Cryptographic performance on STM32H7 series MCUs


This page reports measured performance when using the pure software cryptographic library algorithms with the STM32H7 MCUs. In addition to performance figures, the required code footprint and memory are also given.


This section reports the performance using the STM32H753 MCU. Measurements are done while executing the code from the internal flash memory.

1. Measurement configuration

1.1. Hardware configuration

STM32 MCU STM32H753ZI
Device ID 0x450
Revision ID 0x2003
Board NUCLEO-H753ZI

1.2. Firmware configuration

Cryptographic library version 040000B1[ver. 1]
  1. ↑ This value corresponds to the information returned by a call to cmox_getInfos.

1.3. System configuration

System core clock frequency 400 MHz
Flash latency 4 wait states
Voltage scaling Range 3
Instruction cache (ART/ICU) 1 (0: disabled / 1: enabled)
Data cache (ART/DCU) 1 (0: disabled / 1: enabled)

1.4. Development toolchains and compilers

IAR Embedded Workbench IAR ANSI C/C++ Compiler V9.20.4.327/W64 for ARM
Info white.png Information
The measurements are done using a project built with the High Speed optimization setting enabled.

2. Performance values

2.1. AES symmetric key encryption and decryption

This section provides the performance results for AES-CBC using different operation modes:

  • Sole buffer: one sole buffer is encrypted or decrypted. The time to perform is given in µs.
  • Data flow: a large message is encrypted or decrypted by chunk. The bit rate is given in kilobytes per second.

2.1.1. Sole buffer mode

In this mode, the entire encryption or decryption process, for the entire message size, is managed through a single API call provided by the CMOX library.

The table below shows the number of clock cycles and time (in µs) needed to perform the described operation in small and fast configurations.

AES mode Key size Buffer size Cipher operation Configuration Cycles Time
AES CBC 128 bits 32 bytes Encryption Small 3824 9 µs
AES CBC 128 bits 32 bytes Encryption Fast 3257 8 µs
AES CBC 128 bits 64 bytes Encryption Small 5901 14 µs
AES CBC 128 bits 64 bytes Encryption Fast 4701 11 µs
AES CBC 128 bits 128 bytes Encryption Small 10 156 25 µs
AES CBC 128 bits 128 bytes Encryption Fast 7781 19 µs
AES CBC 192 bits 32 bytes Encryption Small 4223 10 µs
AES CBC 192 bits 32 bytes Encryption Fast 3424 8 µs
AES CBC 192 bits 64 bytes Encryption Small 6660 16 µs
AES CBC 192 bits 64 bytes Encryption Fast 5138 12 µs
AES CBC 192 bits 128 bytes Encryption Small 11 599 28 µs
AES CBC 192 bits 128 bytes Encryption Fast 8677 21 µs
AES CBC 256 bits 32 bytes Encryption Small 4730 11 µs
AES CBC 256 bits 32 bytes Encryption Fast 3863 9 µs
AES CBC 256 bits 64 bytes Encryption Small 7543 18 µs
AES CBC 256 bits 64 bytes Encryption Fast 5839 14 µs
AES CBC 256 bits 128 bytes Encryption Small 13 128 32 µs
AES CBC 256 bits 128 bytes Encryption Fast 9829 24 µs
AES CBC 128 bits 32 bytes Decryption Small 6589 16 µs
AES CBC 128 bits 32 bytes Decryption Fast 3871 9 µs
AES CBC 128 bits 64 bytes Decryption Small 11 458 28 µs
AES CBC 128 bits 64 bytes Decryption Fast 5272 13 µs
AES CBC 128 bits 128 bytes Decryption Small 21 243 53 µs
AES CBC 128 bits 128 bytes Decryption Fast 8281 20 µs
AES CBC 192 bits 32 bytes Decryption Small 7535 18 µs
AES CBC 192 bits 32 bytes Decryption Fast 4261 10 µs
AES CBC 192 bits 64 bytes Decryption Small 13 399 33 µs
AES CBC 192 bits 64 bytes Decryption Fast 5855 14 µs
AES CBC 192 bits 128 bytes Decryption Small 25 100 62 µs
AES CBC 192 bits 128 bytes Decryption Fast 9256 23 µs
AES CBC 256 bits 32 bytes Decryption Small 8689 21 µs
AES CBC 256 bits 32 bytes Decryption Fast 4765 11 µs
AES CBC 256 bits 64 bytes Decryption Small 15 496 38 µs
AES CBC 256 bits 64 bytes Decryption Fast 6675 16 µs
AES CBC 256 bits 128 bytes Decryption Small 29 155 72 µs
AES CBC 256 bits 128 bytes Decryption Fast 10 515 26 µs
Cryptolib STM32H753 AES CBC SB Enc.svg
Cryptolib STM32H753 AES CBC SB Dec.svg


The table below shows flash memory and RAM usage (in bytes).

Cipher operation Configuration Code Constant data Global data Stack usage
Encryption Small 2948 bytes 380 bytes 1 byte 528 bytes
Encryption Fast 3268 bytes 1404 bytes 1 byte 548 bytes
Decryption Small 3060 bytes 636 bytes 1 byte 552 bytes
Decryption Fast 3720 bytes 1660 bytes 1 byte 560 bytes
Cryptolib STM32H753 AES CBC SB Enc FP.svg
Cryptolib STM32H753 AES CBC SB Dec FP.svg


2.1.2. Data flow mode

In this mode, the operation is performed in several calls to the CMOX library APIs, as below:

  • cmox_cipher_init
  • cmox_cipher_setKey
  • cmox_cipher_setIV
  • cmox_cipher_append: called several times to encrypt or decrypt the entire message by fixed-size chunk

The table below shows the number of clock cycles and bit rate (in kilobytes per second) needed to perform the described operation in small and fast configuration.

