Built for the board you actually have
Most of these devices have kilobytes of RAM, a small battery, and a radio that drops packets. A cipher that needs a table, a heap and three fragments to send one message is the wrong cipher. Here is what we built APEX-256 around, and how we check it.
Your message fits in one packet
Ciphers that pad blocks or bolt a tag onto every frame make small messages bigger. On a sub-GHz link with a tight payload limit, that is enough to push a message into a second packet. Lose either packet and the whole message is gone. The device resends, and the resend costs battery.
APEX-256 is a stream cipher. Ciphertext is the same length as plaintext. A 40-byte reading stays 40 bytes.
Authentication is its own layer and costs its own bytes. We say so on How It Works instead of hiding it.
What it costs on the board
One message, one packet
Ciphertext = plaintext length
Stream XOR means nothing gets added by the cipher. Channel capacity and the radio’s duty cycle stay where they were.
No heap
40-byte self-contained context
Operates inside a 40-byte self-contained instance context. Zero heap allocation, zero static .bss, no malloc, no free, no fragmentation, no heap exhaustion.
Constant-time
Same cycles, every byte
No data-dependent branches, no lookup tables in the keystream path, and hardware side-channel hardening (CPA |r| = 0.0024, Welch |t| = 0.74 < 4.50).
Target silicon
ARM Cortex-M • ESP32 • RISC-V • FPGA
Run on STM32F405/H757 (Cortex-M4/M7), ESP32-S3 (Xtensa LX7 @ 240 MHz), nRF52840, RISC-V, and synthesizable Verilog-2005 RTL cores.
What we haven’t published
Cycles per byte, flash size and energy per byte all depend on the compiler, the flags and the silicon. We would rather hand you the logs and the harness so you can reproduce them on your own board than print a number you can’t check.
Both ship with the Engineering Evaluation Kit. See Licensing.
Hardware-in-the-Loop (HIL) Test Instrumentation
Every benchmark and power capture is taken in our Henderson, NV lab, on physical boards: