 ns, 2.72× the fastest +AES-256-GCM seal, 32 B, OpenSSL on ovh-iad: 252 ns, 3.34× the fastest +AES-256-GCM seal, 32 B, OpenSSL on ovh-sea: 245 ns, 3.32× the fastest AES-256-GCM seal, 1350 B AES-256-GCM seal, 1350 B, rind on nixos: 184 ns, 1.00× the fastest AES-256-GCM seal, 1350 B, rind on desktop: 106 ns, 1.00× the fastest AES-256-GCM seal, 1350 B, rind on nixos2: 325 ns, 1.00× the fastest; verified: rind's Lean proof, through Aeneas and hand models of the function-pointer dispatch, of the AES-NI key expansion and block cipher's raw-pointer loads, and of the SIMD intrinsics as Intel's manual defines them, of its AEAD API's AES-GCM key setup, seal, and open, for AAD and messages under 2^32 bytes, down to HACL*'s Vale AES-GCM routines, composed with Vale's F* proofs of Gcm_blocks_stdcall, Gcm_blocks_decrypt_stdcall, and Compute_iv_stdcall, of the code Vale prints at HACL* f557259007db, which rind imports ✓ -AES-256-GCM seal, 1350 B, rind on ovh-iad: 523 ns, 1.00× the fastest; verified: rind's Lean proof, through Aeneas and hand models of the function-pointer dispatch, of the AES-NI key expansion and block cipher's raw-pointer loads, and of the SIMD intrinsics as Intel's manual defines them, of its AEAD API's AES-GCM key setup, seal, and open, for AAD and messages under 2^32 bytes, down to HACL*'s Vale AES-GCM routines, composed with Vale's F* proofs of Gcm_blocks_stdcall, Gcm_blocks_decrypt_stdcall, and Compute_iv_stdcall, of the code Vale prints at HACL* f557259007db, which rind imports -✓ -AES-256-GCM seal, 1350 B, rind on ovh-sea: 507 ns, 1.00× the fastest; verified: rind's Lean proof, through Aeneas and hand models of the function-pointer dispatch, of the AES-NI key expansion and block cipher's raw-pointer loads, and of the SIMD intrinsics as Intel's manual defines them, of its AEAD API's AES-GCM key setup, seal, and open, for AAD and messages under 2^32 bytes, down to HACL*'s Vale AES-GCM routines, composed with Vale's F* proofs of Gcm_blocks_stdcall, Gcm_blocks_decrypt_stdcall, and Compute_iv_stdcall, of the code Vale prints at HACL* f557259007db, which rind imports +AES-256-GCM seal, 1350 B, rind on kixtop: 237 ns, 1.16× the fastest +AES-256-GCM seal, 1350 B, rind on ovh-iad: 523 ns, 1.00× the fastest; verified: rind's Lean proof, through Aeneas and hand models of the function-pointer dispatch, of the AES-NI key expansion and block cipher's raw-pointer loads, and of the SIMD intrinsics as Intel's manual defines them, of its AEAD API's AES-GCM key setup, seal, and open, for AAD and messages under 2^32 bytes, down to HACL*'s Vale AES-GCM routines, composed with Vale's F* proofs of Gcm_blocks_stdcall, Gcm_blocks_decrypt_stdcall, and Compute_iv_stdcall, of the code Vale prints at HACL* f557259007db, which rind imports ✓ -AES-256-GCM seal, 1350 B, aws-lc-rs on nixos: 311 ns, 1.69× the fastest -AES-256-GCM seal, 1350 B, aws-lc-rs on desktop: 173 ns, 1.63× the fastest -AES-256-GCM seal, 1350 B, aws-lc-rs on nixos2: 363 ns, 1.12× the fastest -AES-256-GCM seal, 1350 B, aws-lc-rs on ovh-iad: 581 ns, 1.11× the fastest -AES-256-GCM seal, 1350 B, aws-lc-rs on ovh-sea: 556 ns, 1.10× the fastest -AES-256-GCM seal, 1350 B, ring on nixos: 205 ns, 1.11× the fastest -AES-256-GCM seal, 1350 B, ring on desktop: 133 ns, 1.25× the fastest -AES-256-GCM seal, 1350 B, ring on nixos2: 353 ns, 1.09× the fastest -AES-256-GCM seal, 1350 B, ring on ovh-iad: 557 ns, 1.06× the fastest -AES-256-GCM seal, 1350 B, ring on ovh-sea: 550 ns, 1.08× the fastest -AES-256-GCM seal, 1350 B, RustCrypto + dalek on nixos: 489 ns, 2.65× the fastest -AES-256-GCM seal, 1350 B, RustCrypto + dalek on desktop: 313 ns, 2.94× the fastest -AES-256-GCM seal, 1350 B, RustCrypto + dalek on nixos2: 623 ns, 1.92× the fastest -AES-256-GCM seal, 1350 B, RustCrypto + dalek on ovh-iad: 999 ns, 1.91× the fastest -AES-256-GCM seal, 1350 B, RustCrypto + dalek on ovh-sea: 958 ns, 1.89× the fastest -AES-256-GCM seal, 1350 B, graviola on nixos: 337 ns, 1.83× the fastest -AES-256-GCM seal, 1350 B, graviola on desktop: 258 ns, 2.42× the fastest -AES-256-GCM seal, 1350 B, graviola on nixos2: 476 ns, 1.46× the fastest -AES-256-GCM seal, 1350 B, libcrux on nixos: 6.91 µs, 37.50× the fastest -AES-256-GCM seal, 1350 B, libcrux on desktop: 2.83 µs, 26.55× the fastest -AES-256-GCM seal, 1350 B, libcrux on nixos2: 4.50 µs, 13.86× the fastest -AES-256-GCM seal, 1350 B, libcrux on ovh-iad: 7.07 µs, 13.51× the fastest -AES-256-GCM seal, 1350 B, libcrux on ovh-sea: 6.92 µs, 13.63× the fastest -AES-256-GCM seal, 1350 B, OpenSSL on nixos: 345 ns, 1.87× the fastest -AES-256-GCM seal, 1350 B, OpenSSL on desktop: 186 ns, 1.75× the fastest -AES-256-GCM seal, 1350 B, OpenSSL on nixos2: 437 ns, 1.34× the fastest -AES-256-GCM seal, 1350 B, OpenSSL on ovh-iad: 707 ns, 1.35× the fastest -AES-256-GCM seal, 1350 B, OpenSSL on ovh-sea: 651 ns, 1.28× the fastest +AES-256-GCM seal, 1350 B, rind on ovh-sea: 507 ns, 1.00× the fastest; verified: rind's Lean proof, through Aeneas and hand models of the function-pointer dispatch, of the AES-NI key expansion and block cipher's raw-pointer loads, and of the SIMD intrinsics as Intel's manual defines them, of its AEAD API's AES-GCM key setup, seal, and open, for AAD and messages under 2^32 bytes, down to HACL*'s Vale AES-GCM routines, composed with Vale's F* proofs of Gcm_blocks_stdcall, Gcm_blocks_decrypt_stdcall, and Compute_iv_stdcall, of the code Vale prints at HACL* f557259007db, which rind imports +✓ +AES-256-GCM seal, 1350 B, aws-lc-rs on nixos: 311 ns, 1.69× the fastest +AES-256-GCM seal, 1350 B, aws-lc-rs on desktop: 173 ns, 1.63× the fastest +AES-256-GCM seal, 1350 B, aws-lc-rs on nixos2: 363 ns, 1.12× the fastest +AES-256-GCM seal, 1350 B, aws-lc-rs on kixtop: 205 ns, 1.00× the fastest +AES-256-GCM seal, 1350 B, aws-lc-rs on ovh-iad: 581 ns, 1.11× the fastest +AES-256-GCM seal, 1350 B, aws-lc-rs on ovh-sea: 556 ns, 1.10× the fastest +AES-256-GCM seal, 1350 B, ring on nixos: 205 ns, 1.11× the fastest +AES-256-GCM seal, 1350 B, ring on desktop: 133 ns, 1.25× the fastest +AES-256-GCM seal, 1350 B, ring on nixos2: 353 ns, 1.09× the fastest +AES-256-GCM seal, 1350 B, ring on kixtop: 220 ns, 1.07× the fastest +AES-256-GCM seal, 1350 B, ring on ovh-iad: 557 ns, 1.06× the fastest +AES-256-GCM seal, 1350 B, ring on ovh-sea: 550 ns, 1.08× the fastest +AES-256-GCM seal, 1350 B, RustCrypto + dalek on nixos: 489 ns, 2.65× the fastest +AES-256-GCM seal, 1350 B, RustCrypto + dalek on desktop: 313 ns, 2.94× the fastest +AES-256-GCM seal, 1350 B, RustCrypto + dalek on nixos2: 623 ns, 1.92× the fastest +AES-256-GCM seal, 1350 B, RustCrypto + dalek on kixtop: 246 ns, 1.20× the fastest +AES-256-GCM seal, 1350 B, RustCrypto + dalek on ovh-iad: 999 ns, 1.91× the fastest +AES-256-GCM seal, 1350 B, RustCrypto + dalek on ovh-sea: 958 ns, 1.89× the fastest +AES-256-GCM seal, 1350 B, graviola on nixos: 337 ns, 1.83× the fastest +AES-256-GCM seal, 1350 B, graviola on desktop: 258 ns, 2.42× the fastest +AES-256-GCM seal, 1350 B, graviola on nixos2: 476 ns, 1.46× the fastest +AES-256-GCM seal, 1350 B, graviola on kixtop: 262 ns, 1.28× the fastest +AES-256-GCM seal, 1350 B, libcrux on nixos: 6.91 µs, 37.50× the fastest +AES-256-GCM seal, 1350 B, libcrux on desktop: 2.83 µs, 26.55× the fastest +AES-256-GCM seal, 1350 B, libcrux on nixos2: 4.50 µs, 13.86× the fastest +AES-256-GCM seal, 1350 B, libcrux on kixtop: 650 ns, 3.18× the fastest +AES-256-GCM seal, 1350 B, libcrux on ovh-iad: 7.07 µs, 13.51× the fastest +AES-256-GCM seal, 1350 B, libcrux on ovh-sea: 6.92 µs, 13.63× the fastest +AES-256-GCM seal, 1350 B, OpenSSL on nixos: 345 ns, 1.87× the fastest +AES-256-GCM seal, 1350 B, OpenSSL on desktop: 186 ns, 1.75× the fastest +AES-256-GCM seal, 1350 B, OpenSSL on nixos2: 437 ns, 1.34× the fastest +AES-256-GCM seal, 1350 B, OpenSSL on kixtop: 222 ns, 1.08× the fastest +AES-256-GCM seal, 1350 B, OpenSSL on ovh-iad: 707 ns, 1.35× the fastest +AES-256-GCM seal, 1350 B, OpenSSL on ovh-sea: 651 ns, 1.28× the fastest AES-256-GCM seal, 16 KB AES-256-GCM seal, 16 KB, rind on nixos: 1.51 µs, 1.00× the fastest AES-256-GCM seal, 16 KB, rind on desktop: 925 ns, 1.00× the fastest AES-256-GCM seal, 16 KB, rind on nixos2: 3.22 µs, 1.00× the fastest; verified: rind's Lean proof, through Aeneas and hand models of the function-pointer dispatch, of the AES-NI key expansion and block cipher's raw-pointer loads, and of the SIMD intrinsics as Intel's manual defines them, of its AEAD API's AES-GCM key setup, seal, and open, for AAD and messages under 2^32 bytes, down to HACL*'s Vale AES-GCM routines, composed with Vale's F* proofs of Gcm_blocks_stdcall, Gcm_blocks_decrypt_stdcall, and Compute_iv_stdcall, of the code Vale prints at HACL* f557259007db, which rind imports ✓ -AES-256-GCM seal, 16 KB, rind on ovh-iad: 5.18 µs, 1.00× the fastest; verified: rind's Lean proof, through Aeneas and hand models of the function-pointer dispatch, of the AES-NI key expansion and block cipher's raw-pointer loads, and of the SIMD intrinsics as Intel's manual defines them, of its AEAD API's AES-GCM key setup, seal, and open, for AAD and messages under 2^32 bytes, down to HACL*'s Vale AES-GCM routines, composed with Vale's F* proofs of Gcm_blocks_stdcall, Gcm_blocks_decrypt_stdcall, and Compute_iv_stdcall, of the code Vale prints at HACL* f557259007db, which rind imports -✓ -AES-256-GCM seal, 16 KB, rind on ovh-sea: 4.99 µs, 1.00× the fastest; verified: rind's Lean proof, through Aeneas and hand models of the function-pointer dispatch, of the AES-NI key expansion and block cipher's raw-pointer loads, and of the SIMD intrinsics as Intel's manual defines them, of its AEAD API's AES-GCM key setup, seal, and open, for AAD and messages under 2^32 bytes, down to HACL*'s Vale AES-GCM routines, composed with Vale's F* proofs of Gcm_blocks_stdcall, Gcm_blocks_decrypt_stdcall, and Compute_iv_stdcall, of the code Vale prints at HACL* f557259007db, which rind imports +AES-256-GCM seal, 16 KB, rind on kixtop: 1.75 µs, 1.02× the fastest +AES-256-GCM seal, 16 KB, rind on ovh-iad: 5.18 µs, 1.00× the fastest; verified: rind's Lean proof, through Aeneas and hand models of the function-pointer dispatch, of the AES-NI key expansion and block cipher's raw-pointer loads, and of the SIMD intrinsics as Intel's manual defines them, of its AEAD API's AES-GCM key setup, seal, and open, for AAD and messages under 2^32 bytes, down to HACL*'s Vale AES-GCM routines, composed with Vale's F* proofs of Gcm_blocks_stdcall, Gcm_blocks_decrypt_stdcall, and Compute_iv_stdcall, of the code Vale prints at HACL* f557259007db, which rind imports ✓ -AES-256-GCM seal, 16 KB, aws-lc-rs on nixos: 2.78 µs, 1.84× the fastest -AES-256-GCM seal, 16 KB, aws-lc-rs on desktop: 1.56 µs, 1.69× the fastest -AES-256-GCM seal, 16 KB, aws-lc-rs on nixos2: 3.30 µs, 1.03× the fastest -AES-256-GCM seal, 16 KB, aws-lc-rs on ovh-iad: 5.46 µs, 1.05× the fastest -AES-256-GCM seal, 16 KB, aws-lc-rs on ovh-sea: 5.08 µs, 1.02× the fastest -AES-256-GCM seal, 16 KB, ring on nixos: 1.53 µs, 1.01× the fastest -AES-256-GCM seal, 16 KB, ring on desktop: 946 ns, 1.02× the fastest -AES-256-GCM seal, 16 KB, ring on nixos2: 3.25 µs, 1.01× the fastest -AES-256-GCM seal, 16 KB, ring on ovh-iad: 5.80 µs, 1.12× the fastest -AES-256-GCM seal, 16 KB, ring on ovh-sea: 4.97 µs, 1.00× the fastest -AES-256-GCM seal, 16 KB, RustCrypto + dalek on nixos: 4.78 µs, 3.16× the fastest -AES-256-GCM seal, 16 KB, RustCrypto + dalek on desktop: 2.91 µs, 3.14× the fastest -AES-256-GCM seal, 16 KB, RustCrypto + dalek on nixos2: 6.45 µs, 2.00× the fastest -AES-256-GCM seal, 16 KB, RustCrypto + dalek on ovh-iad: 10.56 µs, 2.04× the fastest -AES-256-GCM seal, 16 KB, RustCrypto + dalek on ovh-sea: 9.94 µs, 2.00× the fastest -AES-256-GCM seal, 16 KB, graviola on nixos: 2.98 µs, 1.97× the fastest -AES-256-GCM seal, 16 KB, graviola on desktop: 2.46 µs, 2.66× the fastest -AES-256-GCM seal, 16 KB, graviola on nixos2: 4.71 µs, 1.46× the fastest -AES-256-GCM seal, 16 KB, libcrux on nixos: 80.61 µs, 53.39× the fastest -AES-256-GCM seal, 16 KB, libcrux on desktop: 32.69 µs, 35.34× the fastest -AES-256-GCM seal, 16 KB, libcrux on nixos2: 50.92 µs, 15.81× the fastest -AES-256-GCM seal, 16 KB, libcrux on ovh-iad: 83.14 µs, 16.05× the fastest -AES-256-GCM seal, 16 KB, libcrux on ovh-sea: 78.50 µs, 15.79× the fastest -AES-256-GCM seal, 16 KB, OpenSSL on nixos: 2.82 µs, 1.87× the fastest -AES-256-GCM seal, 16 KB, OpenSSL on desktop: 1.59 µs, 1.72× the fastest -AES-256-GCM seal, 16 KB, OpenSSL on nixos2: 3.34 µs, 1.04× the fastest -AES-256-GCM seal, 16 KB, OpenSSL on ovh-iad: 5.20 µs, 1.00× the fastest -AES-256-GCM seal, 16 KB, OpenSSL on ovh-sea: 5.15 µs, 1.04× the fastest +AES-256-GCM seal, 16 KB, rind on ovh-sea: 4.99 µs, 1.00× the fastest; verified: rind's Lean proof, through Aeneas and hand models of the function-pointer dispatch, of the AES-NI key expansion and block cipher's raw-pointer loads, and of the SIMD intrinsics as Intel's manual defines them, of its AEAD API's AES-GCM key setup, seal, and open, for AAD and messages under 2^32 bytes, down to HACL*'s Vale AES-GCM routines, composed with Vale's F* proofs of Gcm_blocks_stdcall, Gcm_blocks_decrypt_stdcall, and Compute_iv_stdcall, of the code Vale prints at HACL* f557259007db, which rind imports +✓ +AES-256-GCM seal, 16 KB, aws-lc-rs on nixos: 2.78 µs, 1.84× the fastest +AES-256-GCM seal, 16 KB, aws-lc-rs on desktop: 1.56 µs, 1.69× the fastest +AES-256-GCM seal, 16 KB, aws-lc-rs on nixos2: 3.30 µs, 1.03× the fastest +AES-256-GCM seal, 16 KB, aws-lc-rs on kixtop: 1.72 µs, 1.00× the fastest +AES-256-GCM seal, 16 KB, aws-lc-rs on ovh-iad: 5.46 µs, 1.05× the fastest +AES-256-GCM seal, 16 KB, aws-lc-rs on ovh-sea: 5.08 µs, 1.02× the fastest +AES-256-GCM seal, 16 KB, ring on nixos: 1.53 µs, 1.01× the fastest +AES-256-GCM seal, 16 KB, ring on desktop: 946 ns, 1.02× the fastest +AES-256-GCM seal, 16 KB, ring on nixos2: 3.25 µs, 1.01× the fastest +AES-256-GCM seal, 16 KB, ring on kixtop: 2.04 µs, 1.19× the fastest +AES-256-GCM seal, 16 KB, ring on ovh-iad: 5.80 µs, 1.12× the fastest +AES-256-GCM seal, 16 KB, ring on ovh-sea: 4.97 µs, 1.00× the fastest +AES-256-GCM seal, 16 KB, RustCrypto + dalek on nixos: 4.78 µs, 3.16× the fastest +AES-256-GCM seal, 16 KB, RustCrypto + dalek on desktop: 2.91 µs, 3.14× the fastest +AES-256-GCM seal, 16 KB, RustCrypto + dalek on nixos2: 6.45 µs, 2.00× the fastest +AES-256-GCM seal, 16 KB, RustCrypto + dalek on kixtop: 2.72 µs, 1.58× the fastest +AES-256-GCM seal, 16 KB, RustCrypto + dalek on ovh-iad: 10.56 µs, 2.04× the fastest +AES-256-GCM seal, 16 KB, RustCrypto + dalek on ovh-sea: 9.94 µs, 2.00× the fastest +AES-256-GCM seal, 16 KB, graviola on nixos: 2.98 µs, 1.97× the fastest +AES-256-GCM seal, 16 KB, graviola on desktop: 2.46 µs, 2.66× the fastest +AES-256-GCM seal, 16 KB, graviola on nixos2: 4.71 µs, 1.46× the fastest +AES-256-GCM seal, 16 KB, graviola on kixtop: 2.16 µs, 1.26× the fastest +AES-256-GCM seal, 16 KB, libcrux on nixos: 80.61 µs, 53.39× the fastest +AES-256-GCM seal, 16 KB, libcrux on desktop: 32.69 µs, 35.34× the fastest +AES-256-GCM seal, 16 KB, libcrux on nixos2: 50.92 µs, 15.81× the fastest +AES-256-GCM seal, 16 KB, libcrux on kixtop: 7.20 µs, 4.19× the fastest +AES-256-GCM seal, 16 KB, libcrux on ovh-iad: 83.14 µs, 16.05× the fastest +AES-256-GCM seal, 16 KB, libcrux on ovh-sea: 78.50 µs, 15.79× the fastest +AES-256-GCM seal, 16 KB, OpenSSL on nixos: 2.82 µs, 1.87× the fastest +AES-256-GCM seal, 16 KB, OpenSSL on desktop: 1.59 µs, 1.72× the fastest +AES-256-GCM seal, 16 KB, OpenSSL on nixos2: 3.34 µs, 1.04× the fastest +AES-256-GCM seal, 16 KB, OpenSSL on kixtop: 1.79 µs, 1.04× the fastest +AES-256-GCM seal, 16 KB, OpenSSL on ovh-iad: 5.20 µs, 1.00× the fastest +AES-256-GCM seal, 16 KB, OpenSSL on ovh-sea: 5.15 µs, 1.04× the fastest AES-256-GCM open, 32 B AES-256-GCM open, 32 B, rind on nixos: 48 ns, 1.00× the fastest AES-256-GCM open, 32 B, rind on desktop: 28 ns, 1.00× the fastest AES-256-GCM open, 32 B, rind on nixos2: 45 ns, 1.00× the fastest; verified: rind's Lean proof, through Aeneas and hand models of the function-pointer dispatch, of the AES-NI key expansion and block cipher's raw-pointer loads, and of the SIMD intrinsics as Intel's manual defines them, of its AEAD API's AES-GCM key setup, seal, and open, for AAD and messages under 2^32 bytes, down to HACL*'s Vale AES-GCM routines, composed with Vale's F* proofs of Gcm_blocks_stdcall, Gcm_blocks_decrypt_stdcall, and Compute_iv_stdcall, of the code Vale prints at HACL* f557259007db, which rind imports ✓ -AES-256-GCM open, 32 B, rind on ovh-iad: 71 ns, 1.00× the fastest; verified: rind's Lean proof, through Aeneas and hand models of the function-pointer dispatch, of the AES-NI key expansion and block cipher's raw-pointer loads, and of the SIMD intrinsics as Intel's manual defines them, of its AEAD API's AES-GCM key setup, seal, and open, for AAD and messages under 2^32 bytes, down to HACL*'s Vale AES-GCM routines, composed with Vale's F* proofs of Gcm_blocks_stdcall, Gcm_blocks_decrypt_stdcall, and Compute_iv_stdcall, of the code Vale prints at HACL* f557259007db, which rind imports -✓ -AES-256-GCM open, 32 B, rind on ovh-sea: 69 ns, 1.00× the fastest; verified: rind's Lean proof, through Aeneas and hand models of the function-pointer dispatch, of the AES-NI key expansion and block cipher's raw-pointer loads, and of the SIMD intrinsics as Intel's manual defines them, of its AEAD API's AES-GCM key setup, seal, and open, for AAD and messages under 2^32 bytes, down to HACL*'s Vale AES-GCM routines, composed with Vale's F* proofs of Gcm_blocks_stdcall, Gcm_blocks_decrypt_stdcall, and Compute_iv_stdcall, of the code Vale prints at HACL* f557259007db, which rind imports +AES-256-GCM open, 32 B, rind on kixtop: 49 ns, 1.24× the fastest +AES-256-GCM open, 32 B, rind on ovh-iad: 71 ns, 1.00× the fastest; verified: rind's Lean proof, through Aeneas and hand models of the function-pointer dispatch, of the AES-NI key expansion and block cipher's raw-pointer loads, and of the SIMD intrinsics as Intel's manual defines them, of its AEAD API's AES-GCM key setup, seal, and open, for AAD and messages under 2^32 bytes, down to HACL*'s Vale AES-GCM routines, composed with Vale's F* proofs of Gcm_blocks_stdcall, Gcm_blocks_decrypt_stdcall, and Compute_iv_stdcall, of the code Vale prints at HACL* f557259007db, which rind imports ✓ -AES-256-GCM open, 32 B, aws-lc-rs on nixos: 79 ns, 1.62× the fastest -AES-256-GCM open, 32 B, aws-lc-rs on desktop: 38 ns, 1.37× the fastest -AES-256-GCM open, 32 B, aws-lc-rs on nixos2: 101 ns, 2.26× the fastest -AES-256-GCM open, 32 B, aws-lc-rs on ovh-iad: 150 ns, 2.10× the fastest -AES-256-GCM open, 32 B, aws-lc-rs on ovh-sea: 147 ns, 2.14× the fastest -AES-256-GCM open, 32 B, ring on nixos: 61 ns, 1.25× the fastest -AES-256-GCM open, 32 B, ring on desktop: 45 ns, 1.61× the fastest -AES-256-GCM open, 32 B, ring on nixos2: 107 ns, 2.39× the fastest -AES-256-GCM open, 32 B, ring on ovh-iad: 129 ns, 1.82× the fastest -AES-256-GCM open, 32 B, ring on ovh-sea: 126 ns, 1.83× the fastest -AES-256-GCM open, 32 B, RustCrypto + dalek on nixos: 109 ns, 2.24× the fastest -AES-256-GCM open, 32 B, RustCrypto + dalek on desktop: 82 ns, 2.98× the fastest -AES-256-GCM open, 32 B, RustCrypto + dalek on nixos2: 118 ns, 2.65× the fastest -AES-256-GCM open, 32 B, RustCrypto + dalek on ovh-iad: 177 ns, 2.49× the fastest -AES-256-GCM open, 32 B, RustCrypto + dalek on ovh-sea: 172 ns, 2.50× the fastest -AES-256-GCM open, 32 B, graviola on nixos: 68 ns, 1.39× the fastest -AES-256-GCM open, 32 B, graviola on desktop: 38 ns, 1.37× the fastest -AES-256-GCM open, 32 B, graviola on nixos2: 73 ns, 1.64× the fastest -AES-256-GCM open, 32 B, libcrux on nixos: 441 ns, 9.10× the fastest -AES-256-GCM open, 32 B, libcrux on desktop: 218 ns, 7.86× the fastest -AES-256-GCM open, 32 B, libcrux on nixos2: 363 ns, 8.12× the fastest -AES-256-GCM open, 32 B, libcrux on ovh-iad: 576 ns, 8.08× the fastest -AES-256-GCM open, 32 B, libcrux on ovh-sea: 563 ns, 8.16× the fastest -AES-256-GCM open, 32 B, OpenSSL on nixos: 122 ns, 2.52× the fastest -AES-256-GCM open, 32 B, OpenSSL on desktop: 62 ns, 2.22× the fastest -AES-256-GCM open, 32 B, OpenSSL on nixos2: 172 ns, 3.84× the fastest -AES-256-GCM open, 32 B, OpenSSL on ovh-iad: 269 ns, 3.78× the fastest -AES-256-GCM open, 32 B, OpenSSL on ovh-sea: 248 ns, 3.60× the fastest +AES-256-GCM open, 32 B, rind on ovh-sea: 69 ns, 1.00× the fastest; verified: rind's Lean proof, through Aeneas and hand models of the function-pointer dispatch, of the AES-NI key expansion and block cipher's raw-pointer loads, and of the SIMD intrinsics as Intel's manual defines them, of its AEAD API's AES-GCM key setup, seal, and open, for AAD and messages under 2^32 bytes, down to HACL*'s Vale AES-GCM routines, composed with Vale's F* proofs of Gcm_blocks_stdcall, Gcm_blocks_decrypt_stdcall, and Compute_iv_stdcall, of the code Vale prints at HACL* f557259007db, which rind imports +✓ +AES-256-GCM open, 32 B, aws-lc-rs on nixos: 79 ns, 1.62× the fastest +AES-256-GCM open, 32 B, aws-lc-rs on desktop: 38 ns, 1.37× the fastest +AES-256-GCM open, 32 B, aws-lc-rs on nixos2: 101 ns, 2.26× the fastest +AES-256-GCM open, 32 B, aws-lc-rs on kixtop: 49 ns, 1.24× the fastest +AES-256-GCM open, 32 B, aws-lc-rs on ovh-iad: 150 ns, 2.10× the fastest +AES-256-GCM open, 32 B, aws-lc-rs on ovh-sea: 147 ns, 2.14× the fastest +AES-256-GCM open, 32 B, ring on nixos: 61 ns, 1.25× the fastest +AES-256-GCM open, 32 B, ring on desktop: 45 ns, 1.61× the fastest +AES-256-GCM open, 32 B, ring on nixos2: 107 ns, 2.39× the fastest +AES-256-GCM open, 32 B, ring on kixtop: 40 ns, 1.00× the fastest +AES-256-GCM open, 32 B, ring on ovh-iad: 129 ns, 1.82× the fastest +AES-256-GCM open, 32 B, ring on ovh-sea: 126 ns, 1.83× the fastest +AES-256-GCM open, 32 B, RustCrypto + dalek on nixos: 109 ns, 2.24× the fastest +AES-256-GCM open, 32 B, RustCrypto + dalek on desktop: 82 ns, 2.98× the fastest +AES-256-GCM open, 32 B, RustCrypto + dalek on nixos2: 118 ns, 2.65× the fastest +AES-256-GCM open, 32 B, RustCrypto + dalek on kixtop: 41 ns, 1.04× the fastest +AES-256-GCM open, 32 B, RustCrypto + dalek on ovh-iad: 177 ns, 2.49× the fastest +AES-256-GCM open, 32 B, RustCrypto + dalek on ovh-sea: 172 ns, 2.50× the fastest +AES-256-GCM open, 32 B, graviola on nixos: 68 ns, 1.39× the fastest +AES-256-GCM open, 32 B, graviola on desktop: 38 ns, 1.37× the fastest +AES-256-GCM open, 32 B, graviola on nixos2: 73 ns, 1.64× the fastest +AES-256-GCM open, 32 B, graviola on kixtop: 85 ns, 2.15× the fastest +AES-256-GCM open, 32 B, libcrux on nixos: 441 ns, 9.10× the fastest +AES-256-GCM open, 32 B, libcrux on desktop: 218 ns, 7.86× the fastest +AES-256-GCM open, 32 B, libcrux on nixos2: 363 ns, 8.12× the fastest +AES-256-GCM open, 32 B, libcrux on kixtop: 67 ns, 1.69× the fastest +AES-256-GCM open, 32 B, libcrux on ovh-iad: 576 ns, 8.08× the fastest +AES-256-GCM open, 32 B, libcrux on ovh-sea: 563 ns, 8.16× the fastest +AES-256-GCM open, 32 B, OpenSSL on nixos: 122 ns, 2.52× the fastest +AES-256-GCM open, 32 B, OpenSSL on desktop: 62 ns, 2.22× the fastest +AES-256-GCM open, 32 B, OpenSSL on nixos2: 172 ns, 3.84× the fastest +AES-256-GCM open, 32 B, OpenSSL on kixtop: 68 ns, 1.71× the fastest +AES-256-GCM open, 32 B, OpenSSL on ovh-iad: 269 ns, 3.78× the fastest +AES-256-GCM open, 32 B, OpenSSL on ovh-sea: 248 ns, 3.60× the fastest AES-256-GCM open, 1350 B AES-256-GCM open, 1350 B, rind on nixos: 192 ns, 1.00× the fastest AES-256-GCM open, 1350 B, rind on desktop: 107 ns, 1.00× the fastest AES-256-GCM open, 1350 B, rind on nixos2: 328 ns, 1.00× the fastest; verified: rind's Lean proof, through Aeneas and hand models of the function-pointer dispatch, of the AES-NI key expansion and block cipher's raw-pointer loads, and of the SIMD intrinsics as Intel's manual defines them, of its AEAD API's AES-GCM key setup, seal, and open, for AAD and messages under 2^32 bytes, down to HACL*'s Vale AES-GCM routines, composed with Vale's F* proofs of Gcm_blocks_stdcall, Gcm_blocks_decrypt_stdcall, and Compute_iv_stdcall, of the code Vale prints at HACL* f557259007db, which rind imports ✓ -AES-256-GCM open, 1350 B, rind on ovh-iad: 497 ns, 1.00× the fastest; verified: rind's Lean proof, through Aeneas and hand models of the function-pointer dispatch, of the AES-NI key expansion and block cipher's raw-pointer loads, and of the SIMD intrinsics as Intel's manual defines them, of its AEAD API's AES-GCM key setup, seal, and open, for AAD and messages under 2^32 bytes, down to HACL*'s Vale AES-GCM routines, composed with Vale's F* proofs of Gcm_blocks_stdcall, Gcm_blocks_decrypt_stdcall, and Compute_iv_stdcall, of the code Vale prints at HACL* f557259007db, which rind imports -✓ -AES-256-GCM open, 1350 B, rind on ovh-sea: 482 ns, 1.00× the fastest; verified: rind's Lean proof, through Aeneas and hand models of the function-pointer dispatch, of the AES-NI key expansion and block cipher's raw-pointer loads, and of the SIMD intrinsics as Intel's manual defines them, of its AEAD API's AES-GCM key setup, seal, and open, for AAD and messages under 2^32 bytes, down to HACL*'s Vale AES-GCM routines, composed with Vale's F* proofs of Gcm_blocks_stdcall, Gcm_blocks_decrypt_stdcall, and Compute_iv_stdcall, of the code Vale prints at HACL* f557259007db, which rind imports +AES-256-GCM open, 1350 B, rind on kixtop: 233 ns, 1.07× the fastest +AES-256-GCM open, 1350 B, rind on ovh-iad: 497 ns, 1.00× the fastest; verified: rind's Lean proof, through Aeneas and hand models of the function-pointer dispatch, of the AES-NI key expansion and block cipher's raw-pointer loads, and of the SIMD intrinsics as Intel's manual defines them, of its AEAD API's AES-GCM key setup, seal, and open, for AAD and messages under 2^32 bytes, down to HACL*'s Vale AES-GCM routines, composed with Vale's F* proofs of Gcm_blocks_stdcall, Gcm_blocks_decrypt_stdcall, and Compute_iv_stdcall, of the code Vale prints at HACL* f557259007db, which rind imports ✓ -AES-256-GCM open, 1350 B, aws-lc-rs on nixos: 322 ns, 1.68× the fastest -AES-256-GCM open, 1350 B, aws-lc-rs on desktop: 173 ns, 1.62× the fastest -AES-256-GCM open, 1350 B, aws-lc-rs on nixos2: 422 ns, 1.29× the fastest -AES-256-GCM open, 1350 B, aws-lc-rs on ovh-iad: 581 ns, 1.17× the fastest -AES-256-GCM open, 1350 B, aws-lc-rs on ovh-sea: 566 ns, 1.17× the fastest -AES-256-GCM open, 1350 B, ring on nixos: 204 ns, 1.06× the fastest -AES-256-GCM open, 1350 B, ring on desktop: 124 ns, 1.16× the fastest -AES-256-GCM open, 1350 B, ring on nixos2: 388 ns, 1.18× the fastest -AES-256-GCM open, 1350 B, ring on ovh-iad: 566 ns, 1.14× the fastest -AES-256-GCM open, 1350 B, ring on ovh-sea: 544 ns, 1.13× the fastest -AES-256-GCM open, 1350 B, RustCrypto + dalek on nixos: 508 ns, 2.65× the fastest -AES-256-GCM open, 1350 B, RustCrypto + dalek on desktop: 322 ns, 3.01× the fastest -AES-256-GCM open, 1350 B, RustCrypto + dalek on nixos2: 677 ns, 2.06× the fastest -AES-256-GCM open, 1350 B, RustCrypto + dalek on ovh-iad: 1.01 µs, 2.03× the fastest -AES-256-GCM open, 1350 B, RustCrypto + dalek on ovh-sea: 1000 ns, 2.07× the fastest -AES-256-GCM open, 1350 B, graviola on nixos: 341 ns, 1.78× the fastest -AES-256-GCM open, 1350 B, graviola on desktop: 203 ns, 1.90× the fastest -AES-256-GCM open, 1350 B, graviola on nixos2: 510 ns, 1.56× the fastest -AES-256-GCM open, 1350 B, libcrux on nixos: 6.79 µs, 35.42× the fastest -AES-256-GCM open, 1350 B, libcrux on desktop: 2.85 µs, 26.66× the fastest -AES-256-GCM open, 1350 B, libcrux on nixos2: 4.74 µs, 14.46× the fastest -AES-256-GCM open, 1350 B, libcrux on ovh-iad: 6.90 µs, 13.90× the fastest -AES-256-GCM open, 1350 B, libcrux on ovh-sea: 6.91 µs, 14.32× the fastest -AES-256-GCM open, 1350 B, OpenSSL on nixos: 354 ns, 1.85× the fastest -AES-256-GCM open, 1350 B, OpenSSL on desktop: 189 ns, 1.77× the fastest -AES-256-GCM open, 1350 B, OpenSSL on nixos2: 643 ns, 1.96× the fastest -AES-256-GCM open, 1350 B, OpenSSL on ovh-iad: 673 ns, 1.35× the fastest -AES-256-GCM open, 1350 B, OpenSSL on ovh-sea: 661 ns, 1.37× the fastest +AES-256-GCM open, 1350 B, rind on ovh-sea: 482 ns, 1.00× the fastest; verified: rind's Lean proof, through Aeneas and hand models of the function-pointer dispatch, of the AES-NI key expansion and block cipher's raw-pointer loads, and of the SIMD intrinsics as Intel's manual defines them, of its AEAD API's AES-GCM key setup, seal, and open, for AAD and messages under 2^32 bytes, down to HACL*'s Vale AES-GCM routines, composed with Vale's F* proofs of Gcm_blocks_stdcall, Gcm_blocks_decrypt_stdcall, and Compute_iv_stdcall, of the code Vale prints at HACL* f557259007db, which rind imports +✓ +AES-256-GCM open, 1350 B, aws-lc-rs on nixos: 322 ns, 1.68× the fastest +AES-256-GCM open, 1350 B, aws-lc-rs on desktop: 173 ns, 1.62× the fastest +AES-256-GCM open, 1350 B, aws-lc-rs on nixos2: 422 ns, 1.29× the fastest +AES-256-GCM open, 1350 B, aws-lc-rs on kixtop: 218 ns, 1.00× the fastest +AES-256-GCM open, 1350 B, aws-lc-rs on ovh-iad: 581 ns, 1.17× the fastest +AES-256-GCM open, 1350 B, aws-lc-rs on ovh-sea: 566 ns, 1.17× the fastest +AES-256-GCM open, 1350 B, ring on nixos: 204 ns, 1.06× the fastest +AES-256-GCM open, 1350 B, ring on desktop: 124 ns, 1.16× the fastest +AES-256-GCM open, 1350 B, ring on nixos2: 388 ns, 1.18× the fastest +AES-256-GCM open, 1350 B, ring on kixtop: 252 ns, 1.15× the fastest +AES-256-GCM open, 1350 B, ring on ovh-iad: 566 ns, 1.14× the fastest +AES-256-GCM open, 1350 B, ring on ovh-sea: 544 ns, 1.13× the fastest +AES-256-GCM open, 1350 B, RustCrypto + dalek on nixos: 508 ns, 2.65× the fastest +AES-256-GCM open, 1350 B, RustCrypto + dalek on desktop: 322 ns, 3.01× the fastest +AES-256-GCM open, 1350 B, RustCrypto + dalek on nixos2: 677 ns, 2.06× the fastest +AES-256-GCM open, 1350 B, RustCrypto + dalek on kixtop: 267 ns, 1.22× the fastest +AES-256-GCM open, 1350 B, RustCrypto + dalek on ovh-iad: 1.01 µs, 2.03× the fastest +AES-256-GCM open, 1350 B, RustCrypto + dalek on ovh-sea: 1000 ns, 2.07× the fastest +AES-256-GCM open, 1350 B, graviola on nixos: 341 ns, 1.78× the fastest +AES-256-GCM open, 1350 B, graviola on desktop: 203 ns, 1.90× the fastest +AES-256-GCM open, 1350 B, graviola on nixos2: 510 ns, 1.56× the fastest +AES-256-GCM open, 1350 B, graviola on kixtop: 263 ns, 1.20× the fastest +AES-256-GCM open, 1350 B, libcrux on nixos: 6.79 µs, 35.42× the fastest +AES-256-GCM open, 1350 B, libcrux on desktop: 2.85 µs, 26.66× the fastest +AES-256-GCM open, 1350 B, libcrux on nixos2: 4.74 µs, 14.46× the fastest +AES-256-GCM open, 1350 B, libcrux on kixtop: 674 ns, 3.09× the fastest +AES-256-GCM open, 1350 B, libcrux on ovh-iad: 6.90 µs, 13.90× the fastest +AES-256-GCM open, 1350 B, libcrux on ovh-sea: 6.91 µs, 14.32× the fastest +AES-256-GCM open, 1350 B, OpenSSL on nixos: 354 ns, 1.85× the fastest +AES-256-GCM open, 1350 B, OpenSSL on desktop: 189 ns, 1.77× the fastest +AES-256-GCM open, 1350 B, OpenSSL on nixos2: 643 ns, 1.96× the fastest +AES-256-GCM open, 1350 B, OpenSSL on kixtop: 225 ns, 1.03× the fastest +AES-256-GCM open, 1350 B, OpenSSL on ovh-iad: 673 ns, 1.35× the fastest +AES-256-GCM open, 1350 B, OpenSSL on ovh-sea: 661 ns, 1.37× the fastest AES-256-GCM open, 16 KB AES-256-GCM open, 16 KB, rind on nixos: 1.60 µs, 1.00× the fastest AES-256-GCM open, 16 KB, rind on desktop: 917 ns, 1.00× the fastest AES-256-GCM open, 16 KB, rind on nixos2: 3.62 µs, 1.00× the fastest; verified: rind's Lean proof, through Aeneas and hand models of the function-pointer dispatch, of the AES-NI key expansion and block cipher's raw-pointer loads, and of the SIMD intrinsics as Intel's manual defines them, of its AEAD API's AES-GCM key setup, seal, and open, for AAD and messages under 2^32 bytes, down to HACL*'s Vale AES-GCM routines, composed with Vale's F* proofs of Gcm_blocks_stdcall, Gcm_blocks_decrypt_stdcall, and Compute_iv_stdcall, of the code Vale prints at HACL* f557259007db, which rind imports ✓ -AES-256-GCM open, 16 KB, rind on ovh-iad: 5.26 µs, 1.00× the fastest; verified: rind's Lean proof, through Aeneas and hand models of the function-pointer dispatch, of the AES-NI key expansion and block cipher's raw-pointer loads, and of the SIMD intrinsics as Intel's manual defines them, of its AEAD API's AES-GCM key setup, seal, and open, for AAD and messages under 2^32 bytes, down to HACL*'s Vale AES-GCM routines, composed with Vale's F* proofs of Gcm_blocks_stdcall, Gcm_blocks_decrypt_stdcall, and Compute_iv_stdcall, of the code Vale prints at HACL* f557259007db, which rind imports -✓ -AES-256-GCM open, 16 KB, rind on ovh-sea: 5.13 µs, 1.00× the fastest; verified: rind's Lean proof, through Aeneas and hand models of the function-pointer dispatch, of the AES-NI key expansion and block cipher's raw-pointer loads, and of the SIMD intrinsics as Intel's manual defines them, of its AEAD API's AES-GCM key setup, seal, and open, for AAD and messages under 2^32 bytes, down to HACL*'s Vale AES-GCM routines, composed with Vale's F* proofs of Gcm_blocks_stdcall, Gcm_blocks_decrypt_stdcall, and Compute_iv_stdcall, of the code Vale prints at HACL* f557259007db, which rind imports +AES-256-GCM open, 16 KB, rind on kixtop: 1.86 µs, 1.01× the fastest +AES-256-GCM open, 16 KB, rind on ovh-iad: 5.26 µs, 1.00× the fastest; verified: rind's Lean proof, through Aeneas and hand models of the function-pointer dispatch, of the AES-NI key expansion and block cipher's raw-pointer loads, and of the SIMD intrinsics as Intel's manual defines them, of its AEAD API's AES-GCM key setup, seal, and open, for AAD and messages under 2^32 bytes, down to HACL*'s Vale AES-GCM routines, composed with Vale's F* proofs of Gcm_blocks_stdcall, Gcm_blocks_decrypt_stdcall, and Compute_iv_stdcall, of the code Vale prints at HACL* f557259007db, which rind imports ✓ -AES-256-GCM open, 16 KB, aws-lc-rs on nixos: 2.92 µs, 1.82× the fastest -AES-256-GCM open, 16 KB, aws-lc-rs on desktop: 1.57 µs, 1.71× the fastest -AES-256-GCM open, 16 KB, aws-lc-rs on nixos2: 3.69 µs, 1.02× the fastest -AES-256-GCM open, 16 KB, aws-lc-rs on ovh-iad: 5.35 µs, 1.02× the fastest -AES-256-GCM open, 16 KB, aws-lc-rs on ovh-sea: 5.25 µs, 1.02× the fastest -AES-256-GCM open, 16 KB, ring on nixos: 1.62 µs, 1.01× the fastest -AES-256-GCM open, 16 KB, ring on desktop: 921 ns, 1.00× the fastest -AES-256-GCM open, 16 KB, ring on nixos2: 3.70 µs, 1.02× the fastest -AES-256-GCM open, 16 KB, ring on ovh-iad: 5.38 µs, 1.02× the fastest -AES-256-GCM open, 16 KB, ring on ovh-sea: 5.23 µs, 1.02× the fastest -AES-256-GCM open, 16 KB, RustCrypto + dalek on nixos: 4.93 µs, 3.08× the fastest -AES-256-GCM open, 16 KB, RustCrypto + dalek on desktop: 2.96 µs, 3.23× the fastest -AES-256-GCM open, 16 KB, RustCrypto + dalek on nixos2: 7.23 µs, 2.00× the fastest -AES-256-GCM open, 16 KB, RustCrypto + dalek on ovh-iad: 10.17 µs, 1.93× the fastest -AES-256-GCM open, 16 KB, RustCrypto + dalek on ovh-sea: 10.04 µs, 1.96× the fastest -AES-256-GCM open, 16 KB, graviola on nixos: 3.04 µs, 1.90× the fastest -AES-256-GCM open, 16 KB, graviola on desktop: 1.74 µs, 1.90× the fastest -AES-256-GCM open, 16 KB, graviola on nixos2: 4.54 µs, 1.25× the fastest -AES-256-GCM open, 16 KB, libcrux on nixos: 79.19 µs, 49.38× the fastest -AES-256-GCM open, 16 KB, libcrux on desktop: 32.51 µs, 35.44× the fastest -AES-256-GCM open, 16 KB, libcrux on nixos2: 53.96 µs, 14.91× the fastest -AES-256-GCM open, 16 KB, libcrux on ovh-iad: 82.11 µs, 15.61× the fastest -AES-256-GCM open, 16 KB, libcrux on ovh-sea: 78.36 µs, 15.27× the fastest -AES-256-GCM open, 16 KB, OpenSSL on nixos: 2.98 µs, 1.86× the fastest -AES-256-GCM open, 16 KB, OpenSSL on desktop: 1.60 µs, 1.75× the fastest -AES-256-GCM open, 16 KB, OpenSSL on nixos2: 3.87 µs, 1.07× the fastest -AES-256-GCM open, 16 KB, OpenSSL on ovh-iad: 5.83 µs, 1.11× the fastest -AES-256-GCM open, 16 KB, OpenSSL on ovh-sea: 5.43 µs, 1.06× the fastest +AES-256-GCM open, 16 KB, rind on ovh-sea: 5.13 µs, 1.00× the fastest; verified: rind's Lean proof, through Aeneas and hand models of the function-pointer dispatch, of the AES-NI key expansion and block cipher's raw-pointer loads, and of the SIMD intrinsics as Intel's manual defines them, of its AEAD API's AES-GCM key setup, seal, and open, for AAD and messages under 2^32 bytes, down to HACL*'s Vale AES-GCM routines, composed with Vale's F* proofs of Gcm_blocks_stdcall, Gcm_blocks_decrypt_stdcall, and Compute_iv_stdcall, of the code Vale prints at HACL* f557259007db, which rind imports +✓ +AES-256-GCM open, 16 KB, aws-lc-rs on nixos: 2.92 µs, 1.82× the fastest +AES-256-GCM open, 16 KB, aws-lc-rs on desktop: 1.57 µs, 1.71× the fastest +AES-256-GCM open, 16 KB, aws-lc-rs on nixos2: 3.69 µs, 1.02× the fastest +AES-256-GCM open, 16 KB, aws-lc-rs on kixtop: 1.83 µs, 1.00× the fastest +AES-256-GCM open, 16 KB, aws-lc-rs on ovh-iad: 5.35 µs, 1.02× the fastest +AES-256-GCM open, 16 KB, aws-lc-rs on ovh-sea: 5.25 µs, 1.02× the fastest +AES-256-GCM open, 16 KB, ring on nixos: 1.62 µs, 1.01× the fastest +AES-256-GCM open, 16 KB, ring on desktop: 921 ns, 1.00× the fastest +AES-256-GCM open, 16 KB, ring on nixos2: 3.70 µs, 1.02× the fastest +AES-256-GCM open, 16 KB, ring on kixtop: 2.25 µs, 1.23× the fastest +AES-256-GCM open, 16 KB, ring on ovh-iad: 5.38 µs, 1.02× the fastest +AES-256-GCM open, 16 KB, ring on ovh-sea: 5.23 µs, 1.02× the fastest +AES-256-GCM open, 16 KB, RustCrypto + dalek on nixos: 4.93 µs, 3.08× the fastest +AES-256-GCM open, 16 KB, RustCrypto + dalek on desktop: 2.96 µs, 3.23× the fastest +AES-256-GCM open, 16 KB, RustCrypto + dalek on nixos2: 7.23 µs, 2.00× the fastest +AES-256-GCM open, 16 KB, RustCrypto + dalek on kixtop: 2.89 µs, 1.58× the fastest +AES-256-GCM open, 16 KB, RustCrypto + dalek on ovh-iad: 10.17 µs, 1.93× the fastest +AES-256-GCM open, 16 KB, RustCrypto + dalek on ovh-sea: 10.04 µs, 1.96× the fastest +AES-256-GCM open, 16 KB, graviola on nixos: 3.04 µs, 1.90× the fastest +AES-256-GCM open, 16 KB, graviola on desktop: 1.74 µs, 1.90× the fastest +AES-256-GCM open, 16 KB, graviola on nixos2: 4.54 µs, 1.25× the fastest +AES-256-GCM open, 16 KB, graviola on kixtop: 2.18 µs, 1.19× the fastest +AES-256-GCM open, 16 KB, libcrux on nixos: 79.19 µs, 49.38× the fastest +AES-256-GCM open, 16 KB, libcrux on desktop: 32.51 µs, 35.44× the fastest +AES-256-GCM open, 16 KB, libcrux on nixos2: 53.96 µs, 14.91× the fastest +AES-256-GCM open, 16 KB, libcrux on kixtop: 7.35 µs, 4.01× the fastest +AES-256-GCM open, 16 KB, libcrux on ovh-iad: 82.11 µs, 15.61× the fastest +AES-256-GCM open, 16 KB, libcrux on ovh-sea: 78.36 µs, 15.27× the fastest +AES-256-GCM open, 16 KB, OpenSSL on nixos: 2.98 µs, 1.86× the fastest +AES-256-GCM open, 16 KB, OpenSSL on desktop: 1.60 µs, 1.75× the fastest +AES-256-GCM open, 16 KB, OpenSSL on nixos2: 3.87 µs, 1.07× the fastest +AES-256-GCM open, 16 KB, OpenSSL on kixtop: 1.94 µs, 1.06× the fastest +AES-256-GCM open, 16 KB, OpenSSL on ovh-iad: 5.83 µs, 1.11× the fastest +AES-256-GCM open, 16 KB, OpenSSL on ovh-sea: 5.43 µs, 1.06× the fastest ChaCha20-Poly1305 seal, 32 B ChaCha20-Poly1305 seal, 32 B, rind on nixos: 114 ns, 1.01× the fastest ChaCha20-Poly1305 seal, 32 B, rind on desktop: 100 ns, 1.00× the fastest ChaCha20-Poly1305 seal, 32 B, rind on nixos2: 129 ns, 1.00× the fastest -ChaCha20-Poly1305 seal, 32 B, rind on ovh-iad: 192 ns, 1.00× the fastest -ChaCha20-Poly1305 seal, 32 B, rind on ovh-sea: 188 ns, 1.00× the fastest -ChaCha20-Poly1305 seal, 32 B, aws-lc-rs on nixos: 119 ns, 1.06× the fastest -ChaCha20-Poly1305 seal, 32 B, aws-lc-rs on desktop: 105 ns, 1.05× the fastest -ChaCha20-Poly1305 seal, 32 B, aws-lc-rs on nixos2: 149 ns, 1.15× the fastest -ChaCha20-Poly1305 seal, 32 B, aws-lc-rs on ovh-iad: 215 ns, 1.12× the fastest -ChaCha20-Poly1305 seal, 32 B, aws-lc-rs on ovh-sea: 210 ns, 1.11× the fastest -ChaCha20-Poly1305 seal, 32 B, ring on nixos: 113 ns, 1.00× the fastest -ChaCha20-Poly1305 seal, 32 B, ring on desktop: 101 ns, 1.01× the fastest -ChaCha20-Poly1305 seal, 32 B, ring on nixos2: 130 ns, 1.01× the fastest -ChaCha20-Poly1305 seal, 32 B, ring on ovh-iad: 196 ns, 1.02× the fastest -ChaCha20-Poly1305 seal, 32 B, ring on ovh-sea: 189 ns, 1.00× the fastest -ChaCha20-Poly1305 seal, 32 B, RustCrypto + dalek on nixos: 1.18 µs, 10.48× the fastest -ChaCha20-Poly1305 seal, 32 B, RustCrypto + dalek on desktop: 1.07 µs, 10.75× the fastest -ChaCha20-Poly1305 seal, 32 B, RustCrypto + dalek on nixos2: 1.21 µs, 9.37× the fastest -ChaCha20-Poly1305 seal, 32 B, RustCrypto + dalek on ovh-iad: 1.84 µs, 9.54× the fastest -ChaCha20-Poly1305 seal, 32 B, RustCrypto + dalek on ovh-sea: 1.75 µs, 9.29× the fastest -ChaCha20-Poly1305 seal, 32 B, graviola on nixos: 216 ns, 1.92× the fastest -ChaCha20-Poly1305 seal, 32 B, graviola on desktop: 180 ns, 1.80× the fastest -ChaCha20-Poly1305 seal, 32 B, graviola on nixos2: 232 ns, 1.80× the fastest -ChaCha20-Poly1305 seal, 32 B, libcrux on nixos: 220 ns, 1.96× the fastest; verified: HACL*'s F* proof of Hacl.Chacha20Poly1305_32, compiled to Rust by an unverified step -✓ -ChaCha20-Poly1305 seal, 32 B, libcrux on desktop: 157 ns, 1.57× the fastest; verified: HACL*'s F* proof of Hacl.Chacha20Poly1305_32, compiled to Rust by an unverified step -✓ -ChaCha20-Poly1305 seal, 32 B, libcrux on nixos2: 301 ns, 2.33× the fastest; verified: HACL*'s F* proof of Hacl.Chacha20Poly1305_32, compiled to Rust by an unverified step -✓ -ChaCha20-Poly1305 seal, 32 B, libcrux on ovh-iad: 428 ns, 2.22× the fastest; verified: HACL*'s F* proof of Hacl.Chacha20Poly1305_32, compiled to Rust by an unverified step -✓ -ChaCha20-Poly1305 seal, 32 B, libcrux on ovh-sea: 416 ns, 2.21× the fastest; verified: HACL*'s F* proof of Hacl.Chacha20Poly1305_32, compiled to Rust by an unverified step -✓ -ChaCha20-Poly1305 seal, 32 B, OpenSSL on nixos: 257 ns, 2.29× the fastest -ChaCha20-Poly1305 seal, 32 B, OpenSSL on desktop: 177 ns, 1.77× the fastest -ChaCha20-Poly1305 seal, 32 B, OpenSSL on nixos2: 337 ns, 2.61× the fastest -ChaCha20-Poly1305 seal, 32 B, OpenSSL on ovh-iad: 526 ns, 2.73× the fastest -ChaCha20-Poly1305 seal, 32 B, OpenSSL on ovh-sea: 489 ns, 2.59× the fastest +ChaCha20-Poly1305 seal, 32 B, rind on kixtop: 185 ns, 1.25× the fastest +ChaCha20-Poly1305 seal, 32 B, rind on ovh-iad: 192 ns, 1.00× the fastest +ChaCha20-Poly1305 seal, 32 B, rind on ovh-sea: 188 ns, 1.00× the fastest +ChaCha20-Poly1305 seal, 32 B, aws-lc-rs on nixos: 119 ns, 1.06× the fastest +ChaCha20-Poly1305 seal, 32 B, aws-lc-rs on desktop: 105 ns, 1.05× the fastest +ChaCha20-Poly1305 seal, 32 B, aws-lc-rs on nixos2: 149 ns, 1.15× the fastest +ChaCha20-Poly1305 seal, 32 B, aws-lc-rs on kixtop: 163 ns, 1.10× the fastest +ChaCha20-Poly1305 seal, 32 B, aws-lc-rs on ovh-iad: 215 ns, 1.12× the fastest +ChaCha20-Poly1305 seal, 32 B, aws-lc-rs on ovh-sea: 210 ns, 1.11× the fastest +ChaCha20-Poly1305 seal, 32 B, ring on nixos: 113 ns, 1.00× the fastest +ChaCha20-Poly1305 seal, 32 B, ring on desktop: 101 ns, 1.01× the fastest +ChaCha20-Poly1305 seal, 32 B, ring on nixos2: 130 ns, 1.01× the fastest +ChaCha20-Poly1305 seal, 32 B, ring on kixtop: 148 ns, 1.00× the fastest +ChaCha20-Poly1305 seal, 32 B, ring on ovh-iad: 196 ns, 1.02× the fastest +ChaCha20-Poly1305 seal, 32 B, ring on ovh-sea: 189 ns, 1.00× the fastest +ChaCha20-Poly1305 seal, 32 B, RustCrypto + dalek on nixos: 1.18 µs, 10.48× the fastest +ChaCha20-Poly1305 seal, 32 B, RustCrypto + dalek on desktop: 1.07 µs, 10.75× the fastest +ChaCha20-Poly1305 seal, 32 B, RustCrypto + dalek on nixos2: 1.21 µs, 9.37× the fastest +ChaCha20-Poly1305 seal, 32 B, RustCrypto + dalek on kixtop: 344 ns, 2.33× the fastest +ChaCha20-Poly1305 seal, 32 B, RustCrypto + dalek on ovh-iad: 1.84 µs, 9.54× the fastest +ChaCha20-Poly1305 seal, 32 B, RustCrypto + dalek on ovh-sea: 1.75 µs, 9.29× the fastest +ChaCha20-Poly1305 seal, 32 B, graviola on nixos: 216 ns, 1.92× the fastest +ChaCha20-Poly1305 seal, 32 B, graviola on desktop: 180 ns, 1.80× the fastest +ChaCha20-Poly1305 seal, 32 B, graviola on nixos2: 232 ns, 1.80× the fastest +ChaCha20-Poly1305 seal, 32 B, graviola on kixtop: 196 ns, 1.32× the fastest +ChaCha20-Poly1305 seal, 32 B, libcrux on nixos: 220 ns, 1.96× the fastest; verified: HACL*'s F* proof of Hacl.Chacha20Poly1305_32, compiled to Rust by an unverified step +✓ +ChaCha20-Poly1305 seal, 32 B, libcrux on desktop: 157 ns, 1.57× the fastest; verified: HACL*'s F* proof of Hacl.Chacha20Poly1305_32, compiled to Rust by an unverified step +✓ +ChaCha20-Poly1305 seal, 32 B, libcrux on nixos2: 301 ns, 2.33× the fastest; verified: HACL*'s F* proof of Hacl.Chacha20Poly1305_32, compiled to Rust by an unverified step +✓ +ChaCha20-Poly1305 seal, 32 B, libcrux on kixtop: 171 ns, 1.16× the fastest; verified: HACL*'s F* proof of Hacl.Chacha20Poly1305_32, compiled to Rust by an unverified step +✓ +ChaCha20-Poly1305 seal, 32 B, libcrux on ovh-iad: 428 ns, 2.22× the fastest; verified: HACL*'s F* proof of Hacl.Chacha20Poly1305_32, compiled to Rust by an unverified step +✓ +ChaCha20-Poly1305 seal, 32 B, libcrux on ovh-sea: 416 ns, 2.21× the fastest; verified: HACL*'s F* proof of Hacl.Chacha20Poly1305_32, compiled to Rust by an unverified step +✓ +ChaCha20-Poly1305 seal, 32 B, OpenSSL on nixos: 257 ns, 2.29× the fastest +ChaCha20-Poly1305 seal, 32 B, OpenSSL on desktop: 177 ns, 1.77× the fastest +ChaCha20-Poly1305 seal, 32 B, OpenSSL on nixos2: 337 ns, 2.61× the fastest +ChaCha20-Poly1305 seal, 32 B, OpenSSL on kixtop: 215 ns, 1.46× the fastest +ChaCha20-Poly1305 seal, 32 B, OpenSSL on ovh-iad: 526 ns, 2.73× the fastest +ChaCha20-Poly1305 seal, 32 B, OpenSSL on ovh-sea: 489 ns, 2.59× the fastest ChaCha20-Poly1305 seal, 1350 B ChaCha20-Poly1305 seal, 1350 B, rind on nixos: 533 ns, 1.01× the fastest ChaCha20-Poly1305 seal, 1350 B, rind on desktop: 441 ns, 1.00× the fastest ChaCha20-Poly1305 seal, 1350 B, rind on nixos2: 718 ns, 1.00× the fastest -ChaCha20-Poly1305 seal, 1350 B, rind on ovh-iad: 1.07 µs, 1.00× the fastest -ChaCha20-Poly1305 seal, 1350 B, rind on ovh-sea: 1.04 µs, 1.00× the fastest -ChaCha20-Poly1305 seal, 1350 B, aws-lc-rs on nixos: 532 ns, 1.01× the fastest -ChaCha20-Poly1305 seal, 1350 B, aws-lc-rs on desktop: 453 ns, 1.03× the fastest -ChaCha20-Poly1305 seal, 1350 B, aws-lc-rs on nixos2: 755 ns, 1.06× the fastest -ChaCha20-Poly1305 seal, 1350 B, aws-lc-rs on ovh-iad: 1.10 µs, 1.03× the fastest -ChaCha20-Poly1305 seal, 1350 B, aws-lc-rs on ovh-sea: 1.05 µs, 1.02× the fastest -ChaCha20-Poly1305 seal, 1350 B, ring on nixos: 527 ns, 1.00× the fastest -ChaCha20-Poly1305 seal, 1350 B, ring on desktop: 447 ns, 1.01× the fastest -ChaCha20-Poly1305 seal, 1350 B, ring on nixos2: 714 ns, 1.00× the fastest -ChaCha20-Poly1305 seal, 1350 B, ring on ovh-iad: 1.08 µs, 1.00× the fastest -ChaCha20-Poly1305 seal, 1350 B, ring on ovh-sea: 1.04 µs, 1.00× the fastest -ChaCha20-Poly1305 seal, 1350 B, RustCrypto + dalek on nixos: 1.93 µs, 3.65× the fastest -ChaCha20-Poly1305 seal, 1350 B, RustCrypto + dalek on desktop: 1.67 µs, 3.79× the fastest -ChaCha20-Poly1305 seal, 1350 B, RustCrypto + dalek on nixos2: 2.18 µs, 3.05× the fastest -ChaCha20-Poly1305 seal, 1350 B, RustCrypto + dalek on ovh-iad: 3.26 µs, 3.04× the fastest -ChaCha20-Poly1305 seal, 1350 B, RustCrypto + dalek on ovh-sea: 3.15 µs, 3.04× the fastest -ChaCha20-Poly1305 seal, 1350 B, graviola on nixos: 1.08 µs, 2.05× the fastest -ChaCha20-Poly1305 seal, 1350 B, graviola on desktop: 905 ns, 2.05× the fastest -ChaCha20-Poly1305 seal, 1350 B, graviola on nixos2: 1.29 µs, 1.81× the fastest -ChaCha20-Poly1305 seal, 1350 B, libcrux on nixos: 2.34 µs, 4.43× the fastest; verified: HACL*'s F* proof of Hacl.Chacha20Poly1305_32, compiled to Rust by an unverified step -✓ -ChaCha20-Poly1305 seal, 1350 B, libcrux on desktop: 1.78 µs, 4.03× the fastest; verified: HACL*'s F* proof of Hacl.Chacha20Poly1305_32, compiled to Rust by an unverified step -✓ -ChaCha20-Poly1305 seal, 1350 B, libcrux on nixos2: 3.16 µs, 4.43× the fastest; verified: HACL*'s F* proof of Hacl.Chacha20Poly1305_32, compiled to Rust by an unverified step -✓ -ChaCha20-Poly1305 seal, 1350 B, libcrux on ovh-iad: 4.73 µs, 4.40× the fastest; verified: HACL*'s F* proof of Hacl.Chacha20Poly1305_32, compiled to Rust by an unverified step -✓ -ChaCha20-Poly1305 seal, 1350 B, libcrux on ovh-sea: 4.60 µs, 4.43× the fastest; verified: HACL*'s F* proof of Hacl.Chacha20Poly1305_32, compiled to Rust by an unverified step -✓ -ChaCha20-Poly1305 seal, 1350 B, OpenSSL on nixos: 745 ns, 1.41× the fastest -ChaCha20-Poly1305 seal, 1350 B, OpenSSL on desktop: 590 ns, 1.34× the fastest -ChaCha20-Poly1305 seal, 1350 B, OpenSSL on nixos2: 971 ns, 1.36× the fastest -ChaCha20-Poly1305 seal, 1350 B, OpenSSL on ovh-iad: 1.68 µs, 1.57× the fastest -ChaCha20-Poly1305 seal, 1350 B, OpenSSL on ovh-sea: 1.58 µs, 1.53× the fastest +ChaCha20-Poly1305 seal, 1350 B, rind on kixtop: 792 ns, 1.05× the fastest +ChaCha20-Poly1305 seal, 1350 B, rind on ovh-iad: 1.07 µs, 1.00× the fastest +ChaCha20-Poly1305 seal, 1350 B, rind on ovh-sea: 1.04 µs, 1.00× the fastest +ChaCha20-Poly1305 seal, 1350 B, aws-lc-rs on nixos: 532 ns, 1.01× the fastest +ChaCha20-Poly1305 seal, 1350 B, aws-lc-rs on desktop: 453 ns, 1.03× the fastest +ChaCha20-Poly1305 seal, 1350 B, aws-lc-rs on nixos2: 755 ns, 1.06× the fastest +ChaCha20-Poly1305 seal, 1350 B, aws-lc-rs on kixtop: 771 ns, 1.02× the fastest +ChaCha20-Poly1305 seal, 1350 B, aws-lc-rs on ovh-iad: 1.10 µs, 1.03× the fastest +ChaCha20-Poly1305 seal, 1350 B, aws-lc-rs on ovh-sea: 1.05 µs, 1.02× the fastest +ChaCha20-Poly1305 seal, 1350 B, ring on nixos: 527 ns, 1.00× the fastest +ChaCha20-Poly1305 seal, 1350 B, ring on desktop: 447 ns, 1.01× the fastest +ChaCha20-Poly1305 seal, 1350 B, ring on nixos2: 714 ns, 1.00× the fastest +ChaCha20-Poly1305 seal, 1350 B, ring on kixtop: 755 ns, 1.00× the fastest +ChaCha20-Poly1305 seal, 1350 B, ring on ovh-iad: 1.08 µs, 1.00× the fastest +ChaCha20-Poly1305 seal, 1350 B, ring on ovh-sea: 1.04 µs, 1.00× the fastest +ChaCha20-Poly1305 seal, 1350 B, RustCrypto + dalek on nixos: 1.93 µs, 3.65× the fastest +ChaCha20-Poly1305 seal, 1350 B, RustCrypto + dalek on desktop: 1.67 µs, 3.79× the fastest +ChaCha20-Poly1305 seal, 1350 B, RustCrypto + dalek on nixos2: 2.18 µs, 3.05× the fastest +ChaCha20-Poly1305 seal, 1350 B, RustCrypto + dalek on kixtop: 1.78 µs, 2.36× the fastest +ChaCha20-Poly1305 seal, 1350 B, RustCrypto + dalek on ovh-iad: 3.26 µs, 3.04× the fastest +ChaCha20-Poly1305 seal, 1350 B, RustCrypto + dalek on ovh-sea: 3.15 µs, 3.04× the fastest +ChaCha20-Poly1305 seal, 1350 B, graviola on nixos: 1.08 µs, 2.05× the fastest +ChaCha20-Poly1305 seal, 1350 B, graviola on desktop: 905 ns, 2.05× the fastest +ChaCha20-Poly1305 seal, 1350 B, graviola on nixos2: 1.29 µs, 1.81× the fastest +ChaCha20-Poly1305 seal, 1350 B, graviola on kixtop: 1.25 µs, 1.65× the fastest +ChaCha20-Poly1305 seal, 1350 B, libcrux on nixos: 2.34 µs, 4.43× the fastest; verified: HACL*'s F* proof of Hacl.Chacha20Poly1305_32, compiled to Rust by an unverified step +✓ +ChaCha20-Poly1305 seal, 1350 B, libcrux on desktop: 1.78 µs, 4.03× the fastest; verified: HACL*'s F* proof of Hacl.Chacha20Poly1305_32, compiled to Rust by an unverified step +✓ +ChaCha20-Poly1305 seal, 1350 B, libcrux on nixos2: 3.16 µs, 4.43× the fastest; verified: HACL*'s F* proof of Hacl.Chacha20Poly1305_32, compiled to Rust by an unverified step +✓ +ChaCha20-Poly1305 seal, 1350 B, libcrux on kixtop: 1.98 µs, 2.62× the fastest; verified: HACL*'s F* proof of Hacl.Chacha20Poly1305_32, compiled to Rust by an unverified step +✓ +ChaCha20-Poly1305 seal, 1350 B, libcrux on ovh-iad: 4.73 µs, 4.40× the fastest; verified: HACL*'s F* proof of Hacl.Chacha20Poly1305_32, compiled to Rust by an unverified step +✓ +ChaCha20-Poly1305 seal, 1350 B, libcrux on ovh-sea: 4.60 µs, 4.43× the fastest; verified: HACL*'s F* proof of Hacl.Chacha20Poly1305_32, compiled to Rust by an unverified step +✓ +ChaCha20-Poly1305 seal, 1350 B, OpenSSL on nixos: 745 ns, 1.41× the fastest +ChaCha20-Poly1305 seal, 1350 B, OpenSSL on desktop: 590 ns, 1.34× the fastest +ChaCha20-Poly1305 seal, 1350 B, OpenSSL on nixos2: 971 ns, 1.36× the fastest +ChaCha20-Poly1305 seal, 1350 B, OpenSSL on kixtop: 842 ns, 1.12× the fastest +ChaCha20-Poly1305 seal, 1350 B, OpenSSL on ovh-iad: 1.68 µs, 1.57× the fastest +ChaCha20-Poly1305 seal, 1350 B, OpenSSL on ovh-sea: 1.58 µs, 1.53× the fastest ChaCha20-Poly1305 seal, 16 KB ChaCha20-Poly1305 seal, 16 KB, rind on nixos: 4.68 µs, 1.00× the fastest ChaCha20-Poly1305 seal, 16 KB, rind on desktop: 4.17 µs, 1.01× the fastest ChaCha20-Poly1305 seal, 16 KB, rind on nixos2: 6.81 µs, 1.03× the fastest -ChaCha20-Poly1305 seal, 16 KB, rind on ovh-iad: 9.85 µs, 1.00× the fastest -ChaCha20-Poly1305 seal, 16 KB, rind on ovh-sea: 9.56 µs, 1.00× the fastest -ChaCha20-Poly1305 seal, 16 KB, aws-lc-rs on nixos: 4.78 µs, 1.02× the fastest -ChaCha20-Poly1305 seal, 16 KB, aws-lc-rs on desktop: 4.15 µs, 1.00× the fastest -ChaCha20-Poly1305 seal, 16 KB, aws-lc-rs on nixos2: 6.63 µs, 1.00× the fastest -ChaCha20-Poly1305 seal, 16 KB, aws-lc-rs on ovh-iad: 9.91 µs, 1.01× the fastest -ChaCha20-Poly1305 seal, 16 KB, aws-lc-rs on ovh-sea: 9.69 µs, 1.01× the fastest -ChaCha20-Poly1305 seal, 16 KB, ring on nixos: 4.68 µs, 1.00× the fastest -ChaCha20-Poly1305 seal, 16 KB, ring on desktop: 4.14 µs, 1.00× the fastest -ChaCha20-Poly1305 seal, 16 KB, ring on nixos2: 6.60 µs, 1.00× the fastest -ChaCha20-Poly1305 seal, 16 KB, ring on ovh-iad: 10.42 µs, 1.06× the fastest -ChaCha20-Poly1305 seal, 16 KB, ring on ovh-sea: 9.93 µs, 1.04× the fastest -ChaCha20-Poly1305 seal, 16 KB, RustCrypto + dalek on nixos: 10.09 µs, 2.16× the fastest -ChaCha20-Poly1305 seal, 16 KB, RustCrypto + dalek on desktop: 8.14 µs, 1.97× the fastest -ChaCha20-Poly1305 seal, 16 KB, RustCrypto + dalek on nixos2: 12.61 µs, 1.91× the fastest -ChaCha20-Poly1305 seal, 16 KB, RustCrypto + dalek on ovh-iad: 18.84 µs, 1.91× the fastest -ChaCha20-Poly1305 seal, 16 KB, RustCrypto + dalek on ovh-sea: 18.34 µs, 1.92× the fastest -ChaCha20-Poly1305 seal, 16 KB, graviola on nixos: 10.15 µs, 2.17× the fastest -ChaCha20-Poly1305 seal, 16 KB, graviola on desktop: 8.30 µs, 2.01× the fastest -ChaCha20-Poly1305 seal, 16 KB, graviola on nixos2: 12.52 µs, 1.90× the fastest -ChaCha20-Poly1305 seal, 16 KB, libcrux on nixos: 26.70 µs, 5.71× the fastest; verified: HACL*'s F* proof of Hacl.Chacha20Poly1305_32, compiled to Rust by an unverified step -✓ -ChaCha20-Poly1305 seal, 16 KB, libcrux on desktop: 19.63 µs, 4.74× the fastest; verified: HACL*'s F* proof of Hacl.Chacha20Poly1305_32, compiled to Rust by an unverified step -✓ -ChaCha20-Poly1305 seal, 16 KB, libcrux on nixos2: 35.52 µs, 5.38× the fastest; verified: HACL*'s F* proof of Hacl.Chacha20Poly1305_32, compiled to Rust by an unverified step -✓ -ChaCha20-Poly1305 seal, 16 KB, libcrux on ovh-iad: 54.85 µs, 5.57× the fastest; verified: HACL*'s F* proof of Hacl.Chacha20Poly1305_32, compiled to Rust by an unverified step -✓ -ChaCha20-Poly1305 seal, 16 KB, libcrux on ovh-sea: 51.63 µs, 5.40× the fastest; verified: HACL*'s F* proof of Hacl.Chacha20Poly1305_32, compiled to Rust by an unverified step -✓ -ChaCha20-Poly1305 seal, 16 KB, OpenSSL on nixos: 5.14 µs, 1.10× the fastest -ChaCha20-Poly1305 seal, 16 KB, OpenSSL on desktop: 4.41 µs, 1.07× the fastest -ChaCha20-Poly1305 seal, 16 KB, OpenSSL on nixos2: 6.64 µs, 1.01× the fastest -ChaCha20-Poly1305 seal, 16 KB, OpenSSL on ovh-iad: 11.10 µs, 1.13× the fastest -ChaCha20-Poly1305 seal, 16 KB, OpenSSL on ovh-sea: 10.83 µs, 1.13× the fastest +ChaCha20-Poly1305 seal, 16 KB, rind on kixtop: 7.70 µs, 1.03× the fastest +ChaCha20-Poly1305 seal, 16 KB, rind on ovh-iad: 9.85 µs, 1.00× the fastest +ChaCha20-Poly1305 seal, 16 KB, rind on ovh-sea: 9.56 µs, 1.00× the fastest +ChaCha20-Poly1305 seal, 16 KB, aws-lc-rs on nixos: 4.78 µs, 1.02× the fastest +ChaCha20-Poly1305 seal, 16 KB, aws-lc-rs on desktop: 4.15 µs, 1.00× the fastest +ChaCha20-Poly1305 seal, 16 KB, aws-lc-rs on nixos2: 6.63 µs, 1.00× the fastest +ChaCha20-Poly1305 seal, 16 KB, aws-lc-rs on kixtop: 7.65 µs, 1.03× the fastest +ChaCha20-Poly1305 seal, 16 KB, aws-lc-rs on ovh-iad: 9.91 µs, 1.01× the fastest +ChaCha20-Poly1305 seal, 16 KB, aws-lc-rs on ovh-sea: 9.69 µs, 1.01× the fastest +ChaCha20-Poly1305 seal, 16 KB, ring on nixos: 4.68 µs, 1.00× the fastest +ChaCha20-Poly1305 seal, 16 KB, ring on desktop: 4.14 µs, 1.00× the fastest +ChaCha20-Poly1305 seal, 16 KB, ring on nixos2: 6.60 µs, 1.00× the fastest +ChaCha20-Poly1305 seal, 16 KB, ring on kixtop: 7.67 µs, 1.03× the fastest +ChaCha20-Poly1305 seal, 16 KB, ring on ovh-iad: 10.42 µs, 1.06× the fastest +ChaCha20-Poly1305 seal, 16 KB, ring on ovh-sea: 9.93 µs, 1.04× the fastest +ChaCha20-Poly1305 seal, 16 KB, RustCrypto + dalek on nixos: 10.09 µs, 2.16× the fastest +ChaCha20-Poly1305 seal, 16 KB, RustCrypto + dalek on desktop: 8.14 µs, 1.97× the fastest +ChaCha20-Poly1305 seal, 16 KB, RustCrypto + dalek on nixos2: 12.61 µs, 1.91× the fastest +ChaCha20-Poly1305 seal, 16 KB, RustCrypto + dalek on kixtop: 15.21 µs, 2.04× the fastest +ChaCha20-Poly1305 seal, 16 KB, RustCrypto + dalek on ovh-iad: 18.84 µs, 1.91× the fastest +ChaCha20-Poly1305 seal, 16 KB, RustCrypto + dalek on ovh-sea: 18.34 µs, 1.92× the fastest +ChaCha20-Poly1305 seal, 16 KB, graviola on nixos: 10.15 µs, 2.17× the fastest +ChaCha20-Poly1305 seal, 16 KB, graviola on desktop: 8.30 µs, 2.01× the fastest +ChaCha20-Poly1305 seal, 16 KB, graviola on nixos2: 12.52 µs, 1.90× the fastest +ChaCha20-Poly1305 seal, 16 KB, graviola on kixtop: 12.85 µs, 1.72× the fastest +ChaCha20-Poly1305 seal, 16 KB, libcrux on nixos: 26.70 µs, 5.71× the fastest; verified: HACL*'s F* proof of Hacl.Chacha20Poly1305_32, compiled to Rust by an unverified step +✓ +ChaCha20-Poly1305 seal, 16 KB, libcrux on desktop: 19.63 µs, 4.74× the fastest; verified: HACL*'s F* proof of Hacl.Chacha20Poly1305_32, compiled to Rust by an unverified step +✓ +ChaCha20-Poly1305 seal, 16 KB, libcrux on nixos2: 35.52 µs, 5.38× the fastest; verified: HACL*'s F* proof of Hacl.Chacha20Poly1305_32, compiled to Rust by an unverified step +✓ +ChaCha20-Poly1305 seal, 16 KB, libcrux on kixtop: 22.07 µs, 2.96× the fastest; verified: HACL*'s F* proof of Hacl.Chacha20Poly1305_32, compiled to Rust by an unverified step +✓ +ChaCha20-Poly1305 seal, 16 KB, libcrux on ovh-iad: 54.85 µs, 5.57× the fastest; verified: HACL*'s F* proof of Hacl.Chacha20Poly1305_32, compiled to Rust by an unverified step +✓ +ChaCha20-Poly1305 seal, 16 KB, libcrux on ovh-sea: 51.63 µs, 5.40× the fastest; verified: HACL*'s F* proof of Hacl.Chacha20Poly1305_32, compiled to Rust by an unverified step +✓ +ChaCha20-Poly1305 seal, 16 KB, OpenSSL on nixos: 5.14 µs, 1.10× the fastest +ChaCha20-Poly1305 seal, 16 KB, OpenSSL on desktop: 4.41 µs, 1.07× the fastest +ChaCha20-Poly1305 seal, 16 KB, OpenSSL on nixos2: 6.64 µs, 1.01× the fastest +ChaCha20-Poly1305 seal, 16 KB, OpenSSL on kixtop: 7.45 µs, 1.00× the fastest +ChaCha20-Poly1305 seal, 16 KB, OpenSSL on ovh-iad: 11.10 µs, 1.13× the fastest +ChaCha20-Poly1305 seal, 16 KB, OpenSSL on ovh-sea: 10.83 µs, 1.13× the fastest XChaCha20-Poly1305 seal, 32 B XChaCha20-Poly1305 seal, 32 B, rind on nixos: 243 ns, 1.00× the fastest XChaCha20-Poly1305 seal, 32 B, rind on desktop: 188 ns, 1.00× the fastest XChaCha20-Poly1305 seal, 32 B, rind on nixos2: 256 ns, 1.00× the fastest -XChaCha20-Poly1305 seal, 32 B, rind on ovh-iad: 419 ns, 1.00× the fastest -XChaCha20-Poly1305 seal, 32 B, rind on ovh-sea: 402 ns, 1.00× the fastest -XChaCha20-Poly1305 seal, 32 B, aws-lc-rs on nixos: 267 ns, 1.10× the fastest -XChaCha20-Poly1305 seal, 32 B, aws-lc-rs on desktop: 199 ns, 1.06× the fastest -XChaCha20-Poly1305 seal, 32 B, aws-lc-rs on nixos2: 278 ns, 1.09× the fastest -XChaCha20-Poly1305 seal, 32 B, aws-lc-rs on ovh-iad: 440 ns, 1.05× the fastest -XChaCha20-Poly1305 seal, 32 B, aws-lc-rs on ovh-sea: 434 ns, 1.08× the fastest -XChaCha20-Poly1305 seal, 32 B, RustCrypto + dalek on nixos: 1.36 µs, 5.60× the fastest -XChaCha20-Poly1305 seal, 32 B, RustCrypto + dalek on desktop: 889 ns, 4.72× the fastest -XChaCha20-Poly1305 seal, 32 B, RustCrypto + dalek on nixos2: 1.27 µs, 4.95× the fastest -XChaCha20-Poly1305 seal, 32 B, RustCrypto + dalek on ovh-iad: 2.02 µs, 4.82× the fastest -XChaCha20-Poly1305 seal, 32 B, RustCrypto + dalek on ovh-sea: 1.98 µs, 4.93× the fastest -XChaCha20-Poly1305 seal, 32 B, graviola on nixos: 357 ns, 1.47× the fastest -XChaCha20-Poly1305 seal, 32 B, graviola on desktop: 259 ns, 1.38× the fastest -XChaCha20-Poly1305 seal, 32 B, graviola on nixos2: 335 ns, 1.31× the fastest -XChaCha20-Poly1305 seal, 32 B, libcrux on nixos: 351 ns, 1.45× the fastest -XChaCha20-Poly1305 seal, 32 B, libcrux on desktop: 248 ns, 1.32× the fastest -XChaCha20-Poly1305 seal, 32 B, libcrux on nixos2: 400 ns, 1.56× the fastest -XChaCha20-Poly1305 seal, 32 B, libcrux on ovh-iad: 685 ns, 1.63× the fastest -XChaCha20-Poly1305 seal, 32 B, libcrux on ovh-sea: 640 ns, 1.59× the fastest +XChaCha20-Poly1305 seal, 32 B, rind on kixtop: 1.19 µs, 1.26× the fastest +XChaCha20-Poly1305 seal, 32 B, rind on ovh-iad: 419 ns, 1.00× the fastest +XChaCha20-Poly1305 seal, 32 B, rind on ovh-sea: 402 ns, 1.00× the fastest +XChaCha20-Poly1305 seal, 32 B, aws-lc-rs on nixos: 267 ns, 1.10× the fastest +XChaCha20-Poly1305 seal, 32 B, aws-lc-rs on desktop: 199 ns, 1.06× the fastest +XChaCha20-Poly1305 seal, 32 B, aws-lc-rs on nixos2: 278 ns, 1.09× the fastest +XChaCha20-Poly1305 seal, 32 B, aws-lc-rs on kixtop: 943 ns, 1.00× the fastest +XChaCha20-Poly1305 seal, 32 B, aws-lc-rs on ovh-iad: 440 ns, 1.05× the fastest +XChaCha20-Poly1305 seal, 32 B, aws-lc-rs on ovh-sea: 434 ns, 1.08× the fastest +XChaCha20-Poly1305 seal, 32 B, RustCrypto + dalek on nixos: 1.36 µs, 5.60× the fastest +XChaCha20-Poly1305 seal, 32 B, RustCrypto + dalek on desktop: 889 ns, 4.72× the fastest +XChaCha20-Poly1305 seal, 32 B, RustCrypto + dalek on nixos2: 1.27 µs, 4.95× the fastest +XChaCha20-Poly1305 seal, 32 B, RustCrypto + dalek on kixtop: 1.53 µs, 1.62× the fastest +XChaCha20-Poly1305 seal, 32 B, RustCrypto + dalek on ovh-iad: 2.02 µs, 4.82× the fastest +XChaCha20-Poly1305 seal, 32 B, RustCrypto + dalek on ovh-sea: 1.98 µs, 4.93× the fastest +XChaCha20-Poly1305 seal, 32 B, graviola on nixos: 357 ns, 1.47× the fastest +XChaCha20-Poly1305 seal, 32 B, graviola on desktop: 259 ns, 1.38× the fastest +XChaCha20-Poly1305 seal, 32 B, graviola on nixos2: 335 ns, 1.31× the fastest +XChaCha20-Poly1305 seal, 32 B, graviola on kixtop: 1.11 µs, 1.17× the fastest +XChaCha20-Poly1305 seal, 32 B, libcrux on nixos: 351 ns, 1.45× the fastest +XChaCha20-Poly1305 seal, 32 B, libcrux on desktop: 248 ns, 1.32× the fastest +XChaCha20-Poly1305 seal, 32 B, libcrux on nixos2: 400 ns, 1.56× the fastest +XChaCha20-Poly1305 seal, 32 B, libcrux on kixtop: 1.11 µs, 1.18× the fastest +XChaCha20-Poly1305 seal, 32 B, libcrux on ovh-iad: 685 ns, 1.63× the fastest +XChaCha20-Poly1305 seal, 32 B, libcrux on ovh-sea: 640 ns, 1.59× the fastest XChaCha20-Poly1305 seal, 1350 B XChaCha20-Poly1305 seal, 1350 B, rind on nixos: 775 ns, 1.07× the fastest XChaCha20-Poly1305 seal, 1350 B, rind on desktop: 838 ns, 1.22× the fastest XChaCha20-Poly1305 seal, 1350 B, rind on nixos2: 804 ns, 1.00× the fastest -XChaCha20-Poly1305 seal, 1350 B, rind on ovh-iad: 1.34 µs, 1.00× the fastest -XChaCha20-Poly1305 seal, 1350 B, rind on ovh-sea: 1.26 µs, 1.00× the fastest -XChaCha20-Poly1305 seal, 1350 B, aws-lc-rs on nixos: 723 ns, 1.00× the fastest -XChaCha20-Poly1305 seal, 1350 B, aws-lc-rs on desktop: 687 ns, 1.00× the fastest -XChaCha20-Poly1305 seal, 1350 B, aws-lc-rs on nixos2: 831 ns, 1.03× the fastest -XChaCha20-Poly1305 seal, 1350 B, aws-lc-rs on ovh-iad: 1.37 µs, 1.02× the fastest -XChaCha20-Poly1305 seal, 1350 B, aws-lc-rs on ovh-sea: 1.29 µs, 1.02× the fastest -XChaCha20-Poly1305 seal, 1350 B, RustCrypto + dalek on nixos: 2.18 µs, 3.01× the fastest -XChaCha20-Poly1305 seal, 1350 B, RustCrypto + dalek on desktop: 1.74 µs, 2.54× the fastest -XChaCha20-Poly1305 seal, 1350 B, RustCrypto + dalek on nixos2: 2.20 µs, 2.74× the fastest -XChaCha20-Poly1305 seal, 1350 B, RustCrypto + dalek on ovh-iad: 3.59 µs, 2.69× the fastest -XChaCha20-Poly1305 seal, 1350 B, RustCrypto + dalek on ovh-sea: 3.40 µs, 2.69× the fastest -XChaCha20-Poly1305 seal, 1350 B, graviola on nixos: 1.31 µs, 1.81× the fastest -XChaCha20-Poly1305 seal, 1350 B, graviola on desktop: 1.35 µs, 1.97× the fastest -XChaCha20-Poly1305 seal, 1350 B, graviola on nixos2: 1.32 µs, 1.64× the fastest -XChaCha20-Poly1305 seal, 1350 B, libcrux on nixos: 2.70 µs, 3.73× the fastest -XChaCha20-Poly1305 seal, 1350 B, libcrux on desktop: 2.56 µs, 3.73× the fastest -XChaCha20-Poly1305 seal, 1350 B, libcrux on nixos2: 3.16 µs, 3.92× the fastest -XChaCha20-Poly1305 seal, 