In the following speed table, smaller keygen/enc/dec numbers are better.
The numbers are interquartile means of single-core cycle counts on various microarchitectures.
Overclocking is disabled.


| μarch |  KEM | keypair | enc  | dec  |
| :---- | :--- | ------: | ---: | ---: |
| Zen 3 (2020) | sntrup653 | 624984 | 32586 | 45614
|  | sntrup761 | 832981 | 35728 | 47720
|  | sntrup857 | 1046715 | 42691 | 60909
|  | sntrup953 | 1234177 | 45770 | 65164
|  | sntrup1013 | 1372132 | 46670 | 65848
|  | sntrup1277 | 2243926 | 59286 | 80917
| Zen 2 (2019) | sntrup653 | 938915 | 38190 | 60364
|  | sntrup761 | 1252286 | 41932 | 63279
|  | sntrup857 | 1603327 | 51045 | 81958
|  | sntrup953 | 1954404 | 54283 | 85850
|  | sntrup1013 | 2202132 | 55113 | 87982
|  | sntrup1277 | 3447331 | 69302 | 108263
| Cortex-A72 (2016) | sntrup653 | 9638356 | 693800 | 1241500
|  | sntrup761 | 12849166 | 894735 | 1662045
|  | sntrup857 | 16107454 | 1090320 | 2088182
|  | sntrup953 | 20050844 | 1303813 | 2570311
|  | sntrup1013 | 22564453 | 1446928 | 2885112
|  | sntrup1277 | 35885422 | 2327244 | 4855653
| Skylake (2015) | sntrup653 | 652780 | 39670 | 59354
|  | sntrup761 | 825921 | 42616 | 61734
|  | sntrup857 | 1083616 | 51061 | 78134
|  | sntrup953 | 1274661 | 54933 | 82806
|  | sntrup1013 | 1493919 | 57335 | 87541
|  | sntrup1277 | 2179755 | 73587 | 108213


Microarchitectures are listed in reverse chronological order of when they were introduced.

In the libntruprime distribution,
`command/ntruprime-speed.c` measures libntruprime;
`benchmarks/*-*` is the output of `ntruprime-speed` on various machines;
and `autogen/md-speed` extracts the table from those measurements.

The table reports only interquartile means of cycle counts, not the full distribution of cycle counts.
See the full output files
for differences between multiple measurements and the interquartile mean.

### <a name="faster">Faster `sntrup` software

There has been extensive further work on `sntrup` software speeds
beyond the current libntruprime speeds.
libntruprime has a policy of [limiting code size](security.html),
but if there are applications that need these speedups
then they can still be considered for inclusion in libntruprime:

* `mult3sntrup761/avx2unsigned` in SUPERCOP
  from Ming-Shing Chen:
  faster multiplications on Intel/AMD.

* `invsntrup761/jumpdivsteps` in SUPERCOP
  from Daniel J. Bernstein, Ming-Shing Chen, Gregor Seiler, and Bo-Yin Yang:
  faster inversions on Intel/AMD.

* ["OpenSSLNTRU: Faster post-quantum TLS key exchange"](https://eprint.iacr.org/2021/826)
  from Daniel J. Bernstein, Billy Bob Brumley, Ming-Shing Chen, and Nicola Tuveri:
  faster inversions for batch operations.

* ["Multi-Parameter Support with NTTs for NTRU and NTRU Prime on Cortex-M4"](https://eprint.iacr.org/2022/930)
  from Erdem Alkim, Vincent Hwang, and Bo-Yin Yang:
  faster multiplications on 32-bit ARM.

* ["Algorithmic Views of Vectorized Polynomial Multipliers for NTRU and NTRU Prime"](https://eprint.iacr.org/2023/541)
  from Han-Ting Chen, Yi-Hua Chung, Vincent Hwang, Chi-Ting Liu, and Bo-Yin Yang:
  faster multiplications on 64-bit ARM.

* ["Pushing the Limit of Vectorized Polynomial Multiplication for NTRU Prime"](https://eprint.iacr.org/2023/604)
  from Vincent Hwang:
  faster multiplications on 64-bit ARM and Intel/AMD.

* ["Algorithmic Views of Vectorized Polynomial Multipliers – NTRU Prime"](https://eprint.iacr.org/2023/1580)
  from Vincent Hwang, Chi-Ting Liu, and Bo-Yin Yang:
  faster multiplications on 64-bit ARM.

* ["A Survey of Polynomial Multiplications for Lattice-Based Cryptosystems"](https://eprint.iacr.org/2023/1962)
  from Vincent Hwang:
  faster multiplications on Intel/AMD.

* ["Jumping for Bernstein-Yang Inversion"](https://eprint.iacr.org/2024/644)
  from Li-Jie Jian, Ting-Yuan Wang, Bo-Yin Yang, and Ming-Shing Chen:
  faster inversions on 64-bit ARM.