Cryptographic performance on STM32G0 Series

This page reports measured performance when using the pure software cryptographic library algorithms with an STM32G0 MCU. In addition to performance figures, the required code footprint and memory are also given.


1. Measurement configuration

1.1. Hardware configuration

STM32 MCU STM32G071RB
Device ID 0x460
Revision ID 0x2000
Board NUCLEO-G071RB

1.2. Firmware configuration

Cryptographic Library version 040000B1[ver. 1]
  1. This value corresponds to the information returned by a call to cmox_getInfos

1.3. System configuration

System Core Clock Frequency 64 MHz
Flash latency 2 wait states
Voltage scaling Range 1
Instruction Cache (ART/ICU) 1 (0: disabled / 1: enabled)
Prefetch Cache (ART) 1 (0: disabled / 1: enabled)

1.4. Development toolchains and compilers

IAR Embedded Workbench IAR ANSI C/C++ Compiler V8.50.4.261/W32 for ARM
Info white.png Information
NOTE: The measurements are done using a project built with High Speed optimization setting enabled.


2. Performance values

2.1. AES symmetric key encryption & decryption

This section provides the performance results for AES-CBC using different modes of operation:

  • Sole buffer: one sole buffer is encrypted or decrypted. Time to perform is given in µs.
  • Data flow: a big message is encrypted or decrypted by chunk. Bit rate is given in kilobytes per second.

2.1.1. Sole buffer mode

In this mode the entire encryption or decryption process, for the whole message size, is managed through a single API call provided by the CMOX library.

The table below shows the number of clock cycles and time (in µs) needed to perform the described operation in small and fast configurations.

AES mode Key size Buffer size Cipher operation Configuration Cycles Time
AES CBC 128 bits 32 bytes Encryption Small 10 142 158 µs
AES CBC 128 bits 32 bytes Encryption Fast 8921 139 µs
AES CBC 128 bits 64 bytes Encryption Small 17 428 272 µs
AES CBC 128 bits 64 bytes Encryption Fast 14 897 232 µs
AES CBC 128 bits 128 bytes Encryption Small 32 000 500 µs
AES CBC 128 bits 128 bytes Encryption Fast 26 849 419 µs
AES CBC 192 bits 32 bytes Encryption Small 11 497 179 µs
AES CBC 192 bits 32 bytes Encryption Fast 9936 155 µs
AES CBC 192 bits 64 bytes Encryption Small 20 107 314 µs
AES CBC 192 bits 64 bytes Encryption Fast 16 928 264 µs
AES CBC 192 bits 128 bytes Encryption Small 37 327 583 µs
AES CBC 192 bits 128 bytes Encryption Fast 30 912 483 µs
AES CBC 256 bits 32 bytes Encryption Small 13 250 207 µs
AES CBC 256 bits 32 bytes Encryption Fast 11 304 176 µs
AES CBC 256 bits 64 bytes Encryption Small 23 184 362 µs
AES CBC 256 bits 64 bytes Encryption Fast 19 312 301 µs
AES CBC 256 bits 128 bytes Encryption Small 43 052 672 µs
AES CBC 256 bits 128 bytes Encryption Fast 35 328 552 µs
AES CBC 128 bits 32 bytes Decryption Small 14 418 225 µs
AES CBC 128 bits 32 bytes Decryption Fast 11 538 180 µs
AES CBC 128 bits 64 bytes Decryption Small 25 974 405 µs
AES CBC 128 bits 64 bytes Decryption Fast 17 798 278 µs
AES CBC 128 bits 128 bytes Decryption Small 49 086 766 µs
AES CBC 128 bits 128 bytes Decryption Fast 30 318 473 µs
AES CBC 192 bits 32 bytes Decryption Small 16 686 260 µs
AES CBC 192 bits 32 bytes Decryption Fast 13 100 204 µs
AES CBC 192 bits 64 bytes Decryption Small 30 486 476 µs
AES CBC 192 bits 64 bytes Decryption Fast 20 408 318 µs
AES CBC 192 bits 128 bytes Decryption Small 58 086 907 µs
AES CBC 192 bits 128 bytes Decryption Fast 35 024 547 µs
AES CBC 256 bits 32 bytes Decryption Small 19 366 302 µs
AES CBC 256 bits 32 bytes Decryption Fast 15 013 234 µs
AES CBC 256 bits 64 bytes Decryption Small 35 410 553 µs
AES CBC 256 bits 64 bytes Decryption Fast 23 381 365 µs
AES CBC 256 bits 128 bytes Decryption Small 67 498 1054 µs
AES CBC 256 bits 128 bytes Decryption Fast 40 117 626 µs
Cryptolib STM32G071 AES CBC SB Enc.svg
Cryptolib STM32G071 AES CBC SB Dec.svg


The table below shows Flash and RAM usage (in bytes).

