1088
6437E–ATARM–23-Apr-13
SAM9M11
45.3
Product Dependencies
45.3.1
Power Management
The TDES may be clocked through the Power Management Controller (PMC), so the program-
mer must first configure the PMC to enable the TDES clock.
45.3.2
Interrupt
The TDES interface has an interrupt line connected to the Advanced Interrupt Controller (AIC).
Handling the TDES interrupt requires programming the AIC before configuring the TDES.
45.4
Functional Description
The Data Encryption Standard (DES) and the Triple Data Encryption Algorithm (TDES) specify
FIPS-approved cryptographic algorithms that can be used to protect electronic data. The TDES
bit in the TDES Mode Register (TDES_MR) is used to select either the single DES or the Triple
DES mode.
Encryption (enciphering) converts data to an unintelligible form called ciphertext. Decrypting
(deciphering) the ciphertext converts the data back into its original form, called plaintext. The
CIPHER bit in the TDES Mode Register is used to choose between encryption and decryption.
A DES is capable of using cryptographic keys of 64 bits to encrypt and decrypt data in blocks of
64 bits. This 64-bit key is defined in the Key 1 Word Registers (TDES_KEY1WxR).
A TDES key consists of three DES keys, which is also referred to as a key bundle. These three
64-bit keys are defined, respectively, in the Key 1, 2 and 3 Word Registers (TDES_KEY1WxR,
TDES_KEY2WxR and TDES_KEY3WxR). In Triple DES mode (TDESMOD set to 1), the KEY-
MOD bit in the TDES Mode Register is used to choose between a two- and a three-key
algorithm:
– In three-key encryption mode, the data is first encrypted with Key 1, then decrypted
using Key 2 and then encrypted with Key 3.
– In three-key decryption mode, the data is decrypted with Key 3, then encrypted with
Key 2 and then decrypted using Key 1.
– In two-key encryption mode, the data is first encrypted with Key 1, then decrypted
using Key 2 and then encrypted with Key 1.
– In two-key decryption mode, the data is decrypted with Key 1, then encrypted with
Key 2 and then decrypted using Key 1.
The input to the encryption processes of the CBC, CFB, and OFB modes includes, in addition to
the plaintext, a 64-bit data block called the initialization vector (IV), which must be set in the Ini-
tialization Vector Registers (TDES_IVxR). The initialization vector is used in an initial step in the
encryption of a message and in the corresponding decryption of the message.
XTEA algorithm can be used instead of DES/TDES by configuring the TDESMOD field in the
TDES_MR register with the appropriate value 0x2. An XTEA key consists of a 128-bit key. They
are defined in the Key 1 and 2 Word Registers (TDES_KEY1WxR, TDES_KEY2WxR).
The number of rounds of XTEA is defined in the TDES_XTEA_RNDR register and can be pro-
grammed up to 64 (1 round = 2 feistel network rounds).
All the start and operating modes of the TDES algorithm can be applied to the XTEA algorithm.