Cryptographic performance on STM32U3 Series V4.x

This message will disappear after all relevant tasks have been resolved.
Semantic MediaWiki
There are 1 incomplete or pending task to finish installation of Semantic MediaWiki. An administrator or user with sufficient rights can complete it. This should be done before adding new data to avoid inconsistencies.

This page shows the measured performance results when using the pure software cryptographic library algorithms with an STM32U3 MCU. In addition to performance figures, it also gives the required code footprint and memory.


1. Measurement configuration

1.1. Hardware configuration

STM32 MCU STM32U385RGTxQ
Device ID 0x454
Revision ID 0x1001
Board NUCLEO-U385RG-Q

1.2. Firmware configuration

Cryptographic library version 040000B1[ver. 1]
  1. ↑ This value corresponds to the information returned by a call to cmox_getInfos

1.3. System configuration

System core clock frequency 96 MHz
Flash latency 2 wait states
Voltage scaling Range 1
ICACHE peripheral 1 (0: disabled / 1: enabled)
Prefetch cache (ART) 1 (0: disabled / 1: enabled)

1.4. Development toolchains and compilers

IAR Embedded Workbench IAR ANSI C/C++ Compiler V9.20.4.327/W64 for ARM
Information
The measurements are done using a project built with the High Speed optimization setting enabled.


2. Performance values

2.1. AES symmetric key encryption and decryption

This section provides the performance results for AES-CBC using different operation modes:

  • Sole buffer: one sole buffer is encrypted or decrypted. The performance time is given in µs.
  • Data flow: a big message is encrypted or decrypted in chunks. The bit rate is given in kilobytes per second.

2.1.1. Sole buffer mode

In this mode, the entire encryption or decryption process, for the full message size, is managed through a single API call provided by the CMOX library.

The table below shows the number of clock cycles and time (in µs) needed to perform the described operation in small and fast configurations.

AES mode Key size Buffer size Cipher operation Configuration Cycles Time
AES CBC 128 bits 32 bytes Encryption Small 5281 55 µs
AES CBC 128 bits 32 bytes Encryption Fast 4610 48 µs
AES CBC 128 bits 64 bytes Encryption Small 8669 90 µs
AES CBC 128 bits 64 bytes Encryption Fast 7213 75 µs
AES CBC 128 bits 128 bytes Encryption Small 15 457 161 µs
AES CBC 128 bits 128 bytes Encryption Fast 12 457 129 µs
AES CBC 192 bits 32 bytes Encryption Small 5915 61 µs
AES CBC 192 bits 32 bytes Encryption Fast 5046 52 µs
AES CBC 192 bits 64 bytes Encryption Small 9881 102 µs
AES CBC 192 bits 64 bytes Encryption Fast 8064 84 µs
AES CBC 192 bits 128 bytes Encryption Small 17 821 185 µs
AES CBC 192 bits 128 bytes Encryption Fast 14 120 147 µs
AES CBC 256 bits 32 bytes Encryption Small 6796 70 µs
AES CBC 256 bits 32 bytes Encryption Fast 5680 59 µs
AES CBC 256 bits 64 bytes Encryption Small 11 344 118 µs
AES CBC 256 bits 64 bytes Encryption Fast 9099 94 µs
AES CBC 256 bits 128 bytes Encryption Small 20 443 212 µs
AES CBC 256 bits 128 bytes Encryption Fast 15 955 166 µs
AES CBC 128 bits 32 bytes Decryption Small 8966 93 µs
AES CBC 128 bits 32 bytes Decryption Fast 5921 61 µs
AES CBC 128 bits 64 bytes Decryption Small 15 902 165 µs
AES CBC 128 bits 64 bytes Decryption Fast 8601 89 µs
AES CBC 128 bits 128 bytes Decryption Small 29 787 310 µs
AES CBC 128 bits 128 bytes Decryption Fast 13 918 144 µs
AES CBC 192 bits 32 bytes Decryption Small 10 324 107 µs
AES CBC 192 bits 32 bytes Decryption Fast 6687 69 µs
AES CBC 192 bits 64 bytes Decryption Small 18 622 193 µs
AES CBC 192 bits 64 bytes Decryption Fast 9769 101 µs
AES CBC 192 bits 128 bytes Decryption Small 35 226 366 µs
AES CBC 192 bits 128 bytes Decryption Fast 15 913 165 µs
AES CBC 256 bits 32 bytes Decryption Small 11 951 124 µs
AES CBC 256 bits 32 bytes Decryption Fast 7471 77 µs
AES CBC 256 bits 64 bytes Decryption Small 21 613 225 µs
AES CBC 256 bits 64 bytes Decryption Fast 10 966 114 µs
AES CBC 256 bits 128 bytes Decryption Small 40 942 426 µs
AES CBC 256 bits 128 bytes Decryption Fast 17 904 186 µs


