9 Is Hardware Acceleration Necessary?

Developers building embedded systems that use elliptic curve cryptography may use microcontrollers with acceleration for the elliptic curve computation, if the application is latency sensitive. This can, however, lead to the selection of a microcontroller that is more expensive than what the application actually requires.

For example, in a challenge-response application, computing an ECDSA P-384 signature for a challenge-response scheme can take more than 2s on an 80MHz Arm Cortex-M0+ processor, which is far longer than the 6ms that it takes to transmit the resulting signature on the wire at 100Kbps (a typical rate, assuming communication methods such as standard I²C or 115200 serial universal asynchronous receiver transmitter).

When moving to PQC, the larger digital signatures and shorter computation times change this dynamic significantly. For example, the wire time required to transmit a signature increases by 48 times, from approximately 9ms (for ECDSA P-384) to approximately 420ms (for ML-DSA-87). Signature verification computation time reduces from approximately 2,200ms (for ECDSA P-384) to approximately 260ms, which is nearly one-half the time it takes to transmit the signature on the wire. As a result, applications such as attestation tend to be more limited by communication time than by computation time, making CPU-based implementations economical. Figure 9-1 compares the verify performance for each security level on Arm Cortex-M0+ and Arm Cortex-M33 target MCUs.