Cryptographic performance on STM32H7 series MCUs


This page reports measured performance when using the pure software cryptographic library algorithms with the STM32H7 MCUs. In addition to performance figures, the required code footprint and memory are also given.


This section reports the performance using the STM32H753 MCU. Measurements are done while executing the code from the internal flash memory.

1. Measurement configuration

1.1. Hardware configuration

1.2. Firmware configuration

  1. This value corresponds to the information returned by a call to cmox_getInfos.

1.3. System configuration

1.4. Development toolchains and compilers

2. Performance values

2.1. AES symmetric key encryption and decryption

This section provides the performance results for AES-CBC using different operation modes:

  • Sole buffer: one sole buffer is encrypted or decrypted. The time to perform is given in µs.
  • Data flow: a large message is encrypted or decrypted by chunk. The bit rate is given in kilobytes per second.

2.1.1. Sole buffer mode

In this mode, the entire encryption or decryption process, for the entire message size, is managed through a single API call provided by the CMOX library.

The table below shows the number of clock cycles and time (in µs) needed to perform the described operation in small and fast configurations.

AES mode Key size Buffer size Cipher operation Configuration Cycles Time
AES CBC 128 bits 32 bytes Encryption Small 3824 9 µs
AES CBC 128 bits 32 bytes Encryption Fast 3257 8 µs
AES CBC 128 bits 64 bytes Encryption Small 5901 14 µs
AES CBC 128 bits 64 bytes Encryption Fast 4701 11 µs
AES CBC 128 bits 128 bytes Encryption Small 10 156 25 µs
AES CBC 128 bits 128 bytes Encryption Fast 7781 19 µs
AES CBC 192 bits 32 bytes Encryption Small 4223 10 µs
AES CBC 192 bits 32 bytes Encryption Fast 3424 8 µs
AES CBC 192 bits 64 bytes Encryption Small 6660 16 µs
AES CBC 192 bits 64 bytes Encryption Fast 5138 12 µs
AES CBC 192 bits 128 bytes Encryption Small 11 599 28 µs
AES CBC 192 bits 128 bytes Encryption Fast 8677 21 µs
AES CBC 256 bits 32 bytes Encryption Small 4730 11 µs
AES CBC 256 bits 32 bytes Encryption Fast 3863 9 µs
AES CBC 256 bits 64 bytes Encryption Small 7543 18 µs
AES CBC 256 bits 64 bytes Encryption Fast 5839 14 µs
AES CBC 256 bits 128 bytes Encryption Small 13 128 32 µs
AES CBC 256 bits 128 bytes Encryption Fast 9829 24 µs
AES CBC 128 bits 32 bytes Decryption Small 6589 16 µs
AES CBC 128 bits 32 bytes Decryption Fast 3871 9 µs
AES CBC 128 bits 64 bytes Decryption Small 11 458 28 µs
AES CBC 128 bits 64 bytes Decryption Fast 5272 13 µs
AES CBC 128 bits 128 bytes Decryption Small 21 243 53 µs
AES CBC 128 bits 128 bytes Decryption Fast 8281 20 µs
AES CBC 192 bits 32 bytes Decryption Small 7535 18 µs
AES CBC 192 bits 32 bytes Decryption Fast 4261 10 µs
AES CBC 192 bits 64 bytes Decryption Small 13 399 33 µs
AES CBC 192 bits 64 bytes Decryption Fast 5855 14 µs
AES CBC 192 bits 128 bytes Decryption Small 25 100 62 µs
AES CBC 192 bits 128 bytes Decryption Fast 9256 23 µs
AES CBC 256 bits 32 bytes Decryption Small 8689 21 µs
AES CBC 256 bits 32 bytes Decryption Fast 4765 11 µs
AES CBC 256 bits 64 bytes Decryption Small 15 496 38 µs
AES CBC 256 bits 64 bytes Decryption Fast 6675 16 µs
AES CBC 256 bits 128 bytes Decryption Small 29 155 72 µs
AES CBC 256 bits 128 bytes Decryption Fast 10 515 26 µs
Cryptolib STM32H753 AES CBC SB Enc.svg
Cryptolib STM32H753 AES CBC SB Dec.svg


The table below shows flash memory and RAM usage (in bytes).