The table below shows flash memory and RAM usage (in bytes).

Cipher operation Configuration Code Constant data Global data Stack usage
Encryption Small 2960 bytes 380 bytes 1 bytes 524 bytes
Encryption Fast 3292 bytes 1404 bytes 1 bytes 548 bytes
Decryption Small 3056 bytes 636 bytes 1 bytes 552 bytes
Decryption Fast 3716 bytes 1660 bytes 1 bytes 556 bytes


2.1.2. Data flow mode

In this mode, the operation is performed in several calls to the CMOX library APIs, as shown below:

  • cmox_cipher_init
  • cmox_cipher_setKey
  • cmox_cipher_setIV
  • cmox_cipher_append: called several times to encrypt or decrypt the whole message in fixed-size chunks

The table below shows the number of clock cycles and the bit rate (in kilobytes per second) needed to perform the described operation in small and fast configuration.

AES mode Key size Message size Chunk size Cipher operation Configuration Cycles Bit rate
AES CBC 128 bits 8000 bytes 128 bytes Encryption Small 855 584 897 Kbytes/s
AES CBC 128 bits 8000 bytes 128 bytes Encryption Fast 665 720 1153 Kbytes/s
AES CBC 128 bits 8000 bytes 512 bytes Encryption Small 849 752 903 Kbytes/s
AES CBC 128 bits 8000 bytes 512 bytes Encryption Fast 660 224 1163 Kbytes/s
AES CBC 128 bits 8000 bytes 1024 bytes Encryption Small 848 736 904 Kbytes/s
AES CBC 128 bits 8000 bytes 1024 bytes Encryption Fast 659 208 1165 Kbytes/s
AES CBC 128 bits 8000 bytes 2048 bytes Encryption Small 848 240 905 Kbytes/s
AES CBC 128 bits 8000 bytes 2048 bytes Encryption Fast 658 712 1165 Kbytes/s
AES CBC 192 bits 8000 bytes 128 bytes Encryption Small 1 000 584 767 Kbytes/s
AES CBC 192 bits 8000 bytes 128 bytes Encryption Fast 766 200 1002 Kbytes/s
AES CBC 192 bits 8000 bytes 512 bytes Encryption Small 994 776 772 Kbytes/s
AES CBC 192 bits 8000 bytes 512 bytes Encryption Fast 760 816 1009 Kbytes/s
AES CBC 192 bits 8000 bytes 1024 bytes Encryption Small 993 768 772 Kbytes/s
AES CBC 192 bits 8000 bytes 1024 bytes Encryption Fast 759 800 1010 Kbytes/s
AES CBC 192 bits 8000 bytes 2048 bytes Encryption Small 993 272 773 Kbytes/s
AES CBC 192 bits 8000 bytes 2048 bytes Encryption Fast 759 304 1011 Kbytes/s
AES CBC 256 bits 8000 bytes 128 bytes Encryption Small 1 145 584 670 Kbytes/s
AES CBC 256 bits 8000 bytes 128 bytes Encryption Fast 866 688 886 Kbytes/s
AES CBC 256 bits 8000 bytes 512 bytes Encryption Small 1 139 752 673 Kbytes/s
AES CBC 256 bits 8000 bytes 512 bytes Encryption Fast 861 200 891 Kbytes/s
AES CBC 256 bits 8000 bytes 1024 bytes Encryption Small 1 138 728 674 Kbytes/s
AES CBC 256 bits 8000 bytes 1024 bytes Encryption Fast 860 184 892 Kbytes/s
