CRYPTOCELL — Arm TrustZone CryptoCell 310

Arm® TrustZone® CryptoCell 310 (CRYPTOCELL) is a security subsystem providing root of trust (RoT) and cryptographic services for a device.

The following cryptographic features are among the functionality that can be supported:

True random number generator (TRNG) compliant with FIPS 140-2, BSI AIS-31, and NIST 800-90B.
Pseudorandom number generator (PRNG) using underlying AES engine compliant with NIST 800-90A
RSA public key cryptography
- Signature verification up to key sizes of 2048 bits
- Key generation up to key sizes of 2048 bits
- PKCS#1 v2.1/v1.5
Elliptic curve cryptography (ECC)
- NIST FIPS 186-4 recommended curves using pseudorandom parameters, up to 521 bits:
  - Prime field: P-192, P-224, P-256, P-384, P-521
- SEC 2 recommended curves using pseudorandom parameters, up to 521 bits:
  - Prime field: secp160r1, secp192r1, secp224r1, secp256r1, secp384r1, secp521r1
- Koblitz curves using fixed parameters, up to 256 bits:
  - Prime field: secp160k1, secp192k1, secp224k1, secp256k1
- Brainpool curves:
  - Prime field: BrainpoolP256r1
- Edwards/Montgomery curves:
  - Ed25519, Curve25519
- ECDH/ECDSA support
Secure remote password protocol (SRP), up to 3072 bits operations
Hashing functions
- SHA-1, SHA-2 up to 256 bits
- Keyed-hash message authentication code (HMAC)
AES symmetric encryption
- General purpose AES engine (encrypt/decrypt, sign/verify)
- 128 bits key size
- Supported encryption modes: ECB, CBC, CMAC/CBC-MAC, CTR, CCM/CCM*
ChaCha20/Poly1305 symmetric encryption
- 128 and 256 bits key size
- Authenticated encryption with associated data (AEAD) mode

Disclaimer

This section contains an important disclaimer about the CRYPTOCELL subsystem documentation.

The CRYPTOCELL subsystem is recommended for use with the libraries in the Nordic Semiconductor ASA SDK. These libraries are tested and verified to work with the CRYPTOCELL subsystem hardware. The CRYPTOCELL subsystem documentation and register descriptions are for reference only and can be used for modifying the Nordic supplied SDK libraries or implementing new features.

Nordic Semiconductor ASA reserves the right to change the CRYPTOCELL documentation and register descriptions without further notice. Changes will not trigger erratas and will not be seen as changing form/fit/function of the device.

Please note that Nordic cannot support questions directly related to the register interface or modification of the source code implementation. Nordic provide support for the top-level API in the software library distributed as part of the device SDK.

Usage

The CRYPTOCELL subsystem is a hardware and software solution where software is delivered as libraries in Nordic device SDKs. Recommended usage of the CRYPTOCELL subsystem is to use the SDK library implementation available for the device. The CRYPTOCELL subsystem is documented for reference purpose only, please see section Disclaimer for more information.

To enable CRYPTOCELL, use register ENABLE. The device will not enter the System ON IDLE mode until CRYPTOCELL has been disabled, see POWER — Power control for more information. The Nordic SDK software library automatically controls enabling and disabling of the CRYPTOCELL subsystem as a part of its function calls.

Security configuration

CRYPTOCELL has internal storage for its security configuration, which is preserved even if CRYPTOCELL is disabled.

The following configuration settings are retained:

Device life cycle state (LCS)
Various lock bits
128 bits device root key, K_DR, see Device root key

Any reset source will erase the CRYPTOCELL internal storage, see Reset for more information.

Lifecycle state (LCS)

Lifecycle refers to the multiple states a device goes through during its lifetime. DebugEnable and Secure are the two CRYPTOCELL lifecycle states available to the device.

The CRYPTOCELL lifecycle state (LCS) is controlled through register HOST_IOT_LCS. The LCS is configured by writing either DebugEnable or Secure to the LCS field of this register. To validate that the register is configured correctly, read back the read-only field LCS_IS_VALID from the register HOST_IOT_LCS. The LCS_IS_VALID field will change from Invalid to Valid once a valid LCS value is written.

The following debug override functionality is available if LCS is configured as DebugEnable:

Registers HOST_IOT_KDR0 through HOST_IOT_KDR3 can be written multiple times.
The TRNG output can be overridden. This is done by writing the desired value to register EHR_DATA[0] through EHR_DATA[5] in RNG engine. If LCS is configured as Secure, registers EHR_DATA are read-only and its content is randomly generated by the RNG engine.

Table 1. Lifecycle states
LCS field value	LCS_IS_VALID field value	Description
Secure	Invalid	Default reset value indicating that LCS has not been configured.
Secure	Valid	LCS set to `Secure` mode, and LCS is valid. Registers HOST_IOT_KDR0 through HOST_IOT_KDR3 can only be written once. Any additional writes are ignored.
DebugEnable	Valid	LCS set to `DebugEnable` mode, and LCS is valid. Registers HOST_IOT_KDR0 through HOST_IOT_KDR3 can be written multiple times.

Cryptographic flow

The following section describe a typical cryptographic flow for the CRYPTOCELL subsystem.

Enable CRYPTOCELL subsystem as described in Usage.
Perform clock control for the desired cryptographic engine(s) as described in Power and clock.
Configure the desired cryptographic mode as described in CTL interface.
Depending on the selected cryptographic mode the active engine(s) must be configured, including which cryptographic key to use as described in Cryptographic key selection.
Optionally configure DMA engines as described in Direct memory access (DMA).
Initiate the operation, and wait for an event as described in Interrupt handling.
Check status register(s) for the active engine(s).

Cryptographic key selection

The CRYPTOCELL subsystem can operate on different cryptographic keys.

Hardware unique keys

The AES engine can be instructed to use different key input sources.

The cryptographic key input for the AES engine can either be a hard-coded RTL key referred to as K_PRTL, a device root key referred to as K_DR which is typically programmed into CRYPTOCELL during boot by an immutable bootloader, or a session key provided runtime by the application or the KMU — Key management unit.

RTL key K_PRTL
Device root key K_DR
Session key

RTL key

CRYPTOCELL contains one hard-coded RTL key referred to as K_PRTL. This key is set to the same value for all devices with the same part code and cannot be changed.

CRYPTOCELL can perform cryptographic operations using the K_PRTL key without a bootloader or application having access to the key value itself. Usage of K_PRTL can be disabled until next reset by writing to register HOST_IOT_KPRTL_LOCK. If a locked K_PRTL key is requested, a zero vector key will be used by the AES engine instead.

Device root key

The device root key, K_DR, is a 128 bits AES key typically programmed by an immutable bootloader as part of the CRYPTOCELL initialization process during device boot sequence. It is kept in the CRYPTOCELL internal storage until the next reset.

To configure the K_DR key, write the key value into registers HOST_IOT_KDR0 through HOST_IOT_KDR3. These registers are write-only when LCS is set to DebugEnable mode, and write-once when LCS is set to Secure mode. The K_DR key value is kept when the read-back value of register HOST_IOT_KDR0 is Retained. Once configured, CRYPTOCELL can perform cryptographic operations using the K_DR key without an updatable bootloader or application having access to the key value itself.

The K_DR key should be protected by the KMU — Key management unit.

Session keys

Session keys are supported by the AES and CHACHA engine.

Before starting a cryptographic operation using a session key, the desired key value must be written in clear-text by the CPU into the write-only key registers of the corresponding engine. One session key can be overwritten by another as long as the write order of the write-only key registers are respected. Please refer to the corresponding chapter of each cryptographic engine for more information about write order.

The AES engine supports 128 bits session keys, and CHACHA engine supports 128/256 bits session keys.

The last written session key for each engine is retained until CRYPTOCELL is disabled, the engine is reset, or the device is reset.

Key Management Unit (KMU) keys

The KMU — Key management unit is designed to securely transfer symmetric encryption keys directly into the dedicated write-only key registers of the AES and CHACHA cryptographic engines upon request from the CPU.

Pushing a symmetric key value stored in a KMU key slot into either the AES or CHACHA engine will replace the need for software to write a session key in clear-text into registers AES_KEY_0[n] (n=0..7) for 128 bits AES keys or registers CHACHA_KEY[n] (n=0..7) for 128/256 bits CHACHA keys.

The symmetric key value pushed from a KMU key slot into the AES or CHACHA engine will be retained until CRYPTOCELL is disabled or the device is reset.

Asymmetric keys

Asymmetric cryptographic keys are supported by the PKA engine.

Before starting a cryptographic operation using an asymmetric key, the desired key value must be written into the PKA SRAM together with the payload.

See PKA engine for more information.

Internal memories

CRYPTOCELL contains two dedicated memory blocks; one 4 kB SRAM block for the PKA engine calculations, and one 2 kB SRAM block for the RNG engine entropy collector.

See PKA SRAM and RNG SRAM for more information about these dedicated memory blocks.

Direct memory access (DMA)

CRYPTOCELL support direct memory access (DMA) to allow cryptographic operations on memory mapped regions without involving the CPU.

The following table indicates which memory is accessible by CRYPTOCELL DMA engines.

Table 2. DMA transaction types
Memory type	Read	Write
SRAM	Yes	Yes
Flash	No	No

Data stored in a memory type not accessible by CRYPTOCELL DMA engines must be copied to an accessible memory type before it can be processed by the CRYPTOCELL subsystem. Maximum DMA transaction size is limited to 2¹⁶-1 bytes.

The CRYPTOCELL DMA engine can also run in Bypass mode, meaning data is read and written without being piped through a cryptographic engine. Thus CRYPTOCELL can act as a general purpose DMA engine for moving data.

Operating the DMA engines in Bypass mode involve the following steps:

Enable DMA engines clock using register DMA_CLK.
Configure cryptographic control for Bypass mode using register CRYPTO_CTL.
Set the the output destination address and size of the receiving buffer.
Start the DMA transaction by configuring the input source address and the number of bytes to transfer.
Status of the DMA transaction can be monitored by either polling register DOUT_DMA_MEM_BUSY, or by unmasking the interrupt for field DOUT_TO_MEM_MASK in register IMR.

See DIN DMA engine and DOUT DMA engine for more information.

Power and clock

Power and clock management of the CRYPTOCELL subsystem is handled automatically in hardware, as long as the neccessary conditions are fulfilled by software.

Clock gating

CRYPTOCELL implements separate clock domains for each cryptographic engine. Internal clock gating control is handled through the MISC interface, as well as register RNG_CLK. The registers of a cryptographic engine are only accessible when its clock is enabled.

Power gating

CRYPTOCELL must be disabled to ensure lowest possible power consumption when the subsystem is not needed.

The CRYPTOCELL subsystem power is controlled through register ENABLE. Even though external clock input is gated away automatically by hardware, the CRYPTOCELL subsystem power will still be enabled. To initiate a full power-down sequence software must perform the following steps:

Make sure there are no pending tasks
Clear all pending interrupts in register RNG_ICR and register ICR.
Disable CRYPTOCELL subsystem using register ENABLE.

Interrupt handling

CRYPTOCELL triggers interrupt once processing is complete.

See register IRR for more information on which CRYPTOCELL subsystem components are able to trigger an interrupt request.

To clear the IRQ line when an interrupt has occurred, the relevant interrupt bit in register ICR must be cleared. Interrupt sources can be masked using register IMR. If an interrupt source is masked, no interrupt request will be triggered.

In addition if field RNG_INT in register IRR is asserted, the relevant RNG engine interrupt bit in register RNG_ICR must be cleared before clearing that interrupt bit in register ICR as described above.

The figure below shows how the CRYPTOCELL subsystem interrupt handling is designed and how it is connected to the NVIC module in the CPU.

Figure 2. CRYPTOCELL interrupt handling

Standards

Arm TrustZone® CryptoCell 310 (CRYPTOCELL) is compliant with the protocol specifications and standards shown in the following table.

Table 3. CRYPTOCELL cryptography standards
Algorithm family	Identification code	Document title
TRNG	NIST SP 800-90B	Recommendation for the Entropy Sources Used for Random Bit Generation
	BSI AIS-31	Functionality Classes and Evaluation Methodology for True Random Number Generators
	FIPS 140-2	Security Requirements for Cryptographic Modules
PRNG	NIST SP 800-90A	Recommendation for Random Number Generation Using Deterministic Random Bit Generators
Stream cipher	Chacha	ChaCha, a variant of Salsa20, Daniel J. Bernstein, January 28th 2008
MAC	Poly1305	The Poly1305-AES message-authentication code, Daniel J. Bernstein Cryptography in NaCl, Daniel J. Bernstein
Key agreement	SRP	The Secure Remote Password Protocol, Thomas Wu, November 11th 1997
Key derivation	NIST SP 800-108	Recommendation for Key Derivation Using Pseudorandom Functions.
AES	FIPS-197	Advanced Encryption Standard (AES). Compliant with 128 bits key size only
	NIST SP 800-38A	Recommendation for Block Cipher Modes of Operation - Methods and Techniques
	NIST SP 800-38B	Recommendation for Block Cipher Modes of Operation: The CMAC Mode for Authentication
	NIST SP 800-38C	Recommendation for Block Cipher Modes of Operation: The CCM Mode for Authentication and Confidentiality
	ISO/IEC 9797-1	AES CBC-MAC per ISO/IEC 9797-1 MAC algorithm 1
	IEEE 802.15.4-2011	IEEE Standard for Local and metropolitan area networks - Part 15.4: Low-Rate Wireless Personal Area Networks (LR-WPANs), Annex B.4: Specification of generic CCM* mode of operation
Hash	FIPS 180-4	Secure Hash Standard (SHA1, SHA-224, SHA-256)
Hash	RFC2104	HMAC: Keyed-Hashing for Message Authentication
RSA	PKCS#1	Public-Key Cryptography Standards (PKCS) #1: RSA Cryptography Specifications v1.5/2.1. RSA signature verification supported up to key sizes of 2048 bits. RSA key generation supported up to key sizes of 2048 bits.
Diffie-Hellman	ANSI X9.42	Public Key Cryptography for the Financial Services Industry: Agreement of Symmetric Keys Using Discrete Logarithm Cryptography
Diffie-Hellman	PKCS#3	Diffie-Hellman Key-Agreement Standard
ECC	ANSI X9.63	Public Key Cryptography for the Financial Services Industry - Key Agreement and Key Transport Using Elliptic Curve Cryptography
	IEEE 1363	Standard Specifications for Public-Key Cryptography
	ANSI X9.62	Public Key Cryptography For The Financial Services Industry: The Elliptic Curve Digital Signature Algorithm (ECDSA)
	Ed25519	Edwards-curve, Ed25519: high-speed high-security signatures, Daniel J. Bernstein, Niels Duif, Tanja Lange, Peter Schwabe, and Bo-Yin Yang
	Curve25519	Montgomery curve, Curve25519: new Diffie-Hellman speed records, Daniel J. Bernstein
	FIPS 186-4	Digital Signature Standard (DSS)
	SEC 2	Recommended Elliptic Curve Domain Parameters, Certicom Research
	NIST SP 800-56A rev. 2	Recommendation for Pair-Wise Key Establishment Schemes Using Discrete Logarithm Cryptography

Registers

Instances


Instance	Base address	TrustZone			Split access	Description
Instance	Base address	Map	Att	DMA	Split access	Description
CRYPTOCELL	0x50840000	HF	S	NSA	No	CRYPTOCELL 310 security subsystem

Register overview


Register	Offset	TZ	Description
ENABLE	0x500		Enable CRYPTOCELL subsystem.

ENABLE

Address offset: 0x500

Enable CRYPTOCELL subsystem.


Bit number				31	30	29	28	27	26	25	24	23	22	21	20	19	18	17	16	15	14	13	12	11	10	9	8	7	6	5	4	3	2	1	0
ID																																			A
Reset 0x00000000				0	0	0	0	0	0	0	0	0	0	0	0	0	0	0	0	0	0	0	0	0	0	0	0	0	0	0	0	0	0	0	0
ID	R/W	Field	Value ID	Value								Description
A	RW	ENABLE										Enable or disable the CRYPTOCELL subsystem.
			Disabled	0								CRYPTOCELL subsystem disabled.
			Enabled	1								CRYPTOCELL subsystem enabled.

Accelerators

This chapter contains register interfaces for each of the hardware accelerator engines.

AES engine

The Advanced Encryption Standard (AES) hardware engine is designed according to FIPS197 for use in encrypt/decrypt and sign/verify operations for 128 bits key sizes.

