Secure AuthenticationのトピックSetting AES-GCM Authentication Tag Length to 12 Bytes for DLMS with SE050E2

Setting AES-GCM Authentication Tag Length to 12 Bytes for DLMS with SE050E2

Faizy98 — Mon, 11 Aug 2025 18:06:53 GMT

Hi,

I am currently using the SE050E2 secure element for AES-GCM encryption and decryption operations. The encryption and decryption APIs work well, specifically the following function:

sss_status_t sss_aead_one_go( sss_aead_t *context, const uint8_t *srcData, uint8_t *destData, size_t size, uint8_t *nonce, size_t nonceLen, const uint8_t *aad, size_t aadLen, uint8_t *tag, size_t *tagLen);

This API functions perfectly when the authentication tag length is 16 bytes. However, I am working with DLMS protocol payloads that require the authentication tag to be only 12 bytes in length.

When I use this API to encrypt DLMS plain data, it generates an authentication tag of 16 bytes, but the DLMS standard expects a 12-byte tag. Similarly, for decryption, when the encrypted DLMS payload arrives with a 12-byte authentication tag, passing this 12-byte tag to the API results in a decryption failure, because the API expects the tag to be 16 bytes.

My question is:

Is there any way to configure or set the authentication tag length in the SE050E2 or its middleware so it can use a 12-byte tag as required by the DLMS standard?

Currently, the API always returns a 16-byte tag after encryption, and requires a 16-byte tag for decryption. I want to ensure compatibility with DLMS devices that use 12-byte tags without causing decryption errors.

Any guidance on configuring AES-GCM tag length for SE050E2, or recommended approaches for handling this DLMS tag size mismatch, would be highly appreciated.

Thanks in advance!

BR,
Faizy

Re: Setting AES-GCM Authentication Tag Length to 12 Bytes for DLMS with SE050E2

Kan_Li — Thu, 14 Aug 2025 09:10:09 GMT

Hi @Faizy98 ,

This is defined when you create the key for AEAD operation. please kindly refer to the following for details.

Have a great day,
Kan

-------------------------------------------------------------------------------
Note:
- If this post answers your question, please click the "Mark Correct" button. Thank you!
- We are following threads for 7 weeks after the last post, later replies are ignored
Please open a new thread and refer to the closed one, if you have a related question at a later point in time.
-------------------------------------------------------------------------------

Re: Setting AES-GCM Authentication Tag Length to 12 Bytes for DLMS with SE050E2

Faizy98 — Thu, 14 Aug 2025 14:23:34 GMT

Thank you for your support.

BR,

Faizy