Cryptographic performance on STM32U5 Series

This page reports measured performance when using the pure software cryptographic library algorithms with an STM32U5 MCU. In addition to performance figures, the required code footprint and memory are also given.


1. Measurement configuration

1.1. Hardware configuration

STM32 MCU STM32U575ZITxQ
Device ID 0x482
Revision ID 0x1001
Board NUCLEO-U575ZI-Q

1.2. Firmware configuration

Cryptographic Library version 040000B1[ver. 1]
  1. ↑ This value corresponds to the information returned by a call to cmox_getInfos

1.3. System configuration

System Core Clock Frequency 160 MHz
Flash latency 4 wait states
Voltage scaling Range 0
ICACHE peripheral 1 (0: disabled / 1: enabled)
Prefetch Cache (ART) 1 (0: disabled / 1: enabled)

1.4. Development toolchains and compilers

IAR Embedded Workbench IAR ANSI C/C++ Compiler V8.50.4.261/W32 for ARM
Info white.png Information
NOTE: The measurements are done using a project built with the High Speed optimization setting enabled.


2. Performance values

2.1. AES symmetric key encryption and decryption

This section provides the performance results for AES-CBC using different modes of operation:

  • Sole buffer: one sole buffer is encrypted or decrypted. Time to perform is given in µs.
  • Data flow: a big message is encrypted or decrypted by chunk. Bit rate is given in kilobytes per second.

2.1.1. Sole buffer mode

In this mode the entire encryption or decryption process, for the whole message size, is managed through a single API call provided by the CMOX library.

The table below shows the number of clock cycles and time (in µs) needed to perform the described operation in small and fast configurations.

AES mode Key size Buffer size Cipher operation Configuration Cycles Time
AES CBC 128 bits 32 bytes Encryption Small 5304 33 µs
AES CBC 128 bits 32 bytes Encryption Fast 4836 30 µs
AES CBC 128 bits 64 bytes Encryption Small 8684 54 µs
AES CBC 128 bits 64 bytes Encryption Fast 7459 46 µs
AES CBC 128 bits 128 bytes Encryption Small 15 473 96 µs
AES CBC 128 bits 128 bytes Encryption Fast 12 701 79 µs
AES CBC 192 bits 32 bytes Encryption Small 5913 36 µs
AES CBC 192 bits 32 bytes Encryption Fast 5373 33 µs
AES CBC 192 bits 64 bytes Encryption Small 9882 61 µs
AES CBC 192 bits 64 bytes Encryption Fast 8438 52 µs
AES CBC 192 bits 128 bytes Encryption Small 17 818 111 µs
AES CBC 192 bits 128 bytes Encryption Fast 14 466 90 µs
AES CBC 256 bits 32 bytes Encryption Small 6753 42 µs
AES CBC 256 bits 32 bytes Encryption Fast 5985 37 µs
AES CBC 256 bits 64 bytes Encryption Small 11 315 70 µs
AES CBC 256 bits 64 bytes Encryption Fast 9401 58 µs
AES CBC 256 bits 128 bytes Encryption Small 20 425 127 µs
AES CBC 256 bits 128 bytes Encryption Fast 16 274 101 µs
AES CBC 128 bits 32 bytes Decryption Small 8879 55 µs
AES CBC 128 bits 32 bytes Decryption Fast 6036 37 µs
AES CBC 128 bits 64 bytes Decryption Small 15 810 98 µs
AES CBC 128 bits 64 bytes Decryption Fast 8693 54 µs
AES CBC 128 bits 128 bytes Decryption Small 29 695 185 µs
AES CBC 128 bits 128 bytes Decryption Fast 14 074 87 µs
AES CBC 192 bits 32 bytes Decryption Small 10 351 64 µs
AES CBC 192 bits 32 bytes Decryption Fast 6662 41 µs
AES CBC 192 bits 64 bytes Decryption Small 18 661 116 µs
AES CBC 192 bits 64 bytes Decryption Fast 9747 60 µs
AES CBC 192 bits 128 bytes Decryption Small 35 252 220 µs
AES CBC 192 bits 128 bytes Decryption Fast 15 943 99 µs
AES CBC 256 bits 32 bytes Decryption Small 11 995 74 µs
AES CBC 256 bits 32 bytes Decryption Fast 7606 47 µs
AES CBC 256 bits 64 bytes Decryption Small 21 660 135 µs
AES CBC 256 bits 64 bytes Decryption Fast 11 092 69 µs
AES CBC 256 bits 128 bytes Decryption Small 41 004 256 µs
AES CBC 256 bits 128 bytes Decryption Fast 18 049 112 µs
Cryptolib STM32U575 AES CBC SB Enc.svg
Cryptolib STM32U575 AES CBC SB Dec.svg


The table below shows Flash and RAM usage (in bytes).