The following cipher modes are supported:

ECB
CBC
CBC-MAC
CMAC
CTR
CCM
CCM*

Note:

To ensure proper operation when writing 128 bits AES keys, the write-only key registers of the AES engine must be written in ascending order, starting with:

Cryptographic flow

The following section describe a simple cryptographic flow for this engine.


    
    uint8_t buf_dst[16] = { 0 };
    uint8_t buf_src[16] = { 0x81, 0x02, 0xF2, 0x40, 0xD5, 0xB9, 0x44, 0x59,
                            0xA2, 0xEB, 0x6F, 0xF2, 0x49, 0xF5, 0xEB, 0x94 };
   
    /* Enable CRYPTOCELL subsystem */
    NRF_CRYPTOCELL->ENABLE =  CRYPTOCELL_ENABLE_ENABLE_Enabled;

    /* Enable engine and DMA clock */
    NRF_CC_MISC->AES_CLK = CC_MISC_AES_CLK_ENABLE_Enable;
    NRF_CC_MISC->DMA_CLK = CC_MISC_DMA_CLK_ENABLE_Enable;

    /* Wait until crypto engine is Idle  */
    while (NRF_CC_CTL->CRYPTO_BUSY == CC_CTL_CRYPTO_BUSY_STATUS_Busy) { }

    /* Configure AES as cryptographic flow */
    NRF_CC_CTL->CRYPTO_CTL = CC_CTL_CRYPTO_CTL_MODE_AESActive;

    /* Configure AES engine control for decryption using ECB mode (default) */
    NRF_CC_AES->AES_CONTROL = CC_AES_AES_CONTROL_DEC_KEY0_Decrypt;

    /* Load the AES key value into the engine */
    NRF_CC_AES->AES_KEY_0[0] = 0x51515151;
    NRF_CC_AES->AES_KEY_0[1] = 0x52525252;
    NRF_CC_AES->AES_KEY_0[2] = 0x53535353;
    NRF_CC_AES->AES_KEY_0[3] = 0x54545454;

    /* Configure default init vector */
    NRF_CC_AES->AES_IV_0[0] = 0x0;
    NRF_CC_AES->AES_IV_0[1] = 0x0;
    NRF_CC_AES->AES_IV_0[2] = 0x0;
    NRF_CC_AES->AES_IV_0[3] = 0x0;

    /* Configure DMA output destination address */
    NRF_CC_DOUT->DST_MEM_ADDR = (uint32_t) buf_dst;
    NRF_CC_DOUT->DST_MEM_SIZE = (uint32_t) sizeof(buf_dst);

    /* Configure DMA input source address to start the cryptographic operation */
    NRF_CC_DIN->SRC_MEM_ADDR = (uint32_t) buf_src;
    NRF_CC_DIN->SRC_MEM_SIZE = (uint32_t) sizeof(buf_src);

    /* Wait on DOUT DMA interrupt */
    while(!(NRF_CC_HOST_RGF->IRR & CC_HOST_RGF_IRR_DOUT_TO_MEM_INT_Msk)) {}

Registers

Instances


Instance	Base address	TrustZone			Split access	Description
Instance	Base address	Map	Att	DMA	Split access	Description
CC_AES	0x50841000	HF	S	NSA	No	CRYPTOCELL AES engine

Register overview


Register	Offset	Description
AES_KEY_0[n]	0x400	AES key value to use. The initial AES_KEY_0[0] register holds the least significant bits [31:0] of the key value.
AES_IV_0[n]	0x440	AES Initialization Vector (IV) to use. The initial AES_IV_0[0] register holds the least significant bits [31:0] of the IV.
AES_CTR[n]	0x460	AES counter (CTR) to use. The initial AES_CTR[0] register holds the least significant bits [31:0] of the CTR.
AES_BUSY	0x470	Status register for AES engine activity.
AES_SK	0x478	Writing to this address trigger sampling of the HW key to the AES_KEY_0 register
AES_CMAC_INIT	0x47C	Writing to this address triggers the AES engine to generate K1 and K2 for AES-CMAC operations.
AES_REMAINING_BYTES	0x4BC	This register should be set with the amount of remaining bytes until the end of the current AES operation.
AES_CONTROL	0x4C0	Control the AES engine behavior.
AES_HW_FLAGS	0x4C8	Hardware configuration of the AES engine. Reset value holds the supported features.
AES_CTR_NO_INCREMENT	0x4D8	This register enables the AES CTR no increment mode in which the counter mode is not incremented between two blocks
AES_SW_RESET	0x4F4	Reset the AES engine.
AES_CMAC_SIZE0_KICK	0x524	Writing to this address triggers the AES engine to perform a CMAC operation with size 0. The CMAC result can be read from the AES_IV_0 register.

AES_KEY_0[n] (n=0..7)

Address offset: 0x400 + (n × 0x4)

AES key value to use. The initial AES_KEY_0[0] register holds the least significant bits [31:0] of the key value.


Bit number				31	30	29	28	27	26	25	24	23	22	21	20	19	18	17	16	15	14	13	12	11	10	9	8	7	6	5	4	3	2	1	0
ID				A	A	A	A	A	A	A	A	A	A	A	A	A	A	A	A	A	A	A	A	A	A	A	A	A	A	A	A	A	A	A	A
Reset 0x00000000				0	0	0	0	0	0	0	0	0	0	0	0	0	0	0	0	0	0	0	0	0	0	0	0	0	0	0	0	0	0	0	0
ID	R/W	Field	Value ID	Value								Description
A	W	VALUE										AES key value.

AES_IV_0[n] (n=0..3)

Address offset: 0x440 + (n × 0x4)

AES Initialization Vector (IV) to use. The initial AES_IV_0[0] register holds the least significant bits [31:0] of the IV.

AES_IV_0 must be configured according to the selected AES mode:

AES CBC/CBC-MAC : Loaded with the IV.

This register is a 'R/W change' register, as the written register values changes during processing.


Bit number				31	30	29	28	27	26	25	24	23	22	21	20	19	18	17	16	15	14	13	12	11	10	9	8	7	6	5	4	3	2	1	0
ID				A	A	A	A	A	A	A	A	A	A	A	A	A	A	A	A	A	A	A	A	A	A	A	A	A	A	A	A	A	A	A	A
Reset 0x00000000				0	0	0	0	0	0	0	0	0	0	0	0	0	0	0	0	0	0	0	0	0	0	0	0	0	0	0	0	0	0	0	0
ID	R/W	Field	Value ID	Value								Description
A	RW	VALUE										AES non-tunneling or first tunnel stage IV value.

AES_CTR[n] (n=0..3)

Address offset: 0x460 + (n × 0x4)

AES counter (CTR) to use. The initial AES_CTR[0] register holds the least significant bits [31:0] of the CTR.

AES_CTR must be configured according to the selected AES mode:

AES CTR : Loaded with the counter value.

This register is a 'R/W change' register, as the written register values changes during processing.


Bit number				31	30	29	28	27	26	25	24	23	22	21	20	19	18	17	16	15	14	13	12	11	10	9	8	7	6	5	4	3	2	1	0
ID				A	A	A	A	A	A	A	A	A	A	A	A	A	A	A	A	A	A	A	A	A	A	A	A	A	A	A	A	A	A	A	A
Reset 0x00000000				0	0	0	0	0	0	0	0	0	0	0	0	0	0	0	0	0	0	0	0	0	0	0	0	0	0	0	0	0	0	0	0
ID	R/W	Field	Value ID	Value								Description
A	RW	VALUE										AES CTR value.

AES_BUSY

Address offset: 0x470

Status register for AES engine activity.


Bit number				31	30	29	28	27	26	25	24	23	22	21	20	19	18	17	16	15	14	13	12	11	10	9	8	7	6	5	4	3	2	1	0
ID																																			A
Reset 0x00000000				0	0	0	0	0	0	0	0	0	0	0	0	0	0	0	0	0	0	0	0	0	0	0	0	0	0	0	0	0	0	0	0
ID	R/W	Field	Value ID	Value								Description
A	R	STATUS										AES engine status.
			Idle	0								AES engine is idle
			Busy	1								AES engine is busy

AES_SK

Address offset: 0x478

Writing to this address trigger sampling of the HW key to the AES_KEY_0 register


Bit number				31	30	29	28	27	26	25	24	23	22	21	20	19	18	17	16	15	14	13	12	11	10	9	8	7	6	5	4	3	2	1	0
ID																																			A
Reset 0x00000000				0	0	0	0	0	0	0	0	0	0	0	0	0	0	0	0	0	0	0	0	0	0	0	0	0	0	0	0	0	0	0	0
ID	R/W	Field	Value ID	Value								Description
A	W	AES_SK										Sample HW key to AES_KEY_0 registers.

AES_CMAC_INIT

Address offset: 0x47C

Writing to this address triggers the AES engine to generate K1 and K2 for AES-CMAC operations.


Bit number				31	30	29	28	27	26	25	24	23	22	21	20	19	18	17	16	15	14	13	12	11	10	9	8	7	6	5	4	3	2	1	0
ID																																			A
Reset 0x00000000				0	0	0	0	0	0	0	0	0	0	0	0	0	0	0	0	0	0	0	0	0	0	0	0	0	0	0	0	0	0	0	0
ID	R/W	Field	Value ID	Value								Description
A	W	ENABLE										Generate K1 and K2 for the AES-CMAC operations.
			Enable	1								Initialize AES-CMAC operations.

AES_REMAINING_BYTES

Address offset: 0x4BC

This register should be set with the amount of remaining bytes until the end of the current AES operation.

The AES engine counts down from this value to determine the last block or the block before the last blocks in mode AES CMAC and mode AES CCM.


Bit number				31	30	29	28	27	26	25	24	23	22	21	20	19	18	17	16	15	14	13	12	11	10	9	8	7	6	5	4	3	2	1	0
ID				A	A	A	A	A	A	A	A	A	A	A	A	A	A	A	A	A	A	A	A	A	A	A	A	A	A	A	A	A	A	A	A
Reset 0x00000000				0	0	0	0	0	0	0	0	0	0	0	0	0	0	0	0	0	0	0	0	0	0	0	0	0	0	0	0	0	0	0	0
ID	R/W	Field	Value ID	Value								Description
A	RW	VALUE										Remaining bytes util the end of the current AES operation.

AES_CONTROL

Address offset: 0x4C0

Control the AES engine behavior.


Bit number				31	30	29	28	27	26	25	24	23	22	21	20	19	18	17	16	15	14	13	12	11	10	9	8	7	6	5	4	3	2	1	0
ID				E		D																C	C								B	B	B		A
Reset 0x00000000				0	0	0	0	0	0	0	0	0	0	0	0	0	0	0	0	0	0	0	0	0	0	0	0	0	0	0	0	0	0	0	0
ID	R/W	Field	Value ID	Value								Description
A	RW	DEC_KEY0										Set AES encrypt or decrypt mode in non-tunneling operations.
			Encrypt	0								Perform AES encryption
			Decrypt	1								Perform AES decryption
B	RW	MODE_KEY0										Set the AES mode.
			ECB	0x0								Electronic codebook mode
			CBC	0x1								Cipher block chaining mode
			CTR	0x2								Counter mode
			CBC_MAC	0x3								Cipher Block Chaining Message Authentication Code
			CMAC	0x7								Cipher-based Message Authentication Code
C	RW	NK_KEY0										Set the AES key length.
			128Bits	0x0								128 bits key length
D	RW	AES_XOR_CRYPTOKEY										This field determines the value that is written to AES_KEY_0, when AES_SK is kicked.
			Disable	0								The value that is written to AES_KEY_0 is the value of the HW cryptokey as is.
			Enable	1								The value that is written to AES_KEY_0 is the value of the HW cryptokey XOR with the current value of AES_KEY_0.
E	RW	DIRECT_ACCESS										Using direct access and not the DIN-DOUT DMA interface
			Disable	0								Access using the DIN-DOUT DMA interface
			Enable	1								Access using direct access

AES_HW_FLAGS

Address offset: 0x4C8

Hardware configuration of the AES engine. Reset value holds the supported features.


Bit number				31	30	29	28	27	26	25	24	23	22	21	20	19	18	17	16	15	14	13	12	11	10	9	8	7	6	5	4	3	2	1	0
ID																							K	J	I	H	G			F	E	D	C	B	A
Reset 0x00000108				0	0	0	0	0	0	0	0	0	0	0	0	0	0	0	0	0	0	0	0	0	0	0	1	0	0	0	0	1	0	0	0
ID	R/W	Field	Value ID	Value								Description
A	R	SUPPORT_256_192_KEY										If this flag is set, the engine support 192 bits and 256 bits key size.
B	R	AES_LARGE_RKEK										If this flag is set, the engine support AES_LARGE_RKEK.
C	R	DPA_CNTRMSR_EXIST										If this flag is set, the engine support DPA countermeasures.
D	R	CTR_EXIST										If this flag is set, the engine support AES CTR mode.
E	R	ONLY_ENCRYPT										If this flag is set, the engine only support encrypt operations.
F	R	USE_SBOX_TABLE										If this flag is set, the engine uses SBOX tables.
G	R	USE_5_SBOXES										If this flag is set, the engine uses 5 SBOX where each AES round takes 4 cycles.
H	R	AES_SUPPORT_PREV_IV										If this flag is set, the engine contains the PREV_IV register for faster AES XCBC MAC calculation.
I	R	AES_TUNNEL_EXIST										If this flag is set, the engine support tunneling operations.
J	R	SECOND_REGS_SET_EXIST										If this flag is set, the engine support a second register set for tunneling operations.
K	R	DFA_CNTRMSR_EXIST										If this flag is set, the engine support DFA countermeasures.

AES_CTR_NO_INCREMENT

Address offset: 0x4D8

This register enables the AES CTR no increment mode in which the counter mode is not incremented between two blocks


Bit number				31	30	29	28	27	26	25	24	23	22	21	20	19	18	17	16	15	14	13	12	11	10	9	8	7	6	5	4	3	2	1	0
ID																																			A
Reset 0x00000000				0	0	0	0	0	0	0	0	0	0	0	0	0	0	0	0	0	0	0	0	0	0	0	0	0	0	0	0	0	0	0	0
ID	R/W	Field	Value ID	Value								Description
A	RW	ENABLE										This field enables the AES CTR no increment mode in which the counter mode is not incremented between two blocks
			Disable	0								Counter always incremented between blocks
			Enable	1								Do not increment counter between blocks

AES_SW_RESET

Address offset: 0x4F4

Reset the AES engine.


Bit number				31	30	29	28	27	26	25	24	23	22	21	20	19	18	17	16	15	14	13	12	11	10	9	8	7	6	5	4	3	2	1	0
ID																																			A
Reset 0x00000000				0	0	0	0	0	0	0	0	0	0	0	0	0	0	0	0	0	0	0	0	0	0	0	0	0	0	0	0	0	0	0	0
ID	R/W	Field	Value ID	Value								Description
A	W	RESET										Writing any value to this address resets the AES engine. The reset takes 4 CPU clock cycles to complete.
			Enable	1								Reset AES engine.

AES_CMAC_SIZE0_KICK

Address offset: 0x524

Writing to this address triggers the AES engine to perform a CMAC operation with size 0. The CMAC result can be read from the AES_IV_0 register.


Bit number				31	30	29	28	27	26	25	24	23	22	21	20	19	18	17	16	15	14	13	12	11	10	9	8	7	6	5	4	3	2	1	0
ID																																			A
Reset 0x00000000				0	0	0	0	0	0	0	0	0	0	0	0	0	0	0	0	0	0	0	0	0	0	0	0	0	0	0	0	0	0	0	0
ID	R/W	Field	Value ID	Value								Description
A	W	ENABLE										Force AES CMAC operation with size 0.
			Disable	0								Normal AES CMAC operation
			Enable	1								Force CMAC operation with size 0

CHACHA engine

The ChaCha algorithm is a family of stream ciphers.

The ChaCha family of stream ciphers can be used as both a stand-alone algorithm, and in combination with the Poly1305 authenticator to form an Authenticated Encryption with Associated Data (AEAD) algorithm as defined in RFC7539 for IETF protocols.

The CHACHA engine provide acceleration for the stream encryption, while the PKA engine is used for acceleration of the Poly1305 authenticator. The core of the ChaCha algorithm is a hash function which is based on rotation operations. In the default configuration the hash function consist of 20 rounds of rotation permutations. The implementation support ChaCha stream ciphers using key sizes up to 256 bits in 8, 12 and 20 rounds. The ChaCha20/Poly1305 combination is perfectly suited for embedded environments, and can achieve much higher throughput than AES using similar power consumption and execution time.

