Cryptographic performance on STM32G4 Series

This page reports measured performance when using the pure software cryptographic library algorithms with an STM32G4 MCU. In addition to performance figures, the required code footprint and memory are also given.


1. Measurement configuration

1.1. Hardware configuration

STM32 MCU STM32G474RET6
Device ID 0x469
Revision ID 0x2000
Board NUCLEO-G474RE RevC

1.2. Firmware configuration

Cryptographic Library version 040000B1[ver. 1]
  1. This value corresponds to the information returned by a call to cmox_getInfos

1.3. System configuration

System Core Clock Frequency 170 MHz
Flash latency 8 wait states
Voltage scaling Range 0
Dual bank 0 (0: Single / 1: Dual)
Instruction Cache (ART/ICU) 1 (0: disabled / 1: enabled)
Data Cache (ART/DCU) 1 (0: disabled / 1: enabled)
Prefetch Cache (ART) 1 (0: disabled / 1: enabled)

1.4. Development toolchains and compilers

IAR Embedded Workbench IAR ANSI C/C++ Compiler V8.50.4.261/W32 for ARM
Info white.png Information
NOTE: The measurements are done using a project built with High Speed optimization setting enabled.


2. Performance values

2.1. AES symmetric key encryption & decryption

This section provides the performance results for AES-CBC using different modes of operation:

  • Sole buffer: one sole buffer is encrypted or decrypted. Time to perform is given in µs.
  • Data flow: a big message is encrypted or decrypted by chunk. Bit rate is given in kilobytes per second.

2.1.1. Sole buffer mode

In this mode the entire encryption or decryption process, for the whole message size, is managed through a single API call provided by the CMOX library.

The table below shows the number of clock cycles and time (in µs) needed to perform the described operation in small and fast configurations.

AES mode Key size Buffer size Cipher operation Configuration Cycles Time
AES CBC 128 bits 32 bytes Encryption Small 6993 41 µs
AES CBC 128 bits 32 bytes Encryption Fast 8860 52 µs
AES CBC 128 bits 64 bytes Encryption Small 10 888 64 µs
AES CBC 128 bits 64 bytes Encryption Fast 14 364 84 µs
AES CBC 128 bits 128 bytes Encryption Small 18 572 109 µs
AES CBC 128 bits 128 bytes Encryption Fast 25 151 147 µs
AES CBC 192 bits 32 bytes Encryption Small 7521 44 µs
AES CBC 192 bits 32 bytes Encryption Fast 9815 57 µs
AES CBC 192 bits 64 bytes Encryption Small 12 022 70 µs
AES CBC 192 bits 64 bytes Encryption Fast 16 291 95 µs
AES CBC 192 bits 128 bytes Encryption Small 20 943 123 µs
AES CBC 192 bits 128 bytes Encryption Fast 28 738 169 µs
AES CBC 256 bits 32 bytes Encryption Small 8947 52 µs
AES CBC 256 bits 32 bytes Encryption Fast 11 230 66 µs
AES CBC 256 bits 64 bytes Encryption Small 14 108 82 µs
AES CBC 256 bits 64 bytes Encryption Fast 18 495 108 µs
AES CBC 256 bits 128 bytes Encryption Small 24 080 141 µs
AES CBC 256 bits 128 bytes Encryption Fast 32 657 192 µs
AES CBC 128 bits 32 bytes Decryption Small 11 239 66 µs
AES CBC 128 bits 32 bytes Decryption Fast 12 335 72 µs
AES CBC 128 bits 64 bytes Decryption Small 18 951 111 µs
AES CBC 128 bits 64 bytes Decryption Fast 17 811 104 µs
AES CBC 128 bits 128 bytes Decryption Small 34 403 202 µs
AES CBC 128 bits 128 bytes Decryption Fast 28 649 168 µs
AES CBC 192 bits 32 bytes Decryption Small 12 455 73 µs
AES CBC 192 bits 32 bytes Decryption Fast 14 250 83 µs
AES CBC 192 bits 64 bytes Decryption Small 21 794 128 µs
AES CBC 192 bits 64 bytes Decryption Fast 20 754 122 µs
AES CBC 192 bits 128 bytes Decryption Small 40 409 237 µs
AES CBC 192 bits 128 bytes Decryption Fast 33 476 196 µs
AES CBC 256 bits 32 bytes Decryption Small 14 549 85 µs
AES CBC 256 bits 32 bytes Decryption Fast 16 193 95 µs
AES CBC 256 bits 64 bytes Decryption Small 25 416 149 µs
AES CBC 256 bits 64 bytes Decryption Fast 23 435 137 µs
AES CBC 256 bits 128 bytes Decryption Small 47 180 277 µs
AES CBC 256 bits 128 bytes Decryption Fast 37 869 222 µs
Cryptolib STM32G474 AES CBC SB Enc.svg
Cryptolib STM32G474 AES CBC SB Dec.svg


