Cryptographic performance on STM32N6 Series V5.x

This message will disappear after all relevant tasks have been resolved.
Semantic MediaWiki
There are 1 incomplete or pending task to finish installation of Semantic MediaWiki. An administrator or user with sufficient rights can complete it. This should be done before adding new data to avoid inconsistencies.

This page reports measured performance when using the pure software cryptographic library algorithms with an STM32N6 MCU. In addition to performance figures, the required code footprint and memory are also given.

Measurements are done while executing the code from the external flash memory in execute-in-place mode (XIP).

1. Measurement configuration

1.1. Hardware configuration

STM32 MCU STM32N657X0H3Q
Device ID 0x486
Revision ID 0x200
Board NUCLEO-N657X0-Q

1.2. Firmware configuration

Cryptographic library version 050000B2[ver. 1]
  1. ↑ This value corresponds to the information returned by a call to cmox_getInfos

1.3. System configuration

System core clock frequency 600 MHz
Voltage scaling Range 0
Instruction cache (ART/ICU) 1 (0: disabled / 1: enabled)
Data cache (ART/DCU) 1 (0: disabled / 1: enabled)

1.4. Development toolchains and compilers

IAR Embedded Workbench IAR ANSI C/C++ Compiler V9.40.1.364/W64 for ARM
Information
The measurements are done using a project built with the High Speed optimization setting enabled.


2. Performance values

2.1. AES symmetric key encryption and decryption

This section provides the performance results for AES-CBC using different operation modes:

  • Sole buffer: one sole buffer is encrypted or decrypted. The performance time is given in µs.
  • Data flow: a big message is encrypted or decrypted in chunks. The bit rate is given in kilobytes per second.

2.1.1. Sole buffer mode

In this mode, the entire encryption or decryption process, for the full message size, is managed through a single API call provided by the CMOX library.

The table below shows the number of clock cycles and time (in µs) needed to perform the described operation in small and fast configurations.

AES mode Key size Buffer size Cipher operation Configuration Cycles Time
AES CBC 128 bits 32 bytes Encryption Small 17 280 28 µs
AES CBC 128 bits 32 bytes Encryption Fast 26 056 43 µs
AES CBC 128 bits 64 bytes Encryption Small 19 792 32 µs
AES CBC 128 bits 64 bytes Encryption Fast 27 760 46 µs
AES CBC 128 bits 128 bytes Encryption Small 24 424 40 µs
AES CBC 128 bits 128 bytes Encryption Fast 31 184 51 µs
AES CBC 192 bits 32 bytes Encryption Small 19 032 31 µs
AES CBC 192 bits 32 bytes Encryption Fast 26 936 44 µs
AES CBC 192 bits 64 bytes Encryption Small 21 752 36 µs
AES CBC 192 bits 64 bytes Encryption Fast 28 976 48 µs
AES CBC 192 bits 128 bytes Encryption Small 27 184 45 µs
AES CBC 192 bits 128 bytes Encryption Fast 32 880 54 µs
AES CBC 256 bits 32 bytes Encryption Small 20 056 33 µs
AES CBC 256 bits 32 bytes Encryption Fast 27 984 46 µs
AES CBC 256 bits 64 bytes Encryption Small 23 416 39 µs
AES CBC 256 bits 64 bytes Encryption Fast 30 320 50 µs
AES CBC 256 bits 128 bytes Encryption Small 29 568 49 µs
AES CBC 256 bits 128 bytes Encryption Fast 34 680 57 µs
AES CBC 128 bits 32 bytes Decryption Small 22 608 37 µs
AES CBC 128 bits 32 bytes Decryption Fast 40 216 67 µs
AES CBC 128 bits 64 bytes Decryption Small 26 296 43 µs
AES CBC 128 bits 64 bytes Decryption Fast 42 104 70 µs
AES CBC 128 bits 128 bytes Decryption Small 33 368 55 µs
AES CBC 128 bits 128 bytes Decryption Fast 45 576 75 µs
AES CBC 192 bits 32 bytes Decryption Small 24 304 40 µs
AES CBC 192 bits 32 bytes Decryption Fast 40 784 67 µs
AES CBC 192 bits 64 bytes Decryption Small 28 480 47 µs
AES CBC 192 bits 64 bytes Decryption Fast 42 872 71 µs
AES CBC 192 bits 128 bytes Decryption Small 36 776 61 µs
AES CBC 192 bits 128 bytes Decryption Fast 46 792 77 µs
AES CBC 256 bits 32 bytes Decryption Small 25 600 42 µs
AES CBC 256 bits 32 bytes Decryption Fast 42 576 70 µs
AES CBC 256 bits 64 bytes Decryption Small 30 392 50 µs
AES CBC 256 bits 64 bytes Decryption Fast 44 912 74 µs
AES CBC 256 bits 128 bytes Decryption Small 39 960 66 µs
AES CBC 256 bits 128 bytes Decryption Fast 49 616 82 µs