Note: To ensure proper operation when writing 128 bits CHACHA keys, the write-only key registers of the CHACHA engine must be written in ascending order, starting with:

For 256 bits CHACHA keys, this must be followed by:

Cryptographic flow

The following section describe a simple cryptographic flow for this engine.


    
    uint8_t buf_dst[16] = { 0 };
    uint8_t buf_src[16] = { 0x18, 0x35, 0x9B, 0x75, 0x18, 0x6F, 0x33, 0xBE,
                            0x22, 0x0A, 0x3D, 0xB7, 0x66, 0xFD, 0x98, 0x35 };
  
    /* Enable CRYPTOCELL subsystem */
    NRF_CRYPTOCELL->ENABLE = CRYPTOCELL_ENABLE_ENABLE_Enabled;

    /* Enable engine and DMA clock */
    NRF_CC_MISC->CHACHA_CLK = CC_MISC_CHACHA_CLK_ENABLE_Enable;
    NRF_CC_MISC->DMA_CLK = CC_MISC_DMA_CLK_ENABLE_Enable;

    /* Wait until crypto engine is Idle  */
    while (NRF_CC_CTL->CRYPTO_BUSY == CC_CTL_CRYPTO_BUSY_STATUS_Busy) { }

    /* Configure CHACHA as cryptographic flow */
    NRF_CC_CTL->CRYPTO_CTL = CC_CTL_CRYPTO_CTL_MODE_ChaChaActive;
  
    /* Configure testing NONCE */
    NRF_CC_CHACHA->CHACHA_IV[0] = 0xBBBBAAAA;
    NRF_CC_CHACHA->CHACHA_IV[1] = 0x22221111;
  
    /* Load the CHACHA test key value into the engine */
    NRF_CC_CHACHA->CHACHA_KEY[0] = 0x51515151;
    NRF_CC_CHACHA->CHACHA_KEY[1] = 0x52525252;
    NRF_CC_CHACHA->CHACHA_KEY[2] = 0x53535353;
    NRF_CC_CHACHA->CHACHA_KEY[3] = 0x54545454;
    NRF_CC_CHACHA->CHACHA_KEY[4] = 0x51515151;
    NRF_CC_CHACHA->CHACHA_KEY[5] = 0x52525252;
    NRF_CC_CHACHA->CHACHA_KEY[6] = 0x53535353;
    NRF_CC_CHACHA->CHACHA_KEY[7] = 0x54545454;
  
    /* Configure CHACHA mode - using default (0x0), adding new message init */
    NRF_CC_CHACHA->CHACHA_CONTROL =
      (CC_CHACHA_CHACHA_CONTROL_INIT_Enable <<
       CC_CHACHA_CHACHA_CONTROL_INIT_Pos);
  
    /* Configure DMA output destination address */
    NRF_CC_DOUT->DST_MEM_ADDR = (uint32_t) buf_dst;
    NRF_CC_DOUT->DST_MEM_SIZE = (uint32_t) sizeof(buf_dst);

    /* Configure DMA input source address to start the cryptographic operation */
    NRF_CC_DIN->SRC_MEM_ADDR = (uint32_t) buf_src;
    NRF_CC_DIN->SRC_MEM_SIZE = (uint32_t) sizeof(buf_src);
  
    /* Wait on DOUT DMA interrupt */
    while(!(NRF_CC_HOST_RGF->IRR & CC_HOST_RGF_IRR_DOUT_TO_MEM_INT_Msk)) {}

Registers

Instances


Instance	Base address	TrustZone			Split access	Description
Instance	Base address	Map	Att	DMA	Split access	Description
CC_CHACHA	0x50841000	HF	S	NSA	No	CRYPTOCELL CHACHA engine

Register overview


Register	Offset	Description
CHACHA_CONTROL	0x380	Control the CHACHA engine behavior.
CHACHA_VERSION	0x384	CHACHA engine HW version
CHACHA_KEY[n]	0x388	CHACHA key value to use. The initial CHACHA_KEY[0] register holds the least significant bits [31:0] of the key value.
CHACHA_IV[n]	0x3A8	CHACHA Initialization Vector (IV) to use. The IV is also known as the nonce.
CHACHA_BUSY	0x3B0	Status register for CHACHA engine activity.
CHACHA_HW_FLAGS	0x3B4	Hardware configuration of the CHACHA engine. Reset value holds the supported features.
CHACHA_BLOCK_CNT_LSB	0x3B8	Store the LSB value of the block counter, in order to support suspend/resume of operation
CHACHA_BLOCK_CNT_MSB	0x3BC	Store the MSB value of the block counter, in order to support suspend/resume of operation
CHACHA_SW_RESET	0x3C0	Reset the CHACHA engine.
CHACHA_POLY1305_KEY[n]	0x3C4	The auto-generated key to use in Poly1305 MAC calculation. The initial CHACHA_POLY1305_KEY[0] register holds the least significant bits [31:0] of the key value.
CHACHA_ENDIANNESS	0x3E4	CHACHA engine data order configuration.
CHACHA_DEBUG	0x3E8	Debug register for the CHACHA engine

CHACHA_CONTROL

Address offset: 0x380

Control the CHACHA engine behavior.


Bit number				31	30	29	28	27	26	25	24	23	22	21	20	19	18	17	16	15	14	13	12	11	10	9	8	7	6	5	4	3	2	1	0
ID																									G	F				E	E	D	C	B	A
Reset 0x00000000				0	0	0	0	0	0	0	0	0	0	0	0	0	0	0	0	0	0	0	0	0	0	0	0	0	0	0	0	0	0	0	0
ID	R/W	Field	Value ID	Value								Description
A	RW	CHACHA_OR_SALSA										Run engine in ChaCha or Salsa mode
			ChaCha	0								Run engine in ChaCha mode
			Salsa	1								Run engine in Salsa mode
B	RW	INIT										Perform initialization for a new message
			Disable	0								Message already initialized
			Enable	1								Initialize new message
C	RW	GEN_KEY_POLY1305										Generate the key to use in Poly1305 message authentication code calculation.
			Disable	0								Do not generate Poly1305 key
			Enable	1								Generate Poly1305 key
D	RW	KEY_LEN										Key length selection.
			256Bits	0								Use 256 bits key length
			128Bits	1								Use 128 bits key length
E	RW	NUM_OF_ROUNDS										Set number of permutation rounds, default value is 20.
			Default	0								Use 20 rounds of rotation (default)
			12Rounds	1								Use 12 rounds of rotation
			8Rounds	2								Use 8 rounds of rotation
F	RW	RESET_BLOCK_CNT										Reset block counter for new messages
			Disable	0								Use current block counter value
			Enable	1								Reset block counter value to zero
G	RW	USE_IV_96BIT										Use 96 bits Initialization Vector (IV)
			Disable	0								Use default size IV of 64 bit
			Enable	1								The IV is 96 bits

CHACHA_VERSION

Address offset: 0x384

CHACHA engine HW version


Bit number				31	30	29	28	27	26	25	24	23	22	21	20	19	18	17	16	15	14	13	12	11	10	9	8	7	6	5	4	3	2	1	0
ID				A	A	A	A	A	A	A	A	A	A	A	A	A	A	A	A	A	A	A	A	A	A	A	A	A	A	A	A	A	A	A	A
Reset 0x00000001				0	0	0	0	0	0	0	0	0	0	0	0	0	0	0	0	0	0	0	0	0	0	0	0	0	0	0	0	0	0	0	1
ID	R/W	Field	Value ID	Value								Description
A	R	CHACHA_VERSION

CHACHA_KEY[n] (n=0..7)

Address offset: 0x388 + (n × 0x4)

CHACHA key value to use. The initial CHACHA_KEY[0] register holds the least significant bits [31:0] of the key value.


Bit number				31	30	29	28	27	26	25	24	23	22	21	20	19	18	17	16	15	14	13	12	11	10	9	8	7	6	5	4	3	2	1	0
ID				A	A	A	A	A	A	A	A	A	A	A	A	A	A	A	A	A	A	A	A	A	A	A	A	A	A	A	A	A	A	A	A
Reset 0x00000000				0	0	0	0	0	0	0	0	0	0	0	0	0	0	0	0	0	0	0	0	0	0	0	0	0	0	0	0	0	0	0	0
ID	R/W	Field	Value ID	Value								Description
A	W	VALUE										CHACHA key value.

CHACHA_IV[n] (n=0..1)

Address offset: 0x3A8 + (n × 0x4)

CHACHA Initialization Vector (IV) to use. The IV is also known as the nonce.

The size of the nonce is controlled from register CHACHA_CONTROL.

For 64 bits IV size the nonce value must be encoded using:

CHACHA_IV[0] : Bits [31:0] of the nonce
CHACHA_IV[1] : Bits [63:32] of the nonce

For 96 bits IV size the nonce value must be encoded using:

CHACHA_BLOCK_CNT_MSB : Bits [31:0] of the nonce
CHACHA_IV[0] : Bits [63:32] of the nonce
CHACHA_IV[1] : Bits [95:64] of the nonce


Bit number				31	30	29	28	27	26	25	24	23	22	21	20	19	18	17	16	15	14	13	12	11	10	9	8	7	6	5	4	3	2	1	0
ID				A	A	A	A	A	A	A	A	A	A	A	A	A	A	A	A	A	A	A	A	A	A	A	A	A	A	A	A	A	A	A	A
Reset 0x00000000				0	0	0	0	0	0	0	0	0	0	0	0	0	0	0	0	0	0	0	0	0	0	0	0	0	0	0	0	0	0	0	0
ID	R/W	Field	Value ID	Value								Description
A	RW	VALUE										CHACHA IV value.

CHACHA_BUSY

Address offset: 0x3B0

Status register for CHACHA engine activity.


Bit number				31	30	29	28	27	26	25	24	23	22	21	20	19	18	17	16	15	14	13	12	11	10	9	8	7	6	5	4	3	2	1	0
ID																																			A
Reset 0x00000000				0	0	0	0	0	0	0	0	0	0	0	0	0	0	0	0	0	0	0	0	0	0	0	0	0	0	0	0	0	0	0	0
ID	R/W	Field	Value ID	Value								Description
A	R	STATUS										CHACHA engine status.
			Idle	0								CHACHA engine is idle
			Busy	1								CHACHA engine is busy

CHACHA_HW_FLAGS

Address offset: 0x3B4

Hardware configuration of the CHACHA engine. Reset value holds the supported features.


Bit number				31	30	29	28	27	26	25	24	23	22	21	20	19	18	17	16	15	14	13	12	11	10	9	8	7	6	5	4	3	2	1	0
ID																																	C	B	A
Reset 0x00000001				0	0	0	0	0	0	0	0	0	0	0	0	0	0	0	0	0	0	0	0	0	0	0	0	0	0	0	0	0	0	0	1
ID	R/W	Field	Value ID	Value								Description
A	R	CHACHA_EXISTS										If this flag is set, the engine include ChaCha support
B	R	SALSA_EXISTS										If this flag is set, the engine include Salsa support
C	R	FAST_CHACHA										If this flag is set, the next matrix calculated when the current one is written to data output path.

CHACHA_BLOCK_CNT_LSB

Address offset: 0x3B8

Store the LSB value of the block counter, in order to support suspend/resume of operation

The two first words (n) in the last row of the cipher matrix are the block counter. At the end of each block (512b), the block counter for the next block is written by HW to register CHACHA_BLOCK_CNT_LSB and register CHACHA_BLOCK_CNT_MSB. If starting a new message the block counter must also be reset.


Bit number				31	30	29	28	27	26	25	24	23	22	21	20	19	18	17	16	15	14	13	12	11	10	9	8	7	6	5	4	3	2	1	0
ID				A	A	A	A	A	A	A	A	A	A	A	A	A	A	A	A	A	A	A	A	A	A	A	A	A	A	A	A	A	A	A	A
Reset 0x00000000				0	0	0	0	0	0	0	0	0	0	0	0	0	0	0	0	0	0	0	0	0	0	0	0	0	0	0	0	0	0	0	0
ID	R/W	Field	Value ID	Value								Description
A	RW	VALUE										This register holds the ChaCha block counter bits [31:0] and must be read and written during respectively suspend and resume operations.

CHACHA_BLOCK_CNT_MSB

Address offset: 0x3BC

Store the MSB value of the block counter, in order to support suspend/resume of operation

For the description of register CHACHA_BLOCK_CNT_MSB, see register CHACHA_BLOCK_CNT_LSB.


Bit number				31	30	29	28	27	26	25	24	23	22	21	20	19	18	17	16	15	14	13	12	11	10	9	8	7	6	5	4	3	2	1	0
ID				A	A	A	A	A	A	A	A	A	A	A	A	A	A	A	A	A	A	A	A	A	A	A	A	A	A	A	A	A	A	A	A
Reset 0x00000000				0	0	0	0	0	0	0	0	0	0	0	0	0	0	0	0	0	0	0	0	0	0	0	0	0	0	0	0	0	0	0	0
ID	R/W	Field	Value ID	Value								Description
A	RW	VALUE										This register holds the ChaCha block counter bits [63:32] and must be read and written during respectively suspend and resume operations.

CHACHA_SW_RESET

Address offset: 0x3C0

Reset the CHACHA engine.


Bit number				31	30	29	28	27	26	25	24	23	22	21	20	19	18	17	16	15	14	13	12	11	10	9	8	7	6	5	4	3	2	1	0
ID																																			A
Reset 0x00000000				0	0	0	0	0	0	0	0	0	0	0	0	0	0	0	0	0	0	0	0	0	0	0	0	0	0	0	0	0	0	0	0
ID	R/W	Field	Value ID	Value								Description
A	W	RESET										Writing any value to this address resets the CHACHA engine. The reset takes 4 CPU clock cycles to complete.
			Enable	1								Reset CHACHA engine.

CHACHA_POLY1305_KEY[n] (n=0..7)

Address offset: 0x3C4 + (n × 0x4)

The auto-generated key to use in Poly1305 MAC calculation.

The initial CHACHA_POLY1305_KEY[0] register holds the least significant bits [31:0] of the key value.


Bit number				31	30	29	28	27	26	25	24	23	22	21	20	19	18	17	16	15	14	13	12	11	10	9	8	7	6	5	4	3	2	1	0
ID				A	A	A	A	A	A	A	A	A	A	A	A	A	A	A	A	A	A	A	A	A	A	A	A	A	A	A	A	A	A	A	A
Reset 0x00000000				0	0	0	0	0	0	0	0	0	0	0	0	0	0	0	0	0	0	0	0	0	0	0	0	0	0	0	0	0	0	0	0
ID	R/W	Field	Value ID	Value								Description
A	R	VALUE										Poly1305 key value.

CHACHA_ENDIANNESS

Address offset: 0x3E4

CHACHA engine data order configuration.


Bit number				31	30	29	28	27	26	25	24	23	22	21	20	19	18	17	16	15	14	13	12	11	10	9	8	7	6	5	4	3	2	1	0
ID																															E	D	C	B	A
Reset 0x00000000				0	0	0	0	0	0	0	0	0	0	0	0	0	0	0	0	0	0	0	0	0	0	0	0	0	0	0	0	0	0	0	0
ID	R/W	Field	Value ID	Value								Description
A	RW	CHACHA_DIN_WORD_ORDER										Change the word order of the input data.
			Default	0								Use default word order for 128-bits input, where words are ordered as follows: w0, w1, w2, w3.
			Reverse	1								Reverses the word order for 128-bits input, where words are re-ordered as follows: w3, w2, w1, w0.
B	RW	CHACHA_DIN_BYTE_ORDER										Change the byte order of the input data.
			Default	0								Use default byte order within each input word, where bytes are ordered as follows: B0, B1, B2, B3.
			Reverse	1								Reverse the byte order within each input word, where bytes are re-ordered as follows: B3, B2, B1, B0.
C	RW	CHACHA_CORE_MATRIX_LBE_ORDER										Change the quarter of a matrix order in the engine.
			Default	0								Use default quarter of matrix order, where quarters are ordered as follows: q0, q1, q2, q3. Each quarter represents a 128-bits section of the matrix.
			Reverse	1								Reverse the order of matrix quarters, where quarters are re-ordered as follows: q3, q2, q1, q0. Each quarter represents a 128-bits section of the matrix.
D	RW	CHACHA_DOUT_WORD_ORDER										Change the word order of the output data.
			Default	0								Uses default word order for 128-bits output, where words are ordered as follows: w0, w1, w2, w3.
			Reverse	1								Reverse the word order for 128-bits output, where words are re-ordered as follows: w3, w2, w1, w0.
E	RW	CHACHA_DOUT_BYTE_ORDER										Change the byte order of the output data.
			Default	0								Use default byte order within each output word, where bytes are ordered as follows: B0, B1, B2, B3.
			Reverse	1								Reverse the byte order within each output word, where bytes are re-ordered as follows: B3, B2, B1, B0.

CHACHA_DEBUG

Address offset: 0x3E8

Debug register for the CHACHA engine


Bit number				31	30	29	28	27	26	25	24	23	22	21	20	19	18	17	16	15	14	13	12	11	10	9	8	7	6	5	4	3	2	1	0
ID																																		A	A
Reset 0x00000000				0	0	0	0	0	0	0	0	0	0	0	0	0	0	0	0	0	0	0	0	0	0	0	0	0	0	0	0	0	0	0	0
ID	R/W	Field	Value ID	Value								Description
A	R	FSM_STATE										Reflects the debug state of the CHACHA FSM.
			IDLE_STATE	0								CHACHA FSM is in idle state
			INIT_STATE	1								CHACHA FSM is in init state
			ROUNDS_STATE	2								CHACHA FSM is in rounds state
			FINAL_STATE	3								CHACHA FSM is in final state

HASH engine

The HASH engine is designed according to FIPS 180-4, and support both the SHA1 and SHA2 family of digest algorithms up to 256 bits.