AES mode Key size Message size Chunk size Cipher operation Configuration Cycles Bit rate
AES CBC 128 bits 8000 bytes 128 bytes Encryption Small 534 952 5981 Kbytes/s
AES CBC 128 bits 8000 bytes 128 bytes Encryption Fast 394 520 8111 Kbytes/s
AES CBC 128 bits 8000 bytes 512 bytes Encryption Small 528 872 6050 Kbytes/s
AES CBC 128 bits 8000 bytes 512 bytes Encryption Fast 387 992 8247 Kbytes/s
AES CBC 128 bits 8000 bytes 1024 bytes Encryption Small 528 144 6058 Kbytes/s
AES CBC 128 bits 8000 bytes 1024 bytes Encryption Fast 387 040 8267 Kbytes/s
AES CBC 128 bits 8000 bytes 2048 bytes Encryption Small 527 688 6064 Kbytes/s
AES CBC 128 bits 8000 bytes 2048 bytes Encryption Fast 386 536 8278 Kbytes/s
AES CBC 192 bits 8000 bytes 128 bytes Encryption Small 624 032 5127 Kbytes/s
AES CBC 192 bits 8000 bytes 128 bytes Encryption Fast 450 496 7103 Kbytes/s
AES CBC 192 bits 8000 bytes 512 bytes Encryption Small 617 800 5179 Kbytes/s
AES CBC 192 bits 8000 bytes 512 bytes Encryption Fast 444 176 7204 Kbytes/s
AES CBC 192 bits 8000 bytes 1024 bytes Encryption Small 617 304 5183 Kbytes/s
AES CBC 192 bits 8000 bytes 1024 bytes Encryption Fast 442 632 7229 Kbytes/s
AES CBC 192 bits 8000 bytes 2048 bytes Encryption Small 616 824 5187 Kbytes/s
AES CBC 192 bits 8000 bytes 2048 bytes Encryption Fast 442 304 7234 Kbytes/s
AES CBC 256 bits 8000 bytes 128 bytes Encryption Small 712 824 4489 Kbytes/s
AES CBC 256 bits 8000 bytes 128 bytes Encryption Fast 507 040 6311 Kbytes/s
AES CBC 256 bits 8000 bytes 512 bytes Encryption Small 706 808 4527 Kbytes/s
AES CBC 256 bits 8000 bytes 512 bytes Encryption Fast 499 816 6402 Kbytes/s
AES CBC 256 bits 8000 bytes 1024 bytes Encryption Small 706 264 4530 Kbytes/s
AES CBC 256 bits 8000 bytes 1024 bytes Encryption Fast 499 616 6404 Kbytes/s
AES CBC 256 bits 8000 bytes 2048 bytes Encryption Small 705 720 4534 Kbytes/s
AES CBC 256 bits 8000 bytes 2048 bytes Encryption Fast 499 152 6410 Kbytes/s
AES CBC 128 bits 8000 bytes 128 bytes Decryption Small 1 238 288 2584 Kbytes/s
AES CBC 128 bits 8000 bytes 128 bytes Decryption Fast 391 176 8180 Kbytes/s
AES CBC 128 bits 8000 bytes 512 bytes Decryption Small 1 233 584 2594 Kbytes/s
AES CBC 128 bits 8000 bytes 512 bytes Decryption Fast 385 608 8298 Kbytes/s
AES CBC 128 bits 8000 bytes 1024 bytes Decryption Small 1 232 440 2596 Kbytes/s
AES CBC 128 bits 8000 bytes 1024 bytes Decryption Fast 384 288 8327 Kbytes/s
AES CBC 128 bits 8000 bytes 2048 bytes Decryption Small 1 231 240 2599 Kbytes/s
AES CBC 128 bits 8000 bytes 2048 bytes Decryption Fast 382 672 8362 Kbytes/s
AES CBC 192 bits 8000 bytes 128 bytes Decryption Small 1 480 072 2162 Kbytes/s
AES CBC 192 bits 8000 bytes 128 bytes Decryption Fast 444 776 7194 Kbytes/s
AES CBC 192 bits 8000 bytes 512 bytes Decryption Small 1 475 032 2169 Kbytes/s
AES CBC 192 bits 8000 bytes 512 bytes Decryption Fast 439 352 7283 Kbytes/s
AES CBC 192 bits 8000 bytes 1024 bytes Decryption Small 1 473 864 2171 Kbytes/s
AES CBC 192 bits 8000 bytes 1024 bytes Decryption Fast 437 984 7306 Kbytes/s
AES CBC 192 bits 8000 bytes 2048 bytes Decryption Small 1 472 480 2173 Kbytes/s
AES CBC 192 bits 8000 bytes 2048 bytes Decryption Fast 436 832 7325 Kbytes/s
AES CBC 256 bits 8000 bytes 128 bytes Decryption Small 1 721 368 1858 Kbytes/s
AES CBC 256 bits 8000 bytes 128 bytes Decryption Fast 498 800 6415 Kbytes/s
AES CBC 256 bits 8000 bytes 512 bytes Decryption Small 1 716 456 1864 Kbytes/s
AES CBC 256 bits 8000 bytes 512 bytes Decryption Fast 493 952 6478 Kbytes/s
AES CBC 256 bits 8000 bytes 1024 bytes Decryption Small 1 715 216 1865 Kbytes/s
AES CBC 256 bits 8000 bytes 1024 bytes Decryption Fast 492 352 6499 Kbytes/s
AES CBC 256 bits 8000 bytes 2048 bytes Decryption Small 1 713 856 1867 Kbytes/s
AES CBC 256 bits 8000 bytes 2048 bytes Decryption Fast 491 104 6515 Kbytes/s
Cryptolib STM32H753 AES CBC DF Enc.svg
Cryptolib STM32H753 AES CBC DF Dec.svg


The table below shows flash memory and RAM usage (in bytes).

Cipher operation Configuration Code Constant data Global data Stack usage
Encryption Small 2840 bytes 372 bytes 1 byte 144 bytes
Encryption Fast 3160 bytes 1396 bytes 1 byte 172 bytes
Decryption Small 2952 bytes 628 bytes 1 byte 176 bytes
Decryption Fast 3612 bytes 1652 bytes 1 byte 180 bytes
Cryptolib STM32H753 AES CBC DF Enc FP.svg
Cryptolib STM32H753 AES CBC DF Dec FP.svg


2.2. HASH digest

In this section we provide the performance results for HASH using different operation modes:

  • Sole buffer: one sole buffer is hashed. The time to perform is given in us.
  • Data flow: a large message is hashed by chunk. The bit rate is given in bytes per second.

2.2.1. Sole buffer mode

In this mode, the entire message hashing process is managed through a single API call provided by the CMOX library.

The table below shows the number of clock cycles and time (in µs) needed to perform described operation.

HASH mode Buffer size Cycles Time
SHA256 32 bytes 3699 9 µs
SHA256 64 bytes 5477 13 µs
SHA256 128 bytes 7166 17 µs
SHA384 32 bytes 10 219 25 µs
SHA384 64 bytes 10 292 25 µs
SHA384 128 bytes 18 478 46 µs
Cryptolib STM32H753 HASH SB Dig.svg


The table below shows flash memory and RAM usage (in bytes).

HASH mode Code Constant data Global data Stack usage
SHA256 1872 296 bytes 1 byte 564 bytes
SHA384 3068 744 bytes 1 byte 1124 bytes
Cryptolib STM32H753 HASH SB Dig FP.svg


2.2.2. Data flow mode

In this mode, the operation is performed in several calls to the CMOX library APIs, as below:

  • cmox_hash_init
  • cmox_hash_append: called several times to hash the entire message by fixed-size chunk
  • cmox_hash_generateTag

The table below shows the number of clock cycles and bit rate (in kilobytes per second) needed to perform described operation.

HASH mode Message size Chunk size Cycles Bit rate
SHA256 8000 bytes 128 bytes 232 267 13 777 Kbytes/s
SHA256 8000 bytes 512 bytes 215 414 14 855 Kbytes/s
SHA256 8000 bytes 1024 bytes 213 042 15 020 Kbytes/s
SHA256 8000 bytes 2048 bytes 211 832 15 106 Kbytes/s
SHA384 8000 bytes 128 bytes 525 674 6087 Kbytes/s
SHA384 8000 bytes 512 bytes 500 700 6391 Kbytes/s
SHA384 8000 bytes 1024 bytes 496 816 6441 Kbytes/s
SHA384 8000 bytes 2048 bytes 494 839 6466 Kbytes/s
Cryptolib STM32H753 HASH DF Dig.svg


The table below shows the final tag generation done through the call to cmox_hash_generateTag.

HASH mode Cycles Time
SHA256 2997 7 µs
SHA384 9504 23 µs

The table below shows flash memory and RAM usage (in bytes).

HASH mode Code Constant data Global data Stack usage
SHA256 1884 bytes 288 bytes 1 byte 372 bytes
SHA384 3080 bytes 736 bytes 1 byte 828 bytes
Cryptolib STM32H753 HASH DF Dig FP.svg


2.3. ECDSA signature and verification

This section provides the performance results for ECDSA signature and verification.

The table below shows the number of clock cycles and time (in ms) needed to perform the described operation in different configurations.

Curve Operation ECC mathematics configuration Curve definition Cycles Time
SECP256R1 Signature Small Low 2 186 024 5 ms
SECP256R1 Signature Small High 2 102 432 5 ms
SECP256R1 Signature SuperFast Low 1 350 144 3 ms
SECP256R1 Signature SuperFast High 1 261 368 3 ms
SECP256R1 Verification Small Low 5 252 088 13 ms
SECP256R1 Verification Small High 4 608 304 11 ms
SECP256R1 Verification SuperFast Low 3 245 712 8 ms
SECP256R1 Verification SuperFast High 2 801 768 7 ms
SECP384R1 Signature Small Low 6 110 304 15 ms
SECP384R1 Signature Small High 5 791 888 14 ms
SECP384R1 Signature Fast Low 4 951 016 12 ms
SECP384R1 Signature Fast High 4 699 520 11 ms
SECP384R1 Verification Small Low 14 515 016 36 ms
SECP384R1 Verification Small High 12 600 728 31 ms
SECP384R1 Verification Fast Low 11 809 240 29 ms
SECP384R1 Verification Fast High 10 204 608 25 ms
Cryptolib STM32H753 ECDSA Sig.svg
Cryptolib STM32H753 ECDSA Ver.svg


The table below shows ECDSA flash memory and RAM usage (in bytes).

Curve Operation ECC mathematics configuration Curve definition Code Constant data Global data Stack usage Working buffer
SECP256R1 Signature Small Low 11 746 bytes 1184 bytes 1 byte 328 bytes 628 bytes
CP256R1 Signature Small High 11 746 bytes 1568 bytes 1 byte 328 bytes 696 bytes
SECP256R1 Signature SuperFast Low 13 056 bytes 1184 byte 1 byte 332 bytes 628 bytes
SECP256R1 Signature SuperFast High 13 056 bytes 1568 byte 1 byte 332 bytes 696 bytes
SECP256R1 Verification Small Low 12 238 bytes 1200 bytes 1 byte 424 bytes 856 bytes
SECP256R1 Verification Small High 12 238 bytes 1584 bytes 1 byte 424 bytes 1648 bytes
SECP256R1 Verification SuperFast Low 13 548 bytes 1200 bytes 1 byte 428 bytes 856 bytes
SECP256R1 Verification SuperFast High 13 548 bytes 1584 bytes 1 byte 428 bytes 1648 bytes
SECP384R1 Signature Small Low 11 746 bytes 1664 bytes 1 byte 328 bytes 884 bytes
SECP384R1 Signature Small High 11 746 bytes 2240 bytes 1 byte 328 bytes 984 bytes
SECP384R1 Signature Fast Low 12 116 bytes 1664 bytes 1 byte 344 bytes 884 bytes
SECP384R1 Signature Fast High 12 116 bytes 2240 bytes 1 byte 344 bytes 984 bytes
SECP384R1 Verification Small Low 12 238 bytes 1680 bytes 1 byte 424 bytes 1192 bytes
SECP384R1 Verification Small High 12 238 bytes 2256 bytes 1 byte 424 bytes 2272 bytes
SECP384R1 Verification Fast Low 12 608 bytes 1680 bytes 1 byte 440 bytes 1192 bytes
SECP384R1 Verification Fast High 12 608 bytes 2256 bytes 1 byte 440 bytes 2272 bytes
Cryptolib STM32H753 ECDSA SECP256R1 Sig FP.svg
Cryptolib STM32H753 ECDSA SECP256R1 Ver FP.svg
Cryptolib STM32H753 ECDSA SECP384R1 Sig FP.svg
Cryptolib STM32H753 ECDSA SECP384R1 Ver FP.svg


2.4. EdDSA signature and verification

This section provides the performance results for EdDSA signature and verification.

The table below shows the number of clock cycles and time (in ms) needed to perform the described operation in different configurations.

Curve Message size Operation ECC mathematics configuration Curve definition Cycles Time
Ed25519 1023 bytes Signature Small OptLow 3 280 976 8 ms
Ed25519 1023 bytes Signature Small OptHigh 1 906 680 4 ms
Ed25519 1023 bytes Signature SuperFast OptLow 2 174 408 5 ms
Ed25519 1023 bytes Signature SuperFast OptHigh 1 267 800 3 ms
Ed25519 1023 bytes Verification Small OptLow 4 991 552 12 ms
Ed25519 1023 bytes Verification Small OptHigh 4 361 912 10 ms
Ed25519 1023 bytes Verification SuperFast OptLow 3 122 304 7 ms
Ed25519 1023 bytes Verification SuperFast OptHigh 2 722 080 6 ms
Cryptolib STM32H753 EdDSA Sig.svg
Cryptolib STM32H753 EdDSA Ver.svg


The table below shows EdDSA flash memory and RAM usage (in bytes).

Curve Message size Operation ECC mathematics configuration Curve definition Code Constant data Global data Stack usage Working buffer
Ed25519 1023 bytes Signature Small OptLow 14 158 bytes 1744 bytes 1 byte 1236 bytes 1388 bytes
Ed25519 1023 bytes Signature Small OptHigh 14 562 bytes 2896 bytes 1 byte 1236 bytes 1388 bytes
Ed25519 1023 bytes Signature SuperFast OptLow 15 468 bytes 1744 bytes 1 byte 1236 bytes 1388 bytes
Ed25519 1023 bytes Signature SuperFast OptHigh 15 872 bytes 2896 bytes 1 byte 1236 bytes 1388 bytes
Ed25519 1023 bytes Verification Small OptLow 14 256 bytes 1748 bytes 1 byte 1244 bytes 1152 bytes
Ed25519 1023 bytes Verification Small OptHigh 14 660 bytes 2900 bytes 1 byte 1244 bytes 1992 bytes
Ed25519 1023 bytes Verification SuperFast OptLow 15 566 bytes 1748 bytes 1 byte 1244 bytes 1152 bytes
Ed25519 1023 bytes Verification SuperFast OptHigh 15 970 bytes 2900 bytes 1 byte 1244 bytes 1992 bytes
Cryptolib STM32H753 EdDSA Sig FP.svg
Cryptolib STM32H753 EdDSA Ver FP.svg


2.5. RSA signature and verification

This section provides the performance results for RSA signature and verification.

The table below shows the number of clock cycles and time (in ms) needed to perform the described operation in different configurations.

PKCS#1 Priv. key mod. exp. method Hash method Modulus size Operation RSA mathematics configuration Priv. key mod. exp. implementation Cycles Time
v2.2 CRT SHA-256 3K Signature Small Low 150 819 752 377 ms
v2.2 CRT SHA-256 3K Signature Small Mid 113 693 520 284 ms
v2.2 CRT SHA-256 3K Signature Small High 95 444 288 238 ms
v2.2 CRT SHA-256 3K Signature Fast Low 101 419 632 253 ms
v2.2 CRT SHA-256 3K Signature Fast Mid 76 159 688 190 ms
v2.2 CRT SHA-256 3K Signature Fast High 63 965 304 159 ms
v2.2 No CRT SHA-256 3K Signature Small Low 583 580 688 1458 ms
v2.2 No CRT SHA-256 3K Signature Small Mid 438 589 640 1096 ms
v2.2 No CRT SHA-256 3K Signature Small High 366 815 120 917 ms
v2.2 No CRT SHA-256 3K Signature Fast Low 378 080 688 945 ms
v2.2 No CRT SHA-256 3K Signature Fast Mid 283 579 064 708 ms
v2.2 No CRT SHA-256 3K Signature Fast High 237 220 880 593 ms
v2.2 n/a SHA-256 3K Verification Small n/a 2 701 096 6 ms
v2.2 n/a SHA-256 3K Verification Fast n/a 2 020 528 5 ms
Cryptolib STM32H753 RSA Sig.svg
Cryptolib STM32H753 RSA Ver.svg


The table below shows RSA flash memory and RAM usage (in bytes).

PKCS#1 Priv. key mod. exp. method Hash method Modulus size Operation RSA mathematics configuration Priv. key mod. exp. implementation Code Constant data Global data Stack usage Working buffer
v2.2 CRT SHA-256 3K Signature Small Low 7056 bytes 369 bytes 5 bytes 700 bytes 3704 bytes
v2.2 CRT SHA-256 3K Signature Small Mid 7308 bytes 369 bytes 5 bytes 700 bytes 4308 bytes
v2.2 CRT SHA-256 3K Signature Small High 7308 bytes 369 bytes 5 bytes 700 bytes 6708 bytes
v2.2 CRT SHA-256 3K Signature Fast Low 7426 bytes 369 bytes 5 bytes 700 bytes 3704 bytes
v2.2 CRT SHA-256 3K Signature Fast Mid 7678 bytes 369 bytes 5 bytes 700 bytes 4308 bytes
v2.2 CRT SHA-256 3K Signature Fast High 7678 bytes 369 bytes 5 bytes 700 bytes 6708 bytes
v2.2 No CRT SHA-256 3K Signature Small Low 6088 bytes 361 bytes 5 bytes 700 bytes 3484 bytes
v2.2 No CRT SHA-256 3K Signature Small Mid 6340 bytes 361 bytes 5 bytes 700 bytes 4664 bytes
v2.2 No CRT SHA-256 3K Signature Small High 6340 bytes 361 bytes 5 bytes 700 bytes 9368 bytes
v2.2 No CRT SHA-256 3K Signature Fast Low 6458 bytes 361 bytes 5 bytes 700 bytes 3484 bytes
v2.2 No CRT SHA-256 3K Signature Fast Mid 6710 bytes 361 bytes 5 bytes 700 bytes 4664 bytes
v2.2 No CRT SHA-256 3K Signature Fast High 6710 bytes 361 bytes 5 bytes 700 bytes 9368 bytes
v2.2 n/a SHA-256 3K Verification Small n/a 6842 bytes 366 bytes 5 bytes 716 bytes 3108 bytes
v2.2 n/a SHA-256 3K Verification Fast n/a 7212 bytes 366 bytes 5 bytes 716 bytes 3108 bytes
Cryptolib STM32H753 RSA 3K CRT Sig FP.svg
Cryptolib STM32H753 RSA 3K NoCRT Sig FP.svg
Cryptolib STM32H753 RSA 3K Ver FP.svg


This section reports the performance with the STM32H7S3 MCU. Measurements are done while executing the code from the external flash memory in execute-in-place mode (XIP).

