951
SAM4CP [DATASHEET]
43051E–ATPL–08/14
6.
Fill the IDATA field of AES_IDATARx with the current fragment of the message to process (aligned on 16 byte
boundary) according to the SMOD configuration used. If Manual Mode or Auto Mode is used, the DATRDY bit indi-
cates when the data have been processed (however, no output data are generated when processing AAD).
Make sure the last output data have been read if the fragment ends in C phase (or wait for DATRDY if the fragment
ends in AAD phase), then read the GHASH field of AES_GHASHRx to obtain the value of the hash after the last
processed data and finally read the CTR field of the AES_CTR to obtain the value of the CTR encryption counter
(not needed when the fragment ends in AAD phase).
7.
Note:
Step 1 and 2 are required only if the value of the concerned registers has been modified.
Once the last fragment has been processed, the GHASH value will allow manual generation of the GCM tag, see
Section
41.4.5.3.4
for details.
41.4.5.3.4 Manual GCM Tag Generation
This section describes the last steps of the GCM Tag generation.
The Manual GCM Tag Generation is used to complete the GCM Tag Generation when the message has been processed
without Tag Generation.
Note:
The Message Processing without Tag Generation must be finished before processing the Manual
GCM Tag
Generation.
To generate a GCM Tag manually, perform the following steps:
Processing
S
= GHASH
H
(
ADD
|| 0
v
||
C
|| 0
u
|| [len(
ADD
)]
64
|| [len(
C
)]
64
):
1.
2.
In AES_MR set OPMOD to GCM and GTAGEN to ‘0’ (configuration as usual for the rest).
Set KEYW in AES_KEYWRx and wait for DATRDY bit of AES_ISR to be set (GCM hash subkey generation com-
plete), use interrupt if needed.
After the GCM hash subkey
generation is complete the GCM hash subkey can be
read or overwritten with
specific value in the AES_GCMHRx (
see Section
Section 41.4.5.2 ”Key Writing and Auto-
matic Hash Subkey Calculation”
for details).
Set AADLEN field to 0x10 (16 bytes) in AES_AADLENR and CLEN field to ‘0’ in AES_CLENR. This will allow
running a single GHASH
H
on a 16-byte input data (see
Figure 41-6
).
Fill the GHASH field of AES_GHASHRx with the state of the GHASH field stored at the end of the message
processing.
Fill the IDATA field of AES_IDATARx according to the SMOD configuration used with ‘len(ADD)
64
|| len(C)
64
’ value
as described in the NIST documentation and wait for DATRDY to be set, use interrupt if needed.
Read the GHASH field of AES_GHASHRx to obtain the current value of the hash.
3.
4.
5.
6.
Processing T = GCTR
K
(J
0
, S):
7.
8.
9.
In AES_MR set OPMOD to CTR (configuration as usual for the rest).
Set the IV field in AES_IVRx with ‘J
0
’ value.
Fill the IDATA field of AES_IDATARx with the GHASH value read at step 6 and wait for DATRDY to be set (use
interrupt if needed).
10. Read the ODATA field of AES_ODATARx to obtain the GCM TAG value.
Note:
Step 4 is optional if the GHASH field is to be filled with value ‘0’ (0 length packet for instance).