Perform AES-GCM encryption and decryption of plaintext using the CAAM hardware on the LS1028A board

[Sweet]

I am developing a Security Engine (CAAM) driver for a Layerscape board. I’m currently looking for guidance or source code references for the following operation:

I want to create a black key and use it for AES-GCM encryption/decryption of plaintext.

I am already able to generate a black key successfully using AES-CCM. However, I need to encrypt and decrypt the plaintext using the AES-GCM algorithm, and I'm unable to find any example code or clear steps to build the required job descriptor.

While the Linux kernel source includes code to construct shared descriptors, I need to create a non-shared (simple) descriptor for this operation.

Additionally, could someone please explain how the black key is properly used to encrypt and decrypt data using AES-GCM? Specifically:

- How to load the black key and key modifier in the descriptor.

- How the CAAM uses this key internally for GCM encryption/decryption.

Any reference links or working examples would be greatly appreciated.

[Oswalag]

Hello,

You can find a reference of how to generate a black key.

GitHub - nxp-imx/keyctl_caam: Keyctl CAAM Security

DPDK default supports AES_GCM in dpaa sec driver. You can refer to DPDK source code on descriptor building in DPAA_SEC_AEAD case.
DPDK/drivers/crypto/dpaa_sec/dpaa_sec.c

You can also find more information in the LS1028ASECRM

[Sweet · Accepted solution]

Thanks, @Oswalag 

I found a good reference for the black key at https://gitlab.navisincontrol.com/varigit/linux-imx/-/blob/lf-5.15.y_var01/drivers/crypto/caam/caamk... , and for AES-GCM at https://github.com/nxp-mcuxpresso/mcux-sdk/blob/main/drivers/caam/fsl_caam.c