CAAM issue with AES CCM: tag verification fails

cancel
Showing results for 
Search instead for 
Did you mean: 

CAAM issue with AES CCM: tag verification fails

377 Views
mbriand
Contributor I

Hi,

I am currently trying to use the CAAM to encrypt/decrypt buffers with AES CCM algorithm. I can successfully encrypt and decrypt some buffers, but sometimes (about 1% of the samples), the TAG verification fails during decryption, despite the TAG being valid.

Here is an example of CAAM job I am using:

- AES key is 128 bits, all 0.

- Encrypted buffer is 4 bytes: 0x37, 0xee, 0xf4, 0xa3.

- Tag is 16 bytes: 0xa2, 0x18, 0x45, 0xe6, 0x93, 0x8b, 0x03, 0x0d, 0x67, 0xdc, 0xc6, 0xcc, 0xdc, 0xaa, 0x3e, 0x38.

- Corresponding decrypted buffer is: 0x0, 0x0, 0x0, 0x0.

b0800011 # Header   
02800010 # Load class 1 key (AES 128, all 0)
00000000
00000000
00000000
00000000
8210080e # Operation: AES CCM, decrypt and check tag
12200038 # Load context from 4e08d220
4e08d220
22530000 # Fifo load 4 bytes of data from 4e08f5c0
4e08f5c0
00000004
60700000 # Fifo store 4 bytes of data to 4e08f580
4e08f580
00000004
223b0010 # Fifo load tag from 4e08f54
4e08f54

If I run the same job several times, the test will fail once in a while. CAAM error is 20000f1a: CCB error with AES ICV check, command 15 (fifo load tag).

Between each iterations:

- The job is not modified (I always use the same job).

- Referenced memory areas are not modified (caches are flushed before the first iteration).

- Only one core of the CPU is used to ensure no other core is modifying memory or interacting with the CAAM.

Only some CCM parameters seem to trigger the issue:

- TAG length of 14 or 16 bytes.

- Data length up to 16 bytes.

I have never had any issue regarding other tag lengths or with longer data buffers. There isn't any issue with AES CCM encryption.

Is there something I am doing wrong here ? Is there any external cause that may trigger this issue ?

Labels (5)
Tags (3)
0 Kudos
2 Replies

187 Views
Yuri
NXP TechSupport
NXP TechSupport

Hello,

  please refer to section 5.7.5.10 (AESA CCM mode) of the i.MX6 Security Reference Manual for
some details regarding using this mode.

https://www.nxp.com/webapp/sps/download/mod_download.jsp?colCode=IMX6DQ6SDLSRM&appType=moderatedWith... 

  Also, You may create request / ticket:

Support|NXP 


Have a great day,
Yuri

-----------------------------------------------------------------------------------------------------------------------
Note: If this post answers your question, please click the Correct Answer button. Thank you!
-----------------------------------------------------------------------------------------------------------------------

0 Kudos

187 Views
mbriand
Contributor I

Hi Yuri,

Yes I did look at the said section in the i.MX6 SRM, but I have not found any clue about what is going wrong here.

I will create a ticket, thanks for your suggestion.

Best regards,

Mathieu

0 Kudos