Cryptographic performance on STM32U3 Series V5.x

This message will disappear after all relevant tasks have been resolved.
Semantic MediaWiki
There are 1 incomplete or pending task to finish installation of Semantic MediaWiki. An administrator or user with sufficient rights can complete it. This should be done before adding new data to avoid inconsistencies.

This page shows the measured performance results when using the pure software cryptographic library algorithms with an STM32U3 MCU. In addition to performance figures, it also gives the required code footprint and memory.


1. Measurement configuration

1.1. Hardware configuration

STM32 MCU STM32U385RGTxQ
Device ID 0x454
Revision ID 0x1001
Board NUCLEO-U385RG-Q

1.2. Firmware configuration

Cryptographic library version 050000B2[ver. 1]
  1. ↑ This value corresponds to the information returned by a call to cmox_getInfos

1.3. System configuration

System core clock frequency 96 MHz
Flash latency 2 wait states
Voltage scaling Range 1
ICACHE peripheral 1 (0: disabled / 1: enabled)
Prefetch cache (ART) 1 (0: disabled / 1: enabled)

1.4. Development toolchains and compilers

IAR Embedded Workbench IAR ANSI C/C++ Compiler V9.40.1.364/W64 for ARM
Information
The measurements are done using a project built with the High Speed optimization setting enabled.


2. Performance values

2.1. AES symmetric key encryption and decryption

This section provides the performance results for AES-CBC using different operation modes:

  • Sole buffer: one sole buffer is encrypted or decrypted. The performance time is given in µs.
  • Data flow: a big message is encrypted or decrypted in chunks. The bit rate is given in kilobytes per second.

2.1.1. Sole buffer mode

In this mode, the entire encryption or decryption process, for the full message size, is managed through a single API call provided by the CMOX library.

The table below shows the number of clock cycles and time (in µs) needed to perform the described operation in small and fast configurations.

AES mode Key size Buffer size Cipher operation Configuration Cycles Time
AES CBC 128 bits 32 bytes Encryption Small 3672 38 µs
AES CBC 128 bits 32 bytes Encryption Fast 3184 33 µs
AES CBC 128 bits 64 bytes Encryption Small 6319 65 µs
AES CBC 128 bits 64 bytes Encryption Fast 5260 54 µs
AES CBC 128 bits 128 bytes Encryption Small 11 609 120 µs
AES CBC 128 bits 128 bytes Encryption Fast 9443 98 µs
AES CBC 192 bits 32 bytes Encryption Small 4029 41 µs
AES CBC 192 bits 32 bytes Encryption Fast 3426 35 µs
AES CBC 192 bits 64 bytes Encryption Small 7099 73 µs
AES CBC 192 bits 64 bytes Encryption Fast 5811 60 µs
AES CBC 192 bits 128 bytes Encryption Small 13 227 137 µs
AES CBC 192 bits 128 bytes Encryption Fast 10 601 110 µs
AES CBC 256 bits 32 bytes Encryption Small 4591 47 µs
AES CBC 256 bits 32 bytes Encryption Fast 3855 40 µs
AES CBC 256 bits 64 bytes Encryption Small 8081 84 µs
AES CBC 256 bits 64 bytes Encryption Fast 6555 68 µs
AES CBC 256 bits 128 bytes Encryption Small 15 054 156 µs
AES CBC 256 bits 128 bytes Encryption Fast 11 936 124 µs
AES CBC 128 bits 32 bytes Decryption Small 4947 51 µs
AES CBC 128 bits 32 bytes Decryption Fast 4491 46 µs
AES CBC 128 bits 64 bytes Decryption Small 8794 91 µs
AES CBC 128 bits 64 bytes Decryption Fast 6610 68 µs
AES CBC 128 bits 128 bytes Decryption Small 16 443 171 µs
AES CBC 128 bits 128 bytes Decryption Fast 10 851 113 µs
AES CBC 192 bits 32 bytes Decryption Small 5581 58 µs
AES CBC 192 bits 32 bytes Decryption Fast 5035 52 µs
AES CBC 192 bits 64 bytes Decryption Small 10 107 105 µs
AES CBC 192 bits 64 bytes Decryption Fast 7477 77 µs
AES CBC 192 bits 128 bytes Decryption Small 19 119 199 µs
AES CBC 192 bits 128 bytes Decryption Fast 12 288 128 µs
AES CBC 256 bits 32 bytes Decryption Small 6377 66 µs
AES CBC 256 bits 32 bytes Decryption Fast 5790 60 µs
AES CBC 256 bits 64 bytes Decryption Small 11 581 120 µs
AES CBC 256 bits 64 bytes Decryption Fast 8505 88 µs
AES CBC 256 bits 128 bytes Decryption Small 21 965 228 µs
AES CBC 256 bits 128 bytes Decryption Fast 13 925 145 µs


The table below shows flash memory and RAM usage (in bytes).