Cipher operation Configuration Code Constant data Global data Stack usage
Encryption Small 3028 bytes 380 bytes 1 bytes 536 bytes
Encryption Fast 3276 bytes 1404 bytes 1 bytes 540 bytes
Decryption Small 3104 bytes 636 bytes 1 bytes 584 bytes
Decryption Fast 3696 bytes 1660 bytes 1 bytes 560 bytes
Cryptolib STM32G071 AES CBC SB Enc FP.svg
Cryptolib STM32G071 AES CBC SB Dec FP.svg


2.1.2. Data flow mode

In this mode, operation is performed in several calls to the CMOX library APIs, as below:

  • cmox_cipher_init
  • cmox_cipher_setKey
  • cmox_cipher_setIV
  • cmox_cipher_append: called several times to encrypt or decrypt the whole message by chunk of fixed size

The table below shows the number of clock cycles and bit rate (in kilobytes per second) needed to perform described operation in small and in fast configuration.

AES mode Key size Message size Chunk size Cipher operation Configuration Cycles Bit rate
AES CBC 128 bits 8000 bytes 128 bytes Encryption Small 1 856 448 275 kbyte/s
AES CBC 128 bits 8000 bytes 128 bytes Encryption Fast 1 530 384 334 kbyte/s
AES CBC 128 bits 8000 bytes 512 bytes Encryption Small 1 847 568 277 kbyte/s
AES CBC 128 bits 8000 bytes 512 bytes Encryption Fast 1 521 552 336 kbyte/s
AES CBC 128 bits 8000 bytes 1024 bytes Encryption Small 1 846 056 277 kbyte/s
AES CBC 128 bits 8000 bytes 1024 bytes Encryption Fast 1 520 040 336 kbyte/s
AES CBC 128 bits 8000 bytes 2048 bytes Encryption Small 1 845 304 277 kbyte/s
AES CBC 128 bits 8000 bytes 2048 bytes Encryption Fast 1 519 296 336 kbyte/s
AES CBC 192 bits 8000 bytes 128 bytes Encryption Small 2 187 448 234 kbyte/s
AES CBC 192 bits 8000 bytes 128 bytes Encryption Fast 1 784 384 286 kbyte/s
AES CBC 192 bits 8000 bytes 512 bytes Encryption Small 2 178 568 235 kbyte/s
AES CBC 192 bits 8000 bytes 512 bytes Encryption Fast 1 775 552 288 kbyte/s
AES CBC 192 bits 8000 bytes 1024 bytes Encryption Small 2 177 056 235 kbyte/s
AES CBC 192 bits 8000 bytes 1024 bytes Encryption Fast 1 774 048 288 kbyte/s
AES CBC 192 bits 8000 bytes 2048 bytes Encryption Small 2 176 296 235 kbyte/s
AES CBC 192 bits 8000 bytes 2048 bytes Encryption Fast 1 773 296 288 kbyte/s
AES CBC 256 bits 8000 bytes 128 bytes Encryption Small 2 518 448 203 kbyte/s
AES CBC 256 bits 8000 bytes 128 bytes Encryption Fast 2 038 392 251 kbyte/s
AES CBC 256 bits 8000 bytes 512 bytes Encryption Small 2 509 568 204 kbyte/s
AES CBC 256 bits 8000 bytes 512 bytes Encryption Fast 2 029 552 252 kbyte/s
AES CBC 256 bits 8000 bytes 1024 bytes Encryption Small 2 508 056 204 kbyte/s
AES CBC 256 bits 8000 bytes 1024 bytes Encryption Fast 2 028 048 252 kbyte/s
AES CBC 256 bits 8000 bytes 2048 bytes Encryption Small 2 507 296 204 kbyte/s
AES CBC 256 bits 8000 bytes 2048 bytes Encryption Fast 2 027 296 252 kbyte/s
AES CBC 128 bits 8000 bytes 128 bytes Decryption Small 2 926 544 174 kbyte/s
AES CBC 128 bits 8000 bytes 128 bytes Decryption Fast 1 602 360 319 kbyte/s
AES CBC 128 bits 8000 bytes 512 bytes Decryption Small 2 914 088 175 kbyte/s