Cipher operation Configuration Code Constant data Global data Stack usage
Encryption Small 2948 bytes 380 bytes 1 byte 528 bytes
Encryption Fast 3268 bytes 1404 bytes 1 byte 548 bytes
Decryption Small 3060 bytes 636 bytes 1 byte 552 bytes
Decryption Fast 3720 bytes 1660 bytes 1 byte 560 bytes
Cryptolib STM32H753 AES CBC SB Enc FP.svg
Cryptolib STM32H753 AES CBC SB Dec FP.svg


2.1.2. Data flow mode

In this mode, the operation is performed in several calls to the CMOX library APIs, as below:

  • cmox_cipher_init
  • cmox_cipher_setKey
  • cmox_cipher_setIV
  • cmox_cipher_append: called several times to encrypt or decrypt the entire message by fixed-size chunk

The table below shows the number of clock cycles and bit rate (in kilobytes per second) needed to perform the described operation in small and fast configuration.

AES mode Key size Message size Chunk size Cipher operation Configuration Cycles Bit rate
AES CBC 128 bits 8000 bytes 128 bytes Encryption Small 534 952 5981 Kbytes/s
AES CBC 128 bits 8000 bytes 128 bytes Encryption Fast 394 520 8111 Kbytes/s
AES CBC 128 bits 8000 bytes 512 bytes Encryption Small 528 872 6050 Kbytes/s
AES CBC 128 bits 8000 bytes 512 bytes Encryption Fast 387 992 8247 Kbytes/s
AES CBC 128 bits 8000 bytes 1024 bytes Encryption Small 528 144 6058 Kbytes/s
AES CBC 128 bits 8000 bytes 1024 bytes Encryption Fast 387 040 8267 Kbytes/s
AES CBC 128 bits 8000 bytes 2048 bytes Encryption Small 527 688 6064 Kbytes/s
AES CBC 128 bits 8000 bytes 2048 bytes Encryption Fast 386 536 8278 Kbytes/s
AES CBC 192 bits 8000 bytes 128 bytes Encryption Small 624 032 5127 Kbytes/s
AES CBC 192 bits 8000 bytes 128 bytes Encryption Fast 450 496 7103 Kbytes/s
AES CBC 192 bits 8000 bytes 512 bytes Encryption Small 617 800 5179 Kbytes/s
AES CBC 192 bits 8000 bytes 512 bytes Encryption Fast 444 176 7204 Kbytes/s
AES CBC 192 bits 8000 bytes 1024 bytes Encryption Small 617 304 5183 Kbytes/s
AES CBC 192 bits 8000 bytes 1024 bytes Encryption Fast 442 632 7229 Kbytes/s
AES CBC 192 bits 8000 bytes 2048 bytes Encryption Small 616 824 5187 Kbytes/s
AES CBC 192 bits 8000 bytes 2048 bytes Encryption Fast 442 304 7234 Kbytes/s
AES CBC 256 bits 8000 bytes 128 bytes Encryption Small 712 824 4489 Kbytes/s
AES CBC 256 bits 8000 bytes 128 bytes Encryption Fast 507 040 6311 Kbytes/s
AES CBC 256 bits 8000 bytes 512 bytes Encryption Small 706 808 4527 Kbytes/s
AES CBC 256 bits 8000 bytes 512 bytes Encryption Fast 499 816 6402 Kbytes/s
AES CBC 256 bits 8000 bytes 1024 bytes Encryption Small 706 264 4530 Kbytes/s
AES CBC 256 bits 8000 bytes 1024 bytes Encryption Fast 499 616 6404 Kbytes/s
AES CBC 256 bits 8000 bytes 2048 bytes Encryption Small 705 720 4534 Kbytes/s
AES CBC 256 bits 8000 bytes 2048 bytes Encryption Fast 499 152 6410 Kbytes/s
AES CBC 128 bits 8000 bytes 128 bytes Decryption Small 1 238 288 2584 Kbytes/s
AES CBC 128 bits 8000 bytes 128 bytes Decryption Fast 391 176 8180 Kbytes/s
AES CBC 128 bits 8000 bytes 512 bytes Decryption Small 1 233 584 2594 Kbytes/s
AES CBC 128 bits 8000 bytes 512 bytes Decryption Fast 385 608 8298 Kbytes/s
AES CBC 128 bits 8000 bytes 1024 bytes Decryption Small 1 232 440 2596 Kbytes/s
AES CBC 128 bits 8000 bytes 1024 bytes Decryption Fast 384 288 8327 Kbytes/s
AES CBC 128 bits 8000 bytes 2048 bytes Decryption Small 1 231 240 2599 Kbytes/s
AES CBC 128 bits 8000 bytes 2048 bytes Decryption Fast 382 672 8362 Kbytes/s
AES CBC 192 bits 8000 bytes 128 bytes Decryption Small 1 480 072 2162 Kbytes/s
AES CBC 192 bits 8000 bytes 128 bytes Decryption Fast 444 776 7194 Kbytes/s
AES CBC 192 bits 8000 bytes 512 bytes Decryption Small 1 475 032 2169 Kbytes/s
AES CBC 192 bits 8000 bytes 512 bytes Decryption Fast 439 352 7283 Kbytes/s
AES CBC 192 bits 8000 bytes 1024 bytes Decryption Small 1 473 864 2171 Kbytes/s
AES CBC 192 bits 8000 bytes 1024 bytes Decryption Fast 437 984 7306 Kbytes/s
AES CBC 192 bits 8000 bytes 2048 bytes Decryption Small 1 472 480 2173 Kbytes/s
AES CBC 192 bits 8000 bytes 2048 bytes Decryption Fast 436 832 7325 Kbytes/s
AES CBC 256 bits 8000 bytes 128 bytes Decryption Small 1 721 368 1858 Kbytes/s
AES CBC 256 bits 8000 bytes 128 bytes Decryption Fast 498 800 6415 Kbytes/s
AES CBC 256 bits 8000 bytes 512 bytes Decryption Small 1 716 456 1864 Kbytes/s
AES CBC 256 bits 8000 bytes 512 bytes Decryption Fast 493 952 6478 Kbytes/s
AES CBC 256 bits 8000 bytes 1024 bytes Decryption Small 1 715 216 1865 Kbytes/s
AES CBC 256 bits 8000 bytes 1024 bytes Decryption Fast 492 352 6499 Kbytes/s
AES CBC 256 bits 8000 bytes 2048 bytes Decryption Small 1 713 856 1867 Kbytes/s
AES CBC 256 bits 8000 bytes 2048 bytes Decryption Fast 491 104 6515 Kbytes/s
Cryptolib STM32H753 AES CBC DF Enc.svg
Cryptolib STM32H753 AES CBC DF Dec.svg


