24. SECURITY

24.1 Introduction

SP7021 supports AES / RSA / HASH algorithms in security block. The Security IP is used to speed up AES / RSA / HASH related operations and reduce CPU overhead. The Security IP features are useful in applications that require AES / RSA / HASH operation.

Encryption techniques are usually divided into "symmetric", "asymmetric" and a special "Hash" algorithm.
Symmetric encryption algorithm: Symmetric encryption uses the same key for encryption and decryption. Both parties to the information need to know the key and the encryption and decryption algorithm in advance and their keys are the same, and then the data is encrypted and decrypted. Symmetric encryption algorithms are used to encrypt information such as sensitive data.
Asymmetric encryption algorithm: Asymmetric encryption is not the same key used for encryption and decryption. There are usually two keys, called "public key" and "private key". They must be paired, otherwise they cannot be opened. Encrypt the file. Both sides A and B send a stack of keys in advance, then A sends its own public key to B, and B sends its own public key to A. If A wants to send a message to B, it needs to use B first. The public key encrypts the message and sends it to the B end. At this time, the B end decrypts the message with its own private key. The same is true when B sends a message to A.
Hash algorithm: Hash algorithm, also known as hash function, is a one-way encryption algorithm. In information security technology, it is often necessary to verify the integrity of a message. A hash function provides this service, which produces fixed-length output for input messages of different lengths. This fixed length output is called the "hash" or "message digest" of the original input message. The hash algorithm does not count as an encryption algorithm because the result is irreversible. Since it is irreversible, it is of course not used for encryption, but for signature.

The Security IP include below features.

AES (Advanced Encryption Standard):

• Support encryption and decryption.

• Support key length: 128bit, 192bit and 256bit.

• Support mode: ECB, CBC and CTR.

RSA: Issued by RSA company.

• Support modular exponentiation.

• Support data length: 256/512/1024/2048 bit.

HASH:

• Support MD5.

• Support GHASH.

• Support SHA3-224, SHA3-256, SHA3-384 and SHA3-512 modes.

The Security block control registers locate at RGST Table Group 84 and 85 which memory map in 0x9C002A00~0x9C002AFF.

24.2 Function Diagram

The function diagram of Security block is shown in Figure 24-1.

Figure 24-1 Security Functional Blocks

• REG_CTL: CPU can configure registers in this module through Register Bus to configure function in Security IP and deal with interrupt related issue.

• AES_ENDEC: AES encryption and decryption, including DMA, Descriptor, block algorithm and core algorithm.

• RSA_ENDEC: RSA includes DMA, RSA Complementation processing, modular exponentiation and modular multiplication algorithm.

• HASH: HASH module includes DMA, Descriptor, GHASH algorithm, MD5 algorithm and SHA3 algorithm.

• DMA: DMA Module is used to get or write back data for encryption/decryption according to the configuration info in register file.

• Auto DMA: Auto DMA Module is used to get or write back TRB (Transfer Request Block) data or according to the configuration info in register file. One TRB contain the configuration info in a DMA operation.

24.3 Data Structure

Defined two rings for each type of transfer: One command ring for SW to put schedule for controller, which is read only for controller. One event ring for HW to report the status of the transfers SW scheduled, SW should not modify this ring after it started.

• Command Ring

Figure 24-2 Command Ring Data Structure

• Event Ring

Figure 24-3 Event Ring Data Structure

• TRB Structure

Figure 24-4 TRB Structure

• Parameter for AES

Figure 24-5 AES Structure

• Parameter for HASH

Figure 24-6 HASH Structure

•  

  • Structure Parameters:

24.4 Ring Operation

• Ring Empty

          For command ring, the HW will implement an internal Current Cycle State(CCS). The ring is empty when CCS != TRB.C. The initial value of CCS is RCS in CRCR register. When ever a link TRB with TC bit set is read in, the CCS toggles. For event ring, this bit is always 0.

• Ring Full

          The event ring will be full if HW has and TRB to write and the next TRB address reaches the de-queue pointer. For command ring, the SW can read the CRCR register for the current TRB address which HW is process.

• Command Ring Size

          SW can change the command ring size to any value even when the ring is running. To do this just link the new TRB or TRB segment to the ring. The cycle bits of each TRB should be set to the ring value.

24.5 Security Block Interrupts

The security block interrupt events are connected to the same interrupt vector, please refer to figure 24-7. These events generate an interrupt if the corresponding "Enable Control Bit" is set.

Figure 24-7 Security Interrupt Tree

• AES_CRD interrupt is issued when AES Command Ring Empty and AES_CRD_IE is set to 1.

• HASH_CRD interrupt is issued when HASH Command Ring Empty and HASH_CRD_IE is set to 1.

• AES_TRB interrupt is issued when AES TRB done , AES_TRB_IE is set to 1 and IOC is set to 1.

• HASH_TRB interrupt is issued when HASH TRB done ,HASH_TRB_IE is set to 1 and IOC is set to 1.

• AES_ERF interrupt is issued when AES Event Ring Full and AES_ERF_IE is set to 1 .

• HASH_ERF interrupt is issued when HASH Event Ring Full and HASH_ERF_IE is set to 1.

• AES_DMA interrupt is issued when AES DMA finish and AES_DMA_IE is set to 1.

• HASH_DMA interrupt is issued when HASH DMA finish and HASH_DMA_IE is set to 1.

• RSA_DMA interrupt is issued when RSA DMA finish and RSA_DMA_IE is set to 1.

24.6 Registers Map

24.6.1 Registers Memory Map

24.6.2 Registers Description

RGST Table Group 84 Security DMA Control Registers

84.0 AES DMA Control Status register (AESDMACS)

Address: 0x9C002A
Reset: 0x0

84.1 AES Source Data pointer (AESSPTR)
Address: 0x9C002A04
Reset: 0x0