Cryptographic performance on STM32G0 Series V5.x

This message will disappear after all relevant tasks have been resolved.
Semantic MediaWiki
There are 1 incomplete or pending task to finish installation of Semantic MediaWiki. An administrator or user with sufficient rights can complete it. This should be done before adding new data to avoid inconsistencies.

This page reports measured performance when using the pure software cryptographic library algorithms with an STM32G0 MCU. In addition to performance figures, the required code footprint and memory are also given.


1. Measurement configuration

1.1. Hardware configuration

STM32 MCU STM32G071RB
Device ID 0x460
Revision ID 0x2000
Board NUCLEO-G071RB

1.2. Firmware configuration

Cryptographic library version 050000B2[ver. 1]
  1. ↑ This value corresponds to the information returned by a call to cmox_getInfos

1.3. System configuration

System core clock frequency 64 MHz
Flash latency 2 wait states
Voltage scaling Range 1
Instruction cache (ART/ICU) 1 (0: disabled / 1: enabled)
Prefetch cache (ART) 1 (0: disabled / 1: enabled)

1.4. Development toolchains and compilers

IAR Embedded Workbench IAR ANSI C/C++ Compiler V9.40.1.364/W64 for ARM
Information
The measurements are done using a project built with the High Speed optimization setting enabled.


2. Performance values

2.1. AES symmetric key encryption and decryption

This section provides the performance results for AES-CBC using different operation modes:

  • Sole buffer: one sole buffer is encrypted or decrypted. The performance time is given in µs.
  • Data flow: a big message is encrypted or decrypted in chunks. The bit rate is given in kilobytes per second.

2.1.1. Sole buffer mode

In this mode, the entire encryption or decryption process, for the full message size, is managed through a single API call provided by the CMOX library.

The table below shows the number of clock cycles and time (in µs) needed to perform the described operation in small and fast configurations.

AES mode Key size Buffer size Cipher operation Configuration Cycles Time
AES CBC 128 bits 32 bytes Encryption Small 6266 97 µs
AES CBC 128 bits 32 bytes Encryption Fast 6312 98 µs
AES CBC 128 bits 64 bytes Encryption Small 11 048 172 µs
AES CBC 128 bits 64 bytes Encryption Fast 11 126 173 µs
AES CBC 128 bits 128 bytes Encryption Small 20 612 322 µs
AES CBC 128 bits 128 bytes Encryption Fast 20 754 324 µs
AES CBC 192 bits 32 bytes Encryption Small 7038 109 µs
AES CBC 192 bits 32 bytes Encryption Fast 7084 110 µs
AES CBC 192 bits 64 bytes Encryption Small 12 604 196 µs
AES CBC 192 bits 64 bytes Encryption Fast 12 682 198 µs
AES CBC 192 bits 128 bytes Encryption Small 23 736 370 µs
AES CBC 192 bits 128 bytes Encryption Fast 23 878 373 µs
AES CBC 256 bits 32 bytes Encryption Small 8032 125 µs
AES CBC 256 bits 32 bytes Encryption Fast 8078 126 µs
AES CBC 256 bits 64 bytes Encryption Small 14 382 224 µs
AES CBC 256 bits 64 bytes Encryption Fast 14 460 225 µs
AES CBC 256 bits 128 bytes Encryption Small 27 082 423 µs
AES CBC 256 bits 128 bytes Encryption Fast 27 224 425 µs
AES CBC 128 bits 32 bytes Decryption Small 8017 125 µs
AES CBC 128 bits 32 bytes Decryption Fast 8063 125 µs
AES CBC 128 bits 64 bytes Decryption Small 14 553 227 µs
AES CBC 128 bits 64 bytes Decryption Fast 14 631 228 µs
AES CBC 128 bits 128 bytes Decryption Small 27 625 431 µs
AES CBC 128 bits 128 bytes Decryption Fast 27 767 433 µs
AES CBC 192 bits 32 bytes Decryption Small 9169 143 µs
AES CBC 192 bits 32 bytes Decryption Fast 9215 143 µs
AES CBC 192 bits 64 bytes Decryption Small 16 869 263 µs
AES CBC 192 bits 64 bytes Decryption Fast 16 947 264 µs
AES CBC 192 bits 128 bytes Decryption Small 32 269 504 µs
AES CBC 192 bits 128 bytes Decryption Fast 32 411 506 µs
AES CBC 256 bits 32 bytes Decryption Small 10 543 164 µs
AES CBC 256 bits 32 bytes Decryption Fast 10 589 165 µs
AES CBC 256 bits 64 bytes Decryption Small 19 407 303 µs
AES CBC 256 bits 64 bytes Decryption Fast 19 485 304 µs
AES CBC 256 bits 128 bytes Decryption Small 37 135 580 µs
AES CBC 256 bits 128 bytes Decryption Fast 37 277 582 µs


The table below shows flash memory and RAM usage (in bytes).

Cipher operation Configuration Code Constant data Global data Stack usage
Encryption Small 2338 bytes 324 bytes 0 bytes 544 bytes
Encryption Fast 2362 bytes 324 bytes 0 bytes 552 bytes
Decryption Small 2742 bytes 592 bytes 0 bytes 564 bytes
Decryption Fast 2766 bytes 592 bytes 0 bytes 572 bytes


2.1.2. Data flow mode

In this mode, the operation is performed in several calls to the CMOX library APIs, as shown below:

  • cmox_cipher_init
  • cmox_cipher_setKey
  • cmox_cipher_setIV
  • cmox_cipher_append: called several times to encrypt or decrypt the whole message in fixed-size chunks

The table below shows the number of clock cycles and the bit rate (in kilobytes per second) needed to perform the described operation in small and fast configuration.

AES mode Key size Message size Chunk size Cipher operation Configuration Cycles Bit rate
AES CBC 128 bits 8000 bytes 128 bytes Encryption Small 1 206 640 424 Kbytes/s
AES CBC 128 bits 8000 bytes 128 bytes Encryption Fast 1 214 648 421 Kbytes/s
AES CBC 128 bits 8000 bytes 512 bytes Encryption Small 1 198 368 427 Kbytes/s
AES CBC 128 bits 8000 bytes 512 bytes Encryption Fast 1 206 376 424 Kbytes/s
AES CBC 128 bits 8000 bytes 1024 bytes Encryption Small 1 196 960 427 Kbytes/s
AES CBC 128 bits 8000 bytes 1024 bytes Encryption Fast 1 204 968 424 Kbytes/s
AES CBC 128 bits 8000 bytes 2048 bytes Encryption Small 1 196 256 428 Kbytes/s
AES CBC 128 bits 8000 bytes 2048 bytes Encryption Fast 1 204 256 425 Kbytes/s
AES CBC 192 bits 8000 bytes 128 bytes Encryption Small 1 402 648 365 Kbytes/s
AES CBC 192 bits 8000 bytes 128 bytes Encryption Fast 1 410 640 362 Kbytes/s
AES CBC 192 bits 8000 bytes 512 bytes Encryption Small 1 394 376 367 Kbytes/s
AES CBC 192 bits 8000 bytes 512 bytes Encryption Fast 1 402 368 365 Kbytes/s
AES CBC 192 bits 8000 bytes 1024 bytes Encryption Small 1 392 960 367 Kbytes/s
AES CBC 192 bits 8000 bytes 1024 bytes Encryption Fast 1 400 960 365 Kbytes/s
AES CBC 192 bits 8000 bytes 2048 bytes Encryption Small 1 392 256 367 Kbytes/s
AES CBC 192 bits 8000 bytes 2048 bytes Encryption Fast 1 400 256 365 Kbytes/s
AES CBC 256 bits 8000 bytes 128 bytes Encryption Small 1 598 640 320 Kbytes/s
AES CBC 256 bits 8000 bytes 128 bytes Encryption Fast 1 606 648 318 Kbytes/s
AES CBC 256 bits 8000 bytes 512 bytes Encryption Small 1 590 368 321 Kbytes/s
AES CBC 256 bits 8000 bytes 512 bytes Encryption Fast 1 598 368 320 Kbytes/s
AES CBC 256 bits 8000 bytes 1024 bytes Encryption Small 1 588 968 322 Kbytes/s
AES CBC 256 bits 8000 bytes 1024 bytes Encryption Fast 1 596 960 320 Kbytes/s
AES CBC 256 bits 8000 bytes 2048 bytes Encryption Small 1 588 256 322 Kbytes/s
AES CBC 256 bits 8000 bytes 2048 bytes Encryption Fast 1 596 256 320 Kbytes/s
AES CBC 128 bits 8000 bytes 128 bytes Decryption Small 1 671 424 306 Kbytes/s
AES CBC 128 bits 8000 bytes 128 bytes Decryption Fast 1 679 424 304 Kbytes/s