The table below shows flash memory and RAM usage (in bytes).

Cipher operation Configuration Code Constant data Global data Stack usage
Encryption Small 2840 bytes 372 bytes 1 byte 144 bytes
Encryption Fast 3160 bytes 1396 bytes 1 byte 172 bytes
Decryption Small 2952 bytes 628 bytes 1 byte 176 bytes
Decryption Fast 3612 bytes 1652 bytes 1 byte 180 bytes
Cryptolib STM32H753 AES CBC DF Enc FP.svg
Cryptolib STM32H753 AES CBC DF Dec FP.svg


2.2. HASH digest

In this section we provide the performance results for HASH using different operation modes:

  • Sole buffer: one sole buffer is hashed. The time to perform is given in us.
  • Data flow: a large message is hashed by chunk. The bit rate is given in bytes per second.

2.2.1. Sole buffer mode

In this mode, the entire message hashing process is managed through a single API call provided by the CMOX library.

The table below shows the number of clock cycles and time (in µs) needed to perform described operation.

HASH mode Buffer size Cycles Time
SHA256 32 bytes 3699 9 µs
SHA256 64 bytes 5477 13 µs
SHA256 128 bytes 7166 17 µs
SHA384 32 bytes 10 219 25 µs
SHA384 64 bytes 10 292 25 µs
SHA384 128 bytes 18 478 46 µs
Cryptolib STM32H753 HASH SB Dig.svg


The table below shows flash memory and RAM usage (in bytes).