The table below shows flash memory and RAM usage (in bytes).

Cipher operation Configuration Code Constant data Global data Stack usage
Encryption Small 2386 bytes 324 bytes 0 bytes 552 bytes
Encryption Fast 2330 bytes 1092 bytes 0 bytes 552 bytes
Decryption Small 2746 bytes 580 bytes 0 bytes 568 bytes
Decryption Fast 2696 bytes 2372 bytes 0 bytes 568 bytes


2.1.2. Data flow mode

In this mode, the operation is performed in several calls to the CMOX library APIs, as shown below:

  • cmox_cipher_init
  • cmox_cipher_setKey
  • cmox_cipher_setIV
  • cmox_cipher_append: called several times to encrypt or decrypt the whole message in fixed-size chunks

The table below shows the number of clock cycles and the bit rate (in kilobytes per second) needed to perform the described operation in small and fast configuration.

AES mode Key size Message size Chunk size Cipher operation Configuration Cycles Bit rate
AES CBC 128 bits 8000 bytes 128 bytes Encryption Small 595 896 8055 Kbytes/s
AES CBC 128 bits 8000 bytes 128 bytes Encryption Fast 452 664 10 603 Kbytes/s
AES CBC 128 bits 8000 bytes 512 bytes Encryption Small 590 496 8128 Kbytes/s
AES CBC 128 bits 8000 bytes 512 bytes Encryption Fast 447 088 10 736 Kbytes/s
AES CBC 128 bits 8000 bytes 1024 bytes Encryption Small 589 688 8139 Kbytes/s
AES CBC 128 bits 8000 bytes 1024 bytes Encryption Fast 445 952 10 763 Kbytes/s
AES CBC 128 bits 8000 bytes 2048 bytes Encryption Small 589 032 8148 Kbytes/s
AES CBC 128 bits 8000 bytes 2048 bytes Encryption Fast 446 792 10 743 Kbytes/s
AES CBC 192 bits 8000 bytes 128 bytes Encryption Small 687 856 6978 Kbytes/s
AES CBC 192 bits 8000 bytes 128 bytes Encryption Fast 512 864 9359 Kbytes/s
AES CBC 192 bits 8000 bytes 512 bytes Encryption Small 682 360 7034 Kbytes/s
AES CBC 192 bits 8000 bytes 512 bytes Encryption Fast 507 320 9461 Kbytes/s
AES CBC 192 bits 8000 bytes 1024 bytes Encryption Small 681 560 7042 Kbytes/s
AES CBC 192 bits 8000 bytes 1024 bytes Encryption Fast 505 544 9494 Kbytes/s
AES CBC 192 bits 8000 bytes 2048 bytes Encryption Small 680 776 7050 Kbytes/s
AES CBC 192 bits 8000 bytes 2048 bytes Encryption Fast 503 816 9527 Kbytes/s
AES CBC 256 bits 8000 bytes 128 bytes Encryption Small 779 232 6159 Kbytes/s
AES CBC 256 bits 8000 bytes 128 bytes Encryption Fast 562 936 8526 Kbytes/s
AES CBC 256 bits 8000 bytes 512 bytes Encryption Small 773 824 6202 Kbytes/s
AES CBC 256 bits 8000 bytes 512 bytes Encryption Fast 559 400 8580 Kbytes/s
AES CBC 256 bits 8000 bytes 1024 bytes Encryption Small 773 016 6209 Kbytes/s
AES CBC 256 bits 8000 bytes 1024 bytes Encryption Fast 557 368 8611 Kbytes/s