AES CBC 128 bits 8000 bytes 512 bytes Decryption Fast 1 590 048 322 kbyte/s
AES CBC 128 bits 8000 bytes 1024 bytes Decryption Small 2 910 672 175 kbyte/s
AES CBC 128 bits 8000 bytes 1024 bytes Decryption Fast 1 586 672 322 kbyte/s
AES CBC 128 bits 8000 bytes 2048 bytes Decryption Small 2 906 856 176 kbyte/s
AES CBC 128 bits 8000 bytes 2048 bytes Decryption Fast 1 582 864 323 kbyte/s
AES CBC 192 bits 8000 bytes 128 bytes Decryption Small 3 487 296 146 kbyte/s
AES CBC 192 bits 8000 bytes 128 bytes Decryption Fast 1 864 608 274 kbyte/s
AES CBC 192 bits 8000 bytes 512 bytes Decryption Small 3 475 032 147 kbyte/s
AES CBC 192 bits 8000 bytes 512 bytes Decryption Fast 1 852 096 276 kbyte/s
AES CBC 192 bits 8000 bytes 1024 bytes Decryption Small 3 471 656 147 kbyte/s
AES CBC 192 bits 8000 bytes 1024 bytes Decryption Fast 1 848 680 276 kbyte/s
AES CBC 192 bits 8000 bytes 2048 bytes Decryption Small 3 467 856 147 kbyte/s
AES CBC 192 bits 8000 bytes 2048 bytes Decryption Fast 1 844 864 277 kbyte/s
AES CBC 256 bits 8000 bytes 128 bytes Decryption Small 4 048 536 126 kbyte/s
AES CBC 256 bits 8000 bytes 128 bytes Decryption Fast 2 129 360 240 kbyte/s
AES CBC 256 bits 8000 bytes 512 bytes Decryption Small 4 036 080 126 kbyte/s
AES CBC 256 bits 8000 bytes 512 bytes Decryption Fast 2 117 056 241 kbyte/s
AES CBC 256 bits 8000 bytes 1024 bytes Decryption Small 4 032 680 126 kbyte/s
AES CBC 256 bits 8000 bytes 1024 bytes Decryption Fast 2 113 672 242 kbyte/s
AES CBC 256 bits 8000 bytes 2048 bytes Decryption Small 4 028 856 127 kbyte/s
AES CBC 256 bits 8000 bytes 2048 bytes Decryption Fast 2 109 864 242 kbyte/s
Cryptolib STM32G071 AES CBC DF Enc.svg
Cryptolib STM32G071 AES CBC DF Dec.svg


The table below shows Flash and RAM usage (in bytes).

Cipher operation Configuration Code Constant data Global data Stack usage
Encryption Small 2950 bytes 372 bytes 1 bytes 152 bytes
Encryption Fast 3198 bytes 1396 bytes 1 bytes 164 bytes
Decryption Small 3022 bytes 628 bytes 1 bytes 208 bytes
Decryption Fast 3614 bytes 1652 bytes 1 bytes 184 bytes
Cryptolib STM32G071 AES CBC DF Enc FP.svg
Cryptolib STM32G071 AES CBC DF Dec FP.svg


2.2. HASH digest

In this section we provide the performance results for HASH using different modes of operation:

  • Sole buffer: one sole buffer is hashed. Time to perform is given in us.
  • Data flow: a big message is hashed by chunk. Bit rate is given in bytes per s.

2.2.1. Sole buffer mode

In this mode, the entire message hashing process is managed through a single API call provided by the CMOX library.

The table below shows the number of clock cycles and time (in µs) needed to perform described operation.

HASH mode Buffer size Cycles Time
SHA256 32 bytes 11 081 173 µs
SHA256 64 bytes 19 241 300 µs
SHA256 128 bytes 27 309 426 µs
SHA384 32 bytes 38 735 605 µs
SHA384 64 bytes 38 745 605 µs
SHA384 128 bytes 73 045 1141 µs
Cryptolib STM32G071 HASH SB Dig.svg


The table below shows Flash and RAM usage (in bytes).

