Curve25519 on Cortex-M0 shootout

ImplementationOptimisationCyclesCode sizeStack usage
donna-Os15748K7.4KB3148B
donna-O215218K7.9KB3148B
donna-O312907K16KB3380B
naclref-Os47813K3.2KB4012B
naclref-O234309K3.5KB4036B
naclref-O335059K4.1KB4044B
tweetnacl-Os75979K2.8KB2244B
tweetnacl-O268876K3.0KB2268B
tweetnacl-O369622K8.9KB2900B

naclref at -O2 seems to give a good balance. If you can spare the flash, donna is quite significantly quicker.