1350 B, libcrux on ovh-iad: 5.18 µs, 3.88× the fastest -XChaCha20-Poly1305 seal, 1350 B, libcrux on ovh-sea: 4.82 µs, 3.81× the fastest +XChaCha20-Poly1305 seal, 1350 B, rind on kixtop: 2.02 µs, 1.07× the fastest +XChaCha20-Poly1305 seal, 1350 B, rind on ovh-iad: 1.34 µs, 1.00× the fastest +XChaCha20-Poly1305 seal, 1350 B, rind on ovh-sea: 1.26 µs, 1.00× the fastest +XChaCha20-Poly1305 seal, 1350 B, aws-lc-rs on nixos: 723 ns, 1.00× the fastest +XChaCha20-Poly1305 seal, 1350 B, aws-lc-rs on desktop: 687 ns, 1.00× the fastest +XChaCha20-Poly1305 seal, 1350 B, aws-lc-rs on nixos2: 831 ns, 1.03× the fastest +XChaCha20-Poly1305 seal, 1350 B, aws-lc-rs on kixtop: 1.89 µs, 1.00× the fastest +XChaCha20-Poly1305 seal, 1350 B, aws-lc-rs on ovh-iad: 1.37 µs, 1.02× the fastest +XChaCha20-Poly1305 seal, 1350 B, aws-lc-rs on ovh-sea: 1.29 µs, 1.02× the fastest +XChaCha20-Poly1305 seal, 1350 B, RustCrypto + dalek on nixos: 2.18 µs, 3.01× the fastest +XChaCha20-Poly1305 seal, 1350 B, RustCrypto + dalek on desktop: 1.74 µs, 2.54× the fastest +XChaCha20-Poly1305 seal, 1350 B, RustCrypto + dalek on nixos2: 2.20 µs, 2.74× the fastest +XChaCha20-Poly1305 seal, 1350 B, RustCrypto + dalek on kixtop: 3.19 µs, 1.69× the fastest +XChaCha20-Poly1305 seal, 1350 B, RustCrypto + dalek on ovh-iad: 3.59 µs, 2.69× the fastest +XChaCha20-Poly1305 seal, 1350 B, RustCrypto + dalek on ovh-sea: 3.40 µs, 2.69× the fastest +XChaCha20-Poly1305 seal, 1350 B, graviola on nixos: 1.31 µs, 1.81× the fastest +XChaCha20-Poly1305 seal, 1350 B, graviola on desktop: 1.35 µs, 1.97× the fastest +XChaCha20-Poly1305 seal, 1350 B, graviola on nixos2: 1.32 µs, 1.64× the fastest +XChaCha20-Poly1305 seal, 1350 B, graviola on kixtop: 2.85 µs, 1.51× the fastest +XChaCha20-Poly1305 seal, 1350 B, libcrux on nixos: 2.70 µs, 3.73× the fastest +XChaCha20-Poly1305 seal, 1350 B, libcrux on desktop: 2.56 µs, 3.73× the fastest +XChaCha20-Poly1305 seal, 1350 B, libcrux on nixos2: 3.16 µs, 3.92× the fastest +XChaCha20-Poly1305 seal, 1350 B, libcrux on kixtop: 3.80 µs, 2.02× the fastest +XChaCha20-Poly1305 seal, 1350 B, libcrux on ovh-iad: 5.18 µs, 3.88× the fastest +XChaCha20-Poly1305 seal, 1350 B, libcrux on ovh-sea: 4.82 µs, 3.81× the fastest XChaCha20-Poly1305 seal, 16 KB XChaCha20-Poly1305 seal, 16 KB, rind on nixos: 5.23 µs, 1.00× the fastest XChaCha20-Poly1305 seal, 16 KB, rind on desktop: 6.26 µs, 1.00× the fastest XChaCha20-Poly1305 seal, 16 KB, rind on nixos2: 6.38 µs, 1.00× the fastest -XChaCha20-Poly1305 seal, 16 KB, rind on ovh-iad: 10.26 µs, 1.00× the fastest -XChaCha20-Poly1305 seal, 16 KB, rind on ovh-sea: 10.02 µs, 1.01× the fastest -XChaCha20-Poly1305 seal, 16 KB, aws-lc-rs on nixos: 5.37 µs, 1.03× the fastest -XChaCha20-Poly1305 seal, 16 KB, aws-lc-rs on desktop: 6.27 µs, 1.00× the fastest -XChaCha20-Poly1305 seal, 16 KB, aws-lc-rs on nixos2: 6.44 µs, 1.01× the fastest -XChaCha20-Poly1305 seal, 16 KB, aws-lc-rs on ovh-iad: 10.47 µs, 1.02× the fastest -XChaCha20-Poly1305 seal, 16 KB, aws-lc-rs on ovh-sea: 9.94 µs, 1.00× the fastest -XChaCha20-Poly1305 seal, 16 KB, RustCrypto + dalek on nixos: 11.38 µs, 2.17× the fastest -XChaCha20-Poly1305 seal, 16 KB, RustCrypto + dalek on desktop: 12.28 µs, 1.96× the fastest -XChaCha20-Poly1305 seal, 16 KB, RustCrypto + dalek on nixos2: 12.04 µs, 1.89× the fastest -XChaCha20-Poly1305 seal, 16 KB, RustCrypto + dalek on ovh-iad: 18.84 µs, 1.84× the fastest -XChaCha20-Poly1305 seal, 16 KB, RustCrypto + dalek on ovh-sea: 18.77 µs, 1.89× the fastest -XChaCha20-Poly1305 seal, 16 KB, graviola on nixos: 10.80 µs, 2.06× the fastest -XChaCha20-Poly1305 seal, 16 KB, graviola on desktop: 12.79 µs, 2.04× the fastest -XChaCha20-Poly1305 seal, 16 KB, graviola on nixos2: 11.86 µs, 1.86× the fastest -XChaCha20-Poly1305 seal, 16 KB, libcrux on nixos: 28.66 µs, 5.48× the fastest -XChaCha20-Poly1305 seal, 16 KB, libcrux on desktop: 27.40 µs, 4.37× the fastest -XChaCha20-Poly1305 seal, 16 KB, libcrux on nixos2: 33.42 µs, 5.23× the fastest -XChaCha20-Poly1305 seal, 16 KB, libcrux on ovh-iad: 54.13 µs, 5.28× the fastest -XChaCha20-Poly1305 seal, 16 KB, libcrux on ovh-sea: 52.01 µs, 5.23× the fastest +XChaCha20-Poly1305 seal, 16 KB, rind on kixtop: 11.36 µs, 1.00× the fastest +XChaCha20-Poly1305 seal, 16 KB, rind on ovh-iad: 10.26 µs, 1.00× the fastest +XChaCha20-Poly1305 seal, 16 KB, rind on ovh-sea: 10.02 µs, 1.01× the fastest +XChaCha20-Poly1305 seal, 16 KB, aws-lc-rs on nixos: 5.37 µs, 1.03× the fastest +XChaCha20-Poly1305 seal, 16 KB, aws-lc-rs on desktop: 6.27 µs, 1.00× the fastest +XChaCha20-Poly1305 seal, 16 KB, aws-lc-rs on nixos2: 6.44 µs, 1.01× the fastest +XChaCha20-Poly1305 seal, 16 KB, aws-lc-rs on kixtop: 11.43 µs, 1.01× the fastest +XChaCha20-Poly1305 seal, 16 KB, aws-lc-rs on ovh-iad: 10.47 µs, 1.02× the fastest +XChaCha20-Poly1305 seal, 16 KB, aws-lc-rs on ovh-sea: 9.94 µs, 1.00× the fastest +XChaCha20-Poly1305 seal, 16 KB, RustCrypto + dalek on nixos: 11.38 µs, 2.17× the fastest +XChaCha20-Poly1305 seal, 16 KB, RustCrypto + dalek on desktop: 12.28 µs, 1.96× the fastest +XChaCha20-Poly1305 seal, 16 KB, RustCrypto + dalek on nixos2: 12.04 µs, 1.89× the fastest +XChaCha20-Poly1305 seal, 16 KB, RustCrypto + dalek on kixtop: 22.76 µs, 2.00× the fastest +XChaCha20-Poly1305 seal, 16 KB, RustCrypto + dalek on ovh-iad: 18.84 µs, 1.84× the fastest +XChaCha20-Poly1305 seal, 16 KB, RustCrypto + dalek on ovh-sea: 18.77 µs, 1.89× the fastest +XChaCha20-Poly1305 seal, 16 KB, graviola on nixos: 10.80 µs, 2.06× the fastest +XChaCha20-Poly1305 seal, 16 KB, graviola on desktop: 12.79 µs, 2.04× the fastest +XChaCha20-Poly1305 seal, 16 KB, graviola on nixos2: 11.86 µs, 1.86× the fastest +XChaCha20-Poly1305 seal, 16 KB, graviola on kixtop: 19.24 µs, 1.69× the fastest +XChaCha20-Poly1305 seal, 16 KB, libcrux on nixos: 28.66 µs, 5.48× the fastest +XChaCha20-Poly1305 seal, 16 KB, libcrux on desktop: 27.40 µs, 4.37× the fastest +XChaCha20-Poly1305 seal, 16 KB, libcrux on nixos2: 33.42 µs, 5.23× the fastest +XChaCha20-Poly1305 seal, 16 KB, libcrux on kixtop: 34.20 µs, 3.01× the fastest +XChaCha20-Poly1305 seal, 16 KB, libcrux on ovh-iad: 54.13 µs, 5.28× the fastest +XChaCha20-Poly1305 seal, 16 KB, libcrux on ovh-sea: 52.01 µs, 5.23× the fastest QUIC header protection - + AES-128 header protection AES-128 header protection, rind on nixos: 4 ns, 1.00× the fastest AES-128 header protection, rind on desktop: 2 ns, 1.00× the fastest AES-128 header protection, rind on nixos2: 5 ns, 1.00× the fastest -AES-128 header protection, rind on ovh-iad: 7 ns, 1.00× the fastest -AES-128 header protection, rind on ovh-sea: 7 ns, 1.00× the fastest -AES-128 header protection, aws-lc-rs on nixos: 6 ns, 1.45× the fastest -AES-128 header protection, aws-lc-rs on desktop: 3 ns, 1.59× the fastest -AES-128 header protection, aws-lc-rs on nixos2: 9 ns, 1.95× the fastest -AES-128 header protection, aws-lc-rs on ovh-iad: 12 ns, 1.66× the fastest -AES-128 header protection, aws-lc-rs on ovh-sea: 11 ns, 1.66× the fastest -AES-128 header protection, ring on nixos: 7 ns, 1.74× the fastest -AES-128 header protection, ring on desktop: 3 ns, 1.68× the fastest -AES-128 header protection, ring on nixos2: 8 ns, 1.73× the fastest -AES-128 header protection, ring on ovh-iad: 13 ns, 1.74× the fastest -AES-128 header protection, ring on ovh-sea: 12 ns, 1.70× the fastest +AES-128 header protection, rind on kixtop: 35 ns, 12.24× the fastest +AES-128 header protection, rind on ovh-iad: 7 ns, 1.00× the fastest +AES-128 header protection, rind on ovh-sea: 7 ns, 1.00× the fastest +AES-128 header protection, aws-lc-rs on nixos: 6 ns, 1.45× the fastest +AES-128 header protection, aws-lc-rs on desktop: 3 ns, 1.59× the fastest +AES-128 header protection, aws-lc-rs on nixos2: 9 ns, 1.95× the fastest +AES-128 header protection, aws-lc-rs on kixtop: 3 ns, 1.00× the fastest +AES-128 header protection, aws-lc-rs on ovh-iad: 12 ns, 1.66× the fastest +AES-128 header protection, aws-lc-rs on ovh-sea: 11 ns, 1.66× the fastest +AES-128 header protection, ring on nixos: 7 ns, 1.74× the fastest +AES-128 header protection, ring on desktop: 3 ns, 1.68× the fastest +AES-128 header protection, ring on nixos2: 8 ns, 1.73× the fastest +AES-128 header protection, ring on kixtop: 3 ns, 1.15× the fastest +AES-128 header protection, ring on ovh-iad: 13 ns, 1.74× the fastest +AES-128 header protection, ring on ovh-sea: 12 ns, 1.70× the fastest AES-256 header protection AES-256 header protection, rind on nixos: 6 ns, 1.00× the fastest AES-256 header protection, rind on desktop: 2 ns, 1.00× the fastest AES-256 header protection, rind on nixos2: 8 ns, 1.00× the fastest -AES-256 header protection, rind on ovh-iad: 10 ns, 1.00× the fastest -AES-256 header protection, rind on ovh-sea: 9 ns, 1.00× the fastest -AES-256 header protection, aws-lc-rs on nixos: 8 ns, 1.32× the fastest -AES-256 header protection, aws-lc-rs on desktop: 5 ns, 2.06× the fastest -AES-256 header protection, aws-lc-rs on nixos2: 10 ns, 1.25× the fastest -AES-256 header protection, aws-lc-rs on ovh-iad: 16 ns, 1.62× the fastest -AES-256 header protection, aws-lc-rs on ovh-sea: 15 ns, 1.58× the fastest -AES-256 header protection, ring on nixos: 10 ns, 1.64× the fastest -AES-256 header protection, ring on desktop: 5 ns, 2.16× the fastest -AES-256 header protection, ring on nixos2: 10 ns, 1.24× the fastest -AES-256 header protection, ring on ovh-iad: 15 ns, 1.59× the fastest -AES-256 header protection, ring on ovh-sea: 15 ns, 1.56× the fastest +AES-256 header protection, rind on kixtop: 38 ns, 12.62× the fastest +AES-256 header protection, rind on ovh-iad: 10 ns, 1.00× the fastest +AES-256 header protection, rind on ovh-sea: 9 ns, 1.00× the fastest +AES-256 header protection, aws-lc-rs on nixos: 8 ns, 1.32× the fastest +AES-256 header protection, aws-lc-rs on desktop: 5 ns, 2.06× the fastest +AES-256 header protection, aws-lc-rs on nixos2: 10 ns, 1.25× the fastest +AES-256 header protection, aws-lc-rs on kixtop: 3 ns, 1.00× the fastest +AES-256 header protection, aws-lc-rs on ovh-iad: 16 ns, 1.62× the fastest +AES-256 header protection, aws-lc-rs on ovh-sea: 15 ns, 1.58× the fastest +AES-256 header protection, ring on nixos: 10 ns, 1.64× the fastest +AES-256 header protection, ring on desktop: 5 ns, 2.16× the fastest +AES-256 header protection, ring on nixos2: 10 ns, 1.24× the fastest +AES-256 header protection, ring on kixtop: 4 ns, 1.31× the fastest +AES-256 header protection, ring on ovh-iad: 15 ns, 1.59× the fastest +AES-256 header protection, ring on ovh-sea: 15 ns, 1.56× the fastest ChaCha20 header protection ChaCha20 header protection, rind on nixos: 61 ns, 1.00× the fastest; verified: rind's Lean proof, through Aeneas and a hand model of the function-pointer dispatch Aeneas cannot translate, which assumes each key's mask is its own cipher's, the only one rind builds, of its header-protection API's ChaCha20 against RFC 9001 and RFC 8439, HACL*'s rounds included ✓ @@ -914,22 +1087,26 @@ ✓ ChaCha20 header protection, rind on nixos2: 84 ns, 1.00× the fastest; verified: rind's Lean proof, through Aeneas and a hand model of the function-pointer dispatch Aeneas cannot translate, which assumes each key's mask is its own cipher's, the only one rind builds, of its header-protection API's ChaCha20 against RFC 9001 and RFC 8439, HACL*'s rounds included ✓ -ChaCha20 header protection, rind on ovh-iad: 126 ns, 1.00× the fastest; verified: rind's Lean proof, through Aeneas and a hand model of the function-pointer dispatch Aeneas cannot translate, which assumes each key's mask is its own cipher's, the only one rind builds, of its header-protection API's ChaCha20 against RFC 9001 and RFC 8439, HACL*'s rounds included +ChaCha20 header protection, rind on kixtop: 89 ns, 1.29× the fastest; verified: rind's Lean proof, through Aeneas and a hand model of the function-pointer dispatch Aeneas cannot translate, which assumes each key's mask is its own cipher's, the only one rind builds, of its header-protection API's ChaCha20 against RFC 9001 and RFC 8439, HACL*'s rounds included ✓ -ChaCha20 header protection, rind on ovh-sea: 122 ns, 1.00× the fastest; verified: rind's Lean proof, through Aeneas and a hand model of the function-pointer dispatch Aeneas cannot translate, which assumes each key's mask is its own cipher's, the only one rind builds, of its header-protection API's ChaCha20 against RFC 9001 and RFC 8439, HACL*'s rounds included +ChaCha20 header protection, rind on ovh-iad: 126 ns, 1.00× the fastest; verified: rind's Lean proof, through Aeneas and a hand model of the function-pointer dispatch Aeneas cannot translate, which assumes each key's mask is its own cipher's, the only one rind builds, of its header-protection API's ChaCha20 against RFC 9001 and RFC 8439, HACL*'s rounds included ✓ -ChaCha20 header protection, aws-lc-rs on nixos: 82 ns, 1.34× the fastest -ChaCha20 header protection, aws-lc-rs on desktop: 69 ns, 1.28× the fastest -ChaCha20 header protection, aws-lc-rs on nixos2: 104 ns, 1.24× the fastest -ChaCha20 header protection, aws-lc-rs on ovh-iad: 160 ns, 1.27× the fastest -ChaCha20 header protection, aws-lc-rs on ovh-sea: 152 ns, 1.25× the fastest -ChaCha20 header protection, ring on nixos: 74 ns, 1.22× the fastest -ChaCha20 header protection, ring on desktop: 61 ns, 1.14× the fastest -ChaCha20 header protection, ring on nixos2: 98 ns, 1.17× the fastest -ChaCha20 header protection, ring on ovh-iad: 145 ns, 1.15× the fastest -ChaCha20 header protection, ring on ovh-sea: 139 ns, 1.14× the fastest +ChaCha20 header protection, rind on ovh-sea: 122 ns, 1.00× the fastest; verified: rind's Lean proof, through Aeneas and a hand model of the function-pointer dispatch Aeneas cannot translate, which assumes each key's mask is its own cipher's, the only one rind builds, of its header-protection API's ChaCha20 against RFC 9001 and RFC 8439, HACL*'s rounds included +✓ +ChaCha20 header protection, aws-lc-rs on nixos: 82 ns, 1.34× the fastest +ChaCha20 header protection, aws-lc-rs on desktop: 69 ns, 1.28× the fastest +ChaCha20 header protection, aws-lc-rs on nixos2: 104 ns, 1.24× the fastest +ChaCha20 header protection, aws-lc-rs on kixtop: 73 ns, 1.07× the fastest +ChaCha20 header protection, aws-lc-rs on ovh-iad: 160 ns, 1.27× the fastest +ChaCha20 header protection, aws-lc-rs on ovh-sea: 152 ns, 1.25× the fastest +ChaCha20 header protection, ring on nixos: 74 ns, 1.22× the fastest +ChaCha20 header protection, ring on desktop: 61 ns, 1.14× the fastest +ChaCha20 header protection, ring on nixos2: 98 ns, 1.17× the fastest +ChaCha20 header protection, ring on kixtop: 68 ns, 1.00× the fastest +ChaCha20 header protection, ring on ovh-iad: 145 ns, 1.15× the fastest +ChaCha20 header protection, ring on ovh-sea: 139 ns, 1.14× the fastest Key agreement - + X25519 X25519, rind on nixos: 23.97 µs, 1.00× the fastest; verified: rind's Lean proof, through Aeneas and a hand model of the function-pointer dispatch Aeneas cannot translate, which assumes each key's dispatch table holds its own curve's functions, the only table rind builds, of its agreement API's X25519 down to s2n-bignum's routines, composed with s2n-bignum's HOL Light proofs of curve25519_x25519, curve25519_x25519base, their _alt forms without BMI2 and ADX, and bignum_eq, of s2n-bignum's own object code, which rind transliterates ✓ @@ -937,1015 +1114,1221 @@ ✓ X25519, rind on nixos2: 25.00 µs, 1.00× the fastest; verified: rind's Lean proof, through Aeneas and a hand model of the function-pointer dispatch Aeneas cannot translate, which assumes each key's dispatch table holds its own curve's functions, the only table rind builds, of its agreement API's X25519 down to s2n-bignum's routines, composed with s2n-bignum's HOL Light proofs of curve25519_x25519, curve25519_x25519base, their _alt forms without BMI2 and ADX, and bignum_eq, of s2n-bignum's own object code, which rind transliterates ✓ -X25519, rind on ovh-iad: 51.79 µs, 1.00× the fastest; verified: rind's Lean proof, through Aeneas and a hand model of the function-pointer dispatch Aeneas cannot translate, which assumes each key's dispatch table holds its own curve's functions, the only table rind builds, of its agreement API's X25519 down to s2n-bignum's routines, composed with s2n-bignum's HOL Light proofs of curve25519_x25519, curve25519_x25519base, their _alt forms without BMI2 and ADX, and bignum_eq, of s2n-bignum's own object code, which rind transliterates +X25519, rind on kixtop: 16.71 µs, 1.00× the fastest; verified: rind's Lean proof, through Aeneas and a hand model of the function-pointer dispatch Aeneas cannot translate, which assumes each key's dispatch table holds its own curve's functions, the only table rind builds, of its agreement API's X25519 down to s2n-bignum's routines, composed with s2n-bignum's HOL Light proofs of curve25519_x25519_alt, curve25519_x25519base_alt, and bignum_eq, of s2n-bignum's own object code, which rind transliterates ✓ -X25519, rind on ovh-sea: 51.10 µs, 1.00× the fastest; verified: rind's Lean proof, through Aeneas and a hand model of the function-pointer dispatch Aeneas cannot translate, which assumes each key's dispatch table holds its own curve's functions, the only table rind builds, of its agreement API's X25519 down to s2n-bignum's routines, composed with s2n-bignum's HOL Light proofs of curve25519_x25519, curve25519_x25519base, their _alt forms without BMI2 and ADX, and bignum_eq, of s2n-bignum's own object code, which rind transliterates +X25519, rind on ovh-iad: 51.79 µs, 1.00× the fastest; verified: rind's Lean proof, through Aeneas and a hand model of the function-pointer dispatch Aeneas cannot translate, which assumes each key's dispatch table holds its own curve's functions, the only table rind builds, of its agreement API's X25519 down to s2n-bignum's routines, composed with s2n-bignum's HOL Light proofs of curve25519_x25519, curve25519_x25519base, their _alt forms without BMI2 and ADX, and bignum_eq, of s2n-bignum's own object code, which rind transliterates ✓ -X25519, aws-lc-rs on nixos: 24.61 µs, 1.03× the fastest -X25519, aws-lc-rs on desktop: 19.54 µs, 1.06× the fastest -X25519, aws-lc-rs on nixos2: 30.89 µs, 1.24× the fastest -X25519, aws-lc-rs on ovh-iad: 55.09 µs, 1.06× the fastest -X25519, aws-lc-rs on ovh-sea: 51.15 µs, 1.00× the fastest -X25519, ring on nixos: 46.72 µs, 1.95× the fastest -X25519, ring on desktop: 35.63 µs, 1.93× the fastest -X25519, ring on nixos2: 53.60 µs, 2.15× the fastest -X25519, ring on ovh-iad: 79.18 µs, 1.53× the fastest -X25519, ring on ovh-sea: 76.22 µs, 1.49× the fastest -X25519, RustCrypto + dalek on nixos: 52.09 µs, 2.18× the fastest -X25519, RustCrypto + dalek on desktop: 36.52 µs, 1.97× the fastest -X25519, RustCrypto + dalek on nixos2: 56.59 µs, 2.27× the fastest -X25519, RustCrypto + dalek on ovh-iad: 92.76 µs, 1.79× the fastest -X25519, RustCrypto + dalek on ovh-sea: 87.59 µs, 1.71× the fastest -X25519, graviola on nixos: 23.94 µs, 1.00× the fastest -X25519, graviola on desktop: 18.50 µs, 1.00× the fastest -X25519, graviola on nixos2: 24.95 µs, 1.00× the fastest -X25519, libcrux on nixos: 64.60 µs, 2.70× the fastest; verified: HACL*'s F* proof of Hacl.Curve25519_51's secret_to_public and ecdh, compiled to Rust by an unverified step -✓ -X25519, libcrux on desktop: 43.11 µs, 2.33× the fastest; verified: HACL*'s F* proof of Hacl.Curve25519_51's secret_to_public and ecdh, compiled to Rust by an unverified step -✓ -X25519, libcrux on nixos2: 72.34 µs, 2.90× the fastest; verified: HACL*'s F* proof of Hacl.Curve25519_51's secret_to_public and ecdh, compiled to Rust by an unverified step -✓ -X25519, libcrux on ovh-iad: 118.60 µs, 2.29× the fastest; verified: HACL*'s F* proof of Hacl.Curve25519_51's secret_to_public and ecdh, compiled to Rust by an unverified step -✓ -X25519, libcrux on ovh-sea: 113.85 µs, 2.23× the fastest; verified: HACL*'s F* proof of Hacl.Curve25519_51's secret_to_public and ecdh, compiled to Rust by an unverified step -✓ -X25519, OpenSSL on nixos: 49.70 µs, 2.08× the fastest -X25519, OpenSSL on desktop: 34.02 µs, 1.84× the fastest -X25519, OpenSSL on nixos2: 55.20 µs, 2.21× the fastest -X25519, OpenSSL on ovh-iad: 108.87 µs, 2.10× the fastest -X25519, OpenSSL on ovh-sea: 94.95 µs, 1.86× the fastest +X25519, rind on ovh-sea: 51.10 µs, 1.00× the fastest; verified: rind's Lean proof, through Aeneas and a hand model of the function-pointer dispatch Aeneas cannot translate, which assumes each key's dispatch table holds its own curve's functions, the only table rind builds, of its agreement API's X25519 down to s2n-bignum's routines, composed with s2n-bignum's HOL Light proofs of curve25519_x25519, curve25519_x25519base, their _alt forms without BMI2 and ADX, and bignum_eq, of s2n-bignum's own object code, which rind transliterates +✓ +X25519, aws-lc-rs on nixos: 24.61 µs, 1.03× the fastest +X25519, aws-lc-rs on desktop: 19.54 µs, 1.06× the fastest +X25519, aws-lc-rs on nixos2: 30.89 µs, 1.24× the fastest +X25519, aws-lc-rs on kixtop: 17.85 µs, 1.07× the fastest +X25519, aws-lc-rs on ovh-iad: 55.09 µs, 1.06× the fastest +X25519, aws-lc-rs on ovh-sea: 51.15 µs, 1.00× the fastest +X25519, ring on nixos: 46.72 µs, 1.95× the fastest +X25519, ring on desktop: 35.63 µs, 1.93× the fastest +X25519, ring on nixos2: 53.60 µs, 2.15× the fastest +X25519, ring on kixtop: 24.48 µs, 1.46× the fastest +X25519, ring on ovh-iad: 79.18 µs, 1.53× the fastest +X25519, ring on ovh-sea: 76.22 µs, 1.49× the fastest +X25519, RustCrypto + dalek on nixos: 52.09 µs, 2.18× the fastest +X25519, RustCrypto + dalek on desktop: 36.52 µs, 1.97× the fastest +X25519, RustCrypto + dalek on nixos2: 56.59 µs, 2.27× the fastest +X25519, RustCrypto + dalek on kixtop: 29.71 µs, 1.78× the fastest +X25519, RustCrypto + dalek on ovh-iad: 92.76 µs, 1.79× the fastest +X25519, RustCrypto + dalek on ovh-sea: 87.59 µs, 1.71× the fastest +X25519, graviola on nixos: 23.94 µs, 1.00× the fastest +X25519, graviola on desktop: 18.50 µs, 1.00× the fastest +X25519, graviola on nixos2: 24.95 µs, 1.00× the fastest +X25519, graviola on kixtop: 17.74 µs, 1.06× the fastest +X25519, libcrux on nixos: 64.60 µs, 2.70× the fastest; verified: HACL*'s F* proof of Hacl.Curve25519_51's secret_to_public and ecdh, compiled to Rust by an unverified step +✓ +X25519, libcrux on desktop: 43.11 µs, 2.33× the fastest; verified: HACL*'s F* proof of Hacl.Curve25519_51's secret_to_public and ecdh, compiled to Rust by an unverified step +✓ +X25519, libcrux on nixos2: 72.34 µs, 2.90× the fastest; verified: HACL*'s F* proof of Hacl.Curve25519_51's secret_to_public and ecdh, compiled to Rust by an unverified step +✓ +X25519, libcrux on kixtop: 37.77 µs, 2.26× the fastest; verified: HACL*'s F* proof of Hacl.Curve25519_51's secret_to_public and ecdh, compiled to Rust by an unverified step +✓ +X25519, libcrux on ovh-iad: 118.60 µs, 2.29× the fastest; verified: HACL*'s F* proof of Hacl.Curve25519_51's secret_to_public and ecdh, compiled to Rust by an unverified step +✓ +X25519, libcrux on ovh-sea: 113.85 µs, 2.23× the fastest; verified: HACL*'s F* proof of Hacl.Curve25519_51's secret_to_public and ecdh, compiled to Rust by an unverified step +✓ +X25519, OpenSSL on nixos: 49.70 µs, 2.08× the fastest +X25519, OpenSSL on desktop: 34.02 µs, 1.84× the fastest +X25519, OpenSSL on nixos2: 55.20 µs, 2.21× the fastest +X25519, OpenSSL on kixtop: 35.77 µs, 2.14× the fastest +X25519, OpenSSL on ovh-iad: 108.87 µs, 2.10× the fastest +X25519, OpenSSL on ovh-sea: 94.95 µs, 1.86× the fastest P-256 ECDH P-256 ECDH, rind on nixos: 42.82 µs, 1.01× the fastest P-256 ECDH, rind on desktop: 29.85 µs, 1.00× the fastest P-256 ECDH, rind on nixos2: 42.80 µs, 1.00× the fastest -P-256 ECDH, rind on ovh-iad: 80.93 µs, 1.00× the fastest -P-256 ECDH, rind on ovh-sea: 78.75 µs, 1.00× the fastest -P-256 ECDH, aws-lc-rs on nixos: 42.60 µs, 1.00× the fastest -P-256 ECDH, aws-lc-rs on desktop: 32.27 µs, 1.08× the fastest -P-256 ECDH, aws-lc-rs on nixos2: 51.71 µs, 1.21× the fastest -P-256 ECDH, aws-lc-rs on ovh-iad: 90.86 µs, 1.12× the fastest -P-256 ECDH, aws-lc-rs on ovh-sea: 83.71 µs, 1.06× the fastest -P-256 ECDH, ring on nixos: 46.05 µs, 1.08× the fastest -P-256 ECDH, ring on desktop: 34.14 µs, 1.14× the fastest -P-256 ECDH, ring on nixos2: 47.10 µs, 1.10× the fastest -P-256 ECDH, ring on ovh-iad: 86.47 µs, 1.07× the fastest -P-256 ECDH, ring on ovh-sea: 83.41 µs, 1.06× the fastest -P-256 ECDH, RustCrypto + dalek on nixos: 268.62 µs, 6.31× the fastest -P-256 ECDH, RustCrypto + dalek on desktop: 123.01 µs, 4.12× the fastest -P-256 ECDH, RustCrypto + dalek on nixos2: 233.70 µs, 5.46× the fastest -P-256 ECDH, RustCrypto + dalek on ovh-iad: 379.56 µs, 4.69× the fastest -P-256 ECDH, RustCrypto + dalek on ovh-sea: 363.81 µs, 4.62× the fastest -P-256 ECDH, graviola on nixos: 47.87 µs, 1.12× the fastest -P-256 ECDH, graviola on desktop: 33.46 µs, 1.12× the fastest -P-256 ECDH, graviola on nixos2: 46.44 µs, 1.08× the fastest -P-256 ECDH, libcrux on nixos: 268.70 µs, 6.31× the fastest; verified: HACL*'s F* proof of Hacl.P256's dh_initiator, dh_responder, ecdsa_sign_p256_sha2, and ecdsa_verif_p256_sha2, compiled to Rust by an unverified step -✓ -P-256 ECDH, libcrux on desktop: 169.87 µs, 5.69× the fastest; verified: HACL*'s F* proof of Hacl.P256's dh_initiator, dh_responder, ecdsa_sign_p256_sha2, and ecdsa_verif_p256_sha2, compiled to Rust by an unverified step -✓ -P-256 ECDH, libcrux on nixos2: 280.52 µs, 6.55× the fastest; verified: HACL*'s F* proof of Hacl.P256's dh_initiator, dh_responder, ecdsa_sign_p256_sha2, and ecdsa_verif_p256_sha2, compiled to Rust by an unverified step -✓ -P-256 ECDH, libcrux on ovh-iad: 448.99 µs, 5.55× the fastest; verified: HACL*'s F* proof of Hacl.P256's dh_initiator, dh_responder, ecdsa_sign_p256_sha2, and ecdsa_verif_p256_sha2, compiled to Rust by an unverified step -✓ -P-256 ECDH, libcrux on ovh-sea: 431.73 µs, 5.48× the fastest; verified: HACL*'s F* proof of Hacl.P256's dh_initiator, dh_responder, ecdsa_sign_p256_sha2, and ecdsa_verif_p256_sha2, compiled to Rust by an unverified step -✓ -P-256 ECDH, OpenSSL on nixos: 71.25 µs, 1.67× the fastest -P-256 ECDH, OpenSSL on desktop: 52.91 µs, 1.77× the fastest -P-256 ECDH, OpenSSL on nixos2: 81.68 µs, 1.91× the fastest -P-256 ECDH, OpenSSL on ovh-iad: 144.90 µs, 1.79× the fastest -P-256 ECDH, OpenSSL on ovh-sea: 135.76 µs, 1.72× the fastest +P-256 ECDH, rind on kixtop: 26.27 µs, 1.00× the fastest; verified: rind's Lean proof, through Aeneas and hand models of the function-pointer dispatch and of key generation's draws through a dyn RandomSource, which Aeneas cannot translate, of its agreement API's P-256 key generation, public key, and agreement down to s2n-bignum's routines, composed with s2n-bignum's HOL Light proofs of p256_scalarmulbase_alt, p256_scalarmul_alt, bignum_tomont_p256, bignum_demont_p256, bignum_add_p256, bignum_montmul_p256, bignum_montsqr_p256, bignum_mod_n256_4, and bignum_eq, of s2n-bignum's own object code, which rind transliterates, with rind's generator table proven to hold the multiples of G that s2n-bignum's proof assumes +✓ +P-256 ECDH, rind on ovh-iad: 80.93 µs, 1.00× the fastest +P-256 ECDH, rind on ovh-sea: 78.75 µs, 1.00× the fastest +P-256 ECDH, aws-lc-rs on nixos: 42.60 µs, 1.00× the fastest +P-256 ECDH, aws-lc-rs on desktop: 32.27 µs, 1.08× the fastest +P-256 ECDH, aws-lc-rs on nixos2: 51.71 µs, 1.21× the fastest +P-256 ECDH, aws-lc-rs on kixtop: 28.51 µs, 1.09× the fastest +P-256 ECDH, aws-lc-rs on ovh-iad: 90.86 µs, 1.12× the fastest +P-256 ECDH, aws-lc-rs on ovh-sea: 83.71 µs, 1.06× the fastest +P-256 ECDH, ring on nixos: 46.05 µs, 1.08× the fastest +P-256 ECDH, ring on desktop: 34.14 µs, 1.14× the fastest +P-256 ECDH, ring on nixos2: 47.10 µs, 1.10× the fastest +P-256 ECDH, ring on kixtop: 32.31 µs, 1.23× the fastest +P-256 ECDH, ring on ovh-iad: 86.47 µs, 1.07× the fastest +P-256 ECDH, ring on ovh-sea: 83.41 µs, 1.06× the fastest +P-256 ECDH, RustCrypto + dalek on nixos: 268.62 µs, 6.31× the fastest +P-256 ECDH, RustCrypto + dalek on desktop: 123.01 µs, 4.12× the fastest +P-256 ECDH, RustCrypto + dalek on nixos2: 233.70 µs, 5.46× the fastest +P-256 ECDH, RustCrypto + dalek on kixtop: 180.62 µs, 6.88× the fastest +P-256 ECDH, RustCrypto + dalek on ovh-iad: 379.56 µs, 4.69× the fastest +P-256 ECDH, RustCrypto + dalek on ovh-sea: 363.81 µs, 4.62× the fastest +P-256 ECDH, graviola on nixos: 47.87 µs, 1.12× the fastest +P-256 ECDH, graviola on desktop: 33.46 µs, 1.12× the fastest +P-256 ECDH, graviola on nixos2: 46.44 µs, 1.08× the fastest +P-256 ECDH, graviola on kixtop: 31.56 µs, 1.20× the fastest +P-256 ECDH, libcrux on nixos: 268.70 µs, 6.31× the fastest; verified: HACL*'s F* proof of Hacl.P256's dh_initiator, dh_responder, ecdsa_sign_p256_sha2, and ecdsa_verif_p256_sha2, compiled to Rust by an unverified step +✓ +P-256 ECDH, libcrux on desktop: 169.87 µs, 5.69× the fastest; verified: HACL*'s F* proof of Hacl.P256's dh_initiator, dh_responder, ecdsa_sign_p256_sha2, and ecdsa_verif_p256_sha2, compiled to Rust by an unverified step +✓ +P-256 ECDH, libcrux on nixos2: 280.52 µs, 6.55× the fastest; verified: HACL*'s F* proof of Hacl.P256's dh_initiator, dh_responder, ecdsa_sign_p256_sha2, and ecdsa_verif_p256_sha2, compiled to Rust by an unverified step +✓ +P-256 ECDH, libcrux on kixtop: 183.72 µs, 6.99× the fastest; verified: HACL*'s F* proof of Hacl.P256's dh_initiator, dh_responder, ecdsa_sign_p256_sha2, and ecdsa_verif_p256_sha2, compiled to Rust by an unverified step +✓ +P-256 ECDH, libcrux on ovh-iad: 448.99 µs, 5.55× the fastest; verified: HACL*'s F* proof of Hacl.P256's dh_initiator, dh_responder, ecdsa_sign_p256_sha2, and ecdsa_verif_p256_sha2, compiled to Rust by an unverified step +✓ +P-256 ECDH, libcrux on ovh-sea: 431.73 µs, 5.48× the fastest; verified: HACL*'s F* proof of Hacl.P256's dh_initiator, dh_responder, ecdsa_sign_p256_sha2, and ecdsa_verif_p256_sha2, compiled to Rust by an unverified step +✓ +P-256 ECDH, OpenSSL on nixos: 71.25 µs, 1.67× the fastest +P-256 ECDH, OpenSSL on desktop: 52.91 µs, 1.77× the fastest +P-256 ECDH, OpenSSL on nixos2: 81.68 µs, 1.91× the fastest +P-256 ECDH, OpenSSL on kixtop: 49.96 µs, 1.90× the fastest +P-256 ECDH, OpenSSL on ovh-iad: 144.90 µs, 1.79× the fastest +P-256 ECDH, OpenSSL on ovh-sea: 135.76 µs, 1.72× the fastest Signatures - + Ed25519 sign Ed25519 sign, rind on nixos: 5.72 µs, 1.00× the fastest Ed25519 sign, rind on desktop: 4.15 µs, 1.00× the fastest Ed25519 sign, rind on nixos2: 7.13 µs, 1.00× the fastest -Ed25519 sign, rind on ovh-iad: 14.51 µs, 1.13× the fastest -Ed25519 sign, rind on ovh-sea: 11.68 µs, 1.00× the fastest -Ed25519 sign, aws-lc-rs on nixos: 6.13 µs, 1.07× the fastest -Ed25519 sign, aws-lc-rs on desktop: 4.56 µs, 1.10× the fastest -Ed25519 sign, aws-lc-rs on nixos2: 7.81 µs, 1.10× the fastest -Ed25519 sign, aws-lc-rs on ovh-iad: 12.85 µs, 1.00× the fastest -Ed25519 sign, aws-lc-rs on ovh-sea: 12.65 µs, 1.08× the fastest -Ed25519 sign, ring on nixos: 17.23 µs, 3.01× the fastest -Ed25519 sign, ring on desktop: 13.14 µs, 3.16× the fastest -Ed25519 sign, ring on nixos2: 22.26 µs, 3.12× the fastest -Ed25519 sign, ring on ovh-iad: 29.90 µs, 2.33× the fastest -Ed25519 sign, ring on ovh-sea: 28.95 µs, 2.48× the fastest -Ed25519 sign, RustCrypto + dalek on nixos: 13.30 µs, 2.33× the fastest -Ed25519 sign, RustCrypto + dalek on desktop: 9.61 µs, 2.31× the fastest -Ed25519 sign, RustCrypto + dalek on nixos2: 17.40 µs, 2.44× the fastest -Ed25519 sign, RustCrypto + dalek on ovh-iad: 25.23 µs, 1.96× the fastest -Ed25519 sign, RustCrypto + dalek on ovh-sea: 23.74 µs, 2.03× the fastest -Ed25519 sign, graviola on nixos: 5.83 µs, 1.02× the fastest -Ed25519 sign, graviola on desktop: 4.39 µs, 1.06× the fastest -Ed25519 sign, graviola on nixos2: 7.22 µs, 1.01× the fastest -Ed25519 sign, libcrux on nixos: 41.37 µs, 7.24× the fastest; verified: HACL*'s F* proof of Hacl.Ed25519's sign and verify, compiled to Rust by an unverified step -✓ -Ed25519 sign, libcrux on desktop: 28.97 µs, 6.97× the fastest; verified: HACL*'s F* proof of Hacl.Ed25519's sign and verify, compiled to Rust by an unverified step -✓ -Ed25519 sign, libcrux on nixos2: 53.66 µs, 7.52× the fastest; verified: HACL*'s F* proof of Hacl.Ed25519's sign and verify, compiled to Rust by an unverified step -✓ -Ed25519 sign, libcrux on ovh-iad: 92.43 µs, 7.19× the fastest; verified: HACL*'s F* proof of Hacl.Ed25519's sign and verify, compiled to Rust by an unverified step -✓ -Ed25519 sign, libcrux on ovh-sea: 73.35 µs, 6.28× the fastest; verified: HACL*'s F* proof of Hacl.Ed25519's sign and verify, compiled to Rust by an unverified step -✓ -Ed25519 sign, OpenSSL on nixos: 23.38 µs, 4.09× the fastest -Ed25519 sign, OpenSSL on desktop: 13.69 µs, 3.30× the fastest -Ed25519 sign, OpenSSL on nixos2: 31.01 µs, 4.35× the fastest -Ed25519 sign, OpenSSL on ovh-iad: 49.77 µs, 3.87× the fastest -Ed25519 sign, OpenSSL on ovh-sea: 41.96 µs, 3.59× the fastest +Ed25519 sign, rind on kixtop: 3.95 µs, 1.00× the fastest +Ed25519 sign, rind on ovh-iad: 14.51 µs, 1.13× the fastest +Ed25519 sign, rind on ovh-sea: 11.68 µs, 1.00× the fastest +Ed25519 sign, aws-lc-rs on nixos: 6.13 µs, 1.07× the fastest +Ed25519 sign, aws-lc-rs on desktop: 4.56 µs, 1.10× the fastest +Ed25519 sign, aws-lc-rs on nixos2: 7.81 µs, 1.10× the fastest +Ed25519 sign, aws-lc-rs on kixtop: 4.06 µs, 1.03× the fastest +Ed25519 sign, aws-lc-rs on ovh-iad: 12.85 µs, 1.00× the fastest +Ed25519 sign, aws-lc-rs on ovh-sea: 12.65 µs, 1.08× the fastest +Ed25519 sign, ring on nixos: 17.23 µs, 3.01× the fastest +Ed25519 sign, ring on desktop: 13.14 µs, 3.16× the fastest +Ed25519 sign, ring on nixos2: 22.26 µs, 3.12× the fastest +Ed25519 sign, ring on kixtop: 7.07 µs, 1.79× the fastest +Ed25519 sign, ring on ovh-iad: 29.90 µs, 2.33× the fastest +Ed25519 sign, ring on ovh-sea: 28.95 µs, 2.48× the fastest +Ed25519 sign, RustCrypto + dalek on nixos: 13.30 µs, 2.33× the fastest +Ed25519 sign, RustCrypto + dalek on desktop: 9.61 µs, 2.31× the fastest +Ed25519 sign, RustCrypto + dalek on nixos2: 17.40 µs, 2.44× the fastest +Ed25519 sign, RustCrypto + dalek on kixtop: 8.66 µs, 2.19× the fastest +Ed25519 sign, RustCrypto + dalek on ovh-iad: 25.23 µs, 1.96× the fastest +Ed25519 sign, RustCrypto + dalek on ovh-sea: 23.74 µs, 2.03× the fastest +Ed25519 sign, graviola on nixos: 5.83 µs, 1.02× the fastest +Ed25519 sign, graviola on desktop: 4.39 µs, 1.06× the fastest +Ed25519 sign, graviola on nixos2: 7.22 µs, 1.01× the fastest +Ed25519 sign, graviola on kixtop: 4.17 µs, 1.06× the fastest +Ed25519 sign, libcrux on nixos: 41.37 µs, 7.24× the fastest; verified: HACL*'s F* proof of Hacl.Ed25519's sign and verify, compiled to Rust by an unverified step +✓ +Ed25519 sign, libcrux on desktop: 28.97 µs, 6.97× the fastest; verified: HACL*'s F* proof of Hacl.Ed25519's sign and verify, compiled to Rust by an unverified step +✓ +Ed25519 sign, libcrux on nixos2: 53.66 µs, 7.52× the fastest; verified: HACL*'s F* proof of Hacl.Ed25519's sign and verify, compiled to Rust by an unverified step +✓ +Ed25519 sign, libcrux on kixtop: 22.12 µs, 5.60× the fastest; verified: HACL*'s F* proof of Hacl.Ed25519's sign and verify, compiled to Rust by an unverified step +✓ +Ed25519 sign, libcrux on ovh-iad: 92.43 µs, 7.19× the fastest; verified: HACL*'s F* proof of Hacl.Ed25519's sign and verify, compiled to Rust by an unverified step +✓ +Ed25519 sign, libcrux on ovh-sea: 73.35 µs, 6.28× the fastest; verified: HACL*'s F* proof of Hacl.Ed25519's sign and verify, compiled to Rust by an unverified step +✓ +Ed25519 sign, OpenSSL on nixos: 23.38 µs, 4.09× the fastest +Ed25519 sign, OpenSSL on desktop: 13.69 µs, 3.30× the fastest +Ed25519 sign, OpenSSL on nixos2: 31.01 µs, 4.35× the fastest +Ed25519 sign, OpenSSL on kixtop: 16.42 µs, 4.16× the fastest +Ed25519 sign, OpenSSL on ovh-iad: 49.77 µs, 3.87× the fastest +Ed25519 sign, OpenSSL on ovh-sea: 41.96 µs, 3.59× the fastest Ed25519 verify Ed25519 verify, rind on nixos: 27.15 µs, 1.09× the fastest Ed25519 verify, rind on desktop: 21.75 µs, 1.01× the fastest Ed25519 verify, rind on nixos2: 31.81 µs, 1.06× the fastest -Ed25519 verify, rind on ovh-iad: 60.71 µs, 1.30× the fastest -Ed25519 verify, rind on ovh-sea: 58.97 µs, 1.29× the fastest -Ed25519 verify, aws-lc-rs on nixos: 27.03 µs, 1.09× the fastest -Ed25519 verify, aws-lc-rs on desktop: 21.56 µs, 1.00× the fastest -Ed25519 verify, aws-lc-rs on nixos2: 31.62 µs, 1.06× the fastest -Ed25519 verify, aws-lc-rs on ovh-iad: 60.32 µs, 1.30× the fastest -Ed25519 verify, aws-lc-rs on ovh-sea: 57.63 µs, 1.26× the fastest -Ed25519 verify, ring on nixos: 34.76 µs, 1.40× the fastest -Ed25519 verify, ring on desktop: 26.22 µs, 1.22× the fastest -Ed25519 verify, ring on nixos2: 42.48 µs, 1.42× the fastest -Ed25519 verify, ring on ovh-iad: 61.26 µs, 1.32× the fastest -Ed25519 verify, ring on ovh-sea: 59.24 µs, 1.29× the fastest -Ed25519 verify, RustCrypto + dalek on nixos: 24.83 µs, 1.00× the fastest -Ed25519 verify, RustCrypto + dalek on desktop: 21.88 µs, 1.02× the fastest -Ed25519 verify, RustCrypto + dalek on nixos2: 29.88 µs, 1.00× the fastest -Ed25519 verify, RustCrypto + dalek on ovh-iad: 46.55 µs, 1.00× the fastest -Ed25519 verify, RustCrypto + dalek on ovh-sea: 45.80 µs, 1.00× the fastest -Ed25519 verify, graviola on nixos: 27.08 µs, 1.09× the fastest -Ed25519 verify, graviola on desktop: 21.61 µs, 1.00× the fastest -Ed25519 verify, graviola on nixos2: 32.22 µs, 1.08× the fastest -Ed25519 verify, libcrux on nixos: 54.52 µs, 2.20× the fastest; verified: HACL*'s F* proof of Hacl.Ed25519's sign and verify, compiled to Rust by an unverified step -✓ -Ed25519 verify, libcrux on desktop: 42.16 µs, 1.96× the fastest; verified: HACL*'s F* proof of Hacl.Ed25519's sign and verify, compiled to Rust by an unverified step -✓ -Ed25519 verify, libcrux on nixos2: 69.12 µs, 2.31× the fastest; verified: HACL*'s F* proof of Hacl.Ed25519's sign and verify, compiled to Rust by an unverified step -✓ -Ed25519 verify, libcrux on ovh-iad: 98.92 µs, 2.13× the fastest; verified: HACL*'s F* proof of Hacl.Ed25519's sign and verify, compiled to Rust by an unverified step -✓ -Ed25519 verify, libcrux on ovh-sea: 93.99 µs, 2.05× the fastest; verified: HACL*'s F* proof of Hacl.Ed25519's sign and verify, compiled to Rust by an unverified step -✓ -Ed25519 verify, OpenSSL on nixos: 79.25 µs, 3.19× the fastest -Ed25519 verify, OpenSSL on desktop: 45.59 µs, 2.11× the fastest -Ed25519 verify, OpenSSL on nixos2: 93.09 µs, 3.12× the fastest -Ed25519 verify, OpenSSL on ovh-iad: 140.95 µs, 3.03× the fastest -Ed25519 verify, OpenSSL on ovh-sea: 136.50 µs, 2.98× the fastest +Ed25519 verify, rind on kixtop: 18.66 µs, 1.01× the fastest +Ed25519 verify, rind on ovh-iad: 60.71 µs, 1.30× the fastest +Ed25519 verify, rind on ovh-sea: 58.97 µs, 1.29× the fastest +Ed25519 verify, aws-lc-rs on nixos: 27.03 µs, 1.09× the fastest +Ed25519 verify, aws-lc-rs on desktop: 21.56 µs, 1.00× the fastest +Ed25519 verify, aws-lc-rs on nixos2: 31.62 µs, 1.06× the fastest +Ed25519 verify, aws-lc-rs on kixtop: 18.52 µs, 1.01× the fastest +Ed25519 verify, aws-lc-rs on ovh-iad: 60.32 µs, 1.30× the fastest +Ed25519 verify, aws-lc-rs on ovh-sea: 57.63 µs, 1.26× the fastest +Ed25519 verify, ring on nixos: 34.76 µs, 1.40× the fastest +Ed25519 verify, ring on desktop: 26.22 µs, 1.22× the fastest +Ed25519 verify, ring on nixos2: 42.48 µs, 1.42× the fastest +Ed25519 verify, ring on kixtop: 19.94 µs, 1.08× the fastest +Ed25519 verify, ring on ovh-iad: 61.26 µs, 1.32× the fastest +Ed25519 verify, ring on ovh-sea: 59.24 µs, 1.29× the fastest +Ed25519 verify, RustCrypto + dalek on nixos: 24.83 µs, 1.00× the fastest +Ed25519 verify, RustCrypto + dalek on desktop: 21.88 µs, 1.02× the fastest +Ed25519 verify, RustCrypto + dalek on nixos2: 29.88 µs, 1.00× the fastest +Ed25519 verify, RustCrypto + dalek on kixtop: 18.42 µs, 1.00× the fastest +Ed25519 verify, RustCrypto + dalek on ovh-iad: 46.55 µs, 1.00× the fastest +Ed25519 verify, RustCrypto + dalek on ovh-sea: 45.80 µs, 1.00× the fastest +Ed25519 verify, graviola on nixos: 27.08 µs, 1.09× the fastest +Ed25519 verify, graviola on desktop: 21.61 µs, 1.00× the fastest +Ed25519 verify, graviola on nixos2: 32.22 µs, 1.08× the fastest +Ed25519 verify, graviola on kixtop: 18.69 µs, 1.01× the fastest +Ed25519 verify, libcrux on nixos: 54.52 µs, 2.20× the fastest; verified: HACL*'s F* proof of Hacl.Ed25519's sign and verify, compiled to Rust by an unverified step +✓ +Ed25519 verify, libcrux on desktop: 42.16 µs, 1.96× the fastest; verified: HACL*'s F* proof of Hacl.Ed25519's sign and verify, compiled to Rust by an unverified step +✓ +Ed25519 verify, libcrux on nixos2: 69.12 µs, 2.31× the fastest; verified: HACL*'s F* proof of Hacl.Ed25519's sign and verify, compiled to Rust by an unverified step +✓ +Ed25519 verify, libcrux on kixtop: 29.57 µs, 1.61× the fastest; verified: HACL*'s F* proof of Hacl.Ed25519's sign and verify, compiled to Rust by an unverified step +✓ +Ed25519 verify, libcrux on ovh-iad: 98.92 µs, 2.13× the fastest; verified: HACL*'s F* proof of Hacl.Ed25519's sign and verify, compiled to Rust by an unverified step +✓ +Ed25519 verify, libcrux on ovh-sea: 93.99 µs, 2.05× the fastest; verified: HACL*'s F* proof of Hacl.Ed25519's sign and verify, compiled to Rust by an unverified step +✓ +Ed25519 verify, OpenSSL on nixos: 79.25 µs, 3.19× the fastest +Ed25519 verify, OpenSSL on desktop: 45.59 µs, 2.11× the fastest +Ed25519 verify, OpenSSL on nixos2: 93.09 µs, 3.12× the fastest +Ed25519 verify, OpenSSL on kixtop: 41.08 µs, 2.23× the fastest +Ed25519 verify, OpenSSL on ovh-iad: 140.95 µs, 3.03× the fastest +Ed25519 verify, OpenSSL on ovh-sea: 136.50 µs, 2.98× the fastest P-256 ECDSA sign P-256 ECDSA sign, rind on nixos: 9.62 µs, 1.00× the fastest P-256 ECDSA sign, rind on desktop: 6.84 µs, 1.00× the fastest P-256 ECDSA sign, rind on nixos2: 13.11 µs, 1.00× the fastest -P-256 ECDSA sign, rind on ovh-iad: 22.42 µs, 1.00× the fastest -P-256 ECDSA sign, rind on ovh-sea: 21.44 µs, 1.00× the fastest -P-256 ECDSA sign, aws-lc-rs on nixos: 12.66 µs, 1.32× the fastest -P-256 ECDSA sign, aws-lc-rs on desktop: 12.33 µs, 1.80× the fastest -P-256 ECDSA sign, aws-lc-rs on nixos2: 19.80 µs, 1.51× the fastest -P-256 ECDSA sign, aws-lc-rs on ovh-iad: 24.53 µs, 1.09× the fastest -P-256 ECDSA sign, aws-lc-rs on ovh-sea: 23.93 µs, 1.12× the fastest -P-256 ECDSA sign, ring on nixos: 13.68 µs, 1.42× the fastest -P-256 ECDSA sign, ring on desktop: 12.24 µs, 1.79× the fastest -P-256 ECDSA sign, ring on nixos2: 14.86 µs, 1.13× the fastest -P-256 ECDSA sign, ring on ovh-iad: 26.21 µs, 1.17× the fastest -P-256 ECDSA sign, ring on ovh-sea: 24.84 µs, 1.16× the fastest -P-256 ECDSA sign, RustCrypto + dalek on nixos: 70.62 µs, 7.34× the fastest -P-256 ECDSA sign, RustCrypto + dalek on desktop: 31.65 µs, 4.63× the fastest -P-256 ECDSA sign, RustCrypto + dalek on nixos2: 69.11 µs, 5.27× the fastest -P-256 ECDSA sign, RustCrypto + dalek on ovh-iad: 107.76 µs, 4.81× the fastest -P-256 ECDSA sign, RustCrypto + dalek on ovh-sea: 107.39 µs, 5.01× the fastest -P-256 ECDSA sign, graviola on nixos: 11.49 µs, 1.19× the fastest -P-256 ECDSA sign, graviola on desktop: 9.26 µs, 1.35× the fastest -P-256 ECDSA sign, graviola on nixos2: 19.89 µs, 1.52× the fastest -P-256 ECDSA sign, libcrux on nixos: 95.47 µs, 9.92× the fastest; verified: HACL*'s F* proof of Hacl.P256's dh_initiator, dh_responder, ecdsa_sign_p256_sha2, and ecdsa_verif_p256_sha2, compiled to Rust by an unverified step -✓ -P-256 ECDSA sign, libcrux on desktop: 61.34 µs, 8.97× the fastest; verified: HACL*'s F* proof of Hacl.P256's dh_initiator, dh_responder, ecdsa_sign_p256_sha2, and ecdsa_verif_p256_sha2, compiled to Rust by an unverified step -✓ -P-256 ECDSA sign, libcrux on nixos2: 102.03 µs, 7.78× the fastest; verified: HACL*'s F* proof of Hacl.P256's dh_initiator, dh_responder, ecdsa_sign_p256_sha2, and ecdsa_verif_p256_sha2, compiled to Rust by an unverified step -✓ -P-256 ECDSA sign, libcrux on ovh-iad: 163.02 µs, 7.27× the fastest; verified: HACL*'s F* proof of Hacl.P256's dh_initiator, dh_responder, ecdsa_sign_p256_sha2, and ecdsa_verif_p256_sha2, compiled to Rust by an unverified step -✓ -P-256 ECDSA sign, libcrux on ovh-sea: 156.95 µs, 7.32× the fastest; verified: HACL*'s F* proof of Hacl.P256's dh_initiator, dh_responder, ecdsa_sign_p256_sha2, and ecdsa_verif_p256_sha2, compiled to Rust by an unverified step -✓ -P-256 ECDSA sign, OpenSSL on nixos: 18.04 µs, 1.88× the fastest -P-256 ECDSA sign, OpenSSL on desktop: 14.33 µs, 2.09× the fastest -P-256 ECDSA sign, OpenSSL on nixos2: 20.35 µs, 1.55× the fastest -P-256 ECDSA sign, OpenSSL on ovh-iad: 32.70 µs, 1.46× the fastest -P-256 ECDSA sign, OpenSSL on ovh-sea: 31.82 µs, 1.48× the fastest +P-256 ECDSA sign, rind on kixtop: 7.11 µs, 1.00× the fastest; verified: rind's Lean proof, through Aeneas and hand models of the function-pointer dispatch and of the nonces' draws through a dyn RandomSource, which Aeneas cannot translate, of its signature API's P-256 ECDSA with SHA-256 and fixed-length signatures, key generation and loading, signing, and verification, down to s2n-bignum's routines, composed with s2n-bignum's HOL Light proofs of p256_scalarmulbase_alt, p256_montjadd_alt, p256_montjdouble_alt, p256_montjmixadd_alt, bignum_inv_p256, bignum_neg_p256, bignum_tomont_p256, bignum_demont_p256, bignum_add_p256, bignum_montmul_p256, bignum_montsqr_p256, bignum_mod_n256_4, bignum_modadd, bignum_montmul, bignum_demont, bignum_modinv, and bignum_eq, of s2n-bignum's own object code, which rind transliterates, with the group laws its twin multiplication relies on proven from Mathlib's and the generator's order n proven, assuming HOL Light's P256_GROUP_ELEMENT_ORDER, that a point has order n, only for verification with a parsed public key, and proving a signature right when signing returns, as its nonce loop has no bound +✓ +P-256 ECDSA sign, rind on ovh-iad: 22.42 µs, 1.00× the fastest +P-256 ECDSA sign, rind on ovh-sea: 21.44 µs, 1.00× the fastest +P-256 ECDSA sign, aws-lc-rs on nixos: 12.66 µs, 1.32× the fastest +P-256 ECDSA sign, aws-lc-rs on desktop: 12.33 µs, 1.80× the fastest +P-256 ECDSA sign, aws-lc-rs on nixos2: 19.80 µs, 1.51× the fastest +P-256 ECDSA sign, aws-lc-rs on kixtop: 11.27 µs, 1.58× the fastest +P-256 ECDSA sign, aws-lc-rs on ovh-iad: 24.53 µs, 1.09× the fastest +P-256 ECDSA sign, aws-lc-rs on ovh-sea: 23.93 µs, 1.12× the fastest +P-256 ECDSA sign, ring on nixos: 13.68 µs, 1.42× the fastest +P-256 ECDSA sign, ring on desktop: 12.24 µs, 1.79× the fastest +P-256 ECDSA sign, ring on nixos2: 14.86 µs, 1.13× the fastest +P-256 ECDSA sign, ring on kixtop: 11.01 µs, 1.55× the fastest +P-256 ECDSA sign, ring on ovh-iad: 26.21 µs, 1.17× the fastest +P-256 ECDSA sign, ring on ovh-sea: 24.84 µs, 1.16× the fastest +P-256 ECDSA sign, RustCrypto + dalek on nixos: 70.62 µs, 7.34× the fastest +P-256 ECDSA sign, RustCrypto + dalek on desktop: 31.65 µs, 4.63× the fastest +P-256 ECDSA sign, RustCrypto + dalek on nixos2: 69.11 µs, 5.27× the fastest +P-256 ECDSA sign, RustCrypto + dalek on kixtop: 44.33 µs, 6.23× the fastest +P-256 ECDSA sign, RustCrypto + dalek on ovh-iad: 107.76 µs, 4.81× the fastest +P-256 ECDSA sign, RustCrypto + dalek on ovh-sea: 107.39 µs, 5.01× the fastest +P-256 ECDSA sign, graviola on nixos: 11.49 µs, 1.19× the fastest +P-256 ECDSA sign, graviola on desktop: 9.26 µs, 1.35× the fastest +P-256 ECDSA sign, graviola on nixos2: 19.89 µs, 1.52× the fastest +P-256 ECDSA sign, graviola on kixtop: 8.83 µs, 1.24× the fastest +P-256 ECDSA sign, libcrux on nixos: 95.47 µs, 9.92× the fastest; verified: HACL*'s F* proof of Hacl.P256's dh_initiator, dh_responder, ecdsa_sign_p256_sha2, and ecdsa_verif_p256_sha2, compiled to Rust by an unverified step +✓ +P-256 ECDSA sign, libcrux on desktop: 61.34 µs, 8.97× the fastest; verified: HACL*'s F* proof of Hacl.P256's dh_initiator, dh_responder, ecdsa_sign_p256_sha2, and ecdsa_verif_p256_sha2, compiled to Rust by an unverified step +✓ +P-256 ECDSA sign, libcrux on nixos2: 102.03 µs, 7.78× the fastest; verified: HACL*'s F* proof of Hacl.P256's dh_initiator, dh_responder, ecdsa_sign_p256_sha2, and ecdsa_verif_p256_sha2, compiled to Rust by an unverified step +✓ +P-256 ECDSA sign, libcrux on kixtop: 67.38 µs, 9.47× the fastest; verified: HACL*'s F* proof of Hacl.P256's dh_initiator, dh_responder, ecdsa_sign_p256_sha2, and ecdsa_verif_p256_sha2, compiled to Rust by an unverified step +✓ +P-256 ECDSA sign, libcrux on ovh-iad: 163.02 µs, 7.27× the fastest; verified: HACL*'s F* proof of Hacl.P256's dh_initiator, dh_responder, ecdsa_sign_p256_sha2, and ecdsa_verif_p256_sha2, compiled to Rust by an unverified step +✓ +P-256 ECDSA sign, libcrux on ovh-sea: 156.95 µs, 7.32× the fastest; verified: HACL*'s F* proof of Hacl.P256's dh_initiator, dh_responder, ecdsa_sign_p256_sha2, and ecdsa_verif_p256_sha2, compiled to Rust by an unverified step +✓ +P-256 ECDSA sign, OpenSSL on nixos: 18.04 µs, 1.88× the fastest +P-256 ECDSA sign, OpenSSL on desktop: 14.33 µs, 2.09× the fastest +P-256 ECDSA sign, OpenSSL on nixos2: 20.35 µs, 1.55× the fastest +P-256 ECDSA sign, OpenSSL on kixtop: 12.62 µs, 1.77× the fastest +P-256 ECDSA sign, OpenSSL on ovh-iad: 32.70 µs, 1.46× the fastest +P-256 ECDSA sign, OpenSSL on ovh-sea: 31.82 µs, 1.48× the fastest P-256 ECDSA verify P-256 ECDSA verify, rind on nixos: 39.25 µs, 1.00× the fastest P-256 ECDSA verify, rind on desktop: 30.95 µs, 1.03× the fastest P-256 ECDSA verify, rind on nixos2: 41.56 µs, 1.00× the fastest -P-256 ECDSA verify, rind on ovh-iad: 81.50 µs, 1.05× the fastest -P-256 ECDSA verify, rind on ovh-sea: 77.75 µs, 1.04× the fastest -P-256 ECDSA verify, aws-lc-rs on nixos: 40.24 µs, 1.03× the fastest -P-256 ECDSA verify, aws-lc-rs on desktop: 30.08 µs, 1.00× the fastest -P-256 ECDSA verify, aws-lc-rs on nixos2: 43.27 µs, 1.04× the fastest -P-256 ECDSA verify, aws-lc-rs on ovh-iad: 77.59 µs, 1.00× the fastest -P-256 ECDSA verify, aws-lc-rs on ovh-sea: 74.54 µs, 1.00× the fastest -P-256 ECDSA verify, ring on nixos: 41.25 µs, 1.05× the fastest -P-256 ECDSA verify, ring on desktop: 33.74 µs, 1.12× the fastest -P-256 ECDSA verify, ring on nixos2: 43.93 µs, 1.06× the fastest -P-256 ECDSA verify, ring on ovh-iad: 79.97 µs, 1.03× the fastest -P-256 ECDSA verify, ring on ovh-sea: 78.73 µs, 1.06× the fastest -P-256 ECDSA verify, RustCrypto + dalek on nixos: 226.27 µs, 5.77× the fastest -P-256 ECDSA verify, RustCrypto + dalek on desktop: 104.58 µs, 3.48× the fastest -P-256 ECDSA verify, RustCrypto + dalek on nixos2: 197.15 µs, 4.74× the fastest -P-256 ECDSA verify, RustCrypto + dalek on ovh-iad: 324.89 µs, 4.19× the fastest -P-256 ECDSA verify, RustCrypto + dalek on ovh-sea: 305.79 µs, 4.10× the fastest -P-256 ECDSA verify, graviola on nixos: 41.92 µs, 1.07× the fastest -P-256 ECDSA verify, graviola on desktop: 32.89 µs, 1.09× the fastest -P-256 ECDSA verify, graviola on nixos2: 44.30 µs, 1.07× the fastest -P-256 ECDSA verify, libcrux on nixos: 215.83 µs, 5.50× the fastest; verified: HACL*'s F* proof of Hacl.P256's dh_initiator, dh_responder, ecdsa_sign_p256_sha2, and ecdsa_verif_p256_sha2, compiled to Rust by an unverified step -✓ -P-256 ECDSA verify, libcrux on desktop: 147.11 µs, 4.89× the fastest; verified: HACL*'s F* proof of Hacl.P256's dh_initiator, dh_responder, ecdsa_sign_p256_sha2, and ecdsa_verif_p256_sha2, compiled to Rust by an unverified step -✓ -P-256 ECDSA verify, libcrux on nixos2: 236.87 µs, 5.70× the fastest; verified: HACL*'s F* proof of Hacl.P256's dh_initiator, dh_responder, ecdsa_sign_p256_sha2, and ecdsa_verif_p256_sha2, compiled to Rust by an unverified step -✓ -P-256 ECDSA verify, libcrux on ovh-iad: 389.47 µs, 5.02× the fastest; verified: HACL*'s F* proof of Hacl.P256's dh_initiator, dh_responder, ecdsa_sign_p256_sha2, and ecdsa_verif_p256_sha2, compiled to Rust by an unverified step -✓ -P-256 ECDSA verify, libcrux on ovh-sea: 363.17 µs, 4.87× the fastest; verified: HACL*'s F* proof of Hacl.P256's dh_initiator, dh_responder, ecdsa_sign_p256_sha2, and ecdsa_verif_p256_sha2, compiled to Rust by an unverified step -✓ -P-256 ECDSA verify, OpenSSL on nixos: 60.27 µs, 1.54× the fastest -P-256 ECDSA verify, OpenSSL on desktop: 46.41 µs, 1.54× the fastest -P-256 ECDSA verify, OpenSSL on nixos2: 68.34 µs, 1.64× the fastest -P-256 ECDSA verify, OpenSSL on ovh-iad: 115.24 µs, 1.49× the fastest -P-256 ECDSA verify, OpenSSL on ovh-sea: 111.98 µs, 1.50× the fastest +P-256 ECDSA verify, rind on kixtop: 27.15 µs, 1.00× the fastest; verified: rind's Lean proof, through Aeneas and hand models of the function-pointer dispatch and of the nonces' draws through a dyn RandomSource, which Aeneas cannot translate, of its signature API's P-256 ECDSA with SHA-256 and fixed-length signatures, key generation and loading, signing, and verification, down to s2n-bignum's routines, composed with s2n-bignum's HOL Light proofs of p256_scalarmulbase_alt, p256_montjadd_alt, p256_montjdouble_alt, p256_montjmixadd_alt, bignum_inv_p256, bignum_neg_p256, bignum_tomont_p256, bignum_demont_p256, bignum_add_p256, bignum_montmul_p256, bignum_montsqr_p256, bignum_mod_n256_4, bignum_modadd, bignum_montmul, bignum_demont, bignum_modinv, and bignum_eq, of s2n-bignum's own object code, which rind transliterates, with the group laws its twin multiplication relies on proven from Mathlib's and the generator's order n proven, assuming HOL Light's P256_GROUP_ELEMENT_ORDER, that a point has order n, only for verification with a parsed public key, and proving a signature right when signing returns, as its nonce loop has no bound +✓ +P-256 ECDSA verify, rind on ovh-iad: 81.50 µs, 1.05× the fastest +P-256 ECDSA verify, rind on ovh-sea: 77.75 µs, 1.04× the fastest +P-256 ECDSA verify, aws-lc-rs on nixos: 40.24 µs, 1.03× the fastest +P-256 ECDSA verify, aws-lc-rs on desktop: 30.08 µs, 1.00× the fastest +P-256 ECDSA verify, aws-lc-rs on nixos2: 43.27 µs, 1.04× the fastest +P-256 ECDSA verify, aws-lc-rs on kixtop: 27.15 µs, 1.00× the fastest +P-256 ECDSA verify, aws-lc-rs on ovh-iad: 77.59 µs, 1.00× the fastest +P-256 ECDSA verify, aws-lc-rs on ovh-sea: 74.54 µs, 1.00× the fastest +P-256 ECDSA verify, ring on nixos: 41.25 µs, 1.05× the fastest +P-256 ECDSA verify, ring on desktop: 33.74 µs, 1.12× the fastest +P-256 ECDSA verify, ring on nixos2: 43.93 µs, 1.06× the fastest +P-256 ECDSA verify, ring on kixtop: 29.35 µs, 1.08× the fastest +P-256 ECDSA verify, ring on ovh-iad: 79.97 µs, 1.03× the fastest +P-256 ECDSA verify, ring on ovh-sea: 78.73 µs, 1.06× the fastest +P-256 ECDSA verify, RustCrypto + dalek on nixos: 226.27 µs, 5.77× the fastest +P-256 ECDSA verify, RustCrypto + dalek on desktop: 104.58 µs, 3.48× the fastest +P-256 ECDSA verify, RustCrypto + dalek on nixos2: 197.15 µs, 4.74× the fastest +P-256 ECDSA verify, RustCrypto + dalek on kixtop: 157.87 µs, 5.82× the fastest +P-256 ECDSA verify, RustCrypto + dalek on ovh-iad: 324.89 µs, 4.19× the fastest +P-256 ECDSA verify, RustCrypto + dalek on ovh-sea: 305.79 µs, 4.10× the fastest +P-256 ECDSA verify, graviola on nixos: 41.92 µs, 1.07× the fastest +P-256 ECDSA verify, graviola on desktop: 32.89 µs, 1.09× the fastest +P-256 ECDSA verify, graviola on nixos2: 44.30 µs, 1.07× the fastest +P-256 ECDSA verify, graviola on kixtop: 28.60 µs, 1.05× the fastest +P-256 ECDSA verify, libcrux on nixos: 215.83 µs, 5.50× the fastest; verified: HACL*'s F* proof of Hacl.P256's dh_initiator, dh_responder, ecdsa_sign_p256_sha2, and ecdsa_verif_p256_sha2, compiled to Rust by an unverified step +✓ +P-256 ECDSA verify, libcrux on desktop: 147.11 µs, 4.89× the fastest; verified: HACL*'s F* proof of Hacl.P256's dh_initiator, dh_responder, ecdsa_sign_p256_sha2, and ecdsa_verif_p256_sha2, compiled to Rust by an unverified step +✓ +P-256 ECDSA verify, libcrux on nixos2: 236.87 µs, 5.70× the fastest; verified: HACL*'s F* proof of Hacl.P256's dh_initiator, dh_responder, ecdsa_sign_p256_sha2, and ecdsa_verif_p256_sha2, compiled to Rust by an unverified step +✓ +P-256 ECDSA verify, libcrux on kixtop: 156.54 µs, 5.77× the fastest; verified: HACL*'s F* proof of Hacl.P256's dh_initiator, dh_responder, ecdsa_sign_p256_sha2, and ecdsa_verif_p256_sha2, compiled to Rust by an unverified step +✓ +P-256 ECDSA verify, libcrux on ovh-iad: 389.47 µs, 5.02× the fastest; verified: HACL*'s F* proof of Hacl.P256's dh_initiator, dh_responder, ecdsa_sign_p256_sha2, and ecdsa_verif_p256_sha2, compiled to Rust by an unverified step +✓ +P-256 ECDSA verify, libcrux on ovh-sea: 363.17 µs, 4.87× the fastest; verified: HACL*'s F* proof of Hacl.P256's dh_initiator, dh_responder, ecdsa_sign_p256_sha2, and ecdsa_verif_p256_sha2, compiled to Rust by an unverified step +✓ +P-256 ECDSA verify, OpenSSL on nixos: 60.27 µs, 1.54× the fastest +P-256 ECDSA verify, OpenSSL on desktop: 46.41 µs, 1.54× the fastest +P-256 ECDSA verify, OpenSSL on nixos2: 68.34 µs, 1.64× the fastest +P-256 ECDSA verify, OpenSSL on kixtop: 41.90 µs, 1.54× the fastest +P-256 ECDSA verify, OpenSSL on ovh-iad: 115.24 µs, 1.49× the fastest +P-256 ECDSA verify, OpenSSL on ovh-sea: 111.98 µs, 1.50× the fastest Hashes and KDFs - + SHA-256, 64 B SHA-256, 64 B, rind on nixos: 69 ns, 1.17× the fastest SHA-256, 64 B, rind on desktop: 28 ns, 1.00× the fastest SHA-256, 64 B, rind on nixos2: 244 ns, 1.00× the fastest -SHA-256, 64 B, rind on ovh-iad: 399 ns, 1.00× the fastest -SHA-256, 64 B, rind on ovh-sea: 386 ns, 1.00× the fastest -SHA-256, 64 B, aws-lc-rs on nixos: 96 ns, 1.63× the fastest -SHA-256, 64 B, aws-lc-rs on desktop: 57 ns, 2.02× the fastest -SHA-256, 64 B, aws-lc-rs on nixos2: 307 ns, 1.26× the fastest -SHA-256, 64 B, aws-lc-rs on ovh-iad: 491 ns, 1.23× the fastest -SHA-256, 64 B, aws-lc-rs on ovh-sea: 481 ns, 1.24× the fastest -SHA-256, 64 B, ring on nixos: 78 ns, 1.34× the fastest -SHA-256, 64 B, ring on desktop: 58 ns, 2.04× the fastest -SHA-256, 64 B, ring on nixos2: 277 ns, 1.13× the fastest -SHA-256, 64 B, ring on ovh-iad: 449 ns, 1.13× the fastest -SHA-256, 64 B, ring on ovh-sea: 432 ns, 1.12× the fastest -SHA-256, 64 B, RustCrypto + dalek on nixos: 59 ns, 1.00× the fastest -SHA-256, 64 B, RustCrypto + dalek on desktop: 40 ns, 1.41× the fastest -SHA-256, 64 B, RustCrypto + dalek on nixos2: 473 ns, 1.94× the fastest -SHA-256, 64 B, RustCrypto + dalek on ovh-iad: 762 ns, 1.91× the fastest -SHA-256, 64 B, RustCrypto + dalek on ovh-sea: 734 ns, 1.90× the fastest -SHA-256, 64 B, graviola on nixos: 67 ns, 1.15× the fastest -SHA-256, 64 B, graviola on desktop: 41 ns, 1.45× the fastest -SHA-256, 64 B, graviola on nixos2: 576 ns, 2.37× the fastest -SHA-256, 64 B, libcrux on nixos: 385 ns, 6.56× the fastest; verified: HACL*'s F* proof of Hacl.Streaming.SHA2's hash_256 and hash_512, compiled to Rust by an unverified step -✓ -SHA-256, 64 B, libcrux on desktop: 211 ns, 7.50× the fastest; verified: HACL*'s F* proof of Hacl.Streaming.SHA2's hash_256 and hash_512, compiled to Rust by an unverified step -✓ -SHA-256, 64 B, libcrux on nixos2: 485 ns, 1.99× the fastest; verified: HACL*'s F* proof of Hacl.Streaming.SHA2's hash_256 and hash_512, compiled to Rust by an unverified step -✓ -SHA-256, 64 B, libcrux on ovh-iad: 764 ns, 1.92× the fastest; verified: HACL*'s F* proof of Hacl.Streaming.SHA2's hash_256 and hash_512, compiled to Rust by an unverified step -✓ -SHA-256, 64 B, libcrux on ovh-sea: 760 ns, 1.97× the fastest; verified: HACL*'s F* proof of Hacl.Streaming.SHA2's hash_256 and hash_512, compiled to Rust by an unverified step -✓ -SHA-256, 64 B, OpenSSL on nixos: 244 ns, 4.15× the fastest -SHA-256, 64 B, OpenSSL on desktop: 161 ns, 5.72× the fastest -SHA-256, 64 B, OpenSSL on nixos2: 505 ns, 2.07× the fastest -SHA-256, 64 B, OpenSSL on ovh-iad: 813 ns, 2.04× the fastest -SHA-256, 64 B, OpenSSL on ovh-sea: 801 ns, 2.07× the fastest +SHA-256, 64 B, rind on kixtop: 93 ns, 2.58× the fastest +SHA-256, 64 B, rind on ovh-iad: 399 ns, 1.00× the fastest +SHA-256, 64 B, rind on ovh-sea: 386 ns, 1.00× the fastest +SHA-256, 64 B, aws-lc-rs on nixos: 96 ns, 1.63× the fastest +SHA-256, 64 B, aws-lc-rs on desktop: 57 ns, 2.02× the fastest +SHA-256, 64 B, aws-lc-rs on nixos2: 307 ns, 1.26× the fastest +SHA-256, 64 B, aws-lc-rs on kixtop: 71 ns, 1.97× the fastest +SHA-256, 64 B, aws-lc-rs on ovh-iad: 491 ns, 1.23× the fastest +SHA-256, 64 B, aws-lc-rs on ovh-sea: 481 ns, 1.24× the fastest +SHA-256, 64 B, ring on nixos: 78 ns, 1.34× the fastest +SHA-256, 64 B, ring on desktop: 58 ns, 2.04× the fastest +SHA-256, 64 B, ring on nixos2: 277 ns, 1.13× the fastest +SHA-256, 64 B, ring on kixtop: 45 ns, 1.25× the fastest +SHA-256, 64 B, ring on ovh-iad: 449 ns, 1.13× the fastest +SHA-256, 64 B, ring on ovh-sea: 432 ns, 1.12× the fastest +SHA-256, 64 B, RustCrypto + dalek on nixos: 59 ns, 1.00× the fastest +SHA-256, 64 B, RustCrypto + dalek on desktop: 40 ns, 1.41× the fastest +SHA-256, 64 B, RustCrypto + dalek on nixos2: 473 ns, 1.94× the fastest +SHA-256, 64 B, RustCrypto + dalek on kixtop: 37 ns, 1.03× the fastest +SHA-256, 64 B, RustCrypto + dalek on ovh-iad: 762 ns, 1.91× the fastest +SHA-256, 64 B, RustCrypto + dalek on ovh-sea: 734 ns, 1.90× the fastest +SHA-256, 64 B, graviola on nixos: 67 ns, 1.15× the fastest +SHA-256, 64 B, graviola on desktop: 41 ns, 1.45× the fastest +SHA-256, 64 B, graviola on nixos2: 576 ns, 2.37× the fastest +SHA-256, 64 B, graviola on kixtop: 36 ns, 1.00× the fastest +SHA-256, 64 B, libcrux on nixos: 385 ns, 6.56× the fastest; verified: HACL*'s F* proof of Hacl.Streaming.SHA2's hash_256 and hash_512, compiled to Rust by an unverified step +✓ +SHA-256, 64 B, libcrux on desktop: 211 ns, 7.50× the fastest; verified: HACL*'s F* proof of Hacl.Streaming.SHA2's hash_256 and hash_512, compiled to Rust by an unverified step +✓ +SHA-256, 64 B, libcrux on nixos2: 485 ns, 1.99× the fastest; verified: HACL*'s F* proof of Hacl.Streaming.SHA2's hash_256 and hash_512, compiled to Rust by an unverified step +✓ +SHA-256, 64 B, libcrux on kixtop: 232 ns, 6.45× the fastest; verified: HACL*'s F* proof of Hacl.Streaming.SHA2's hash_256 and hash_512, compiled to Rust by an unverified step +✓ +SHA-256, 64 B, libcrux on ovh-iad: 764 ns, 1.92× the fastest; verified: HACL*'s F* proof of Hacl.Streaming.SHA2's hash_256 and hash_512, compiled to Rust by an unverified step +✓ +SHA-256, 64 B, libcrux on ovh-sea: 760 ns, 1.97× the fastest; verified: HACL*'s F* proof of Hacl.Streaming.SHA2's hash_256 and hash_512, compiled to Rust by an unverified step +✓ +SHA-256, 64 B, OpenSSL on nixos: 244 ns, 4.15× the fastest +SHA-256, 64 B, OpenSSL on desktop: 161 ns, 5.72× the fastest +SHA-256, 64 B, OpenSSL on nixos2: 505 ns, 2.07× the fastest +SHA-256, 64 B, OpenSSL on kixtop: 162 ns, 4.50× the fastest +SHA-256, 64 B, OpenSSL on ovh-iad: 813 ns, 2.04× the fastest +SHA-256, 64 B, OpenSSL on ovh-sea: 801 ns, 2.07× the fastest SHA-256, 1350 B SHA-256, 1350 B, rind on nixos: 620 ns, 1.00× the fastest SHA-256, 1350 B, rind on desktop: 279 ns, 1.00× the fastest SHA-256, 1350 B, rind on nixos2: 2.46 µs, 1.00× the fastest -SHA-256, 1350 B, rind on ovh-iad: 3.87 µs, 1.00× the fastest -SHA-256, 1350 B, rind on ovh-sea: 3.85 µs, 1.00× the fastest -SHA-256, 1350 B, aws-lc-rs on nixos: 740 ns, 1.20× the fastest -SHA-256, 1350 B, aws-lc-rs on desktop: 312 ns, 1.12× the fastest -SHA-256, 1350 B, aws-lc-rs on nixos2: 2.79 µs, 1.14× the fastest -SHA-256, 1350 B, aws-lc-rs on ovh-iad: 4.74 µs, 1.22× the fastest -SHA-256, 1350 B, aws-lc-rs on ovh-sea: 4.75 µs, 1.23× the fastest -SHA-256, 1350 B, ring on nixos: 637 ns, 1.03× the fastest -SHA-256, 1350 B, ring on desktop: 304 ns, 1.09× the fastest -SHA-256, 1350 B, ring on nixos2: 2.82 µs, 1.15× the fastest -SHA-256, 1350 B, ring on ovh-iad: 4.47 µs, 1.15× the fastest -SHA-256, 1350 B, ring on ovh-sea: 4.31 µs, 1.12× the fastest -SHA-256, 1350 B, RustCrypto + dalek on nixos: 618 ns, 1.00× the fastest -SHA-256, 1350 B, RustCrypto + dalek on desktop: 296 ns, 1.06× the fastest -SHA-256, 1350 B, RustCrypto + dalek on nixos2: 5.11 µs, 2.08× the fastest -SHA-256, 1350 B, RustCrypto + dalek on ovh-iad: 8.13 µs, 2.10× the fastest -SHA-256, 1350 B, RustCrypto + dalek on ovh-sea: 8.29 µs, 2.15× the fastest -SHA-256, 1350 B, graviola on nixos: 637 ns, 1.03× the fastest -SHA-256, 1350 B, graviola on desktop: 297 ns, 1.06× the fastest -SHA-256, 1350 B, graviola on nixos2: 6.07 µs, 2.47× the fastest -SHA-256, 1350 B, libcrux on nixos: 3.71 µs, 6.00× the fastest; verified: HACL*'s F* proof of Hacl.Streaming.SHA2's hash_256 and hash_512, compiled to Rust by an unverified step -✓ -SHA-256, 1350 B, libcrux on desktop: 2.31 µs, 8.25× the fastest; verified: HACL*'s F* proof of Hacl.Streaming.SHA2's hash_256 and hash_512, compiled to Rust by an unverified step -✓ -SHA-256, 1350 B, libcrux on nixos2: 5.23 µs, 2.13× the fastest; verified: HACL*'s F* proof of Hacl.Streaming.SHA2's hash_256 and hash_512, compiled