This is inaccurate. SIKE takes 139 million cyc=
les (E+D) on ARM Cortex M4 while the fastest structured lattice (Kyber) tak=
es about 1.2 million cycles which is only about x100 slower.
I compared the actual performance (timing, not the CPU cycles) on Intel CP=
Us. Your point is taken.
Accelerating SIKE in hardware will make it down t=
o 2-4 million cycles or even lower if you pay more for silicon. <=
/o:p>
<=
/o:p>
Hardware (2-4M cycles) =E2=80=93 do you mean ASIC, or FPGA?
&=
nbsp;
You c=
annot pay to reduce the key size of Kyber. In a real-world example, if both=
SIKE and Kyber get accelerated in hardware, SIKE will be as efficient as K=
yber in terms of both speed and area for the whole protocol, e.g., Mbe=
d TLS.
Good point, thanks.
The comparison could get even more interesting if you plan to add side-c=
hannel countermeasures which will make SIKE even more efficient as it is mo=
re SCA resistant friendly adding less overhead than Kyber. =
=
Indeed, but I haven=E2=80=99t looked that deep (yet), not to mention th=
at adding SCA would be somebody else=E2=80=99s job. 😉
&nbs=
p;Thank you!