CRYPTO - Cryptography Accelerator

Description

Cryptography accelerator peripheral API.

For cryptographic support, users should consider the crypto APIs of the mbedTLS library provided by Silicon Labs instead of the interface provided in em_crypto.h. The mbedTLS library provides a much richer crypto API, including hardware acceleration of several functions.

The main purpose of em_crypto.h is to implement a thin software interface for the CRYPTO hardware functions especially for the accelerated APIs of the mbedTLS library. Additionally em_crypto.h implement the AES API of the em_aes.h (supported by classic EFM32) for backwards compatibility. The following list summarizes the em_crypto.h inteface:


AES

The AES APIs include support for AES-128 and AES-256 with block cipher modes:

  • CBC - Cipher Block Chaining mode
  • CFB - Cipher Feedback mode
  • CTR - Counter mode
  • ECB - Electronic Code Book mode
  • OFB - Output Feedback mode

For the AES APIs input/output data (plaintext, ciphertext, key, and so on) are treated as byte arrays, starting with most significant byte. In other words, 32 bytes of plaintext (B0...B31) is located in memory in the same order, with B0 at the lower address and B31 at the higher address.

Byte arrays must always be a multiple of AES block size, ie. a multiple of 16. Padding, if required, is done at the end of the byte array.

Byte arrays should be word (32 bit) aligned for performance considerations, since the array is accessed with 32 bit access type. The core MCUs supports unaligned accesses, but with a performance penalty.

It is possible to specify the same output buffer as input buffer as long as they point to the same address. In that case the provided input buffer is replaced with the encrypted/decrypted output. Notice that the buffers must be exactly overlapping. If partly overlapping, the behavior is undefined.

It is up to the user to use a cipher mode according to its requirements to avoid breaking security. See the specific cipher mode theory for details.

References:

  • Wikipedia - Cipher modes, en.wikipedia.org/wiki/Cipher_modes
  • Recommendation for Block Cipher Modes of Operation, NIST Special Publication 800-38A, 2001 Edition, csrc.nist.gov/publications/nistpubs/800-38a/sp800-38a.pdf
  • Recommendation for Block Cipher Modes of Operation, csrc.nist.gov/publications/fips/fips180-4/fips-180-4.pdf


SHA

The SHA APIs include support for

The SHA-1 implementation is FIPS-180-1 compliant, ref:

  • Wikipedia - SHA-1, en.wikipedia.org/wiki/SHA-1
  • SHA-1 spec - www.itl.nist.gov/fipspubs/fip180-1.htm

The SHA-256 implementation is FIPS-180-2 compliant, ref:

  • Wikipedia - SHA-2, en.wikipedia.org/wiki/SHA-2
  • SHA-2 spec - csrc.nist.gov/publications/fips/fips180-2/fips180-2.pdf


CRYPTO_Mul

CRYPTO_Mul is a function for multiplying big integers that are bigger than the operand size of the MUL instruction, which is 128 bits. CRYPTO_Mul multiplies all partial operands of the input operands using MUL to form a resulting number which may be twice the size of the operands.

CRPYTO_Mul is typically used by RSA implementations, which perform a huge amount of multiplication and square operations to implement modular exponentiation. Some RSA implementations use a number representation including arrays of 32bit words of variable size. Compile with -D USE_VARIABLE_SIZED_DATA_LOADS in order to load these numbers directly into CRYPTO without converting the number representation.


Load and Execute Instruction Sequences

The functions for loading data and executing instruction sequences can be used to implement complex algorithms like elliptic curve cryptography (ECC)) and authenticated encryption algorithms. There are two typical modes of operation:

  • Multi-sequence operation
  • Single static instruction sequence operation

In multi-sequence mode the software starts by loading input data, an instruction sequence, execute, and finally read the result. This process is repeated until the full crypto operation is complete.

When using a single static instruction sequence, only one instruction sequence is loaded initially. The sequence can be set up to run multiple times. Data can be loaded during the execution of the sequence by using DMA, BUFC and/or programmed I/O directly from the MCU core. For details about how to program the instruction sequences, see the reference manual of the particular Silicon Labs device.

To load input data to the CRYPTO module, use any of the following functions:

In order to read output data from the CRYPTO module use any of the following functions: