SLAU846B June 2023 – November 2024 MSPM0G1105 , MSPM0G1106 , MSPM0G1107 , MSPM0G1505 , MSPM0G1506 , MSPM0G1507 , MSPM0G1519 , MSPM0G3105 , MSPM0G3105-Q1 , MSPM0G3106 , MSPM0G3106-Q1 , MSPM0G3107 , MSPM0G3107-Q1 , MSPM0G3505 , MSPM0G3505-Q1 , MSPM0G3506 , MSPM0G3506-Q1 , MSPM0G3507 , MSPM0G3507-Q1 , MSPM0G3519
The CCM (Counter with CBC-MAC) protocol operation is a combined operation, consisting of encryption/decryption and authentication. Both the authentication and encryption/decryption operations use the crypto core; these are executed sequentially on the AES core. A part of the data stream can require authentication only. The authentication only data always needs to be in front of the data that requires encryption.
Figure 24-9 illustrates the CCM protocol. The authentication starts with the encryption of a pre-defined block B0. This block consists of flags, nonce and message length. The next blocks contain the authentication data length concatenated with the authentication only data. After processing the authentication only data, the encryption/decryption operations are performed, each followed by the related authentication of the plaintext data block (which equals the input in the case of encryption and the output in the case of decryption). The final authentication result needs to be encrypted using the output of the encryption of the IV block A0. This block contains the IV (consisting of flags and nonce) concatenated with the counter, which is zero for A0.
Figure 24-10 shows one round of a CCM operation for both encryption and decryption. A 32-bit counter is used as IV (as it is for CTR mode). The data is encrypted in the same way as CTR mode, by XOR-ing the crypto core output with the input. Directly after the encrypt-operation, the plaintext is XOR-ed with the intermediate authentication result. The XOR result is used as input for a second encrypt-operation to calculate the next (intermediate) authentication result.