The table below shows Flash and RAM usage (in bytes).

Cipher operation Configuration Code Constant data Global data Stack usage
Encryption Small 2936 bytes 380 bytes 1 bytes 524 bytes
Encryption Fast 3188 bytes 1404 bytes 1 bytes 548 bytes
Decryption Small 3068 bytes 636 bytes 1 bytes 552 bytes
Decryption Fast 3644 bytes 1660 bytes 1 bytes 556 bytes
Cryptolib STM32G474 AES CBC SB Enc FP.svg
Cryptolib STM32G474 AES CBC SB Dec FP.svg


2.1.2. Data flow mode

In this mode, operation is performed in several calls to the CMOX library APIs, as below:

  • cmox_cipher_init
  • cmox_cipher_setKey
  • cmox_cipher_setIV
  • cmox_cipher_append: called several times to encrypt or decrypt the whole message by chunk of fixed size

The table below shows the number of clock cycles and bit rate (in kilobytes per second) needed to perform described operation in small and in fast configuration.

AES mode Key size Message size Chunk size Cipher operation Configuration Cycles Bit rate
AES CBC 128 bits 8000 bytes 128 bytes Encryption Small 995 848 1365 kbyte/s
AES CBC 128 bits 8000 bytes 128 bytes Encryption Fast 1 376 936 987 kbyte/s
AES CBC 128 bits 8000 bytes 512 bytes Encryption Small 981 672 1385 kbyte/s
AES CBC 128 bits 8000 bytes 512 bytes Encryption Fast 1 325 952 1025 kbyte/s
AES CBC 128 bits 8000 bytes 1024 bytes Encryption Small 979 264 1388 kbyte/s
AES CBC 128 bits 8000 bytes 1024 bytes Encryption Fast 1 312 832 1035 kbyte/s
AES CBC 128 bits 8000 bytes 2048 bytes Encryption Small 978 088 1390 kbyte/s
AES CBC 128 bits 8000 bytes 2048 bytes Encryption Fast 1 306 064 1041 kbyte/s
AES CBC 192 bits 8000 bytes 128 bytes Encryption Small 1 142 656 1190 kbyte/s
AES CBC 192 bits 8000 bytes 128 bytes Encryption Fast 1 600 632 849 kbyte/s
AES CBC 192 bits 8000 bytes 512 bytes Encryption Small 1 133 704 1199 kbyte/s
AES CBC 192 bits 8000 bytes 512 bytes Encryption Fast 1 550 344 877 kbyte/s
AES CBC 192 bits 8000 bytes 1024 bytes Encryption Small 1 132 152 1201 kbyte/s
AES CBC 192 bits 8000 bytes 1024 bytes Encryption Fast 1 538 360 884 kbyte/s
AES CBC 192 bits 8000 bytes 2048 bytes Encryption Small 1 131 416 1202 kbyte/s
AES CBC 192 bits 8000 bytes 2048 bytes Encryption Fast 1 531 480 888 kbyte/s
AES CBC 256 bits 8000 bytes 128 bytes Encryption Small 1 303 512 1043 kbyte/s
AES CBC 256 bits 8000 bytes 128 bytes Encryption Fast 1 825 304 745 kbyte/s
AES CBC 256 bits 8000 bytes 512 bytes Encryption Small 1 289 280 1054 kbyte/s
AES CBC 256 bits 8000 bytes 512 bytes Encryption Fast 1 767 080 769 kbyte/s
AES CBC 256 bits 8000 bytes 1024 bytes Encryption Small 1 286 864 1056 kbyte/s
AES CBC 256 bits 8000 bytes 1024 bytes Encryption Fast 1 755 480 774 kbyte/s
AES CBC 256 bits 8000 bytes 2048 bytes Encryption Small 1 285 672 1057 kbyte/s
AES CBC 256 bits 8000 bytes 2048 bytes Encryption Fast 1 749 592 777 kbyte/s
