131
8111C–MCU Wireless–09/09
AT86RF231
When decrypting, due to the nature of AES algorithm, the initial key to be used is not the same
as the one used for encryption, but rather the last round key instead. This last round key is the
content of the key address space stored after running one full encryption cycle, and must be
saved for decryption. If the decryption key has not been saved, it has to be recomputed by first
running a dummy encryption (of an arbitrary plaintext) using the original encryption key, then
fetching the resulting round key from the key memory, and writing it back into the key memory as
the decryption key.
ECB decryption is not used by either IEEE 802.15.4 or ZigBee frame security. Both of these
standards do not directly encrypt the payload, but rather a nonce instead, and protect the pay-
load by applying an XOR operation between the resulting (AES-) cipher text and the original
payload. As the nonce is the same for encryption and decryption only ECB encryption is
required. Decryption is performed by XORing the received cipher text with its own encryption
result respectively, which results in the original plaintext payload upon success.
11.1.4.2
Cipher Block Chaining (CBC)
In CBC mode, the result of a previous AES operation is XORed with the new incoming vector,
computation of a cryptographic checksum (message integrity code, MIC).
Figure 11-4. CBC Mode - Encryption
After preparing the AES key, and defining the AES operation direction using SRAM register bit
AES_DIR, the data has to be provided to the AES engine and the CBC operation can be started.
The first CBC run has to be configured as ECB to process the initial data (plaintext XORed with
an initialization vector provided by the microcontroller). All succeeding AES runs are to be con-
figured as CBC by setting register bits AES_MODE = 0x2 (register 0x83, AES_CTRL). Register
bit AES_DIR (register 0x83, AES_CTRL) must be set to AES_DIR = 0 to enable AES encryption.
The data to be processed has to be transferred to the SRAM starting with address 0x84 to 0x93
(register AES_STA T E). Setting register bit AES_REQUEST = 1 (register 0x94,
starts the first encryption within one SRAM access. This causes the next 128 bits of plaintext
According to IEEE 802.15.4 the input for the very first CBC operation has to be prepared by a
XORing a plaintext with an initialization vector (IV). The value of the initialization vector is 0.
However, for non-compliant usage any other initialization vector can be used. This operation has
to be prepared by the microcontroller.
Block Cipher
Encryption
Key
Ciphertext
Block Cipher
Encryption
Plaintext
Ciphertext
Plaintext
Initialization Vector (IV)
Encryption
Key
ECB
mode
CBC
mode