As a caveat, I haven't been involved with the process, so can't speak fully to it (and would welcome an answer from someone more in-the-know).
That being said, it is worth mentioning how "light" or "heavy" a scheme is is highly context-dependent.
For example AES is not particularly fast to implement in software --- typically ARX ciphers (things like ChaChaPoly1305) are much faster. But many processors have dedicated AES instructions, making them faster on these computing platforms. So AES is "heavy" in some settings (where there isn't chip space for a dedicated instruction), and "light" in others (when there is).
What is the context of the LWC competition? You can read older NIST reports for some indication.
Copying from page 10, we see
Microcontrollers are available with a wide array of performance attributes. Although 8-bit, 16-bit
and 32-bit microcontrollers are the most common, there are significant sales of 4-bit
microcontrollers for certain ultra-low cost applications. A wide variety of instruction sets exist,
typically only simple instructions are supported, and the number of instructions is often very
limited. This may result in a high number of cycles to execute common cryptographic
algorithms, which may make them too slow or energy-consuming for the intended application.
This is particularly a problem when it is necessary to satisfy real-time constraints using a limited
amount of energy.
From this, we see constraints such as
- limited instruction sets
- limited register sizes (potentially sub-16 bit),
- energy efficiency is a priority
These are all design constraints that don't appear in the desktop environment. It's therefore plausible that if you design cryptosystems without these constraints, you can get faster schemes.
For fun, we can compare
- "Standard" crypto (on desktop), with
- a LWC crypto finalist (on desktop)
using benchmarks like SUPERCOP.
It looks like we are a few weeks out from the selection occuring, so I will look at benchmarks for the alphabetically-first LWC finalist, ASCON.
It has a number of different algorithms listed on SUPERCOP, and I won't claim to know the differences between them.
I will point out this page, where one sees that for desktop-grade processors (say AMD Ryzen 5 5560U --- this might be a laptop processor, I can't remember), that "heavyweight cryptography" is significantly faster than ASCON variants.
So "lightweight" crypto is not faster in all contexts, and seems to be a good deal slower in comparison to standard crypto in standard computing environments.