HASH mode Code Constant data Global data Stack usage
SHA256 1872 296 bytes 1 byte 564 bytes
SHA384 3068 744 bytes 1 byte 1124 bytes
Cryptolib STM32H753 HASH SB Dig FP.svg


2.2.2. Data flow mode

In this mode, the operation is performed in several calls to the CMOX library APIs, as below:

  • cmox_hash_init
  • cmox_hash_append: called several times to hash the entire message by fixed-size chunk
  • cmox_hash_generateTag

The table below shows the number of clock cycles and bit rate (in kilobytes per second) needed to perform described operation.

HASH mode Message size Chunk size Cycles Bit rate
SHA256 8000 bytes 128 bytes 232 267 13 777 Kbytes/s
SHA256 8000 bytes 512 bytes 215 414 14 855 Kbytes/s
SHA256 8000 bytes 1024 bytes 213 042 15 020 Kbytes/s
SHA256 8000 bytes 2048 bytes 211 832 15 106 Kbytes/s
SHA384 8000 bytes 128 bytes 525 674 6087 Kbytes/s
SHA384 8000 bytes 512 bytes 500 700 6391 Kbytes/s
SHA384 8000 bytes 1024 bytes 496 816 6441 Kbytes/s
SHA384 8000 bytes 2048 bytes 494 839 6466 Kbytes/s
Cryptolib STM32H753 HASH DF Dig.svg


The table below shows the final tag generation done through the call to cmox_hash_generateTag.

HASH mode Cycles Time
SHA256 2997 7 µs
SHA384 9504 23 µs

The table below shows flash memory and RAM usage (in bytes).

HASH mode Code Constant data Global data Stack usage
SHA256 1884 bytes 288 bytes 1 byte 372 bytes
SHA384 3080 bytes 736 bytes 1 byte 828 bytes
Cryptolib STM32H753 HASH DF Dig FP.svg


2.3. ECDSA signature and verification

This section provides the performance results for ECDSA signature and verification.

The table below shows the number of clock cycles and time (in ms) needed to perform the described operation in different configurations.

Curve Operation ECC mathematics configuration Curve definition Cycles Time
SECP256R1 Signature Small Low 2 186 024 5 ms
SECP256R1 Signature Small High 2 102 432 5 ms
SECP256R1 Signature SuperFast Low 1 350 144 3 ms
SECP256R1 Signature SuperFast High 1 261 368 3 ms
SECP256R1 Verification Small Low 5 252 088 13 ms
SECP256R1 Verification Small High 4 608 304 11 ms
SECP256R1 Verification SuperFast Low 3 245 712 8 ms
SECP256R1 Verification SuperFast High 2 801 768 7 ms
SECP384R1 Signature Small Low 6 110 304 15 ms
SECP384R1 Signature Small High 5 791 888 14 ms
SECP384R1 Signature Fast Low 4 951 016 12 ms
SECP384R1 Signature Fast High 4 699 520 11 ms
SECP384R1 Verification Small Low 14 515 016 36 ms
SECP384R1 Verification Small High 12 600 728 31 ms
SECP384R1 Verification Fast Low 11 809 240 29 ms
SECP384R1 Verification Fast High 10 204 608 25 ms
Cryptolib STM32H753 ECDSA Sig.svg
Cryptolib STM32H753 ECDSA Ver.svg


The table below shows ECDSA flash memory and RAM usage (in bytes).