The following SHA modes are supported:

SHA-1
SHA-224
SHA-256

Note:

To ensure proper operation, the FIPS 180-4 defined initial hash values written to the registers of the HASH engine must be written in descending order, starting with:

HASH_H[7] for SHA-256, and SHA-224.
HASH_H[6] for SHA-256, and SHA-224.
HASH_H[5] for SHA-256, and SHA-224.
HASH_H[4] for SHA-256, SHA-224, and SHA-1.
HASH_H[3] for SHA-256, SHA-224, and SHA-1.
HASH_H[2] for SHA-256, SHA-224, and SHA-1.
HASH_H[1] for SHA-256, SHA-224, and SHA-1.
HASH_H[0] for SHA-256, SHA-224, and SHA-1.

Cryptographic flow

The following section describe a simple cryptographic flow for this engine.


    
    uint8_t buf_src[32] =  {
          0xFA,0xFA,0xFA,0xFA,0xFA,0xFA,0xFA,0xFA,
          0xFA,0xFA,0xFA,0xFA,0xFA,0xFA,0xFA,0xFA,
          0xFA,0xFA,0xFA,0xFA,0xFA,0xFA,0xFA,0xFA,
          0xFA,0xFA,0xFA,0xFA,0xFA,0xFA,0xFA,0xFA };

    /* Enable CRYPTOCELL subsystem */
    NRF_CRYPTOCELL->ENABLE = CRYPTOCELL_ENABLE_ENABLE_Enabled;

    /* Enable engine and DMA clock */
    NRF_CC_MISC->HASH_CLK = CC_MISC_HASH_CLK_ENABLE_Enable;
    NRF_CC_MISC->DMA_CLK = CC_MISC_DMA_CLK_ENABLE_Enable;

    /* Wait until hash engine is Idle  */
    while (NRF_CC_CTL->HASH_BUSY == CC_CTL_HASH_BUSY_STATUS_Busy) {}

    /* Clear all interrupts */
    NRF_CC_HOST_RGF->ICR = 0xFFFFFFFF;

    /* Configure HASH as cryptographic flow */
    NRF_CC_CTL->CRYPTO_CTL = CC_CTL_CRYPTO_CTL_MODE_HashActive;

    /* Configure engine for SHA256 */
    NRF_CC_HASH->HASH_CONTROL = CC_HASH_HASH_CONTROL_MODE_SHA256;

    /* Configure initial SHA256 values */
    NRF_CC_HASH->HASH_H[7] = 0x5BE0CD19;
    NRF_CC_HASH->HASH_H[6] = 0x1F83D9AB;
    NRF_CC_HASH->HASH_H[5] = 0x9B05688C;
    NRF_CC_HASH->HASH_H[4] = 0x510E527F;
    NRF_CC_HASH->HASH_H[3] = 0xA54FF53A;
    NRF_CC_HASH->HASH_H[2] = 0x3C6EF372;
    NRF_CC_HASH->HASH_H[1] = 0xBB67AE85;
    NRF_CC_HASH->HASH_H[0] = 0x6A09E667;

    /* Configure DMA input source address to start the cryptographic operation */
    NRF_CC_DIN->SRC_MEM_ADDR = (uint32_t) buf_src;
    NRF_CC_DIN->SRC_MEM_SIZE = (uint32_t) sizeof(buf_src);

    /* Wait on DIN DMA interrupt indicating data has been fetched */
    while(!(NRF_CC_HOST_RGF->IRR & CC_HOST_RGF_IRR_MEM_TO_DIN_INT_Msk)) {}

    /* Wait until hash engine is Idle */
    while (NRF_CC_CTL->HASH_BUSY == CC_CTL_HASH_BUSY_STATUS_Busy) {}

    /* Calculated SHA256 digest now available in 
    NRF_CC_HASH->HASH_H[0] to NRF_CC_HASH->HASH_H[7]  */

Registers

Instances


Instance	Base address	TrustZone			Split access	Description
Instance	Base address	Map	Att	DMA	Split access	Description
CC_HASH	0x50841000	HF	S	NSA	No	CRYPTOCELL HASH engine

Register overview


Register	Offset	Description
HASH_H[n]	0x640	HASH_H value registers. The initial HASH_H[0] register holds the least significant bits [31:0] of the value.
HASH_PAD_AUTO	0x684	Configure the HASH engine to automatically pad data at the end of the DMA transfer to complete the digest operation.
HASH_INIT_STATE	0x694	Configure HASH engine initial state registers.
HASH_VERSION	0x7B0	HASH engine HW version
HASH_CONTROL	0x7C0	Control the HASH engine behavior.
HASH_PAD	0x7C4	Enable the hardware padding feature of the HASH engine.
HASH_PAD_FORCE	0x7C8	Force the hardware padding operation to trigger if the input data length is zero bytes.
HASH_CUR_LEN_0	0x7CC	Bits [31:0] of the number of bytes that have been digested so far.
HASH_CUR_LEN_1	0x7D0	Bits [63:32] of the number of bytes that have been digested so far.
HASH_HW_FLAGS	0x7DC	Hardware configuration of the HASH engine. Reset value holds the supported features.
HASH_SW_RESET	0x7E4	Reset the HASH engine.
HASH_ENDIANNESS	0x7E8	Configure the endianness of HASH data and padding generation.

HASH_H[n] (n=0..7)

Address offset: 0x640 + (n × 0x4)

HASH_H value registers. The initial HASH_H[0] register holds the least significant bits [31:0] of the value.

This register is a 'R/W change' register, as the written register values changes during processing.


Bit number				31	30	29	28	27	26	25	24	23	22	21	20	19	18	17	16	15	14	13	12	11	10	9	8	7	6	5	4	3	2	1	0
ID				A	A	A	A	A	A	A	A	A	A	A	A	A	A	A	A	A	A	A	A	A	A	A	A	A	A	A	A	A	A	A	A
Reset 0x00000000				0	0	0	0	0	0	0	0	0	0	0	0	0	0	0	0	0	0	0	0	0	0	0	0	0	0	0	0	0	0	0	0
ID	R/W	Field	Value ID	Value								Description
A	RW	VALUE										Write the initial hash value before start of digest operation, and read the final hash value result after the digest operation has been completed.

HASH_PAD_AUTO

Address offset: 0x684

Configure the HASH engine to automatically pad data at the end of the DMA transfer to complete the digest operation.

This feature can only be used if HASH_PAD is enabled, and must be disabled after a digest operation is completed. In the event of zero bytes input data length the hardware padding must be manually triggered using register HASH_PAD_FORCE.


Bit number				31	30	29	28	27	26	25	24	23	22	21	20	19	18	17	16	15	14	13	12	11	10	9	8	7	6	5	4	3	2	1	0
ID																																			A
Reset 0x00000000				0	0	0	0	0	0	0	0	0	0	0	0	0	0	0	0	0	0	0	0	0	0	0	0	0	0	0	0	0	0	0	0
ID	R/W	Field	Value ID	Value								Description
A	W	HWPAD										Enable automatic padding in hardware. Disable this register when the digest operation is completed.
			Disable	0								Do not enable automatic hardware padding.
			Enable	1								Enable automatic hardware padding.

HASH_INIT_STATE

Address offset: 0x694

Configure HASH engine initial state registers.

Data fetched using the DIN DMA engine will be loaded into initial hash value registers HASH_H[n] (n=0..7) or used as IV for AES MAC.


Bit number				31	30	29	28	27	26	25	24	23	22	21	20	19	18	17	16	15	14	13	12	11	10	9	8	7	6	5	4	3	2	1	0
ID																																			A
Reset 0x00000000				0	0	0	0	0	0	0	0	0	0	0	0	0	0	0	0	0	0	0	0	0	0	0	0	0	0	0	0	0	0	0	0
ID	R/W	Field	Value ID	Value								Description
A	W	LOAD										Enable loading of data to initial state registers. Digest/IV for HASH/AES_MAC. Disable this register when loading of data using DIN DMA is done.
			Disable	0								Disable loading of data to initial state registers.
			Enable	1								Enable loading of data to initial state registers.

HASH_VERSION

Address offset: 0x7B0

HASH engine HW version


Bit number				31	30	29	28	27	26	25	24	23	22	21	20	19	18	17	16	15	14	13	12	11	10	9	8	7	6	5	4	3	2	1	0
ID																				C	C	C	C	B	B	B	B	A	A	A	A	A	A	A	A
Reset 0x00000000				0	0	0	0	0	0	0	0	0	0	0	0	0	0	0	0	0	0	0	0	0	0	0	0	0	0	0	0	0	0	0	0
ID	R/W	Field	Value ID	Value								Description
A	R	PATCH
B	R	MINOR_VERSION_NUMBER										Minor version number
C	R	MAJOR_VERSION_NUMBER										Major version number

HASH_CONTROL

Address offset: 0x7C0

Control the HASH engine behavior.


Bit number				31	30	29	28	27	26	25	24	23	22	21	20	19	18	17	16	15	14	13	12	11	10	9	8	7	6	5	4	3	2	1	0
ID																																A	A	A	A
Reset 0x00000000				0	0	0	0	0	0	0	0	0	0	0	0	0	0	0	0	0	0	0	0	0	0	0	0	0	0	0	0	0	0	0	0
ID	R/W	Field	Value ID	Value								Description
A	RW	MODE										Select HASH mode to execute
			SHA1	1								Select SHA1 mode
			SHA256	2								Select SHA256 mode
			SHA224	10								Select SHA224 mode

HASH_PAD

Address offset: 0x7C4

Enable the hardware padding feature of the HASH engine.


Bit number				31	30	29	28	27	26	25	24	23	22	21	20	19	18	17	16	15	14	13	12	11	10	9	8	7	6	5	4	3	2	1	0
ID																																			A
Reset 0x00000001				0	0	0	0	0	0	0	0	0	0	0	0	0	0	0	0	0	0	0	0	0	0	0	0	0	0	0	0	0	0	0	1
ID	R/W	Field	Value ID	Value								Description
A	RW	ENABLE										Configure hardware padding feature.
			Disable	0								Disable hardware padding feature.
			Enable	1								Enable hardware padding feature.

HASH_PAD_FORCE

Address offset: 0x7C8

Force the hardware padding operation to trigger if the input data length is zero bytes.

This feature can only be used if HASH_PAD is enabled, and must be disabled after a digest operation is completed.


Bit number				31	30	29	28	27	26	25	24	23	22	21	20	19	18	17	16	15	14	13	12	11	10	9	8	7	6	5	4	3	2	1	0
ID																																	A
Reset 0x00000000				0	0	0	0	0	0	0	0	0	0	0	0	0	0	0	0	0	0	0	0	0	0	0	0	0	0	0	0	0	0	0	0
ID	R/W	Field	Value ID	Value								Description
A	RW	ENABLE										Trigger hardware padding operation. Disable this register when the digest operation is completed.
			Disable	0								Do not force hardware padding to trigger.
			Enable	1								Force hardware padding to trigger.

HASH_CUR_LEN_0

Address offset: 0x7CC

Bits [31:0] of the number of bytes that have been digested so far.


Bit number				31	30	29	28	27	26	25	24	23	22	21	20	19	18	17	16	15	14	13	12	11	10	9	8	7	6	5	4	3	2	1	0
ID				A	A	A	A	A	A	A	A	A	A	A	A	A	A	A	A	A	A	A	A	A	A	A	A	A	A	A	A	A	A	A	A
Reset 0x00000000				0	0	0	0	0	0	0	0	0	0	0	0	0	0	0	0	0	0	0	0	0	0	0	0	0	0	0	0	0	0	0	0
ID	R/W	Field	Value ID	Value								Description
A	RW	VALUE										Bits [31:0] of current length of digested data in bytes.

HASH_CUR_LEN_1

Address offset: 0x7D0

Bits [63:32] of the number of bytes that have been digested so far.


Bit number				31	30	29	28	27	26	25	24	23	22	21	20	19	18	17	16	15	14	13	12	11	10	9	8	7	6	5	4	3	2	1	0
ID				A	A	A	A	A	A	A	A	A	A	A	A	A	A	A	A	A	A	A	A	A	A	A	A	A	A	A	A	A	A	A	A
Reset 0x00000000				0	0	0	0	0	0	0	0	0	0	0	0	0	0	0	0	0	0	0	0	0	0	0	0	0	0	0	0	0	0	0	0
ID	R/W	Field	Value ID	Value								Description
A	RW	VALUE										Bits [63:32] of current length of digested data in bytes.

HASH_HW_FLAGS

Address offset: 0x7DC

Hardware configuration of the HASH engine. Reset value holds the supported features.


Bit number				31	30	29	28	27	26	25	24	23	22	21	20	19	18	17	16	15	14	13	12	11	10	9	8	7	6	5	4	3	2	1	0
ID																	J	I	H	G	F	E	D	C	C	C	C	B	B	B	B	A	A	A	A
Reset 0x00012001				0	0	0	0	0	0	0	0	0	0	0	0	0	0	0	1	0	0	1	0	0	0	0	0	0	0	0	0	0	0	0	1
ID	R/W	Field	Value ID	Value								Description
A	R	CW										Indicates the number of concurrent words the hash is using to compute signature.
			One	1								One concurrent word used by hash during signature generation
			Two	2								Two concurrent words used by hash during signature generation
B	R	CH										Indicate if Hi adders are present for each Hi value or 1 adder is shared for all Hi.
			One	0								One Hi value is updated at a time.
			All	1								All Hi values are updated at the same time.
C	R	DW										Determine the granularity of word size.
			32Bits	0								32 bits word data.
			64Bits	1								64 bits word data.
D	R	SHA_512_EXISTS										If this flag is set, the engine include SHA-512 support.
E	R	PAD_EXISTS										If this flag is set, the engine include pad block support.
F	R	MD5_EXISTS										If this flag is set, the engine include MD5 support.
G	R	HMAC_EXISTS										If this flag is set, the engine include HMAC support.
H	R	SHA_256_EXISTS										If this flag is set, the engine include SHA-256 support.
I	R	HASH_COMPARE_EXISTS										If this flag is set, the engine include compare digest logic.
J	R	DUMP_HASH_TO_DOUT_EXISTS										If this flag is set, the engine include HASH to DOUT support.

HASH_SW_RESET

Address offset: 0x7E4

Reset the HASH engine.


Bit number				31	30	29	28	27	26	25	24	23	22	21	20	19	18	17	16	15	14	13	12	11	10	9	8	7	6	5	4	3	2	1	0
ID																																			A
Reset 0x00000000				0	0	0	0	0	0	0	0	0	0	0	0	0	0	0	0	0	0	0	0	0	0	0	0	0	0	0	0	0	0	0	0
ID	R/W	Field	Value ID	Value								Description
A	W	RESET										Writing any value to this address resets the HASH engine. The reset takes 4 CPU clock cycles to complete.
			Enable	1								Reset HASH engine.

HASH_ENDIANNESS

Address offset: 0x7E8

Configure the endianness of HASH data and padding generation.


Bit number				31	30	29	28	27	26	25	24	23	22	21	20	19	18	17	16	15	14	13	12	11	10	9	8	7	6	5	4	3	2	1	0
ID																																			A
Reset 0x00000001				0	0	0	0	0	0	0	0	0	0	0	0	0	0	0	0	0	0	0	0	0	0	0	0	0	0	0	0	0	0	0	1
ID	R/W	Field	Value ID	Value								Description
A	RW	ENDIAN										Endianness of HASH data and padding generation. The default value is little-endian.
			LittleEndian	0								Use little-endian format for data and padding
			BigEndian	1								Use big-endian format for data and padding

PKA engine

The Public Key Accelerator (PKA) engine is designed to accelerate asymmetric cryptographic algorithms.

The PKA design is a general purpose bignum modular ALU capable of supporting operand sizes between 128-3136 bits in the following operations:

Modular exponentiation/inversion
Modular/regular addition/subtraction
Modular/regular increment/decrement
Modular/regular multiplication/division
Logical operations (AND, OR, XOR, SHIFT)

The PKA engine can be used to hardware accelerate various arithmentic regular and modular mathematical operations involving very large numbers which are used in both RSA and Elliptic Curve Cryptographic (ECC) public-key cryptosystems.

Virtual memory mapping

The PKA engine uses virtual register mapping to facilitate flexible data management across a variety of cryptographic algorithms.

Figure 3. Virtual register mapping

All virtual registers must be defined and configured in the dedicated PKA SRAM before they can be accessed by the PKA engine during processing. This SRAM acts as a private memory pool for the PKA engine, where all other access is blocked during processing. The virtual registers are used as input for the PKA calculation and as a placeholder for intermediate and final results.

The PKA engine can be configured to perform multiple operations on virtual operand registers and store the result of the operation in a virtual result or intermediate result register. During the next iteration the PKA engine can then use an intermediate result register from a previous operation as a virtual operand register for further calculations. This re-mapping strategy enables the PKA engine to efficiently handle complex cryptographic operations.