AES CBC 128 bits 8000 bytes 512 bytes Decryption Small 1 659 064 308 Kbytes/s
AES CBC 128 bits 8000 bytes 512 bytes Decryption Fast 1 667 056 307 Kbytes/s
AES CBC 128 bits 8000 bytes 1024 bytes Decryption Small 1 655 664 309 Kbytes/s
AES CBC 128 bits 8000 bytes 1024 bytes Decryption Fast 1 663 664 307 Kbytes/s
AES CBC 128 bits 8000 bytes 2048 bytes Decryption Small 1 651 856 309 Kbytes/s
AES CBC 128 bits 8000 bytes 2048 bytes Decryption Fast 1 659 864 308 Kbytes/s
AES CBC 192 bits 8000 bytes 128 bytes Decryption Small 1 962 416 260 Kbytes/s
AES CBC 192 bits 8000 bytes 128 bytes Decryption Fast 1 970 424 259 Kbytes/s
AES CBC 192 bits 8000 bytes 512 bytes Decryption Small 1 950 056 262 Kbytes/s
AES CBC 192 bits 8000 bytes 512 bytes Decryption Fast 1 958 056 261 Kbytes/s
AES CBC 192 bits 8000 bytes 1024 bytes Decryption Small 1 946 672 263 Kbytes/s
AES CBC 192 bits 8000 bytes 1024 bytes Decryption Fast 1 954 672 261 Kbytes/s
AES CBC 192 bits 8000 bytes 2048 bytes Decryption Small 1 942 864 263 Kbytes/s
AES CBC 192 bits 8000 bytes 2048 bytes Decryption Fast 1 950 856 262 Kbytes/s
AES CBC 256 bits 8000 bytes 128 bytes Decryption Small 2 253 424 227 Kbytes/s
AES CBC 256 bits 8000 bytes 128 bytes Decryption Fast 2 261 416 226 Kbytes/s
AES CBC 256 bits 8000 bytes 512 bytes Decryption Small 2 241 064 228 Kbytes/s
AES CBC 256 bits 8000 bytes 512 bytes Decryption Fast 2 249 064 227 Kbytes/s
AES CBC 256 bits 8000 bytes 1024 bytes Decryption Small 2 237 672 228 Kbytes/s
AES CBC 256 bits 8000 bytes 1024 bytes Decryption Fast 2 245 664 227 Kbytes/s
AES CBC 256 bits 8000 bytes 2048 bytes Decryption Small 2 233 856 229 Kbytes/s
AES CBC 256 bits 8000 bytes 2048 bytes Decryption Fast 2 241 856 228 Kbytes/s


The table below shows flash memory and RAM usage (in bytes).

Cipher operation Configuration Code Constant data Global data Stack usage
Encryption Small 2274 bytes 316 bytes 0 bytes 168 bytes
Encryption Fast 2298 bytes 316 bytes 0 bytes 176 bytes
Decryption Small 2678 bytes 584 bytes 0 bytes 188 bytes
Decryption Fast 2702 bytes 584 bytes 0 bytes 196 bytes


2.2. HASH digest

In this section we provide the performance results for HASH, using different modes of operation:

  • Sole buffer: one sole buffer is hashed. The performance time is given in us.
  • Data flow: a big message is hashed in chunks. The bit rate is given in bytes per second.

2.2.1. Sole buffer mode

In this mode, the entire message hashing process is managed through a single API call provided by the CMOX library.

The table below shows the number of clock cycles and time (in µs) needed to perform the described operation.

HASH mode Buffer size Cycles Time
SHA256 32 bytes 9480 148 µs
SHA256 64 bytes 17 658 275 µs
SHA256 128 bytes 25 771 402 µs
SHA384 32 bytes 37 025 578 µs
SHA384 64 bytes 37 047 578 µs
SHA384 128 bytes 71 378 1115 µs


The table below shows flash memory and RAM usage (in bytes).