AES CBC 256 bits 8000 bytes 2048 bytes Encryption Small 772 216 6215 Kbytes/s
AES CBC 256 bits 8000 bytes 2048 bytes Encryption Fast 555 552 8640 Kbytes/s
AES CBC 128 bits 8000 bytes 128 bytes Decryption Small 943 368 5088 Kbytes/s
AES CBC 128 bits 8000 bytes 128 bytes Decryption Fast 497 032 9657 Kbytes/s
AES CBC 128 bits 8000 bytes 512 bytes Decryption Small 915 272 5244 Kbytes/s
AES CBC 128 bits 8000 bytes 512 bytes Decryption Fast 469 152 10 231 Kbytes/s
AES CBC 128 bits 8000 bytes 1024 bytes Decryption Small 908 352 5284 Kbytes/s
AES CBC 128 bits 8000 bytes 1024 bytes Decryption Fast 464 712 10 328 Kbytes/s
AES CBC 128 bits 8000 bytes 2048 bytes Decryption Small 904 088 5309 Kbytes/s
AES CBC 128 bits 8000 bytes 2048 bytes Decryption Fast 462 480 10 378 Kbytes/s
AES CBC 192 bits 8000 bytes 128 bytes Decryption Small 1 100 512 4361 Kbytes/s
AES CBC 192 bits 8000 bytes 128 bytes Decryption Fast 552 480 8688 Kbytes/s
AES CBC 192 bits 8000 bytes 512 bytes Decryption Small 1 072 344 4476 Kbytes/s
AES CBC 192 bits 8000 bytes 512 bytes Decryption Fast 524 888 9144 Kbytes/s
AES CBC 192 bits 8000 bytes 1024 bytes Decryption Small 1 065 800 4503 Kbytes/s
AES CBC 192 bits 8000 bytes 1024 bytes Decryption Fast 520 184 9227 Kbytes/s
AES CBC 192 bits 8000 bytes 2048 bytes Decryption Small 1 061 128 4523 Kbytes/s
AES CBC 192 bits 8000 bytes 2048 bytes Decryption Fast 517 088 9282 Kbytes/s
AES CBC 256 bits 8000 bytes 128 bytes Decryption Small 1 255 328 3823 Kbytes/s
AES CBC 256 bits 8000 bytes 128 bytes Decryption Fast 607 920 7895 Kbytes/s
AES CBC 256 bits 8000 bytes 512 bytes Decryption Small 1 228 288 3907 Kbytes/s
AES CBC 256 bits 8000 bytes 512 bytes Decryption Fast 581 824 8249 Kbytes/s
AES CBC 256 bits 8000 bytes 1024 bytes Decryption Small 1 221 088 3930 Kbytes/s
AES CBC 256 bits 8000 bytes 1024 bytes Decryption Fast 576 424 8327 Kbytes/s
AES CBC 256 bits 8000 bytes 2048 bytes Decryption Small 1 216 832 3944 Kbytes/s
AES CBC 256 bits 8000 bytes 2048 bytes Decryption Fast 575 872 8335 Kbytes/s


The table below shows flash memory and RAM usage (in bytes).

Cipher operation Configuration Code Constant data Global data Stack usage
Encryption Small 2306 bytes 316 bytes 0 bytes 176 bytes
Encryption Fast 2250 bytes 1084 bytes 0 bytes 176 bytes
Decryption Small 2666 bytes 572 bytes 0 bytes 192 bytes
Decryption Fast 2616 bytes 2364 bytes 0 bytes 192 bytes


2.2. HASH digest

In this section we provide the performance results for HASH, using different modes of operation:

  • Sole buffer: one sole buffer is hashed. The performance time is given in us.
  • Data flow: a big message is hashed in chunks. The bit rate is given in bytes per second.