to Rust by an unverified step -✓ -SHA-256, 1350 B, libcrux on ovh-iad: 8.43 µs, 2.18× the fastest; verified: HACL*'s F* proof of Hacl.Streaming.SHA2's hash_256 and hash_512, compiled to Rust by an unverified step -✓ -SHA-256, 1350 B, libcrux on ovh-sea: 8.24 µs, 2.14× the fastest; verified: HACL*'s F* proof of Hacl.Streaming.SHA2's hash_256 and hash_512, compiled to Rust by an unverified step -✓ -SHA-256, 1350 B, OpenSSL on nixos: 815 ns, 1.32× the fastest -SHA-256, 1350 B, OpenSSL on desktop: 415 ns, 1.48× the fastest -SHA-256, 1350 B, OpenSSL on nixos2: 2.68 µs, 1.09× the fastest -SHA-256, 1350 B, OpenSSL on ovh-iad: 4.34 µs, 1.12× the fastest -SHA-256, 1350 B, OpenSSL on ovh-sea: 4.22 µs, 1.10× the fastest +SHA-256, 1350 B, rind on kixtop: 484 ns, 1.17× the fastest +SHA-256, 1350 B, rind on ovh-iad: 3.87 µs, 1.00× the fastest +SHA-256, 1350 B, rind on ovh-sea: 3.85 µs, 1.00× the fastest +SHA-256, 1350 B, aws-lc-rs on nixos: 740 ns, 1.20× the fastest +SHA-256, 1350 B, aws-lc-rs on desktop: 312 ns, 1.12× the fastest +SHA-256, 1350 B, aws-lc-rs on nixos2: 2.79 µs, 1.14× the fastest +SHA-256, 1350 B, aws-lc-rs on kixtop: 440 ns, 1.06× the fastest +SHA-256, 1350 B, aws-lc-rs on ovh-iad: 4.74 µs, 1.22× the fastest +SHA-256, 1350 B, aws-lc-rs on ovh-sea: 4.75 µs, 1.23× the fastest +SHA-256, 1350 B, ring on nixos: 637 ns, 1.03× the fastest +SHA-256, 1350 B, ring on desktop: 304 ns, 1.09× the fastest +SHA-256, 1350 B, ring on nixos2: 2.82 µs, 1.15× the fastest +SHA-256, 1350 B, ring on kixtop: 414 ns, 1.00× the fastest +SHA-256, 1350 B, ring on ovh-iad: 4.47 µs, 1.15× the fastest +SHA-256, 1350 B, ring on ovh-sea: 4.31 µs, 1.12× the fastest +SHA-256, 1350 B, RustCrypto + dalek on nixos: 618 ns, 1.00× the fastest +SHA-256, 1350 B, RustCrypto + dalek on desktop: 296 ns, 1.06× the fastest +SHA-256, 1350 B, RustCrypto + dalek on nixos2: 5.11 µs, 2.08× the fastest +SHA-256, 1350 B, RustCrypto + dalek on kixtop: 475 ns, 1.15× the fastest +SHA-256, 1350 B, RustCrypto + dalek on ovh-iad: 8.13 µs, 2.10× the fastest +SHA-256, 1350 B, RustCrypto + dalek on ovh-sea: 8.29 µs, 2.15× the fastest +SHA-256, 1350 B, graviola on nixos: 637 ns, 1.03× the fastest +SHA-256, 1350 B, graviola on desktop: 297 ns, 1.06× the fastest +SHA-256, 1350 B, graviola on nixos2: 6.07 µs, 2.47× the fastest +SHA-256, 1350 B, graviola on kixtop: 472 ns, 1.14× the fastest +SHA-256, 1350 B, libcrux on nixos: 3.71 µs, 6.00× the fastest; verified: HACL*'s F* proof of Hacl.Streaming.SHA2's hash_256 and hash_512, compiled to Rust by an unverified step +✓ +SHA-256, 1350 B, libcrux on desktop: 2.31 µs, 8.25× the fastest; verified: HACL*'s F* proof of Hacl.Streaming.SHA2's hash_256 and hash_512, compiled to Rust by an unverified step +✓ +SHA-256, 1350 B, libcrux on nixos2: 5.23 µs, 2.13× the fastest; verified: HACL*'s F* proof of Hacl.Streaming.SHA2's hash_256 and hash_512, compiled to Rust by an unverified step +✓ +SHA-256, 1350 B, libcrux on kixtop: 2.52 µs, 6.08× the fastest; verified: HACL*'s F* proof of Hacl.Streaming.SHA2's hash_256 and hash_512, compiled to Rust by an unverified step +✓ +SHA-256, 1350 B, libcrux on ovh-iad: 8.43 µs, 2.18× the fastest; verified: HACL*'s F* proof of Hacl.Streaming.SHA2's hash_256 and hash_512, compiled to Rust by an unverified step +✓ +SHA-256, 1350 B, libcrux on ovh-sea: 8.24 µs, 2.14× the fastest; verified: HACL*'s F* proof of Hacl.Streaming.SHA2's hash_256 and hash_512, compiled to Rust by an unverified step +✓ +SHA-256, 1350 B, OpenSSL on nixos: 815 ns, 1.32× the fastest +SHA-256, 1350 B, OpenSSL on desktop: 415 ns, 1.48× the fastest +SHA-256, 1350 B, OpenSSL on nixos2: 2.68 µs, 1.09× the fastest +SHA-256, 1350 B, OpenSSL on kixtop: 531 ns, 1.28× the fastest +SHA-256, 1350 B, OpenSSL on ovh-iad: 4.34 µs, 1.12× the fastest +SHA-256, 1350 B, OpenSSL on ovh-sea: 4.22 µs, 1.10× the fastest SHA-256, 16 KB SHA-256, 16 KB, rind on nixos: 6.86 µs, 1.00× the fastest SHA-256, 16 KB, rind on desktop: 3.24 µs, 1.00× the fastest SHA-256, 16 KB, rind on nixos2: 28.06 µs, 1.00× the fastest -SHA-256, 16 KB, rind on ovh-iad: 45.11 µs, 1.00× the fastest -SHA-256, 16 KB, rind on ovh-sea: 43.51 µs, 1.00× the fastest -SHA-256, 16 KB, aws-lc-rs on nixos: 6.88 µs, 1.00× the fastest -SHA-256, 16 KB, aws-lc-rs on desktop: 3.28 µs, 1.01× the fastest -SHA-256, 16 KB, aws-lc-rs on nixos2: 31.46 µs, 1.12× the fastest -SHA-256, 16 KB, aws-lc-rs on ovh-iad: 50.68 µs, 1.12× the fastest -SHA-256, 16 KB, aws-lc-rs on ovh-sea: 49.41 µs, 1.14× the fastest -SHA-256, 16 KB, ring on nixos: 6.97 µs, 1.01× the fastest -SHA-256, 16 KB, ring on desktop: 3.28 µs, 1.01× the fastest -SHA-256, 16 KB, ring on nixos2: 32.37 µs, 1.15× the fastest -SHA-256, 16 KB, ring on ovh-iad: 50.70 µs, 1.12× the fastest -SHA-256, 16 KB, ring on ovh-sea: 51.35 µs, 1.18× the fastest -SHA-256, 16 KB, RustCrypto + dalek on nixos: 7.22 µs, 1.05× the fastest -SHA-256, 16 KB, RustCrypto + dalek on desktop: 3.26 µs, 1.01× the fastest -SHA-256, 16 KB, RustCrypto + dalek on nixos2: 58.17 µs, 2.07× the fastest -SHA-256, 16 KB, RustCrypto + dalek on ovh-iad: 93.30 µs, 2.07× the fastest -SHA-256, 16 KB, RustCrypto + dalek on ovh-sea: 92.84 µs, 2.13× the fastest -SHA-256, 16 KB, graviola on nixos: 7.08 µs, 1.03× the fastest -SHA-256, 16 KB, graviola on desktop: 3.27 µs, 1.01× the fastest -SHA-256, 16 KB, graviola on nixos2: 69.84 µs, 2.49× the fastest -SHA-256, 16 KB, libcrux on nixos: 43.12 µs, 6.28× the fastest; verified: HACL*'s F* proof of Hacl.Streaming.SHA2's hash_256 and hash_512, compiled to Rust by an unverified step -✓ -SHA-256, 16 KB, libcrux on desktop: 26.81 µs, 8.27× the fastest; verified: HACL*'s F* proof of Hacl.Streaming.SHA2's hash_256 and hash_512, compiled to Rust by an unverified step -✓ -SHA-256, 16 KB, libcrux on nixos2: 61.68 µs, 2.20× the fastest; verified: HACL*'s F* proof of Hacl.Streaming.SHA2's hash_256 and hash_512, compiled to Rust by an unverified step -✓ -SHA-256, 16 KB, libcrux on ovh-iad: 96.58 µs, 2.14× the fastest; verified: HACL*'s F* proof of Hacl.Streaming.SHA2's hash_256 and hash_512, compiled to Rust by an unverified step -✓ -SHA-256, 16 KB, libcrux on ovh-sea: 97.66 µs, 2.24× the fastest; verified: HACL*'s F* proof of Hacl.Streaming.SHA2's hash_256 and hash_512, compiled to Rust by an unverified step -✓ -SHA-256, 16 KB, OpenSSL on nixos: 7.37 µs, 1.07× the fastest -SHA-256, 16 KB, OpenSSL on desktop: 3.39 µs, 1.05× the fastest -SHA-256, 16 KB, OpenSSL on nixos2: 28.83 µs, 1.03× the fastest -SHA-256, 16 KB, OpenSSL on ovh-iad: 45.56 µs, 1.01× the fastest -SHA-256, 16 KB, OpenSSL on ovh-sea: 43.72 µs, 1.00× the fastest +SHA-256, 16 KB, rind on kixtop: 4.94 µs, 1.01× the fastest +SHA-256, 16 KB, rind on ovh-iad: 45.11 µs, 1.00× the fastest +SHA-256, 16 KB, rind on ovh-sea: 43.51 µs, 1.00× the fastest +SHA-256, 16 KB, aws-lc-rs on nixos: 6.88 µs, 1.00× the fastest +SHA-256, 16 KB, aws-lc-rs on desktop: 3.28 µs, 1.01× the fastest +SHA-256, 16 KB, aws-lc-rs on nixos2: 31.46 µs, 1.12× the fastest +SHA-256, 16 KB, aws-lc-rs on kixtop: 4.87 µs, 1.00× the fastest +SHA-256, 16 KB, aws-lc-rs on ovh-iad: 50.68 µs, 1.12× the fastest +SHA-256, 16 KB, aws-lc-rs on ovh-sea: 49.41 µs, 1.14× the fastest +SHA-256, 16 KB, ring on nixos: 6.97 µs, 1.01× the fastest +SHA-256, 16 KB, ring on desktop: 3.28 µs, 1.01× the fastest +SHA-256, 16 KB, ring on nixos2: 32.37 µs, 1.15× the fastest +SHA-256, 16 KB, ring on kixtop: 4.90 µs, 1.01× the fastest +SHA-256, 16 KB, ring on ovh-iad: 50.70 µs, 1.12× the fastest +SHA-256, 16 KB, ring on ovh-sea: 51.35 µs, 1.18× the fastest +SHA-256, 16 KB, RustCrypto + dalek on nixos: 7.22 µs, 1.05× the fastest +SHA-256, 16 KB, RustCrypto + dalek on desktop: 3.26 µs, 1.01× the fastest +SHA-256, 16 KB, RustCrypto + dalek on nixos2: 58.17 µs, 2.07× the fastest +SHA-256, 16 KB, RustCrypto + dalek on kixtop: 5.69 µs, 1.17× the fastest +SHA-256, 16 KB, RustCrypto + dalek on ovh-iad: 93.30 µs, 2.07× the fastest +SHA-256, 16 KB, RustCrypto + dalek on ovh-sea: 92.84 µs, 2.13× the fastest +SHA-256, 16 KB, graviola on nixos: 7.08 µs, 1.03× the fastest +SHA-256, 16 KB, graviola on desktop: 3.27 µs, 1.01× the fastest +SHA-256, 16 KB, graviola on nixos2: 69.84 µs, 2.49× the fastest +SHA-256, 16 KB, graviola on kixtop: 5.76 µs, 1.18× the fastest +SHA-256, 16 KB, libcrux on nixos: 43.12 µs, 6.28× the fastest; verified: HACL*'s F* proof of Hacl.Streaming.SHA2's hash_256 and hash_512, compiled to Rust by an unverified step +✓ +SHA-256, 16 KB, libcrux on desktop: 26.81 µs, 8.27× the fastest; verified: HACL*'s F* proof of Hacl.Streaming.SHA2's hash_256 and hash_512, compiled to Rust by an unverified step +✓ +SHA-256, 16 KB, libcrux on nixos2: 61.68 µs, 2.20× the fastest; verified: HACL*'s F* proof of Hacl.Streaming.SHA2's hash_256 and hash_512, compiled to Rust by an unverified step +✓ +SHA-256, 16 KB, libcrux on kixtop: 29.13 µs, 5.98× the fastest; verified: HACL*'s F* proof of Hacl.Streaming.SHA2's hash_256 and hash_512, compiled to Rust by an unverified step +✓ +SHA-256, 16 KB, libcrux on ovh-iad: 96.58 µs, 2.14× the fastest; verified: HACL*'s F* proof of Hacl.Streaming.SHA2's hash_256 and hash_512, compiled to Rust by an unverified step +✓ +SHA-256, 16 KB, libcrux on ovh-sea: 97.66 µs, 2.24× the fastest; verified: HACL*'s F* proof of Hacl.Streaming.SHA2's hash_256 and hash_512, compiled to Rust by an unverified step +✓ +SHA-256, 16 KB, OpenSSL on nixos: 7.37 µs, 1.07× the fastest +SHA-256, 16 KB, OpenSSL on desktop: 3.39 µs, 1.05× the fastest +SHA-256, 16 KB, OpenSSL on nixos2: 28.83 µs, 1.03× the fastest +SHA-256, 16 KB, OpenSSL on kixtop: 5.17 µs, 1.06× the fastest +SHA-256, 16 KB, OpenSSL on ovh-iad: 45.56 µs, 1.01× the fastest +SHA-256, 16 KB, OpenSSL on ovh-sea: 43.72 µs, 1.00× the fastest SHA-512, 64 B SHA-512, 64 B, rind on nixos: 138 ns, 1.00× the fastest SHA-512, 64 B, rind on desktop: 60 ns, 1.00× the fastest SHA-512, 64 B, rind on nixos2: 198 ns, 1.00× the fastest -SHA-512, 64 B, rind on ovh-iad: 321 ns, 1.00× the fastest -SHA-512, 64 B, rind on ovh-sea: 304 ns, 1.00× the fastest -SHA-512, 64 B, aws-lc-rs on nixos: 224 ns, 1.62× the fastest -SHA-512, 64 B, aws-lc-rs on desktop: 136 ns, 2.27× the fastest; verified: aws-lc-verification's SAW proof of SHA-512 through EVP_Digest, padding included, over sha512_block_data_order_avx, which aws-lc runs only on Intel; of aws-lc c21d40da, whose SHA-512 code 5.12.0 keeps -✓ -SHA-512, 64 B, aws-lc-rs on nixos2: 228 ns, 1.15× the fastest; verified: aws-lc-verification's SAW proof of SHA-512 through EVP_Digest, padding included, over sha512_block_data_order_avx, which aws-lc runs only on Intel; of aws-lc c21d40da, whose SHA-512 code 5.12.0 keeps -✓ -SHA-512, 64 B, aws-lc-rs on ovh-iad: 389 ns, 1.21× the fastest; verified: aws-lc-verification's SAW proof of SHA-512 through EVP_Digest, padding included, over sha512_block_data_order_avx, which aws-lc runs only on Intel; of aws-lc c21d40da, whose SHA-512 code 5.12.0 keeps +SHA-512, 64 B, rind on kixtop: 113 ns, 1.44× the fastest +SHA-512, 64 B, rind on ovh-iad: 321 ns, 1.00× the fastest +SHA-512, 64 B, rind on ovh-sea: 304 ns, 1.00× the fastest +SHA-512, 64 B, aws-lc-rs on nixos: 224 ns, 1.62× the fastest +SHA-512, 64 B, aws-lc-rs on desktop: 136 ns, 2.27× the fastest; verified: aws-lc-verification's SAW proof of SHA-512 through EVP_Digest, padding included, over sha512_block_data_order_avx, which aws-lc runs only on Intel; of aws-lc c21d40da, whose SHA-512 code 5.12.0 keeps +✓ +SHA-512, 64 B, aws-lc-rs on nixos2: 228 ns, 1.15× the fastest; verified: aws-lc-verification's SAW proof of SHA-512 through EVP_Digest, padding included, over sha512_block_data_order_avx, which aws-lc runs only on Intel; of aws-lc c21d40da, whose SHA-512 code 5.12.0 keeps ✓ -SHA-512, 64 B, aws-lc-rs on ovh-sea: 362 ns, 1.19× the fastest; verified: aws-lc-verification's SAW proof of SHA-512 through EVP_Digest, padding included, over sha512_block_data_order_avx, which aws-lc runs only on Intel; of aws-lc c21d40da, whose SHA-512 code 5.12.0 keeps -✓ -SHA-512, 64 B, ring on nixos: 198 ns, 1.43× the fastest -SHA-512, 64 B, ring on desktop: 142 ns, 2.36× the fastest -SHA-512, 64 B, ring on nixos2: 203 ns, 1.02× the fastest -SHA-512, 64 B, ring on ovh-iad: 321 ns, 1.00× the fastest -SHA-512, 64 B, ring on ovh-sea: 331 ns, 1.09× the fastest -SHA-512, 64 B, RustCrypto + dalek on nixos: 192 ns, 1.39× the fastest -SHA-512, 64 B, RustCrypto + dalek on desktop: 120 ns, 1.99× the fastest -SHA-512, 64 B, RustCrypto + dalek on nixos2: 270 ns, 1.36× the fastest -SHA-512, 64 B, RustCrypto + dalek on ovh-iad: 435 ns, 1.35× the fastest -SHA-512, 64 B, RustCrypto + dalek on ovh-sea: 424 ns, 1.40× the fastest -SHA-512, 64 B, graviola on nixos: 206 ns, 1.49× the fastest -SHA-512, 64 B, graviola on desktop: 150 ns, 2.49× the fastest -SHA-512, 64 B, graviola on nixos2: 236 ns, 1.19× the fastest -SHA-512, 64 B, libcrux on nixos: 246 ns, 1.78× the fastest; verified: HACL*'s F* proof of Hacl.Streaming.SHA2's hash_256 and hash_512, compiled to Rust by an unverified step -✓ -SHA-512, 64 B, libcrux on desktop: 167 ns, 2.78× the fastest; verified: HACL*'s F* proof of Hacl.Streaming.SHA2's hash_256 and hash_512, compiled to Rust by an unverified step -✓ -SHA-512, 64 B, libcrux on nixos2: 289 ns, 1.45× the fastest; verified: HACL*'s F* proof of Hacl.Streaming.SHA2's hash_256 and hash_512, compiled to Rust by an unverified step -✓ -SHA-512, 64 B, libcrux on ovh-iad: 462 ns, 1.44× the fastest; verified: HACL*'s F* proof of Hacl.Streaming.SHA2's hash_256 and hash_512, compiled to Rust by an unverified step -✓ -SHA-512, 64 B, libcrux on ovh-sea: 443 ns, 1.46× the fastest; verified: HACL*'s F* proof of Hacl.Streaming.SHA2's hash_256 and hash_512, compiled to Rust by an unverified step -✓ -SHA-512, 64 B, OpenSSL on nixos: 355 ns, 2.57× the fastest -SHA-512, 64 B, OpenSSL on desktop: 233 ns, 3.87× the fastest -SHA-512, 64 B, OpenSSL on nixos2: 430 ns, 2.17× the fastest -SHA-512, 64 B, OpenSSL on ovh-iad: 699 ns, 2.18× the fastest -SHA-512, 64 B, OpenSSL on ovh-sea: 682 ns, 2.25× the fastest +SHA-512, 64 B, aws-lc-rs on kixtop: 108 ns, 1.37× the fastest +SHA-512, 64 B, aws-lc-rs on ovh-iad: 389 ns, 1.21× the fastest; verified: aws-lc-verification's SAW proof of SHA-512 through EVP_Digest, padding included, over sha512_block_data_order_avx, which aws-lc runs only on Intel; of aws-lc c21d40da, whose SHA-512 code 5.12.0 keeps +✓ +SHA-512, 64 B, aws-lc-rs on ovh-sea: 362 ns, 1.19× the fastest; verified: aws-lc-verification's SAW proof of SHA-512 through EVP_Digest, padding included, over sha512_block_data_order_avx, which aws-lc runs only on Intel; of aws-lc c21d40da, whose SHA-512 code 5.12.0 keeps +✓ +SHA-512, 64 B, ring on nixos: 198 ns, 1.43× the fastest +SHA-512, 64 B, ring on desktop: 142 ns, 2.36× the fastest +SHA-512, 64 B, ring on nixos2: 203 ns, 1.02× the fastest +SHA-512, 64 B, ring on kixtop: 88 ns, 1.11× the fastest +SHA-512, 64 B, ring on ovh-iad: 321 ns, 1.00× the fastest +SHA-512, 64 B, ring on ovh-sea: 331 ns, 1.09× the fastest +SHA-512, 64 B, RustCrypto + dalek on nixos: 192 ns, 1.39× the fastest +SHA-512, 64 B, RustCrypto + dalek on desktop: 120 ns, 1.99× the fastest +SHA-512, 64 B, RustCrypto + dalek on nixos2: 270 ns, 1.36× the fastest +SHA-512, 64 B, RustCrypto + dalek on kixtop: 79 ns, 1.00× the fastest +SHA-512, 64 B, RustCrypto + dalek on ovh-iad: 435 ns, 1.35× the fastest +SHA-512, 64 B, RustCrypto + dalek on ovh-sea: 424 ns, 1.40× the fastest +SHA-512, 64 B, graviola on nixos: 206 ns, 1.49× the fastest +SHA-512, 64 B, graviola on desktop: 150 ns, 2.49× the fastest +SHA-512, 64 B, graviola on nixos2: 236 ns, 1.19× the fastest +SHA-512, 64 B, graviola on kixtop: 177 ns, 2.25× the fastest +SHA-512, 64 B, libcrux on nixos: 246 ns, 1.78× the fastest; verified: HACL*'s F* proof of Hacl.Streaming.SHA2's hash_256 and hash_512, compiled to Rust by an unverified step +✓ +SHA-512, 64 B, libcrux on desktop: 167 ns, 2.78× the fastest; verified: HACL*'s F* proof of Hacl.Streaming.SHA2's hash_256 and hash_512, compiled to Rust by an unverified step +✓ +SHA-512, 64 B, libcrux on nixos2: 289 ns, 1.45× the fastest; verified: HACL*'s F* proof of Hacl.Streaming.SHA2's hash_256 and hash_512, compiled to Rust by an unverified step +✓ +SHA-512, 64 B, libcrux on kixtop: 141 ns, 1.79× the fastest; verified: HACL*'s F* proof of Hacl.Streaming.SHA2's hash_256 and hash_512, compiled to Rust by an unverified step +✓ +SHA-512, 64 B, libcrux on ovh-iad: 462 ns, 1.44× the fastest; verified: HACL*'s F* proof of Hacl.Streaming.SHA2's hash_256 and hash_512, compiled to Rust by an unverified step +✓ +SHA-512, 64 B, libcrux on ovh-sea: 443 ns, 1.46× the fastest; verified: HACL*'s F* proof of Hacl.Streaming.SHA2's hash_256 and hash_512, compiled to Rust by an unverified step +✓ +SHA-512, 64 B, OpenSSL on nixos: 355 ns, 2.57× the fastest +SHA-512, 64 B, OpenSSL on desktop: 233 ns, 3.87× the fastest +SHA-512, 64 B, OpenSSL on nixos2: 430 ns, 2.17× the fastest +SHA-512, 64 B, OpenSSL on kixtop: 211 ns, 2.68× the fastest +SHA-512, 64 B, OpenSSL on ovh-iad: 699 ns, 2.18× the fastest +SHA-512, 64 B, OpenSSL on ovh-sea: 682 ns, 2.25× the fastest SHA-512, 1350 B SHA-512, 1350 B, rind on nixos: 1.77 µs, 1.01× the fastest SHA-512, 1350 B, rind on desktop: 470 ns, 1.00× the fastest SHA-512, 1350 B, rind on nixos2: 1.65 µs, 1.00× the fastest -SHA-512, 1350 B, rind on ovh-iad: 2.60 µs, 1.00× the fastest -SHA-512, 1350 B, rind on ovh-sea: 2.54 µs, 1.00× the fastest -SHA-512, 1350 B, aws-lc-rs on nixos: 1.90 µs, 1.08× the fastest -SHA-512, 1350 B, aws-lc-rs on desktop: 1.27 µs, 2.69× the fastest; verified: aws-lc-verification's SAW proof of SHA-512 through EVP_Digest, padding included, over sha512_block_data_order_avx, which aws-lc runs only on Intel; of aws-lc c21d40da, whose SHA-512 code 5.12.0 keeps -✓ -SHA-512, 1350 B, aws-lc-rs on nixos2: 1.97 µs, 1.19× the fastest; verified: aws-lc-verification's SAW proof of SHA-512 through EVP_Digest, padding included, over sha512_block_data_order_avx, which aws-lc runs only on Intel; of aws-lc c21d40da, whose SHA-512 code 5.12.0 keeps -✓ -SHA-512, 1350 B, aws-lc-rs on ovh-iad: 3.12 µs, 1.20× the fastest; verified: aws-lc-verification's SAW proof of SHA-512 through EVP_Digest, padding included, over sha512_block_data_order_avx, which aws-lc runs only on Intel; of aws-lc c21d40da, whose SHA-512 code 5.12.0 keeps +SHA-512, 1350 B, rind on kixtop: 827 ns, 1.15× the fastest +SHA-512, 1350 B, rind on ovh-iad: 2.60 µs, 1.00× the fastest +SHA-512, 1350 B, rind on ovh-sea: 2.54 µs, 1.00× the fastest +SHA-512, 1350 B, aws-lc-rs on nixos: 1.90 µs, 1.08× the fastest +SHA-512, 1350 B, aws-lc-rs on desktop: 1.27 µs, 2.69× the fastest; verified: aws-lc-verification's SAW proof of SHA-512 through EVP_Digest, padding included, over sha512_block_data_order_avx, which aws-lc runs only on Intel; of aws-lc c21d40da, whose SHA-512 code 5.12.0 keeps +✓ +SHA-512, 1350 B, aws-lc-rs on nixos2: 1.97 µs, 1.19× the fastest; verified: aws-lc-verification's SAW proof of SHA-512 through EVP_Digest, padding included, over sha512_block_data_order_avx, which aws-lc runs only on Intel; of aws-lc c21d40da, whose SHA-512 code 5.12.0 keeps ✓ -SHA-512, 1350 B, aws-lc-rs on ovh-sea: 3.04 µs, 1.19× the fastest; verified: aws-lc-verification's SAW proof of SHA-512 through EVP_Digest, padding included, over sha512_block_data_order_avx, which aws-lc runs only on Intel; of aws-lc c21d40da, whose SHA-512 code 5.12.0 keeps -✓ -SHA-512, 1350 B, ring on nixos: 1.87 µs, 1.06× the fastest -SHA-512, 1350 B, ring on desktop: 1.26 µs, 2.69× the fastest -SHA-512, 1350 B, ring on nixos2: 1.93 µs, 1.17× the fastest -SHA-512, 1350 B, ring on ovh-iad: 3.02 µs, 1.16× the fastest -SHA-512, 1350 B, ring on ovh-sea: 2.97 µs, 1.17× the fastest -SHA-512, 1350 B, RustCrypto + dalek on nixos: 1.92 µs, 1.09× the fastest -SHA-512, 1350 B, RustCrypto + dalek on desktop: 1.18 µs, 2.50× the fastest -SHA-512, 1350 B, RustCrypto + dalek on nixos2: 2.67 µs, 1.61× the fastest -SHA-512, 1350 B, RustCrypto + dalek on ovh-iad: 4.26 µs, 1.64× the fastest -SHA-512, 1350 B, RustCrypto + dalek on ovh-sea: 4.17 µs, 1.64× the fastest -SHA-512, 1350 B, graviola on nixos: 1.98 µs, 1.13× the fastest -SHA-512, 1350 B, graviola on desktop: 1.51 µs, 3.21× the fastest -SHA-512, 1350 B, graviola on nixos2: 2.35 µs, 1.42× the fastest -SHA-512, 1350 B, libcrux on nixos: 2.94 µs, 1.67× the fastest; verified: HACL*'s F* proof of Hacl.Streaming.SHA2's hash_256 and hash_512, compiled to Rust by an unverified step -✓ -SHA-512, 1350 B, libcrux on desktop: 1.69 µs, 3.59× the fastest; verified: HACL*'s F* proof of Hacl.Streaming.SHA2's hash_256 and hash_512, compiled to Rust by an unverified step -✓ -SHA-512, 1350 B, libcrux on nixos2: 3.08 µs, 1.86× the fastest; verified: HACL*'s F* proof of Hacl.Streaming.SHA2's hash_256 and hash_512, compiled to Rust by an unverified step -✓ -SHA-512, 1350 B, libcrux on ovh-iad: 4.91 µs, 1.88× the fastest; verified: HACL*'s F* proof of Hacl.Streaming.SHA2's hash_256 and hash_512, compiled to Rust by an unverified step -✓ -SHA-512, 1350 B, libcrux on ovh-sea: 4.66 µs, 1.83× the fastest; verified: HACL*'s F* proof of Hacl.Streaming.SHA2's hash_256 and hash_512, compiled to Rust by an unverified step -✓ -SHA-512, 1350 B, OpenSSL on nixos: 1.76 µs, 1.00× the fastest -SHA-512, 1350 B, OpenSSL on desktop: 1.20 µs, 2.55× the fastest -SHA-512, 1350 B, OpenSSL on nixos2: 1.90 µs, 1.15× the fastest -SHA-512, 1350 B, OpenSSL on ovh-iad: 3.10 µs, 1.19× the fastest -SHA-512, 1350 B, OpenSSL on ovh-sea: 2.99 µs, 1.18× the fastest +SHA-512, 1350 B, aws-lc-rs on kixtop: 775 ns, 1.07× the fastest +SHA-512, 1350 B, aws-lc-rs on ovh-iad: 3.12 µs, 1.20× the fastest; verified: aws-lc-verification's SAW proof of SHA-512 through EVP_Digest, padding included, over sha512_block_data_order_avx, which aws-lc runs only on Intel; of aws-lc c21d40da, whose SHA-512 code 5.12.0 keeps +✓ +SHA-512, 1350 B, aws-lc-rs on ovh-sea: 3.04 µs, 1.19× the fastest; verified: aws-lc-verification's SAW proof of SHA-512 through EVP_Digest, padding included, over sha512_block_data_order_avx, which aws-lc runs only on Intel; of aws-lc c21d40da, whose SHA-512 code 5.12.0 keeps +✓ +SHA-512, 1350 B, ring on nixos: 1.87 µs, 1.06× the fastest +SHA-512, 1350 B, ring on desktop: 1.26 µs, 2.69× the fastest +SHA-512, 1350 B, ring on nixos2: 1.93 µs, 1.17× the fastest +SHA-512, 1350 B, ring on kixtop: 737 ns, 1.02× the fastest +SHA-512, 1350 B, ring on ovh-iad: 3.02 µs, 1.16× the fastest +SHA-512, 1350 B, ring on ovh-sea: 2.97 µs, 1.17× the fastest +SHA-512, 1350 B, RustCrypto + dalek on nixos: 1.92 µs, 1.09× the fastest +SHA-512, 1350 B, RustCrypto + dalek on desktop: 1.18 µs, 2.50× the fastest +SHA-512, 1350 B, RustCrypto + dalek on nixos2: 2.67 µs, 1.61× the fastest +SHA-512, 1350 B, RustCrypto + dalek on kixtop: 722 ns, 1.00× the fastest +SHA-512, 1350 B, RustCrypto + dalek on ovh-iad: 4.26 µs, 1.64× the fastest +SHA-512, 1350 B, RustCrypto + dalek on ovh-sea: 4.17 µs, 1.64× the fastest +SHA-512, 1350 B, graviola on nixos: 1.98 µs, 1.13× the fastest +SHA-512, 1350 B, graviola on desktop: 1.51 µs, 3.21× the fastest +SHA-512, 1350 B, graviola on nixos2: 2.35 µs, 1.42× the fastest +SHA-512, 1350 B, graviola on kixtop: 1.88 µs, 2.60× the fastest +SHA-512, 1350 B, libcrux on nixos: 2.94 µs, 1.67× the fastest; verified: HACL*'s F* proof of Hacl.Streaming.SHA2's hash_256 and hash_512, compiled to Rust by an unverified step +✓ +SHA-512, 1350 B, libcrux on desktop: 1.69 µs, 3.59× the fastest; verified: HACL*'s F* proof of Hacl.Streaming.SHA2's hash_256 and hash_512, compiled to Rust by an unverified step +✓ +SHA-512, 1350 B, libcrux on nixos2: 3.08 µs, 1.86× the fastest; verified: HACL*'s F* proof of Hacl.Streaming.SHA2's hash_256 and hash_512, compiled to Rust by an unverified step +✓ +SHA-512, 1350 B, libcrux on kixtop: 1.58 µs, 2.18× the fastest; verified: HACL*'s F* proof of Hacl.Streaming.SHA2's hash_256 and hash_512, compiled to Rust by an unverified step +✓ +SHA-512, 1350 B, libcrux on ovh-iad: 4.91 µs, 1.88× the fastest; verified: HACL*'s F* proof of Hacl.Streaming.SHA2's hash_256 and hash_512, compiled to Rust by an unverified step +✓ +SHA-512, 1350 B, libcrux on ovh-sea: 4.66 µs, 1.83× the fastest; verified: HACL*'s F* proof of Hacl.Streaming.SHA2's hash_256 and hash_512, compiled to Rust by an unverified step +✓ +SHA-512, 1350 B, OpenSSL on nixos: 1.76 µs, 1.00× the fastest +SHA-512, 1350 B, OpenSSL on desktop: 1.20 µs, 2.55× the fastest +SHA-512, 1350 B, OpenSSL on nixos2: 1.90 µs, 1.15× the fastest +SHA-512, 1350 B, OpenSSL on kixtop: 878 ns, 1.22× the fastest +SHA-512, 1350 B, OpenSSL on ovh-iad: 3.10 µs, 1.19× the fastest +SHA-512, 1350 B, OpenSSL on ovh-sea: 2.99 µs, 1.18× the fastest SHA-512, 16 KB SHA-512, 16 KB, rind on nixos: 16.28 µs, 1.07× the fastest SHA-512, 16 KB, rind on desktop: 2.68 µs, 1.00× the fastest SHA-512, 16 KB, rind on nixos2: 18.53 µs, 1.00× the fastest -SHA-512, 16 KB, rind on ovh-iad: 33.08 µs, 1.03× the fastest -SHA-512, 16 KB, rind on ovh-sea: 29.12 µs, 1.00× the fastest -SHA-512, 16 KB, aws-lc-rs on nixos: 25.17 µs, 1.66× the fastest -SHA-512, 16 KB, aws-lc-rs on desktop: 14.32 µs, 5.34× the fastest; verified: aws-lc-verification's SAW proof of SHA-512 through EVP_Digest, padding included, over sha512_block_data_order_avx, which aws-lc runs only on Intel; of aws-lc c21d40da, whose SHA-512 code 5.12.0 keeps -✓ -SHA-512, 16 KB, aws-lc-rs on nixos2: 21.92 µs, 1.18× the fastest; verified: aws-lc-verification's SAW proof of SHA-512 through EVP_Digest, padding included, over sha512_block_data_order_avx, which aws-lc runs only on Intel; of aws-lc c21d40da, whose SHA-512 code 5.12.0 keeps -✓ -SHA-512, 16 KB, aws-lc-rs on ovh-iad: 35.17 µs, 1.09× the fastest; verified: aws-lc-verification's SAW proof of SHA-512 through EVP_Digest, padding included, over sha512_block_data_order_avx, which aws-lc runs only on Intel; of aws-lc c21d40da, whose SHA-512 code 5.12.0 keeps +SHA-512, 16 KB, rind on kixtop: 8.77 µs, 1.03× the fastest +SHA-512, 16 KB, rind on ovh-iad: 33.08 µs, 1.03× the fastest +SHA-512, 16 KB, rind on ovh-sea: 29.12 µs, 1.00× the fastest +SHA-512, 16 KB, aws-lc-rs on nixos: 25.17 µs, 1.66× the fastest +SHA-512, 16 KB, aws-lc-rs on desktop: 14.32 µs, 5.34× the fastest; verified: aws-lc-verification's SAW proof of SHA-512 through EVP_Digest, padding included, over sha512_block_data_order_avx, which aws-lc runs only on Intel; of aws-lc c21d40da, whose SHA-512 code 5.12.0 keeps +✓ +SHA-512, 16 KB, aws-lc-rs on nixos2: 21.92 µs, 1.18× the fastest; verified: aws-lc-verification's SAW proof of SHA-512 through EVP_Digest, padding included, over sha512_block_data_order_avx, which aws-lc runs only on Intel; of aws-lc c21d40da, whose SHA-512 code 5.12.0 keeps ✓ -SHA-512, 16 KB, aws-lc-rs on ovh-sea: 34.42 µs, 1.18× the fastest; verified: aws-lc-verification's SAW proof of SHA-512 through EVP_Digest, padding included, over sha512_block_data_order_avx, which aws-lc runs only on Intel; of aws-lc c21d40da, whose SHA-512 code 5.12.0 keeps -✓ -SHA-512, 16 KB, ring on nixos: 25.38 µs, 1.68× the fastest -SHA-512, 16 KB, ring on desktop: 14.36 µs, 5.35× the fastest -SHA-512, 16 KB, ring on nixos2: 21.75 µs, 1.17× the fastest -SHA-512, 16 KB, ring on ovh-iad: 35.28 µs, 1.09× the fastest -SHA-512, 16 KB, ring on ovh-sea: 33.89 µs, 1.16× the fastest -SHA-512, 16 KB, RustCrypto + dalek on nixos: 24.12 µs, 1.59× the fastest -SHA-512, 16 KB, RustCrypto + dalek on desktop: 13.55 µs, 5.05× the fastest -SHA-512, 16 KB, RustCrypto + dalek on nixos2: 30.73 µs, 1.66× the fastest -SHA-512, 16 KB, RustCrypto + dalek on ovh-iad: 53.82 µs, 1.67× the fastest -SHA-512, 16 KB, RustCrypto + dalek on ovh-sea: 47.69 µs, 1.64× the fastest -SHA-512, 16 KB, graviola on nixos: 21.04 µs, 1.39× the fastest -SHA-512, 16 KB, graviola on desktop: 17.96 µs, 6.70× the fastest -SHA-512, 16 KB, graviola on nixos2: 27.16 µs, 1.47× the fastest -SHA-512, 16 KB, libcrux on nixos: 29.75 µs, 1.96× the fastest; verified: HACL*'s F* proof of Hacl.Streaming.SHA2's hash_256 and hash_512, compiled to Rust by an unverified step -✓ -SHA-512, 16 KB, libcrux on desktop: 20.01 µs, 7.46× the fastest; verified: HACL*'s F* proof of Hacl.Streaming.SHA2's hash_256 and hash_512, compiled to Rust by an unverified step -✓ -SHA-512, 16 KB, libcrux on nixos2: 35.45 µs, 1.91× the fastest; verified: HACL*'s F* proof of Hacl.Streaming.SHA2's hash_256 and hash_512, compiled to Rust by an unverified step -✓ -SHA-512, 16 KB, libcrux on ovh-iad: 59.59 µs, 1.85× the fastest; verified: HACL*'s F* proof of Hacl.Streaming.SHA2's hash_256 and hash_512, compiled to Rust by an unverified step -✓ -SHA-512, 16 KB, libcrux on ovh-sea: 54.80 µs, 1.88× the fastest; verified: HACL*'s F* proof of Hacl.Streaming.SHA2's hash_256 and hash_512, compiled to Rust by an unverified step -✓ -SHA-512, 16 KB, OpenSSL on nixos: 15.14 µs, 1.00× the fastest -SHA-512, 16 KB, OpenSSL on desktop: 12.51 µs, 4.66× the fastest -SHA-512, 16 KB, OpenSSL on nixos2: 18.99 µs, 1.02× the fastest -SHA-512, 16 KB, OpenSSL on ovh-iad: 32.22 µs, 1.00× the fastest -SHA-512, 16 KB, OpenSSL on ovh-sea: 29.59 µs, 1.02× the fastest +SHA-512, 16 KB, aws-lc-rs on kixtop: 8.70 µs, 1.02× the fastest +SHA-512, 16 KB, aws-lc-rs on ovh-iad: 35.17 µs, 1.09× the fastest; verified: aws-lc-verification's SAW proof of SHA-512 through EVP_Digest, padding included, over sha512_block_data_order_avx, which aws-lc runs only on Intel; of aws-lc c21d40da, whose SHA-512 code 5.12.0 keeps +✓ +SHA-512, 16 KB, aws-lc-rs on ovh-sea: 34.42 µs, 1.18× the fastest; verified: aws-lc-verification's SAW proof of SHA-512 through EVP_Digest, padding included, over sha512_block_data_order_avx, which aws-lc runs only on Intel; of aws-lc c21d40da, whose SHA-512 code 5.12.0 keeps +✓ +SHA-512, 16 KB, ring on nixos: 25.38 µs, 1.68× the fastest +SHA-512, 16 KB, ring on desktop: 14.36 µs, 5.35× the fastest +SHA-512, 16 KB, ring on nixos2: 21.75 µs, 1.17× the fastest +SHA-512, 16 KB, ring on kixtop: 8.69 µs, 1.02× the fastest +SHA-512, 16 KB, ring on ovh-iad: 35.28 µs, 1.09× the fastest +SHA-512, 16 KB, ring on ovh-sea: 33.89 µs, 1.16× the fastest +SHA-512, 16 KB, RustCrypto + dalek on nixos: 24.12 µs, 1.59× the fastest +SHA-512, 16 KB, RustCrypto + dalek on desktop: 13.55 µs, 5.05× the fastest +SHA-512, 16 KB, RustCrypto + dalek on nixos2: 30.73 µs, 1.66× the fastest +SHA-512, 16 KB, RustCrypto + dalek on kixtop: 8.50 µs, 1.00× the fastest +SHA-512, 16 KB, RustCrypto + dalek on ovh-iad: 53.82 µs, 1.67× the fastest +SHA-512, 16 KB, RustCrypto + dalek on ovh-sea: 47.69 µs, 1.64× the fastest +SHA-512, 16 KB, graviola on nixos: 21.04 µs, 1.39× the fastest +SHA-512, 16 KB, graviola on desktop: 17.96 µs, 6.70× the fastest +SHA-512, 16 KB, graviola on nixos2: 27.16 µs, 1.47× the fastest +SHA-512, 16 KB, graviola on kixtop: 22.11 µs, 2.60× the fastest +SHA-512, 16 KB, libcrux on nixos: 29.75 µs, 1.96× the fastest; verified: HACL*'s F* proof of Hacl.Streaming.SHA2's hash_256 and hash_512, compiled to Rust by an unverified step +✓ +SHA-512, 16 KB, libcrux on desktop: 20.01 µs, 7.46× the fastest; verified: HACL*'s F* proof of Hacl.Streaming.SHA2's hash_256 and hash_512, compiled to Rust by an unverified step +✓ +SHA-512, 16 KB, libcrux on nixos2: 35.45 µs, 1.91× the fastest; verified: HACL*'s F* proof of Hacl.Streaming.SHA2's hash_256 and hash_512, compiled to Rust by an unverified step +✓ +SHA-512, 16 KB, libcrux on kixtop: 18.41 µs, 2.17× the fastest; verified: HACL*'s F* proof of Hacl.Streaming.SHA2's hash_256 and hash_512, compiled to Rust by an unverified step +✓ +SHA-512, 16 KB, libcrux on ovh-iad: 59.59 µs, 1.85× the fastest; verified: HACL*'s F* proof of Hacl.Streaming.SHA2's hash_256 and hash_512, compiled to Rust by an unverified step +✓ +SHA-512, 16 KB, libcrux on ovh-sea: 54.80 µs, 1.88× the fastest; verified: HACL*'s F* proof of Hacl.Streaming.SHA2's hash_256 and hash_512, compiled to Rust by an unverified step +✓ +SHA-512, 16 KB, OpenSSL on nixos: 15.14 µs, 1.00× the fastest +SHA-512, 16 KB, OpenSSL on desktop: 12.51 µs, 4.66× the fastest +SHA-512, 16 KB, OpenSSL on nixos2: 18.99 µs, 1.02× the fastest +SHA-512, 16 KB, OpenSSL on kixtop: 8.88 µs, 1.04× the fastest +SHA-512, 16 KB, OpenSSL on ovh-iad: 32.22 µs, 1.00× the fastest +SHA-512, 16 KB, OpenSSL on ovh-sea: 29.59 µs, 1.02× the fastest HMAC-SHA256, 64 B HMAC-SHA256, 64 B, rind