wolfSSL runs the full set of NIST post-quantum algorithms on the STM32C5. Below are the measurements on a NUCLEO-C5A3ZG with a Cortex-M33 at 144 MHz.
- ML-KEM (FIPS 203) key exchange. ML-KEM-768 encapsulates in 5.9 ms and decapsulates in 7.7 ms.
- ML-DSA (FIPS 204) signatures at all three parameter sets. ML-DSA-44 verifies in 18.5 ms.
- LMS/HSS (RFC 8554) stateful hash signatures, verifying in 18.2 ms.
- Our Thumb-2 assembly gives about 1.5x on ML-KEM and 1.3x on ML-DSA over the portable C build. The assembly replaces the C, so the post-quantum code size barely moves.
Adding all three families costs about 47 KB of flash: roughly 18 KB for ML-KEM, 15 KB for ML-DSA, 7 KB for LMS, and 7 KB for the SHA-3 and SHAKE code that ML-KEM and ML-DSA share. That leaves most of the 1 MB on the part for the application.
The STM32C5 is a Cortex-M33 part with TrustZone, up to 1 MB of flash and 256 KB of RAM. On the C5A3 it pairs that with a full hardware crypto set: AES, a hash engine, a true random number generator, a public key accelerator for ECC, and a secure AES block. That mix suits connected and industrial equipment that has to hold a per device identity, verify firmware at boot, and now also carry keys that stay valid once quantum computers arrive.
The STM32C5 also carries SAES and a device hardware unique key, so a private key can be wrapped to the silicon and used without ever appearing in software. wolfSSL reaches that through the standard crypto callback API, validated on this same board.
STM32C5 support covers hashing, AES and SAES, the PKA and the RNG, and it was merged in PR #10395. It is on wolfSSL master now and will appear in the next release.
Build instructions, the full list of STM32 family flags and the DHUK and CCB documentation are in wolfcrypt/src/port/st/README.md.
Check out the benchmark harness and ready made board configurations!
If you have questions about any of the above, please contact us at facts@wolfssl.com or call us at +1 425 245 8247.
Download wolfSSL Now