AES CBC 128 bits 8000 bytes 128 bytes Decryption Small 2 007 112 677 kbyte/s
AES CBC 128 bits 8000 bytes 128 bytes Decryption Fast 1 439 616 944 kbyte/s
AES CBC 128 bits 8000 bytes 512 bytes Decryption Small 1 982 184 686 kbyte/s
AES CBC 128 bits 8000 bytes 512 bytes Decryption Fast 1 395 696 974 kbyte/s
AES CBC 128 bits 8000 bytes 1024 bytes Decryption Small 1 977 008 687 kbyte/s
AES CBC 128 bits 8000 bytes 1024 bytes Decryption Fast 1 386 136 981 kbyte/s
AES CBC 128 bits 8000 bytes 2048 bytes Decryption Small 1 971 088 689 kbyte/s
AES CBC 128 bits 8000 bytes 2048 bytes Decryption Fast 1 377 064 987 kbyte/s
AES CBC 192 bits 8000 bytes 128 bytes Decryption Small 2 379 848 571 kbyte/s
AES CBC 192 bits 8000 bytes 128 bytes Decryption Fast 1 666 904 815 kbyte/s
AES CBC 192 bits 8000 bytes 512 bytes Decryption Small 2 355 176 577 kbyte/s
AES CBC 192 bits 8000 bytes 512 bytes Decryption Fast 1 614 960 842 kbyte/s
AES CBC 192 bits 8000 bytes 1024 bytes Decryption Small 2 348 760 579 kbyte/s
AES CBC 192 bits 8000 bytes 1024 bytes Decryption Fast 1 602 424 848 kbyte/s
AES CBC 192 bits 8000 bytes 2048 bytes Decryption Small 2 342 600 580 kbyte/s
AES CBC 192 bits 8000 bytes 2048 bytes Decryption Fast 1 596 944 851 kbyte/s
AES CBC 256 bits 8000 bytes 128 bytes Decryption Small 2 749 360 494 kbyte/s
AES CBC 256 bits 8000 bytes 128 bytes Decryption Fast 1 906 672 713 kbyte/s
AES CBC 256 bits 8000 bytes 512 bytes Decryption Small 2 724 360 499 kbyte/s
AES CBC 256 bits 8000 bytes 512 bytes Decryption Fast 1 857 408 732 kbyte/s
AES CBC 256 bits 8000 bytes 1024 bytes Decryption Small 2 721 888 499 kbyte/s
AES CBC 256 bits 8000 bytes 1024 bytes Decryption Fast 1 839 936 739 kbyte/s
AES CBC 256 bits 8000 bytes 2048 bytes Decryption Small 2 718 888 500 kbyte/s
AES CBC 256 bits 8000 bytes 2048 bytes Decryption Fast 1 830 112 743 kbyte/s
Cryptolib STM32G474 AES CBC DF Enc.svg
Cryptolib STM32G474 AES CBC DF Dec.svg


The table below shows Flash and RAM usage (in bytes).

Cipher operation Configuration Code Constant data Global data Stack usage
Encryption Small 2828 bytes 372 bytes 1 bytes 140 bytes
Encryption Fast 3080 bytes 1396 bytes 1 bytes 172 bytes
Decryption Small 2960 bytes 628 bytes 1 bytes 176 bytes
Decryption Fast 3536 bytes 1652 bytes 1 bytes 180 bytes
Cryptolib STM32G474 AES CBC DF Enc FP.svg
Cryptolib STM32G474 AES CBC DF Dec FP.svg


2.2. HASH digest

In this section we provide the performance results for HASH using different modes of operation:

  • Sole buffer: one sole buffer is hashed. Time to perform is given in us.
  • Data flow: a big message is hashed by chunk. Bit rate is given in bytes per s.

2.2.1. Sole buffer mode

In this mode, the entire message hashing process is managed through a single API call provided by the CMOX library.

The table below shows the number of clock cycles and time (in µs) needed to perform described operation.

HASH mode Buffer size Cycles Time
SHA256 32 bytes 6240 36 µs
SHA256 64 bytes 9708 57 µs
SHA256 128 bytes 12 833 75 µs
SHA384 32 bytes 20 316 119 µs
SHA384 64 bytes 20 522 120 µs
SHA384 128 bytes 37 709 221 µs
Cryptolib STM32G474 HASH SB Dig.svg


The table below shows Flash and RAM usage (in bytes).

HASH mode Code Constant data Global data Stack usage
SHA256 1848 296 bytes 1 bytes 564 bytes
SHA384 3004 744 bytes 1 bytes 1124 bytes
Cryptolib STM32G474 HASH SB Dig FP.svg


2.2.2. Data flow mode

In this mode, operation is performed in several calls to the CMOX library APIs, as below:

  • cmox_hash_init
  • cmox_hash_append: called several times to hash the whole message by chunk of fixed size
  • cmox_hash_generateTag

The table below shows the number of clock cycles and bit rate (in kilobytes per second) needed to perform described operation.

HASH mode Message size Chunk size Cycles Bit rate
SHA256 8000 bytes 128 bytes 431 844 3149 kbyte/s
SHA256 8000 bytes 512 bytes 404 819 3359 kbyte/s
SHA256 8000 bytes 1024 bytes 400 219 3398 kbyte/s
SHA256 8000 bytes 2048 bytes 397 919 3417 kbyte/s
SHA384 8000 bytes 128 bytes 1 109 125 1226 kbyte/s
SHA384 8000 bytes 512 bytes 1 055 668 1288 kbyte/s
SHA384 8000 bytes 1024 bytes 1 046 404 1299 kbyte/s
SHA384 8000 bytes 2048 bytes 1 041 772 1305 kbyte/s
Cryptolib STM32G474 HASH DF Dig.svg


The table below shows final tag generation done through the call to cmox_hash_generateTag.

HASH mode Cycles Time
SHA256 4932 29 µs
SHA384 18 731 110 µs

The table below shows Flash and RAM usage (in bytes).

HASH mode Code Constant data Global data Stack usage
SHA256 1856 bytes 288 bytes 1 bytes 372 bytes
SHA384 3012 bytes 736 bytes 1 bytes 828 bytes
Cryptolib STM32G474 HASH DF Dig FP.svg


2.3. ECDSA signature & verification

In this section we provide the performance results for ECDSA signature & verification.

The table below shows the number of clock cycles and time (in ms) needed to perform described operation in different configurations.

Curve Operation ECC mathematics configuration Curve definition Cycles Time
SECP256R1 Signature Small Low 3 146 816 18 ms
SECP256R1 Signature Small High 3 060 560 18 ms
SECP256R1 Signature SuperFast Low 3 042 360 17 ms
SECP256R1 Signature SuperFast High 2 957 360 17 ms
SECP256R1 Verification Small Low 7 704 120 45 ms
SECP256R1 Verification Small High 6 821 808 40 ms
SECP256R1 Verification SuperFast Low 7 414 376 43 ms
SECP256R1 Verification SuperFast High 6 575 536 38 ms
SECP384R1 Signature Small Low 8 498 928 49 ms
SECP384R1 Signature Small High 8 140 592 47 ms
SECP384R1 Signature Fast Low 8 480 176 49 ms
SECP384R1 Signature Fast High 8 102 872 47 ms
SECP384R1 Verification Small Low 20 555 648 120 ms
SECP384R1 Verification Small High 17 872 888 105 ms
SECP384R1 Verification Fast Low 20 536 648 120 ms
SECP384R1 Verification Fast High 17 816 224 104 ms
Cryptolib STM32G474 ECDSA Sig.svg
Cryptolib STM32G474 ECDSA Ver.svg


The table below shows ECDSA Flash and RAM usage (in bytes).

Curve Operation ECC mathematics configuration Curve definition Code Constant data Global data Stack usage Working buffer
SECP256R1 Signature Small Low 11 732 bytes 1184 bytes 1 bytes 328 bytes 628 bytes
SECP256R1 Signature Small High 11 732 bytes 1568 bytes 1 bytes 328 bytes 696 bytes
SECP256R1 Signature SuperFast Low 13 042 bytes 1184 bytes 1 bytes 332 bytes 628 bytes
SECP256R1 Signature SuperFast High 13 042 bytes 1568 bytes 1 bytes 332 bytes 696 bytes
SECP256R1 Verification Small Low 12 216 bytes 1200 bytes 1 bytes 424 bytes 856 bytes
SECP256R1 Verification Small High 12 216 bytes 1584 bytes 1 bytes 424 bytes 1648 bytes
SECP256R1 Verification SuperFast Low 13 526 bytes 1200 bytes 1 bytes 428 bytes 856 bytes
SECP256R1 Verification SuperFast High 13 526 bytes 1584 bytes 1 bytes 428 bytes 1648 bytes
SECP384R1 Signature Small Low 11 732 bytes 1664 bytes 1 bytes 328 bytes 884 bytes
SECP384R1 Signature Small High 11 732 bytes 2240 bytes 1 bytes 328 bytes 984 bytes
SECP384R1 Signature Fast Low 12 102 bytes 1664 bytes 1 bytes 344 bytes 884 bytes
SECP384R1 Signature Fast High 12 102 bytes 2240 bytes 1 bytes 344 bytes 984 bytes
SECP384R1 Verification Small Low 12 216 bytes 1680 bytes 1 bytes 424 bytes 1192 bytes
SECP384R1 Verification Small High 12 216 bytes 2256 bytes 1 bytes 424 bytes 2272 bytes
SECP384R1 Verification Fast Low 12 586 bytes 1680 bytes 1 bytes 440 bytes 1192 bytes
SECP384R1 Verification Fast High 12 586 bytes 2256 bytes 1 bytes 440 bytes 2272 bytes
Cryptolib STM32G474 ECDSA SECP256R1 Sig FP.svg
Cryptolib STM32G474 ECDSA SECP256R1 Ver FP.svg
Cryptolib STM32G474 ECDSA SECP384R1 Sig FP.svg
Cryptolib STM32G474 ECDSA SECP384R1 Ver FP.svg


2.4. EdDSA signature & verification

In this section we provide the performance results for EdDSA signature & verification.

The table below shows the number of clock cycles and time (in ms) needed to perform described operation in different configurations.

Curve Message size Operation ECC mathematics configuration Curve definition Cycles Time
Ed25519 1023 bytes Signature Small OptLow 5 034 568 29 ms
Ed25519 1023 bytes Signature Small OptHigh 2 936 224 17 ms
Ed25519 1023 bytes Signature SuperFast OptLow 4 867 600 28 ms
Ed25519 1023 bytes Signature SuperFast OptHigh 2 857 728 16 ms
Ed25519 1023 bytes Verification Small OptLow 7 482 072 44 ms
Ed25519 1023 bytes Verification Small OptHigh 6 556 072 38 ms
Ed25519 1023 bytes Verification SuperFast OptLow 7 202 600 42 ms
Ed25519 1023 bytes Verification SuperFast OptHigh 6 341 968 37 ms
Cryptolib STM32G474 EdDSA Sig.svg
Cryptolib STM32G474 EdDSA Ver.svg


The table below shows EdDSA Flash and RAM usage (in bytes).

Curve Message size Operation ECC mathematics configuration Curve definition Code Constant data Global data Stack usage Working buffer
Ed25519 1023 bytes Signature Small OptLow 14 088 bytes 1744 bytes 1 bytes 1236 bytes 1388 bytes
Ed25519 1023 bytes Signature Small OptHigh 14 494 bytes 2896 bytes 1 bytes 1236 bytes 1388 bytes
Ed25519 1023 bytes Signature SuperFast OptLow 15 398 bytes 1744 bytes 1 bytes 1236 bytes 1388 bytes
Ed25519 1023 bytes Signature SuperFast OptHigh 15 804 bytes 2896 bytes 1 bytes 1236 bytes 1388 bytes
Ed25519 1023 bytes Verification Small OptLow 14 178 bytes 1748 bytes 1 bytes 1244 bytes 1152 bytes
Ed25519 1023 bytes Verification Small OptHigh 14 584 bytes 2900 bytes 1 bytes 1244 bytes 1992 bytes
Ed25519 1023 bytes Verification SuperFast OptLow 15 488 bytes 1748 bytes 1 bytes 1244 bytes 1152 bytes
Ed25519 1023 bytes Verification SuperFast OptHigh 15 894 bytes 2900 bytes 1 bytes 1244 bytes 1992 bytes
Cryptolib STM32G474 EdDSA Sig FP.svg
Cryptolib STM32G474 EdDSA Ver FP.svg


2.5. RSA signature & verification

In this section we provide the performance results for RSA signature & verification.