HASH mode Code Constant data Global data Stack usage
SHA256 1846 296 bytes 1 bytes 580 bytes
SHA384 3158 744 bytes 1 bytes 1132 bytes
Cryptolib STM32G071 HASH SB Dig FP.svg


2.2.2. Data flow mode

In this mode, operation is performed in several calls to the CMOX library APIs, as below:

  • cmox_hash_init
  • cmox_hash_append: called several times to hash the whole message by chunk of fixed size
  • cmox_hash_generateTag

The table below shows the number of clock cycles and bit rate (in kilobytes per second) needed to perform described operation.

HASH mode Message size Chunk size Cycles Bit rate
SHA256 8000 bytes 128 bytes 1 031 181 496 kbyte/s
SHA256 8000 bytes 512 bytes 1 017 269 503 kbyte/s
SHA256 8000 bytes 1024 bytes 1 014 901 504 kbyte/s
SHA256 8000 bytes 2048 bytes 1 013 717 505 kbyte/s
SHA384 8000 bytes 128 bytes 2 143 651 238 kbyte/s
SHA384 8000 bytes 512 bytes 2 127 898 240 kbyte/s
SHA384 8000 bytes 1024 bytes 2 125 194 240 kbyte/s
SHA384 8000 bytes 2048 bytes 2 123 842 241 kbyte/s
Cryptolib STM32G071 HASH DF Dig.svg


The table below shows final tag generation done through the call to cmox_hash_generateTag.

HASH mode Cycles Time
SHA256 10 336 161 µs
SHA384 37 935 592 µs

The table below shows Flash and RAM usage (in bytes).

HASH mode Code Constant data Global data Stack usage
SHA256 1874 bytes 288 bytes 1 bytes 380 bytes
SHA384 3186 bytes 736 bytes 1 bytes 828 bytes
Cryptolib STM32G071 HASH DF Dig FP.svg


2.3. ECDSA signature & verification

In this section we provide the performance results for ECDSA signature & verification.

The table below shows the number of clock cycles and time (in ms) needed to perform described operation in different configurations.

Curve Operation ECC mathematics configuration Curve definition Cycles Time
SECP256R1 Signature Small Low 12 375 208 193 ms
SECP256R1 Signature Small High 11 920 184 186 ms
SECP256R1 Signature SuperFast Low 9 316 976 145 ms
SECP256R1 Signature SuperFast High 9 035 616 141 ms
SECP256R1 Verification Small Low 29 309 224 457 ms
SECP256R1 Verification Small High 25 839 976 403 ms
SECP256R1 Verification SuperFast Low 22 311 256 348 ms
SECP256R1 Verification SuperFast High 19 781 112 309 ms
SECP384R1 Signature Small Low 39 214 864 612 ms
SECP384R1 Signature Small High 37 467 128 585 ms
SECP384R1 Signature Fast Low 33 184 800 518 ms
SECP384R1 Signature Fast High 31 892 872 498 ms
SECP384R1 Verification Small Low 92 640 888 1447 ms
SECP384R1 Verification Small High 80 571 880 1258 ms
SECP384R1 Verification Fast Low 78 845 888 1231 ms
SECP384R1 Verification Fast High 68 981 728 1077 ms
Cryptolib STM32G071 ECDSA Sig.svg
Cryptolib STM32G071 ECDSA Ver.svg


The table below shows ECDSA Flash and RAM usage (in bytes).