AES CBC 256 bits 8000 bytes 2048 bytes Encryption Small 1 138 240 674 Kbytes/s
AES CBC 256 bits 8000 bytes 2048 bytes Encryption Fast 859 680 893 Kbytes/s
AES CBC 128 bits 8000 bytes 128 bytes Decryption Small 1 761 224 436 Kbytes/s
AES CBC 128 bits 8000 bytes 128 bytes Decryption Fast 694 760 1105 Kbytes/s
AES CBC 128 bits 8000 bytes 512 bytes Decryption Small 1 753 256 438 Kbytes/s
AES CBC 128 bits 8000 bytes 512 bytes Decryption Fast 686 816 1118 Kbytes/s
AES CBC 128 bits 8000 bytes 1024 bytes Decryption Small 1 750 856 438 Kbytes/s
AES CBC 128 bits 8000 bytes 1024 bytes Decryption Fast 684 472 1122 Kbytes/s
AES CBC 128 bits 8000 bytes 2048 bytes Decryption Small 1 748 096 439 Kbytes/s
AES CBC 128 bits 8000 bytes 2048 bytes Decryption Fast 681 744 1126 Kbytes/s
AES CBC 192 bits 8000 bytes 128 bytes Decryption Small 2 102 232 365 Kbytes/s
AES CBC 192 bits 8000 bytes 128 bytes Decryption Fast 796 424 964 Kbytes/s
AES CBC 192 bits 8000 bytes 512 bytes Decryption Small 2 094 240 366 Kbytes/s
AES CBC 192 bits 8000 bytes 512 bytes Decryption Fast 788 456 974 Kbytes/s
AES CBC 192 bits 8000 bytes 1024 bytes Decryption Small 2 091 872 367 Kbytes/s
AES CBC 192 bits 8000 bytes 1024 bytes Decryption Fast 786 224 976 Kbytes/s
AES CBC 192 bits 8000 bytes 2048 bytes Decryption Small 2 089 096 367 Kbytes/s
AES CBC 192 bits 8000 bytes 2048 bytes Decryption Fast 783 512 980 Kbytes/s
AES CBC 256 bits 8000 bytes 128 bytes Decryption Small 2 443 232 314 Kbytes/s
AES CBC 256 bits 8000 bytes 128 bytes Decryption Fast 898 088 855 Kbytes/s
AES CBC 256 bits 8000 bytes 512 bytes Decryption Small 2 435 240 315 Kbytes/s
AES CBC 256 bits 8000 bytes 512 bytes Decryption Fast 890 176 862 Kbytes/s
AES CBC 256 bits 8000 bytes 1024 bytes Decryption Small 2 432 864 315 Kbytes/s
AES CBC 256 bits 8000 bytes 1024 bytes Decryption Fast 887 848 865 Kbytes/s
AES CBC 256 bits 8000 bytes 2048 bytes Decryption Small 2 430 088 316 Kbytes/s
AES CBC 256 bits 8000 bytes 2048 bytes Decryption Fast 885 096 867 Kbytes/s


The table below shows flash memory and RAM usage (in bytes).

Cipher operation Configuration Code Constant data Global data Stack usage
Encryption Small 2852 bytes 372 bytes 1 bytes 140 bytes
Encryption Fast 3184 bytes 1396 bytes 1 bytes 172 bytes
Decryption Small 2948 bytes 628 bytes 1 bytes 176 bytes
Decryption Fast 3608 bytes 1652 bytes 1 bytes 180 bytes


2.2. HASH digest

In this section we provide the performance results for HASH, using different modes of operation:

  • Sole buffer: one sole buffer is hashed. The performance time is given in us.
  • Data flow: a big message is hashed in chunks. The bit rate is given in bytes per second.

