Reducing the rounds from 10 to 7 results in a ~10/7 = ~1.4x speedup. But single-threaded BLAKE3 is 5-6x faster than BLAKE2b, and most of that comes from SIMD op

Reducing the rounds from 10 to 7 results in a ~10/7 = ~1.4x speedup. But single-threaded BLAKE3 is 5-6x faster than BLAKE2b, and most of that comes from SIMD optimizations. Thatonelutenist (the author of the original post) points out in a sibling comment that BLAKE2sp closes a lot of that gap, and that's very true. BLAKE2sp and BLAKE2bp can take advantage of many of the same SIMD optimizations that BLAKE3 can. But not all :) A fully optimized implementation of BLAKE2bp/sp is about 2x faster than BLAKE2b and more than 3x faster than BLAKE2s. That's an enormous speedup. Consider that SHA-3 has a reputation for being slow, but the software speed difference between SHA-512 and SHA3-256 is smaller than this. There are some complications when you get into short input performance, but any application that needs to hash files (where short input performance is dominated by the cost of opening the file) would almost certainly be better served by BLAKE2bp/sp than by BLAKE2b/s. In that sense, I think the biggest practical advantage of BLAKE3 is just that it doesn't ask users to navigate these tradeoffs. We discussed this a bit in the intro section of the BLAKE3 paper.