CRYPTO - Cryptography Accelerator
Description
Cryptography accelerator peripheral API.
For cryptographic support, users should consider the crypto APIs of the mbedTLS library provided by Silicon Labs instead of the interface provided in em_crypto.h. The mbedTLS library provides a much richer crypto API, including hardware acceleration of several functions.
The main purpose of em_crypto.h is to implement a thin software interface for the CRYPTO hardware functions especially for the accelerated APIs of the mbedTLS library. Additionally em_crypto.h implement the AES API of the em_aes.h (supported by classic EFM32) for backwards compatibility. The following list summarizes the em_crypto.h inteface:
- AES (Advanced Encryption Standard) AES
- SHA (Secure Hash Algorithm) SHA
- Big Integer multiplier CRYPTO_Mul
- Functions for loading data and executing instruction sequences Load and Execute Instruction Sequences
AES
The AES APIs include support for AES-128 and AES-256 with block cipher modes:
- CBC - Cipher Block Chaining mode
- CFB - Cipher Feedback mode
- CTR - Counter mode
- ECB - Electronic Code Book mode
- OFB - Output Feedback mode
For the AES APIs input/output data (plaintext, ciphertext, key, and so on) are treated as byte arrays, starting with most significant byte. In other words, 32 bytes of plaintext (B0...B31) is located in memory in the same order, with B0 at the lower address and B31 at the higher address.
Byte arrays must always be a multiple of AES block size, ie. a multiple of 16. Padding, if required, is done at the end of the byte array.
Byte arrays should be word (32 bit) aligned for performance considerations, since the array is accessed with 32 bit access type. The core MCUs supports unaligned accesses, but with a performance penalty.
It is possible to specify the same output buffer as input buffer as long as they point to the same address. In that case the provided input buffer is replaced with the encrypted/decrypted output. Notice that the buffers must be exactly overlapping. If partly overlapping, the behavior is undefined.
It is up to the user to use a cipher mode according to its requirements to avoid breaking security. See the specific cipher mode theory for details.
References:
- Wikipedia - Cipher modes, en.wikipedia.org/wiki/Cipher_modes
- Recommendation for Block Cipher Modes of Operation, NIST Special Publication 800-38A, 2001 Edition, csrc.nist.gov/publications/nistpubs/800-38a/sp800-38a.pdf
- Recommendation for Block Cipher Modes of Operation, csrc.nist.gov/publications/fips/fips180-4/fips-180-4.pdf
SHA
The SHA APIs include support for
- SHA-1 CRYPTO_SHA_1
- SHA-256 CRYPTO_SHA_256
The SHA-1 implementation is FIPS-180-1 compliant, ref:
- Wikipedia - SHA-1, en.wikipedia.org/wiki/SHA-1
- SHA-1 spec - www.itl.nist.gov/fipspubs/fip180-1.htm
The SHA-256 implementation is FIPS-180-2 compliant, ref:
- Wikipedia - SHA-2, en.wikipedia.org/wiki/SHA-2
- SHA-2 spec - csrc.nist.gov/publications/fips/fips180-2/fips180-2.pdf
CRYPTO_Mul
CRYPTO_Mul is a function for multiplying big integers that are bigger than the operand size of the MUL instruction, which is 128 bits. CRYPTO_Mul multiplies all partial operands of the input operands using MUL to form a resulting number which may be twice the size of the operands.
CRPYTO_Mul is typically used by RSA implementations, which perform a huge amount of multiplication and square operations to implement modular exponentiation. Some RSA implementations use a number representation including arrays of 32bit words of variable size. Compile with -D USE_VARIABLE_SIZED_DATA_LOADS in order to load these numbers directly into CRYPTO without converting the number representation.
Load and Execute Instruction Sequences
The functions for loading data and executing instruction sequences can be used to implement complex algorithms like elliptic curve cryptography (ECC)) and authenticated encryption algorithms. There are two typical modes of operation:
- Multi-sequence operation
- Single static instruction sequence operation
In multi-sequence mode the software starts by loading input data, an instruction sequence, execute, and finally read the result. This process is repeated until the full crypto operation is complete.
When using a single static instruction sequence, only one instruction sequence is loaded initially. The sequence can be set up to run multiple times. Data can be loaded during the execution of the sequence by using DMA, BUFC and/or programmed I/O directly from the MCU core. For details about how to program the instruction sequences, see the reference manual of the particular Silicon Labs device.
To load input data to the CRYPTO module, use any of the following functions:
- CRYPTO_DataWrite - Write 128 bits to a DATA register.
- CRYPTO_DDataWrite - Write 256 bits to a DDATA register.
- CRYPTO_QDataWrite - Write 512 bits to a QDATA register.
In order to read output data from the CRYPTO module use any of the following functions:
- CRYPTO_DataRead - Read 128 bi