nRF5340 Development Kit board: ECDH implementation (found in nrf/samples/crypto/ecdh) using hardware (cc3xx) is significantly slower than when using software (oberon)

RE: nRF5340 Development Kit board: ECDH implementation (found in nrf/samples/crypto/ecdh) using hardware (cc3xx) is significantly slower than when using software (oberon)

Hieu — Wed, 21 May 2025 08:24:26 GMT

Unfortunately, there is no purpose. It's a mismatch between the CC31X driver design and the PSA API design.

The saving grace is that the key generation operation is one that is seldomly run, so the impact of this issue hasn't been too big.

Nonetheless, we agree it should be improved. It is a part of the improvement that I mentioned has been queued.

RE: nRF5340 Development Kit board: ECDH implementation (found in nrf/samples/crypto/ecdh) using hardware (cc3xx) is significantly slower than when using software (oberon)

Emil Lenngren — Tue, 20 May 2025 15:34:11 GMT

Thanks for the info!

"However, the key isn't kept to be used in a later export, but discarded."

What is the purpose of the public key derivation then, if it is immediately discarded? It's not useful to do expensive computations if the result will be immediately discarded, right?

RE: nRF5340 Development Kit board: ECDH implementation (found in nrf/samples/crypto/ecdh) using hardware (cc3xx) is significantly slower than when using software (oberon)

Hieu — Tue, 20 May 2025 15:26:53 GMT

Emil's guess that the CC31X implementations generate both private and public key is right. However, the key isn't kept to be used in a later export, but discarded. For an apple-to-apple performance comparison, then the test should be only generating the private key with the CC31X backend, while doing both private key generation and public key export with the Oberon backend.

Even then, the CC31X performance will still be significantly weaker than the Oberon library due to aforementioned current state of the driver. Our engineers have put considerations for improvement into our backlog.

RE: nRF5340 Development Kit board: ECDH implementation (found in nrf/samples/crypto/ecdh) using hardware (cc3xx) is significantly slower than when using software (oberon)

Emil Lenngren — Sat, 17 May 2025 14:25:06 GMT

Hmm something is very weird with the generation on cryptocell then, as it should definitely not take a million cycles (16 milliseconds) to simply generate 32 random bytes...

RE: nRF5340 Development Kit board: ECDH implementation (found in nrf/samples/crypto/ecdh) using hardware (cc3xx) is significantly slower than when using software (oberon)

achi77 — Sat, 17 May 2025 09:53:29 GMT

Hi Emil

Here is the comparison between HW and SW for public key export after key generation:

HW:

Starting ECDH KEY PAIR GENERATION benchmark (100 runs)...
Frequency: 64 MHz
ECDH KEY PAIR GENERATION benchmark results:
   Runs:    100
   Total:   97356680 cycles
   Average: 973566.000 cycles
   Minimum: 943227 cycles
   Maximum: 1013147 cycles
   Std:     13392.071 cycles

Starting ECDH PUBLIC KEY EXPORT benchmark (100 runs)...
Frequency: 64 MHz
ECDH PUBLIC KEY EXPORT benchmark results:
   Runs:    100
   Total:   90703453 cycles
   Average: 907034.000 cycles
   Minimum: 906987 cycles
   Maximum: 907036 cycles
   Std:     4.796 cycles

SW:

Starting ECDH KEY PAIR GENERATION benchmark (100 runs)...
Frequency: 64 MHz
ECDH KEY PAIR GENERATION benchmark results:
   Runs:    100
   Total:   1107485 cycles
   Average: 11074.000 cycles
   Minimum: 11074 cycles
   Maximum: 11153 cycles
   Std:     7.874 cycles

Starting ECDH PUBLIC KEY EXPORT benchmark (100 runs)...
Frequency: 64 MHz
ECDH PUBLIC KEY EXPORT benchmark results:
   Runs:    100
   Total:   147704871 cycles
   Average: 1477048.000 cycles
   Minimum: 1477031 cycles
   Maximum: 1477049 cycles
   Std:     2.000 cycles

I use the nRF5340 DK and according to https://www.nordicsemi.com/Products/nRF5340, it should use the Arm CryptoCell-312. I have seen that Cracen is also a possibility, but not on nRF5340 devices.

RE: nRF5340 Development Kit board: ECDH implementation (found in nrf/samples/crypto/ecdh) using hardware (cc3xx) is significantly slower than when using software (oberon)

Emil Lenngren — Fri, 16 May 2025 22:54:49 GMT

I put my bet on that the answer by Hieu is wrong.

I think it's different behaviour in the two implementations how they each define "keypair generation". The oberon lib only generates some random numbers which constitute the private key, while I think CC310 also derives the public key internally (which is the operation that actually costs). Please try to redo your benchmark by performing key pair generation followed by public key export to make an apples by apples comparison.

In any case, the CC310 is quite slow when it comes to big number arithmetic (as is used in public key cryptography) for being a hw accelerator. The multiplier internally is not so fast and it uses the generic Barrett reduction algorithm, while software implementations can be optimized better for "special prime moduli" such as the ones typically used for elliptic curves. The Cracen found in nRF54L is several times faster.

RE: nRF5340 Development Kit board: ECDH implementation (found in nrf/samples/crypto/ecdh) using hardware (cc3xx) is significantly slower than when using software (oberon)

achi77 — Fri, 16 May 2025 13:27:12 GMT

Hi Hieu,

Thank you very much for the fast reply!

achi

RE: nRF5340 Development Kit board: ECDH implementation (found in nrf/samples/crypto/ecdh) using hardware (cc3xx) is significantly slower than when using software (oberon)

Hieu — Thu, 15 May 2025 12:50:42 GMT

Hello achi77,

I got feedback from our engineers that this is the state of the CC3XX driver right now with ECDH key generation. It is meant to have better security than the Oberon library, but at the cost of performance.

I was also tipped that you can improve the performance a little by changing the access lock strategy here: sdk-nrfxlib/crypto/Kconfig at v3.0.1 · nrfconnect/sdk-nrfxlib.
Please note that this change will make CryptoCell access not thread-safe.

Hieu

RE: nRF5340 Development Kit board: ECDH implementation (found in nrf/samples/crypto/ecdh) using hardware (cc3xx) is significantly slower than when using software (oberon)

Hieu — Wed, 14 May 2025 13:35:17 GMT

Hello achi77,

I will look into this and follow-up with you this week.

Hieu