2.2.1. Sole buffer mode

In this mode, the entire message hashing process is managed through a single API call provided by the CMOX library.

The table below shows the number of clock cycles and time (in µs) needed to perform the described operation.

HASH mode Buffer size Cycles Time
SHA256 32 bytes 17 600 29 µs
SHA256 64 bytes 20 608 34 µs
SHA256 128 bytes 23 624 39 µs
SHA384 32 bytes 27 744 46 µs
SHA384 64 bytes 27 960 46 µs
SHA384 128 bytes 39 136 65 µs


The table below shows flash memory and RAM usage (in bytes).

HASH mode Code Constant data Global data Stack usage
SHA256 1394 280 bytes 0 bytes 536 bytes
SHA384 2590 728 bytes 0 bytes 1076 bytes


2.2.2. Data flow mode

In this mode, the operation is performed in several calls to the CMOX library APIs, as shown below:

  • cmox_hash_init
  • cmox_hash_append: called several times to hash the whole message in fixed-size chunks
  • cmox_hash_generateTag

The table below shows the number of clock cycles and the bit rate (in kilobytes per second) needed to perform the described operation.

HASH mode Message size Chunk size Cycles Bit rate
SHA256 8000 bytes 128 bytes 387 016 12 402 Kbytes/s
SHA256 8000 bytes 512 bytes 365 256 13 141 Kbytes/s
SHA256 8000 bytes 1024 bytes 361 528 13 276 Kbytes/s
SHA256 8000 bytes 2048 bytes 359 696 13 344 Kbytes/s
SHA384 8000 bytes 128 bytes 728 696 6587 Kbytes/s
SHA384 8000 bytes 512 bytes 689 496 6961 Kbytes/s
SHA384 8000 bytes 1024 bytes 682 688 7031 Kbytes/s
SHA384 8000 bytes 2048 bytes 679 440 7064 Kbytes/s


The table below shows the final tag generation done through the call to cmox_hash_generateTag.

HASH mode Cycles Time
SHA256 6672 11 µs
SHA384 16 304 27 µs

The table below shows flash memory and RAM usage (in bytes).

HASH mode Code Constant data Global data Stack usage
SHA256 1390 bytes 272 bytes 0 bytes 344 bytes
SHA384 2586 bytes 720 bytes 0 bytes 780 bytes


2.3. ECDSA signature and verification

This section provides the performance results for ECDSA signature and verification.

The table below shows the number of clock cycles and time (in ms) needed to perform the described operation in different configurations.

Curve Operation ECC mathematics configuration Curve definition Cycles Time
SECP256R1 Signature Small Low 2 796 080 4 ms
SECP256R1 Signature Small High 2 730 464 4 ms
SECP256R1 Signature SuperFast Low 1 690 544 2 ms
SECP256R1 Signature SuperFast High 1 636 848 2 ms
SECP256R1 Verification Small Low 6 640 904 11 ms
SECP256R1 Verification Small High 5 936 048 9 ms
SECP256R1 Verification SuperFast Low 4 058 896 6 ms
SECP256R1 Verification SuperFast High 3 593 968 5 ms
SECP384R1 Signature Small Low 8 079 432 13 ms
SECP384R1 Signature Small High 7 675 128 12 ms
SECP384R1 Signature Fast Low 5 694 160 9 ms
SECP384R1 Signature Fast High 5 442 176 9 ms
SECP384R1 Verification Small Low 19 598 448 32 ms
SECP384R1 Verification Small High 16 598 672 27 ms
SECP384R1 Verification Fast Low 13 472 792 22 ms
SECP384R1 Verification Fast High 11 715 672 19 ms


The table below shows ECDSA flash memory and RAM usage (in bytes).