on nixos: 147 ns, 1.00× the fastest HMAC-SHA256, 64 B, rind on desktop: 75 ns, 1.00× the fastest HMAC-SHA256, 64 B, rind on nixos2: 628 ns, 1.00× the fastest -HMAC-SHA256, 64 B, rind on ovh-iad: 1.16 µs, 1.00× the fastest -HMAC-SHA256, 64 B, rind on ovh-sea: 963 ns, 1.00× the fastest -HMAC-SHA256, 64 B, aws-lc-rs on nixos: 264 ns, 1.80× the fastest -HMAC-SHA256, 64 B, aws-lc-rs on desktop: 180 ns, 2.38× the fastest -HMAC-SHA256, 64 B, aws-lc-rs on nixos2: 811 ns, 1.29× the fastest -HMAC-SHA256, 64 B, aws-lc-rs on ovh-iad: 1.60 µs, 1.38× the fastest -HMAC-SHA256, 64 B, aws-lc-rs on ovh-sea: 1.24 µs, 1.29× the fastest -HMAC-SHA256, 64 B, ring on nixos: 214 ns, 1.45× the fastest -HMAC-SHA256, 64 B, ring on desktop: 145 ns, 1.93× the fastest -HMAC-SHA256, 64 B, ring on nixos2: 707 ns, 1.13× the fastest -HMAC-SHA256, 64 B, ring on ovh-iad: 1.64 µs, 1.42× the fastest -HMAC-SHA256, 64 B, ring on ovh-sea: 1.09 µs, 1.13× the fastest -HMAC-SHA256, 64 B, RustCrypto + dalek on nixos: 155 ns, 1.06× the fastest -HMAC-SHA256, 64 B, RustCrypto + dalek on desktop: 104 ns, 1.39× the fastest -HMAC-SHA256, 64 B, RustCrypto + dalek on nixos2: 1.19 µs, 1.89× the fastest -HMAC-SHA256, 64 B, RustCrypto + dalek on ovh-iad: 2.13 µs, 1.84× the fastest -HMAC-SHA256, 64 B, RustCrypto + dalek on ovh-sea: 1.82 µs, 1.89× the fastest -HMAC-SHA256, 64 B, graviola on nixos: 172 ns, 1.17× the fastest -HMAC-SHA256, 64 B, graviola on desktop: 115 ns, 1.52× the fastest -HMAC-SHA256, 64 B, graviola on nixos2: 1.44 µs, 2.30× the fastest -HMAC-SHA256, 64 B, libcrux on nixos: 851 ns, 5.79× the fastest; verified: HACL*'s F* proof of Hacl.HMAC's compute_sha2_256, compiled to Rust by an unverified step -✓ -HMAC-SHA256, 64 B, libcrux on desktop: 536 ns, 7.12× the fastest; verified: HACL*'s F* proof of Hacl.HMAC's compute_sha2_256, compiled to Rust by an unverified step -✓ -HMAC-SHA256, 64 B, libcrux on nixos2: 1.20 µs, 1.92× the fastest; verified: HACL*'s F* proof of Hacl.HMAC's compute_sha2_256, compiled to Rust by an unverified step -✓ -HMAC-SHA256, 64 B, libcrux on ovh-iad: 2.36 µs, 2.03× the fastest; verified: HACL*'s F* proof of Hacl.HMAC's compute_sha2_256, compiled to Rust by an unverified step -✓ -HMAC-SHA256, 64 B, libcrux on ovh-sea: 1.83 µs, 1.90× the fastest; verified: HACL*'s F* proof of Hacl.HMAC's compute_sha2_256, compiled to Rust by an unverified step -✓ -HMAC-SHA256, 64 B, OpenSSL on nixos: 2.57 µs, 17.50× the fastest -HMAC-SHA256, 64 B, OpenSSL on desktop: 1.56 µs, 20.76× the fastest -HMAC-SHA256, 64 B, OpenSSL on nixos2: 3.69 µs, 5.88× the fastest -HMAC-SHA256, 64 B, OpenSSL on ovh-iad: 6.68 µs, 5.76× the fastest -HMAC-SHA256, 64 B, OpenSSL on ovh-sea: 5.66 µs, 5.88× the fastest +HMAC-SHA256, 64 B, rind on kixtop: 191 ns, 1.88× the fastest +HMAC-SHA256, 64 B, rind on ovh-iad: 1.16 µs, 1.00× the fastest +HMAC-SHA256, 64 B, rind on ovh-sea: 963 ns, 1.00× the fastest +HMAC-SHA256, 64 B, aws-lc-rs on nixos: 264 ns, 1.80× the fastest +HMAC-SHA256, 64 B, aws-lc-rs on desktop: 180 ns, 2.38× the fastest +HMAC-SHA256, 64 B, aws-lc-rs on nixos2: 811 ns, 1.29× the fastest +HMAC-SHA256, 64 B, aws-lc-rs on kixtop: 248 ns, 2.43× the fastest +HMAC-SHA256, 64 B, aws-lc-rs on ovh-iad: 1.60 µs, 1.38× the fastest +HMAC-SHA256, 64 B, aws-lc-rs on ovh-sea: 1.24 µs, 1.29× the fastest +HMAC-SHA256, 64 B, ring on nixos: 214 ns, 1.45× the fastest +HMAC-SHA256, 64 B, ring on desktop: 145 ns, 1.93× the fastest +HMAC-SHA256, 64 B, ring on nixos2: 707 ns, 1.13× the fastest +HMAC-SHA256, 64 B, ring on kixtop: 137 ns, 1.34× the fastest +HMAC-SHA256, 64 B, ring on ovh-iad: 1.64 µs, 1.42× the fastest +HMAC-SHA256, 64 B, ring on ovh-sea: 1.09 µs, 1.13× the fastest +HMAC-SHA256, 64 B, RustCrypto + dalek on nixos: 155 ns, 1.06× the fastest +HMAC-SHA256, 64 B, RustCrypto + dalek on desktop: 104 ns, 1.39× the fastest +HMAC-SHA256, 64 B, RustCrypto + dalek on nixos2: 1.19 µs, 1.89× the fastest +HMAC-SHA256, 64 B, RustCrypto + dalek on kixtop: 102 ns, 1.00× the fastest +HMAC-SHA256, 64 B, RustCrypto + dalek on ovh-iad: 2.13 µs, 1.84× the fastest +HMAC-SHA256, 64 B, RustCrypto + dalek on ovh-sea: 1.82 µs, 1.89× the fastest +HMAC-SHA256, 64 B, graviola on nixos: 172 ns, 1.17× the fastest +HMAC-SHA256, 64 B, graviola on desktop: 115 ns, 1.52× the fastest +HMAC-SHA256, 64 B, graviola on nixos2: 1.44 µs, 2.30× the fastest +HMAC-SHA256, 64 B, graviola on kixtop: 115 ns, 1.12× the fastest +HMAC-SHA256, 64 B, libcrux on nixos: 851 ns, 5.79× the fastest; verified: HACL*'s F* proof of Hacl.HMAC's compute_sha2_256, compiled to Rust by an unverified step +✓ +HMAC-SHA256, 64 B, libcrux on desktop: 536 ns, 7.12× the fastest; verified: HACL*'s F* proof of Hacl.HMAC's compute_sha2_256, compiled to Rust by an unverified step +✓ +HMAC-SHA256, 64 B, libcrux on nixos2: 1.20 µs, 1.92× the fastest; verified: HACL*'s F* proof of Hacl.HMAC's compute_sha2_256, compiled to Rust by an unverified step +✓ +HMAC-SHA256, 64 B, libcrux on kixtop: 568 ns, 5.57× the fastest; verified: HACL*'s F* proof of Hacl.HMAC's compute_sha2_256, compiled to Rust by an unverified step +✓ +HMAC-SHA256, 64 B, libcrux on ovh-iad: 2.36 µs, 2.03× the fastest; verified: HACL*'s F* proof of Hacl.HMAC's compute_sha2_256, compiled to Rust by an unverified step +✓ +HMAC-SHA256, 64 B, libcrux on ovh-sea: 1.83 µs, 1.90× the fastest; verified: HACL*'s F* proof of Hacl.HMAC's compute_sha2_256, compiled to Rust by an unverified step +✓ +HMAC-SHA256, 64 B, OpenSSL on nixos: 2.57 µs, 17.50× the fastest +HMAC-SHA256, 64 B, OpenSSL on desktop: 1.56 µs, 20.76× the fastest +HMAC-SHA256, 64 B, OpenSSL on nixos2: 3.69 µs, 5.88× the fastest +HMAC-SHA256, 64 B, OpenSSL on kixtop: 2.06 µs, 20.24× the fastest +HMAC-SHA256, 64 B, OpenSSL on ovh-iad: 6.68 µs, 5.76× the fastest +HMAC-SHA256, 64 B, OpenSSL on ovh-sea: 5.66 µs, 5.88× the fastest HMAC-SHA256, 1350 B HMAC-SHA256, 1350 B, rind on nixos: 692 ns, 1.00× the fastest HMAC-SHA256, 1350 B, rind on desktop: 327 ns, 1.00× the fastest HMAC-SHA256, 1350 B, rind on nixos2: 2.79 µs, 1.00× the fastest -HMAC-SHA256, 1350 B, rind on ovh-iad: 4.82 µs, 1.00× the fastest -HMAC-SHA256, 1350 B, rind on ovh-sea: 4.31 µs, 1.00× the fastest -HMAC-SHA256, 1350 B, aws-lc-rs on nixos: 853 ns, 1.23× the fastest -HMAC-SHA256, 1350 B, aws-lc-rs on desktop: 434 ns, 1.33× the fastest -HMAC-SHA256, 1350 B, aws-lc-rs on nixos2: 3.30 µs, 1.18× the fastest -HMAC-SHA256, 1350 B, aws-lc-rs on ovh-iad: 5.59 µs, 1.16× the fastest -HMAC-SHA256, 1350 B, aws-lc-rs on ovh-sea: 5.11 µs, 1.19× the fastest -HMAC-SHA256, 1350 B, ring on nixos: 791 ns, 1.14× the fastest -HMAC-SHA256, 1350 B, ring on desktop: 399 ns, 1.22× the fastest -HMAC-SHA256, 1350 B, ring on nixos2: 3.19 µs, 1.14× the fastest -HMAC-SHA256, 1350 B, ring on ovh-iad: 5.16 µs, 1.07× the fastest -HMAC-SHA256, 1350 B, ring on ovh-sea: 4.97 µs, 1.15× the fastest -HMAC-SHA256, 1350 B, RustCrypto + dalek on nixos: 728 ns, 1.05× the fastest -HMAC-SHA256, 1350 B, RustCrypto + dalek on desktop: 358 ns, 1.09× the fastest -HMAC-SHA256, 1350 B, RustCrypto + dalek on nixos2: 5.80 µs, 2.08× the fastest -HMAC-SHA256, 1350 B, RustCrypto + dalek on ovh-iad: 9.61 µs, 1.99× the fastest -HMAC-SHA256, 1350 B, RustCrypto + dalek on ovh-sea: 8.95 µs, 2.08× the fastest -HMAC-SHA256, 1350 B, graviola on nixos: 731 ns, 1.06× the fastest -HMAC-SHA256, 1350 B, graviola on desktop: 363 ns, 1.11× the fastest -HMAC-SHA256, 1350 B, graviola on nixos2: 7.05 µs, 2.53× the fastest -HMAC-SHA256, 1350 B, libcrux on nixos: 4.39 µs, 6.34× the fastest; verified: HACL*'s F* proof of Hacl.HMAC's compute_sha2_256, compiled to Rust by an unverified step -✓ -HMAC-SHA256, 1350 B, libcrux on desktop: 2.66 µs, 8.15× the fastest; verified: HACL*'s F* proof of Hacl.HMAC's compute_sha2_256, compiled to Rust by an unverified step -✓ -HMAC-SHA256, 1350 B, libcrux on nixos2: 6.02 µs, 2.16× the fastest; verified: HACL*'s F* proof of Hacl.HMAC's compute_sha2_256, compiled to Rust by an unverified step -✓ -HMAC-SHA256, 1350 B, libcrux on ovh-iad: 9.65 µs, 2.00× the fastest; verified: HACL*'s F* proof of Hacl.HMAC's compute_sha2_256, compiled to Rust by an unverified step -✓ -HMAC-SHA256, 1350 B, libcrux on ovh-sea: 9.24 µs, 2.14× the fastest; verified: HACL*'s F* proof of Hacl.HMAC's compute_sha2_256, compiled to Rust by an unverified step -✓ -HMAC-SHA256, 1350 B, OpenSSL on nixos: 3.11 µs, 4.50× the fastest -HMAC-SHA256, 1350 B, OpenSSL on desktop: 1.83 µs, 5.60× the fastest -HMAC-SHA256, 1350 B, OpenSSL on nixos2: 5.94 µs, 2.13× the fastest -HMAC-SHA256, 1350 B, OpenSSL on ovh-iad: 9.44 µs, 1.96× the fastest -HMAC-SHA256, 1350 B, OpenSSL on ovh-sea: 9.08 µs, 2.11× the fastest +HMAC-SHA256, 1350 B, rind on kixtop: 559 ns, 1.11× the fastest +HMAC-SHA256, 1350 B, rind on ovh-iad: 4.82 µs, 1.00× the fastest +HMAC-SHA256, 1350 B, rind on ovh-sea: 4.31 µs, 1.00× the fastest +HMAC-SHA256, 1350 B, aws-lc-rs on nixos: 853 ns, 1.23× the fastest +HMAC-SHA256, 1350 B, aws-lc-rs on desktop: 434 ns, 1.33× the fastest +HMAC-SHA256, 1350 B, aws-lc-rs on nixos2: 3.30 µs, 1.18× the fastest +HMAC-SHA256, 1350 B, aws-lc-rs on kixtop: 620 ns, 1.24× the fastest +HMAC-SHA256, 1350 B, aws-lc-rs on ovh-iad: 5.59 µs, 1.16× the fastest +HMAC-SHA256, 1350 B, aws-lc-rs on ovh-sea: 5.11 µs, 1.19× the fastest +HMAC-SHA256, 1350 B, ring on nixos: 791 ns, 1.14× the fastest +HMAC-SHA256, 1350 B, ring on desktop: 399 ns, 1.22× the fastest +HMAC-SHA256, 1350 B, ring on nixos2: 3.19 µs, 1.14× the fastest +HMAC-SHA256, 1350 B, ring on kixtop: 502 ns, 1.00× the fastest +HMAC-SHA256, 1350 B, ring on ovh-iad: 5.16 µs, 1.07× the fastest +HMAC-SHA256, 1350 B, ring on ovh-sea: 4.97 µs, 1.15× the fastest +HMAC-SHA256, 1350 B, RustCrypto + dalek on nixos: 728 ns, 1.05× the fastest +HMAC-SHA256, 1350 B, RustCrypto + dalek on desktop: 358 ns, 1.09× the fastest +HMAC-SHA256, 1350 B, RustCrypto + dalek on nixos2: 5.80 µs, 2.08× the fastest +HMAC-SHA256, 1350 B, RustCrypto + dalek on kixtop: 542 ns, 1.08× the fastest +HMAC-SHA256, 1350 B, RustCrypto + dalek on ovh-iad: 9.61 µs, 1.99× the fastest +HMAC-SHA256, 1350 B, RustCrypto + dalek on ovh-sea: 8.95 µs, 2.08× the fastest +HMAC-SHA256, 1350 B, graviola on nixos: 731 ns, 1.06× the fastest +HMAC-SHA256, 1350 B, graviola on desktop: 363 ns, 1.11× the fastest +HMAC-SHA256, 1350 B, graviola on nixos2: 7.05 µs, 2.53× the fastest +HMAC-SHA256, 1350 B, graviola on kixtop: 557 ns, 1.11× the fastest +HMAC-SHA256, 1350 B, libcrux on nixos: 4.39 µs, 6.34× the fastest; verified: HACL*'s F* proof of Hacl.HMAC's compute_sha2_256, compiled to Rust by an unverified step +✓ +HMAC-SHA256, 1350 B, libcrux on desktop: 2.66 µs, 8.15× the fastest; verified: HACL*'s F* proof of Hacl.HMAC's compute_sha2_256, compiled to Rust by an unverified step +✓ +HMAC-SHA256, 1350 B, libcrux on nixos2: 6.02 µs, 2.16× the fastest; verified: HACL*'s F* proof of Hacl.HMAC's compute_sha2_256, compiled to Rust by an unverified step +✓ +HMAC-SHA256, 1350 B, libcrux on kixtop: 2.86 µs, 5.70× the fastest; verified: HACL*'s F* proof of Hacl.HMAC's compute_sha2_256, compiled to Rust by an unverified step +✓ +HMAC-SHA256, 1350 B, libcrux on ovh-iad: 9.65 µs, 2.00× the fastest; verified: HACL*'s F* proof of Hacl.HMAC's compute_sha2_256, compiled to Rust by an unverified step +✓ +HMAC-SHA256, 1350 B, libcrux on ovh-sea: 9.24 µs, 2.14× the fastest; verified: HACL*'s F* proof of Hacl.HMAC's compute_sha2_256, compiled to Rust by an unverified step +✓ +HMAC-SHA256, 1350 B, OpenSSL on nixos: 3.11 µs, 4.50× the fastest +HMAC-SHA256, 1350 B, OpenSSL on desktop: 1.83 µs, 5.60× the fastest +HMAC-SHA256, 1350 B, OpenSSL on nixos2: 5.94 µs, 2.13× the fastest +HMAC-SHA256, 1350 B, OpenSSL on kixtop: 2.43 µs, 4.84× the fastest +HMAC-SHA256, 1350 B, OpenSSL on ovh-iad: 9.44 µs, 1.96× the fastest +HMAC-SHA256, 1350 B, OpenSSL on ovh-sea: 9.08 µs, 2.11× the fastest HKDF-SHA256 extract and expand HKDF-SHA256 extract and expand, rind on nixos: 257 ns, 1.00× the fastest HKDF-SHA256 extract and expand, rind on desktop: 152 ns, 1.00× the fastest HKDF-SHA256 extract and expand, rind on nixos2: 1.15 µs, 1.00× the fastest -HKDF-SHA256 extract and expand, rind on ovh-iad: 2.10 µs, 1.01× the fastest -HKDF-SHA256 extract and expand, rind on ovh-sea: 1.70 µs, 1.00× the fastest -HKDF-SHA256 extract and expand, aws-lc-rs on nixos: 369 ns, 1.44× the fastest -HKDF-SHA256 extract and expand, aws-lc-rs on desktop: 288 ns, 1.90× the fastest -HKDF-SHA256 extract and expand, aws-lc-rs on nixos2: 1.44 µs, 1.25× the fastest -HKDF-SHA256 extract and expand, aws-lc-rs on ovh-iad: 2.36 µs, 1.13× the fastest -HKDF-SHA256 extract and expand, aws-lc-rs on ovh-sea: 2.01 µs, 1.18× the fastest -HKDF-SHA256 extract and expand, ring on nixos: 399 ns, 1.55× the fastest -HKDF-SHA256 extract and expand, ring on desktop: 305 ns, 2.01× the fastest -HKDF-SHA256 extract and expand, ring on nixos2: 1.31 µs, 1.14× the fastest -HKDF-SHA256 extract and expand, ring on ovh-iad: 2.08 µs, 1.00× the fastest -HKDF-SHA256 extract and expand, ring on ovh-sea: 1.85 µs, 1.09× the fastest -HKDF-SHA256 extract and expand, RustCrypto + dalek on nixos: 309 ns, 1.20× the fastest -HKDF-SHA256 extract and expand, RustCrypto + dalek on desktop: 223 ns, 1.47× the fastest -HKDF-SHA256 extract and expand, RustCrypto + dalek on nixos2: 1.98 µs, 1.72× the fastest -HKDF-SHA256 extract and expand, RustCrypto + dalek on ovh-iad: 3.39 µs, 1.63× the fastest -HKDF-SHA256 extract and expand, RustCrypto + dalek on ovh-sea: 3.01 µs, 1.77× the fastest -HKDF-SHA256 extract and expand, libcrux on nixos: 1.37 µs, 5.34× the fastest; verified: HACL*'s F* proof of Hacl.HKDF's extract_sha2_256 and expand_sha2_256, compiled to Rust by an unverified step -✓ -HKDF-SHA256 extract and expand, libcrux on desktop: 965 ns, 6.36× the fastest; verified: HACL*'s F* proof of Hacl.HKDF's extract_sha2_256 and expand_sha2_256, compiled to Rust by an unverified step -✓ -HKDF-SHA256 extract and expand, libcrux on nixos2: 2.04 µs, 1.77× the fastest; verified: HACL*'s F* proof of Hacl.HKDF's extract_sha2_256 and expand_sha2_256, compiled to Rust by an unverified step -✓ -HKDF-SHA256 extract and expand, libcrux on ovh-iad: 3.73 µs, 1.80× the fastest; verified: HACL*'s F* proof of Hacl.HKDF's extract_sha2_256 and expand_sha2_256, compiled to Rust by an unverified step -✓ -HKDF-SHA256 extract and expand, libcrux on ovh-sea: 3.08 µs, 1.81× the fastest; verified: HACL*'s F* proof of Hacl.HKDF's extract_sha2_256 and expand_sha2_256, compiled to Rust by an unverified step -✓ -HKDF-SHA256 extract and expand, OpenSSL on nixos: 2.72 µs, 10.57× the fastest -HKDF-SHA256 extract and expand, OpenSSL on desktop: 1.76 µs, 11.57× the fastest -HKDF-SHA256 extract and expand, OpenSSL on nixos2: 4.33 µs, 3.76× the fastest -HKDF-SHA256 extract and expand, OpenSSL on ovh-iad: 10.10 µs, 4.86× the fastest -HKDF-SHA256 extract and expand, OpenSSL on ovh-sea: 6.80 µs, 3.99× the fastest +HKDF-SHA256 extract and expand, rind on kixtop: 343 ns, 1.58× the fastest +HKDF-SHA256 extract and expand, rind on ovh-iad: 2.10 µs, 1.01× the fastest +HKDF-SHA256 extract and expand, rind on ovh-sea: 1.70 µs, 1.00× the fastest +HKDF-SHA256 extract and expand, aws-lc-rs on nixos: 369 ns, 1.44× the fastest +HKDF-SHA256 extract and expand, aws-lc-rs on desktop: 288 ns, 1.90× the fastest +HKDF-SHA256 extract and expand, aws-lc-rs on nixos2: 1.44 µs, 1.25× the fastest +HKDF-SHA256 extract and expand, aws-lc-rs on kixtop: 330 ns, 1.52× the fastest +HKDF-SHA256 extract and expand, aws-lc-rs on ovh-iad: 2.36 µs, 1.13× the fastest +HKDF-SHA256 extract and expand, aws-lc-rs on ovh-sea: 2.01 µs, 1.18× the fastest +HKDF-SHA256 extract and expand, ring on nixos: 399 ns, 1.55× the fastest +HKDF-SHA256 extract and expand, ring on desktop: 305 ns, 2.01× the fastest +HKDF-SHA256 extract and expand, ring on nixos2: 1.31 µs, 1.14× the fastest +HKDF-SHA256 extract and expand, ring on kixtop: 274 ns, 1.26× the fastest +HKDF-SHA256 extract and expand, ring on ovh-iad: 2.08 µs, 1.00× the fastest +HKDF-SHA256 extract and expand, ring on ovh-sea: 1.85 µs, 1.09× the fastest +HKDF-SHA256 extract and expand, RustCrypto + dalek on nixos: 309 ns, 1.20× the fastest +HKDF-SHA256 extract and expand, RustCrypto + dalek on desktop: 223 ns, 1.47× the fastest +HKDF-SHA256 extract and expand, RustCrypto + dalek on nixos2: 1.98 µs, 1.72× the fastest +HKDF-SHA256 extract and expand, RustCrypto + dalek on kixtop: 218 ns, 1.00× the fastest +HKDF-SHA256 extract and expand, RustCrypto + dalek on ovh-iad: 3.39 µs, 1.63× the fastest +HKDF-SHA256 extract and expand, RustCrypto + dalek on ovh-sea: 3.01 µs, 1.77× the fastest +HKDF-SHA256 extract and expand, libcrux on nixos: 1.37 µs, 5.34× the fastest; verified: HACL*'s F* proof of Hacl.HKDF's extract_sha2_256 and expand_sha2_256, compiled to Rust by an unverified step +✓ +HKDF-SHA256 extract and expand, libcrux on desktop: 965 ns, 6.36× the fastest; verified: HACL*'s F* proof of Hacl.HKDF's extract_sha2_256 and expand_sha2_256, compiled to Rust by an unverified step +✓ +HKDF-SHA256 extract and expand, libcrux on nixos2: 2.04 µs, 1.77× the fastest; verified: HACL*'s F* proof of Hacl.HKDF's extract_sha2_256 and expand_sha2_256, compiled to Rust by an unverified step +✓ +HKDF-SHA256 extract and expand, libcrux on kixtop: 942 ns, 4.32× the fastest; verified: HACL*'s F* proof of Hacl.HKDF's extract_sha2_256 and expand_sha2_256, compiled to Rust by an unverified step +✓ +HKDF-SHA256 extract and expand, libcrux on ovh-iad: 3.73 µs, 1.80× the fastest; verified: HACL*'s F* proof of Hacl.HKDF's extract_sha2_256 and expand_sha2_256, compiled to Rust by an unverified step +✓ +HKDF-SHA256 extract and expand, libcrux on ovh-sea: 3.08 µs, 1.81× the fastest; verified: HACL*'s F* proof of Hacl.HKDF's extract_sha2_256 and expand_sha2_256, compiled to Rust by an unverified step +✓ +HKDF-SHA256 extract and expand, OpenSSL on nixos: 2.72 µs, 10.57× the fastest +HKDF-SHA256 extract and expand, OpenSSL on desktop: 1.76 µs, 11.57× the fastest +HKDF-SHA256 extract and expand, OpenSSL on nixos2: 4.33 µs, 3.76× the fastest +HKDF-SHA256 extract and expand, OpenSSL on kixtop: 2.14 µs, 9.84× the fastest +HKDF-SHA256 extract and expand, OpenSSL on ovh-iad: 10.10 µs, 4.86× the fastest +HKDF-SHA256 extract and expand, OpenSSL on ovh-sea: 6.80 µs, 3.99× the fastest HKDF-SHA256 expand HKDF-SHA256 expand, rind on nixos: 89 ns, 1.00× the fastest HKDF-SHA256 expand, rind on desktop: 47 ns, 1.00× the fastest HKDF-SHA256 expand, rind on nixos2: 300 ns, 1.00× the fastest -HKDF-SHA256 expand, rind on ovh-iad: 540 ns, 1.00× the fastest -HKDF-SHA256 expand, rind on ovh-sea: 464 ns, 1.00× the fastest -HKDF-SHA256 expand, aws-lc-rs on nixos: 179 ns, 2.02× the fastest -HKDF-SHA256 expand, aws-lc-rs on desktop: 126 ns, 2.70× the fastest -HKDF-SHA256 expand, aws-lc-rs on nixos2: 636 ns, 2.12× the fastest -HKDF-SHA256 expand, aws-lc-rs on ovh-iad: 1.23 µs, 2.29× the fastest -HKDF-SHA256 expand, aws-lc-rs on ovh-sea: 973 ns, 2.10× the fastest -HKDF-SHA256 expand, ring on nixos: 142 ns, 1.60× the fastest -HKDF-SHA256 expand, ring on desktop: 122 ns, 2.63× the fastest -HKDF-SHA256 expand, ring on nixos2: 337 ns, 1.12× the fastest -HKDF-SHA256 expand, ring on ovh-iad: 651 ns, 1.21× the fastest -HKDF-SHA256 expand, ring on ovh-sea: 508 ns, 1.09× the fastest -HKDF-SHA256 expand, RustCrypto + dalek on nixos: 103 ns, 1.16× the fastest -HKDF-SHA256 expand, RustCrypto + dalek on desktop: 85 ns, 1.83× the fastest -HKDF-SHA256 expand, RustCrypto + dalek on nixos2: 512 ns, 1.71× the fastest -HKDF-SHA256 expand, RustCrypto + dalek on ovh-iad: 887 ns, 1.64× the fastest -HKDF-SHA256 expand, RustCrypto + dalek on ovh-sea: 773 ns, 1.67× the fastest -HKDF-SHA256 expand, libcrux on nixos: 714 ns, 8.06× the fastest; verified: HACL*'s F* proof of Hacl.HKDF's extract_sha2_256 and expand_sha2_256, compiled to Rust by an unverified step -✓ -HKDF-SHA256 expand, libcrux on desktop: 484 ns, 10.38× the fastest; verified: HACL*'s F* proof of Hacl.HKDF's extract_sha2_256 and expand_sha2_256, compiled to Rust by an unverified step -✓ -HKDF-SHA256 expand, libcrux on nixos2: 1.01 µs, 3.37× the fastest; verified: HACL*'s F* proof of Hacl.HKDF's extract_sha2_256 and expand_sha2_256, compiled to Rust by an unverified step -✓ -HKDF-SHA256 expand, libcrux on ovh-iad: 1.77 µs, 3.28× the fastest; verified: HACL*'s F* proof of Hacl.HKDF's extract_sha2_256 and expand_sha2_256, compiled to Rust by an unverified step -✓ -HKDF-SHA256 expand, libcrux on ovh-sea: 1.58 µs, 3.41× the fastest; verified: HACL*'s F* proof of Hacl.HKDF's extract_sha2_256 and expand_sha2_256, compiled to Rust by an unverified step -✓ -HKDF-SHA256 expand, OpenSSL on nixos: 2.00 µs, 22.59× the fastest -HKDF-SHA256 expand, OpenSSL on desktop: 1.25 µs, 26.79× the fastest -HKDF-SHA256 expand, OpenSSL on nixos2: 2.87 µs, 9.58× the fastest -HKDF-SHA256 expand, OpenSSL on ovh-iad: 6.74 µs, 12.48× the fastest -HKDF-SHA256 expand, OpenSSL on ovh-sea: 4.62 µs, 9.94× the fastest +HKDF-SHA256 expand, rind on kixtop: 109 ns, 1.55× the fastest +HKDF-SHA256 expand, rind on ovh-iad: 540 ns, 1.00× the fastest +HKDF-SHA256 expand, rind on ovh-sea: 464 ns, 1.00× the fastest +HKDF-SHA256 expand, aws-lc-rs on nixos: 179 ns, 2.02× the fastest +HKDF-SHA256 expand, aws-lc-rs on desktop: 126 ns, 2.70× the fastest +HKDF-SHA256 expand, aws-lc-rs on nixos2: 636 ns, 2.12× the fastest +HKDF-SHA256 expand, aws-lc-rs on kixtop: 154 ns, 2.20× the fastest +HKDF-SHA256 expand, aws-lc-rs on ovh-iad: 1.23 µs, 2.29× the fastest +HKDF-SHA256 expand, aws-lc-rs on ovh-sea: 973 ns, 2.10× the fastest +HKDF-SHA256 expand, ring on nixos: 142 ns, 1.60× the fastest +HKDF-SHA256 expand, ring on desktop: 122 ns, 2.63× the fastest +HKDF-SHA256 expand, ring on nixos2: 337 ns, 1.12× the fastest +HKDF-SHA256 expand, ring on kixtop: 94 ns, 1.33× the fastest +HKDF-SHA256 expand, ring on ovh-iad: 651 ns, 1.21× the fastest +HKDF-SHA256 expand, ring on ovh-sea: 508 ns, 1.09× the fastest +HKDF-SHA256 expand, RustCrypto + dalek on nixos: 103 ns, 1.16× the fastest +HKDF-SHA256 expand, RustCrypto + dalek on desktop: 85 ns, 1.83× the fastest +HKDF-SHA256 expand, RustCrypto + dalek on nixos2: 512 ns, 1.71× the fastest +HKDF-SHA256 expand, RustCrypto + dalek on kixtop: 70 ns, 1.00× the fastest +HKDF-SHA256 expand, RustCrypto + dalek on ovh-iad: 887 ns, 1.64× the fastest +HKDF-SHA256 expand, RustCrypto + dalek on ovh-sea: 773 ns, 1.67× the fastest +HKDF-SHA256 expand, libcrux on nixos: 714 ns, 8.06× the fastest; verified: HACL*'s F* proof of Hacl.HKDF's extract_sha2_256 and expand_sha2_256, compiled to Rust by an unverified step +✓ +HKDF-SHA256 expand, libcrux on desktop: 484 ns, 10.38× the fastest; verified: HACL*'s F* proof of Hacl.HKDF's extract_sha2_256 and expand_sha2_256, compiled to Rust by an unverified step +✓ +HKDF-SHA256 expand, libcrux on nixos2: 1.01 µs, 3.37× the fastest; verified: HACL*'s F* proof of Hacl.HKDF's extract_sha2_256 and expand_sha2_256, compiled to Rust by an unverified step +✓ +HKDF-SHA256 expand, libcrux on kixtop: 481 ns, 6.86× the fastest; verified: HACL*'s F* proof of Hacl.HKDF's extract_sha2_256 and expand_sha2_256, compiled to Rust by an unverified step +✓ +HKDF-SHA256 expand, libcrux on ovh-iad: 1.77 µs, 3.28× the fastest; verified: HACL*'s F* proof of Hacl.HKDF's extract_sha2_256 and expand_sha2_256, compiled to Rust by an unverified step +✓ +HKDF-SHA256 expand, libcrux on ovh-sea: 1.58 µs, 3.41× the fastest; verified: HACL*'s F* proof of Hacl.HKDF's extract_sha2_256 and expand_sha2_256, compiled to Rust by an unverified step +✓ +HKDF-SHA256 expand, OpenSSL on nixos: 2.00 µs, 22.59× the fastest +HKDF-SHA256 expand, OpenSSL on desktop: 1.25 µs, 26.79× the fastest +HKDF-SHA256 expand, OpenSSL on nixos2: 2.87 µs, 9.58× the fastest +HKDF-SHA256 expand, OpenSSL on kixtop: 1.54 µs, 21.93× the fastest +HKDF-SHA256 expand, OpenSSL on ovh-iad: 6.74 µs, 12.48× the fastest +HKDF-SHA256 expand, OpenSSL on ovh-sea: 4.62 µs, 9.94× the fastest RSA - + RSA-2048 PKCS#1 sign RSA-2048 PKCS#1 sign, rind on nixos: 523.17 µs, 1.10× the fastest RSA-2048 PKCS#1 sign, rind on desktop: 348.43 µs, 1.02× the fastest RSA-2048 PKCS#1 sign, rind on nixos2: 447.43 µs, 1.03× the fastest -RSA-2048 PKCS#1 sign, rind on ovh-iad: 762.79 µs, 1.00× the fastest -RSA-2048 PKCS#1 sign, rind on ovh-sea: 740.76 µs, 1.00× the fastest -RSA-2048 PKCS#1 sign, aws-lc-rs on nixos: 532.39 µs, 1.12× the fastest -RSA-2048 PKCS#1 sign, aws-lc-rs on desktop: 349.47 µs, 1.02× the fastest -RSA-2048 PKCS#1 sign, aws-lc-rs on nixos2: 448.68 µs, 1.03× the fastest -RSA-2048 PKCS#1 sign, aws-lc-rs on ovh-iad: 796.90 µs, 1.04× the fastest -RSA-2048 PKCS#1 sign, aws-lc-rs on ovh-sea: 779.05 µs, 1.05× the fastest -RSA-2048 PKCS#1 sign, ring on nixos: 523.12 µs, 1.10× the fastest -RSA-2048 PKCS#1 sign, ring on desktop: 341.11 µs, 1.00× the fastest -RSA-2048 PKCS#1 sign, ring on nixos2: 434.47 µs, 1.00× the fastest -RSA-2048 PKCS#1 sign, ring on ovh-iad: 1.05 ms, 1.38× the fastest -RSA-2048 PKCS#1 sign, ring on ovh-sea: 982.45 µs, 1.33× the fastest -RSA-2048 PKCS#1 sign, RustCrypto + dalek on nixos: 1.26 ms, 2.66× the fastest -RSA-2048 PKCS#1 sign, RustCrypto + dalek on desktop: 588.67 µs, 1.73× the fastest -RSA-2048 PKCS#1 sign, RustCrypto + dalek on nixos2: 1.14 ms, 2.63× the fastest -RSA-2048 PKCS#1 sign, RustCrypto + dalek on ovh-iad: 1.83 ms, 2.40× the fastest -RSA-2048 PKCS#1 sign, RustCrypto + dalek on ovh-sea: 1.78 ms, 2.40× the fastest -RSA-2048 PKCS#1 sign, graviola on nixos: 474.44 µs, 1.00× the fastest -RSA-2048 PKCS#1 sign, graviola on desktop: 343.91 µs, 1.01× the fastest -RSA-2048 PKCS#1 sign, graviola on nixos2: 445.92 µs, 1.03× the fastest -RSA-2048 PKCS#1 sign, OpenSSL on nixos: 520.25 µs, 1.10× the fastest -RSA-2048 PKCS#1 sign, OpenSSL on desktop: 397.72 µs, 1.17× the fastest -RSA-2048 PKCS#1 sign, OpenSSL on nixos2: 453.81 µs, 1.04× the fastest -RSA-2048 PKCS#1 sign, OpenSSL on ovh-iad: 846.94 µs, 1.11× the fastest -RSA-2048 PKCS#1 sign, OpenSSL on ovh-sea: 777.23 µs, 1.05× the fastest +RSA-2048 PKCS#1 sign, rind on kixtop: 275.12 µs, 1.00× the fastest +RSA-2048 PKCS#1 sign, rind on ovh-iad: 762.79 µs, 1.00× the fastest +RSA-2048 PKCS#1 sign, rind on ovh-sea: 740.76 µs, 1.00× the fastest +RSA-2048 PKCS#1 sign, aws-lc-rs on nixos: 532.39 µs, 1.12× the fastest +RSA-2048 PKCS#1 sign, aws-lc-rs on desktop: 349.47 µs, 1.02× the fastest +RSA-2048 PKCS#1 sign, aws-lc-rs on nixos2: 448.68 µs, 1.03× the fastest +RSA-2048 PKCS#1 sign, aws-lc-rs on kixtop: 285.95 µs, 1.04× the fastest +RSA-2048 PKCS#1 sign, aws-lc-rs on ovh-iad: 796.90 µs, 1.04× the fastest +RSA-2048 PKCS#1 sign, aws-lc-rs on ovh-sea: 779.05 µs, 1.05× the fastest +RSA-2048 PKCS#1 sign, ring on nixos: 523.12 µs, 1.10× the fastest +RSA-2048 PKCS#1 sign, ring on desktop: 341.11 µs, 1.00× the fastest +RSA-2048 PKCS#1 sign, ring on nixos2: 434.47 µs, 1.00× the fastest +RSA-2048 PKCS#1 sign, ring on kixtop: 322.84 µs, 1.17× the fastest +RSA-2048 PKCS#1 sign, ring on ovh-iad: 1.05 ms, 1.38× the fastest +RSA-2048 PKCS#1 sign, ring on ovh-sea: 982.45 µs, 1.33× the fastest +RSA-2048 PKCS#1 sign, RustCrypto + dalek on nixos: 1.26 ms, 2.66× the fastest +RSA-2048 PKCS#1 sign, RustCrypto + dalek on desktop: 588.67 µs, 1.73× the fastest +RSA-2048 PKCS#1 sign, RustCrypto + dalek on nixos2: 1.14 ms, 2.63× the fastest +RSA-2048 PKCS#1 sign, RustCrypto + dalek on kixtop: 586.34 µs, 2.13× the fastest +RSA-2048 PKCS#1 sign, RustCrypto + dalek on ovh-iad: 1.83 ms, 2.40× the fastest +RSA-2048 PKCS#1 sign, RustCrypto + dalek on ovh-sea: 1.78 ms, 2.40× the fastest +RSA-2048 PKCS#1 sign, graviola on nixos: 474.44 µs, 1.00× the fastest +RSA-2048 PKCS#1 sign, graviola on desktop: 343.91 µs, 1.01× the fastest +RSA-2048 PKCS#1 sign, graviola on nixos2: 445.92 µs, 1.03× the fastest +RSA-2048 PKCS#1 sign, graviola on kixtop: 556.70 µs, 2.02× the fastest +RSA-2048 PKCS#1 sign, OpenSSL on nixos: 520.25 µs, 1.10× the fastest +RSA-2048 PKCS#1 sign, OpenSSL on desktop: 397.72 µs, 1.17× the fastest +RSA-2048 PKCS#1 sign, OpenSSL on nixos2: 453.81 µs, 1.04× the fastest +RSA-2048 PKCS#1 sign, OpenSSL on kixtop: 341.31 µs, 1.24× the fastest +RSA-2048 PKCS#1 sign, OpenSSL on ovh-iad: 846.94 µs, 1.11× the fastest +RSA-2048 PKCS#1 sign, OpenSSL on ovh-sea: 777.23 µs, 1.05× the fastest RSA-2048 PKCS#1 verify RSA-2048 PKCS#1 verify, rind on nixos: 12.28 µs, 1.00× the fastest RSA-2048 PKCS#1 verify, rind on desktop: 8.97 µs, 1.00× the fastest RSA-2048 PKCS#1 verify, rind on nixos2: 12.88 µs, 1.00× the fastest -RSA-2048 PKCS#1 verify, rind on ovh-iad: 30.35 µs, 1.00× the fastest -RSA-2048 PKCS#1 verify, rind on ovh-sea: 29.50 µs, 1.00× the fastest -RSA-2048 PKCS#1 verify, aws-lc-rs on nixos: 14.60 µs, 1.19× the fastest -RSA-2048 PKCS#1 verify, aws-lc-rs on desktop: 10.86 µs, 1.21× the fastest -RSA-2048 PKCS#1 verify, aws-lc-rs on nixos2: 15.88 µs, 1.23× the fastest -RSA-2048 PKCS#1 verify, aws-lc-rs on ovh-iad: 35.39 µs, 1.17× the fastest -RSA-2048 PKCS#1 verify, aws-lc-rs on ovh-sea: 32.95 µs, 1.12× the fastest -RSA-2048 PKCS#1 verify, ring on nixos: 16.56 µs, 1.35× the fastest -RSA-2048 PKCS#1 verify, ring on desktop: 12.70 µs, 1.41× the fastest -RSA-2048 PKCS#1 verify, ring on nixos2: 16.51 µs, 1.28× the fastest -RSA-2048 PKCS#1 verify, ring on ovh-iad: 39.13 µs, 1.29× the fastest -RSA-2048 PKCS#1 verify, ring on ovh-sea: 37.72 µs, 1.28× the fastest -RSA-2048 PKCS#1 verify, RustCrypto + dalek on nixos: 54.06 µs, 4.40× the fastest -RSA-2048 PKCS#1 verify, RustCrypto + dalek on desktop: 29.41 µs, 3.28× the fastest -RSA-2048 PKCS#1 verify, RustCrypto + dalek on nixos2: 57.81 µs, 4.49× the fastest -RSA-2048 PKCS#1 verify, RustCrypto + dalek on ovh-iad: 92.51 µs, 3.05× the fastest -RSA-2048 PKCS#1 verify, RustCrypto + dalek on ovh-sea: 88.47 µs, 3.00× the fastest -RSA-2048 PKCS#1 verify, graviola on nixos: 19.25 µs, 1.57× the fastest -RSA-2048 PKCS#1 verify, graviola on desktop: 14.06 µs, 1.57× the fastest -RSA-2048 PKCS#1 verify, graviola on nixos2: 19.05 µs, 1.48× the fastest -RSA-2048 PKCS#1 verify, OpenSSL on nixos: 23.59 µs, 1.92× the fastest -RSA-2048 PKCS#1 verify, OpenSSL on desktop: 15.59 µs, 1.74× the fastest -RSA-2048 PKCS#1 verify, OpenSSL on nixos2: 24.54 µs, 1.91× the fastest -RSA-2048 PKCS#1 verify, OpenSSL on ovh-iad: 50.31 µs, 1.66× the fastest -RSA-2048 PKCS#1 verify, OpenSSL on ovh-sea: 47.30 µs, 1.60× the fastest +RSA-2048 PKCS#1 verify, rind on kixtop: 8.38 µs, 1.00× the fastest +RSA-2048 PKCS#1 verify, rind on ovh-iad: 30.35 µs, 1.00× the fastest +RSA-2048 PKCS#1 verify, rind on ovh-sea: 29.50 µs, 1.00× the fastest +RSA-2048 PKCS#1 verify, aws-lc-rs on nixos: 14.60 µs, 1.19× the fastest +RSA-2048 PKCS#1 verify, aws-lc-rs on desktop: 10.86 µs, 1.21× the fastest +RSA-2048 PKCS#1 verify, aws-lc-rs on nixos2: 15.88 µs, 1.23× the fastest +RSA-2048 PKCS#1 verify, aws-lc-rs on kixtop: 9.48 µs, 1.13× the fastest +RSA-2048 PKCS#1 verify, aws-lc-rs on ovh-iad: 35.39 µs, 1.17× the fastest +RSA-2048 PKCS#1 verify, aws-lc-rs on ovh-sea: 32.95 µs, 1.12× the fastest +RSA-2048 PKCS#1 verify, ring on nixos: 16.56 µs, 1.35× the fastest +RSA-2048 PKCS#1 verify, ring on desktop: 12.70 µs, 1.41× the fastest +RSA-2048 PKCS#1 verify, ring on nixos2: 16.51 µs, 1.28× the fastest +RSA-2048 PKCS#1 verify, ring on kixtop: 11.05 µs, 1.32× the fastest +RSA-2048 PKCS#1 verify, ring on ovh-iad: 39.13 µs, 1.29× the fastest +RSA-2048 PKCS#1 verify, ring on ovh-sea: 37.72 µs, 1.28× the fastest +RSA-2048 PKCS#1 verify, RustCrypto + dalek on nixos: 54.06 µs, 4.40× the fastest +RSA-2048 PKCS#1 verify, RustCrypto + dalek on desktop: 29.41 µs, 3.28× the fastest +RSA-2048 PKCS#1 verify, RustCrypto + dalek on nixos2: 57.81 µs, 4.49× the fastest +RSA-2048 PKCS#1 verify, RustCrypto + dalek on kixtop: 30.77 µs, 3.67× the fastest +RSA-2048 PKCS#1 verify, RustCrypto + dalek on ovh-iad: 92.51 µs, 3.05× the fastest +RSA-2048 PKCS#1 verify, RustCrypto + dalek on ovh-sea: 88.47 µs, 3.00× the fastest +RSA-2048 PKCS#1 verify, graviola on nixos: 19.25 µs, 1.57× the fastest +RSA-2048 PKCS#1 verify, graviola on desktop: 14.06 µs, 1.57× the fastest +RSA-2048 PKCS#1 verify, graviola on nixos2: 19.05 µs, 1.48× the fastest +RSA-2048 PKCS#1 verify, graviola on kixtop: 18.51 µs, 2.21× the fastest +RSA-2048 PKCS#1 verify, OpenSSL on nixos: 23.59 µs, 1.92× the fastest +RSA-2048 PKCS#1 verify, OpenSSL on desktop: 15.59 µs, 1.74× the fastest +RSA-2048 PKCS#1 verify, OpenSSL on nixos2: 24.54 µs, 1.91× the