
NUC970 Technical Reference Manual
Publication Release Date: Dec. 15, 2015
- 935 -
Revision V1.30
NUC97
0
T
E
CHNIC
A
L
RE
F
E
RE
N
CE
MA
NUA
L
5.27.5 Functional description
The cryptographic accelerator includes a secure pseudo random number generator (PRNG) core and
supports AES, DES/TDES, SHA, and HMAC algorithms. The accelerator can be used in different data
security applications, such as secure communications that need cryptographic protection and integrity.
1. The PRNG core supports 64 bits, 128 bits, 192 bits, and 256 bits random number generation
configured by KEYSZ.
2. The AES accelerator is a fully compliant implementation of the AES (Advance Encryption
Standard) encryption and decryption algorithm. The AES accelerator supports ECB, CBC, CFB,
OFB, CTR, CBC-CS1, CBC-CS2, and CBC-CS3 mode. The AES accelerator provides the DMA
function to reduce the CPU intervention, and supports three burst lengths, sixteen-words, eight-
words, and four-words.
3. The DES/TDES accelerator is a fully compliant implementation of the DES and Triple DES
encryption/decryption algorithm. The DES/TDES accelerator supports ECB, CBC, CFB, OFB, and
CTR mode. The DES/TDES accelerator also supports the DMA function to reduce the CPU
intervention. Only two burst lengths, four words and eight words, are supported.
4. The SHA/HMAC accelerator is a fully compliant implementation of the SHA-160, SHA-224, SHA-
256, SHA-384, SHA-512, and corresponding HMAC algorithm. The SHA/HMAC accelerator also
supports the DMA function to reduce the CPU intervention. It supports three burst lengths,
sixteen-words, eight-words, and four-words.
Software can control the data flow by enabling the CRPT_INTEN, and monitor the accelerator status
by checking the CRPT_INTSTS.
The cryptographic accelerator supports the following features to enhance the performance.
1.
DMA mode:
Once DMA source address register, destination address register, and byte count
register
are configurated by CPU, moving
data from and to accelerator is done by DMA logic
totally. This mode can off-load the loading from the CPU.
The cryptographic
accelerator
embeds
four hardware DMA channels for AES engine, four hardware DMA channels for DES/TDES
engine, and one hardware DMA channel for SHA/HMAC engine.
2.
DMA Cascade mode:
In the case that the data SRAM resource is tight, or another peripheral is
scheduled to switch, the data source or sink needs an update, while the setting for the accelerator
operation is planned to be kept. In this mode, software can update DMA source address register,
destination address register, and byte count register during a cascade operation, without finishing
the accelerator operation.
3.
Non-DMA mode:
In the case that the input data is small in size, DMA mode is not preferred. This
mode can reduce the processing time for the accelerator, since no DMA related register needs a
configuration, and no latency in DMA logic is introduced. Input data was feeding to cryptographic
engine via writing to data input register.
4.
Channel Expansion mode:
In this mode, several virtual channels in one of four DMA channels
are feasible in AES or DES/TDES mode. The total channel number can exceed the limit of four
DMA channels. The intermediate data from feedback registers (CRPT_AES_FDBCKx,
CRPT_TDES_FDBCKH, and CRPT_TDES_FDBCKL) should be stored temporarily in data SRAM.
And switch to another configuration setting of accelerator operation that includes operational
mode, encryption/decryption, key, key size, IV, and other parameters. Once switching back, the
intermediate data from feedback registers should be written to initial vectors (CRPT_AESn_IVx,
CRPY_TDESx_IVH, and CRPT_TDESx_IVL) for the accelerator to continue the operation with
the original configuration setting. Note that, in ECB mode, there is no need to move the
intermediate data from feedback registers to IV.