Cryptographic performance on STM32U0 Series V5.x

This message will disappear after all relevant tasks have been resolved.
Semantic MediaWiki
There are 1 incomplete or pending task to finish installation of Semantic MediaWiki. An administrator or user with sufficient rights can complete it. This should be done before adding new data to avoid inconsistencies.


This page shows the measured performance results when using the pure software cryptographic library algorithms with an STM32U0 MCU. In addition to performance figures, it also gives the required code footprint and memory.

1. Measurement configuration

1.1. Hardware configuration

STM32 MCU STM32U083RCTx
Device ID 0x489
Revision ID 0x1000
Board NUCLEO-U083RC

1.2. Firmware configuration

Cryptographic library version 050000B2[ver. 1]
  1. ↑ This value corresponds to the information returned by a call to cmox_getInfos

1.3. System configuration

System core clock frequency 56 MHz
Flash latency 1 wait states
Voltage scaling Range 1
Instruction cache (ART/ICU) 1 (0: disabled / 1: enabled)
Prefetch cache (ART) 1 (0: disabled / 1: enabled)

1.4. Development toolchains and compilers

IAR Embedded Workbench IAR ANSI C/C++ Compiler V9.40.1.364/W64 for ARM
Information
The measurements are done using a project built with the High Speed optimization setting enabled.


2. Performance values

2.1. AES symmetric key encryption and decryption

This section provides the performance results for AES-CBC using different operation modes:

  • Sole buffer: one sole buffer is encrypted or decrypted. The performance time is given in µs.
  • Data flow: a big message is encrypted or decrypted in chunks. The bit rate is given in kilobytes per second.

2.1.1. Sole buffer mode

In this mode, the entire encryption or decryption process, for the full message size, is managed through a single API call provided by the CMOX library.

The table below shows the number of clock cycles and time (in µs) needed to perform the described operation in small and fast configurations.

AES mode Key size Buffer size Cipher operation Configuration Cycles Time
AES CBC 128 bits 32 bytes Encryption Small 5547 99 µs
AES CBC 128 bits 32 bytes Encryption Fast 5586 99 µs
AES CBC 128 bits 64 bytes Encryption Small 9802 175 µs
AES CBC 128 bits 64 bytes Encryption Fast 9869 176 µs
AES CBC 128 bits 128 bytes Encryption Small 18 310 326 µs
AES CBC 128 bits 128 bytes Encryption Fast 18 433 329 µs
AES CBC 192 bits 32 bytes Encryption Small 6216 111 µs
AES CBC 192 bits 32 bytes Encryption Fast 6258 111 µs
AES CBC 192 bits 64 bytes Encryption Small 11 168 199 µs
AES CBC 192 bits 64 bytes Encryption Fast 11 244 200 µs
AES CBC 192 bits 128 bytes Encryption Small 21 072 376 µs
AES CBC 192 bits 128 bytes Encryption Fast 21 216 378 µs
AES CBC 256 bits 32 bytes Encryption Small 7141 127 µs
AES CBC 256 bits 32 bytes Encryption Fast 7181 128 µs
AES CBC 256 bits 64 bytes Encryption Small 12 787 228 µs
AES CBC 256 bits 64 bytes Encryption Fast 12 856 229 µs
AES CBC 256 bits 128 bytes Encryption Small 24 079 429 µs
AES CBC 256 bits 128 bytes Encryption Fast 24 208 432 µs
AES CBC 128 bits 32 bytes Decryption Small 7157 127 µs
AES CBC 128 bits 32 bytes Decryption Fast 7196 128 µs
AES CBC 128 bits 64 bytes Decryption Small 13 038 232 µs
AES CBC 128 bits 64 bytes Decryption Fast 13 104 234 µs
AES CBC 128 bits 128 bytes Decryption Small 24 800 442 µs
AES CBC 128 bits 128 bytes Decryption Fast 24 918 444 µs
AES CBC 192 bits 32 bytes Decryption Small 8172 145 µs
AES CBC 192 bits 32 bytes Decryption Fast 8210 146 µs
AES CBC 192 bits 64 bytes Decryption Small 15 102 269 µs
AES CBC 192 bits 64 bytes Decryption Fast 15 166 270 µs
AES CBC 192 bits 128 bytes Decryption Small 28 956 517 µs
AES CBC 192 bits 128 bytes Decryption Fast 29 072 519 µs
AES CBC 256 bits 32 bytes Decryption Small 9447 168 µs
AES CBC 256 bits 32 bytes Decryption Fast 9485 169 µs
AES CBC 256 bits 64 bytes Decryption Small 17 418 311 µs
AES CBC 256 bits 64 bytes Decryption Fast 17 482 312 µs
AES CBC 256 bits 128 bytes Decryption Small 33 358 595 µs
AES CBC 256 bits 128 bytes Decryption Fast 33 474 597 µs


The table below shows flash memory and RAM usage (in bytes).

Cipher operation Configuration Code Constant data Global data Stack usage
Encryption Small 2338 bytes 324 bytes 0 bytes 544 bytes
Encryption Fast 2362 bytes 324 bytes 0 bytes 552 bytes
Decryption Small 2742 bytes 592 bytes 0 bytes 564 bytes
Decryption Fast 2766 bytes 592 bytes 0 bytes 572 bytes


2.1.2. Data flow mode

In this mode, the operation is performed in several calls to the CMOX library APIs, as shown below:

  • cmox_cipher_init
  • cmox_cipher_setKey
  • cmox_cipher_setIV
  • cmox_cipher_append: called several times to encrypt or decrypt the whole message in fixed-size chunks

The table below shows the number of clock cycles and the bit rate (in kilobytes per second) needed to perform the described operation in small and fast configuration.

AES mode Key size Message size Chunk size Cipher operation Configuration Cycles Bit rate
AES CBC 128 bits 8000 bytes 128 bytes Encryption Small 1 074 184 417 Kbytes/s
AES CBC 128 bits 8000 bytes 128 bytes Encryption Fast 1 081 304 414 Kbytes/s
AES CBC 128 bits 8000 bytes 512 bytes Encryption Small 1 066 264 420 Kbytes/s
AES CBC 128 bits 8000 bytes 512 bytes Encryption Fast 1 073 296 417 Kbytes/s
AES CBC 128 bits 8000 bytes 1024 bytes Encryption Small 1 064 912 420 Kbytes/s
AES CBC 128 bits 8000 bytes 1024 bytes Encryption Fast 1 071 928 417 Kbytes/s
AES CBC 128 bits 8000 bytes 2048 bytes Encryption Small 1 064 248 420 Kbytes/s
AES CBC 128 bits 8000 bytes 2048 bytes Encryption Fast 1 071 240 418 Kbytes/s
AES CBC 192 bits 8000 bytes 128 bytes Encryption Small 1 248 528 358 Kbytes/s
AES CBC 192 bits 8000 bytes 128 bytes Encryption Fast 1 257 520 356 Kbytes/s
AES CBC 192 bits 8000 bytes 512 bytes Encryption Small 1 240 728 361 Kbytes/s
AES CBC 192 bits 8000 bytes 512 bytes Encryption Fast 1 249 720 358 Kbytes/s
AES CBC 192 bits 8000 bytes 1024 bytes Encryption Small 1 239 392 361 Kbytes/s
AES CBC 192 bits 8000 bytes 1024 bytes Encryption Fast 1 247 240 359 Kbytes/s
AES CBC 192 bits 8000 bytes 2048 bytes Encryption Small 1 238 728 361 Kbytes/s
AES CBC 192 bits 8000 bytes 2048 bytes Encryption Fast 1 247 224 359 Kbytes/s
AES CBC 256 bits 8000 bytes 128 bytes Encryption Small 1 422 272 314 Kbytes/s
AES CBC 256 bits 8000 bytes 128 bytes Encryption Fast 1 429 800 313 Kbytes/s
AES CBC 256 bits 8000 bytes 512 bytes Encryption Small 1 414 288 316 Kbytes/s
AES CBC 256 bits 8000 bytes 512 bytes Encryption Fast 1 421 792 315 Kbytes/s
AES CBC 256 bits 8000 bytes 1024 bytes Encryption Small 1 412 920 317 Kbytes/s
AES CBC 256 bits 8000 bytes 1024 bytes Encryption Fast 1 420 416 315 Kbytes/s
AES CBC 256 bits 8000 bytes 2048 bytes Encryption Small 1 412 240 317 Kbytes/s
AES CBC 256 bits 8000 bytes 2048 bytes Encryption Fast 1 419 744 315 Kbytes/s
AES CBC 128 bits 8000 bytes 128 bytes Decryption Small 1 503 696 297 Kbytes/s
AES CBC 128 bits 8000 bytes 128 bytes Decryption Fast 1 510 136 296 Kbytes/s
AES CBC 128 bits 8000 bytes 512 bytes Decryption Small 1 492 712 300 Kbytes/s
AES CBC 128 bits 8000 bytes 512 bytes Decryption Fast 1 499 200 298 Kbytes/s
AES CBC 128 bits 8000 bytes 1024 bytes Decryption Small 1 489 672 300 Kbytes/s
AES CBC 128 bits 8000 bytes 1024 bytes Decryption Fast 1 496 160 299 Kbytes/s
AES CBC 128 bits 8000 bytes 2048 bytes Decryption Small 1 486 232 301 Kbytes/s
AES CBC 128 bits 8000 bytes 2048 bytes Decryption Fast 1 492 728 300 Kbytes/s
AES CBC 192 bits 8000 bytes 128 bytes Decryption Small 1 764 976 253 Kbytes/s
AES CBC 192 bits 8000 bytes 128 bytes Decryption Fast 1 771 472 252 Kbytes/s
AES CBC 192 bits 8000 bytes 512 bytes Decryption Small 1 754 032 255 Kbytes/s
AES CBC 192 bits 8000 bytes 512 bytes Decryption Fast 1 760 536 254 Kbytes/s
AES CBC 192 bits 8000 bytes 1024 bytes Decryption Small 1 751 056 255 Kbytes/s
AES CBC 192 bits 8000 bytes 1024 bytes Decryption Fast 1 757 552 254 Kbytes/s
AES CBC 192 bits 8000 bytes 2048 bytes Decryption Small 1 747 664 256 Kbytes/s
AES CBC 192 bits 8000 bytes 2048 bytes Decryption Fast 1 754 160 255 Kbytes/s
AES CBC 256 bits 8000 bytes 128 bytes Decryption Small 2 025 872 221 Kbytes/s
AES CBC 256 bits 8000 bytes 128 bytes Decryption Fast 2 032 376 220 Kbytes/s
AES CBC 256 bits 8000 bytes 512 bytes Decryption Small 2 014 896 222 Kbytes/s
AES CBC 256 bits 8000 bytes 512 bytes Decryption Fast 2 021 392 221 Kbytes/s
AES CBC 256 bits 8000 bytes 1024 bytes Decryption Small 2 012 120 222 Kbytes/s
AES CBC 256 bits 8000 bytes 1024 bytes Decryption Fast 2 018 624 221 Kbytes/s
AES CBC 256 bits 8000 bytes 2048 bytes Decryption Small 2 008 400 223 Kbytes/s
AES CBC 256 bits 8000 bytes 2048 bytes Decryption Fast 2 014 896 222 Kbytes/s


The table below shows flash memory and RAM usage (in bytes).

Cipher operation Configuration Code Constant data Global data Stack usage
Encryption Small 2274 bytes 316 bytes 0 bytes 168 bytes
Encryption Fast 2298 bytes 316 bytes 0 bytes 176 bytes
Decryption Small 2678 bytes 584 bytes 0 bytes 188 bytes
Decryption Fast 2702 bytes 584 bytes 0 bytes 196 bytes


2.2. HASH digest

In this section we provide the performance results for HASH, using different modes of operation:

  • Sole buffer: one sole buffer is hashed. The performance time is given in us.
  • Data flow: a big message is hashed in chunks. The bit rate is given in bytes per second.

2.2.1. Sole buffer mode

In this mode, the entire message hashing process is managed through a single API call provided by the CMOX library.

The table below shows the number of clock cycles and time (in µs) needed to perform the described operation.