Cipher operation Configuration Code Constant data Global data Stack usage
Encryption Small 2386 bytes 324 bytes 0 bytes 552 bytes
Encryption Fast 2330 bytes 1092 bytes 0 bytes 552 bytes
Decryption Small 2746 bytes 580 bytes 0 bytes 568 bytes
Decryption Fast 2696 bytes 2372 bytes 0 bytes 568 bytes


2.1.2. Data flow mode

In this mode, the operation is performed in several calls to the CMOX library APIs, as shown below:

  • cmox_cipher_init
  • cmox_cipher_setKey
  • cmox_cipher_setIV
  • cmox_cipher_append: called several times to encrypt or decrypt the whole message in fixed-size chunks

The table below shows the number of clock cycles and the bit rate (in kilobytes per second) needed to perform the described operation in small and fast configuration.

AES mode Key size Message size Chunk size Cipher operation Configuration Cycles Bit rate
AES CBC 128 bits 8000 bytes 128 bytes Encryption Small 668 280 1149 Kbytes/s
AES CBC 128 bits 8000 bytes 128 bytes Encryption Fast 532 208 1443 Kbytes/s
AES CBC 128 bits 8000 bytes 512 bytes Encryption Small 663 048 1158 Kbytes/s
AES CBC 128 bits 8000 bytes 512 bytes Encryption Fast 527 152 1456 Kbytes/s
AES CBC 128 bits 8000 bytes 1024 bytes Encryption Small 662 136 1159 Kbytes/s
AES CBC 128 bits 8000 bytes 1024 bytes Encryption Fast 526 240 1459 Kbytes/s
AES CBC 128 bits 8000 bytes 2048 bytes Encryption Small 661 680 1160 Kbytes/s
AES CBC 128 bits 8000 bytes 2048 bytes Encryption Fast 525 776 1460 Kbytes/s
AES CBC 192 bits 8000 bytes 128 bytes Encryption Small 773 288 993 Kbytes/s
AES CBC 192 bits 8000 bytes 128 bytes Encryption Fast 606 232 1266 Kbytes/s
AES CBC 192 bits 8000 bytes 512 bytes Encryption Small 768 056 999 Kbytes/s
AES CBC 192 bits 8000 bytes 512 bytes Encryption Fast 601 216 1277 Kbytes/s
AES CBC 192 bits 8000 bytes 1024 bytes Encryption Small 767 144 1001 Kbytes/s
AES CBC 192 bits 8000 bytes 1024 bytes Encryption Fast 600 304 1279 Kbytes/s
AES CBC 192 bits 8000 bytes 2048 bytes Encryption Small 766 688 1001 Kbytes/s
AES CBC 192 bits 8000 bytes 2048 bytes Encryption Fast 599 848 1280 Kbytes/s
AES CBC 256 bits 8000 bytes 128 bytes Encryption Small 878 288 874 Kbytes/s
AES CBC 256 bits 8000 bytes 128 bytes Encryption Fast 680 200 1129 Kbytes/s
AES CBC 256 bits 8000 bytes 512 bytes Encryption Small 873 048 879 Kbytes/s
AES CBC 256 bits 8000 bytes 512 bytes Encryption Fast 675 096 1137 Kbytes/s
AES CBC 256 bits 8000 bytes 1024 bytes Encryption Small 872 136 880 Kbytes/s
AES CBC 256 bits 8000 bytes 1024 bytes Encryption Fast 674 176 1139 Kbytes/s
AES CBC 256 bits 8000 bytes 2048 bytes Encryption Small 871 672 881 Kbytes/s
AES CBC 256 bits 8000 bytes 2048 bytes Encryption Fast 673 720 1139 Kbytes/s
AES CBC 128 bits 8000 bytes 128 bytes Decryption Small 985 384 779 Kbytes/s
AES CBC 128 bits 8000 bytes 128 bytes Decryption Fast 557 496 1377 Kbytes/s
AES CBC 128 bits 8000 bytes 512 bytes Decryption Small 977 688 785 Kbytes/s
AES CBC 128 bits 8000 bytes 512 bytes Decryption Fast 549 920 1396 Kbytes/s
AES CBC 128 bits 8000 bytes 1024 bytes Decryption Small 975 360 787 Kbytes/s
AES CBC 128 bits 8000 bytes 1024 bytes Decryption Fast 547 576 1402 Kbytes/s
AES CBC 128 bits 8000 bytes 2048 bytes Decryption Small 972 632 789 Kbytes/s
AES CBC 128 bits 8000 bytes 2048 bytes Decryption Fast 544 792 1409 Kbytes/s
AES CBC 192 bits 8000 bytes 128 bytes Decryption Small 1 155 392 664 Kbytes/s
AES CBC 192 bits 8000 bytes 128 bytes Decryption Fast 631 424 1216 Kbytes/s
AES CBC 192 bits 8000 bytes 512 bytes Decryption Small 1 147 696 669 Kbytes/s
AES CBC 192 bits 8000 bytes 512 bytes Decryption Fast 623 792 1231 Kbytes/s
AES CBC 192 bits 8000 bytes 1024 bytes Decryption Small 1 145 360 670 Kbytes/s
AES CBC 192 bits 8000 bytes 1024 bytes Decryption Fast 621 472 1235 Kbytes/s
AES CBC 192 bits 8000 bytes 2048 bytes Decryption Small 1 142 600 672 Kbytes/s
AES CBC 192 bits 8000 bytes 2048 bytes Decryption Fast 618 680 1241 Kbytes/s
AES CBC 256 bits 8000 bytes 128 bytes Decryption Small 1 325 384 579 Kbytes/s
AES CBC 256 bits 8000 bytes 128 bytes Decryption Fast 705 456 1088 Kbytes/s
AES CBC 256 bits 8000 bytes 512 bytes Decryption Small 1 317 720 582 Kbytes/s
AES CBC 256 bits 8000 bytes 512 bytes Decryption Fast 697 896 1100 Kbytes/s
AES CBC 256 bits 8000 bytes 1024 bytes Decryption Small 1 315 376 583 Kbytes/s
AES CBC 256 bits 8000 bytes 1024 bytes Decryption Fast 695 568 1104 Kbytes/s
AES CBC 256 bits 8000 bytes 2048 bytes Decryption Small 1 312 608 585 Kbytes/s
AES CBC 256 bits 8000 bytes 2048 bytes Decryption Fast 692 792 1108 Kbytes/s