Note
The footpring is measured using the general-purpose CMOX_ECC_XXX_HIGHMEM or CMOX_ECC_XXX_LOWMEM configuration, which shows the footprint increase compared with the V4.x.x. To reduce the footprint, the optimized confinguration CMOX_ECC_XXX_YYY_SIGN or CMOX_ECC_XXX_YYY_VERIFY is recommended.
Curve Operation ECC mathematics configuration Curve definition Code Constant data Global data Stack usage Working buffer
SECP256R1 Signature Small Low 13 472 bytes 1212 bytes 0 bytes 440 bytes 628 bytes
SECP256R1 Signature Small High 13 472 bytes 1596 bytes 0 bytes 440 bytes 696 bytes
SECP256R1 Signature SuperFast Low 14 782 bytes 1212 bytes 0 bytes 444 bytes 628 bytes
SECP256R1 Signature SuperFast High 14 782 bytes 1596 bytes 0 bytes 444 bytes 696 bytes
SECP256R1 Verification Small Low 13 460 bytes 1212 bytes 0 bytes 488 bytes 856 bytes
SECP256R1 Verification Small High 13 460 bytes 1596 bytes 0 bytes 488 bytes 1648 bytes
SECP256R1 Verification SuperFast Low 14 770 bytes 1212 bytes 0 bytes 492 bytes 856 bytes
SECP256R1 Verification SuperFast High 14 770 bytes 1596 bytes 0 bytes 492 bytes 1648 bytes
SECP384R1 Signature Small Low 13 472 bytes 1692 bytes 0 bytes 440 bytes 884 bytes
SECP384R1 Signature Small High 13 472 bytes 2268 bytes 0 bytes 440 bytes 984 bytes
SECP384R1 Signature Fast Low 13 842 bytes 1692 bytes 0 bytes 456 bytes 884 bytes
SECP384R1 Signature Fast High 13 842 bytes 2268 bytes 0 bytes 456 bytes 984 bytes
SECP384R1 Verification Small Low 13 460 bytes 1692 bytes 0 bytes 488 bytes 1192 bytes
SECP384R1 Verification Small High 13 460 bytes 2268 bytes 0 bytes 488 bytes 2272 bytes
SECP384R1 Verification Fast Low 13 830 bytes 1692 bytes 0 bytes 504 bytes 1192 bytes
SECP384R1 Verification Fast High 13 830 bytes 2268 bytes 0 bytes 504 bytes 2272 bytes


2.4. EdDSA signature and verification

This section provides the performance results for EdDSA signature and verification.

The table below shows the number of clock cycles and time (in ms) needed to perform the described operation in different configurations.

Curve Message size Operation ECC mathematics configuration Curve definition Cycles Time
Ed25519 1023 bytes Signature Small OptLow 4 203 528 7 ms
Ed25519 1023 bytes Signature Small OptHigh 2 461 264 4 ms
Ed25519 1023 bytes Signature SuperFast OptLow 2 788 800 4 ms
Ed25519 1023 bytes Signature SuperFast OptHigh 1 677 224 2 ms
Ed25519 1023 bytes Verification Small OptLow 6 379 832 10 ms
Ed25519 1023 bytes Verification Small OptHigh 5 587 352 9 ms
Ed25519 1023 bytes Verification SuperFast OptLow 4 027 000 6 ms
Ed25519 1023 bytes Verification SuperFast OptHigh 3 545 368 5 ms


The table below shows EdDSA flash memory and RAM usage (in bytes).

Note
The footpring is measured using the general-purpose CMOX_ECC_XXX_HIGHMEM or CMOX_ECC_XXX_LOWMEM configuration, which shows the footprint increase compared with the V4.x.x. To reduce the footprint, the optimized confinguration CMOX_ECC_XXX_YYY_SIGN or CMOX_ECC_XXX_YYY_VERIFY is recommended.
Curve Message size Operation ECC mathematics configuration Curve definition Code Constant data Global data Stack usage Working buffer
Ed25519 1023 bytes Signature Small OptLow 14 852 bytes 1748 bytes 0 bytes 1172 bytes 1672 bytes
Ed25519 1023 bytes Signature Small OptHigh 15 272 bytes 2900 bytes 0 bytes 1172 bytes 1672 bytes
Ed25519 1023 bytes Signature SuperFast OptLow 16 162 bytes 1748 bytes 0 bytes 1172 bytes 1672 bytes
Ed25519 1023 bytes Signature SuperFast OptHigh 16 582 bytes 2900 bytes 0 bytes 1172 bytes 1672 bytes
Ed25519 1023 bytes Verification Small OptLow 14 848 bytes 1748 bytes 0 bytes 1172 bytes 984 bytes
Ed25519 1023 bytes Verification Small OptHigh 15 268 bytes 2900 bytes 0 bytes 1172 bytes 1992 bytes
Ed25519 1023 bytes Verification SuperFast OptLow 16 158 bytes 1748 bytes 0 bytes 1172 bytes 984 bytes
Ed25519 1023 bytes Verification SuperFast OptHigh 16 578 bytes 2900 bytes 0 bytes 1172 bytes 1992 bytes


