topic Re: LPC55S69 AES masking countermeasure against SCA in LPC Microcontrollers

LPC55S69 AES masking countermeasure against SCA

NewDwarf — Thu, 26 Mar 2026 05:30:45 GMT

Hello.

Whether I correctly understand that below approach should protect the reference AES-128 key against the side channel attack due to usage of the mask? I use a bit outdated API but it doesn't matter, I get the correct results.

uint32_t coreClockHz = CLOCK_GetFreq(kCLOCK_CoreSysClk); status_t result = PUF_Init(PUF, PUF_DISCHARGE_TIME_MS, coreClockHz); if (result != kStatus_Success) return result; result = PUF_Start(PUF, ac_buffer, ac_size); if (result != kStatus_Success) { PUF_Deinit(PUF, PUF_DISCHARGE_TIME_MS, coreClockHz); } __attribute__((aligned(4))) uint8_t user_key[16] = {0x2b, 0x7e, 0x15, 0x16, 0x28, 0xae, 0xd2, 0xa6, 0xab, 0xf7, 0x15, 0x88, 0x09, 0xcf, 0x4f, 0x3c}; __attribute__((aligned(4))) uint8_t keyCode[52] = {0x00}; result = PUF_SetUserKey(PUF, kPUF_KeyIndex_00, user_key, sizeof(user_key), keyCode, sizeof(keyCode)); if (result != kStatus_Success) { PUF_Deinit(PUF, PUF_DISCHARGE_TIME_MS, coreClockHz); } hashcrypt_handle_t hch; hch.keySize = kHASHCRYPT_Aes128; hch.keyType = kHASHCRYPT_SecretKey; result = PUF_GetHwKey(PUF, keyCode, 52, kPUF_KeySlot0, 0x01000001); if (result != kStatus_Success) { PUF_Deinit(PUF, PUF_DISCHARGE_TIME_MS, coreClockHz); } uint8_t pt[16] = {0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0}; uint8_t ct[16] = {0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0}; result = HASHCRYPT_AES_EncryptEcb(HASHCRYPT, &hch, pt, ct, 16);

At least key bytes at positions 0, 3, 4, 7... should be protected?

Re: LPC55S69 AES masking countermeasure against SCA

NewDwarf — Thu, 26 Mar 2026 16:59:57 GMT

I am asking this question as I am able to recover the AES-128/AES-256 keys pushed from the PUF to the AES key register by the PUF_GetHwKey() API using the non-zero mask parameter. All key bytes are correctly recovered. Also I validated that plaintext/ciphertext is correct for the recovered AES key.

The question is whether I am doing something wrong with setting the mask or the mask doesn't properly work.

Re: LPC55S69 AES masking countermeasure against SCA

Harry_Zhang — Fri, 27 Mar 2026 10:18:16 GMT

Hi @NewDwarf

We can check the AN12324

LPC55Sxx Usage of the Physically Unclonable Function and Hash

• The PUF offers other features to prevent attacks. For example, by blocking functionalities (enroll, code output,
keylock) or by offering enhanced side-channel protection (by using a keymask)

This refers only to the internal cryptographic operations during key reconstruction.

The mask parameter in PUF_GetHwKey() does not protect individual AES key bytes from being observable once they are loaded into the HASHCRYPT AES key registers.

Harry

Re: LPC55S69 AES masking countermeasure against SCA

NewDwarf — Tue, 31 Mar 2026 09:03:55 GMT

@Harry_Zhang Thanks!

The mask parameter in PUF_GetHwKey() does not protect individual AES key bytes from being observable once they are loaded into the HASHCRYPT AES key registers.

Let me clarify one more question. What is the purpose of the "keyMask" parameter of

status_t PUF_GetHwKey(PUF_Type *base, const uint8_t *keyCode, size_t keyCodeSize, puf_key_slot_t keySlot, uint32_t keyMask);

Re: LPC55S69 AES masking countermeasure against SCA

NewDwarf — Wed, 01 Apr 2026 16:49:41 GMT

@Harry_Zhang The problem is I am able to recover the key from the key code. Or is it expected behaviour, security level?

Re: LPC55S69 AES masking countermeasure against SCA

Harry_Zhang — Thu, 02 Apr 2026 03:55:20 GMT

Hi @NewDwarf

The keyMask parameter is used only inside the PUF hardware to add some randomness during the key‑reconstruction process.
Its purpose is to make the internal PUF operations slightly harder to analyze with side‑channel attacks.
It does NOT mask or modify the final AES key, and it does NOT protect the HASHCRYPT AES engine.
So the mask helps only during PUF key unwrapping, not during AES encryption.

You can view the definition of the PUF_GetHwKey function.

Harry

Re: LPC55S69 AES masking countermeasure against SCA

Harry_Zhang — Thu, 02 Apr 2026 04:12:07 GMT

Hi @NewDwarf

Yes, this is expected behavior.
The diagram shows that the PUF only protects key storage and then sends the reconstructed plaintext key directly to the AES engine.
The AES engine is not side‑channel protected, so its power/EM behavior can still leak the real key during encryption.

Harry