In total there are 32 virtual registers that can be mapped to different PKA SRAM regions using register MEMORY_MAP[n] (n=0..31), denoted as virtual register R0 - R31. Four of these 32 virtual registers are special registers, and their register index mapping can be changed using register N_NP_T0_T1_ADDR:

N - holds the modulus number, by default mapped to virtual register R0. This register is used by the PKA engine for modular operations, and its modulus N value does not change during processing.
Np - holds the inverse modulus number, by default mapped to virtual register R1. This register is used by the PKA engine for the Barrett reduction algorithm, and its inverse modulus Np value does not change during processing.
T0 - temporary register, by default mapped to virtual register R30. This register is for internal use by the PKA engine.
T1 - temporary register, by default mapped to virtual register R31. This register is for internal use by the PKA engine.

All virtual registers must be 64 bits word size aligned, and the size of the virtual registers must be at least the size of the largest operand plus an extra 64 bits for internal PKA calculations. These extra 64 bits must be initialized to zero. This is applicable for all virtual registers R0 - R31. The configured virtual register size does not define the size of the operation, it only limits the largest operand size that can be used with the corresponding virtual register.

The memory map configuration can be altered dynamically by the PKA engine, depending on the operation. Not all virtual registers need to be configured for each operation. It is recommended to re-write the memory map configuration after a reset.

Engine operations

The PKA engine can perform multiple operations on operands stored in virtual registers.

PKA processing is triggered by writing to register OPCODE. This register contains both the PKA operation to perform, and which virtual register indexes to use as operand inputs, tag, and intermediate or final result output of the operation. Register PKA_DONE will indicate Processing until the PKA operation is done, after which the result can be read from the result register in PKA SRAM.

The following OPCODE virtual register indexes must be configured prior to starting the PKA engine:

Field REG_R configure which virtual register to use for storing an intermediate or final result.
Field REG_A and REG_B configure which virtual registers to use as operand input. The operand input fields can be interpreted by the PKA engine as constants instead of virtual register indexes by setting fields CONST_A and CONST_B for certain operations, as documented in the table below.
The size of the operands are set in field LEN, which must point to one of the pre-configured operand sizes in bits configured in register PKA_L[n] (n=0..7).

OPCODE overview

Supported PKA operation codes and the corresponding required virtual register configurations.

Table 4. PKA OPCODE descriptions
OPCODE	Operation
Terminate	Terminate ongoing PKA operation
AddInc	Add or Increment ADD: `REG_R = REG_A + REG_B` INC: `REG_R = REG_A + 0x1`, when `REG_B` and `CONST_B` are 0x1
SubDecNeg	Subtract, Decrement, or Negate SUB: `REG_R = REG_A - REG_B` DEC: `REG_R = REG_A - 0x1`, when `REG_B` and `CONST_B` are 0x1 NEG: `REG_R = 0x0 - REG_B`, when `REG_A` is 0x0 and `CONST_A` is 0x1
ModAddInc	Modular Add or Modular Increment ModADD: `REG_R = (REG_A + REG_B) % REG_N` ModINC: `REG_R = (REG_A + 0x1) % REG_N`, when `REG_B` and `CONST_B` are 0x1
ModSubDecNeg	Modular Subtract, Modular Decrement, or Modular Negate ModSUB: `REG_R = (REG_A - REG_B) % REG_N` ModDEC: `REG_R = (REG_A - 0x1) % REG_N`, when `REG_B` and `CONST_B` is 0x1 ModNEG: `REG_R = (0x0 - REG_B) % REG_N`, when `REG_A` is 0x0
ANDTST0CLR0	And, Test bit 0, or Clear AND: `REG_R = REG_A & REG_B` TST0: `REG_R = REG_A & 0x1`, when `REG_B` is 0x1, and `CONST_B` is 0x1 CLR: `REG_R = 0x0`, when `REG_B` is 0x0 and `CONST_B` is 0x1. `REG_A` is ignored.
ORCOPYSET0	Or, Copy, or Set bit 0 OR: `REG_R = REG_A \| REG_B` COPY: `REG_R = REG_A`, when `REG_B` is 0x0 and `CONST_B` is 0x1. SET0: `REG_R = REG_A \| 0x1`, when `REG_B` and `CONST_B` is 0x1.
XORFLP0INVCMP	XOR, Flip bit 0, Invert, or Compare XOR: `REG_R = REG_A XOR REG_B` FLP0: `REG_R = REG_A XOR 0x1`, when `REG_B` and `CONST_B` is 0x1. INV: `REG_R = REG_A XOR 0xFFFFFFFF`, when `REG_B` is 0x1F and `CONST_B` is 0x1. CMP: `REG_A XOR REG_B`, when `DISCARD_R` is 0x1, result of comparison is provided by the `ALU_OUT_ZERO` flag in PKA_STATUS register.
SHR0	Shift right 0. This operation performs a logical right shift on the contents of `REG_A` by a specified number of bit positions and stores the result in `REG_R`. The leftmost bits of `REG_R` that are vacated by the shift operation are filled with zeros. `REG_R = REG_A >> s`, `CONST_B` must be set to 0x1. To perform `s` shifts, `REG_B` should be set to `s - 1` (where `1 <= s <= 31`).
SHR1	Shift right 1. This operation performs a logical right shift on the contents of `REG_A` by a specified number of bit positions and stores the result in `REG_R`. The leftmost bits of `REG_R` that are vacated by the shift operation are filled with ones. `REG_R = REG_A >> s`, `CONST_B` must be set to 0x1. To perform `s` shifts, `REG_B` should be set to `s - 1` (where `1 <= s <= 31`).
SHL0	Shift left 0. This operation performs a logical left shift on the contents of `REG_A` by a specified number of bit positions and stores the result in `REG_R`. The leftmost bits of `REG_R` that are vacated by the shift operation are filled with zeros. `REG_R = REG_A << s`, `CONST_B` must be set to 0x1. To perform `s` shifts, `REG_B` should be set to `s - 1` (where `1 <= s <= 31`).
SHL1	Shift left 1. This operation performs a logical left shift on the contents of `REG_A` by a specified number of bit positions and stores the result in `REG_R`. The leftmost bits of `REG_R` that are vacated by the shift operation are filled with ones. `REG_R = REG_A << s`, `CONST_B` must be set to 0x1. To perform `s` shifts, `REG_B` should be set to `s - 1` (where `1 <= s <= 31`).
MulLow	Multiply Low. This operation performs a multiplication of the values in `REG_A` and `REG_B` and stores the result in the destination register `REG_R`. Any bits of the product that exceed the operand size are discarded, effectively keeping only the least significant bits (LSBs) that fit within the operand size. `REG_R = (REG_A * REG_B) & operand size mask`
ModMul	Modular Multiply. `REG_R = (REG_A * REG_B) % REG_N`
ModMulN	The output of this operation is a number that is potentially larger than the modulus `N`, but guaranteed to be smaller than `2N`. Assuming `REG_A` and `REG_B` are already reduced modulo `N` or are less than `N`, the operation is simply `REG_R = (REG_A * REG_B)`.
ModExp	Modular Exponentiation. `REG_R = (REG_A ^ REG_B) % REG_N`
Division	Integer Division. This operation performs integer division of the value in `REG_A` by the value in `REG_B`. The quotient of the division is stored in `REG_R`, and the remainder is stored back in `REG_A`. `REG_R = REG_A / REG_B` `REG_A = REG_A % REG_B` If `REG_B` is zero (0x0), the operation is invalid, and the divide by zero bit in the status register is set to indicate a division error.
ModInv	Modular Inversion. `REG_R = 1/REG_B % REG_N`
ModDiv	Modular division is done by calculating the modular inverse of the divisor, check that the inverse value exists by examining the GCD, and then use modular multiplication to multiply the inverse result by the divided. `REG_A = (REG_A * REG_B^(-1)) % REG_N`
MulHigh	Multiply High. This operation multiplies `REG_A` by `REG_B` and captures the high-order bits of the result that exceed the operand size. It places these significant bits, along with an additional `PKA_WORD` number of bits, into the destination register `REG_R`. `REG_R = (REG_A * REG_B) >> operand size`
ModMLAC	Modular Multiplication Acceleration. Performs a modular multiplication and addition. `REG_C` is defined using the operation tag. `REG_R = ((REG_A * REG_B) + REG_C) % REG_N`
ModMLACNR	Modular Multiplication Acceleration No Reduction. Same as ModMLAC, but this omits the final reduction of the result.
Reduction	Reduction. This operation performs a modular reduction, where the result `REG_R` is the remainder of `REG_A` divided by `REG_N`. The length of the operation is flexible and can be chosen based on the specific requirements of the use case. `REG_R = REG_A % REG_N`

Pipeline configuration

The following section describe how the PKA engine is used to accelerate asymmetric cryptographic algorithms.

The PKA engine supports pipelined operations; the pipeline depth is one opcode, thus the next operation can be set up while the previous operation is executing. Register PKA_PIPE will indicate if the pipeline is ready for a new opcode and register PKA_DONE will indicate when the PKA operation has been completed and no operation is waiting in the pipeline.

Enable CRYPTOCELL subsystem as described in Cryptographic flow.
Initialize the PKA engine to accommodate the maximum bit size of all intended operations
1. Configure registers PKA_L[n] (n=0..7) for all required operand bit sizes. The desired operand length is selected using field LEN in register OPCODE.
2. Define the PKA SRAM memory map partitioning using register MEMORY_MAP[n] (n=0..31) for register N, Np, T0, and T1, as well as any other virtual registers intended to be used in the operations. The PKA SRAM memory map partitioning must allow for the max operand bit size plus an additional 64 bits reserved for PKA engine internal calculations.
For all operations
1. Load the PKA SRAM virtual registers N and Np as required
2. Load the remaining PKA SRAM virtual registers as required
3. Execute the operation by writing register OPCODE
4. Prepare the next opcode once register PKA_PIPE is ready.
5. Handle any status bits in register PKA_STATUS
6. Re-use intermediate results of the previous operation as needed.
Wait for the operation to complete by either polling register PKA_DONE, or by unmasking the interrupt for field PKA_MASK in register IMR
Read the result from the result register.

PKA SRAM

The 4 kB PKA SRAM memory connected to the PKA engine is used exclusively by the engine during cryptographic operations. All access to this memory is blocked while the PKA engine is processing.

The PKA SRAM memory is not directly mapped to the device memory map. Instead, any read or write operation to this memory region must be done using the PKA engine.

Writing data to the PKA SRAM involves the following steps:

Set the Address Offset: Specify the starting byte address for writing by setting register PKA_SRAM_WADDR. An offset value of 0x0 points to the first 32-bits word in the PKA SRAM memory. An offset value of 0x10 points to the fourth 32-bits word in the PKA SRAM memory.
Write Data: After setting the address offset, data is written to register PKA_SRAM_WDATA. The address will automatically increment after each write, allowing writes to the next word without needing to set the offset again.

Reading data from the PKA SRAM involves the following steps:

Set the Read Address: Specify the starting byte address for reading by setting register PKA_SRAM_RADDR
Read Data: Retrieve the data from register PKA_SRAM_RDATA. Similar to the write address, the read address will auto-increment with each read, setting it to the next word.

Note: Before switching from writing to reading operations (or vice versa), the PKA SRAM write buffer must be cleared. This is done using register PKA_SRAM_WCLEAR. Clearing the buffer ensures that the next operation starts cleanly without any leftover data from the previous operation.

Cryptographic flow

The following section describe a simple cryptographic flow for this engine.


        
        /* Enable CRYPTOCELL and its PKA engine */
        NRF_CRYPTOCELL->ENABLE = CRYPTOCELL_ENABLE_ENABLE_Enabled;
        NRF_CC_MISC->PKA_CLK = CC_MISC_PKA_CLK_ENABLE_Enable;
    
        /* Define the operand bit size as 2048 */
        NRF_CC_PKA->PKA_L[1] = 0x800;
    
        /* Define the 32-bits PKA SRAM address of the selected R4 and R5 */
        NRF_CC_PKA->MEMORY_MAP[4] = 0x108;
        NRF_CC_PKA->MEMORY_MAP[5] = 0x14A;
    
        /* Initialize the SRAM registers with one word of data */
        NRF_CC_PKA->PKA_SRAM_WADDR = NRF_CC_PKA->MEMORY_MAP[4];
        NRF_CC_PKA->PKA_SRAM_WDATA = 0x5;
        NRF_CC_PKA->PKA_SRAM_WADDR = NRF_CC_PKA->MEMORY_MAP[5];
        NRF_CC_PKA->PKA_SRAM_WDATA = 0x2;
    
        /* Execute subtract, OPCODE SubDecNeg: R4 = R4 - R5 */
        NRF_CC_PKA->OPCODE =
            (4 << CC_PKA_OPCODE_REG_R_Pos) |
            (5 << CC_PKA_OPCODE_REG_B_Pos) |
            (4 << CC_PKA_OPCODE_REG_A_Pos) |
            (1 << CC_PKA_OPCODE_LEN_Pos)   |
            (CC_PKA_OPCODE_OPCODE_SubDecNeg << CC_PKA_OPCODE_OPCODE_Pos);
    
        /* Wait for operation to complete, result will be in R4 */
        while (!NRF_CC_PKA->PKA_DONE) { }

This cryptographic flow example perform a subtract operation with the following assumptions:

All PKA SRAM registers, including the special virtual registers N, Np, T0, and T1, have been cleared before the operation is run.
The operation is using index 1 in register PKA_L[n] (n=0..7), which is set to accommodate an operand size of 2048 bits.
Register R4 and R5 have been selected to run this operation. Register R4 is used both as the operand A register and the result register.
The memory map is configured to allow operands of 2048 bits plus an additional 64 bits for the internal PKA engine calculations. The configuration of the MEMORY_MAP[n] (n=0..31) for virtual register N, Np, T0, and T1 is not included in the example. The memory map is thus configured with 66 words per register, leading to the following:

Virtual register	Memory map register	PKA SRAM address
N (R0)	MEMORY_MAP[0]	0x0
Np (R1)	MEMORY_MAP[1]	0x42
...	...	...
R4	MEMORY_MAP[4]	0x108
R5	MEMORY_MAP[5]	0x14A
...	...	...

Registers

Instances


Instance	Base address	TrustZone			Split access	Description
Instance	Base address	Map	Att	DMA	Split access	Description
CC_PKA	0x50841000	HF	S	NSA	No	CRYPTOCELL PKA engine

Register overview


Register	Offset	Description
MEMORY_MAP[n]	0x0	Register for mapping the virtual register R[n] to a physical address in the PKA SRAM.
OPCODE	0x80	Operation code to be executed by the PKA engine. Writing to this register triggers the PKA operation.
N_NP_T0_T1_ADDR	0x84	This register defines the N, Np, T0, and T1 virtual register index.
PKA_STATUS	0x88	This register holds the status for the PKA pipeline.
PKA_SW_RESET	0x8C	Reset the PKA engine.
PKA_L[n]	0x90	This register holds the operands bit size.
PKA_PIPE	0xB0	Status register indicating if the PKA pipeline is ready to receive a new OPCODE.
PKA_DONE	0xB4	Status register indicating if the PKA operation has been completed.
PKA_VERSION	0xC4	PKA engine HW version. Reset value holds the version.
PKA_SRAM_WADDR	0xD4	Start address in PKA SRAM for subsequent write transactions.
PKA_SRAM_WDATA	0xD8	Write data to PKA SRAM. Writing to this register triggers a DMA transaction writing data into PKA SRAM. The DMA address offset is automatically incremented during write.
PKA_SRAM_RDATA	0xDC	Read data from PKA SRAM. Reading from this register triggers a DMA transaction read data from PKA SRAM. The DMA address offset is automatically incremented during read.
PKA_SRAM_WCLEAR	0xE0	Register for clearing PKA SRAM write buffer.
PKA_SRAM_RADDR	0xE4	Start address in PKA SRAM for subsequent read transactions.

MEMORY_MAP[n] (n=0..31)

Address offset: 0x0 + (n × 0x4)


Bit number				31	30	29	28	27	26	25	24	23	22	21	20	19	18	17	16	15	14	13	12	11	10	9	8	7	6	5	4	3	2	1	0
ID																										A	A	A	A	A	A	A	A	A
Reset 0x00000000				0	0	0	0	0	0	0	0	0	0	0	0	0	0	0	0	0	0	0	0	0	0	0	0	0	0	0	0	0	0	0	0
ID	R/W	Field	Value ID	Value								Description
A	RW	ADDR										The physical word address used for the virtual register.

OPCODE

Address offset: 0x80

Operation code to be executed by the PKA engine.

Writing to this register triggers the PKA operation.