Curve Operation ECC mathematics configuration Curve definition Code Constant data Global data Stack usage Working buffer
SECP256R1 Signature Small Low 11 746 bytes 1184 bytes 1 byte 328 bytes 628 bytes
CP256R1 Signature Small High 11 746 bytes 1568 bytes 1 byte 328 bytes 696 bytes
SECP256R1 Signature SuperFast Low 13 056 bytes 1184 byte 1 byte 332 bytes 628 bytes
SECP256R1 Signature SuperFast High 13 056 bytes 1568 byte 1 byte 332 bytes 696 bytes
SECP256R1 Verification Small Low 12 238 bytes 1200 bytes 1 byte 424 bytes 856 bytes
SECP256R1 Verification Small High 12 238 bytes 1584 bytes 1 byte 424 bytes 1648 bytes
SECP256R1 Verification SuperFast Low 13 548 bytes 1200 bytes 1 byte 428 bytes 856 bytes
SECP256R1 Verification SuperFast High 13 548 bytes 1584 bytes 1 byte 428 bytes 1648 bytes
SECP384R1 Signature Small Low 11 746 bytes 1664 bytes 1 byte 328 bytes 884 bytes
SECP384R1 Signature Small High 11 746 bytes 2240 bytes 1 byte 328 bytes 984 bytes
SECP384R1 Signature Fast Low 12 116 bytes 1664 bytes 1 byte 344 bytes 884 bytes
SECP384R1 Signature Fast High 12 116 bytes 2240 bytes 1 byte 344 bytes 984 bytes
SECP384R1 Verification Small Low 12 238 bytes 1680 bytes 1 byte 424 bytes 1192 bytes
SECP384R1 Verification Small High 12 238 bytes 2256 bytes 1 byte 424 bytes 2272 bytes
SECP384R1 Verification Fast Low 12 608 bytes 1680 bytes 1 byte 440 bytes 1192 bytes
SECP384R1 Verification Fast High 12 608 bytes 2256 bytes 1 byte 440 bytes 2272 bytes
Cryptolib STM32H753 ECDSA SECP256R1 Sig FP.svg
Cryptolib STM32H753 ECDSA SECP256R1 Ver FP.svg
Cryptolib STM32H753 ECDSA SECP384R1 Sig FP.svg
Cryptolib STM32H753 ECDSA SECP384R1 Ver FP.svg


2.4. EdDSA signature and verification

This section provides the performance results for EdDSA signature and verification.

The table below shows the number of clock cycles and time (in ms) needed to perform the described operation in different configurations.

Curve Message size Operation ECC mathematics configuration Curve definition Cycles Time
Ed25519 1023 bytes Signature Small OptLow 3 280 976 8 ms
Ed25519 1023 bytes Signature Small OptHigh 1 906 680 4 ms
Ed25519 1023 bytes Signature SuperFast OptLow 2 174 408 5 ms
Ed25519 1023 bytes Signature SuperFast OptHigh 1 267 800 3 ms
Ed25519 1023 bytes Verification Small OptLow 4 991 552 12 ms
Ed25519 1023 bytes Verification Small OptHigh 4 361 912 10 ms
Ed25519 1023 bytes Verification SuperFast OptLow 3 122 304 7 ms
Ed25519 1023 bytes Verification SuperFast OptHigh 2 722 080 6 ms
Cryptolib STM32H753 EdDSA Sig.svg
Cryptolib STM32H753 EdDSA Ver.svg


The table below shows EdDSA flash memory and RAM usage (in bytes).

Curve Message size Operation ECC mathematics configuration Curve definition Code Constant data Global data Stack usage Working buffer
Ed25519 1023 bytes Signature Small OptLow 14 158 bytes 1744 bytes 1 byte 1236 bytes 1388 bytes
Ed25519 1023 bytes Signature Small OptHigh 14 562 bytes 2896 bytes 1 byte 1236 bytes 1388 bytes
Ed25519 1023 bytes Signature SuperFast OptLow 15 468 bytes 1744 bytes 1 byte 1236 bytes 1388 bytes
Ed25519 1023 bytes Signature SuperFast OptHigh 15 872 bytes 2896 bytes 1 byte 1236 bytes 1388 bytes
Ed25519 1023 bytes Verification Small OptLow 14 256 bytes 1748 bytes 1 byte 1244 bytes 1152 bytes
Ed25519 1023 bytes Verification Small OptHigh 14 660 bytes 2900 bytes 1 byte 1244 bytes 1992 bytes
Ed25519 1023 bytes Verification SuperFast OptLow 15 566 bytes 1748 bytes 1 byte 1244 bytes 1152 bytes
Ed25519 1023 bytes Verification SuperFast OptHigh 15 970 bytes 2900 bytes 1 byte 1244 bytes 1992 bytes
Cryptolib STM32H753 EdDSA Sig FP.svg
Cryptolib STM32H753 EdDSA Ver FP.svg


2.5. RSA signature and verification

This section provides the performance results for RSA signature and verification.