HASH mode Buffer size Cycles Time
SHA256 32 bytes 9050 161 µs
SHA256 64 bytes 16 916 302 µs
SHA256 128 bytes 24 712 441 µs
SHA384 32 bytes 36 210 646 µs
SHA384 64 bytes 36 226 646 µs
SHA384 128 bytes 70 074 1251 µs


The table below shows flash memory and RAM usage (in bytes).

HASH mode Code Constant data Global data Stack usage
SHA256 1502 280 bytes 0 bytes 564 bytes
SHA384 2810 728 bytes 0 bytes 1116 bytes


2.2.2. Data flow mode

In this mode, the operation is performed in several calls to the CMOX library APIs, as shown below:

  • cmox_hash_init
  • cmox_hash_append: called several times to hash the whole message in fixed-size chunks
  • cmox_hash_generateTag

The table below shows the number of clock cycles and the bit rate (in kilobytes per second) needed to perform the described operation.

HASH mode Message size Chunk size Cycles Bit rate
SHA256 8000 bytes 128 bytes 989 417 452 Kbytes/s
SHA256 8000 bytes 512 bytes 978 137 458 Kbytes/s
SHA256 8000 bytes 1024 bytes 976 217 458 Kbytes/s
SHA256 8000 bytes 2048 bytes 975 255 459 Kbytes/s
SHA384 8000 bytes 128 bytes 2 110 364 212 Kbytes/s
SHA384 8000 bytes 512 bytes 2 096 770 213 Kbytes/s
SHA384 8000 bytes 1024 bytes 2 094 434 213 Kbytes/s
SHA384 8000 bytes 2048 bytes 2 093 266 214 Kbytes/s


The table below shows the final tag generation done through the call to cmox_hash_generateTag.

HASH mode Cycles Time
SHA256 8498 151 µs
SHA384 35 625 636 µs

The table below shows flash memory and RAM usage (in bytes).

HASH mode Code Constant data Global data Stack usage
SHA256 1526 bytes 272 bytes 0 bytes 372 bytes
SHA384 2834 bytes 720 bytes 0 bytes 820 bytes


2.3. ECDSA signature and verification

This section provides the performance results for ECDSA signature and verification.

The table below shows the number of clock cycles and time (in ms) needed to perform the described operation in different configurations.

Curve Operation ECC mathematics configuration Curve definition Cycles Time
SECP256R1 Signature Small Low 10 978 664 196 ms
SECP256R1 Signature Small High 10 652 336 190 ms
SECP256R1 Signature SuperFast Low 8 333 144 148 ms
SECP256R1 Signature SuperFast High 8 076 160 144 ms
SECP256R1 Verification Small Low 25 956 800 463 ms
SECP256R1 Verification Small High 23 042 200 411 ms
SECP256R1 Verification SuperFast Low 19 918 056 355 ms
SECP256R1 Verification SuperFast High 17 647 832 315 ms
SECP384R1 Signature Small Low 34 723 480 620 ms
SECP384R1 Signature Small High 33 186 296 592 ms
SECP384R1 Signature Fast Low 29 986 904 535 ms
SECP384R1 Signature Fast High 28 576 760 510 ms
SECP384R1 Verification Small Low 81 913 232 1462 ms
SECP384R1 Verification Small High 71 253 592 1272 ms
SECP384R1 Verification Fast Low 71 304 720 1273 ms
SECP384R1 Verification Fast High 61 795 168 1103 ms


The table below shows ECDSA flash memory and RAM usage (in bytes).