3. Measurement configuration

3.1. Hardware configuration

STM32 MCU STM32H7S3L8Hx
Device ID 0x485
Revision ID 0x1003
Board NUCLEO-H7S3L8

3.2. Firmware configuration

Cryptographic library version 040000B1[ver. 1]
  1. ↑ This value corresponds to the information returned by a call to cmox_getInfos.

3.3. System configuration

System core clock frequency 600 MHz
External flash XSPI / 200 MHz
Voltage scaling Range 1
Instruction cache (ART/ICU) 1 (0: disabled / 1: enabled)
Data cache (ART/DCU) 1 (0: disabled / 1: enabled)

3.4. Development toolchains and compilers

IAR Embedded Workbench IAR ANSI C/C++ Compiler V9.20.4.327/W64 for ARM
Info white.png Information
The measurements are done using a project built with the High Speed optimization setting enabled.

4. Performance values

4.1. AES symmetric key encryption and decryption

This section provides the performance results for AES-CBC using different operation modes:

  • Sole buffer: one sole buffer is encrypted or decrypted. The time to perform is given in µs.
  • Data flow: a large message is encrypted or decrypted by chunk. The bit rate is given in kilobytes per second.

4.1.1. Sole buffer mode

In this mode, the entire encryption or decryption process, for the entire message size, is managed through a single API call provided by the CMOX library.

The table below shows the number of clock cycles and time (in µs) needed to perform the described operation in small and fast configurations.

AES mode Key size Buffer size Cipher operation Configuration Cycles Time
AES CBC 128 bits 32 bytes Encryption Small 28 104 46 µs
AES CBC 128 bits 32 bytes Encryption Fast 38 800 64 µs
AES CBC 128 bits 64 bytes Encryption Small 30 304 50 µs
AES CBC 128 bits 64 bytes Encryption Fast 40 496 67 µs
AES CBC 128 bits 128 bytes Encryption Small 34 512 57 µs
AES CBC 128 bits 128 bytes Encryption Fast 43 592 72 µs
AES CBC 192 bits 32 bytes Encryption Small 29 000 48 µs
AES CBC 192 bits 32 bytes Encryption Fast 41 912 69 µs
AES CBC 192 bits 64 bytes Encryption Small 31 600 52 µs
AES CBC 192 bits 64 bytes Encryption Fast 43 696 72 µs
AES CBC 192 bits 128 bytes Encryption Small 36 520 60 µs
AES CBC 192 bits 128 bytes Encryption Fast 47 288 78 µs
AES CBC 256 bits 32 bytes Encryption Small 30 440 50 µs
AES CBC 256 bits 32 bytes Encryption Fast 41 816 69 µs
AES CBC 256 bits 64 bytes Encryption Small 33 280 55 µs
AES CBC 256 bits 64 bytes Encryption Fast 43 992 73 µs
AES CBC 256 bits 128 bytes Encryption Small 38 912 64 µs
AES CBC 256 bits 128 bytes Encryption Fast 47 976 79 µs
AES CBC 128 bits 32 bytes Decryption Small 34 088 56 µs
AES CBC 128 bits 32 bytes Decryption Fast 44 800 74 µs
AES CBC 128 bits 64 bytes Decryption Small 39 056 65 µs
AES CBC 128 bits 64 bytes Decryption Fast 46 432 77 µs
AES CBC 128 bits 128 bytes Decryption Small 48 848 81 µs
AES CBC 128 bits 128 bytes Decryption Fast 49 440 82 µs
AES CBC 192 bits 32 bytes Decryption Small 36 432 60 µs
AES CBC 192 bits 32 bytes Decryption Fast 47 848 79 µs
AES CBC 192 bits 64 bytes Decryption Small 42 296 70 µs
AES CBC 192 bits 64 bytes Decryption Fast 49 552 82 µs
AES CBC 192 bits 128 bytes Decryption Small 54 320 90 µs
AES CBC 192 bits 128 bytes Decryption Fast 52 984 88 µs
AES CBC 256 bits 32 bytes Decryption Small 36 784 61 µs
AES CBC 256 bits 32 bytes Decryption Fast 46 224 77 µs
AES CBC 256 bits 64 bytes Decryption Small 43 664 72 µs
AES CBC 256 bits 64 bytes Decryption Fast 48 080 80 µs
AES CBC 256 bits 128 bytes Decryption Small 57 440 95 µs
AES CBC 256 bits 128 bytes Decryption Fast 51 968 86 µs
Cryptolib STM32H7S3 AES CBC SB Enc.svg
Cryptolib STM32H7S3 AES CBC SB Dec.svg


The table below shows flash memory and RAM usage (in bytes).

Cipher operation Configuration Code Constant data Global data Stack usage
Encryption Small 2948 bytes 380 bytes 1 byte 528 bytes
Encryption Fast 3268 bytes 1404 bytes 1 byte 548 bytes
Decryption Small 3060 bytes 636 bytes 1 byte 552 bytes
Decryption Fast 3720 bytes 1660 bytes 1 byte 560 bytes
Cryptolib STM32H7S3 AES CBC SB Enc FP.svg
Cryptolib STM32H7S3 AES CBC SB Dec FP.svg


4.1.2. Data flow mode

In this mode, the operation is performed in several calls to the CMOX library APIs, as below:

  • cmox_cipher_init
  • cmox_cipher_setKey
  • cmox_cipher_setIV
  • cmox_cipher_append: called several times to encrypt or decrypt the entire message by fixed-size chunk

The table below shows the number of clock cycles and bit rate (in kilobytes per second) needed to perform the described operation in small and in fast configuration.

