SPRUJ17H March 2022 – October 2024 AM2631 , AM2631-Q1 , AM2632 , AM2632-Q1 , AM2634 , AM2634-Q1
Thanks to a dedicated 128-bit direct-key input bus, the encryption/decryption key for the AES can be either contained in registers or directly coded in the 128-bit input bus. The selection is done by the directbusen bit of the HSM_AES_S_SYSCONFIG register.
Given a mapping in the key registers:
The direct bus should be as in the figure below:
Besides the direct_key bus that is directly used as key for the secure HIB if bit directbusen of the HSM_AES_S_SYSCONFIG register is set, three other options are available:
If bit 10 (kek_mode) of the HSM_AES_S_SYSCONFIG register is set together with the directbusen bit, the direct key input bus is XOR-ed with a constant (constant1) and the AES direction of the operation is forced to encryption. The result of the operation is automatically stored in a separate key register: KEK. No output data is provided in this case; reading from the data output register returns zeroes.
If bit 11 (key_enc) of the HSM_AES_S_SYSCONFIG register is set, the KEK(from previous operation) key is XOR-ed with a new constant (constant2). The result is used as the key for the selected cryptographic operation.
Two cases must be distinguished:
If bit 12 (K3) of the HSM_AES_S_SYSCONFIG register is set, the K3 key is used as key for the selected cryptographic operation. The encrypted result is provided in the data output register, as it is a normal operation.
For all these three options, a key size of 128-bit must be selected in the AES_CTRL register.