Post-quantum cost measurements: 2026-10-14, x86-64 reference VPS
Post-quantum cost measurements on an x86-64 machine, with raw data.
This page reproduces docs/benchmarks/2026-10-14_x86-64/README.md from qanum-core v0.9.0 (release tag). Links to files that are not published on this site are shown as plain text until the source repository is public.
Second run of examples/pq_bench, on the reference VPS, to check the
Verify-Unit constants on x86-64, with a development build that predates
the first public release. The first run, on the
ARM build machine, is in
../2026-10-14_arm/. The raw data
are the files; the reduction rules are pinned by tests/pq_bench_report.rs.
| Core 1 | Core 3 | |
|---|---|---|
| Data | epyc-core1.jsonl |
epyc-core3.jsonl |
| Environment | epyc-core1.env.txt |
epyc-core3.env.txt |
- Machine: KVM guest, AMD EPYC-Milan, 6 vCPUs, 8 GB RAM, Linux 6.8.0, glibc 2.39. Shared: a testnet seed node was mining on another vCPU during the runs, and the guest exposes no CPU frequency data.
- Build:
cargo build --release --locked --example pq_bench, Rust 1.98.1 (rust-toolchain.toml; therustcfield of the files is empty becauserustcwas not on the run’sPATH). liboqs 0.16.0 linked,oqs-sys0.11.0+liboqs-0.16.0-rc1 (git revc6fd1a6). - Command:
QANUM_BENCH_COMMIT=<commit> taskset -c <core> target/release/examples/pq_bench --out epyc-core<core>.jsonl, one run after the other, 78 s each. - At measurement time the SLH-DSA-256s constant was still 3500; the files record that value.
Signature verification
Through OqsVerifier::verify_suite, in A/B/A/B/A rounds as in the first
run. Estimate = ceil(100 × median / median of ML-DSA-44).
| Suite | Core 1 median (rounds) | Core 3 median (rounds) | VU estimate 1 / 3 | Consensus VU |
|---|---|---|---|---|
| ML-DSA-44 | 20.4 µs-20.8 µs | 20.5 µs-20.9 µs | 100 / 100 | 100 |
| ML-DSA-87 | 54.4 µs-54.9 µs | 54.8 µs-55.1 µs | 266 / 264 | 290 |
| SLH-DSA-128s | 542 µs-565 µs | 536 µs-566 µs | 2687 / 2623 | 1600 |
| SLH-DSA-256s | 1.20 ms-1.24 ms | 1.16 ms-1.17 ms | 5902 / 5601 | 3600 |
- Spread between rounds of the same suite: up to 556 basis points (SLH-DSA-128s, core 3); ML-DSA-44 control at the end of the run vs the start: 68 bp (core 1), 34 bp (core 3). Noisier than the ARM run.
Blocks (one thread, median of 10)
| Block | Bound by | no_crypto core 1 / 3 |
cold core 1 / 3 |
warm core 1 / 3 |
|---|---|---|---|---|
| 415 P2PQK ML-DSA-87 spends | auth bytes | 43.0 / 42.3 ms | 75.2 / 78.5 ms | 47.8 / 53.3 ms |
| 57 P2RKPQ recovery SLH-DSA-256s spends | verify units at 3500 | 10.4 / 8.8 ms | 85.7 / 80.8 ms | 11.7 / 11.5 ms |
The same blocks take 553 ms and 446 ms cold on the slow ARM core of the
first run.
Reading
- Every check is faster on this core than on either ARM core, but the SLH-DSA ratios are higher: 2623-2687 for SLH-DSA-128s and 5601-5902 for SLH-DSA-256s, against 1466-1576 and 3200-3492 on ARM.
- Cause, from the liboqs 0.16 sources: ML-DSA runs
mldsa-native, which has an x86-64 (AVX2) and an aarch64 backend; SLH-DSA runsslh_dsa_c, portable C with its own Keccak permutation (slh_dsa_c/sha3_f1600.c) on every architecture. The unit, ML-DSA-44, gains more from AVX2 than SLH-DSA does. - The Verify-Unit budgets bound the wall-clock time of a block. The constants follow the slowest reference core, where that time is largest; here the worst block verifies in about 86 ms. The constants are not raised to the x86-64 ratios.
- One shared VM, two vCPUs, one day: indicative numbers, like those of the first run.