The table below shows the number of clock cycles and time (in ms) needed to perform described operation in different configurations.

PKCS#1 Priv. key mod. exp. method Hash method Modulus size Operation RSA mathematics configuration Priv. key mod. exp. implementation Cycles Time
v2.2 CRT SHA-256 3K Signature Small Low 187 676 128 1103 ms
v2.2 CRT SHA-256 3K Signature Small Mid 141 312 344 831 ms
v2.2 CRT SHA-256 3K Signature Small High 118 686 408 698 ms
v2.2 CRT SHA-256 3K Signature Fast Low 187 014 168 1100 ms
v2.2 CRT SHA-256 3K Signature Fast Mid 141 097 208 829 ms
v2.2 CRT SHA-256 3K Signature Fast High 118 396 064 696 ms
v2.2 No CRT SHA-256 3K Signature Small Low 713 575 920 4197 ms
v2.2 No CRT SHA-256 3K Signature Small Mid 536 012 128 3153 ms
v2.2 No CRT SHA-256 3K Signature Small High 448 377 888 2637 ms
v2.2 No CRT SHA-256 3K Signature Fast Low 712 492 720 4191 ms
v2.2 No CRT SHA-256 3K Signature Fast Mid 535 410 056 3149 ms
v2.2 No CRT SHA-256 3K Signature Fast High 447 765 488 2633 ms
v2.2 n/a SHA-256 3K Verification Small n/a 3 801 888 22 ms
v2.2 n/a SHA-256 3K Verification Fast n/a 3 780 824 22 ms
Cryptolib STM32G474 RSA Sig.svg
Cryptolib STM32G474 RSA Ver.svg


The table below shows RSA Flash and RAM usage (in bytes).

PKCS#1 Priv. key mod. exp. method Hash method Modulus size Operation RSA mathematics configuration Priv. key mod. exp. implementation Code Constant data Global data Stack usage Working buffer
v2.2 CRT SHA-256 3K Signature Small Low 7034 bytes 370 bytes 5 bytes 700 bytes 3704 bytes
v2.2 CRT SHA-256 3K Signature Small Mid 7282 bytes 370 bytes 5 bytes 700 bytes 4308 bytes
v2.2 CRT SHA-256 3K Signature Small High 7282 bytes 370 bytes 5 bytes 700 bytes 6708 bytes
v2.2 CRT SHA-256 3K Signature Fast Low 7404 bytes 370 bytes 5 bytes 700 bytes 3704 bytes
v2.2 CRT SHA-256 3K Signature Fast Mid 7652 bytes 370 bytes 5 bytes 700 bytes 4308 bytes
v2.2 CRT SHA-256 3K Signature Fast High 7652 bytes 370 bytes 5 bytes 700 bytes 6708 bytes
v2.2 No CRT SHA-256 3K Signature Small Low 6064 bytes 362 bytes 5 bytes 700 bytes 3484 bytes
v2.2 No CRT SHA-256 3K Signature Small Mid 6312 bytes 362 bytes 5 bytes 700 bytes 4664 bytes
v2.2 No CRT SHA-256 3K Signature Small High 6312 bytes 362 bytes 5 bytes 700 bytes 9368 bytes
v2.2 No CRT SHA-256 3K Signature Fast Low 6434 bytes 362 bytes 5 bytes 700 bytes 3484 bytes
v2.2 No CRT SHA-256 3K Signature Fast Mid 6682 bytes 362 bytes 5 bytes 700 bytes 4664 bytes
v2.2 No CRT SHA-256 3K Signature Fast High 6682 bytes 362 bytes 5 bytes 700 bytes 9368 bytes
v2.2 n/a SHA-256 3K Verification Small n/a 6810 bytes 366 bytes 5 bytes 716 bytes 3108 bytes
v2.2 n/a SHA-256 3K Verification Fast n/a 7180 bytes 366 bytes 5 bytes 716 bytes 3108 bytes
Cryptolib STM32G474 RSA 3K CRT Sig FP.svg
Cryptolib STM32G474 RSA 3K NoCRT Sig FP.svg
Cryptolib STM32G474 RSA 3K Ver FP.svg