CAAM: ICV error when loading back a black key

[throwException]

We are trying to use the CAAM on i.MX 8M Mini with black keys.

First we create a black key by running the following job descriptor.

b081000d

12820004

00000020

82500010

a2000001

14810004

00000020

a2000001

10880004

e000006d

64140020

43b17000

a1001001

This job descriptor first generates 32 bytes of random data, then loads it into a key register and then uses the FIFO store to export the black key in AES-256-CCM. As far as we can tell, this works as expected.

Then we want to encapsulate the black key into a blob using the following job descriptor:

b0810008

f000002c

43b17000

f8000060

43b42000

870d0104

a2000001

a1001001

The job descriptor uses the protocol operation command with the blob protocol to encapsulate, but it returns the status code

2000051a

Which according to the security reference manual designates an ICV error.

We cannot find any reason for this ICV error as we are using the freshly generated black key and loading it with the same parameters as it was exported (AES-256-CCM with JDKEK).

Can anyone find our mistake?

[throwException · Accepted solution]

For the record: The problem was the input length stated in the SEQ IN PTR command. This needs to be the length of the key (32 bytes) instead of the length of the black key data (32 + 12 bytes).