Cipher operation Configuration Code Constant data Global data Stack usage
Encryption Small 2960 bytes 380 bytes 1 bytes 524 bytes
Encryption Fast 3292 bytes 1404 bytes 1 bytes 548 bytes
Decryption Small 3056 bytes 636 bytes 1 bytes 552 bytes
Decryption Fast 3716 bytes 1660 bytes 1 bytes 556 bytes
Cryptolib STM32U575 AES CBC SB Enc FP.svg
Cryptolib STM32U575 AES CBC SB Dec FP.svg


2.1.2. Data flow mode

In this mode, operation is performed in several calls to the CMOX library APIs, as below:

  • cmox_cipher_init
  • cmox_cipher_setKey
  • cmox_cipher_setIV
  • cmox_cipher_append: called several times to encrypt or decrypt the whole message by chunk of fixed size

The table below shows the number of clock cycles and bit rate (in kilobytes per second) needed to perform the described operation in small and in fast configuration.

AES mode Key size Message size Chunk size Cipher operation Configuration Cycles Bit rate
AES CBC 128 bits 8000 bytes 128 bytes Encryption Small 855 568 1496 kbyte/s
AES CBC 128 bits 8000 bytes 128 bytes Encryption Fast 669 888 1910 kbyte/s
AES CBC 128 bits 8000 bytes 512 bytes Encryption Small 849 728 1506 kbyte/s
AES CBC 128 bits 8000 bytes 512 bytes Encryption Fast 661 744 1934 kbyte/s
AES CBC 128 bits 8000 bytes 1024 bytes Encryption Small 848 720 1508 kbyte/s
AES CBC 128 bits 8000 bytes 1024 bytes Encryption Fast 660 320 1938 kbyte/s
AES CBC 128 bits 8000 bytes 2048 bytes Encryption Small 848 208 1509 kbyte/s
AES CBC 128 bits 8000 bytes 2048 bytes Encryption Fast 659 576 1940 kbyte/s
AES CBC 192 bits 8000 bytes 128 bytes Encryption Small 1 000 560 1279 kbyte/s
AES CBC 192 bits 8000 bytes 128 bytes Encryption Fast 767 128 1668 kbyte/s
AES CBC 192 bits 8000 bytes 512 bytes Encryption Small 994 744 1286 kbyte/s
AES CBC 192 bits 8000 bytes 512 bytes Encryption Fast 761 448 1681 kbyte/s
AES CBC 192 bits 8000 bytes 1024 bytes Encryption Small 993 736 1288 kbyte/s
AES CBC 192 bits 8000 bytes 1024 bytes Encryption Fast 760 424 1683 kbyte/s
AES CBC 192 bits 8000 bytes 2048 bytes Encryption Small 993 232 1288 kbyte/s
AES CBC 192 bits 8000 bytes 2048 bytes Encryption Fast 759 920 1684 kbyte/s
AES CBC 256 bits 8000 bytes 128 bytes Encryption Small 1 145 560 1117 kbyte/s
AES CBC 256 bits 8000 bytes 128 bytes Encryption Fast 867 744 1475 kbyte/s
AES CBC 256 bits 8000 bytes 512 bytes Encryption Small 1 139 688 1123 kbyte/s
AES CBC 256 bits 8000 bytes 512 bytes Encryption Fast 862 096 1484 kbyte/s
AES CBC 256 bits 8000 bytes 1024 bytes Encryption Small 1 138 680 1124 kbyte/s
AES CBC 256 bits 8000 bytes 1024 bytes Encryption Fast 861 032 1486 kbyte/s
AES CBC 256 bits 8000 bytes 2048 bytes Encryption Small 1 138 176 1124 kbyte/s
AES CBC 256 bits 8000 bytes 2048 bytes Encryption Fast 860 480 1487 kbyte/s
AES CBC 128 bits 8000 bytes 128 bytes Decryption Small 1 765 200 725 kbyte/s
AES CBC 128 bits 8000 bytes 128 bytes Decryption Fast 701 080 1825 kbyte/s
AES CBC 128 bits 8000 bytes 512 bytes Decryption Small 1 754 496 729 kbyte/s
AES CBC 128 bits 8000 bytes 512 bytes Decryption Fast 691 136 1852 kbyte/s
AES CBC 128 bits 8000 bytes 1024 bytes Decryption Small 1 751 632 730 kbyte/s
AES CBC 128 bits 8000 bytes 1024 bytes Decryption Fast 688 320 1859 kbyte/s
AES CBC 128 bits 8000 bytes 2048 bytes Decryption Small 1 748 528 732 kbyte/s
AES CBC 128 bits 8000 bytes 2048 bytes Decryption Fast 685 264 1867 kbyte/s
AES CBC 192 bits 8000 bytes 128 bytes Decryption Small 2 102 800 608 kbyte/s
AES CBC 192 bits 8000 bytes 128 bytes Decryption Fast 799 752 1600 kbyte/s
AES CBC 192 bits 8000 bytes 512 bytes Decryption Small 2 094 672 611 kbyte/s
AES CBC 192 bits 8000 bytes 512 bytes Decryption Fast 791 744 1616 kbyte/s
AES CBC 192 bits 8000 bytes 1024 bytes Decryption Small 2 092 312 611 kbyte/s
AES CBC 192 bits 8000 bytes 1024 bytes Decryption Fast 789 304 1621 kbyte/s
AES CBC 192 bits 8000 bytes 2048 bytes Decryption Small 2 089 376 612 kbyte/s
AES CBC 192 bits 8000 bytes 2048 bytes Decryption Fast 786 640 1627 kbyte/s
AES CBC 256 bits 8000 bytes 128 bytes Decryption Small 2 443 840 523 kbyte/s
AES CBC 256 bits 8000 bytes 128 bytes Decryption Fast 901 816 1419 kbyte/s
AES CBC 256 bits 8000 bytes 512 bytes Decryption Small 2 435 736 525 kbyte/s
AES CBC 256 bits 8000 bytes 512 bytes Decryption Fast 893 848 1432 kbyte/s
AES CBC 256 bits 8000 bytes 1024 bytes Decryption Small 2 433 336 526 kbyte/s
AES CBC 256 bits 8000 bytes 1024 bytes Decryption Fast 891 576 1435 kbyte/s
AES CBC 256 bits 8000 bytes 2048 bytes Decryption Small 2 430 456 526 kbyte/s
AES CBC 256 bits 8000 bytes 2048 bytes Decryption Fast 888 800 1440 kbyte/s
Cryptolib STM32U575 AES CBC DF Enc.svg
Cryptolib STM32U575 AES CBC DF Dec.svg


The table below shows Flash and RAM usage (in bytes).

Cipher operation Configuration Code Constant data Global data Stack usage
Encryption Small 2852 bytes 372 bytes 1 bytes 140 bytes
Encryption Fast 3184 bytes 1396 bytes 1 bytes 172 bytes
Decryption Small 2948 bytes 628 bytes 1 bytes 176 bytes
Decryption Fast 3608 bytes 1652 bytes 1 bytes 180 bytes
Cryptolib STM32U575 AES CBC DF Enc FP.svg
Cryptolib STM32U575 AES CBC DF Dec FP.svg


2.2. HASH digest

In this section we provide the performance results for HASH using different modes of operation:

  • Sole buffer: one sole buffer is hashed. Time to perform is given in us.
  • Data flow: a big message is hashed by chunk. Bit rate is given in bytes per s.

2.2.1. Sole buffer mode

In this mode, the entire message hashing process is managed through a single API call provided by the CMOX library.

The table below shows the number of clock cycles and time (in µs) needed to perform described operation.

HASH mode Buffer size Cycles Time
SHA256 32 bytes 5171 32 µs
SHA256 64 bytes 8340 52 µs
SHA256 128 bytes 11 264 70 µs
SHA384 32 bytes 16 640 104 µs
SHA384 64 bytes 16 825 105 µs
SHA384 128 bytes 30 619 191 µs
Cryptolib STM32U575 HASH SB Dig.svg


The table below shows Flash and RAM usage (in bytes).

