In this mode, the engine calculates H and Y0-encrypted internally. At the high-level, the programming involves these steps:
- Provide GCM context (key, IV, lengths and mode).
- Provide AAD data (and wait for calculation of H and encryption of Y0).
- Provide next AAD data.
- Provide last AAD data.
- Provide first crypto data.
- Provide next crypto data.
- Read result data and provide next crypto data.
- ...
- Read result data and provide last crypto data.
- Read result data.
- Read result data.
- Read authentication result (TAG).
To implement GCM encryption over N blocks of plaintext and M blocks of AAD, follow these steps:
- Configure Output DMA channel for saving ciphertext:
- Set DMA channel trigger selection to AES Trig1
- Set DMA channel source address to DATA_OUT
- Set DMA channel destination address to location where ciphertext is to be stored (for example, SRAM)
- Set DMA channel transfer size to N×4
- Set DMA channel mode to single transfer mode
- In the AES event registers, unmask Trig1 in the IMASK register of DMA_TRIG_DATAOUT
- Configure Input DMA channel for loading AAD and plaintext:
- Set DMA channel trigger selection to AES Trig0
- Set DMA channel source address to location where plaintext is stored (for example, SRAM)
- Set DMA channel destination address to DATA_IN
- Set DMA channel transfer size to (N+M)*4
- Set DMA channel mode to single transfer mode
- In the AES event registers, unmask Trig0 in the IMASK register of DMA_TRIG0
- Configure and enable the DMA interrupt for the Output DMA channel in the DMA controller
- Configure DMA_HS for DMA based handshake: set DMA_HS[DMA_DATA_ACK] = 1
- Load Encryption/Decryption key as described in Section 11.2.1
- Load GCMCCM_TAGn (0,1,2,3) registers with 0s.
- Load Initialization vector (IV) by writing to IV0, IV1, IV2 and IV3 registers
- Configure the CTRL register for block cipher encryption mode for GCM
- Select key size via CTRL[KEY_SIZ]
- Select Direction for Encryption by CTRL[DIR] = 1
- Select GCM mode by setting CTRL[GCM] = 3
- Select CTR mode by setting CTRL[CTR] =
1
-
Enabke saving of TAG by setting CTRL[SAVE_CNTXT] = 1
- Write encryption/decryption byte count N×4 to AES C_LENGTH_0 and C_LENGTH_1 registers
- Write authentication data (AAD) byte count M*4 to AES AAD_LENGTH register
- Wait for the DMA output channel interrupt to indicate completion of the entire operation. The output is stored started at the location configured in step 1c.
- Read out the final TAG from the TAG0, TAG1, TAG2, TAG3 registers
Note: The AAD and cryptographic data can end misaligned. The CPU must pad both to a 128-bit boundary with zeroes. More formally, the AAD and crypto data padding must satisfy the bit string: 0n, with 0 <= n <= 127. This means that the AAD must be provided as separate blocks to the engine, such that the cryptographic data starts 128-bit aligned. If the AAD/cryptographic data stream is 128-bit aligned no padding is required. Because the engine
only supports bytes, n must be such that (n MOD 8) = 0. Further, because a single DMA channel supplies both AAD and plaintext, the entire data must be organized contiguously in memory with the first M blocks of AAD followed by N blocks of plaintext. This memory contiguity restriction is not applicable when CPU software directly provides inputs via interrupt handling.
Do not load both length values with zeroes. If a data stream is done and the next data stream uses the same key and control, only the IV and length values need be re-loaded.