fastest +RSA-2048 PKCS#1 verify, OpenSSL on kixtop: 16.66 µs, 1.99× the fastest +RSA-2048 PKCS#1 verify, OpenSSL on ovh-iad: 50.31 µs, 1.66× the fastest +RSA-2048 PKCS#1 verify, OpenSSL on ovh-sea: 47.30 µs, 1.60× the fastest RSA-2048 PSS sign RSA-2048 PSS sign, rind on nixos: 424.30 µs, 1.00× the fastest RSA-2048 PSS sign, rind on desktop: 346.52 µs, 1.01× the fastest RSA-2048 PSS sign, rind on nixos2: 445.92 µs, 1.02× the fastest -RSA-2048 PSS sign, rind on ovh-iad: 819.13 µs, 1.01× the fastest -RSA-2048 PSS sign, rind on ovh-sea: 743.95 µs, 1.00× the fastest -RSA-2048 PSS sign, aws-lc-rs on nixos: 481.00 µs, 1.13× the fastest -RSA-2048 PSS sign, aws-lc-rs on desktop: 350.45 µs, 1.03× the fastest -RSA-2048 PSS sign, aws-lc-rs on nixos2: 461.87 µs, 1.06× the fastest -RSA-2048 PSS sign, aws-lc-rs on ovh-iad: 807.21 µs, 1.00× the fastest -RSA-2048 PSS sign, aws-lc-rs on ovh-sea: 772.15 µs, 1.04× the fastest -RSA-2048 PSS sign, ring on nixos: 471.53 µs, 1.11× the fastest -RSA-2048 PSS sign, ring on desktop: 341.45 µs, 1.00× the fastest -RSA-2048 PSS sign, ring on nixos2: 437.28 µs, 1.00× the fastest -RSA-2048 PSS sign, ring on ovh-iad: 1.04 ms, 1.29× the fastest -RSA-2048 PSS sign, ring on ovh-sea: 987.95 µs, 1.33× the fastest -RSA-2048 PSS sign, RustCrypto + dalek on nixos: 1.06 ms, 2.50× the fastest -RSA-2048 PSS sign, RustCrypto + dalek on desktop: 588.33 µs, 1.72× the fastest -RSA-2048 PSS sign, RustCrypto + dalek on nixos2: 1.15 ms, 2.63× the fastest -RSA-2048 PSS sign, RustCrypto + dalek on ovh-iad: 1.91 ms, 2.36× the fastest -RSA-2048 PSS sign, RustCrypto + dalek on ovh-sea: 1.81 ms, 2.44× the fastest -RSA-2048 PSS sign, graviola on nixos: 448.54 µs, 1.06× the fastest -RSA-2048 PSS sign, graviola on desktop: 342.67 µs, 1.00× the fastest -RSA-2048 PSS sign, graviola on nixos2: 450.24 µs, 1.03× the fastest -RSA-2048 PSS sign, libcrux on nixos: 5.86 ms, 13.81× the fastest; verified: HACL*'s F* proof of Hacl.RSAPSS's rsapss_skey_sign and rsapss_pkey_verify, signing without the CRT, compiled to Rust by an unverified step -✓ -RSA-2048 PSS sign, libcrux on desktop: 4.10 ms, 12.00× the fastest; verified: HACL*'s F* proof of Hacl.RSAPSS's rsapss_skey_sign and rsapss_pkey_verify, signing without the CRT, compiled to Rust by an unverified step -✓ -RSA-2048 PSS sign, libcrux on nixos2: 7.22 ms, 16.51× the fastest; verified: HACL*'s F* proof of Hacl.RSAPSS's rsapss_skey_sign and rsapss_pkey_verify, signing without the CRT, compiled to Rust by an unverified step -✓ -RSA-2048 PSS sign, libcrux on ovh-iad: 11.56 ms, 14.33× the fastest; verified: HACL*'s F* proof of Hacl.RSAPSS's rsapss_skey_sign and rsapss_pkey_verify, signing without the CRT, compiled to Rust by an unverified step -✓ -RSA-2048 PSS sign, libcrux on ovh-sea: 10.86 ms, 14.60× the fastest; verified: HACL*'s F* proof of Hacl.RSAPSS's rsapss_skey_sign and rsapss_pkey_verify, signing without the CRT, compiled to Rust by an unverified step -✓ -RSA-2048 PSS sign, OpenSSL on nixos: 474.99 µs, 1.12× the fastest -RSA-2048 PSS sign, OpenSSL on desktop: 395.81 µs, 1.16× the fastest -RSA-2048 PSS sign, OpenSSL on nixos2: 456.55 µs, 1.04× the fastest -RSA-2048 PSS sign, OpenSSL on ovh-iad: 830.22 µs, 1.03× the fastest -RSA-2048 PSS sign, OpenSSL on ovh-sea: 796.27 µs, 1.07× the fastest +RSA-2048 PSS sign, rind on kixtop: 275.29 µs, 1.00× the fastest +RSA-2048 PSS sign, rind on ovh-iad: 819.13 µs, 1.01× the fastest +RSA-2048 PSS sign, rind on ovh-sea: 743.95 µs, 1.00× the fastest +RSA-2048 PSS sign, aws-lc-rs on nixos: 481.00 µs, 1.13× the fastest +RSA-2048 PSS sign, aws-lc-rs on desktop: 350.45 µs, 1.03× the fastest +RSA-2048 PSS sign, aws-lc-rs on nixos2: 461.87 µs, 1.06× the fastest +RSA-2048 PSS sign, aws-lc-rs on kixtop: 288.58 µs, 1.05× the fastest +RSA-2048 PSS sign, aws-lc-rs on ovh-iad: 807.21 µs, 1.00× the fastest +RSA-2048 PSS sign, aws-lc-rs on ovh-sea: 772.15 µs, 1.04× the fastest +RSA-2048 PSS sign, ring on nixos: 471.53 µs, 1.11× the fastest +RSA-2048 PSS sign, ring on desktop: 341.45 µs, 1.00× the fastest +RSA-2048 PSS sign, ring on nixos2: 437.28 µs, 1.00× the fastest +RSA-2048 PSS sign, ring on kixtop: 324.86 µs, 1.18× the fastest +RSA-2048 PSS sign, ring on ovh-iad: 1.04 ms, 1.29× the fastest +RSA-2048 PSS sign, ring on ovh-sea: 987.95 µs, 1.33× the fastest +RSA-2048 PSS sign, RustCrypto + dalek on nixos: 1.06 ms, 2.50× the fastest +RSA-2048 PSS sign, RustCrypto + dalek on desktop: 588.33 µs, 1.72× the fastest +RSA-2048 PSS sign, RustCrypto + dalek on nixos2: 1.15 ms, 2.63× the fastest +RSA-2048 PSS sign, RustCrypto + dalek on kixtop: 588.38 µs, 2.14× the fastest +RSA-2048 PSS sign, RustCrypto + dalek on ovh-iad: 1.91 ms, 2.36× the fastest +RSA-2048 PSS sign, RustCrypto + dalek on ovh-sea: 1.81 ms, 2.44× the fastest +RSA-2048 PSS sign, graviola on nixos: 448.54 µs, 1.06× the fastest +RSA-2048 PSS sign, graviola on desktop: 342.67 µs, 1.00× the fastest +RSA-2048 PSS sign, graviola on nixos2: 450.24 µs, 1.03× the fastest +RSA-2048 PSS sign, graviola on kixtop: 558.57 µs, 2.03× the fastest +RSA-2048 PSS sign, libcrux on nixos: 5.86 ms, 13.81× the fastest; verified: HACL*'s F* proof of Hacl.RSAPSS's rsapss_skey_sign and rsapss_pkey_verify, signing without the CRT, compiled to Rust by an unverified step +✓ +RSA-2048 PSS sign, libcrux on desktop: 4.10 ms, 12.00× the fastest; verified: HACL*'s F* proof of Hacl.RSAPSS's rsapss_skey_sign and rsapss_pkey_verify, signing without the CRT, compiled to Rust by an unverified step +✓ +RSA-2048 PSS sign, libcrux on nixos2: 7.22 ms, 16.51× the fastest; verified: HACL*'s F* proof of Hacl.RSAPSS's rsapss_skey_sign and rsapss_pkey_verify, signing without the CRT, compiled to Rust by an unverified step +✓ +RSA-2048 PSS sign, libcrux on kixtop: 4.48 ms, 16.28× the fastest; verified: HACL*'s F* proof of Hacl.RSAPSS's rsapss_skey_sign and rsapss_pkey_verify, signing without the CRT, compiled to Rust by an unverified step +✓ +RSA-2048 PSS sign, libcrux on ovh-iad: 11.56 ms, 14.33× the fastest; verified: HACL*'s F* proof of Hacl.RSAPSS's rsapss_skey_sign and rsapss_pkey_verify, signing without the CRT, compiled to Rust by an unverified step +✓ +RSA-2048 PSS sign, libcrux on ovh-sea: 10.86 ms, 14.60× the fastest; verified: HACL*'s F* proof of Hacl.RSAPSS's rsapss_skey_sign and rsapss_pkey_verify, signing without the CRT, compiled to Rust by an unverified step +✓ +RSA-2048 PSS sign, OpenSSL on nixos: 474.99 µs, 1.12× the fastest +RSA-2048 PSS sign, OpenSSL on desktop: 395.81 µs, 1.16× the fastest +RSA-2048 PSS sign, OpenSSL on nixos2: 456.55 µs, 1.04× the fastest +RSA-2048 PSS sign, OpenSSL on kixtop: 342.61 µs, 1.24× the fastest +RSA-2048 PSS sign, OpenSSL on ovh-iad: 830.22 µs, 1.03× the fastest +RSA-2048 PSS sign, OpenSSL on ovh-sea: 796.27 µs, 1.07× the fastest RSA-2048 PSS verify RSA-2048 PSS verify, rind on nixos: 12.67 µs, 1.00× the fastest RSA-2048 PSS verify, rind on desktop: 9.18 µs, 1.00× the fastest RSA-2048 PSS verify, rind on nixos2: 14.36 µs, 1.00× the fastest -RSA-2048 PSS verify, rind on ovh-iad: 35.06 µs, 1.00× the fastest -RSA-2048 PSS verify, rind on ovh-sea: 31.99 µs, 1.00× the fastest -RSA-2048 PSS verify, aws-lc-rs on nixos: 15.94 µs, 1.26× the fastest -RSA-2048 PSS verify, aws-lc-rs on desktop: 11.17 µs, 1.22× the fastest -RSA-2048 PSS verify, aws-lc-rs on nixos2: 17.01 µs, 1.18× the fastest -RSA-2048 PSS verify, aws-lc-rs on ovh-iad: 36.78 µs, 1.05× the fastest -RSA-2048 PSS verify, aws-lc-rs on ovh-sea: 35.48 µs, 1.11× the fastest -RSA-2048 PSS verify, ring on nixos: 18.03 µs, 1.42× the fastest -RSA-2048 PSS verify, ring on desktop: 13.31 µs, 1.45× the fastest -RSA-2048 PSS verify, ring on nixos2: 18.22 µs, 1.27× the fastest -RSA-2048 PSS verify, ring on ovh-iad: 42.45 µs, 1.21× the fastest -RSA-2048 PSS verify, ring on ovh-sea: 40.12 µs, 1.25× the fastest -RSA-2048 PSS verify, RustCrypto + dalek on nixos: 64.70 µs, 5.11× the fastest -RSA-2048 PSS verify, RustCrypto + dalek on desktop: 35.62 µs, 3.88× the fastest -RSA-2048 PSS verify, RustCrypto + dalek on nixos2: 70.02 µs, 4.88× the fastest -RSA-2048 PSS verify, RustCrypto + dalek on ovh-iad: 117.27 µs, 3.35× the fastest -RSA-2048 PSS verify, RustCrypto + dalek on ovh-sea: 106.80 µs, 3.34× the fastest -RSA-2048 PSS verify, graviola on nixos: 19.63 µs, 1.55× the fastest -RSA-2048 PSS verify, graviola on desktop: 14.44 µs, 1.57× the fastest -RSA-2048 PSS verify, graviola on nixos2: 21.85 µs, 1.52× the fastest -RSA-2048 PSS verify, libcrux on nixos: 312.23 µs, 24.64× the fastest; verified: HACL*'s F* proof of Hacl.RSAPSS's rsapss_skey_sign and rsapss_pkey_verify, signing without the CRT, compiled to Rust by an unverified step -✓ -RSA-2048 PSS verify, libcrux on desktop: 252.13 µs, 27.46× the fastest; verified: HACL*'s F* proof of Hacl.RSAPSS's rsapss_skey_sign and rsapss_pkey_verify, signing without the CRT, compiled to Rust by an unverified step -✓ -RSA-2048 PSS verify, libcrux on nixos2: 377.87 µs, 26.32× the fastest; verified: HACL*'s F* proof of Hacl.RSAPSS's rsapss_skey_sign and rsapss_pkey_verify, signing without the CRT, compiled to Rust by an unverified step -✓ -RSA-2048 PSS verify, libcrux on ovh-iad: 636.67 µs, 18.16× the fastest; verified: HACL*'s F* proof of Hacl.RSAPSS's rsapss_skey_sign and rsapss_pkey_verify, signing without the CRT, compiled to Rust by an unverified step -✓ -RSA-2048 PSS verify, libcrux on ovh-sea: 583.13 µs, 18.23× the fastest; verified: HACL*'s F* proof of Hacl.RSAPSS's rsapss_skey_sign and rsapss_pkey_verify, signing without the CRT, compiled to Rust by an unverified step -✓ -RSA-2048 PSS verify, OpenSSL on nixos: 23.60 µs, 1.86× the fastest -RSA-2048 PSS verify, OpenSSL on desktop: 16.36 µs, 1.78× the fastest -RSA-2048 PSS verify, OpenSSL on nixos2: 27.16 µs, 1.89× the fastest -RSA-2048 PSS verify, OpenSSL on ovh-iad: 55.18 µs, 1.57× the fastest -RSA-2048 PSS verify, OpenSSL on ovh-sea: 50.44 µs, 1.58× the fastest +RSA-2048 PSS verify, rind on kixtop: 8.71 µs, 1.00× the fastest +RSA-2048 PSS verify, rind on ovh-iad: 35.06 µs, 1.00× the fastest +RSA-2048 PSS verify, rind on ovh-sea: 31.99 µs, 1.00× the fastest +RSA-2048 PSS verify, aws-lc-rs on nixos: 15.94 µs, 1.26× the fastest +RSA-2048 PSS verify, aws-lc-rs on desktop: 11.17 µs, 1.22× the fastest +RSA-2048 PSS verify, aws-lc-rs on nixos2: 17.01 µs, 1.18× the fastest +RSA-2048 PSS verify, aws-lc-rs on kixtop: 9.84 µs, 1.13× the fastest +RSA-2048 PSS verify, aws-lc-rs on ovh-iad: 36.78 µs, 1.05× the fastest +RSA-2048 PSS verify, aws-lc-rs on ovh-sea: 35.48 µs, 1.11× the fastest +RSA-2048 PSS verify, ring on nixos: 18.03 µs, 1.42× the fastest +RSA-2048 PSS verify, ring on desktop: 13.31 µs, 1.45× the fastest +RSA-2048 PSS verify, ring on nixos2: 18.22 µs, 1.27× the fastest +RSA-2048 PSS verify, ring on kixtop: 11.48 µs, 1.32× the fastest +RSA-2048 PSS verify, ring on ovh-iad: 42.45 µs, 1.21× the fastest +RSA-2048 PSS verify, ring on ovh-sea: 40.12 µs, 1.25× the fastest +RSA-2048 PSS verify, RustCrypto + dalek on nixos: 64.70 µs, 5.11× the fastest +RSA-2048 PSS verify, RustCrypto + dalek on desktop: 35.62 µs, 3.88× the fastest +RSA-2048 PSS verify, RustCrypto + dalek on nixos2: 70.02 µs, 4.88× the fastest +RSA-2048 PSS verify, RustCrypto + dalek on kixtop: 39.26 µs, 4.51× the fastest +RSA-2048 PSS verify, RustCrypto + dalek on ovh-iad: 117.27 µs, 3.35× the fastest +RSA-2048 PSS verify, RustCrypto + dalek on ovh-sea: 106.80 µs, 3.34× the fastest +RSA-2048 PSS verify, graviola on nixos: 19.63 µs, 1.55× the fastest +RSA-2048 PSS verify, graviola on desktop: 14.44 µs, 1.57× the fastest +RSA-2048 PSS verify, graviola on nixos2: 21.85 µs, 1.52× the fastest +RSA-2048 PSS verify, graviola on kixtop: 18.79 µs, 2.16× the fastest +RSA-2048 PSS verify, libcrux on nixos: 312.23 µs, 24.64× the fastest; verified: HACL*'s F* proof of Hacl.RSAPSS's rsapss_skey_sign and rsapss_pkey_verify, signing without the CRT, compiled to Rust by an unverified step +✓ +RSA-2048 PSS verify, libcrux on desktop: 252.13 µs, 27.46× the fastest; verified: HACL*'s F* proof of Hacl.RSAPSS's rsapss_skey_sign and rsapss_pkey_verify, signing without the CRT, compiled to Rust by an unverified step +✓ +RSA-2048 PSS verify, libcrux on nixos2: 377.87 µs, 26.32× the fastest; verified: HACL*'s F* proof of Hacl.RSAPSS's rsapss_skey_sign and rsapss_pkey_verify, signing without the CRT, compiled to Rust by an unverified step +✓ +RSA-2048 PSS verify, libcrux on kixtop: 299.96 µs, 34.44× the fastest; verified: HACL*'s F* proof of Hacl.RSAPSS's rsapss_skey_sign and rsapss_pkey_verify, signing without the CRT, compiled to Rust by an unverified step +✓ +RSA-2048 PSS verify, libcrux on ovh-iad: 636.67 µs, 18.16× the fastest; verified: HACL*'s F* proof of Hacl.RSAPSS's rsapss_skey_sign and rsapss_pkey_verify, signing without the CRT, compiled to Rust by an unverified step +✓ +RSA-2048 PSS verify, libcrux on ovh-sea: 583.13 µs, 18.23× the fastest; verified: HACL*'s F* proof of Hacl.RSAPSS's rsapss_skey_sign and rsapss_pkey_verify, signing without the CRT, compiled to Rust by an unverified step +✓ +RSA-2048 PSS verify, OpenSSL on nixos: 23.60 µs, 1.86× the fastest +RSA-2048 PSS verify, OpenSSL on desktop: 16.36 µs, 1.78× the fastest +RSA-2048 PSS verify, OpenSSL on nixos2: 27.16 µs, 1.89× the fastest +RSA-2048 PSS verify, OpenSSL on kixtop: 17.44 µs, 2.00× the fastest +RSA-2048 PSS verify, OpenSSL on ovh-iad: 55.18 µs, 1.57× the fastest +RSA-2048 PSS verify, OpenSSL on ovh-sea: 50.44 µs, 1.58× the fastest ML-KEM - + ML-KEM-768 key generation ML-KEM-768 key generation, rind on nixos: 8.43 µs, 1.00× the fastest ML-KEM-768 key generation, rind on desktop: 6.45 µs, 1.00× the fastest ML-KEM-768 key generation, rind on nixos2: 10.24 µs, 1.00× the fastest -ML-KEM-768 key generation, rind on ovh-iad: 18.79 µs, 1.00× the fastest -ML-KEM-768 key generation, rind on ovh-sea: 17.44 µs, 1.00× the fastest -ML-KEM-768 key generation, aws-lc-rs on nixos: 9.41 µs, 1.12× the fastest -ML-KEM-768 key generation, aws-lc-rs on desktop: 8.27 µs, 1.28× the fastest -ML-KEM-768 key generation, aws-lc-rs on nixos2: 18.44 µs, 1.80× the fastest -ML-KEM-768 key generation, aws-lc-rs on ovh-iad: 25.06 µs, 1.33× the fastest -ML-KEM-768 key generation, aws-lc-rs on ovh-sea: 23.21 µs, 1.33× the fastest -ML-KEM-768 key generation, RustCrypto + dalek on nixos: 60.18 µs, 7.14× the fastest -ML-KEM-768 key generation, RustCrypto + dalek on desktop: 40.26 µs, 6.24× the fastest -ML-KEM-768 key generation, RustCrypto + dalek on nixos2: 59.97 µs, 5.86× the fastest -ML-KEM-768 key generation, RustCrypto + dalek on ovh-iad: 100.59 µs, 5.35× the fastest -ML-KEM-768 key generation, RustCrypto + dalek on ovh-sea: 92.84 µs, 5.32× the fastest -ML-KEM-768 key generation, graviola on nixos: 9.28 µs, 1.10× the fastest -ML-KEM-768 key generation, graviola on desktop: 7.67 µs, 1.19× the fastest -ML-KEM-768 key generation, graviola on nixos2: 10.41 µs, 1.02× the fastest -ML-KEM-768 key generation, libcrux on nixos: 18.15 µs, 2.15× the fastest -ML-KEM-768 key generation, libcrux on desktop: 15.15 µs, 2.35× the fastest -ML-KEM-768 key generation, libcrux on nixos2: 20.05 µs, 1.96× the fastest -ML-KEM-768 key generation, libcrux on ovh-iad: 36.95 µs, 1.97× the fastest -ML-KEM-768 key generation, libcrux on ovh-sea: 34.54 µs, 1.98× the fastest -ML-KEM-768 key generation, OpenSSL on nixos: 26.82 µs, 3.18× the fastest -ML-KEM-768 key generation, OpenSSL on desktop: 19.80 µs, 3.07× the fastest -ML-KEM-768 key generation, OpenSSL on nixos2: 40.63 µs, 3.97× the fastest -ML-KEM-768 key generation, OpenSSL on ovh-iad: 69.54 µs, 3.70× the fastest -ML-KEM-768 key generation, OpenSSL on ovh-sea: 62.78 µs, 3.60× the fastest +ML-KEM-768 key generation, rind on kixtop: 6.20 µs, 1.00× the fastest +ML-KEM-768 key generation, rind on ovh-iad: 18.79 µs, 1.00× the fastest +ML-KEM-768 key generation, rind on ovh-sea: 17.44 µs, 1.00× the fastest +ML-KEM-768 key generation, aws-lc-rs on nixos: 9.41 µs, 1.12× the fastest +ML-KEM-768 key generation, aws-lc-rs on desktop: 8.27 µs, 1.28× the fastest +ML-KEM-768 key generation, aws-lc-rs on nixos2: 18.44 µs, 1.80× the fastest +ML-KEM-768 key generation, aws-lc-rs on kixtop: 7.46 µs, 1.20× the fastest +ML-KEM-768 key generation, aws-lc-rs on ovh-iad: 25.06 µs, 1.33× the fastest +ML-KEM-768 key generation, aws-lc-rs on ovh-sea: 23.21 µs, 1.33× the fastest +ML-KEM-768 key generation, RustCrypto + dalek on nixos: 60.18 µs, 7.14× the fastest +ML-KEM-768 key generation, RustCrypto + dalek on desktop: 40.26 µs, 6.24× the fastest +ML-KEM-768 key generation, RustCrypto + dalek on nixos2: 59.97 µs, 5.86× the fastest +ML-KEM-768 key generation, RustCrypto + dalek on kixtop: 26.57 µs, 4.29× the fastest +ML-KEM-768 key generation, RustCrypto + dalek on ovh-iad: 100.59 µs, 5.35× the fastest +ML-KEM-768 key generation, RustCrypto + dalek on ovh-sea: 92.84 µs, 5.32× the fastest +ML-KEM-768 key generation, graviola on nixos: 9.28 µs, 1.10× the fastest +ML-KEM-768 key generation, graviola on desktop: 7.67 µs, 1.19× the fastest +ML-KEM-768 key generation, graviola on nixos2: 10.41 µs, 1.02× the fastest +ML-KEM-768 key generation, graviola on kixtop: 6.22 µs, 1.00× the fastest +ML-KEM-768 key generation, libcrux on nixos: 18.15 µs, 2.15× the fastest +ML-KEM-768 key generation, libcrux on desktop: 15.15 µs, 2.35× the fastest +ML-KEM-768 key generation, libcrux on nixos2: 20.05 µs, 1.96× the fastest +ML-KEM-768 key generation, libcrux on kixtop: 12.01 µs, 1.94× the fastest +ML-KEM-768 key generation, libcrux on ovh-iad: 36.95 µs, 1.97× the fastest +ML-KEM-768 key generation, libcrux on ovh-sea: 34.54 µs, 1.98× the fastest +ML-KEM-768 key generation, OpenSSL on nixos: 26.82 µs, 3.18× the fastest +ML-KEM-768 key generation, OpenSSL on desktop: 19.80 µs, 3.07× the fastest +ML-KEM-768 key generation, OpenSSL on nixos2: 40.63 µs, 3.97× the fastest +ML-KEM-768 key generation, OpenSSL on kixtop: 25.06 µs, 4.04× the fastest +ML-KEM-768 key generation, OpenSSL on ovh-iad: 69.54 µs, 3.70× the fastest +ML-KEM-768 key generation, OpenSSL on ovh-sea: 62.78 µs, 3.60× the fastest ML-KEM-768 encapsulate ML-KEM-768 encapsulate, rind on nixos: 8.53 µs, 1.00× the fastest ML-KEM-768 encapsulate, rind on desktop: 6.65 µs, 1.00× the fastest ML-KEM-768 encapsulate, rind on nixos2: 10.61 µs, 1.00× the fastest -ML-KEM-768 encapsulate, rind on ovh-iad: 18.94 µs, 1.00× the fastest -ML-KEM-768 encapsulate, rind on ovh-sea: 18.36 µs, 1.00× the fastest -ML-KEM-768 encapsulate, aws-lc-rs on nixos: 10.41 µs, 1.22× the fastest -ML-KEM-768 encapsulate, aws-lc-rs on desktop: 8.68 µs, 1.31× the fastest -ML-KEM-768 encapsulate, aws-lc-rs on nixos2: 18.73 µs, 1.76× the fastest -ML-KEM-768 encapsulate, aws-lc-rs on ovh-iad: 25.08 µs, 1.32× the fastest -ML-KEM-768 encapsulate, aws-lc-rs on ovh-sea: 23.94 µs, 1.30× the fastest -ML-KEM-768 encapsulate, RustCrypto + dalek on nixos: 72.03 µs, 8.44× the fastest -ML-KEM-768 encapsulate, RustCrypto + dalek on desktop: 41.71 µs, 6.27× the fastest -ML-KEM-768 encapsulate, RustCrypto + dalek on nixos2: 67.03 µs, 6.31× the fastest -ML-KEM-768 encapsulate, RustCrypto + dalek on ovh-iad: 104.24 µs, 5.50× the fastest -ML-KEM-768 encapsulate, RustCrypto + dalek on ovh-sea: 101.88 µs, 5.55× the fastest -ML-KEM-768 encapsulate, graviola on nixos: 10.95 µs, 1.28× the fastest -ML-KEM-768 encapsulate, graviola on desktop: 9.11 µs, 1.37× the fastest -ML-KEM-768 encapsulate, graviola on nixos2: 11.12 µs, 1.05× the fastest -ML-KEM-768 encapsulate, libcrux on nixos: 16.03 µs, 1.88× the fastest -ML-KEM-768 encapsulate, libcrux on desktop: 12.94 µs, 1.94× the fastest -ML-KEM-768 encapsulate, libcrux on nixos2: 18.13 µs, 1.71× the fastest -ML-KEM-768 encapsulate, libcrux on ovh-iad: 32.18 µs, 1.70× the fastest -ML-KEM-768 encapsulate, libcrux on ovh-sea: 31.26 µs, 1.70× the fastest -ML-KEM-768 encapsulate, OpenSSL on nixos: 30.02 µs, 3.52× the fastest -ML-KEM-768 encapsulate, OpenSSL on desktop: 18.77 µs, 2.82× the fastest -ML-KEM-768 encapsulate, OpenSSL on nixos2: 41.18 µs, 3.88× the fastest -ML-KEM-768 encapsulate, OpenSSL on ovh-iad: 66.54 µs, 3.51× the fastest -ML-KEM-768 encapsulate, OpenSSL on ovh-sea: 63.41 µs, 3.45× the fastest +ML-KEM-768 encapsulate, rind on kixtop: 6.84 µs, 1.07× the fastest +ML-KEM-768 encapsulate, rind on ovh-iad: 18.94 µs, 1.00× the fastest +ML-KEM-768 encapsulate, rind on ovh-sea: 18.36 µs, 1.00× the fastest +ML-KEM-768 encapsulate, aws-lc-rs on nixos: 10.41 µs, 1.22× the fastest +ML-KEM-768 encapsulate, aws-lc-rs on desktop: 8.68 µs, 1.31× the fastest +ML-KEM-768 encapsulate, aws-lc-rs on nixos2: 18.73 µs, 1.76× the fastest +ML-KEM-768 encapsulate, aws-lc-rs on kixtop: 8.01 µs, 1.25× the fastest +ML-KEM-768 encapsulate, aws-lc-rs on ovh-iad: 25.08 µs, 1.32× the fastest +ML-KEM-768 encapsulate, aws-lc-rs on ovh-sea: 23.94 µs, 1.30× the fastest +ML-KEM-768 encapsulate, RustCrypto + dalek on nixos: 72.03 µs, 8.44× the fastest +ML-KEM-768 encapsulate, RustCrypto + dalek on desktop: 41.71 µs, 6.27× the fastest +ML-KEM-768 encapsulate, RustCrypto + dalek on nixos2: 67.03 µs, 6.31× the fastest +ML-KEM-768 encapsulate, RustCrypto + dalek on kixtop: 27.77 µs, 4.34× the fastest +ML-KEM-768 encapsulate, RustCrypto + dalek on ovh-iad: 104.24 µs, 5.50× the fastest +ML-KEM-768 encapsulate, RustCrypto + dalek on ovh-sea: 101.88 µs, 5.55× the fastest +ML-KEM-768 encapsulate, graviola on nixos: 10.95 µs, 1.28× the fastest +ML-KEM-768 encapsulate, graviola on desktop: 9.11 µs, 1.37× the fastest +ML-KEM-768 encapsulate, graviola on nixos2: 11.12 µs, 1.05× the fastest +ML-KEM-768 encapsulate, graviola on kixtop: 6.40 µs, 1.00× the fastest +ML-KEM-768 encapsulate, libcrux on nixos: 16.03 µs, 1.88× the fastest +ML-KEM-768 encapsulate, libcrux on desktop: 12.94 µs, 1.94× the fastest +ML-KEM-768 encapsulate, libcrux on nixos2: 18.13 µs, 1.71× the fastest +ML-KEM-768 encapsulate, libcrux on kixtop: 9.39 µs, 1.47× the fastest +ML-KEM-768 encapsulate, libcrux on ovh-iad: 32.18 µs, 1.70× the fastest +ML-KEM-768 encapsulate, libcrux on ovh-sea: 31.26 µs, 1.70× the fastest +ML-KEM-768 encapsulate, OpenSSL on nixos: 30.02 µs, 3.52× the fastest +ML-KEM-768 encapsulate, OpenSSL on desktop: 18.77 µs, 2.82× the fastest +ML-KEM-768 encapsulate, OpenSSL on nixos2: 41.18 µs, 3.88× the fastest +ML-KEM-768 encapsulate, OpenSSL on kixtop: 24.07 µs, 3.76× the fastest +ML-KEM-768 encapsulate, OpenSSL on ovh-iad: 66.54 µs, 3.51× the fastest +ML-KEM-768 encapsulate, OpenSSL on ovh-sea: 63.41 µs, 3.45× the fastest ML-KEM-768 decapsulate ML-KEM-768 decapsulate, rind on nixos: 6.07 µs, 1.00× the fastest ML-KEM-768 decapsulate, rind on desktop: 4.69 µs, 1.00× the fastest ML-KEM-768 decapsulate, rind on nixos2: 7.07 µs, 1.00× the fastest -ML-KEM-768 decapsulate, rind on ovh-iad: 12.89 µs, 1.00× the fastest -ML-KEM-768 decapsulate, rind on ovh-sea: 12.15 µs, 1.00× the fastest -ML-KEM-768 decapsulate, aws-lc-rs on nixos: 11.96 µs, 1.97× the fastest -ML-KEM-768 decapsulate, aws-lc-rs on desktop: 9.02 µs, 1.92× the fastest -ML-KEM-768 decapsulate, aws-lc-rs on nixos2: 16.01 µs, 2.26× the fastest -ML-KEM-768 decapsulate, aws-lc-rs on ovh-iad: 28.78 µs, 2.23× the fastest -ML-KEM-768 decapsulate, aws-lc-rs on ovh-sea: 27.57 µs, 2.27× the fastest -ML-KEM-768 decapsulate, RustCrypto + dalek on nixos: 95.17 µs, 15.68× the fastest -ML-KEM-768 decapsulate, RustCrypto + dalek on desktop: 54.19 µs, 11.55× the fastest -ML-KEM-768 decapsulate, RustCrypto + dalek on nixos2: 84.37 µs, 11.93× the fastest -ML-KEM-768 decapsulate, RustCrypto + dalek on ovh-iad: 148.48 µs, 11.52× the fastest -ML-KEM-768 decapsulate, RustCrypto + dalek on ovh-sea: 130.57 µs, 10.75× the fastest -ML-KEM-768 decapsulate, graviola on nixos: 7.72 µs, 1.27× the fastest -ML-KEM-768 decapsulate, graviola on desktop: 6.59 µs, 1.41× the fastest -ML-KEM-768 decapsulate, graviola on nixos2: 7.42 µs, 1.05× the fastest -ML-KEM-768 decapsulate, libcrux on nixos: 16.22 µs, 2.67× the fastest -ML-KEM-768 decapsulate, libcrux on desktop: 13.44 µs, 2.87× the fastest -ML-KEM-768 decapsulate, libcrux on nixos2: 19.04 µs, 2.69× the fastest -ML-KEM-768 decapsulate, libcrux on ovh-iad: 35.04 µs, 2.72× the fastest -ML-KEM-768 decapsulate, libcrux on ovh-sea: 33.12 µs, 2.73× the fastest -ML-KEM-768 decapsulate, OpenSSL on nixos: 24.64 µs, 4.06× the fastest -ML-KEM-768 decapsulate, OpenSSL on desktop: 16.05 µs, 3.42× the fastest -ML-KEM-768 decapsulate, OpenSSL on nixos2: 31.67 µs, 4.48× the fastest -ML-KEM-768 decapsulate, OpenSSL on ovh-iad: 49.78 µs, 3.86× the fastest -ML-KEM-768 decapsulate, OpenSSL on ovh-sea: 48.94 µs, 4.03× the fastest +ML-KEM-768 decapsulate, rind on kixtop: 4.17 µs, 1.03× the fastest +ML-KEM-768 decapsulate, rind on ovh-iad: 12.89 µs, 1.00× the fastest +ML-KEM-768 decapsulate, rind on ovh-sea: 12.15 µs, 1.00× the fastest +ML-KEM-768 decapsulate, aws-lc-rs on nixos: 11.96 µs, 1.97× the fastest +ML-KEM-768 decapsulate, aws-lc-rs on desktop: 9.02 µs, 1.92× the fastest +ML-KEM-768 decapsulate, aws-lc-rs on nixos2: 16.01 µs, 2.26× the fastest +ML-KEM-768 decapsulate, aws-lc-rs on kixtop: 7.75 µs, 1.91× the fastest +ML-KEM-768 decapsulate, aws-lc-rs on ovh-iad: 28.78 µs, 2.23× the fastest +ML-KEM-768 decapsulate, aws-lc-rs on ovh-sea: 27.57 µs, 2.27× the fastest +ML-KEM-768 decapsulate, RustCrypto + dalek on nixos: 95.17 µs, 15.68× the fastest +ML-KEM-768 decapsulate, RustCrypto + dalek on desktop: 54.19 µs, 11.55× the fastest +ML-KEM-768 decapsulate, RustCrypto + dalek on nixos2: 84.37 µs, 11.93× the fastest +ML-KEM-768 decapsulate, RustCrypto + dalek on kixtop: 34.06 µs, 8.41× the fastest +ML-KEM-768 decapsulate, RustCrypto + dalek on ovh-iad: 148.48 µs, 11.52× the fastest +ML-KEM-768 decapsulate, RustCrypto + dalek on ovh-sea: 130.57 µs, 10.75× the fastest +ML-KEM-768 decapsulate, graviola on nixos: 7.72 µs, 1.27× the fastest +ML-KEM-768 decapsulate, graviola on desktop: 6.59 µs, 1.41× the fastest +ML-KEM-768 decapsulate, graviola on nixos2: 7.42 µs, 1.05× the fastest +ML-KEM-768 decapsulate, graviola on kixtop: 4.05 µs, 1.00× the fastest +ML-KEM-768 decapsulate, libcrux on nixos: 16.22 µs, 2.67× the fastest +ML-KEM-768 decapsulate, libcrux on desktop: 13.44 µs, 2.87× the fastest +ML-KEM-768 decapsulate, libcrux on nixos2: 19.04 µs, 2.69× the fastest +ML-KEM-768 decapsulate, libcrux on kixtop: 9.58 µs, 2.36× the fastest +ML-KEM-768 decapsulate, libcrux on ovh-iad: 35.04 µs, 2.72× the fastest +ML-KEM-768 decapsulate, libcrux on ovh-sea: 33.12 µs, 2.73× the fastest +ML-KEM-768 decapsulate, OpenSSL on nixos: 24.64 µs, 4.06× the fastest +ML-KEM-768 decapsulate, OpenSSL on desktop: 16.05 µs, 3.42× the fastest +ML-KEM-768 decapsulate, OpenSSL on nixos2: 31.67 µs, 4.48× the fastest +ML-KEM-768 decapsulate, OpenSSL on kixtop: 24.43 µs, 6.03× the fastest +ML-KEM-768 decapsulate, OpenSSL on ovh-iad: 49.78 µs, 3.86× the fastest +ML-KEM-768 decapsulate, OpenSSL on ovh-sea: 48.94 µs, 4.03× the fastest P-384 and P-521 - + P-384 ECDH P-384 ECDH, rind on nixos: 179.71 µs, 1.00× the fastest P-384 ECDH, rind on desktop: 100.08 µs, 1.00× the fastest P-384 ECDH, rind on nixos2: 150.97 µs, 1.00× the fastest -P-384 ECDH, rind on ovh-iad: 295.16 µs, 1.00× the fastest -P-384 ECDH, rind on ovh-sea: 264.09 µs, 1.00× the fastest -P-384 ECDH, aws-lc-rs on nixos: 180.49 µs, 1.00× the fastest -P-384 ECDH, aws-lc-rs on desktop: 111.11 µs, 1.11× the fastest -P-384 ECDH, aws-lc-rs on nixos2: 174.62 µs, 1.16× the fastest -P-384 ECDH, aws-lc-rs on ovh-iad: 310.31 µs, 1.05× the fastest -P-384 ECDH, aws-lc-rs on ovh-sea: 291.94 µs, 1.11× the fastest -P-384 ECDH, ring on nixos: 601.49 µs, 3.35× the fastest -P-384 ECDH, ring on desktop: 369.71 µs, 3.69× the fastest -P-384 ECDH, ring on nixos2: 645.54 µs, 4.28× the fastest -P-384 ECDH, ring on ovh-iad: 1.02 ms, 3.45× the fastest -P-384 ECDH, ring on ovh-sea: 980.96 µs, 3.71× the fastest -P-384 ECDH, RustCrypto + dalek on nixos: 1.04 ms, 5.80× the fastest -P-384 ECDH, RustCrypto + dalek on desktop: 401.25 µs, 4.01× the fastest -P-384 ECDH, RustCrypto + dalek on nixos2: 769.61 µs, 5.10× the fastest -P-384 ECDH, RustCrypto + dalek on ovh-iad: 1.23 ms, 4.16× the fastest -P-384 ECDH, RustCrypto + dalek on ovh-sea: 1.20 ms, 4.56× the fastest -P-384 ECDH, graviola on nixos: 302.57 µs, 1.68× the fastest -P-384 ECDH, graviola on desktop: 170.94 µs, 1.71× the fastest -P-384 ECDH, graviola on nixos2: 245.24 µs, 1.62× the fastest -P-384 ECDH, OpenSSL on nixos: 656.67 µs, 3.65× the fastest -P-384 ECDH, OpenSSL on desktop: 264.84 µs, 2.65× the fastest -P-384 ECDH, OpenSSL on nixos2: 483.50 µs, 3.20× the fastest -P-384 ECDH, OpenSSL on ovh-iad: 860.17 µs, 2.91× the fastest -P-384 ECDH, OpenSSL on ovh-sea: 765.55 µs, 2.90× the fastest +P-384 ECDH, rind on kixtop: 91.49 µs, 1.00× the fastest +P-384 ECDH, rind on ovh-iad: 295.16 µs, 1.00× the fastest +P-384 ECDH, rind on ovh-sea: 264.09 µs, 1.00× the fastest +P-384 ECDH, aws-lc-rs on nixos: 180.49 µs, 1.00× the fastest +P-384 ECDH, aws-lc-rs on desktop: 111.11 µs, 1.11× the fastest +P-384 ECDH, aws-lc-rs on nixos2: 174.62 µs, 1.16× the fastest +P-384 ECDH, aws-lc-rs on kixtop: 105.75 µs, 1.16× the fastest +P-384 ECDH, aws-lc-rs on ovh-iad: 310.31 µs, 1.05× the fastest +P-384 ECDH, aws-lc-rs on ovh-sea: 291.94 µs, 1.11× the fastest +P-384 ECDH, ring on nixos: 601.49 µs, 3.35× the fastest +P-384 ECDH, ring on desktop: 369.71 µs, 3.69× the fastest +P-384 ECDH, ring on nixos2: 645.54 µs, 4.28× the fastest +P-384 ECDH, ring on kixtop: 412.48 µs, 4.51× the fastest +P-384 ECDH, ring on ovh-iad: 1.02 ms, 3.45× the fastest +P-384 ECDH, ring on ovh-sea: 980.96 µs, 3.71× the fastest +P-384 ECDH, RustCrypto + dalek on nixos: 1.04 ms, 5.80× the fastest +P-384 ECDH, RustCrypto + dalek on desktop: 401.25 µs, 4.01× the fastest +P-384 ECDH, RustCrypto + dalek on nixos2: 769.61 µs, 5.10× the fastest +P-384 ECDH, RustCrypto + dalek on kixtop: 494.20 µs, 5.40× the fastest +P-384 ECDH, RustCrypto + dalek on ovh-iad: 1.23 ms, 4.16× the fastest +P-384 ECDH, RustCrypto + dalek on ovh-sea: 1.20 ms, 4.56× the fastest +P-384 ECDH, graviola on nixos: 302.57 µs, 1.68× the fastest +P-384 ECDH, graviola on desktop: 170.94 µs, 1.71× the fastest +P-384 ECDH, graviola on nixos2: 245.24 µs, 1.62× the fastest +P-384 ECDH, graviola on kixtop: 153.84 µs, 1.68× the fastest +P-384 ECDH, OpenSSL on nixos: 656.67 µs, 3.65× the fastest +P-384 ECDH, OpenSSL on desktop: 264.84 µs, 2.65× the fastest +P-384 ECDH, OpenSSL on nixos2: 483.50 µs, 3.20× the fastest +P-384 ECDH, OpenSSL on kixtop: 279.51 µs, 3.06× the fastest +P-384 ECDH, OpenSSL on ovh-iad: 860.17 µs, 2.91× the fastest +P-384 ECDH, OpenSSL on ovh-sea: 765.55 µs, 2.90× the fastest P-384 ECDSA sign P-384 ECDSA sign, rind on nixos: 53.07 µs, 1.00× the fastest P-384 ECDSA sign, rind on desktop: 23.53 µs, 1.00× the fastest P-384 ECDSA sign, rind on nixos2: 39.62 µs, 1.00× the fastest -P-384 ECDSA sign, rind on ovh-iad: 71.60 µs, 1.00× the fastest -P-384 ECDSA sign, rind on ovh-sea: 67.08 µs, 1.00× the fastest -P-384 ECDSA sign, aws-lc-rs on nixos: 97.47 µs, 1.84× the fastest -P-384 ECDSA sign, aws-lc-rs on desktop: 46.52 µs, 1.98× the fastest -P-384 ECDSA sign, aws-lc-rs on nixos2: 82.65 µs, 2.09× the fastest -P-384 ECDSA sign, aws-lc-rs on ovh-iad: 127.99 µs, 1.79× the fastest -P-384 ECDSA sign, aws-lc-rs on ovh-sea: 126.33 µs, 1.88× the fastest -P-384 ECDSA sign, ring on nixos: 474.64 µs, 8.94× the fastest -P-384 ECDSA sign, ring on desktop: 200.86 µs, 8.54× the fastest -P-384 ECDSA sign, ring on nixos2: 343.16 µs, 8.66× the fastest -P-384 ECDSA sign, ring on ovh-iad: 549.99 µs, 7.68× the fastest -P-384 ECDSA sign, ring on ovh-sea: 534.87 µs, 7.97× the fastest -P-384 ECDSA sign, RustCrypto + dalek on nixos: 238.31 µs, 4.49× the fastest -P-384 ECDSA sign, RustCrypto + dalek on desktop: 86.86 µs, 3.69× the fastest -P-384 ECDSA sign, RustCrypto + dalek on nixos2: 170.64 µs, 4.31× the fastest -P-384 ECDSA sign, RustCrypto + dalek on ovh-iad: 268.38 µs, 3.75× the fastest -P-384 ECDSA sign, RustCrypto + dalek on ovh-sea: 262.54 µs, 3.91× the fastest -P-384 ECDSA sign, graviola on nixos: 185.15 µs, 3.49× the fastest -P-384 ECDSA sign, graviola on desktop: 90.69 µs, 3.85× the fastest -P-384 ECDSA sign, graviola on nixos2: 128.64 µs, 3.25× the fastest -P-384 ECDSA sign, OpenSSL on nixos: 235.52 µs, 4.44× the fastest -P-384 ECDSA sign, OpenSSL on desktop: 89.64 µs, 3.81× the fastest -P-384 ECDSA sign, OpenSSL on nixos2: 164.53 µs, 4.15× the fastest -P-384 ECDSA sign, OpenSSL