[KenoFischer]

Depends on the scheme and your security parameters. The best known ones we have are probably 5-6 orders of magnitude slower than plaintext in the best case (obviously the worst case is much worse).