Curve Operation ECC mathematics configuration Curve definition Code Constant data Global data Stack usage Working buffer
SECP256R1 Signature Small Low 11 900 bytes 1184 bytes 1 bytes 320 bytes 628 bytes
SECP256R1 Signature Small High 11 900 bytes 1568 bytes 1 bytes 320 bytes 696 bytes
SECP256R1 Signature SuperFast Low 15 240 bytes 1184 bytes 1 bytes 368 bytes 628 bytes
SECP256R1 Signature SuperFast High 15 240 bytes 1568 bytes 1 bytes 368 bytes 696 bytes
SECP256R1 Verification Small Low 12 370 bytes 1200 bytes 1 bytes 408 bytes 856 bytes
SECP256R1 Verification Small High 12 370 bytes 1584 bytes 1 bytes 408 bytes 1648 bytes
SECP256R1 Verification SuperFast Low 15 710 bytes 1200 bytes 1 bytes 456 bytes 856 bytes
SECP256R1 Verification SuperFast High 15 710 bytes 1584 bytes 1 bytes 456 bytes 1648 bytes
SECP384R1 Signature Small Low 11 900 bytes 1664 bytes 1 bytes 320 bytes 884 bytes
SECP384R1 Signature Small High 11 900 bytes 2240 bytes 1 bytes 320 bytes 984 bytes
SECP384R1 Signature Fast Low 12 738 bytes 1664 bytes 1 bytes 312 bytes 884 bytes
SECP384R1 Signature Fast High 12 738 bytes 2240 bytes 1 bytes 312 bytes 984 bytes
SECP384R1 Verification Small Low 12 370 bytes 1680 bytes 1 bytes 408 bytes 1192 bytes
SECP384R1 Verification Small High 12 370 bytes 2256 bytes 1 bytes 408 bytes 2272 bytes
SECP384R1 Verification Fast Low 13 208 bytes 1680 bytes 1 bytes 400 bytes 1192 bytes
SECP384R1 Verification Fast High 13 208 bytes 2256 bytes 1 bytes 400 bytes 2272 bytes
Cryptolib STM32G071 ECDSA SECP256R1 Sig FP.svg
Cryptolib STM32G071 ECDSA SECP256R1 Ver FP.svg
Cryptolib STM32G071 ECDSA SECP384R1 Sig FP.svg
Cryptolib STM32G071 ECDSA SECP384R1 Ver FP.svg


2.4. EdDSA signature & verification

In this section we provide the performance results for EdDSA signature & verification.

The table below shows the number of clock cycles and time (in ms) needed to perform described operation in different configurations.

Curve Message size Operation ECC mathematics configuration Curve definition Cycles Time
Ed25519 1023 bytes Signature Small OptLow 17 542 344 274 ms
Ed25519 1023 bytes Signature Small OptHigh 10 049 208 157 ms
Ed25519 1023 bytes Signature SuperFast OptLow 13 894 560 217 ms
Ed25519 1023 bytes Signature SuperFast OptHigh 7 847 488 122 ms
Ed25519 1023 bytes Verification Small OptLow 27 592 888 431 ms
Ed25519 1023 bytes Verification Small OptHigh 24 076 144 376 ms
Ed25519 1023 bytes Verification SuperFast OptLow 21 383 760 334 ms
Ed25519 1023 bytes Verification SuperFast OptHigh 18 260 824 285 ms
Cryptolib STM32G071 EdDSA Sig.svg
Cryptolib STM32G071 EdDSA Ver.svg


The table below shows EdDSA Flash and RAM usage (in bytes).

Curve Message size Operation ECC mathematics configuration Curve definition Code Constant data Global data Stack usage Working buffer
Ed25519 1023 bytes Signature Small OptLow 14 550 bytes 1744 bytes 1 bytes 1236 bytes 1388 bytes
Ed25519 1023 bytes Signature Small OptHigh 14 972 bytes 2896 bytes 1 bytes 1236 bytes 1388 bytes
Ed25519 1023 bytes Signature SuperFast OptLow 17 890 bytes 1744 bytes 1 bytes 1236 bytes 1388 bytes
Ed25519 1023 bytes Signature SuperFast OptHigh 18 312 bytes 2896 bytes 1 bytes 1236 bytes 1388 bytes
Ed25519 1023 bytes Verification Small OptLow 14 608 bytes 1748 bytes 1 bytes 1236 bytes 1152 bytes
Ed25519 1023 bytes Verification Small OptHigh 15 030 bytes 2900 bytes 1 bytes 1236 bytes 1992 bytes
Ed25519 1023 bytes Verification SuperFast OptLow 17 948 bytes 1748 bytes 1 bytes 1236 bytes 1152 bytes
Ed25519 1023 bytes Verification SuperFast OptHigh 18 370 bytes 2900 bytes 1 bytes 1236 bytes 1992 bytes
Cryptolib STM32G071 EdDSA Sig FP.svg
Cryptolib STM32G071 EdDSA Ver FP.svg


2.5. RSA signature & verification

In this section we provide the performance results for RSA signature & verification.

