949
SAM4CP [DATASHEET]
43051E–ATPL–08/14
41.4.5.3 GCM Processing
GCM processing comprises three phases:
1.
Processing the Additional Authenticated Data (AAD), hash computation only.
2.
Processing the ciphertext (C), hash computation + ciphering/deciphering.
3.
Generating the TAG using length of AAD, length of C and J
0
, (see NIST documentation for details).
The Tag generation can be done either automatically, after the end of AAD/C processing if TAG_EN bit is set in the
AES_MR or done manually, using the GHASH field in AES_GHASHRx (see
Section 41.4.5.3.1
and
Section 41.4.5.3.4
for details).
41.4.5.3.1 Processing a Complete Message with Tag Generation
Use this procedure only if J
0
four LSB bytes
≠
0xFFFFFFFF.
Note:
In the case where J
0
four LSB bytes = 0xFFFFFFFF or if the value is unknown, use the procedure described in
“Processing a Complete Message without Tag Generation”
followed by the procedure in
“Manual GCM Tag
Generation”
.
Figure 41-2.
Full Message Alignment
To process a complete message with Tag generation, perform the following steps:
1.
2.
In AES_MR set OPMOD to GCM and GTAGEN to ‘1’ (configuration as usual for the rest).
Set KEYW in AES_KEYWRx and wait until DATRDY bit of AES_ISR is set (GCM hash subkey generation com-
plete), use interrupt if needed. See Section
Section 41.4.5.2 ”Key Writing and Automatic Hash Subkey Calculation”
for details.
Calculate the J
0
value as described in NIST documentation
J
0
=
IV
|| 0
31
|| 1 when len(
IV
)=96 and
J
0
=GHASH
H
(
IV
|| 0
s
+64
|| [len(
IV
)]
64
) if len(
IV
)
≠
96. See
Section 41.4.5.3.5 ”Processing a Message with only AAD (GHASHH)”
for
J
0
generation.
Set IV in AES_IVRx registers with inc32 (J
0
) (J
0
+ 1 on 32 bits).
Set AADLEN field in AES_AADLENR and CLEN field in AES_CLENR.
Fill the IDATA field of AES_IDATARx with the message to process according to the SMOD configuration used. If
Manual Mode or Auto Mode is used, the DATRDY bit indicates when the data has been processed (however, no
output data are generated when processing AAD).
Wait for TAGRDY to be set (use interrupt if needed), then read the TAG field of AES_TAGRx to obtain the authen-
tication tag of the message.
3.
4.
5.
6.
7.
41.4.5.3.2 Processing a Complete Message without Tag Generation
Processing a message without generating the Tag can be used to customize the Tag generation, or to process a
fragmented message. To manually generate the GCM Tag see
Section 41.4.5.3.4
.
To process a complete message without Tag generation, perform the following steps:
1.
2.
In AES_MR set OPMOD to GCM and GTAGEN to ‘0’ (configuration as usual for the rest).
Set KEYW in AES_KEYWRx and wait until DATRDY bit of AES_ISR is set (GCM hash subkey generation com-
plete), use interrupt if needed.
After the GCM hash subkey
generation is complete the GCM hash subkey can be
read or overwritten with
specific value in the AES_GCMHRx
(see Section
Section 41.4.5.2 ”Key Writing and Auto-
matic Hash Subkey Calculation”
for details).
AAD
C (Text)
16-Byte Boundaries
Padding
Padding
AADLEN
CLEN