HASH mode Code Constant data Global data Stack usage
SHA256 1502 280 bytes 0 bytes 564 bytes
SHA384 2810 728 bytes 0 bytes 1116 bytes


2.2.2. Data flow mode

In this mode, the operation is performed in several calls to the CMOX library APIs, as shown below:

  • cmox_hash_init
  • cmox_hash_append: called several times to hash the whole message in fixed-size chunks
  • cmox_hash_generateTag

The table below shows the number of clock cycles and the bit rate (in kilobytes per second) needed to perform the described operation.

HASH mode Message size Chunk size Cycles Bit rate
SHA256 8000 bytes 128 bytes 1 031 868 496 Kbytes/s
SHA256 8000 bytes 512 bytes 1 018 473 502 Kbytes/s
SHA256 8000 bytes 1024 bytes 1 016 193 503 Kbytes/s
SHA256 8000 bytes 2048 bytes 1 015 053 504 Kbytes/s
SHA384 8000 bytes 128 bytes 2 143 336 238 Kbytes/s
SHA384 8000 bytes 512 bytes 2 128 147 240 Kbytes/s
SHA384 8000 bytes 1024 bytes 2 125 539 240 Kbytes/s
SHA384 8000 bytes 2048 bytes 2 124 235 241 Kbytes/s


The table below shows the final tag generation done through the call to cmox_hash_generateTag.

HASH mode Cycles Time
SHA256 8843 138 µs
SHA384 36 352 568 µs

The table below shows flash memory and RAM usage (in bytes).

HASH mode Code Constant data Global data Stack usage
SHA256 1526 bytes 272 bytes 0 bytes 372 bytes
SHA384 2834 bytes 720 bytes 0 bytes 820 bytes


2.3. ECDSA signature and verification

This section provides the performance results for ECDSA signature and verification.

The table below shows the number of clock cycles and time (in ms) needed to perform the described operation in different configurations.

Curve Operation ECC mathematics configuration Curve definition Cycles Time
SECP256R1 Signature Small Low 12 153 224 189 ms
SECP256R1 Signature Small High 11 810 400 184 ms
SECP256R1 Signature SuperFast Low 9 117 968 142 ms
SECP256R1 Signature SuperFast High 8 851 376 138 ms
SECP256R1 Verification Small Low 28 734 896 448 ms
SECP256R1 Verification Small High 25 548 736 399 ms
SECP256R1 Verification SuperFast Low 21 803 344 340 ms
SECP256R1 Verification SuperFast High 19 333 208 302 ms
SECP384R1 Signature Small Low 38 653 128 603 ms
SECP384R1 Signature Small High 36 791 400 574 ms
SECP384R1 Signature Fast Low 33 073 624 516 ms
SECP384R1 Signature Fast High 31 499 424 492 ms
SECP384R1 Verification Small Low 91 195 128 1424 ms
SECP384R1 Verification Small High 79 008 392 1234 ms
SECP384R1 Verification Fast Low 78 594 600 1228 ms
SECP384R1 Verification Fast High 68 039 872 1063 ms


The table below shows ECDSA flash memory and RAM usage (in bytes).