AES mode Key size Message size Chunk size Cipher operation Configuration Cycles Bit rate
AES CBC 128 bits 8000 bytes 128 bytes Encryption Small 544 200 8820 Kbytes/s
AES CBC 128 bits 8000 bytes 128 bytes Encryption Fast 411 752 11 657 Kbytes/s
AES CBC 128 bits 8000 bytes 512 bytes Encryption Small 535 968 8955 Kbytes/s
AES CBC 128 bits 8000 bytes 512 bytes Encryption Fast 407 464 11 780 Kbytes/s
AES CBC 128 bits 8000 bytes 1024 bytes Encryption Small 534 544 8979 Kbytes/s
AES CBC 128 bits 8000 bytes 1024 bytes Encryption Fast 406 728 11 801 Kbytes/s
AES CBC 128 bits 8000 bytes 2048 bytes Encryption Small 534 232 8984 Kbytes/s
AES CBC 128 bits 8000 bytes 2048 bytes Encryption Fast 406 240 11 815 Kbytes/s
AES CBC 192 bits 8000 bytes 128 bytes Encryption Small 631 872 7596 Kbytes/s
AES CBC 192 bits 8000 bytes 128 bytes Encryption Fast 472 096 10 167 Kbytes/s
AES CBC 192 bits 8000 bytes 512 bytes Encryption Small 625 936 7668 Kbytes/s
AES CBC 192 bits 8000 bytes 512 bytes Encryption Fast 467 768 10 261 Kbytes/s
AES CBC 192 bits 8000 bytes 1024 bytes Encryption Small 624 832 7682 Kbytes/s
AES CBC 192 bits 8000 bytes 1024 bytes Encryption Fast 467 040 10 277 Kbytes/s
AES CBC 192 bits 8000 bytes 2048 bytes Encryption Small 624 464 7686 Kbytes/s
AES CBC 192 bits 8000 bytes 2048 bytes Encryption Fast 466 952 10 279 Kbytes/s
AES CBC 256 bits 8000 bytes 128 bytes Encryption Small 719 024 6675 Kbytes/s
AES CBC 256 bits 8000 bytes 128 bytes Encryption Fast 529 040 9073 Kbytes/s
AES CBC 256 bits 8000 bytes 512 bytes Encryption Small 713 208 6730 Kbytes/s
AES CBC 256 bits 8000 bytes 512 bytes Encryption Fast 524 744 9147 Kbytes/s
AES CBC 256 bits 8000 bytes 1024 bytes Encryption Small 711 976 6741 Kbytes/s
AES CBC 256 bits 8000 bytes 1024 bytes Encryption Fast 523 992 9160 Kbytes/s
AES CBC 256 bits 8000 bytes 2048 bytes Encryption Small 711 616 6745 Kbytes/s
AES CBC 256 bits 8000 bytes 2048 bytes Encryption Fast 523 648 9166 Kbytes/s
AES CBC 128 bits 8000 bytes 128 bytes Decryption Small 1 269 992 3779 Kbytes/s
AES CBC 128 bits 8000 bytes 128 bytes Decryption Fast 422 904 11 350 Kbytes/s
AES CBC 128 bits 8000 bytes 512 bytes Decryption Small 1 253 528 3829 Kbytes/s
AES CBC 128 bits 8000 bytes 512 bytes Decryption Fast 406 168 11 817 Kbytes/s
AES CBC 128 bits 8000 bytes 1024 bytes Decryption Small 1 250 048 3839 Kbytes/s
AES CBC 128 bits 8000 bytes 1024 bytes Decryption Fast 402 560 11 923 Kbytes/s
AES CBC 128 bits 8000 bytes 2048 bytes Decryption Small 1 246 920 3849 Kbytes/s
AES CBC 128 bits 8000 bytes 2048 bytes Decryption Fast 399 104 12 026 Kbytes/s
AES CBC 192 bits 8000 bytes 128 bytes Decryption Small 1 523 760 3150 Kbytes/s
AES CBC 192 bits 8000 bytes 128 bytes Decryption Fast 475 784 10 088 Kbytes/s
AES CBC 192 bits 8000 bytes 512 bytes Decryption Small 1 507 256 3184 Kbytes/s
AES CBC 192 bits 8000 bytes 512 bytes Decryption Fast 458 776 10 462 Kbytes/s
AES CBC 192 bits 8000 bytes 1024 bytes Decryption Small 1 503 720 3192 Kbytes/s
AES CBC 192 bits 8000 bytes 1024 bytes Decryption Fast 455 168 10 545 Kbytes/s
AES CBC 192 bits 8000 bytes 2048 bytes Decryption Small 1 500 272 3199 Kbytes/s
AES CBC 192 bits 8000 bytes 2048 bytes Decryption Fast 451 528 10 630 Kbytes/s
AES CBC 256 bits 8000 bytes 128 bytes Decryption Small 1 766 136 2717 Kbytes/s
AES CBC 256 bits 8000 bytes 128 bytes Decryption Fast 529 488 9065 Kbytes/s
AES CBC 256 bits 8000 bytes 512 bytes Decryption Small 1 749 504 2743 Kbytes/s
AES CBC 256 bits 8000 bytes 512 bytes Decryption Fast 512 344 9368 Kbytes/s
AES CBC 256 bits 8000 bytes 1024 bytes Decryption Small 1 745 968 2749 Kbytes/s
AES CBC 256 bits 8000 bytes 1024 bytes Decryption Fast 508 768 9434 Kbytes/s
AES CBC 256 bits 8000 bytes 2048 bytes Decryption Small 1 743 312 2753 Kbytes/s
AES CBC 256 bits 8000 bytes 2048 bytes Decryption Fast 505 984 9486 Kbytes/s
Cryptolib STM32H7S3 AES CBC DF Enc.svg
Cryptolib STM32H7S3 AES CBC DF Dec.svg


The table below shows flash memory and RAM usage (in bytes).

Cipher operation Configuration Code Constant data Global data Stack usage
Encryption Small 2840 bytes 372 bytes 1 byte 144 bytes
Encryption Fast 3160 bytes 1396 bytes 1 byte 172 bytes
Decryption Small 2952 bytes 628 bytes 1 byte 176 bytes
Decryption Fast 3612 bytes 1652 bytes 1 byte 180 bytes
Cryptolib STM32H7S3 AES CBC DF Enc FP.svg
Cryptolib STM32H7S3 AES CBC DF Dec FP.svg


4.2. HASH digest

This section provides the performance results for HASH using different operation modes:

  • Sole buffer: one sole buffer is hashed. The time to perform is given in µs.
  • Data flow: a large message is hashed by chunk. The bit rate is given in bytes per second.

4.2.1. Sole buffer mode

In this mode, the entire message hashing process is managed through a single API call provided by the CMOX library.

The table below shows the number of clock cycles and time (in µs) needed to perform the described operation.

HASH mode Buffer size Cycles Time
SHA256 32 bytes 21 160 35 µs
SHA256 64 bytes 23 384 38 µs
SHA256 128 bytes 25 256 42 µs
SHA384 32 bytes 30 712 51 µs
SHA384 64 bytes 30 824 51 µs
SHA384 128 bytes 39 792 66 µs
Cryptolib STM32H7S3 HASH SB Dig.svg


The table below shows flash memory and RAM usage (in bytes).

HASH mode Code Constant data Global data Stack usage
SHA256 1872 296 bytes 1 byte 564 bytes
SHA384 3068 744 bytes 1 byte 1124 bytes
Cryptolib STM32H7S3 HASH SB Dig FP.svg


4.2.2. Data flow mode

In this mode, operation is performed in several calls to the CMOX library APIs, as below:

  • cmox_hash_init
  • cmox_hash_append: called several times to hash the entire message by fixed-size chunk
  • cmox_hash_generateTag

The table below shows the number of clock cycles and bit rate (in kilobytes per second) needed to perform the described operation.

HASH mode Message size Chunk size Cycles Bit rate
SHA256 8000 bytes 128 bytes 240 136 19 988 Kbytes/s
SHA256 8000 bytes 512 bytes 228 048 21 048 Kbytes/s
SHA256 8000 bytes 1024 bytes 225 792 21 258 Kbytes/s
SHA256 8000 bytes 2048 bytes 223 760 21 451 Kbytes/s
SHA384 8000 bytes 128 bytes 532 928 9006 Kbytes/s
SHA384 8000 bytes 512 bytes 515 072 9319 Kbytes/s
SHA384 8000 bytes 1024 bytes 511 760 9379 Kbytes/s
SHA384 8000 bytes 2048 bytes 509 776 9415 Kbytes/s
Cryptolib STM32H7S3 HASH DF Dig.svg


The table below shows the final tag generation done through the call to cmox_hash_generateTag.

HASH mode Cycles Time
SHA256 9176 15 µs
SHA384 16 672 27 µs

The table below shows flash memory and RAM usage (in bytes).

HASH mode Code Constant data Global data Stack usage
SHA256 1884 bytes 288 bytes 1 byte 372 bytes
SHA384 3080 bytes 736 bytes 1 byte 828 bytes
Cryptolib STM32H7S3 HASH DF Dig FP.svg


4.3. ECDSA signature and verification

This section provides the performance results for ECDSA signature and verification.

The table below shows the number of clock cycles and time (in ms) needed to perform the described operation in different configurations.

Curve Operation ECC mathematics configuration Curve definition Cycles Time
SECP256R1 Signature Small Low 2 208 616 3 ms
SECP256R1 Signature Small High 2 118 216 3 ms
SECP256R1 Signature SuperFast Low 1 329 488 2 ms
SECP256R1 Signature SuperFast High 1 275 072 2 ms
SECP256R1 Verification Small Low 5 224 536 8 ms
SECP256R1 Verification Small High 4 595 952 7 ms
SECP256R1 Verification SuperFast Low 3 167 744 5 ms
SECP256R1 Verification SuperFast High 2 799 480 4 ms
SECP384R1 Signature Small Low 6 098 400 10 ms
SECP384R1 Signature Small High 5 843 320 9 ms
SECP384R1 Signature Fast Low 4 936 432 8 ms
SECP384R1 Signature Fast High 4 703 656 7 ms
SECP384R1 Verification Small Low 14 429 992 24 ms
SECP384R1 Verification Small High 12 652 736 21 ms
SECP384R1 Verification Fast Low 11 722 720 19 ms
SECP384R1 Verification Fast High 10 151 336 16 ms
Cryptolib STM32H7S3 ECDSA Sig.svg
Cryptolib STM32H7S3 ECDSA Ver.svg


The table below shows ECDSA flash memory and RAM usage (in bytes).

Curve Operation ECC mathematics configuration Curve definition Code Constant data Global data Stack usage Working buffer
SECP256R1 Signature Small Low 11 746 bytes 1184 bytes 1 byte 328 bytes 628 bytes
SECP256R1 Signature Small High 11 746 bytes 1568 bytes 1 byte 328 bytes 696 bytes
SECP256R1 Signature SuperFast Low 13 056 bytes 1184 bytes 1 byte 332 bytes 628 bytes
SECP256R1 Signature SuperFast High 13 056 bytes 1568 bytes 1 byte 332 bytes 696 bytes
SECP256R1 Verification Small Low 12 238 bytes 1200 bytes 1 byte 424 bytes 856 bytes
SECP256R1 Verification Small High 12 238 bytes 1584 bytes 1 byte 424 bytes 1648 bytes
SECP256R1 Verification SuperFast Low 13 548 bytes 1200 bytes 1 byte 428 bytes 856 bytes
SECP256R1 Verification SuperFast High 13 548 bytes 1584 bytes 1 byte 428 bytes 1648 bytes
SECP384R1 Signature Small Low 11 746 bytes 1664 bytes 1 byte 328 bytes 884 bytes
SECP384R1 Signature Small High 11 746 bytes 2240 bytes 1 byte 328 bytes 984 bytes
SECP384R1 Signature Fast Low 12 116 bytes 1664 bytes 1 byte 344 bytes 884 bytes
SECP384R1 Signature Fast High 12 116 bytes 2240 bytes 1 byte 344 bytes 984 bytes
SECP384R1 Verification Small Low 12 238 bytes 1680 bytes 1 byte 424 bytes 1192 bytes
SECP384R1 Verification Small High 12 238 bytes 2256 bytes 1 byte 424 bytes 2272 bytes
SECP384R1 Verification Fast Low 12 608 bytes 1680 bytes 1 byte 440 bytes 1192 bytes
SECP384R1 Verification Fast High 12 608 bytes 2256 bytes 1 byte 440 bytes 2272 bytes
Cryptolib STM32H7S3 ECDSA SECP256R1 Sig FP.svg
Cryptolib STM32H7S3 ECDSA SECP256R1 Ver FP.svg
Cryptolib STM32H7S3 ECDSA SECP384R1 Sig FP.svg
Cryptolib STM32H7S3 ECDSA SECP384R1 Ver FP.svg


4.4. EdDSA signature and verification

This section provides the performance results for EdDSA signature and verification.

The table below shows the number of clock cycles and time (in ms) needed to perform the described operation in different configurations.