Bit number				31	30	29	28	27	26	25	24	23	22	21	20	19	18	17	16	15	14	13	12	11	10	9	8	7	6	5	4	3	2	1	0
ID				I	I	I	I	I	H	H	H	G	F	F	F	F	F	E	D	D	D	D	D	C	B	B	B	B	B	A	A	A	A	A	A
Reset 0x00000000				0	0	0	0	0	0	0	0	0	0	0	0	0	0	0	0	0	0	0	0	0	0	0	0	0	0	0	0	0	0	0	0
ID	R/W	Field	Value ID	Value								Description
A	RW	TAG										Holds the operation tag or the operand C virtual register index.
B	RW	REG_R										Result register virtual register index.
C	RW	DISCARD_R										This field controls the interpretation of REG_R.
			Register	0x0								REG_R is intepreted as a register index.
			Discard	0x1								Result is discarded.
D	RW	REG_B										Operand B virtual register index.
E	RW	CONST_B										This field controls the interpretation of REG_B.
			Register	0x0								REG_B is intepreted as a register index.
			Constant	0x1								REG_B is intepreted as a constant.
F	RW	REG_A										Operand A virtual register index.
G	RW	CONST_A										This field controls the interpretation of REG_A.
			Register	0x0								REG_A is intepreted as a register index.
			Constant	0x1								REG_A is intepreted as a constant.
H	RW	LEN										The length of the operands. This value serves as an PKA length register index. E.g.: if LEN field value is set to 0, PKA_L[0] holds the size of the operands.
I	RW	OPCODE										Operation code to be executed by the PKA engine
			Terminate	0x0								Terminate operation
			AddInc	0x4								Add or Increment
			SubDecNeg	0x5								Subtract, Decrement, or Negate
			ModAddInc	0x6								Modular Add or Modular Increment
			ModSubDecNeg	0x7								Modular Subtract, Modular Decrement, or Modular Negate
			ANDTST0CLR0	0x8								Perform AND, test, or clear
			ORCOPYSET0	0x9								Perform OR, copy, or set bits
			XORFLP0INVCMP	0xA								Perform XOR, flip bits, invert, or compare
			SHR0	0xC								Shift right 0 operation
			SHR1	0xD								Shift right 1 operation
			SHL0	0xE								Shift left 0 operation
			SHL1	0xF								Shift left 1 operation
			MulLow	0x10								Multiply low operation
			ModMul	0x11								Modular multiply operation
			ModMulN	0x12								Modular multiply N operation
			ModExp	0x13								Modular exponentiation operation
			Division	0x14								Division operation
			ModInv	0x15								Modular inversion operation
			ModDiv	0x16								Modular division operation
			MulHigh	0x17								Multiply high operation
			ModMLAC	0x18								Modular multiplication acceleration
			ModMLACNR	0x19								Modular multiplication acceleration where final reduction is omitted
			Reduction	0x1B								Reduction operation

N_NP_T0_T1_ADDR

Address offset: 0x84

This register defines the N, Np, T0, and T1 virtual register index.


Bit number				31	30	29	28	27	26	25	24	23	22	21	20	19	18	17	16	15	14	13	12	11	10	9	8	7	6	5	4	3	2	1	0
ID																D	D	D	D	D	C	C	C	C	C	B	B	B	B	B	A	A	A	A	A
Reset 0x000FF820				0	0	0	0	0	0	0	0	0	0	0	0	1	1	1	1	1	1	1	1	1	0	0	0	0	0	1	0	0	0	0	0
ID	R/W	Field	Value ID	Value								Description
A	RW	N_VIRTUAL_ADDR										Register N virtual register index. Default is R0.
B	RW	NP_VIRTUAL_ADDR										Register Np virtual register index. Default is R1.
C	RW	T0_VIRTUAL_ADDR										Temporary register 0 virtual register index. Default is R30.
D	RW	T1_VIRTUAL_ADDR										Temporary register 1 virtual register index. Default is R31.

PKA_STATUS

Address offset: 0x88

This register holds the status for the PKA pipeline.


Bit number				31	30	29	28	27	26	25	24	23	22	21	20	19	18	17	16	15	14	13	12	11	10	9	8	7	6	5	4	3	2	1	0
ID															K	K	K	K	K	J	I	H	G	F	E	D	C	B	B	B	B	A	A	A	A
Reset 0x00001000				0	0	0	0	0	0	0	0	0	0	0	0	0	0	0	0	0	0	0	1	0	0	0	0	0	0	0	0	0	0	0	0
ID	R/W	Field	Value ID	Value								Description
A	R	ALU_MSB_4BITS										The most significant 4-bits of the operand updated in shift operation.
B	R	ALU_LSB_4BITS										The least significant 4-bits of the operand updated in shift operation.
C	R	ALU_SIGN_OUT										Indicates the MSB sign of the last operation.
D	R	ALU_CARRY										Holds the carry of the last ALU operation.
E	R	ALU_CARRY_MOD										Holds the carry of the last modular operation.
F	R	ALU_SUB_IS_ZERO										Indicates the last subtraction operation sign.
G	R	ALU_OUT_ZERO										Indicates if the result of ALU OUT is zero.
H	R	ALU_MODOVRFLW										Modular overflow flag.
I	R	DIV_BY_ZERO										Indication if the division is done by zero.
J	R	MODINV_OF_ZERO										Indicates the modular inverse of zero.
K	R	OPCODE										Opcode of the last operation

PKA_SW_RESET

Address offset: 0x8C

Reset the PKA engine.


Bit number				31	30	29	28	27	26	25	24	23	22	21	20	19	18	17	16	15	14	13	12	11	10	9	8	7	6	5	4	3	2	1	0
ID																																			A
Reset 0x00000000				0	0	0	0	0	0	0	0	0	0	0	0	0	0	0	0	0	0	0	0	0	0	0	0	0	0	0	0	0	0	0	0
ID	R/W	Field	Value ID	Value								Description
A	W	RESET										Writing any value to this address resets the PKA engine. The reset takes 4 CPU clock cycles to complete.
			Enable	1								Reset PKA engine.

PKA_L[n] (n=0..7)

Address offset: 0x90 + (n × 0x4)

This register holds the operands bit size.


Bit number				31	30	29	28	27	26	25	24	23	22	21	20	19	18	17	16	15	14	13	12	11	10	9	8	7	6	5	4	3	2	1	0
ID																							A	A	A	A	A	A	A	A	A	A	A	A	A
Reset 0x00000000				0	0	0	0	0	0	0	0	0	0	0	0	0	0	0	0	0	0	0	0	0	0	0	0	0	0	0	0	0	0	0	0
ID	R/W	Field	Value ID	Value								Description
A	RW	OpSize										Operand bit size.

PKA_PIPE

Address offset: 0xB0

Status register indicating if the PKA pipeline is ready to receive a new OPCODE.


Bit number				31	30	29	28	27	26	25	24	23	22	21	20	19	18	17	16	15	14	13	12	11	10	9	8	7	6	5	4	3	2	1	0
ID																																			A
Reset 0x00000001				0	0	0	0	0	0	0	0	0	0	0	0	0	0	0	0	0	0	0	0	0	0	0	0	0	0	0	0	0	0	0	1
ID	R/W	Field	Value ID	Value								Description
A	R	STATUS										PKA pipeline status.
			NotReady	0								PKA pipeline is not ready for a new OPCODE
			Ready	1								PKA pipeline is ready for a new OPCODE

PKA_DONE

Address offset: 0xB4

Status register indicating if the PKA operation has been completed.


Bit number				31	30	29	28	27	26	25	24	23	22	21	20	19	18	17	16	15	14	13	12	11	10	9	8	7	6	5	4	3	2	1	0
ID																																			A
Reset 0x00000001				0	0	0	0	0	0	0	0	0	0	0	0	0	0	0	0	0	0	0	0	0	0	0	0	0	0	0	0	0	0	0	1
ID	R/W	Field	Value ID	Value								Description
A	R	STATUS										PKA operation status.
			Processing	0								PKA operation is processing
			Completed	1								PKA operation is completed and pipeline is empty

PKA_VERSION

Address offset: 0xC4

PKA engine HW version. Reset value holds the version.


Bit number				31	30	29	28	27	26	25	24	23	22	21	20	19	18	17	16	15	14	13	12	11	10	9	8	7	6	5	4	3	2	1	0
ID				A	A	A	A	A	A	A	A	A	A	A	A	A	A	A	A	A	A	A	A	A	A	A	A	A	A	A	A	A	A	A	A
Reset 0x16110215				0	0	0	1	0	1	1	0	0	0	0	1	0	0	0	1	0	0	0	0	0	0	1	0	0	0	0	1	0	1	0	1
ID	R/W	Field	Value ID	Value								Description
A	R	PKA_VERSION

PKA_SRAM_WADDR

Address offset: 0xD4

Start address in PKA SRAM for subsequent write transactions.


Bit number				31	30	29	28	27	26	25	24	23	22	21	20	19	18	17	16	15	14	13	12	11	10	9	8	7	6	5	4	3	2	1	0
ID				A	A	A	A	A	A	A	A	A	A	A	A	A	A	A	A	A	A	A	A	A	A	A	A	A	A	A	A	A	A	A	A
Reset 0x00000000				0	0	0	0	0	0	0	0	0	0	0	0	0	0	0	0	0	0	0	0	0	0	0	0	0	0	0	0	0	0	0	0
ID	R/W	Field	Value ID	Value								Description
A	W	ADDR										PKA SRAM start address for write transaction

PKA_SRAM_WDATA

Address offset: 0xD8

Write data to PKA SRAM. Writing to this register triggers a DMA transaction writing data into PKA SRAM. The DMA address offset is automatically incremented during write.


Bit number				31	30	29	28	27	26	25	24	23	22	21	20	19	18	17	16	15	14	13	12	11	10	9	8	7	6	5	4	3	2	1	0
ID				A	A	A	A	A	A	A	A	A	A	A	A	A	A	A	A	A	A	A	A	A	A	A	A	A	A	A	A	A	A	A	A
Reset 0x00000000				0	0	0	0	0	0	0	0	0	0	0	0	0	0	0	0	0	0	0	0	0	0	0	0	0	0	0	0	0	0	0	0
ID	R/W	Field	Value ID	Value								Description
A	W	DATA										Data to write to PKA SRAM.

PKA_SRAM_RDATA

Address offset: 0xDC

Read data from PKA SRAM. Reading from this register triggers a DMA transaction read data from PKA SRAM. The DMA address offset is automatically incremented during read.


Bit number				31	30	29	28	27	26	25	24	23	22	21	20	19	18	17	16	15	14	13	12	11	10	9	8	7	6	5	4	3	2	1	0
ID				A	A	A	A	A	A	A	A	A	A	A	A	A	A	A	A	A	A	A	A	A	A	A	A	A	A	A	A	A	A	A	A
Reset 0x00000000				0	0	0	0	0	0	0	0	0	0	0	0	0	0	0	0	0	0	0	0	0	0	0	0	0	0	0	0	0	0	0	0
ID	R/W	Field	Value ID	Value								Description
A	R	DATA										Data to read from PKA SRAM

PKA_SRAM_WCLEAR

Address offset: 0xE0


Bit number				31	30	29	28	27	26	25	24	23	22	21	20	19	18	17	16	15	14	13	12	11	10	9	8	7	6	5	4	3	2	1	0
ID				A	A	A	A	A	A	A	A	A	A	A	A	A	A	A	A	A	A	A	A	A	A	A	A	A	A	A	A	A	A	A	A
Reset 0x00000000				0	0	0	0	0	0	0	0	0	0	0	0	0	0	0	0	0	0	0	0	0	0	0	0	0	0	0	0	0	0	0	0
ID	R/W	Field	Value ID	Value								Description
A	W	CLEAR										Clear the PKA SRAM write buffer.

PKA_SRAM_RADDR

Address offset: 0xE4

Start address in PKA SRAM for subsequent read transactions.


Bit number				31	30	29	28	27	26	25	24	23	22	21	20	19	18	17	16	15	14	13	12	11	10	9	8	7	6	5	4	3	2	1	0
ID				A	A	A	A	A	A	A	A	A	A	A	A	A	A	A	A	A	A	A	A	A	A	A	A	A	A	A	A	A	A	A	A
Reset 0x00000000				0	0	0	0	0	0	0	0	0	0	0	0	0	0	0	0	0	0	0	0	0	0	0	0	0	0	0	0	0	0	0	0
ID	R/W	Field	Value ID	Value								Description
A	W	ADDR										PKA SRAM start address for read transaction

RNG engine

CRYPTOCELL implements a Random Number Generator (RNG) engine which uses a True Random Number Generator (TRNG) for its entropy collection.

The TRNG is a full entropy design compliant with:

FIPS 140-2: Security requirements for Cryptographic Modules
BSI AIS-31: Functionality Classes and Evaluation Methodology for True Random Number Generators
NIST SP 800-90B: Recommendation for the Entropy Sources Used for Random Bit Generation

where a ring-oscillator is used as the noise source.

The entropy collected using the RNG engine can in turn be used for seeding a Pseudo Random Number Generator (PRNG) as defined in NIST SP 800-90A: Recommendation for Random Number Generation Using Deterministic Random Bit Generators.

NIST SP 800-90A define three Deterministic Random Bit Generator (DRBG) that are considered cryptographically secure pseudorandom number generators for use in cryptography: Hash DRBG, HMAC DRBG, and CTR DRBG.

The CRYPTOCELL DRBG implementation is a combination of hardware and software, where CTR DRBG is implemented using the the AES engine running AES encryption in counter (CTR) mode as the underlying cipher. This DRBG instance is seeded with random entropy from the RNG engine.

Ring oscillator length configuration

The RNG engine must be configured with specific parameters to ensure correct operation in order to output random bits with sufficient entropy.

The noise source used for collecting entropy is based on inverter timing jitter that is collected from a dedicated on-chip free-running ring oscillator. The ring oscillator length, i.e. the number of inverters in the chain, can be configured using register TRNG_CONFIG.

In total there are four different ring oscillator lengths that can be selected, referred to as ROSC1 through ROSC4. For each of these four configurable lengths a corresponding sample count value is provided in register TRNG90B.ROSC1 through register TRNG90B.ROSC4.

The sampling frequency is configured using register SAMPLE_CNT, and the programmed value defines the number of CPU clock cycles between two consecutive ring oscillator samples. The configured sample count value is the minimum number of clock cycles that is enough to get independent outputs from the ring oscillator and must match that of the configured ROSC length.

The following steps describe how to set the RNG engine parameters described above:

Enable RNG engine clock using register RNG_CLK.
Reset the RNG engine using register RNG_SW_RESET.
Re-enable RNG engine clock and select a device-specific sample count from registers TRNG90B.ROSC1 through TRNG90B.ROSC4 starting with the smallest one, and program the value into register SAMPLE_CNT.
Perform a readback of the selected sample count value.
Set the corresponding ROSC length in register TRNG_CONFIG to match the selected sample count selection.
Enable the noise source using register NOISE_SOURCE.
Wait until event EHR_VALID_INT in register RNG_ISR trigger to indicate successful collection of 192 bits of random data. The result can be read from registers EHR_DATA[n] (n=0..5).
If events AUTOCORR_ERR_INT, CRNGT_ERR_INT, or VNC_ERR_INT in register RNG_ISR trigger, the RNG engine must be re-configured starting from step 2 above. Increase the ROSC length by a factor of one, and pick the corresponding sample count value from FICR. This step must be repeated until the collection of 192 bits of random data can be collected without an error event being triggered.

It is recommended to always try the shortest ROSC length first, allowing the RNG engine to complete the entropy collection in a shorter time and keep the ring oscillator turned off for longer periods in order to save power.

RNG SRAM

The 2 kB SRAM memory connected to the RNG engine can be used for storing a large pool of random entropy.

The RNG SRAM memory is not directly mapped to the device memory map. Instead, any read or write operation using word granularity to this memory region must be done using RNG SRAM interface. Larger payloads than word granularity can be processed using the DIN DMA engine and DOUT DMA engine.

Before any RNG SRAM read or write transaction can be performed, the CRYPTOCELL must be enabled.

Writing data to the RNG SRAM involves the following steps:

Set the Address Offset: Specify the starting byte address for writing by setting register SRAM_ADDR. An offset value of 0x0 points to the first 32-bits word in the RNG SRAM memory. An offset value of 0x10 points to the fourth 32-bits word in the RNG SRAM memory.
Write Data: When register SRAM_DATA_READY indicates DMA engine is idle, data is written to register SRAM_DATA. The address will automatically increment after each write, allowing writes to the next word without needing to set the offset again.

Reading data from the RNG SRAM involves the following steps:

Set the Read Address: Specify the starting byte address for reading by setting register SRAM_ADDR
Discard first read: Read and discard the first value from register SRAM_DATA, as it will contain the previous value pointed to by register SRAM_ADDR.
Read Data: When register SRAM_DATA_READY indicates DMA engine is idle, retrieve the data from register SRAM_DATA. Similar to the write address, the read address will auto-increment with each read, setting it to the next word.

