Supported Algorithms

Block ciphers: AES128, AES192, AES256
Block cipher modes: CTR, CFB, CBC, OFB
Stream ciphers: ChaCha
Hash algorithms: SHA1, SHA256, BLAKE2s
Public key algorithms: Curve25519
Random number generation: RNG, TransistorNoiseSource

All cryptographic algorithms have been optimized for 8-bit Arduino platforms like the Uno. Memory usage is also reduced, particularly for SHA1 and SHA256 which save 256 and 192 bytes respectively over traditional implementations. For other algorithms, static sbox tables and the like are placed into program memory to further reduce data memory usage.

ChaCha with 20 rounds and 256-bit keys is the recommended symmetric encryption algorithm because it is twice as fast as AES128, constant-time, and much more secure. AES128, AES192, and AES256 are provided for use in applications where compatibility with other systems is desirable.

BLAKE2s is a variation on the ChaCha stream cipher, designed for hashing, with a 256-bit hash output. It is intended as a high performance drop-in replacement for SHA256 for when speed is critical but exact SHA256 compatibility is not.

Performance

All figures are for the Arduino Uno running at 16 MHz. Figures for the Ardunino Mega 2560 running at 16 MHz are similar:

Algorithm	Encryption / Hashing (per byte)	Decryption (per byte)	Key Setup	State Size (bytes)
AES128 (ECB mode)	36.90us	66.48us	160.00us	208
AES192 (ECB mode)	44.20us	80.35us	166.54us	240
AES256 (ECB mode)	51.50us	94.22us	227.97us	272
ChaCha (20 rounds)	14.87us	14.88us	43.74us	130
ChaCha (12 rounds)	10.38us	10.38us	43.74us	130
ChaCha (8 rounds)	8.13us	8.14us	43.74us	130
SHA1	21.90us			94
SHA256	43.85us			106
BLAKE2s	18.54us			170

Where a cipher supports more than one key size (such as ChaCha), the values are typically almost identical for 128-bit and 256-bit keys so only the maximum is shown above.

Public key algorithms have the following results on an Arduino Uno:

Algorithm	Operation	Time	Comment
Curve25519	eval()	3738 ms	Raw curve evaluation
Curve25519	dh1()	3740 ms	First half of Diffie-Hellman key agreement
Curve25519	dh2()	3738 ms	Second half of Diffie-Hellman key agreement