topic Re: Perform AES-GCM encryption and decryption of plaintext using the CAAM hardware on the LS1028A bo in Other NXP Products

Perform AES-GCM encryption and decryption of plaintext using the CAAM hardware on the LS1028A board

Sweet — Mon, 21 Jul 2025 14:06:35 GMT

I am developing a Security Engine (CAAM) driver for a Layerscape board. I’m currently looking for guidance or source code references for the following operation:

I want to create a black key and use it for AES-GCM encryption/decryption of plaintext.

I am already able to generate a black key successfully using AES-CCM. However, I need to encrypt and decrypt the plaintext using the AES-GCM algorithm, and I'm unable to find any example code or clear steps to build the required job descriptor.

While the Linux kernel source includes code to construct shared descriptors, I need to create a non-shared (simple) descriptor for this operation.

Additionally, could someone please explain how the black key is properly used to encrypt and decrypt data using AES-GCM? Specifically:

- How to load the black key and key modifier in the descriptor.

- How the CAAM uses this key internally for GCM encryption/decryption.

Any reference links or working examples would be greatly appreciated.

Re: Perform AES-GCM encryption and decryption of plaintext using the CAAM hardware on the LS1028A bo

Oswalag — Tue, 22 Jul 2025 14:21:39 GMT

Hello,

You can find a reference of how to generate a black key.

GitHub - nxp-imx/keyctl_caam: Keyctl CAAM Security

DPDK default supports AES_GCM in dpaa sec driver. You can refer to DPDK source code on descriptor building in DPAA_SEC_AEAD case.
DPDK/drivers/crypto/dpaa_sec/dpaa_sec.c

You can also find more information in the LS1028ASECRM

Re: Perform AES-GCM encryption and decryption of plaintext using the CAAM hardware on the LS1028A bo

Sweet — Thu, 31 Jul 2025 05:12:48 GMT

Thanks, @Oswalag

I found a good reference for the black key at https://gitlab.navisincontrol.com/varigit/linux-imx/-/blob/lf-5.15.y_var01/drivers/crypto/caam/caamkeyblob.c , and for AES-GCM at https://github.com/nxp-mcuxpresso/mcux-sdk/blob/main/drivers/caam/fsl_caam.c