HASH mode Code Constant data Global data Stack usage
SHA256 1780 296 bytes 1 bytes 564 bytes
SHA384 3012 744 bytes 1 bytes 1124 bytes
Cryptolib STM32U575 HASH SB Dig FP.svg


2.2.2. Data flow mode

In this mode, operation is performed in several calls to the CMOX library APIs, as below:

  • cmox_hash_init
  • cmox_hash_append: called several times to hash the whole message by chunk of fixed size
  • cmox_hash_generateTag

The table below shows the number of clock cycles and bit rate (in kilobytes per second) needed to perform described operation.

HASH mode Message size Chunk size Cycles Bit rate
SHA256 8000 bytes 128 bytes 397 652 3218 kbyte/s
SHA256 8000 bytes 512 bytes 375 261 3410 kbyte/s
SHA256 8000 bytes 1024 bytes 371 489 3445 kbyte/s
SHA256 8000 bytes 2048 bytes 369 600 3463 kbyte/s
SHA384 8000 bytes 128 bytes 877 595 1458 kbyte/s
SHA384 8000 bytes 512 bytes 837 664 1528 kbyte/s
SHA384 8000 bytes 1024 bytes 830 756 1540 kbyte/s
SHA384 8000 bytes 2048 bytes 827 299 1547 kbyte/s
Cryptolib STM32U575 HASH DF Dig.svg


The table below shows final tag generation done through the call to cmox_hash_generateTag.

HASH mode Cycles Time
SHA256 4283 26 µs
SHA384 15 556 97 µs

The table below shows Flash and RAM usage (in bytes).

HASH mode Code Constant data Global data Stack usage
SHA256 1788 bytes 288 bytes 1 bytes 372 bytes
SHA384 3020 bytes 736 bytes 1 bytes 828 bytes
Cryptolib STM32U575 HASH DF Dig FP.svg


2.3. ECDSA signature and verification

In this section we provide the performance results for ECDSA signature and verification.

The table below shows the number of clock cycles and time (in ms) needed to perform described operation in different configurations.

Curve Operation ECC mathematics configuration Curve definition Cycles Time
SECP256R1 Signature Small Low 2 916 624 18 ms
SECP256R1 Signature Small High 2 830 328 17 ms
SECP256R1 Signature SuperFast Low 1 911 176 11 ms
SECP256R1 Signature SuperFast High 1 842 280 11 ms
SECP256R1 Verification Small Low 7 010 912 43 ms
SECP256R1 Verification Small High 6 212 304 38 ms
SECP256R1 Verification SuperFast Low 4 674 824 29 ms
SECP256R1 Verification SuperFast High 4 103 272 25 ms
SECP384R1 Signature Small Low 8 251 312 51 ms
SECP384R1 Signature Small High 7 886 520 49 ms
SECP384R1 Signature Fast Low 7 029 096 43 ms
SECP384R1 Signature Fast High 6 718 128 41 ms
SECP384R1 Verification Small Low 19 742 240 123 ms
SECP384R1 Verification Small High 17 128 544 107 ms
SECP384R1 Verification Fast Low 16 893 776 105 ms
SECP384R1 Verification Fast High 14 663 544 91 ms
Cryptolib STM32U575 ECDSA Sig.svg
Cryptolib STM32U575 ECDSA Ver.svg


The table below shows ECDSA Flash and RAM usage (in bytes).

