topic Re: K82F LTC AES masking in Kinetis Microcontrollers

K82F LTC AES masking

NewDwarf — Fri, 03 Apr 2026 20:04:13 GMT

Hello.

Is K82F's DPA countermeasure active just after Power-On Reset?

In other words, does DPA countermeasure work without explicit calling of LTC_SetDpaMaskSeed(LTC0, maskSeed)?

I am talking in context of LTC AES-128 encryption.

Re: K82F LTC AES masking

Celeste_Liu — Tue, 07 Apr 2026 04:39:04 GMT

Hello @NewDwarf ,

Thanks for your post. Yes, the LTC DPA countermeasure of the K82F is active immediately after power-on reset. For LTC DPA Mask Seed (LTC0_DPAMS) register, it's an entropy. Even if application didn't initialize, the hardware countermeasure can generate random number for using by itself.

Hope it helps.

Celeste

------------------------------------------------------------------------------------------------------------------------
Note: If this post answers your question, please click the "ACCEPT AS SOLUTION" button. Thank you!
------------------------------------------------------------------------------------------------------------------------

Re: K82F LTC AES masking

NewDwarf — Tue, 07 Apr 2026 07:32:00 GMT

@Celeste_Liu Thanks. If I say I am able to recover the AES keys from the LTC engine, is it known fact or is it something unknown to NXP?

Re: K82F LTC AES masking

Celeste_Liu — Wed, 08 Apr 2026 08:45:31 GMT

Hello @NewDwarf ,

The K82F LTC engine does not provide a non‑transparent mode. AES masking is intended to mitigate information leakage during algorithm execution involving cryptographic keys, thereby defending against non‑invasive DPA attacks targeting key recovery.
However, protection against key recovery typically requires more comprehensive system‑level security design considerations. The LTC AES masking technique operates only at the algorithmic level and does not fully address all use cases, especially as attack methodologies continue to evolve. Moreover, it cannot replace security mechanisms implemented at the overall system design level.

Celeste

Re: K82F LTC AES masking

NewDwarf — Wed, 08 Apr 2026 10:24:55 GMT

@Celeste_Liu Hello

The interesting thing I was able to recover AES keys by using the first-order attack. Two different leakage models gave me correctly recovered AES key on the LTC engine.

Usually, if masking countermeasure is applied, the first-order attack won't work and an attack should be the second and higher order.

Re: K82F LTC AES masking

Celeste_Liu — Thu, 09 Apr 2026 03:41:17 GMT

Hello @NewDwarf ,

I need to check with the internal team for your question. Could you please provide the following information per our policy: company name, end application, and annual volume?

As this issue involves security, could you also help confirm whether an NDA has already been signed? And we recommend creating a private ticket to contact us for further support.

Case Creation Wizard

Celeste

Re: K82F LTC AES masking

NewDwarf — Thu, 09 Apr 2026 05:03:37 GMT

Hello @Celeste_Liu

I am just an independent user/researcher for this specific topic.

Re: K82F LTC AES masking

NewDwarf — Tue, 14 Apr 2026 19:08:01 GMT

@Celeste_Liu

...and I cannot use the Case Creation Wizard as it doesn't allow private email to submit the findings.

Re: K82F LTC AES masking

Celeste_Liu — Wed, 15 Apr 2026 01:49:19 GMT

Hello @NewDwarf ,

Sorry, this was my oversight. Cases cannot be submitted using a personal email address. You can continue to share your findings in the Community.