Note: Once the address register reaches the last RNG SRAM address, the automatic address incrementation halts. Any subsequent read or write transaction will cause the DMA engine to continue operating on the last 32-bits word in the RNG SRAM memory.

TRNG hardware tests

The RNG engine has a number of built-in hardware tests for making sure the collected entropy from the TRNG is of sufficient quality.

Figure 4. CRYPTOCELL True Random Number Generator

The TRNG collects random bits from the noise source according to the programmed sample counter value in register SAMPLE_CNT. The sampled bits are post-processed in a von Neumann corrector (VNC) before being subjected to a continuous random number generation test (CRNGT) and autocorrelation test.

192 bits of random data can be read from the entropy holding registers EHR_DATA[n] (n=0..5) once interrupt EHR_VALID_INT in register RNG_ISR trigger. If this interrupt is masked away in register RNG_IMR, the status register TRNG_VALID contains field EHR_DATA which can be polled when the random data is valid. Reading the most significant word from EHR_DATA registers will reset register TRNG_VALID and a new 192 bits collection period will start.

Note:

To ensure proper operation when reading 192 bits of random data from the EHR_DATA registers of the RNG engine the data must be read in ascending order, starting with:

von Neumann Corrector

The von Neumann Corrector (VNC) is designed to balance the succession of '1' and '0' bits being output by the TRNG noise source.

The input bits to the VNC is tested for bit equality, meaning a sequence of 32 consequtive bits with the same bit value will trigger event VNC_ERR_INT in register RNG_ISR.

If no error event is triggered, the input bits will be balanced using the VNC as shown in the figure below, and the resulting output bits will be subjected to additional TRNG tests. The VNC produce output only if the noise source is active, see register NOISE_SOURCE.

Figure 5. CRYPTOCELL von Neumann corrector

The VNC statistically output one bit for each 4 input bits sampled, meaning the average output rate of the TRNG is 1/(SAMPLE_CNT * 4) bits per CPU clock cycle.

Continuous random number generation test

The Continuous random number generation test (CRNGT) process the balanced output of random data from the von Neumann corrector.

In the event that two consecutive blocks of 16 collected bits are equal, the CRNGT will trigger event CRNGT_ERR_INT in register RNG_ISR.

Autocorrelation test

The Autocorrelation test determine if there over time is a bias in the random bit sequences towards certain values or patterns, or if the bits in the sequence are truly independent.

If a bias in the collected bit stream is detected, the output will be discarded and the error flagged in register AUTOCORR_STATISTIC. If a bias is detected four consecutive times in a row, the autocorrelation test will trigger event AUTOCORR_ERR_INT in register RNG_ISR. In this situation the TRNG will cease to function until manually reset using register RNG_SW_RESET.

Cryptographic flow

The following section describe a simple cryptographic flow for this engine.


    
    /* Enable CRYPTOCELL subsystem */
    NRF_CRYPTOCELL->ENABLE = CRYPTOCELL_ENABLE_ENABLE_Enabled;

    /* Enable engine clock */
    NRF_CC_RNG->RNG_CLK = CC_RNG_RNG_CLK_ENABLE_Enable;

    /* Reset engine */
    NRF_CC_RNG->RNG_SW_RESET = CC_RNG_RNG_SW_RESET_RESET_Enable;

    /* Configure sampling rate between consecutive bits */
    do { 
        NRF_CC_RNG->RNG_CLK = CC_RNG_RNG_CLK_ENABLE_Enable;     
        NRF_CC_RNG->SAMPLE_CNT = NRF_FICR->TRNG90B.ROSC1;
    } while ( NRF_CC_RNG->SAMPLE_CNT != NRF_FICR->TRNG90B.ROSC1 );

    /* Configure ROSC length */
    NRF_CC_RNG->TRNG_CONFIG = CC_RNG_TRNG_CONFIG_ROSC_LEN_ROSC1;

    /* Enable noise source */
    NRF_CC_RNG->NOISE_SOURCE = CC_RNG_NOISE_SOURCE_ENABLE_Enabled;

    /* Wait for random data to be sampled */
    while ((NRF_CC_RNG->RNG_ISR & CC_RNG_RNG_ISR_EHR_VALID_INT_Msk) == 0) {}

    /* 192 bits of random data now available in
       NRF_CC_RNG->EHR_DATA[0] to NRF_CC_RNG->EHR_DATA[5] */

Registers

Instances


Instance	Base address	TrustZone			Split access	Description
Instance	Base address	Map	Att	DMA	Split access	Description
CC_RNG	0x50841000	HF	S	NSA	No	CRYPTOCELL RNG engine

Register overview


Register	Offset	Description
RNG_IMR	0x100	Interrupt mask register. Each bit of this register holds the mask of a single interrupt source.
RNG_ISR	0x104	Interrupt status register. Each bit of this register holds the interrupt status of a single interrupt source. If corresponding RNG_IMR bit is unmasked, an interrupt is generated.
RNG_ICR	0x108	Interrupt clear register. Writing a 1 bit into a field in this register will clear the corresponding bit in RNG_ISR.
TRNG_CONFIG	0x10C	TRNG ring oscillator length configuration
TRNG_VALID	0x110	This register indicates if TRNG entropy collection is valid.
EHR_DATA[n]	0x114	The entropy holding registers (EHR) hold 192-bits random data collected by the TRNG. The initial EHR_DATA[0] register holds the least significant bits [31:0] of the random data value.
NOISE_SOURCE	0x12C	This register controls the ring oscillator circuit used as a noise source.
SAMPLE_CNT	0x130	Sample count defining the number of CPU clock cycles between two consecutive noise source samples.
AUTOCORR_STATISTIC	0x134	Statistics counter for autocorrelation test activations. Statistics collection is stopped if one of the counters reach its limit of all ones.
TRNG_DEBUG	0x138	Debug register for the TRNG. This register is used to bypass TRNG tests in hardware.
RNG_SW_RESET	0x140	Reset the RNG engine.
RNG_BUSY	0x1B8	Status register for RNG engine activity.
TRNG_RESET	0x1BC	Reset the TRNG, including internal counter of collected bits and registers EHR_DATA and TRNG_VALID.
RNG_HW_FLAGS	0x1C0	Hardware configuration of RNG engine. Reset value holds the supported features.
RNG_CLK	0x1C4	Control clock for the RNG engine.
RNG_DMA	0x1C8	Writing to this register enables the RNG DMA engine.
RNG_DMA_ROSC_LEN	0x1CC	This register defines which ring oscillator length configuration should be used when using the RNG DMA engine.
RNG_DMA_SRAM_ADDR	0x1D0	This register defines the start address in TRNG SRAM for the TRNG data to be collected by the RNG DMA engine.
RNG_DMA_SAMPLES_NUM	0x1D4	This register defines the number of 192-bits samples that the RNG DMA engine collects per run.
RNG_WATCHDOG_VAL	0x1D8	This register defines the maximum number of CPU clock cycles per TRNG collection of 192-bits samples. If the number of cycles for a collection exceeds this threshold the WATCHDOG interrupt is triggered.
RNG_DMA_BUSY	0x1DC	Status register for RNG DMA engine activity.

RNG_IMR

Address offset: 0x100

Interrupt mask register. Each bit of this register holds the mask of a single interrupt source.


Bit number				31	30	29	28	27	26	25	24	23	22	21	20	19	18	17	16	15	14	13	12	11	10	9	8	7	6	5	4	3	2	1	0
ID																														F	E	D	C	B	A
Reset 0x0000003F				0	0	0	0	0	0	0	0	0	0	0	0	0	0	0	0	0	0	0	0	0	0	0	0	0	0	1	1	1	1	1	1
ID	R/W	Field	Value ID	Value								Description
A	RW	EHR_VALID_MASK										See RNG_ISR for explanation on this interrupt.
			IRQEnable	0								Do not mask EHR interrupt i.e. interrupt is generated
			IRQDisable	1								Mask EHR interrupt i.e. no interrupt is generated
B	RW	AUTOCORR_ERR_MASK										See RNG_ISR for explanation on this interrupt.
			IRQEnable	0								Do not mask autocorrelation interrupt i.e. interrupt is generated
			IRQDisable	1								Mask autocorrelation interrupt i.e. no interrupt is generated
C	RW	CRNGT_ERR_MASK										See RNG_ISR for explanation on this interrupt.
			IRQEnable	0								Do not mask the CRNGT error interrupt i.e. interrupt is generated
			IRQDisable	1								Mask the CRNGT error interrupt i.e. no interrupt is generated
D	RW	VNC_ERR_MASK										See RNG_ISR for explanation on this interrupt.
			IRQEnable	0								Do not mask the von Neumann corrector error interrupt i.e. interrupt is generated
			IRQDisable	1								Mask the von Neumann corrector error interrupt i.e. no interrupt is generated
E	RW	WATCHDOG_MASK										See RNG_ISR for explanation on this interrupt.
			IRQEnable	0								Do not mask the watchdog interrupt i.e. interrupt is generated
			IRQDisable	1								Mask the watchdog interrupt i.e. no interrupt is generated
F	RW	DMA_DONE_MASK										See RNG_ISR for explanation on this interrupt.
			IRQEnable	0								Do not mask the RNG DMA completion interrupt i.e. interrupt is generated
			IRQDisable	1								Mask the RNG DMA completion interrupt i.e. no interrupt is generated

RNG_ISR

Address offset: 0x104

Interrupt status register. Each bit of this register holds the interrupt status of a single interrupt source. If corresponding RNG_IMR bit is unmasked, an interrupt is generated.


Bit number				31	30	29	28	27	26	25	24	23	22	21	20	19	18	17	16	15	14	13	12	11	10	9	8	7	6	5	4	3	2	1	0
ID																														F	E	D	C	B	A
Reset 0x00000000				0	0	0	0	0	0	0	0	0	0	0	0	0	0	0	0	0	0	0	0	0	0	0	0	0	0	0	0	0	0	0	0
ID	R/W	Field	Value ID	Value								Description
A	R	EHR_VALID_INT										192-bits have been collected and are ready to be read.
B	R	AUTOCORR_ERR_INT										Autocorrelation error. Failure occurs when autocorrelation test has failed four times in a row. Once set, the TRNG ceases to function until next reset.
C	R	CRNGT_ERR_INT										Continuous random number generator test error. Failure occurs when two consecutive blocks of 16 collected bits are equal.
D	R	VNC_ERR_INT										von Neumann corrector error. Failure occurs if 32 consecutive collected bits are identical, ZERO, or ONE.
E	R	WATCHDOG_INT										Maximum number of CPU clock cycles per sample have been exceeded. See RNG_WATCHDOG_VAL for more information.
F	R	DMA_DONE_INT										RNG DMA to SRAM is completed.

RNG_ICR

Address offset: 0x108

Interrupt clear register. Writing a 1 bit into a field in this register will clear the corresponding bit in RNG_ISR.


Bit number				31	30	29	28	27	26	25	24	23	22	21	20	19	18	17	16	15	14	13	12	11	10	9	8	7	6	5	4	3	2	1	0
ID																														F	E	D	C	B	A
Reset 0x00000000				0	0	0	0	0	0	0	0	0	0	0	0	0	0	0	0	0	0	0	0	0	0	0	0	0	0	0	0	0	0	0	0
ID	R/W	Field	Value ID	Value								Description
A	W	EHR_VALID_CLEAR										Writing value '1' clears corresponding bit in RNG_ISR
B	W	AUTOCORR_ERR_CLEAR										Cannot be cleared by software! Only RNG reset clears this bit.
C	W	CRNGT_ERR_CLEAR										Writing value '1' clears corresponding bit in RNG_ISR
D	W	VNC_ERR_CLEAR										Writing value '1' clears corresponding bit in RNG_ISR
E	W	WATCHDOG_CLEAR										Writing value '1' clears corresponding bit in RNG_ISR
F	W	DMA_DONE_CLEAR										Writing value '1' clears corresponding bit in RNG_ISR

TRNG_CONFIG

Address offset: 0x10C

TRNG ring oscillator length configuration


Bit number				31	30	29	28	27	26	25	24	23	22	21	20	19	18	17	16	15	14	13	12	11	10	9	8	7	6	5	4	3	2	1	0
ID																																		A
Reset 0x00000000				0	0	0	0	0	0	0	0	0	0	0	0	0	0	0	0	0	0	0	0	0	0	0	0	0	0	0	0	0	0	0	0
ID	R/W	Field	Value ID	Value								Description
-A	RW	ROSC_LEN										Set the length of the oscillator ring (= the number of inverters) out of four possible configurations.
			ROSC1	0								Use shortest ROSC1 ring oscillator configuration.
			ROSC2	1								Use ROSC2 ring oscillator configuration.
			ROSC3	2								Use ROSC3 ring oscillator configuration.
			ROSC4	3								Use longest ROSC4 ring oscillator configuration.

TRNG_VALID

Address offset: 0x110

This register indicates if TRNG entropy collection is valid.


Bit number				31	30	29	28	27	26	25	24	23	22	21	20	19	18	17	16	15	14	13	12	11	10	9	8	7	6	5	4	3	2	1	0
ID																																			A
Reset 0x00000000				0	0	0	0	0	0	0	0	0	0	0	0	0	0	0	0	0	0	0	0	0	0	0	0	0	0	0	0	0	0	0	0
ID	R/W	Field	Value ID	Value								Description
A	R	EHR_DATA										A value of 1 indicates that collection of bits in the TRNG is completed, and data can be read from EHR_DATA registers.
			NotValid	0								Collection of bits not valid.
			Valid	1								Collection of bits valid.

EHR_DATA[n] (n=0..5)

Address offset: 0x114 + (n × 0x4)

The entropy holding registers (EHR) hold 192-bits random data collected by the TRNG.

The initial EHR_DATA[0] register holds the least significant bits [31:0] of the random data value.

These registers are readable if register TRNG_VALID is Valid. Reading register EHR_DATA[5] will clear the content, reset TRNG_VALID, and start a new 192 bits collection period.


Bit number				31	30	29	28	27	26	25	24	23	22	21	20	19	18	17	16	15	14	13	12	11	10	9	8	7	6	5	4	3	2	1	0
ID				A	A	A	A	A	A	A	A	A	A	A	A	A	A	A	A	A	A	A	A	A	A	A	A	A	A	A	A	A	A	A	A
Reset 0x00000000				0	0	0	0	0	0	0	0	0	0	0	0	0	0	0	0	0	0	0	0	0	0	0	0	0	0	0	0	0	0	0	0
ID	R/W	Field	Value ID	Value								Description
A	R	VALUE										Random data value.

NOISE_SOURCE

Address offset: 0x12C

This register controls the ring oscillator circuit used as a noise source.


Bit number				31	30	29	28	27	26	25	24	23	22	21	20	19	18	17	16	15	14	13	12	11	10	9	8	7	6	5	4	3	2	1	0
ID																																			A
Reset 0x00000000				0	0	0	0	0	0	0	0	0	0	0	0	0	0	0	0	0	0	0	0	0	0	0	0	0	0	0	0	0	0	0	0
ID	R/W	Field	Value ID	Value								Description
A	RW	ENABLE										Enable or disable the noise source.
			Disabled	0								Noise source is disabled
			Enabled	1								Noise source is enabled

SAMPLE_CNT

Address offset: 0x130

Sample count defining the number of CPU clock cycles between two consecutive noise source samples.

After selecting the desired ring oscillator length configuration in TRNG_CONFIG this register must be set to the corresponding value from FICR.TRNG90B.ROSC1-4.


Bit number				31	30	29	28	27	26	25	24	23	22	21	20	19	18	17	16	15	14	13	12	11	10	9	8	7	6	5	4	3	2	1	0
ID				A	A	A	A	A	A	A	A	A	A	A	A	A	A	A	A	A	A	A	A	A	A	A	A	A	A	A	A	A	A	A	A
Reset 0x0000FFFF				0	0	0	0	0	0	0	0	0	0	0	0	0	0	0	0	1	1	1	1	1	1	1	1	1	1	1	1	1	1	1	1
ID	R/W	Field	Value ID	Value								Description
A	RW	VALUE										Number of CPU clock cycles between two consecutive noise source samples. If the von Neumann corrector is bypassed, the minimum value set in this register must not be smaller than decimal 17.

AUTOCORR_STATISTIC

Address offset: 0x134

Statistics counter for autocorrelation test activations. Statistics collection is stopped if one of the counters reach its limit of all ones.


Bit number				31	30	29	28	27	26	25	24	23	22	21	20	19	18	17	16	15	14	13	12	11	10	9	8	7	6	5	4	3	2	1	0
ID														B	B	B	B	B	B	B	B	A	A	A	A	A	A	A	A	A	A	A	A	A	A
Reset 0x00000000				0	0	0	0	0	0	0	0	0	0	0	0	0	0	0	0	0	0	0	0	0	0	0	0	0	0	0	0	0	0	0	0
ID	R/W	Field	Value ID	Value								Description
A	RW	AUTOCORR_TRYS										Count each time an autocorrelation test starts. Any write to the field resets the counter.
B	RW	AUTOCORR_FAILS										Count each time an autocorrelation test fails. Any write to the field resets the counter.

