![Texas Instruments CC2533 User Manual Download Page 155](http://html.mh-extra.com/html/texas-instruments/cc2533/cc2533_user-manual_1094592155.webp)
CCM Mode
CBC-MAC decryption is similar to encryption. The message MAC uploaded must be compared with the
MAC to be verified.
15.7 CCM Mode
To encrypt a message in CCM mode, the following sequence can be conducted (key is already loaded):
Message Authentication Phase
This phase takes place during the following steps 1
–
6.
1. The software loads the IV with zeros.
2. The software creates block B0. The layout of block B0 is shown in
Name
Designation
B0
First Block for Authentication in CCM Mode
Byte
0
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
Name
Flag
Nonce
L_M
Figure 15-1. Message Authentication Phase Block B0
There is no restriction on the nonce value. L_M is the message length in bytes.
For 802.15.4, nonce is 13 bytes and L_M is 2 bytes.
The content of the authentication flag byte is described in
.
L is set to 6 in this example. So, L
–
1 is set to 5. M and A_Data can be set to any value.
Name
Designation
FLAG/B0
Authentication Flag Field for CCM mode
Bit
7
6
5
4
3
2
1
0
Name
Reserved
A_Data
(M
–
2)/2
L
–
1
Value
0
x
x
x
x
1
0
1
Figure 15-2. Authentication Flag Byte
3. If some additional authentication data (denoted a, following) is needed (that is, A_Data = 1), the
software creates the A_Data length field, called L(a) by:
•
(a) If l(a) = 0, (that is, A_Data = 0), then L(a) is the empty string. Note that l(a) is the length of a in
octets.
•
(b) If 0
<
l(a)
<
2
16
–
2
8
, then L(a) is the 2-octet encoding of l(a).
The additional authentication data is appended to the A_Data length field L(a). The additional
authentication blocks are padded with zeros until the last additional authentication block is full. There is
no restriction on the length of a.
AUTH-DATA = L(a) + Authentication Data + (zero padding)
4. The last block of the message is padded with zeros until full (that is, if its length is not an integral
multiple of 128 bits).
5. The software concatenates block B0, the additional authentication blocks if any, and the message;
Input message = B0 + AUTH-DATA + M (zero padding of message)
6. Once the input message authentication by CBC-MAC is finished, the software leaves the uploaded
buffer contents unchanged (M = 16), or keeps only the higher-M bytes of the buffer unchanged, while
setting the lower bits to 0 (M != 16).
The result is called T.
Message Encryption
7. The software creates the key stream block A0. Note that L = 6, with the current example of the CTR
generation. The content is shown in
.
Note that when encrypting authentication data T to generate U in OFB mode, the CTR value must be
zero. When encrypting message blocks using CTR mode, the CTR value must be any value but zero.
The content of the encryption-flag byte is described in
155
SWRU191C
–
April 2009
–
Revised January 2012
AES Coprocessor
Copyright
©
2009
–
2012, Texas Instruments Incorporated