The table below shows flash memory and RAM usage (in bytes).

Cipher operation Configuration Code Constant data Global data Stack usage
Encryption Small 2306 bytes 316 bytes 0 bytes 176 bytes
Encryption Fast 2250 bytes 1084 bytes 0 bytes 176 bytes
Decryption Small 2666 bytes 572 bytes 0 bytes 192 bytes
Decryption Fast 2616 bytes 2364 bytes 0 bytes 192 bytes


2.2. HASH digest

In this section we provide the performance results for HASH, using different modes of operation:

  • Sole buffer: one sole buffer is hashed. The performance time is given in us.
  • Data flow: a big message is hashed in chunks. The bit rate is given in bytes per second.

2.2.1. Sole buffer mode

In this mode, the entire message hashing process is managed through a single API call provided by the CMOX library.

The table below shows the number of clock cycles and time (in µs) needed to perform the described operation.

HASH mode Buffer size Cycles Time
SHA256 32 bytes 4068 42 µs
SHA256 64 bytes 7135 74 µs
SHA256 128 bytes 9992 104 µs
SHA384 32 bytes 15 342 159 µs
SHA384 64 bytes 15 515 161 µs
SHA384 128 bytes 28 923 301 µs


The table below shows flash memory and RAM usage (in bytes).

HASH mode Code Constant data Global data Stack usage
SHA256 1378 280 bytes 0 bytes 532 bytes
SHA384 2590 728 bytes 0 bytes 1076 bytes


2.2.2. Data flow mode

In this mode, the operation is performed in several calls to the CMOX library APIs, as shown below:

  • cmox_hash_init
  • cmox_hash_append: called several times to hash the whole message in fixed-size chunks
  • cmox_hash_generateTag

The table below shows the number of clock cycles and the bit rate (in kilobytes per second) needed to perform the described operation.