2.5. RSA signature and verification

This section provides the performance results for RSA signature and verification.

The table below shows the number of clock cycles and time (in ms) needed to perform the described operation in different configurations.

PKCS#1 Priv. key mod. exp. method Hash method Modulus size Operation RSA mathematics configuration Priv. key mod. exp. implementation Cycles Time
v2.2 CRT SHA-256 3K Signature Small Low 197 619 160 329 ms
v2.2 CRT SHA-256 3K Signature Small Mid 148 706 336 247 ms
v2.2 CRT SHA-256 3K Signature Small High 124 884 768 208 ms
v2.2 CRT SHA-256 3K Signature Fast Low 120 195 056 200 ms
v2.2 CRT SHA-256 3K Signature Fast Mid 90 544 792 150 ms
v2.2 CRT SHA-256 3K Signature Fast High 76 097 544 126 ms
v2.2 No CRT SHA-256 3K Signature Small Low 762 019 472 1270 ms
v2.2 No CRT SHA-256 3K Signature Small Mid 572 279 400 953 ms
v2.2 No CRT SHA-256 3K Signature Small High 478 690 048 797 ms
v2.2 No CRT SHA-256 3K Signature Fast Low 455 278 128 758 ms
v2.2 No CRT SHA-256 3K Signature Fast Mid 342 001 136 570 ms
v2.2 No CRT SHA-256 3K Signature Fast High 286 093 152 476 ms
v2.2 n/a SHA-256 3K Verification Small n/a 3 716 768 6 ms
v2.2 n/a SHA-256 3K Verification Fast n/a 2 771 616 4 ms


The table below shows RSA flash memory and RAM usage (in bytes).

PKCS#1 Priv. key mod. exp. method Hash method Modulus size Operation RSA mathematics configuration Priv. key mod. exp. implementation Code Constant data Global data Stack usage Working buffer
v2.2 CRT SHA-256 3K Signature Small Low 6914 bytes 372 bytes 0 bytes 672 bytes 3704 bytes
v2.2 CRT SHA-256 3K Signature Small Mid 7150 bytes 372 bytes 0 bytes 672 bytes 4308 bytes
v2.2 CRT SHA-256 3K Signature Small High 7150 bytes 372 bytes 0 bytes 672 bytes 6708 bytes
v2.2 CRT SHA-256 3K Signature Fast Low 7284 bytes 372 bytes 0 bytes 672 bytes 3704 bytes
v2.2 CRT SHA-256 3K Signature Fast Mid 7520 bytes 372 bytes 0 bytes 672 bytes 4308 bytes
v2.2 CRT SHA-256 3K Signature Fast High 7520 bytes 372 bytes 0 bytes 672 bytes 6708 bytes
v2.2 No CRT SHA-256 3K Signature Small Low 5982 bytes 364 bytes 0 bytes 672 bytes 3484 bytes
v2.2 No CRT SHA-256 3K Signature Small Mid 6218 bytes 364 bytes 0 bytes 672 bytes 4664 bytes
v2.2 No CRT SHA-256 3K Signature Small High 6218 bytes 364 bytes 0 bytes 672 bytes 9368 bytes
v2.2 No CRT SHA-256 3K Signature Fast Low 6352 bytes 364 bytes 0 bytes 672 bytes 3484 bytes
v2.2 No CRT SHA-256 3K Signature Fast Mid 6588 bytes 364 bytes 0 bytes 672 bytes 4664 bytes
v2.2 No CRT SHA-256 3K Signature Fast High 6588 bytes 364 bytes 0 bytes 672 bytes 9368 bytes
v2.2 n/a SHA-256 3K Verification Small n/a 6172 bytes 368 bytes 0 bytes 688 bytes 3108 bytes
v2.2 n/a SHA-256 3K Verification Fast n/a 6542 bytes 368 bytes 0 bytes 688 bytes 3108 bytes


2.6. Post-Quantum Cryptography ML-DSA key pair generation, Signature and verification

This section provides the performance results for ML-DSA key pair generation, signature and verification.