Note
The footpring is measured using the general-purpose CMOX_ECC_XXX_HIGHMEM or CMOX_ECC_XXX_LOWMEM configuration, which shows the footprint increase compared with the V4.x.x. To reduce the footprint, the optimized confinguration CMOX_ECC_XXX_YYY_SIGN or CMOX_ECC_XXX_YYY_VERIFY is recommended.
Curve Operation ECC mathematics configuration Curve definition Code Constant data Global data Stack usage Working buffer
SECP256R1 Signature Small Low 13 670 bytes 1212 bytes 0 bytes 424 bytes 628 bytes
SECP256R1 Signature Small High 13 670 bytes 1596 bytes 0 bytes 424 bytes 696 bytes
SECP256R1 Signature SuperFast Low 17 010 bytes 1212 bytes 0 bytes 472 bytes 628 bytes
SECP256R1 Signature SuperFast High 17 010 bytes 1596 bytes 0 bytes 472 bytes 696 bytes
SECP256R1 Verification Small Low 13 658 bytes 1212 bytes 0 bytes 472 bytes 856 bytes
SECP256R1 Verification Small High 13 658 bytes 1596 bytes 0 bytes 472 bytes 1648 bytes
SECP256R1 Verification SuperFast Low 16 998 bytes 1212 bytes 0 bytes 520 bytes 856 bytes
SECP256R1 Verification SuperFast High 16 998 bytes 1596 bytes 0 bytes 520 bytes 1648 bytes
SECP384R1 Signature Small Low 13 670 bytes 1692 bytes 0 bytes 424 bytes 884 bytes
SECP384R1 Signature Small High 13 670 bytes 2268 bytes 0 bytes 424 bytes 984 bytes
SECP384R1 Signature Fast Low 14 508 bytes 1692 bytes 0 bytes 416 bytes 884 bytes
SECP384R1 Signature Fast High 14 508 bytes 2268 bytes 0 bytes 416 bytes 984 bytes
SECP384R1 Verification Small Low 13 658 bytes 1692 bytes 0 bytes 472 bytes 1192 bytes
SECP384R1 Verification Small High 13 658 bytes 2268 bytes 0 bytes 472 bytes 2272 bytes
SECP384R1 Verification Fast Low 14 496 bytes 1692 bytes 0 bytes 464 bytes 1192 bytes
SECP384R1 Verification Fast High 14 496 bytes 2268 bytes 0 bytes 464 bytes 2272 bytes


2.4. EdDSA signature and verification

This section provides the performance results for EdDSA signature and verification.

The table below shows the number of clock cycles and time (in ms) needed to perform the described operation in different configurations.

Curve Message size Operation ECC mathematics configuration Curve definition Cycles Time
Ed25519 1023 bytes Signature Small OptLow 17 198 152 268 ms
Ed25519 1023 bytes Signature Small OptHigh 9 935 592 155 ms
Ed25519 1023 bytes Signature SuperFast OptLow 13 509 536 211 ms
Ed25519 1023 bytes Signature SuperFast OptHigh 7 871 032 122 ms
Ed25519 1023 bytes Verification Small OptLow 27 100 072 423 ms
Ed25519 1023 bytes Verification Small OptHigh 23 823 088 372 ms
Ed25519 1023 bytes Verification SuperFast OptLow 20 835 688 325 ms
Ed25519 1023 bytes Verification SuperFast OptHigh 18 363 168 286 ms


The table below shows EdDSA flash memory and RAM usage (in bytes).

Note
The footpring is measured using the general-purpose CMOX_ECC_XXX_HIGHMEM or CMOX_ECC_XXX_LOWMEM configuration, which shows the footprint increase compared with the V4.x.x. To reduce the footprint, the optimized confinguration CMOX_ECC_XXX_YYY_SIGN or CMOX_ECC_XXX_YYY_VERIFY is recommended.
Curve Message size Operation ECC mathematics configuration Curve definition Code Constant data Global data Stack usage Working buffer
Ed25519 1023 bytes Signature Small OptLow 15 360 bytes 1748 bytes 0 bytes 1212 bytes 1672 bytes
Ed25519 1023 bytes Signature Small OptHigh 15 798 bytes 2900 bytes 0 bytes 1212 bytes 1672 bytes
Ed25519 1023 bytes Signature SuperFast OptLow 18 700 bytes 1748 bytes 0 bytes 1212 bytes 1672 bytes
Ed25519 1023 bytes Signature SuperFast OptHigh 19 138 bytes 2900 bytes 0 bytes 1212 bytes 1672 bytes
Ed25519 1023 bytes Verification Small OptLow 15 356 bytes 1748 bytes 0 bytes 1204 bytes 984 bytes
Ed25519 1023 bytes Verification Small OptHigh 15 794 bytes 2900 bytes 0 bytes 1204 bytes 1992 bytes
Ed25519 1023 bytes Verification SuperFast OptLow 18 696 bytes 1748 bytes 0 bytes 1204 bytes 984 bytes
Ed25519 1023 bytes Verification SuperFast OptHigh 19 134 bytes 2900 bytes 0 bytes 1204 bytes 1992 bytes


2.5. RSA signature and verification

This section provides the performance results for RSA signature and verification.