HASH mode Message size Chunk size Cycles Bit rate
SHA256 8000 bytes 128 bytes 386 078 1989 Kbytes/s
SHA256 8000 bytes 512 bytes 364 406 2107 Kbytes/s
SHA256 8000 bytes 1024 bytes 360 752 2128 Kbytes/s
SHA256 8000 bytes 2048 bytes 358 929 2139 Kbytes/s
SHA384 8000 bytes 128 bytes 858 548 894 Kbytes/s
SHA384 8000 bytes 512 bytes 819 692 936 Kbytes/s
SHA384 8000 bytes 1024 bytes 812 961 944 Kbytes/s
SHA384 8000 bytes 2048 bytes 809 579 948 Kbytes/s


The table below shows the final tag generation done through the call to cmox_hash_generateTag.

HASH mode Cycles Time
SHA256 3371 35 µs
SHA384 14 261 148 µs

The table below shows flash memory and RAM usage (in bytes).

HASH mode Code Constant data Global data Stack usage
SHA256 1374 bytes 272 bytes 0 bytes 340 bytes
SHA384 2586 bytes 720 bytes 0 bytes 780 bytes


2.3. ECDSA signature and verification

This section provides the performance results for ECDSA signature and verification.

The table below shows the number of clock cycles and time (in ms) needed to perform the described operation in different configurations.

Curve Operation ECC mathematics configuration Curve definition Cycles Time
SECP256R1 Signature Small Low 2 874 456 29 ms
SECP256R1 Signature Small High 2 811 544 29 ms
SECP256R1 Signature SuperFast Low 1 900 192 19 ms
SECP256R1 Signature SuperFast High 1 828 304 19 ms
SECP256R1 Verification Small Low 6 896 824 71 ms
SECP256R1 Verification Small High 6 164 240 64 ms
SECP256R1 Verification SuperFast Low 4 653 080 48 ms
SECP256R1 Verification SuperFast High 4 076 936 42 ms
SECP384R1 Signature Small Low 8 165 704 85 ms
SECP384R1 Signature Small High 7 859 056 81 ms
SECP384R1 Signature Fast Low 7 014 408 73 ms
SECP384R1 Signature Fast High 6 579 048 68 ms
SECP384R1 Verification Small Low 19 525 256 203 ms
SECP384R1 Verification Small High 17 082 392 177 ms
SECP384R1 Verification Fast Low 16 882 240 175 ms
SECP384R1 Verification Fast High 14 369 720 149 ms


The table below shows ECDSA flash memory and RAM usage (in bytes).

Note
The footpring is measured using the general-purpose CMOX_ECC_XXX_HIGHMEM or CMOX_ECC_XXX_LOWMEM configuration, which shows the footprint increase compared with the V4.x.x. To reduce the footprint, the optimized confinguration CMOX_ECC_XXX_YYY_SIGN or CMOX_ECC_XXX_YYY_VERIFY is recommended.
Curve Operation ECC mathematics configuration Curve definition Code Constant data Global data Stack usage Working buffer
SECP256R1 Signature Small Low 13 468 bytes 1212 bytes 0 bytes 440 bytes 628 bytes
SECP256R1 Signature Small High 13 468 bytes 1596 bytes 0 bytes 440 bytes 696 bytes
SECP256R1 Signature SuperFast Low 14 778 bytes 1212 bytes 0 bytes 444 bytes 628 bytes
SECP256R1 Signature SuperFast High 14 778 bytes 1596 bytes 0 bytes 444 bytes 696 bytes
SECP256R1 Verification Small Low 13 456 bytes 1212 bytes 0 bytes 488 bytes 856 bytes
SECP256R1 Verification Small High 13 456 bytes 1596 bytes 0 bytes 488 bytes 1648 bytes
SECP256R1 Verification SuperFast Low 14 766 bytes 1212 bytes 0 bytes 492 bytes 856 bytes
SECP256R1 Verification SuperFast High 14 766 bytes 1596 bytes 0 bytes 492 bytes 1648 bytes
SECP384R1 Signature Small Low 13 468 bytes 1692 bytes 0 bytes 440 bytes 884 bytes
SECP384R1 Signature Small High 13 468 bytes 2268 bytes 0 bytes 440 bytes 984 bytes
SECP384R1 Signature Fast Low 13 838 bytes 1692 bytes 0 bytes 456 bytes 884 bytes
SECP384R1 Signature Fast High 13 838 bytes 2268 bytes 0 bytes 456 bytes 984 bytes
SECP384R1 Verification Small Low 13 456 bytes 1692 bytes 0 bytes 488 bytes 1192 bytes
SECP384R1 Verification Small High 13 456 bytes 2268 bytes 0 bytes 488 bytes 2272 bytes
SECP384R1 Verification Fast Low 13 826 bytes 1692 bytes 0 bytes 504 bytes 1192 bytes
SECP384R1 Verification Fast High 13 826 bytes 2268 bytes 0 bytes 504 bytes 2272 bytes


2.4. EdDSA signature and verification

This section provides the performance results for EdDSA signature and verification.