The table below shows the number of clock cycles and time (in ms) needed to perform the described function in different suites and functions configurations. Note: For signature generation, the number of clock cycles is not bounded in time. The measurement was taken using one predefined private key and one 32-byte message, and the reported value corresponds to the minimum observed time.

Suite Function Cycles Time (in ms) Stack usage Working buffer
ML-DSA-44 keyGen 1 995 560 3 476 7116
ML-DSA-65 keyGen 3 467 696 5 476 8140
ML-DSA-87 keyGen 5 794 144 9 476 10 188
ML-DSA-44 Signature 3 673 336 6 772 30 796
ML-DSA-44 Signature Low RAM 3 689 504 6 756 11 340
ML-DSA-65 Signature 5 579 912 9 772 43 084
ML-DSA-65 Signature Low RAM 5 705 576 9 756 15 436
ML-DSA-87 Signature 8 787 960 14 772 57 420
ML-DSA-87 Signature Low RAM 8 885 304 14 756 19 532
ML-DSA-44 Verification 2 292 168 3 700 8908
ML-DSA-44 Verification Low RAM 2 937 960 4 700 4812
ML-DSA-65 Verification 3 788 736 6 700 9948
ML-DSA-65 Verification Low RAM 5 171 952 8 700 4828
ML-DSA-87 Verification 6 186 984 10 700 12 268
ML-DSA-87 Verification Low RAM 8 937 192 14 700 5100

2.7. Post-Quantum Cryptography ML-KEM key pair generation, encapsulation, decapsulation

This section provides the performance results for ML-KEM key pair generation, encapsulation and decapsulation.

The table below shows the number of clock cycles and time (in ms) needed to perform the described function in different functions and suites.

Function Suites Cycles Time (in ms) Stack usage
Key-pair-Generation ML-KEM-512 654 216 1 3 060
Key-pair-Generation ML-KEM-768 1 050 832 2 3 572
Key-pair-Generation ML-KEM-1024 1 626 496 3 4 084
Key-Encapsulation ML-KEM-512 1 916 376 3 4 588
Key-Encapsulation ML-KEM-768 2 754 800 5 5 100
Key-Encapsulation ML-KEM-1024 3 741 144 6 5 612
Key-Decapsulation ML-KEM-512 2 175 120 4 4 684
Key-Decapsulation ML-KEM-768 3 104 072 5 5 516
Key-Decapsulation ML-KEM-1024 4 189 560 7 6 508

2.8. Post-Quantum Cryptography HBS-LMS signature verification

This section provides the performance results for ML-LMS signature verification.

The table below shows the number of clock cycles minimum, average and maximum and average time (in ms) needed to perform the described function in different functions and suite. Note: Clock cycles were measured for 10 different generated key and message pairs, and the reported Cycles avg values are averages over these measurements.

Function Suite Cycles min Cycles avg Time avg (in ms) Cycles max Stack usage
LMS-Verify LMS_N32_H10_W1_SHA256 1 003 608 1 048 164 2 1 091 816 1 672
LMS-Verify LMS_N32_H10_W2_SHA256 1 013 680 1 082 000 2 1 174 272 1 672
LMS-Verify LMS_N32_H10_W4_SHA256 1 728 744 2 008 659 3 2 325 624 1 672
LMS-Verify LMS_N32_H10_W8_SHA256 14 903 960 17 122 736 29 19 522 408 1 672
Retrieved from "https://wiki.stmicroelectronics.cn/stm32mcu/index.php?title=Security:STM32N6_Series:_Cryptographic_Library_Performance_V5.x&oldid=88466"