2.2.1. Sole buffer mode

In this mode, the entire message hashing process is managed through a single API call provided by the CMOX library.

The table below shows the number of clock cycles and time (in µs) needed to perform the described operation.

HASH mode Buffer size Cycles Time
SHA256 32 bytes 5065 52 µs
SHA256 64 bytes 8224 85 µs
SHA256 128 bytes 11 142 116 µs
SHA384 32 bytes 16 505 171 µs
SHA384 64 bytes 16 692 173 µs
SHA384 128 bytes 30 385 316 µs


The table below shows flash memory and RAM usage (in bytes).

HASH mode Code Constant data Global data Stack usage
SHA256 1780 296 bytes 1 bytes 564 bytes
SHA384 3012 744 bytes 1 bytes 1124 bytes


2.2.2. Data flow mode

In this mode, the operation is performed in several calls to the CMOX library APIs, as shown below:

  • cmox_hash_init
  • cmox_hash_append: called several times to hash the whole message in fixed-size chunks
  • cmox_hash_generateTag

The table below shows the number of clock cycles and the bit rate (in kilobytes per second) needed to perform the described operation.

HASH mode Message size Chunk size Cycles Bit rate
SHA256 8000 bytes 128 bytes 397 664 1931 Kbytes/s
SHA256 8000 bytes 512 bytes 375 492 2045 Kbytes/s
SHA256 8000 bytes 1024 bytes 371 746 2065 Kbytes/s
SHA256 8000 bytes 2048 bytes 369 858 2076 Kbytes/s
SHA384 8000 bytes 128 bytes 876 826 875 Kbytes/s
SHA384 8000 bytes 512 bytes 837 372 917 Kbytes/s
SHA384 8000 bytes 1024 bytes 830 546 924 Kbytes/s
SHA384 8000 bytes 2048 bytes 827 108 928 Kbytes/s


The table below shows the final tag generation done through the call to cmox_hash_generateTag.

HASH mode Cycles Time
SHA256 4272 44 µs
SHA384 15 366 160 µs

The table below shows flash memory and RAM usage (in bytes).

HASH mode Code Constant data Global data Stack usage
SHA256 1788 bytes 288 bytes 1 bytes 372 bytes
SHA384 3020 bytes 736 bytes 1 bytes 828 bytes


2.3. ECDSA signature and verification

This section provides the performance results for ECDSA signature and verification.

The table below shows the number of clock cycles and time (in ms) needed to perform the described operation in different configurations.

Curve Operation ECC mathematics configuration Curve definition Cycles Time
SECP256R1 Signature Small Low 2 918 848 30 ms
SECP256R1 Signature Small High 2 828 848 29 ms
SECP256R1 Signature SuperFast Low 1 901 400 19 ms
SECP256R1 Signature SuperFast High 1 848 864 19 ms
SECP256R1 Verification Small Low 7 005 048 72 ms
SECP256R1 Verification Small High 6 204 712 64 ms
SECP256R1 Verification SuperFast Low 4 633 792 48 ms
SECP256R1 Verification SuperFast High 4 101 264 42 ms
SECP384R1 Signature Small Low 8 256 560 86 ms
SECP384R1 Signature Small High 7 883 240 82 ms
SECP384R1 Signature Fast Low 7 018 672 73 ms
SECP384R1 Signature Fast High 6 712 656 69 ms
SECP384R1 Verification Small Low 19 761 896 205 ms
SECP384R1 Verification Small High 17 125 424 178 ms
SECP384R1 Verification Fast Low 16 877 048 175 ms
SECP384R1 Verification Fast High 14 650 288 152 ms


The table below shows ECDSA flash memory and RAM usage (in bytes).

Curve Operation ECC mathematics configuration Curve definition Code Constant data Global data Stack usage Working buffer
SECP256R1 Signature Small Low 11 636 bytes 1184 bytes 1 bytes 328 bytes 628 bytes
SECP256R1 Signature Small High 11 636 bytes 1568 bytes 1 bytes 328 bytes 696 bytes
SECP256R1 Signature SuperFast Low 12 946 bytes 1184 bytes 1 bytes 332 bytes 628 bytes
SECP256R1 Signature SuperFast High 12 946 bytes 1568 bytes 1 bytes 332 bytes 696 bytes
SECP256R1 Verification Small Low 12 158 bytes 1200 bytes 1 bytes 424 bytes 856 bytes
SECP256R1 Verification Small High 12 158 bytes 1584 bytes 1 bytes 424 bytes 1648 bytes
SECP256R1 Verification SuperFast Low 13 468 bytes 1200 bytes 1 bytes 428 bytes 856 bytes
SECP256R1 Verification SuperFast High 13 468 bytes 1584 bytes 1 bytes 428 bytes 1648 bytes
SECP384R1 Signature Small Low 11 636 bytes 1664 bytes 1 bytes 328 bytes 884 bytes
SECP384R1 Signature Small High 11 636 bytes 2240 bytes 1 bytes 328 bytes 984 bytes
SECP384R1 Signature Fast Low 12 006 bytes 1664 bytes 1 bytes 344 bytes 884 bytes
SECP384R1 Signature Fast High 12 006 bytes 2240 bytes 1 bytes 344 bytes 984 bytes
SECP384R1 Verification Small Low 12 158 bytes 1680 bytes 1 bytes 424 bytes 1192 bytes
SECP384R1 Verification Small High 12 158 bytes 2256 bytes 1 bytes 424 bytes 2272 bytes
SECP384R1 Verification Fast Low 12 528 bytes 1680 bytes 1 bytes 440 bytes 1192 bytes
SECP384R1 Verification Fast High 12 528 bytes 2256 bytes 1 bytes 440 bytes 2272 bytes


2.4. EdDSA signature and verification

This section provides the performance results for EdDSA signature and verification.

The table below shows the number of clock cycles and time (in ms) needed to perform the described operation in different configurations.

Curve Message size Operation ECC mathematics configuration Curve definition Cycles Time
Ed25519 1023 bytes Signature Small OptLow 4 511 448 46 ms
Ed25519 1023 bytes Signature Small OptHigh 2 627 352 27 ms
Ed25519 1023 bytes Signature SuperFast OptLow 3 251 448 33 ms
Ed25519 1023 bytes Signature SuperFast OptHigh 1 901 720 19 ms
Ed25519 1023 bytes Verification Small OptLow 6 792 768 70 ms
Ed25519 1023 bytes Verification Small OptHigh 5 946 112 61 ms
Ed25519 1023 bytes Verification SuperFast OptLow 4 695 536 48 ms
Ed25519 1023 bytes Verification SuperFast OptHigh 4 063 704 42 ms


The table below shows EdDSA flash memory and RAM usage (in bytes).

Curve Message size Operation ECC mathematics configuration Curve definition Code Constant data Global data Stack usage Working buffer
Ed25519 1023 bytes Signature Small OptLow 14 100 bytes 1744 bytes 1 bytes 1236 bytes 1388 bytes
Ed25519 1023 bytes Signature Small OptHigh 14 506 bytes 2896 bytes 1 bytes 1236 bytes 1388 bytes
Ed25519 1023 bytes Signature SuperFast OptLow 15 410 bytes 1744 bytes 1 bytes 1236 bytes 1388 bytes
Ed25519 1023 bytes Signature SuperFast OptHigh 15 816 bytes 2896 bytes 1 bytes 1236 bytes 1388 bytes
Ed25519 1023 bytes Verification Small OptLow 14 186 bytes 1748 bytes 1 bytes 1244 bytes 1152 bytes
Ed25519 1023 bytes Verification Small OptHigh 14 592 bytes 2900 bytes 1 bytes 1244 bytes 1992 bytes
Ed25519 1023 bytes Verification SuperFast OptLow 15 496 bytes 1748 bytes 1 bytes 1244 bytes 1152 bytes
Ed25519 1023 bytes Verification SuperFast OptHigh 15 902 bytes 2900 bytes 1 bytes 1244 bytes 1992 bytes


2.5. RSA signature and verification

This section provides the performance results for RSA signature and verification.

The table below shows the number of clock cycles and time (in ms) needed to perform the described operation in different configurations.

PKCS#1 Priv. key mod. exp. method Hash method Modulus size Operation RSA mathematics configuration Priv. key mod. exp. implementation Cycles Time
v2.2 CRT SHA-256 3K Signature Small Low 198 343 944 2066 ms
v2.2 CRT SHA-256 3K Signature Small Mid 149 283 832 1555 ms
v2.2 CRT SHA-256 3K Signature Small High 125 368 496 1305 ms
v2.2 CRT SHA-256 3K Signature Fast Low 158 201 400 1647 ms
v2.2 CRT SHA-256 3K Signature Fast Mid 119 134 440 1240 ms
v2.2 CRT SHA-256 3K Signature Fast High 100 072 392 1042 ms
v2.2 No CRT SHA-256 3K Signature Small Low 763 430 176 7952 ms
v2.2 No CRT SHA-256 3K Signature Small Mid 573 373 696 5972 ms
v2.2 No CRT SHA-256 3K Signature Small High 479 616 720 4996 ms
v2.2 No CRT SHA-256 3K Signature Fast Low 605 432 704 6306 ms
v2.2 No CRT SHA-256 3K Signature Fast Mid 454 798 528 4737 ms
v2.2 No CRT SHA-256 3K Signature Fast High 380 470 096 3963 ms
v2.2 n/a SHA-256 3K Verification Small n/a 3 799 128 39 ms
v2.2 n/a SHA-256 3K Verification Fast n/a 3 285 168 34 ms


The table below shows RSA flash memory and RAM usage (in bytes).

PKCS#1 Priv. key mod. exp. method Hash method Modulus size Operation RSA mathematics configuration Priv. key mod. exp. implementation Code Constant data Global data Stack usage Working buffer
v2.2 CRT SHA-256 3K Signature Small Low 6986 bytes 372 bytes 5 bytes 700 bytes 3704 bytes
v2.2 CRT SHA-256 3K Signature Small Mid 7234 bytes 372 bytes 5 bytes 700 bytes 4308 bytes
v2.2 CRT SHA-256 3K Signature Small High 7234 bytes 372 bytes 5 bytes 700 bytes 6708 bytes
v2.2 CRT SHA-256 3K Signature Fast Low 7356 bytes 372 bytes 5 bytes 700 bytes 3704 bytes
v2.2 CRT SHA-256 3K Signature Fast Mid 7604 bytes 372 bytes 5 bytes 700 bytes 4308 bytes
v2.2 CRT SHA-256 3K Signature Fast High 7604 bytes 372 bytes 5 bytes 700 bytes 6708 bytes
v2.2 No CRT SHA-256 3K Signature Small Low 6016 bytes 364 bytes 5 bytes 700 bytes 3484 bytes
v2.2 No CRT SHA-256 3K Signature Small Mid 6264 bytes 364 bytes 5 bytes 700 bytes 4664 bytes
v2.2 No CRT SHA-256 3K Signature Small High 6264 bytes 364 bytes 5 bytes 700 bytes 9368 bytes
v2.2 No CRT SHA-256 3K Signature Fast Low 6386 bytes 364 bytes 5 bytes 700 bytes 3484 bytes
v2.2 No CRT SHA-256 3K Signature Fast Mid 6634 bytes 364 bytes 5 bytes 700 bytes 4664 bytes
v2.2 No CRT SHA-256 3K Signature Fast High 6634 bytes 364 bytes 5 bytes 700 bytes 9368 bytes
v2.2 n/a SHA-256 3K Verification Small n/a 6762 bytes 368 bytes 5 bytes 716 bytes 3108 bytes
v2.2 n/a SHA-256 3K Verification Fast n/a 7132 bytes 368 bytes 5 bytes 716 bytes 3108 bytes


Retrieved from "https://wiki.st.com/stm32mcu/index.php?title=Security:STM32U3_Series:_Cryptographic_Library_Performance_V4.x&oldid=86397"