The table below shows the number of clock cycles and time (in ms) needed to perform the described operation in different configurations.

Curve Message size Operation ECC mathematics configuration Curve definition Cycles Time
Ed25519 1023 bytes Signature Small OptLow 4 429 144 46 ms
Ed25519 1023 bytes Signature Small OptHigh 2 566 584 26 ms
Ed25519 1023 bytes Signature SuperFast OptLow 3 156 904 32 ms
Ed25519 1023 bytes Signature SuperFast OptHigh 1 862 232 19 ms
Ed25519 1023 bytes Verification Small OptLow 6 669 856 69 ms
Ed25519 1023 bytes Verification Small OptHigh 5 834 880 60 ms
Ed25519 1023 bytes Verification SuperFast OptLow 4 578 432 47 ms
Ed25519 1023 bytes Verification SuperFast OptHigh 4 013 480 41 ms


The table below shows EdDSA flash memory and RAM usage (in bytes).

Note
The footpring is measured using the general-purpose CMOX_ECC_XXX_HIGHMEM or CMOX_ECC_XXX_LOWMEM configuration, which shows the footprint increase compared with the V4.x.x. To reduce the footprint, the optimized confinguration CMOX_ECC_XXX_YYY_SIGN or CMOX_ECC_XXX_YYY_VERIFY is recommended.
Curve Message size Operation ECC mathematics configuration Curve definition Code Constant data Global data Stack usage Working buffer
Ed25519 1023 bytes Signature Small OptLow 14 840 bytes 1748 bytes 0 bytes 1172 bytes 1672 bytes
Ed25519 1023 bytes Signature Small OptHigh 15 260 bytes 2900 bytes 0 bytes 1172 bytes 1672 bytes
Ed25519 1023 bytes Signature SuperFast OptLow 16 150 bytes 1748 bytes 0 bytes 1172 bytes 1672 bytes
Ed25519 1023 bytes Signature SuperFast OptHigh 16 570 bytes 2900 bytes 0 bytes 1172 bytes 1672 bytes
Ed25519 1023 bytes Verification Small OptLow 14 836 bytes 1748 bytes 0 bytes 1172 bytes 984 bytes
Ed25519 1023 bytes Verification Small OptHigh 15 256 bytes 2900 bytes 0 bytes 1172 bytes 1992 bytes
Ed25519 1023 bytes Verification SuperFast OptLow 16 146 bytes 1748 bytes 0 bytes 1172 bytes 984 bytes
Ed25519 1023 bytes Verification SuperFast OptHigh 16 566 bytes 2900 bytes 0 bytes 1172 bytes 1992 bytes


2.5. RSA signature and verification

This section provides the performance results for RSA signature and verification.

The table below shows the number of clock cycles and time (in ms) needed to perform the described operation in different configurations.

PKCS#1 Priv. key mod. exp. method Hash method Modulus size Operation RSA mathematics configuration Priv. key mod. exp. implementation Cycles Time
v2.2 CRT SHA-256 3K Signature Small Low 197 726 776 2059 ms
v2.2 CRT SHA-256 3K Signature Small Mid 148 814 880 1550 ms
v2.2 CRT SHA-256 3K Signature Small High 124 974 424 1301 ms
v2.2 CRT SHA-256 3K Signature Fast Low 158 845 736 1654 ms
v2.2 CRT SHA-256 3K Signature Fast Mid 119 613 032 1245 ms
v2.2 CRT SHA-256 3K Signature Fast High 100 473 128 1046 ms
v2.2 No CRT SHA-256 3K Signature Small Low 762 181 864 7939 ms
v2.2 No CRT SHA-256 3K Signature Small Mid 572 421 048 5962 ms
v2.2 No CRT SHA-256 3K Signature Small High 478 812 944 4987 ms
v2.2 No CRT SHA-256 3K Signature Fast Low 606 772 640 6320 ms
v2.2 No CRT SHA-256 3K Signature Fast Mid 455 788 408 4747 ms
v2.2 No CRT SHA-256 3K Signature Fast High 381 290 368 3971 ms
v2.2 n/a SHA-256 3K Verification Small n/a 3 745 608 39 ms
v2.2 n/a SHA-256 3K Verification Fast n/a 3 239 984 33 ms


The table below shows RSA flash memory and RAM usage (in bytes).

