Data Register (DATA). This allows retrieval of only the last data in several encryption/decryption
processes. No output data register reads are necessary between each block of encryption/decryption
process.
Note that assembling message depending on the security level identifier in CCM* has to be done in
software.
38.6.2.5. Computation of last Nk words of expanded key
The AES algorithm takes the cryptographic key provided by the user and performs a Key Expansion
routine to generate an expanded key. The expanded key contains a total of 4(Nr + 1) 32-bit words, where
the first Nk (4/6/8 for a 128-/192-/256-bit key) words are the user-provided key. For data encryption, the
expanded key is used in the forward direction, i.e., the first four words are used in the initial round of data
processing, the second four words in the first round, the third four words in the second round, and so on.
On the other hand, for data decryption, the expanded key is used in the reverse direction, i.e.,the last four
words are used in the initial round of data processing, the last second four words in the first round, the
last third four words in the second round, and so on.
To reduce gate count, the AES module does not generate and store the entire expanded key prior to data
processing. Instead, it computes on-the-fly the round key (four 32-bit words) required for the current
round of data processing. In general, the round key for the current round of data processing can be
computed from the Nk words of the expanded key generated in the previous rounds. When AES module
is operating in the encryption mode, the round key for the initial round of data processing is simply the
user-provided key written to the KEY registers. On the other hand, when AES module is operating in the
decryption mode, the round key for the initial round of data processing is the last four words of the
expanded key, which is not available unless AES module has performed at least one encryption process
prior to operating in the decryption mode.
In general, the last Nk words of the expanded key must be available before decryption can start. If
desired, AES module can be instructed to compute the last Nk words of the expanded key in advance by
writing a one to the Key Generate (KEYGEN) bit in the CTRLA register (CTRLA.KEYGEN). The
computation takes Nr clock cycles. Alternatively, the last Nk words of the expanded key can be
automatically computed by AES module when a decryption process is initiated if they have not been
computed in advance or have become invalid. Note that this will introduce a latency of Nr clock cycles to
the first decryption process.
38.6.2.6. Hardware Countermeasures against Differential Power Analysis Attacks
The AES module features four types of hardware countermeasures that are useful for protecting data
against differential power analysis attacks:
•
Type 1: Randomly add one cycle to data processing
•
Type 2: Randomly add one cycle to data processing (other version)
•
Type 3: Add a random number of clock cycles to data processing, subject to a maximum of
11/13/15 clock cycles for key sizes of 128/192/256 bits
•
Type 4: Add random spurious power consumption during data processing
By default, all countermeasures are enabled. One or more of the countermeasures can be disabled by
programming the Countermeasure Type field in the Control A (CTRLA.CTYPE) register. The
countermeasures use random numbers generated by a deterministic random number generator
embedded in AES module. The seed for the random number generator is written to the RANDSEED
register. Note also that a new seed must be written after a change in the keysize. Note that enabling
countermeasures reduces AES module’s throughput. In short, the throughput is highest with all the
countermeasures disabled. On the other hand, with all of the countermeasures enabled, the best
protection is achieved but the throughput is worst.
Atmel SAM L22G / L22J / L22N [DATASHEET]
Atmel-42402E-SAM L22G / L22J / L22N_Datasheet_Complete-07/2016
894
