UM10503
All information provided in this document is subject to legal disclaimers.
© NXP B.V. 2012. All rights reserved.
User manual
Rev. 1.3 — 6 July 2012
46 of 1269
6.1 How to read this chapter
AES encryption and decryption are supported for parts LPC43Sxx only.
6.2 Features
•
Decryption of external image data.
•
Encryption of image data.
•
Secure storage of decryption keys.
•
Support for CMAC hash calculation to authenticate data.
•
Support for one secret hardware key that cannot be read.
•
AES engine performance of 1 byte/clock cycle.
•
AES engine supports:
–
ECB decode mode with 128-bit key.
–
CBC decode mode with 128-bit key.
–
CMAC hash calculation (see
Details of the AES decryption pertaining to the boot process are described in
6.3 General description
The LPC43Sxx uses an external image to store instruction code and data. The LPC43Sxx
offers hardware to protect the external image content and to accelerate processing for
data decryption, data integrity, and proof of origin.
The hardware consists of:
•
One-time programmable (OTP) non-volatile memories to store the AES key. Two
instances (OTP1/2) are offered to store two keys using the OTP API (
•
An AES engine to perform the AES decryption. This engine supports an external
GPDMA module to read and write data. The engine uses a 128-bit key and processes
blocks of 128 bit. Using the AES API, the keys can be stored in a dedicated hardware
interface that is not visible to software.
•
The AES engine can perform encryption. Encryption is selected through the
AES_SetMode command. The command returns an error if the parts are not
configured for encryption.
The AES engine can be loaded with four different keys:
1. Key1 - stored in the OTP
2. Key2 - stored in the OTP
3. A randomly generated key
4. A software defined key
UM10503
Chapter 6: LPC43xx Security API
Rev. 1.3 — 6 July 2012
User manual