PKCS#1 Priv. key mod. exp. method Hash method Modulus size Operation RSA mathematics configuration Priv. key mod. exp. implementation Code Constant data Global data Stack usage Working buffer
v2.2 CRT SHA-256 3K Signature Small Low 6890 bytes 372 bytes 0 bytes 668 bytes 3704 bytes
v2.2 CRT SHA-256 3K Signature Small Mid 7126 bytes 372 bytes 0 bytes 668 bytes 4308 bytes
v2.2 CRT SHA-256 3K Signature Small High 7126 bytes 372 bytes 0 bytes 668 bytes 6708 bytes
v2.2 CRT SHA-256 3K Signature Fast Low 7260 bytes 372 bytes 0 bytes 668 bytes 3704 bytes
v2.2 CRT SHA-256 3K Signature Fast Mid 7496 bytes 372 bytes 0 bytes 668 bytes 4308 bytes
v2.2 CRT SHA-256 3K Signature Fast High 7496 bytes 372 bytes 0 bytes 668 bytes 6708 bytes
v2.2 No CRT SHA-256 3K Signature Small Low 5958 bytes 364 bytes 0 bytes 668 bytes 3484 bytes
v2.2 No CRT SHA-256 3K Signature Small Mid 6194 bytes 364 bytes 0 bytes 668 bytes 4664 bytes
v2.2 No CRT SHA-256 3K Signature Small High 6194 bytes 364 bytes 0 bytes 668 bytes 9368 bytes
v2.2 No CRT SHA-256 3K Signature Fast Low 6328 bytes 364 bytes 0 bytes 668 bytes 3484 bytes
v2.2 No CRT SHA-256 3K Signature Fast Mid 6564 bytes 364 bytes 0 bytes 668 bytes 4664 bytes
v2.2 No CRT SHA-256 3K Signature Fast High 6564 bytes 364 bytes 0 bytes 668 bytes 9368 bytes
v2.2 n/a SHA-256 3K Verification Small n/a 6142 bytes 368 bytes 0 bytes 684 bytes 3108 bytes
v2.2 n/a SHA-256 3K Verification Fast n/a 6512 bytes 368 bytes 0 bytes 684 bytes 3108 bytes


2.6. Post-Quantum Cryptography ML-DSA key pair generation, Signature and verification

This section provides the performance results for ML-DSA key pair generation, signature and verification.

The table below shows the number of clock cycles and time (in ms) needed to perform the described function in different suites and functions configurations. Note: For signature generation, the number of clock cycles is not bounded in time. The measurement was taken using one predefined private key and one 32-byte message, and the reported value corresponds to the minimum observed time.

Suite Function Cycles Time (in ms) Stack usage Working buffer
ML-DSA-44 keyGen 1 988 616 20 476 7116
ML-DSA-65 keyGen 3 443 896 35 476 8140
ML-DSA-87 keyGen 5 795 152 60 476 10 188
ML-DSA-44 Signature 3 549 040 36 772 30 796
ML-DSA-44 Signature Low RAM 3 811 968 39 756 11 340
ML-DSA-65 Signature 5 459 216 56 772 43 084
ML-DSA-65 Signature Low RAM 5 797 488 60 756 15 436
ML-DSA-87 Signature 8 541 328 88 772 57 420
ML-DSA-87 Signature Low RAM 9 008 800 93 756 19 532
ML-DSA-44 Verification 2 244 248 23 700 8908
ML-DSA-44 Verification Low RAM 3 036 096 31 700 4812
ML-DSA-65 Verification 3 685 000 38 700 9948
ML-DSA-65 Verification Low RAM 5 302 640 55 700 4828
ML-DSA-87 Verification 6 118 224 63 700 12 268
ML-DSA-87 Verification Low RAM 9 125 624 95 700 5100

2.7. Post-Quantum Cryptography ML-KEM key pair generation, encapsulation, decapsulation

This section is under construction.

2.8. Post-Quantum Cryptography HBS-LMS signature verification

This section is under construction.

Retrieved from "https://wiki.st.com/stm32mcu/index.php?title=Security:STM32U3_Series:_Cryptographic_Library_Performance_V5.x&oldid=88459"