The table below shows the number of clock cycles and time (in ms) needed to perform described operation in different configurations.

PKCS#1 Priv. key mod. exp. method Hash method Modulus size Operation RSA mathematics configuration Priv. key mod. exp. implementation Cycles Time
v2.2 CRT SHA-256 3K Signature Small Low 1 094 400 296 17 100 ms
v2.2 CRT SHA-256 3K Signature Small Mid 832 871 456 13 013 ms
v2.2 CRT SHA-256 3K Signature Small High 694 549 312 10 852 ms
v2.2 CRT SHA-256 3K Signature Fast Low 922 033 912 14 406 ms
v2.2 CRT SHA-256 3K Signature Fast Mid 664 077 128 10 376 ms
v2.2 CRT SHA-256 3K Signature Fast High 551 535 136 8617 ms
v2.2 No CRT SHA-256 3K Signature Small Low 4 309 163 808 67 330 ms
v2.2 No CRT SHA-256 3K Signature Small Mid 3 276 559 544 51 196 ms
v2.2 No CRT SHA-256 3K Signature Small High 2 722 194 536 42 534 ms
v2.2 No CRT SHA-256 3K Signature Fast Low 3 624 891 256 56 638 ms
v2.2 No CRT SHA-256 3K Signature Fast Mid 2 599 467 320 40 616 ms
v2.2 No CRT SHA-256 3K Signature Fast High 2 147 945 392 33 561 ms
v2.2 n/a SHA-256 3K Verification Small n/a 17 091 112 267 ms
v2.2 n/a SHA-256 3K Verification Fast n/a 14 019 016 219 ms
Cryptolib STM32G071 RSA Sig.svg
Cryptolib STM32G071 RSA Ver.svg


The table below shows RSA Flash and RAM usage (in bytes).

PKCS#1 Priv. key mod. exp. method Hash method Modulus size Operation RSA mathematics configuration Priv. key mod. exp. implementation Code Constant data Global data Stack usage Working buffer
v2.2 CRT SHA-256 3K Signature Small Low 7260 bytes 370 bytes 5 bytes 708 bytes 3704 bytes
v2.2 CRT SHA-256 3K Signature Small Mid 7538 bytes 370 bytes 5 bytes 708 bytes 4308 bytes
v2.2 CRT SHA-256 3K Signature Small High 7538 bytes 370 bytes 5 bytes 708 bytes 6708 bytes
v2.2 CRT SHA-256 3K Signature Fast Low 8098 bytes 369 bytes 5 bytes 708 bytes 3704 bytes
v2.2 CRT SHA-256 3K Signature Fast Mid 8376 bytes 369 bytes 5 bytes 708 bytes 4308 bytes
v2.2 CRT SHA-256 3K Signature Fast High 8376 bytes 369 bytes 5 bytes 708 bytes 6708 bytes
v2.2 No CRT SHA-256 3K Signature Small Low 6274 bytes 361 bytes 5 bytes 708 bytes 3484 bytes
v2.2 No CRT SHA-256 3K Signature Small Mid 6552 bytes 361 bytes 5 bytes 708 bytes 4664 bytes
v2.2 No CRT SHA-256 3K Signature Small High 6552 bytes 361 bytes 5 bytes 708 bytes 9368 bytes
v2.2 No CRT SHA-256 3K Signature Fast Low 7112 bytes 361 bytes 5 bytes 708 bytes 3484 bytes
v2.2 No CRT SHA-256 3K Signature Fast Mid 7390 bytes 362 bytes 5 bytes 708 bytes 4664 bytes
v2.2 No CRT SHA-256 3K Signature Fast High 7390 bytes 362 bytes 5 bytes 708 bytes 9368 bytes
v2.2 n/a SHA-256 3K Verification Small n/a 7054 bytes 365 bytes 5 bytes 724 bytes 3108 bytes
v2.2 n/a SHA-256 3K Verification Fast n/a 7892 bytes 365 bytes 5 bytes 724 bytes 3108 bytes
Cryptolib STM32G071 RSA 3K CRT Sig FP.svg
Cryptolib STM32G071 RSA 3K NoCRT Sig FP.svg
Cryptolib STM32G071 RSA 3K Ver FP.svg