Note
The footpring is measured using the general-purpose CMOX_ECC_XXX_HIGHMEM or CMOX_ECC_XXX_LOWMEM configuration, which shows the footprint increase compared with the V4.x.x. To reduce the footprint, the optimized confinguration CMOX_ECC_XXX_YYY_SIGN or CMOX_ECC_XXX_YYY_VERIFY is recommended.
Curve Operation ECC mathematics configuration Curve definition Code Constant data Global data Stack usage Working buffer
SECP256R1 Signature Small Low 13 670 bytes 1212 bytes 0 bytes 424 bytes 628 bytes
SECP256R1 Signature Small High 13 670 bytes 1596 bytes 0 bytes 424 bytes 696 bytes
SECP256R1 Signature SuperFast Low 17 010 bytes 1212 bytes 0 bytes 472 bytes 628 bytes
SECP256R1 Signature SuperFast High 17 010 bytes 1596 bytes 0 bytes 472 bytes 696 bytes
SECP256R1 Verification Small Low 13 658 bytes 1212 bytes 0 bytes 472 bytes 856 bytes
SECP256R1 Verification Small High 13 658 bytes 1596 bytes 0 bytes 472 bytes 1648 bytes
SECP256R1 Verification SuperFast Low 16 998 bytes 1212 bytes 0 bytes 520 bytes 856 bytes
SECP256R1 Verification SuperFast High 16 998 bytes 1596 bytes 0 bytes 520 bytes 1648 bytes
SECP384R1 Signature Small Low 13 670 bytes 1692 bytes 0 bytes 424 bytes 884 bytes
SECP384R1 Signature Small High 13 670 bytes 2268 bytes 0 bytes 424 bytes 984 bytes
SECP384R1 Signature Fast Low 14 508 bytes 1692 bytes 0 bytes 416 bytes 884 bytes
SECP384R1 Signature Fast High 14 508 bytes 2268 bytes 0 bytes 416 bytes 984 bytes
SECP384R1 Verification Small Low 13 658 bytes 1692 bytes 0 bytes 472 bytes 1192 bytes
SECP384R1 Verification Small High 13 658 bytes 2268 bytes 0 bytes 472 bytes 2272 bytes
SECP384R1 Verification Fast Low 14 496 bytes 1692 bytes 0 bytes 464 bytes 1192 bytes
SECP384R1 Verification Fast High 14 496 bytes 2268 bytes 0 bytes 464 bytes 2272 bytes


2.4. EdDSA signature and verification

This section provides the performance results for EdDSA signature and verification.

The table below shows the number of clock cycles and time (in ms) needed to perform the described operation in different configurations.

Curve Message size Operation ECC mathematics configuration Curve definition Cycles Time
Ed25519 1023 bytes Signature Small OptLow 15 531 040 277 ms
Ed25519 1023 bytes Signature Small OptHigh 8 942 544 159 ms
Ed25519 1023 bytes Signature SuperFast OptLow 12 385 936 221 ms
Ed25519 1023 bytes Signature SuperFast OptHigh 7 145 008 127 ms
Ed25519 1023 bytes Verification Small OptLow 24 442 544 436 ms
Ed25519 1023 bytes Verification Small OptHigh 21 368 816 381 ms
Ed25519 1023 bytes Verification SuperFast OptLow 19 080 128 340 ms
Ed25519 1023 bytes Verification SuperFast OptHigh 16 602 008 296 ms


The table below shows EdDSA flash memory and RAM usage (in bytes).

Note
The footpring is measured using the general-purpose CMOX_ECC_XXX_HIGHMEM or CMOX_ECC_XXX_LOWMEM configuration, which shows the footprint increase compared with the V4.x.x. To reduce the footprint, the optimized confinguration CMOX_ECC_XXX_YYY_SIGN or CMOX_ECC_XXX_YYY_VERIFY is recommended.
Curve Message size Operation ECC mathematics configuration Curve definition Code Constant data Global data Stack usage Working buffer
Ed25519 1023 bytes Signature Small OptLow 15 360 bytes 1748 bytes 0 bytes 1212 bytes 1672 bytes
Ed25519 1023 bytes Signature Small OptHigh 15 798 bytes 2900 bytes 0 bytes 1212 bytes 1672 bytes
Ed25519 1023 bytes Signature SuperFast OptLow 18 700 bytes 1748 bytes 0 bytes 1212 bytes 1672 bytes
Ed25519 1023 bytes Signature SuperFast OptHigh 19 138 bytes 2900 bytes 0 bytes 1212 bytes 1672 bytes
Ed25519 1023 bytes Verification Small OptLow 15 356 bytes 1748 bytes 0 bytes 1204 bytes 984 bytes
Ed25519 1023 bytes Verification Small OptHigh 15 794 bytes 2900 bytes 0 bytes 1204 bytes 1992 bytes
Ed25519 1023 bytes Verification SuperFast OptLow 18 696 bytes 1748 bytes 0 bytes 1204 bytes 984 bytes
Ed25519 1023 bytes Verification SuperFast OptHigh 19 134 bytes 2900 bytes 0 bytes 1204 bytes 1992 bytes


2.5. RSA signature and verification

This section provides the performance results for RSA signature and verification.

The table below shows the number of clock cycles and time (in ms) needed to perform the described operation in different configurations.

PKCS#1 Priv. key mod. exp. method Hash method Modulus size Operation RSA mathematics configuration Priv. key mod. exp. implementation Cycles Time
v2.2 CRT SHA-256 3K Signature Small Low 1 008 694 816 18 012 ms
v2.2 CRT SHA-256 3K Signature Small Mid 758 179 888 13 538 ms
v2.2 CRT SHA-256 3K Signature Small High 636 388 128 11 364 ms
v2.2 CRT SHA-256 3K Signature Fast Low 854 688 160 15 262 ms
v2.2 CRT SHA-256 3K Signature Fast Mid 620 902 104 11 087 ms
v2.2 CRT SHA-256 3K Signature Fast High 506 902 592 9051 ms
v2.2 No CRT SHA-256 3K Signature Small Low 3 967 989 856 70 856 ms
v2.2 No CRT SHA-256 3K Signature Small Mid 2 978 698 984 53 191 ms
v2.2 No CRT SHA-256 3K Signature Small High 2 491 007 984 44 482 ms
v2.2 No CRT SHA-256 3K Signature Fast Low 3 355 790 576 59 924 ms
v2.2 No CRT SHA-256 3K Signature Fast Mid 2 428 244 688 43 361 ms
v2.2 No CRT SHA-256 3K Signature Fast High 1 970 314 112 35 184 ms
v2.2 n/a SHA-256 3K Verification Small n/a 15 447 328 275 ms
v2.2 n/a SHA-256 3K Verification Fast n/a 12 743 448 227 ms


The table below shows RSA flash memory and RAM usage (in bytes).

PKCS#1 Priv. key mod. exp. method Hash method Modulus size Operation RSA mathematics configuration Priv. key mod. exp. implementation Code Constant data Global data Stack usage Working buffer
v2.2 CRT SHA-256 3K Signature Small Low 7178 bytes 372 bytes 0 bytes 692 bytes 3704 bytes
v2.2 CRT SHA-256 3K Signature Small Mid 7430 bytes 372 bytes 0 bytes 692 bytes 4308 bytes
v2.2 CRT SHA-256 3K Signature Small High 7430 bytes 372 bytes 0 bytes 692 bytes 6708 bytes
v2.2 CRT SHA-256 3K Signature Fast Low 8016 bytes 372 bytes 0 bytes 692 bytes 3704 bytes
v2.2 CRT SHA-256 3K Signature Fast Mid 8268 bytes 372 bytes 0 bytes 692 bytes 4308 bytes
v2.2 CRT SHA-256 3K Signature Fast High 8268 bytes 372 bytes 0 bytes 692 bytes 6708 bytes
v2.2 No CRT SHA-256 3K Signature Small Low 6268 bytes 364 bytes 0 bytes 692 bytes 3484 bytes
v2.2 No CRT SHA-256 3K Signature Small Mid 6520 bytes 364 bytes 0 bytes 692 bytes 4664 bytes
v2.2 No CRT SHA-256 3K Signature Small High 6520 bytes 364 bytes 0 bytes 692 bytes 9368 bytes
v2.2 No CRT SHA-256 3K Signature Fast Low 7106 bytes 364 bytes 0 bytes 692 bytes 3484 bytes
v2.2 No CRT SHA-256 3K Signature Fast Mid 7358 bytes 364 bytes 0 bytes 692 bytes 4664 bytes
v2.2 No CRT SHA-256 3K Signature Fast High 7358 bytes 364 bytes 0 bytes 692 bytes 9368 bytes
v2.2 n/a SHA-256 3K Verification Small n/a 6464 bytes 368 bytes 0 bytes 708 bytes 3108 bytes
v2.2 n/a SHA-256 3K Verification Fast n/a 7302 bytes 368 bytes 0 bytes 708 bytes 3108 bytes


Retrieved from "https://wiki.st.com/stm32mcu/index.php?title=Security:STM32U0_Series:_Cryptographic_Library_Performance_V5.x&oldid=88464"