The table below shows the number of clock cycles and time (in ms) needed to perform the described operation in different configurations.

PKCS#1 Priv. key mod. exp. method Hash method Modulus size Operation RSA mathematics configuration Priv. key mod. exp. implementation Cycles Time
v2.2 CRT SHA-256 3K Signature Small Low 150 819 752 377 ms
v2.2 CRT SHA-256 3K Signature Small Mid 113 693 520 284 ms
v2.2 CRT SHA-256 3K Signature Small High 95 444 288 238 ms
v2.2 CRT SHA-256 3K Signature Fast Low 101 419 632 253 ms
v2.2 CRT SHA-256 3K Signature Fast Mid 76 159 688 190 ms
v2.2 CRT SHA-256 3K Signature Fast High 63 965 304 159 ms
v2.2 No CRT SHA-256 3K Signature Small Low 583 580 688 1458 ms
v2.2 No CRT SHA-256 3K Signature Small Mid 438 589 640 1096 ms
v2.2 No CRT SHA-256 3K Signature Small High 366 815 120 917 ms
v2.2 No CRT SHA-256 3K Signature Fast Low 378 080 688 945 ms
v2.2 No CRT SHA-256 3K Signature Fast Mid 283 579 064 708 ms
v2.2 No CRT SHA-256 3K Signature Fast High 237 220 880 593 ms
v2.2 n/a SHA-256 3K Verification Small n/a 2 701 096 6 ms
v2.2 n/a SHA-256 3K Verification Fast n/a 2 020 528 5 ms
Cryptolib STM32H753 RSA Sig.svg
Cryptolib STM32H753 RSA Ver.svg


The table below shows RSA flash memory and RAM usage (in bytes).

PKCS#1 Priv. key mod. exp. method Hash method Modulus size Operation RSA mathematics configuration Priv. key mod. exp. implementation Code Constant data Global data Stack usage Working buffer
v2.2 CRT SHA-256 3K Signature Small Low 7056 bytes 369 bytes 5 bytes 700 bytes 3704 bytes
v2.2 CRT SHA-256 3K Signature Small Mid 7308 bytes 369 bytes 5 bytes 700 bytes 4308 bytes
v2.2 CRT SHA-256 3K Signature Small High 7308 bytes 369 bytes 5 bytes 700 bytes 6708 bytes
v2.2 CRT SHA-256 3K Signature Fast Low 7426 bytes 369 bytes 5 bytes 700 bytes 3704 bytes
v2.2 CRT SHA-256 3K Signature Fast Mid 7678 bytes 369 bytes 5 bytes 700 bytes 4308 bytes
v2.2 CRT SHA-256 3K Signature Fast High 7678 bytes 369 bytes 5 bytes 700 bytes 6708 bytes
v2.2 No CRT SHA-256 3K Signature Small Low 6088 bytes 361 bytes 5 bytes 700 bytes 3484 bytes
v2.2 No CRT SHA-256 3K Signature Small Mid 6340 bytes 361 bytes 5 bytes 700 bytes 4664 bytes
v2.2 No CRT SHA-256 3K Signature Small High 6340 bytes 361 bytes 5 bytes 700 bytes 9368 bytes
v2.2 No CRT SHA-256 3K Signature Fast Low 6458 bytes 361 bytes 5 bytes 700 bytes 3484 bytes
v2.2 No CRT SHA-256 3K Signature Fast Mid 6710 bytes 361 bytes 5 bytes 700 bytes 4664 bytes
v2.2 No CRT SHA-256 3K Signature Fast High 6710 bytes 361 bytes 5 bytes 700 bytes 9368 bytes
v2.2 n/a SHA-256 3K Verification Small n/a 6842 bytes 366 bytes 5 bytes 716 bytes 3108 bytes
v2.2 n/a SHA-256 3K Verification Fast n/a 7212 bytes 366 bytes 5 bytes 716 bytes 3108 bytes
Cryptolib STM32H753 RSA 3K CRT Sig FP.svg
Cryptolib STM32H753 RSA 3K NoCRT Sig FP.svg
Cryptolib STM32H753 RSA 3K Ver FP.svg