Curve Message size Operation ECC mathematics configuration Curve definition Cycles Time
Ed25519 1023 bytes Signature Small OptLow 3 318 584 5 ms
Ed25519 1023 bytes Signature Small OptHigh 1 973 880 3 ms
Ed25519 1023 bytes Signature SuperFast OptLow 2 233 688 3 ms
Ed25519 1023 bytes Signature SuperFast OptHigh 1 322 184 2 ms
Ed25519 1023 bytes Verification Small OptLow 5 051 048 8 ms
Ed25519 1023 bytes Verification Small OptHigh 4 439 424 7 ms
Ed25519 1023 bytes Verification SuperFast OptLow 3 185 304 5 ms
Ed25519 1023 bytes Verification SuperFast OptHigh 2 751 840 4 ms
Cryptolib STM32H7S3 EdDSA Sig.svg
Cryptolib STM32H7S3 EdDSA Ver.svg


The table below shows EdDSA flash memory and RAM usage (in bytes).

Curve Message size Operation ECC mathematics configuration Curve definition Code Constant data Global data Stack usage Working buffer
Ed25519 1023 bytes Signature Small OptLow 14 158 bytes 1744 bytes 1 byte 1236 bytes 1388 bytes
Ed25519 1023 bytes Signature Small OptHigh 14 562 bytes 2896 bytes 1 byte 1236 bytes 1388 bytes
Ed25519 1023 bytes Signature SuperFast OptLow 15 468 bytes 1744 bytes 1 byte 1236 bytes 1388 bytes
Ed25519 1023 bytes Signature SuperFast OptHigh 15 872 bytes 2896 bytes 1 byte 1236 bytes 1388 bytes
Ed25519 1023 bytes Verification Small OptLow 14 256 bytes 1748 bytes 1 byte 1244 bytes 1152 bytes
Ed25519 1023 bytes Verification Small OptHigh 14 660 bytes 2900 bytes 1 byte 1244 bytes 1992 bytes
Ed25519 1023 bytes Verification SuperFast OptLow 15 566 bytes 1748 bytes 1 byte 1244 bytes 1152 bytes
Ed25519 1023 bytes Verification SuperFast OptHigh 15 970 bytes 2900 bytes 1 byte 1244 bytes 1992 bytes
Cryptolib STM32H7S3 EdDSA Sig FP.svg
Cryptolib STM32H7S3 EdDSA Ver FP.svg


4.5. RSA signature and verification

This section provides the performance results for RSA signature and verification.

The table below shows the number of clock cycles and time (in ms) needed to perform the described operation in different configurations.

PKCS#1 Priv. key mod. exp. method Hash method Modulus size Operation RSA mathematics configuration Priv. key mod. exp. implementation Cycles Time
v2.2 CRT SHA-256 3K Signature Small Low 150 835 632 251 ms
v2.2 CRT SHA-256 3K Signature Small Mid 113 714 584 189 ms
v2.2 CRT SHA-256 3K Signature Small High 95 478 784 159 ms
v2.2 CRT SHA-256 3K Signature Fast Low 101 148 320 168 ms
v2.2 CRT SHA-256 3K Signature Fast Mid 76 193 640 126 ms
v2.2 CRT SHA-256 3K Signature Fast High 64 001 136 106 ms
v2.2 No CRT SHA-256 3K Signature Small Low 583 594 576 972 ms
v2.2 No CRT SHA-256 3K Signature Small Mid 438 629 424 731 ms
v2.2 No CRT SHA-256 3K Signature Small High 366 848 288 611 ms
v2.2 No CRT SHA-256 3K Signature Fast Low 377 515 464 629 ms
v2.2 No CRT SHA-256 3K Signature Fast Mid 283 610 168 472 ms
v2.2 No CRT SHA-256 3K Signature Fast High 237 250 592 395 ms
v2.2 n/a SHA-256 3K Verification Small n/a 2 743 480 4 ms
v2.2 n/a SHA-256 3K Verification Fast n/a 2 061 656 3 ms
Cryptolib STM32H7S3 RSA Sig.svg
Cryptolib STM32H7S3 RSA Ver.svg


The table below shows RSA flash memory and RAM usage (in bytes).

PKCS#1 Priv. key mod. exp. method Hash method Modulus size Operation RSA mathematics configuration Priv. key mod. exp. implementation Code Constant data Global data Stack usage Working buffer
v2.2 CRT SHA-256 3K Signature Small Low 7056 bytes 372 bytes 5 bytes 700 bytes 3704 bytes
v2.2 CRT SHA-256 3K Signature Small Mid 7308 bytes 372 bytes 5 bytes 700 bytes 4308 bytes
v2.2 CRT SHA-256 3K Signature Small High 7308 bytes 372 bytes 5 bytes 700 bytes 6708 bytes
v2.2 CRT SHA-256 3K Signature Fast Low 7426 bytes 372 bytes 5 bytes 700 bytes 3704 bytes
v2.2 CRT SHA-256 3K Signature Fast Mid 7678 bytes 372 bytes 5 bytes 700 bytes 4308 bytes
v2.2 CRT SHA-256 3K Signature Fast High 7678 bytes 372 bytes 5 bytes 700 bytes 6708 bytes
v2.2 No CRT SHA-256 3K Signature Small Low 6088 bytes 364 bytes 5 bytes 700 bytes 3484 bytes
v2.2 No CRT SHA-256 3K Signature Small Mid 6340 bytes 364 bytes 5 bytes 700 bytes 4664 bytes
v2.2 No CRT SHA-256 3K Signature Small High 6340 bytes 364 bytes 5 bytes 700 bytes 9368 bytes
v2.2 No CRT SHA-256 3K Signature Fast Low 6458 bytes 364 bytes 5 bytes 700 bytes 3484 bytes
v2.2 No CRT SHA-256 3K Signature Fast Mid 6710 bytes 364 bytes 5 bytes 700 bytes 4664 bytes
v2.2 No CRT SHA-256 3K Signature Fast High 6710 bytes 364 bytes 5 bytes 700 bytes 9368 bytes
v2.2 n/a SHA-256 3K Verification Small n/a 6842 bytes 368 bytes 5 bytes 716 bytes 3108 bytes
v2.2 n/a SHA-256 3K Verification Fast n/a 7212 bytes 368 bytes 5 bytes 716 bytes 3108 bytes
Cryptolib STM32H7S3 RSA 3K CRT Sig FP.svg
Cryptolib STM32H7S3 RSA 3K NoCRT Sig FP.svg
Cryptolib STM32H7S3 RSA 3K Ver FP.svg




Retrieved from "https://wiki.stmicroelectronics.cn/stm32mcu/index.php?title=Security:STM32H7_Series:_Cryptographic_Library_Performance&oldid=66720"