Curve Operation ECC mathematics configuration Curve definition Code Constant data Global data Stack usage Working buffer
SECP256R1 Signature Small Low 11 636 bytes 1184 bytes 1 bytes 328 bytes 628 bytes
SECP256R1 Signature Small High 11 636 bytes 1568 bytes 1 bytes 328 bytes 696 bytes
SECP256R1 Signature SuperFast Low 12 946 bytes 1184 bytes 1 bytes 332 bytes 628 bytes
SECP256R1 Signature SuperFast High 12 946 bytes 1568 bytes 1 bytes 332 bytes 696 bytes
SECP256R1 Verification Small Low 12 158 bytes 1200 bytes 1 bytes 424 bytes 856 bytes
SECP256R1 Verification Small High 12 158 bytes 1584 bytes 1 bytes 424 bytes 1648 bytes
SECP256R1 Verification SuperFast Low 13 468 bytes 1200 bytes 1 bytes 428 bytes 856 bytes
SECP256R1 Verification SuperFast High 13 468 bytes 1584 bytes 1 bytes 428 bytes 1648 bytes
SECP384R1 Signature Small Low 11 636 bytes 1664 bytes 1 bytes 328 bytes 884 bytes
SECP384R1 Signature Small High 11 636 bytes 2240 bytes 1 bytes 328 bytes 984 bytes
SECP384R1 Signature Fast Low 12 006 bytes 1664 bytes 1 bytes 344 bytes 884 bytes
SECP384R1 Signature Fast High 12 006 bytes 2240 bytes 1 bytes 344 bytes 984 bytes
SECP384R1 Verification Small Low 12 158 bytes 1680 bytes 1 bytes 424 bytes 1192 bytes
SECP384R1 Verification Small High 12 158 bytes 2256 bytes 1 bytes 424 bytes 2272 bytes
SECP384R1 Verification Fast Low 12 528 bytes 1680 bytes 1 bytes 440 bytes 1192 bytes
SECP384R1 Verification Fast High 12 528 bytes 2256 bytes 1 bytes 440 bytes 2272 bytes
Cryptolib STM32U575 ECDSA SECP256R1 Sig FP.svg
Cryptolib STM32U575 ECDSA SECP256R1 Ver FP.svg
Cryptolib STM32U575 ECDSA SECP384R1 Sig FP.svg
Cryptolib STM32U575 ECDSA SECP384R1 Ver FP.svg


2.4. EdDSA signature and verification

In this section we provide the performance results for EdDSA signature and verification.

The table below shows the number of clock cycles and time (in ms) needed to perform described operation in different configurations.

Curve Message size Operation ECC mathematics configuration Curve definition Cycles Time
Ed25519 1023 bytes Signature Small OptLow 4 506 952 28 ms
Ed25519 1023 bytes Signature Small OptHigh 2 630 168 16 ms
Ed25519 1023 bytes Signature SuperFast OptLow 3 241 608 20 ms
Ed25519 1023 bytes Signature SuperFast OptHigh 1 898 968 11 ms
Ed25519 1023 bytes Verification Small OptLow 6 788 752 42 ms
Ed25519 1023 bytes Verification Small OptHigh 5 950 696 37 ms
Ed25519 1023 bytes Verification SuperFast OptLow 4 659 992 29 ms
Ed25519 1023 bytes Verification SuperFast OptHigh 4 062 376 25 ms
Cryptolib STM32U575 EdDSA Sig.svg
Cryptolib STM32U575 EdDSA Ver.svg


The table below shows EdDSA Flash and RAM usage (in bytes).

Curve Message size Operation ECC mathematics configuration Curve definition Code Constant data Global data Stack usage Working buffer
Ed25519 1023 bytes Signature Small OptLow 14 100 bytes 1744 bytes 1 bytes 1236 bytes 1388 bytes
Ed25519 1023 bytes Signature Small OptHigh 14 506 bytes 2896 bytes 1 bytes 1236 bytes 1388 bytes
Ed25519 1023 bytes Signature SuperFast OptLow 15 410 bytes 1744 bytes 1 bytes 1236 bytes 1388 bytes
Ed25519 1023 bytes Signature SuperFast OptHigh 15 816 bytes 2896 bytes 1 bytes 1236 bytes 1388 bytes
Ed25519 1023 bytes Verification Small OptLow 14 186 bytes 1748 bytes 1 bytes 1244 bytes 1152 bytes
Ed25519 1023 bytes Verification Small OptHigh 14 592 bytes 2900 bytes 1 bytes 1244 bytes 1992 bytes
Ed25519 1023 bytes Verification SuperFast OptLow 15 496 bytes 1748 bytes 1 bytes 1244 bytes 1152 bytes
Ed25519 1023 bytes Verification SuperFast OptHigh 15 902 bytes 2900 bytes 1 bytes 1244 bytes 1992 bytes
Cryptolib STM32U575 EdDSA Sig FP.svg
Cryptolib STM32U575 EdDSA Ver FP.svg


2.5. RSA signature and verification

In this section we provide the performance results for RSA signature and verification.