The table below shows the number of clock cycles and time (in ms) needed to perform the described operation in different configurations.

PKCS#1 Priv. key mod. exp. method Hash method Modulus size Operation RSA mathematics configuration Priv. key mod. exp. implementation Cycles Time
v2.2 CRT SHA-256 3K Signature Small Low 1 106 856 648 17 294 ms
v2.2 CRT SHA-256 3K Signature Small Mid 832 577 672 13 009 ms
v2.2 CRT SHA-256 3K Signature Small High 698 386 312 10 912 ms
v2.2 CRT SHA-256 3K Signature Fast Low 914 551 032 14 289 ms
v2.2 CRT SHA-256 3K Signature Fast Mid 667 169 208 10 424 ms
v2.2 CRT SHA-256 3K Signature Fast High 551 541 032 8617 ms
v2.2 No CRT SHA-256 3K Signature Small Low 4 362 188 240 68 159 ms
v2.2 No CRT SHA-256 3K Signature Small Mid 3 275 867 560 51 185 ms
v2.2 No CRT SHA-256 3K Signature Small High 2 738 563 848 42 790 ms
v2.2 No CRT SHA-256 3K Signature Fast Low 3 595 581 200 56 180 ms
v2.2 No CRT SHA-256 3K Signature Fast Mid 2 612 581 448 40 821 ms
v2.2 No CRT SHA-256 3K Signature Fast High 2 147 819 080 33 559 ms
v2.2 n/a SHA-256 3K Verification Small n/a 17 088 864 267 ms
v2.2 n/a SHA-256 3K Verification Fast n/a 14 019 616 219 ms


The table below shows RSA flash memory and RAM usage (in bytes).

PKCS#1 Priv. key mod. exp. method Hash method Modulus size Operation RSA mathematics configuration Priv. key mod. exp. implementation Code Constant data Global data Stack usage Working buffer
v2.2 CRT SHA-256 3K Signature Small Low 7178 bytes 372 bytes 0 bytes 692 bytes 3704 bytes
v2.2 CRT SHA-256 3K Signature Small Mid 7430 bytes 372 bytes 0 bytes 692 bytes 4308 bytes
v2.2 CRT SHA-256 3K Signature Small High 7430 bytes 372 bytes 0 bytes 692 bytes 6708 bytes
v2.2 CRT SHA-256 3K Signature Fast Low 8016 bytes 372 bytes 0 bytes 692 bytes 3704 bytes
v2.2 CRT SHA-256 3K Signature Fast Mid 8268 bytes 372 bytes 0 bytes 692 bytes 4308 bytes
v2.2 CRT SHA-256 3K Signature Fast High 8268 bytes 372 bytes 0 bytes 692 bytes 6708 bytes
v2.2 No CRT SHA-256 3K Signature Small Low 6268 bytes 364 bytes 0 bytes 692 bytes 3484 bytes
v2.2 No CRT SHA-256 3K Signature Small Mid 6520 bytes 364 bytes 0 bytes 692 bytes 4664 bytes
v2.2 No CRT SHA-256 3K Signature Small High 6520 bytes 364 bytes 0 bytes 692 bytes 9368 bytes
v2.2 No CRT SHA-256 3K Signature Fast Low 7106 bytes 364 bytes 0 bytes 692 bytes 3484 bytes
v2.2 No CRT SHA-256 3K Signature Fast Mid 7358 bytes 364 bytes 0 bytes 692 bytes 4664 bytes
v2.2 No CRT SHA-256 3K Signature Fast High 7358 bytes 364 bytes 0 bytes 692 bytes 9368 bytes
v2.2 n/a SHA-256 3K Verification Small n/a 6464 bytes 368 bytes 0 bytes 708 bytes 3108 bytes
v2.2 n/a SHA-256 3K Verification Fast n/a 7302 bytes 368 bytes 0 bytes 708 bytes 3108 bytes


Retrieved from "https://wiki.stmicroelectronics.cn/stm32mcu/index.php?title=Security:STM32G0_Series:_Cryptographic_Library_Performance_V5.x&oldid=88450"