on ovh-iad: 272.00 µs, 3.80× the fastest -P-384 ECDSA sign, OpenSSL on ovh-sea: 253.00 µs, 3.77× the fastest +P-384 ECDSA sign, rind on kixtop: 22.93 µs, 1.00× the fastest +P-384 ECDSA sign, rind on ovh-iad: 71.60 µs, 1.00× the fastest +P-384 ECDSA sign, rind on ovh-sea: 67.08 µs, 1.00× the fastest +P-384 ECDSA sign, aws-lc-rs on nixos: 97.47 µs, 1.84× the fastest +P-384 ECDSA sign, aws-lc-rs on desktop: 46.52 µs, 1.98× the fastest +P-384 ECDSA sign, aws-lc-rs on nixos2: 82.65 µs, 2.09× the fastest +P-384 ECDSA sign, aws-lc-rs on kixtop: 49.16 µs, 2.14× the fastest +P-384 ECDSA sign, aws-lc-rs on ovh-iad: 127.99 µs, 1.79× the fastest +P-384 ECDSA sign, aws-lc-rs on ovh-sea: 126.33 µs, 1.88× the fastest +P-384 ECDSA sign, ring on nixos: 474.64 µs, 8.94× the fastest +P-384 ECDSA sign, ring on desktop: 200.86 µs, 8.54× the fastest +P-384 ECDSA sign, ring on nixos2: 343.16 µs, 8.66× the fastest +P-384 ECDSA sign, ring on kixtop: 223.72 µs, 9.76× the fastest +P-384 ECDSA sign, ring on ovh-iad: 549.99 µs, 7.68× the fastest +P-384 ECDSA sign, ring on ovh-sea: 534.87 µs, 7.97× the fastest +P-384 ECDSA sign, RustCrypto + dalek on nixos: 238.31 µs, 4.49× the fastest +P-384 ECDSA sign, RustCrypto + dalek on desktop: 86.86 µs, 3.69× the fastest +P-384 ECDSA sign, RustCrypto + dalek on nixos2: 170.64 µs, 4.31× the fastest +P-384 ECDSA sign, RustCrypto + dalek on kixtop: 112.64 µs, 4.91× the fastest +P-384 ECDSA sign, RustCrypto + dalek on ovh-iad: 268.38 µs, 3.75× the fastest +P-384 ECDSA sign, RustCrypto + dalek on ovh-sea: 262.54 µs, 3.91× the fastest +P-384 ECDSA sign, graviola on nixos: 185.15 µs, 3.49× the fastest +P-384 ECDSA sign, graviola on desktop: 90.69 µs, 3.85× the fastest +P-384 ECDSA sign, graviola on nixos2: 128.64 µs, 3.25× the fastest +P-384 ECDSA sign, graviola on kixtop: 81.12 µs, 3.54× the fastest +P-384 ECDSA sign, OpenSSL on nixos: 235.52 µs, 4.44× the fastest +P-384 ECDSA sign, OpenSSL on desktop: 89.64 µs, 3.81× the fastest +P-384 ECDSA sign, OpenSSL on nixos2: 164.53 µs, 4.15× the fastest +P-384 ECDSA sign, OpenSSL on kixtop: 104.84 µs, 4.57× the fastest +P-384 ECDSA sign, OpenSSL on ovh-iad: 272.00 µs, 3.80× the fastest +P-384 ECDSA sign, OpenSSL on ovh-sea: 253.00 µs, 3.77× the fastest P-384 ECDSA verify P-384 ECDSA verify, rind on nixos: 157.33 µs, 1.00× the fastest P-384 ECDSA verify, rind on desktop: 98.87 µs, 1.00× the fastest P-384 ECDSA verify, rind on nixos2: 141.44 µs, 1.00× the fastest -P-384 ECDSA verify, rind on ovh-iad: 255.43 µs, 1.00× the fastest -P-384 ECDSA verify, rind on ovh-sea: 247.76 µs, 1.00× the fastest -P-384 ECDSA verify, aws-lc-rs on nixos: 199.21 µs, 1.27× the fastest -P-384 ECDSA verify, aws-lc-rs on desktop: 116.66 µs, 1.18× the fastest -P-384 ECDSA verify, aws-lc-rs on nixos2: 175.92 µs, 1.24× the fastest -P-384 ECDSA verify, aws-lc-rs on ovh-iad: 316.06 µs, 1.24× the fastest -P-384 ECDSA verify, aws-lc-rs on ovh-sea: 299.75 µs, 1.21× the fastest -P-384 ECDSA verify, ring on nixos: 727.10 µs, 4.62× the fastest -P-384 ECDSA verify, ring on desktop: 360.29 µs, 3.64× the fastest -P-384 ECDSA verify, ring on nixos2: 622.90 µs, 4.40× the fastest -P-384 ECDSA verify, ring on ovh-iad: 1.00 ms, 3.92× the fastest -P-384 ECDSA verify, ring on ovh-sea: 951.59 µs, 3.84× the fastest -P-384 ECDSA verify, RustCrypto + dalek on nixos: 872.06 µs, 5.54× the fastest -P-384 ECDSA verify, RustCrypto + dalek on desktop: 360.21 µs, 3.64× the fastest -P-384 ECDSA verify, RustCrypto + dalek on nixos2: 695.04 µs, 4.91× the fastest -P-384 ECDSA verify, RustCrypto + dalek on ovh-iad: 1.08 ms, 4.21× the fastest -P-384 ECDSA verify, RustCrypto + dalek on ovh-sea: 1.05 ms, 4.23× the fastest -P-384 ECDSA verify, graviola on nixos: 315.99 µs, 2.01× the fastest -P-384 ECDSA verify, graviola on desktop: 167.40 µs, 1.69× the fastest -P-384 ECDSA verify, graviola on nixos2: 239.41 µs, 1.69× the fastest -P-384 ECDSA verify, OpenSSL on nixos: 551.89 µs, 3.51× the fastest -P-384 ECDSA verify, OpenSSL on desktop: 215.86 µs, 2.18× the fastest -P-384 ECDSA verify, OpenSSL on nixos2: 399.63 µs, 2.83× the fastest -P-384 ECDSA verify, OpenSSL on ovh-iad: 652.34 µs, 2.55× the fastest -P-384 ECDSA verify, OpenSSL on ovh-sea: 612.24 µs, 2.47× the fastest +P-384 ECDSA verify, rind on kixtop: 88.12 µs, 1.00× the fastest +P-384 ECDSA verify, rind on ovh-iad: 255.43 µs, 1.00× the fastest +P-384 ECDSA verify, rind on ovh-sea: 247.76 µs, 1.00× the fastest +P-384 ECDSA verify, aws-lc-rs on nixos: 199.21 µs, 1.27× the fastest +P-384 ECDSA verify, aws-lc-rs on desktop: 116.66 µs, 1.18× the fastest +P-384 ECDSA verify, aws-lc-rs on nixos2: 175.92 µs, 1.24× the fastest +P-384 ECDSA verify, aws-lc-rs on kixtop: 111.27 µs, 1.26× the fastest +P-384 ECDSA verify, aws-lc-rs on ovh-iad: 316.06 µs, 1.24× the fastest +P-384 ECDSA verify, aws-lc-rs on ovh-sea: 299.75 µs, 1.21× the fastest +P-384 ECDSA verify, ring on nixos: 727.10 µs, 4.62× the fastest +P-384 ECDSA verify, ring on desktop: 360.29 µs, 3.64× the fastest +P-384 ECDSA verify, ring on nixos2: 622.90 µs, 4.40× the fastest +P-384 ECDSA verify, ring on kixtop: 396.57 µs, 4.50× the fastest +P-384 ECDSA verify, ring on ovh-iad: 1.00 ms, 3.92× the fastest +P-384 ECDSA verify, ring on ovh-sea: 951.59 µs, 3.84× the fastest +P-384 ECDSA verify, RustCrypto + dalek on nixos: 872.06 µs, 5.54× the fastest +P-384 ECDSA verify, RustCrypto + dalek on desktop: 360.21 µs, 3.64× the fastest +P-384 ECDSA verify, RustCrypto + dalek on nixos2: 695.04 µs, 4.91× the fastest +P-384 ECDSA verify, RustCrypto + dalek on kixtop: 426.43 µs, 4.84× the fastest +P-384 ECDSA verify, RustCrypto + dalek on ovh-iad: 1.08 ms, 4.21× the fastest +P-384 ECDSA verify, RustCrypto + dalek on ovh-sea: 1.05 ms, 4.23× the fastest +P-384 ECDSA verify, graviola on nixos: 315.99 µs, 2.01× the fastest +P-384 ECDSA verify, graviola on desktop: 167.40 µs, 1.69× the fastest +P-384 ECDSA verify, graviola on nixos2: 239.41 µs, 1.69× the fastest +P-384 ECDSA verify, graviola on kixtop: 151.78 µs, 1.72× the fastest +P-384 ECDSA verify, OpenSSL on nixos: 551.89 µs, 3.51× the fastest +P-384 ECDSA verify, OpenSSL on desktop: 215.86 µs, 2.18× the fastest +P-384 ECDSA verify, OpenSSL on nixos2: 399.63 µs, 2.83× the fastest +P-384 ECDSA verify, OpenSSL on kixtop: 238.33 µs, 2.70× the fastest +P-384 ECDSA verify, OpenSSL on ovh-iad: 652.34 µs, 2.55× the fastest +P-384 ECDSA verify, OpenSSL on ovh-sea: 612.24 µs, 2.47× the fastest P-521 ECDH P-521 ECDH, rind on nixos: 283.91 µs, 1.00× the fastest P-521 ECDH, rind on desktop: 160.77 µs, 1.00× the fastest P-521 ECDH, rind on nixos2: 233.76 µs, 1.00× the fastest -P-521 ECDH, rind on ovh-iad: 467.34 µs, 1.00× the fastest -P-521 ECDH, rind on ovh-sea: 442.81 µs, 1.00× the fastest -P-521 ECDH, aws-lc-rs on nixos: 288.17 µs, 1.01× the fastest -P-521 ECDH, aws-lc-rs on desktop: 170.98 µs, 1.06× the fastest -P-521 ECDH, aws-lc-rs on nixos2: 262.34 µs, 1.12× the fastest -P-521 ECDH, aws-lc-rs on ovh-iad: 510.81 µs, 1.09× the fastest -P-521 ECDH, aws-lc-rs on ovh-sea: 479.78 µs, 1.08× the fastest -P-521 ECDH, RustCrypto + dalek on nixos: 868.41 µs, 3.06× the fastest -P-521 ECDH, RustCrypto + dalek on desktop: 431.17 µs, 2.68× the fastest -P-521 ECDH, RustCrypto + dalek on nixos2: 841.50 µs, 3.60× the fastest -P-521 ECDH, RustCrypto + dalek on ovh-iad: 1.39 ms, 2.97× the fastest -P-521 ECDH, RustCrypto + dalek on ovh-sea: 1.19 ms, 2.68× the fastest -P-521 ECDH, OpenSSL on nixos: 505.62 µs, 1.78× the fastest -P-521 ECDH, OpenSSL on desktop: 276.21 µs, 1.72× the fastest -P-521 ECDH, OpenSSL on nixos2: 497.39 µs, 2.13× the fastest -P-521 ECDH, OpenSSL on ovh-iad: 750.80 µs, 1.61× the fastest -P-521 ECDH, OpenSSL on ovh-sea: 722.01 µs, 1.63× the fastest +P-521 ECDH, rind on kixtop: 130.92 µs, 1.00× the fastest +P-521 ECDH, rind on ovh-iad: 467.34 µs, 1.00× the fastest +P-521 ECDH, rind on ovh-sea: 442.81 µs, 1.00× the fastest +P-521 ECDH, aws-lc-rs on nixos: 288.17 µs, 1.01× the fastest +P-521 ECDH, aws-lc-rs on desktop: 170.98 µs, 1.06× the fastest +P-521 ECDH, aws-lc-rs on nixos2: 262.34 µs, 1.12× the fastest +P-521 ECDH, aws-lc-rs on kixtop: 143.20 µs, 1.09× the fastest +P-521 ECDH, aws-lc-rs on ovh-iad: 510.81 µs, 1.09× the fastest +P-521 ECDH, aws-lc-rs on ovh-sea: 479.78 µs, 1.08× the fastest +P-521 ECDH, RustCrypto + dalek on nixos: 868.41 µs, 3.06× the fastest +P-521 ECDH, RustCrypto + dalek on desktop: 431.17 µs, 2.68× the fastest +P-521 ECDH, RustCrypto + dalek on nixos2: 841.50 µs, 3.60× the fastest +P-521 ECDH, RustCrypto + dalek on kixtop: 397.10 µs, 3.03× the fastest +P-521 ECDH, RustCrypto + dalek on ovh-iad: 1.39 ms, 2.97× the fastest +P-521 ECDH, RustCrypto + dalek on ovh-sea: 1.19 ms, 2.68× the fastest +P-521 ECDH, OpenSSL on nixos: 505.62 µs, 1.78× the fastest +P-521 ECDH, OpenSSL on desktop: 276.21 µs, 1.72× the fastest +P-521 ECDH, OpenSSL on nixos2: 497.39 µs, 2.13× the fastest +P-521 ECDH, OpenSSL on kixtop: 247.22 µs, 1.89× the fastest +P-521 ECDH, OpenSSL on ovh-iad: 750.80 µs, 1.61× the fastest +P-521 ECDH, OpenSSL on ovh-sea: 722.01 µs, 1.63× the fastest P-521 ECDSA sign P-521 ECDSA sign, rind on nixos: 58.32 µs, 1.00× the fastest P-521 ECDSA sign, rind on desktop: 40.56 µs, 1.00× the fastest P-521 ECDSA sign, rind on nixos2: 64.26 µs, 1.00× the fastest -P-521 ECDSA sign, rind on ovh-iad: 132.36 µs, 1.00× the fastest -P-521 ECDSA sign, rind on ovh-sea: 116.50 µs, 1.00× the fastest -P-521 ECDSA sign, aws-lc-rs on nixos: 152.35 µs, 2.61× the fastest -P-521 ECDSA sign, aws-lc-rs on desktop: 89.64 µs, 2.21× the fastest -P-521 ECDSA sign, aws-lc-rs on nixos2: 158.67 µs, 2.47× the fastest -P-521 ECDSA sign, aws-lc-rs on ovh-iad: 279.63 µs, 2.11× the fastest -P-521 ECDSA sign, aws-lc-rs on ovh-sea: 256.02 µs, 2.20× the fastest -P-521 ECDSA sign, RustCrypto + dalek on nixos: 177.47 µs, 3.04× the fastest -P-521 ECDSA sign, RustCrypto + dalek on desktop: 95.29 µs, 2.35× the fastest -P-521 ECDSA sign, RustCrypto + dalek on nixos2: 185.93 µs, 2.89× the fastest -P-521 ECDSA sign, RustCrypto + dalek on ovh-iad: 302.65 µs, 2.29× the fastest -P-521 ECDSA sign, RustCrypto + dalek on ovh-sea: 287.24 µs, 2.47× the fastest -P-521 ECDSA sign, OpenSSL on nixos: 219.60 µs, 3.77× the fastest -P-521 ECDSA sign, OpenSSL on desktop: 129.20 µs, 3.19× the fastest -P-521 ECDSA sign, OpenSSL on nixos2: 221.00 µs, 3.44× the fastest -P-521 ECDSA sign, OpenSSL on ovh-iad: 359.52 µs, 2.72× the fastest -P-521 ECDSA sign, OpenSSL on ovh-sea: 344.79 µs, 2.96× the fastest +P-521 ECDSA sign, rind on kixtop: 36.32 µs, 1.00× the fastest +P-521 ECDSA sign, rind on ovh-iad: 132.36 µs, 1.00× the fastest +P-521 ECDSA sign, rind on ovh-sea: 116.50 µs, 1.00× the fastest +P-521 ECDSA sign, aws-lc-rs on nixos: 152.35 µs, 2.61× the fastest +P-521 ECDSA sign, aws-lc-rs on desktop: 89.64 µs, 2.21× the fastest +P-521 ECDSA sign, aws-lc-rs on nixos2: 158.67 µs, 2.47× the fastest +P-521 ECDSA sign, aws-lc-rs on kixtop: 84.33 µs, 2.32× the fastest +P-521 ECDSA sign, aws-lc-rs on ovh-iad: 279.63 µs, 2.11× the fastest +P-521 ECDSA sign, aws-lc-rs on ovh-sea: 256.02 µs, 2.20× the fastest +P-521 ECDSA sign, RustCrypto + dalek on nixos: 177.47 µs, 3.04× the fastest +P-521 ECDSA sign, RustCrypto + dalek on desktop: 95.29 µs, 2.35× the fastest +P-521 ECDSA sign, RustCrypto + dalek on nixos2: 185.93 µs, 2.89× the fastest +P-521 ECDSA sign, RustCrypto + dalek on kixtop: 79.73 µs, 2.20× the fastest +P-521 ECDSA sign, RustCrypto + dalek on ovh-iad: 302.65 µs, 2.29× the fastest +P-521 ECDSA sign, RustCrypto + dalek on ovh-sea: 287.24 µs, 2.47× the fastest +P-521 ECDSA sign, OpenSSL on nixos: 219.60 µs, 3.77× the fastest +P-521 ECDSA sign, OpenSSL on desktop: 129.20 µs, 3.19× the fastest +P-521 ECDSA sign, OpenSSL on nixos2: 221.00 µs, 3.44× the fastest +P-521 ECDSA sign, OpenSSL on kixtop: 132.13 µs, 3.64× the fastest +P-521 ECDSA sign, OpenSSL on ovh-iad: 359.52 µs, 2.72× the fastest +P-521 ECDSA sign, OpenSSL on ovh-sea: 344.79 µs, 2.96× the fastest P-521 ECDSA verify P-521 ECDSA verify, rind on nixos: 222.28 µs, 1.00× the fastest P-521 ECDSA verify, rind on desktop: 147.09 µs, 1.00× the fastest P-521 ECDSA verify, rind on nixos2: 214.43 µs, 1.00× the fastest -P-521 ECDSA verify, rind on ovh-iad: 423.15 µs, 1.00× the fastest -P-521 ECDSA verify, rind on ovh-sea: 402.02 µs, 1.00× the fastest -P-521 ECDSA verify, aws-lc-rs on nixos: 327.35 µs, 1.47× the fastest -P-521 ECDSA verify, aws-lc-rs on desktop: 186.61 µs, 1.27× the fastest -P-521 ECDSA verify, aws-lc-rs on nixos2: 303.23 µs, 1.41× the fastest -P-521 ECDSA verify, aws-lc-rs on ovh-iad: 547.94 µs, 1.29× the fastest -P-521 ECDSA verify, aws-lc-rs on ovh-sea: 519.35 µs, 1.29× the fastest -P-521 ECDSA verify, RustCrypto + dalek on nixos: 610.17 µs, 2.75× the fastest -P-521 ECDSA verify, RustCrypto + dalek on desktop: 359.57 µs, 2.44× the fastest -P-521 ECDSA verify, RustCrypto + dalek on nixos2: 636.37 µs, 2.97× the fastest -P-521 ECDSA verify, RustCrypto + dalek on ovh-iad: 1.01 ms, 2.38× the fastest -P-521 ECDSA verify, RustCrypto + dalek on ovh-sea: 975.40 µs, 2.43× the fastest -P-521 ECDSA verify, OpenSSL on nixos: 473.66 µs, 2.13× the fastest -P-521 ECDSA verify, OpenSSL on desktop: 267.51 µs, 1.82× the fastest -P-521 ECDSA verify, OpenSSL on nixos2: 460.02 µs, 2.15× the fastest -P-521 ECDSA verify, OpenSSL on ovh-iad: 740.33 µs, 1.75× the fastest -P-521 ECDSA verify, OpenSSL on ovh-sea: 699.48 µs, 1.74× the fastest +P-521 ECDSA verify, rind on kixtop: 121.06 µs, 1.00× the fastest +P-521 ECDSA verify, rind on ovh-iad: 423.15 µs, 1.00× the fastest +P-521 ECDSA verify, rind on ovh-sea: 402.02 µs, 1.00× the fastest +P-521 ECDSA verify, aws-lc-rs on nixos: 327.35 µs, 1.47× the fastest +P-521 ECDSA verify, aws-lc-rs on desktop: 186.61 µs, 1.27× the fastest +P-521 ECDSA verify, aws-lc-rs on nixos2: 303.23 µs, 1.41× the fastest +P-521 ECDSA verify, aws-lc-rs on kixtop: 167.21 µs, 1.38× the fastest +P-521 ECDSA verify, aws-lc-rs on ovh-iad: 547.94 µs, 1.29× the fastest +P-521 ECDSA verify, aws-lc-rs on ovh-sea: 519.35 µs, 1.29× the fastest +P-521 ECDSA verify, RustCrypto + dalek on nixos: 610.17 µs, 2.75× the fastest +P-521 ECDSA verify, RustCrypto + dalek on desktop: 359.57 µs, 2.44× the fastest +P-521 ECDSA verify, RustCrypto + dalek on nixos2: 636.37 µs, 2.97× the fastest +P-521 ECDSA verify, RustCrypto + dalek on kixtop: 253.06 µs, 2.09× the fastest +P-521 ECDSA verify, RustCrypto + dalek on ovh-iad: 1.01 ms, 2.38× the fastest +P-521 ECDSA verify, RustCrypto + dalek on ovh-sea: 975.40 µs, 2.43× the fastest +P-521 ECDSA verify, OpenSSL on nixos: 473.66 µs, 2.13× the fastest +P-521 ECDSA verify, OpenSSL on desktop: 267.51 µs, 1.82× the fastest +P-521 ECDSA verify, OpenSSL on nixos2: 460.02 µs, 2.15× the fastest +P-521 ECDSA verify, OpenSSL on kixtop: 254.80 µs, 2.10× the fastest +P-521 ECDSA verify, OpenSSL on ovh-iad: 740.33 µs, 1.75× the fastest +P-521 ECDSA verify, OpenSSL on ovh-sea: 699.48 µs, 1.74× the fastest diff --git a/quest/m1/README.md b/quest/m1/README.md index f10b106b0..53800c614 100644 --- a/quest/m1/README.md +++ b/quest/m1/README.md @@ -11,5 +11,5 @@ Bun's fastest asymmetric operations run on rind, ahead of Bun writing its own. - [Bun runs its fastest asymmetric crypto on rind](/quest/m1/bun.md) - Ed25519, X25519, P-384, and P-521 in Bun on rind, before Bun writes its own - [The launch post can say what building rind cost in AI tokens, time, and money](/quest/m1/ai-usage.md) - tokens, agent and maintainer hours, and API-price cost, before the post - [rind's launch blog post is published](/quest/m1/launch-post.md) - the Bun PR waits on it -- [The bench report measures Apple M4 and a quiet Arrow Lake](/quest/m1/bench-apple-m4.md) - real Apple silicon in the report before the launch post +- [The bench report has a quiet Arrow Lake run and kixtop's build cost](/quest/m1/bench-apple-m4.md) - a fresh desktop column and M4 build costs before the launch post - [rind covers MoQ](/quest/m1/moq/README.md) - the primitives, CPU check, armv7 backend, and `rind-*` adapters MoQ needs, verified and released diff --git a/quest/m1/bench-apple-m4.md b/quest/m1/bench-apple-m4.md index 1df856b48..74845faa1 100644 --- a/quest/m1/bench-apple-m4.md +++ b/quest/m1/bench-apple-m4.md @@ -1,15 +1,17 @@ -# [S] The bench report measures Apple M4 and a quiet Arrow Lake +# [XS] The bench report has a quiet Arrow Lake run and kixtop's build cost ## Goal -`BENCHMARKS.md` has a `kixtop` (Apple M4, macOS) column, collected natively, and a fresh, quiet `desktop` (Arrow Lake) run, before the launch post. Every gap either opens a speed quest or gets a recorded reason in `benchmarks/gaps.toml`. +`BENCHMARKS.md`'s `desktop` (Arrow Lake) column comes from a fresh run that `admin/bench-report` doesn't flag as noisy, and `kixtop` (Apple M4) has a build-cost table, before the launch post. Every gap either opens a speed quest or gets a recorded reason in `benchmarks/gaps.toml`. ## Plan -Decided with the maintainer on 2026-11-07: plan in m1 the optimizations only the maintainer's hardware can measure. GitHub's runners cover Zen 3/4/5, Intel server cores, Neoverse N2, and a virtual M1, but not real Apple silicon or Arrow Lake. The maintainer opened `desktop`, `nixos`, and `kixtop` to agents. This moves "add `kixtop`" out of the [end-of-m2 refresh](/quest/m3/bench-report-refresh.md), whose other settled choices (libraries, hosts, the ✓ rule, the triage rule) apply here unchanged. +What remains of adding `kixtop` to the report, which [moq-dev/rind#435](https://github.com/moq-dev/rind/pull/435) did. The [end-of-m2 refresh](/quest/m3/bench-report-refresh.md)'s settled choices (libraries, hosts, the ✓ rule, the triage rule) apply here unchanged. -- `kixtop` is the maintainer's own MacBook (Apple M4, FEAT_DIT, SHA3, SHA512), so expect background load. Hold it with `quest gate --host kixtop` as `admin/bench-report` does, prefer a quiet window, and rerun noisy rows rather than recording noise. -- First macOS collection: fix what `admin/bench-report`'s macOS path (#399) hits there (rustup, Homebrew OpenSSL, `top`, `admin/build-cost`), and accept its ssh host key first. -- Re-collect `desktop` quietly. The `rustls-bulk/aes128-gcm` and `xchacha20poly1305/1350B` gaps there are recorded as noise awaiting a recheck, so drop or triage them. -- Recheck `benchmarks/verified.toml` against `kixtop`'s CPU features: a ✓ that lands on no square, or a dispatch the table didn't foresee, is a bug in the table. -- A gap becomes a speed quest when the operation is common or the gap is large, and otherwise gets a recorded reason. Plan new quests with `/quest-plan` as follow-ups in the PR. +- Re-collect `desktop` with `admin/bench-report collect --host desktop`. The `rustls-bulk/aes128-gcm` and `xchacha20poly1305/1350B` gaps there are recorded as noise awaiting a recheck, so drop or triage them. +- Re-collect `kixtop` too if its run gets a build cost, since `collect` measures both together; rerun noisy rows rather than recording noise. +- On 2026-11-07, `collect` refused `desktop` three times: 16.8, 4.7, and 5.3 of its 24 CPUs were busy, against a limit of 2.4, from other sessions' builds outside any gate. One attempt waited an hour for its host hold: the `quest` those sessions run predates [moq-dev/quest#526](https://github.com/moq-dev/quest/pull/526), so their gated commands were admitted past it. `kixtop` measured quietly on the second of two runs, but both runs' build costs were refused, at 11.6 and 6.6 of its 10 CPUs busy. + +## Waiting + +- Maintainer: a quiet window on `desktop`, and on `kixtop` for its build cost: pause the sessions building there, and update the `quest` they run to [moq-dev/quest@99eb7f25](https://github.com/moq-dev/quest/commit/99eb7f256e7395b293f5f3246b01dd0ade760b8f) or later, so their gates honor `admin/bench-report`'s host hold. An agent can't pause the maintainer's own sessions or change their tools. Check: `quest gate --help` on each host lists `--host`, and the hosts are quiet when the maintainer says so. diff --git a/quest/m3/bench-report-refresh.md b/quest/m3/bench-report-refresh.md index 28fc87ce1..e90d6299f 100644 --- a/quest/m3/bench-report-refresh.md +++ b/quest/m3/bench-report-refresh.md @@ -13,7 +13,7 @@ Decided with the maintainer on 2026-11-03: rerun the report at the end of each m - Settled with the maintainer when the report was planned (2026-11-03), so don't reopen them: the hosts `nixos`, `desktop`, `nixos2`, and `kixtop`, each on its native path; the libraries rind, aws-lc-rs, ring, RustCrypto with dalek, graviola, libcrux, and OpenSSL; a ✓ only where a published proof covers the whole computation that library runs on that host, padding included. A gap becomes a [speed](/quest/m2/speed/README.md) quest when the operation is common or the gap is large, and otherwise gets a recorded reason; verified code within about 10% stays. - Recheck the README's opening against the new results: its claims, such as which operations trail aws-lc-rs and ring, must still hold. - The first report's `nixos2` gaps in Ed25519 verify (1.13 against RustCrypto) and ML-KEM-768 encapsulation (1.23 against graviola) come from its older run. Recheck them with a fresh `nixos2` run, and plan a speed quest for either that still holds. -- `kixtop` (Apple M4) joins the report before this run, in [its own m1 quest](/quest/m1/bench-apple-m4.md) (maintainer, 2026-11-07); this run measures it like the other hosts. +- `kixtop` (Apple M4) joined the report in [moq-dev/rind#435](https://github.com/moq-dev/rind/pull/435) (maintainer, 2026-11-07); this run measures it like the other hosts. ## Required From b44c0c620ac069aa5cff7c2344d626816b387e9b Mon Sep 17 00:00:00 2001 From: Luke Curley Date: Fri, 6 Nov 2026 20:21:03 -0800 Subject: [PATCH 3/4] fix(bench): name the merged DIT guard, rind::cpu::Dit::hold Co-Authored-By: Claude Opus 5.5 --- BENCHMARKS.md | 2 +- benchmarks/gaps.toml | 2 +- 2 files changed, 2 insertions(+), 2 deletions(-) diff --git a/BENCHMARKS.md b/BENCHMARKS.md index 7d54e6971..224ab9504 100644 --- a/BENCHMARKS.md +++ b/BENCHMARKS.md @@ -794,7 +794,7 @@ Each operation where another library is more than 10% faster than rind, on a hos | Ed25519 sign | `ovh-iad` | 1.13× (aws-lc-rs) | Noise from the VPS's other tenants: `ovh-sea`, the same virtual CPU, measured 0.92× aws-lc-rs's time, and no dedicated host shows it. The next refresh rechecks it. | | `p256-ecdsa-verify/*` | no ADX tier | 1.14× (aws-lc-rs) | CPUs older than Broadwell and Zen lack ADX, and so do virtual CPUs that hide it, as `ovh-iad`'s and `ovh-sea`'s do. There rind runs s2n-bignum's verified `_alt` routines, which trail by more than 10% only on the nightly runners: on the VPSes P-256 verification measured 1.05× aws-lc-rs's time. | | `chacha20poly1305/*/16KB`, `xchacha20poly1305/*/16KB` | no AES-NI tier | 1.17× (aws-lc-rs) | Without SSE4.1 rind runs Graviola's scalar Poly1305 rather than port BoringSSL's SSE2 `poly1305_vec.c` for CPUs older than Westmere, as ALGORITHMS.md records. | -| AES-128-GCM seal, 32 B, AES-128-GCM seal, 1350 B, AES-128-GCM open, 32 B, AES-128-GCM open, 1350 B, AES-256-GCM seal, 32 B, AES-256-GCM seal, 1350 B, AES-256-GCM open, 32 B, ChaCha20-Poly1305 seal, 32 B, AES-128 header protection, AES-256 header protection, ChaCha20 header protection, SHA-256, 64 B, SHA-256, 1350 B, SHA-512, 64 B, SHA-512, 1350 B, HMAC-SHA256, 64 B, HMAC-SHA256, 1350 B, HKDF-SHA256 extract and expand, HKDF-SHA256 expand | `kixtop` | 1.11× to 12.62× (RustCrypto + dalek, aws-lc-rs, graviola, ring) | DIT: the M4 has it, and rind turns it on and off around every call that handles a secret, which costs about 35 to 55 ns a call there; the other libraries never set it. Keeping it per call was decided with the maintainer from [#387](https://github.com/moq-dev/rind/pull/387)'s findings, and [#431](https://github.com/moq-dev/rind/pull/431)'s `rind::cpu::hold_dit()` pays it once across a batch of calls. With DIT denied (`--cfg rind_cpu_disable` and `RIND_CPU_DISABLE_dit`), the same commit measured each of these within 10% of the fastest library but AES header protection (1.2× aws-lc-rs's 2.9 ns) and HMAC-SHA-256 at 64 B (1.15× RustCrypto's 101 ns). | +| AES-128-GCM seal, 32 B, AES-128-GCM seal, 1350 B, AES-128-GCM open, 32 B, AES-128-GCM open, 1350 B, AES-256-GCM seal, 32 B, AES-256-GCM seal, 1350 B, AES-256-GCM open, 32 B, ChaCha20-Poly1305 seal, 32 B, AES-128 header protection, AES-256 header protection, ChaCha20 header protection, SHA-256, 64 B, SHA-256, 1350 B, SHA-512, 64 B, SHA-512, 1350 B, HMAC-SHA256, 64 B, HMAC-SHA256, 1350 B, HKDF-SHA256 extract and expand, HKDF-SHA256 expand | `kixtop` | 1.11× to 12.62× (RustCrypto + dalek, aws-lc-rs, graviola, ring) | DIT: the M4 has it, and rind turns it on and off around every call that handles a secret, which costs about 35 to 55 ns a call there; the other libraries never set it. Keeping it per call was decided with the maintainer from [#387](https://github.com/moq-dev/rind/pull/387)'s findings, and `rind::cpu::Dit::hold()` ([#431](https://github.com/moq-dev/rind/pull/431)) pays it once across a batch of calls. With DIT denied (`--cfg rind_cpu_disable` and `RIND_CPU_DISABLE_dit`), the same commit measured each of these within 10% of the fastest library but AES header protection (1.2× aws-lc-rs's 2.9 ns) and HMAC-SHA-256 at 64 B (1.15× RustCrypto's 101 ns). | | XChaCha20-Poly1305 seal, 32 B | `kixtop` | 1.26× (aws-lc-rs) | Noise: a rerun of the row on the same commit measured 1.04× aws-lc-rs's time, as did the run before this one, on a commit that changed only x86_64 code. The next refresh rechecks it. | ## Verified code diff --git a/benchmarks/gaps.toml b/benchmarks/gaps.toml index c867860fb..02f29edc3 100644 --- a/benchmarks/gaps.toml +++ b/benchmarks/gaps.toml @@ -71,7 +71,7 @@ operations = [ "hkdf-sha256/expand", ] on = ["kixtop"] -reason = "DIT: the M4 has it, and rind turns it on and off around every call that handles a secret, which costs about 35 to 55 ns a call there; the other libraries never set it. Keeping it per call was decided with the maintainer from [#387](https://github.com/moq-dev/rind/pull/387)'s findings, and [#431](https://github.com/moq-dev/rind/pull/431)'s `rind::cpu::hold_dit()` pays it once across a batch of calls. With DIT denied (`--cfg rind_cpu_disable` and `RIND_CPU_DISABLE_dit`), the same commit measured each of these within 10% of the fastest library but AES header protection (1.2× aws-lc-rs's 2.9 ns) and HMAC-SHA-256 at 64 B (1.15× RustCrypto's 101 ns)." +reason = "DIT: the M4 has it, and rind turns it on and off around every call that handles a secret, which costs about 35 to 55 ns a call there; the other libraries never set it. Keeping it per call was decided with the maintainer from [#387](https://github.com/moq-dev/rind/pull/387)'s findings, and `rind::cpu::Dit::hold()` ([#431](https://github.com/moq-dev/rind/pull/431)) pays it once across a batch of calls. With DIT denied (`--cfg rind_cpu_disable` and `RIND_CPU_DISABLE_dit`), the same commit measured each of these within 10% of the fastest library but AES header protection (1.2× aws-lc-rs's 2.9 ns) and HMAC-SHA-256 at 64 B (1.15× RustCrypto's 101 ns)." [[gap]] operations = ["xchacha20poly1305/32B"] From 58faaf527873888e248bac656f58d365d62d065b Mon Sep 17 00:00:00 2001 From: Luke Curley Date: Fri, 6 Nov 2026 20:25:06 -0800 Subject: [PATCH 4/4] chore(quest): schedule the quiet re-collect for 5 am and plan DIT-held rows Co-Authored-By: Claude Opus 5.5 --- quest/m1/README.md | 1 + quest/m1/bench-apple-m4.md | 5 ++--- quest/m1/bench-dit-held.md | 13 +++++++++++++ 3 files changed, 16 insertions(+), 3 deletions(-) create mode 100644 quest/m1/bench-dit-held.md diff --git a/quest/m1/README.md b/quest/m1/README.md index cc25c0dc7..b3614d442 100644 --- a/quest/m1/README.md +++ b/quest/m1/README.md @@ -12,5 +12,6 @@ Bun's fastest asymmetric operations run on rind, ahead of Bun writing its own. - [The launch post can say what building rind cost in AI tokens, time, and money](/quest/m1/ai-usage.md) - tokens, agent and maintainer hours, and API-price cost, before the post - [rind's launch blog post is published](/quest/m1/launch-post.md) - the Bun PR waits on it - [The bench report has a quiet Arrow Lake run and kixtop's build cost](/quest/m1/bench-apple-m4.md) - a fresh desktop column and M4 build costs before the launch post +- [The bench report times rind with the DIT guard held](/quest/m1/bench-dit-held.md) - shows what MoQ pays on DIT cores, before the post - [Each adapter's version matches the upstream it adapts](/quest/m1/adapter-versions.md) - rind-ring 0.17, rind-rustls 0.23, and so on, before the post quotes them - [rind covers MoQ](/quest/m1/moq/README.md) - the primitives, CPU check, armv7 backend, and `rind-*` adapters MoQ needs, verified and released diff --git a/quest/m1/bench-apple-m4.md b/quest/m1/bench-apple-m4.md index 74845faa1..2f6fba1d6 100644 --- a/quest/m1/bench-apple-m4.md +++ b/quest/m1/bench-apple-m4.md @@ -12,6 +12,5 @@ What remains of adding `kixtop` to the report, which [moq-dev/rind#435](https:// - Re-collect `kixtop` too if its run gets a build cost, since `collect` measures both together; rerun noisy rows rather than recording noise. - On 2026-11-07, `collect` refused `desktop` three times: 16.8, 4.7, and 5.3 of its 24 CPUs were busy, against a limit of 2.4, from other sessions' builds outside any gate. One attempt waited an hour for its host hold: the `quest` those sessions run predates [moq-dev/quest#526](https://github.com/moq-dev/quest/pull/526), so their gated commands were admitted past it. `kixtop` measured quietly on the second of two runs, but both runs' build costs were refused, at 11.6 and 6.6 of its 10 CPUs busy. -## Waiting - -- Maintainer: a quiet window on `desktop`, and on `kixtop` for its build cost: pause the sessions building there, and update the `quest` they run to [moq-dev/quest@99eb7f25](https://github.com/moq-dev/quest/commit/99eb7f256e7395b293f5f3246b01dd0ade760b8f) or later, so their gates honor `admin/bench-report`'s host hold. An agent can't pause the maintainer's own sessions or change their tools. Check: `quest gate --help` on each host lists `--host`, and the hosts are quiet when the maintainer says so. +- Decided with the maintainer on 2026-11-07: run it at about 5 am Pacific, when no session is building on `desktop` or `kixtop`; a scheduled agent starts it then. Those hosts' `quest` still predates [moq-dev/quest#526](https://github.com/moq-dev/quest/pull/526), so the host hold can't keep other sessions out; if `collect` still refuses a host as busy, record the load and stop, rather than waiting on the hold. +- If [rind's rows with the DIT guard held](/quest/m1/bench-dit-held.md) have landed, the `kixtop` re-collect carries them. diff --git a/quest/m1/bench-dit-held.md b/quest/m1/bench-dit-held.md new file mode 100644 index 000000000..d63194d31 --- /dev/null +++ b/quest/m1/bench-dit-held.md @@ -0,0 +1,13 @@ +# [XS] The bench report times rind with the DIT guard held + +## Goal + +On a CPU with DIT, the bench report shows rind both as it runs by default and with `rind::cpu::Dit::hold()` held across the timed loop, so readers see what MoQ, which holds the guard, actually pays. + +## Plan + +Decided with the maintainer on 2026-11-07, from [moq-dev/rind#435](https://github.com/moq-dev/rind/pull/435): `kixtop` (Apple M4) showed rind behind on 19 short-message rows (short AES-GCM, header protection, SHA-2, HMAC, HKDF). It sets DIT on and off around every call that handles a secret, which costs about 35-55 ns, and no other library sets DIT. With DIT off, all but two of those rows came within 10%. [moq-dev/rind#431](https://github.com/moq-dev/rind/pull/431) added the guard, but skipped a held case because no report host had DIT. + +- Add a held series for rind (for example `rind (DIT held)`) to the `rind-bench` groups those rows come from, timed only where the CPU has DIT. Elsewhere the guard does nothing, so it would just duplicate the default row. +- Show it in `BENCHMARKS.md`'s `kixtop` column next to the default row, and say in the gap reasons (`benchmarks/gaps.toml`) that holding the guard closes them. +- `kixtop` is the only report host with DIT. GitHub's Cobalt runners hide it. Collect with `admin/bench-report collect --host kixtop` in a quiet window. The [quiet re-collect](/quest/m1/bench-apple-m4.md) carries the new rows if this lands first.