The table below shows the number of clock cycles and time (in ms) needed to perform described operation in different configurations.

PKCS#1 Priv. key mod. exp. method Hash method Modulus size Operation RSA mathematics configuration Priv. key mod. exp. implementation Cycles Time
v2.2 CRT SHA-256 3K Signature Small Low 198 351 808 1239 ms
v2.2 CRT SHA-256 3K Signature Small Mid 149 291 432 933 ms
v2.2 CRT SHA-256 3K Signature Small High 125 368 552 783 ms
v2.2 CRT SHA-256 3K Signature Fast Low 158 892 464 993 ms
v2.2 CRT SHA-256 3K Signature Fast Mid 119 655 392 747 ms
v2.2 CRT SHA-256 3K Signature Fast High 100 072 440 625 ms
v2.2 No CRT SHA-256 3K Signature Small Low 763 442 408 4771 ms
v2.2 No CRT SHA-256 3K Signature Small Mid 573 385 616 3583 ms
v2.2 No CRT SHA-256 3K Signature Small High 479 616 784 2997 ms
v2.2 No CRT SHA-256 3K Signature Fast Low 606 865 248 3792 ms
v2.2 No CRT SHA-256 3K Signature Fast Mid 455 876 584 2849 ms
v2.2 No CRT SHA-256 3K Signature Fast High 380 469 912 2377 ms
v2.2 n/a SHA-256 3K Verification Small n/a 3 811 272 23 ms
v2.2 n/a SHA-256 3K Verification Fast n/a 3 285 160 20 ms
Cryptolib STM32U575 RSA Sig.svg
Cryptolib STM32U575 RSA Ver.svg


The table below shows RSA Flash and RAM usage (in bytes).

PKCS#1 Priv. key mod. exp. method Hash method Modulus size Operation RSA mathematics configuration Priv. key mod. exp. implementation Code Constant data Global data Stack usage Working buffer
v2.2 CRT SHA-256 3K Signature Small Low 6986 bytes 371 bytes 5 bytes 700 bytes 3704 bytes
v2.2 CRT SHA-256 3K Signature Small Mid 7234 bytes 371 bytes 5 bytes 700 bytes 4308 bytes
v2.2 CRT SHA-256 3K Signature Small High 7234 bytes 371 bytes 5 bytes 700 bytes 6708 bytes
v2.2 CRT SHA-256 3K Signature Fast Low 7356 bytes 371 bytes 5 bytes 700 bytes 3704 bytes
v2.2 CRT SHA-256 3K Signature Fast Mid 7604 bytes 371 bytes 5 bytes 700 bytes 4308 bytes
v2.2 CRT SHA-256 3K Signature Fast High 7604 bytes 371 bytes 5 bytes 700 bytes 6708 bytes
v2.2 No CRT SHA-256 3K Signature Small Low 6016 bytes 363 bytes 5 bytes 700 bytes 3484 bytes
v2.2 No CRT SHA-256 3K Signature Small Mid 6264 bytes 363 bytes 5 bytes 700 bytes 4664 bytes
v2.2 No CRT SHA-256 3K Signature Small High 6264 bytes 363 bytes 5 bytes 700 bytes 9368 bytes
v2.2 No CRT SHA-256 3K Signature Fast Low 6386 bytes 363 bytes 5 bytes 700 bytes 3484 bytes
v2.2 No CRT SHA-256 3K Signature Fast Mid 6634 bytes 363 bytes 5 bytes 700 bytes 4664 bytes
v2.2 No CRT SHA-256 3K Signature Fast High 6634 bytes 363 bytes 5 bytes 700 bytes 9368 bytes
v2.2 n/a SHA-256 3K Verification Small n/a 6762 bytes 367 bytes 5 bytes 716 bytes 3108 bytes
v2.2 n/a SHA-256 3K Verification Fast n/a 7132 bytes 367 bytes 5 bytes 716 bytes 3108 bytes
Cryptolib STM32U575 RSA 3K CRT Sig FP.svg
Cryptolib STM32U575 RSA 3K NoCRT Sig FP.svg
Cryptolib STM32U575 RSA 3K Ver FP.svg



Retrieved from "https://wiki.stmicroelectronics.cn/stm32mcu/index.php?title=Security:STM32U5_Series:_Cryptographic_Library_Performance&oldid=13922"