TRNG_DEBUG

Address offset: 0x138

Debug register for the TRNG. This register is used to bypass TRNG tests in hardware.


Bit number				31	30	29	28	27	26	25	24	23	22	21	20	19	18	17	16	15	14	13	12	11	10	9	8	7	6	5	4	3	2	1	0
ID																																C	B	A
Reset 0x00000000				0	0	0	0	0	0	0	0	0	0	0	0	0	0	0	0	0	0	0	0	0	0	0	0	0	0	0	0	0	0	0	0
ID	R/W	Field	Value ID	Value								Description
A	RW	VNC_BYPASS										Bypass the von Neumann corrector post-processing test, including the 32 consecutive bits test.
			Disabled	0								von Neumann corrector post-processing is active
			Enabled	1								Bypass the von Neumann corrector
B	RW	CRNGT_BYPASS										Bypass the Continuous Random Number Generator Test (CRNGT).
			Disabled	0								CRNGT is active
			Enabled	1								Bypass CRNGT
C	RW	AUTOCORR_BYPASS										Bypass the autocorrelation test.
			Disabled	0								Autocorrelation test is active
			Enabled	1								Bypass the autocorrelation test

RNG_SW_RESET

Address offset: 0x140

Reset the RNG engine.


Bit number				31	30	29	28	27	26	25	24	23	22	21	20	19	18	17	16	15	14	13	12	11	10	9	8	7	6	5	4	3	2	1	0
ID																																			A
Reset 0x00000000				0	0	0	0	0	0	0	0	0	0	0	0	0	0	0	0	0	0	0	0	0	0	0	0	0	0	0	0	0	0	0	0
ID	R/W	Field	Value ID	Value								Description
A	W	RESET										Writing any value to this address resets the RNG engine. The reset takes 4 CPU clock cycles to complete.
			Enable	1								Reset RNG engine.

RNG_BUSY

Address offset: 0x1B8

Status register for RNG engine activity.


Bit number				31	30	29	28	27	26	25	24	23	22	21	20	19	18	17	16	15	14	13	12	11	10	9	8	7	6	5	4	3	2	1	0
ID																																		B
Reset 0x00000000				0	0	0	0	0	0	0	0	0	0	0	0	0	0	0	0	0	0	0	0	0	0	0	0	0	0	0	0	0	0	0	0
ID	R/W	Field	Value ID	Value								Description
	R	STATUS										RNG engine status.
			Idle	0								RNG engine is idle
			Busy	1								RNG engine is busy
B	R	TRNG_STATUS										TRNG status.
			Idle	0								TRNG is idle
			Busy	1								TRNG is busy

TRNG_RESET

Address offset: 0x1BC

Reset the TRNG, including internal counter of collected bits and registers EHR_DATA and TRNG_VALID.


Bit number				31	30	29	28	27	26	25	24	23	22	21	20	19	18	17	16	15	14	13	12	11	10	9	8	7	6	5	4	3	2	1	0
ID																																			A
Reset 0x00000000				0	0	0	0	0	0	0	0	0	0	0	0	0	0	0	0	0	0	0	0	0	0	0	0	0	0	0	0	0	0	0	0
ID	R/W	Field	Value ID	Value								Description
A	W	RESET										Writing any value to this address resets the internal bits counter and registers EHR_DATA and TRNG_VALID. Register NOISE_SOURCE must be disabled in order for the reset to take place.
			Enable	1								Reset TRNG.

RNG_HW_FLAGS

Address offset: 0x1C0

Hardware configuration of RNG engine. Reset value holds the supported features.


Bit number				31	30	29	28	27	26	25	24	23	22	21	20	19	18	17	16	15	14	13	12	11	10	9	8	7	6	5	4	3	2	1	0
ID																												H	G	F	E	D	C	B	A
Reset 0x0000000F				0	0	0	0	0	0	0	0	0	0	0	0	0	0	0	0	0	0	0	0	0	0	0	0	0	0	0	0	1	1	1	1
ID	R/W	Field	Value ID	Value								Description
A	R	EHR_WIDTH										Data width supported by the entropy collector
			128Bits	0								128 bits EHR width
			192Bits	1								192 bits EHR width
B	R	CRNGT_EXISTS										If this flag is set, the engine include support for continuous random number generator test.
C	R	AUTOCORR_EXISTS										If this flag is set, the engine include support for autocorrelation test.
D	R	BYPASS_EXISTS										If this flag is set, the engine include support for bypassing TRNG tests.
E	R	PRNG_EXISTS										If this flag is set, the engine include a pseudo-random number generator.
F	R	KAT_EXISTS										If this flag is set, the engine include support for known answer tests.
G	R	RESEEDING_EXISTS										If this flag is set, the engine include support for automatic reseeding.
H	R	RNG_USE_5_SBOXES
			Disable	0								20 SBOX AES
			Enable	1								5 SBOX AES

RNG_CLK

Address offset: 0x1C4

Control clock for the RNG engine.


Bit number				31	30	29	28	27	26	25	24	23	22	21	20	19	18	17	16	15	14	13	12	11	10	9	8	7	6	5	4	3	2	1	0
ID																																			A
Reset 0x00000000				0	0	0	0	0	0	0	0	0	0	0	0	0	0	0	0	0	0	0	0	0	0	0	0	0	0	0	0	0	0	0	0
ID	R/W	Field	Value ID	Value								Description
A	W	ENABLE										Enables clock for the RNG engine.
			Disable	0								Disable clock for RNG engine.
			Enable	1								Enable clock for RNG engine.

RNG_DMA

Address offset: 0x1C8

Writing to this register enables the RNG DMA engine.


Bit number				31	30	29	28	27	26	25	24	23	22	21	20	19	18	17	16	15	14	13	12	11	10	9	8	7	6	5	4	3	2	1	0
ID																																			A
Reset 0x00000000				0	0	0	0	0	0	0	0	0	0	0	0	0	0	0	0	0	0	0	0	0	0	0	0	0	0	0	0	0	0	0	0
ID	R/W	Field	Value ID	Value								Description
A	RW	ENABLE
			Disable	0								Disable RNG DMA engine
			Enable	1								Enable RNG DMA engine This value is cleared when the RNG DMA engine completes its operation.

RNG_DMA_ROSC_LEN

Address offset: 0x1CC

This register defines which ring oscillator length configuration should be used when using the RNG DMA engine.


Bit number				31	30	29	28	27	26	25	24	23	22	21	20	19	18	17	16	15	14	13	12	11	10	9	8	7	6	5	4	3	2	1	0
ID																																D	C	B	A
Reset 0x00000000				0	0	0	0	0	0	0	0	0	0	0	0	0	0	0	0	0	0	0	0	0	0	0	0	0	0	0	0	0	0	0	0
ID	R/W	Field	Value ID	Value								Description
A	RW	ROSC1										Use shortest ROSC1 ring oscillator configuration.
			Disable	0								Disable ROSC1
			Enable	1								Enable ROSC1
B	RW	ROSC2										Use ROSC2 ring oscillator configuration.
			Disable	0								Disable ROSC2
			Enable	1								Enable ROSC2
C	RW	ROSC3										Use ROSC3 ring oscillator configuration.
			Disable	0								Disable ROSC3
			Enable	1								Enable ROSC3
D	RW	ROSC4										Use longest ROSC4 ring oscillator configuration.
			Disable	0								Disable ROSC4
			Enable	1								Enable ROSC4

RNG_DMA_SRAM_ADDR

Address offset: 0x1D0

This register defines the start address in TRNG SRAM for the TRNG data to be collected by the RNG DMA engine.


Bit number				31	30	29	28	27	26	25	24	23	22	21	20	19	18	17	16	15	14	13	12	11	10	9	8	7	6	5	4	3	2	1	0
ID																									A	A	A	A	A	A	A	A	A	A	A
Reset 0x00000000				0	0	0	0	0	0	0	0	0	0	0	0	0	0	0	0	0	0	0	0	0	0	0	0	0	0	0	0	0	0	0	0
ID	R/W	Field	Value ID	Value								Description
A	RW	RNG_SRAM_DMA_ADDR										Start address of the TRNG data in TRNG SRAM.

RNG_DMA_SAMPLES_NUM

Address offset: 0x1D4

This register defines the number of 192-bits samples that the RNG DMA engine collects per run.


Bit number				31	30	29	28	27	26	25	24	23	22	21	20	19	18	17	16	15	14	13	12	11	10	9	8	7	6	5	4	3	2	1	0
ID																												A	A	A	A	A	A	A	A
Reset 0x00000000				0	0	0	0	0	0	0	0	0	0	0	0	0	0	0	0	0	0	0	0	0	0	0	0	0	0	0	0	0	0	0	0
ID	R/W	Field	Value ID	Value								Description
A	RW	RNG_SAMPLES_NUM										Defines the number of 192-bits samples that the DMA engine collects per run.

RNG_WATCHDOG_VAL

Address offset: 0x1D8

This register defines the maximum number of CPU clock cycles per TRNG collection of 192-bits samples. If the number of cycles for a collection exceeds this threshold the WATCHDOG interrupt is triggered.


Bit number				31	30	29	28	27	26	25	24	23	22	21	20	19	18	17	16	15	14	13	12	11	10	9	8	7	6	5	4	3	2	1	0
ID				A	A	A	A	A	A	A	A	A	A	A	A	A	A	A	A	A	A	A	A	A	A	A	A	A	A	A	A	A	A	A	A
Reset 0x00000000				0	0	0	0	0	0	0	0	0	0	0	0	0	0	0	0	0	0	0	0	0	0	0	0	0	0	0	0	0	0	0	0
ID	R/W	Field	Value ID	Value								Description
A	RW	RNG_WATCHDOG_VAL										Defines the maximum number of CPU clock cycles per TRNG collection of 192-bits samples. If the number of cycles for a collection exceeds this threshold the WATCHDOG interrupt is triggered.

RNG_DMA_BUSY

Address offset: 0x1DC

Status register for RNG DMA engine activity.


Bit number				31	30	29	28	27	26	25	24	23	22	21	20	19	18	17	16	15	14	13	12	11	10	9	8	7	6	5	4	3	2	1	0
ID																									C	C	C	C	C	C	C	C	B	B	A
Reset 0x00000000				0	0	0	0	0	0	0	0	0	0	0	0	0	0	0	0	0	0	0	0	0	0	0	0	0	0	0	0	0	0	0	0
ID	R/W	Field	Value ID	Value								Description
A	R	STATUS										RNG DMA engine status.
			Idle	0								RNG DMA engine is idle
			Busy	1								RNG DMA engine is busy
B	R	ROSC_LEN										The active ring oscillator length configuration used by the RNG DMA engine.
			ROSC1	0								Shortest ROSC1 ring oscillator configuration used.
			ROSC2	1								ROSC2 ring oscillator configuration used.
			ROSC3	2								ROSC3 ring oscillator configuration used.
			ROSC4	3								Longest ROSC4 ring oscillator configuration used.
C	R	NUM_OF_SAMPLES										Number of samples already collected using the current ring oscillator configuration.

Host integration

This chapter describes host registers used to control CRYPTOCELL behavior.

AHB interface

The AHB interface controls CRYPTOCELL bus master behavior.

Registers

Instances


Instance	Base address	TrustZone			Split access	Description
Instance	Base address	Map	Att	DMA	Split access	Description
CC_AHB	0x50841000	HF	S	NSA	No	CRYPTOCELL AHB interface

Register overview


Register	Offset	Description
AHBM_SINGLES	0xB00	This register forces the AHB transactions from CRYPTOCELL master to be always singles.
AHBM_HPROT	0xB04	This register holds the AHB HPROT value
AHBM_HMASTLOCK	0xB08	This register holds AHB HMASTLOCK value
AHBM_HNONSEC	0xB0C	This register holds AHB HNONSEC value

AHBM_SINGLES

Address offset: 0xB00

This register forces the AHB transactions from CRYPTOCELL master to be always singles.


Bit number				31	30	29	28	27	26	25	24	23	22	21	20	19	18	17	16	15	14	13	12	11	10	9	8	7	6	5	4	3	2	1	0
ID																																			A
Reset 0x00000000				0	0	0	0	0	0	0	0	0	0	0	0	0	0	0	0	0	0	0	0	0	0	0	0	0	0	0	0	0	0	0	0
ID	R/W	Field	Value ID	Value								Description
A	RW	AHB_SINGLES										Force AHB singles

AHBM_HPROT

Address offset: 0xB04

This register holds the AHB HPROT value


Bit number				31	30	29	28	27	26	25	24	23	22	21	20	19	18	17	16	15	14	13	12	11	10	9	8	7	6	5	4	3	2	1	0
ID																																A	A	A	A
Reset 0x00000000				0	0	0	0	0	0	0	0	0	0	0	0	0	0	0	0	0	0	0	0	0	0	0	0	0	0	0	0	0	0	0	0
ID	R/W	Field	Value ID	Value								Description
A	RW	AHB_HPROT										The AHB HPROT value

AHBM_HMASTLOCK

Address offset: 0xB08

This register holds AHB HMASTLOCK value


Bit number				31	30	29	28	27	26	25	24	23	22	21	20	19	18	17	16	15	14	13	12	11	10	9	8	7	6	5	4	3	2	1	0
ID																																			A
Reset 0x00000000				0	0	0	0	0	0	0	0	0	0	0	0	0	0	0	0	0	0	0	0	0	0	0	0	0	0	0	0	0	0	0	0
ID	R/W	Field	Value ID	Value								Description
A	RW	AHB_HMASTLOCK										The AHB HMASTLOCK value.

AHBM_HNONSEC

Address offset: 0xB0C

This register holds AHB HNONSEC value


Bit number				31	30	29	28	27	26	25	24	23	22	21	20	19	18	17	16	15	14	13	12	11	10	9	8	7	6	5	4	3	2	1	0
ID																																		B	A
Reset 0x00000000				0	0	0	0	0	0	0	0	0	0	0	0	0	0	0	0	0	0	0	0	0	0	0	0	0	0	0	0	0	0	0	0
ID	R/W	Field	Value ID	Value								Description
A	RW	AHB_WRITE_HNONSEC										The AHB HNONSEC value for write transaction.
B	RW	AHB_READ_HNONSEC										The AHB HNONSEC value for read transaction.

CTL interface

The CTL interface controls the cryptographic flow and provide busy status for individual components in the CRYPTOCELL subsystem.

Registers

Instances


Instance	Base address	TrustZone			Split access	Description
Instance	Base address	Map	Att	DMA	Split access	Description
CC_CTL	0x50841000	HF	S	NSA	No	CRYPTOCELL CTL interface

Register overview


Register	Offset	Description
CRYPTO_CTL	0x900	Defines the cryptographic flow.
CRYPTO_BUSY	0x910	Status register for cryptographic cores engine activity.
HASH_BUSY	0x91C	Status register for HASH engine activity.
CONTEXT_ID	0x930	A general-purpose read/write register.

CRYPTO_CTL

Address offset: 0x900

Defines the cryptographic flow.


Bit number				31	30	29	28	27	26	25	24	23	22	21	20	19	18	17	16	15	14	13	12	11	10	9	8	7	6	5	4	3	2	1	0
ID																															A	A	A	A	A
Reset 0x00000000				0	0	0	0	0	0	0	0	0	0	0	0	0	0	0	0	0	0	0	0	0	0	0	0	0	0	0	0	0	0	0	0
ID	R/W	Field	Value ID	Value								Description
A	W	MODE										Configure the cryptographic engine mode.
			Bypass	0								Bypass cryptographic engine
			AESActive	1								Use AES engine
			AESToHashActive	2								Pipe AES engine output to HASH engine input
			AESAndHashActive	3								Process input using both AES and HASH engine in parallell
			HashActive	7								Use HASH engine
			AESMACAndBypassActive	9								Calculate AES MAC and bypass
			AESToHashAndDOUTActive	10								Pipe AES engine output to HASH engine input. The resulting digest output is piped to DOUT buffer.
			ChaChaActive	16								Use CHACHA engine

CRYPTO_BUSY

Address offset: 0x910

Status register for cryptographic cores engine activity.

This register will be asserted whenever register AES_BUSY or register HASH_BUSY is asserted or when register DIN_FIFO_EMPTY indicate that the DIN FIFO is not empty.


Bit number				31	30	29	28	27	26	25	24	23	22	21	20	19	18	17	16	15	14	13	12	11	10	9	8	7	6	5	4	3	2	1	0
ID																																			A
Reset 0x00000000				0	0	0	0	0	0	0	0	0	0	0	0	0	0	0	0	0	0	0	0	0	0	0	0	0	0	0	0	0	0	0	0
ID	R/W	Field	Value ID	Value								Description
A	R	STATUS										Cryptographic core engines status.
			Idle	0								Cryptographic core engines are idle
			Busy	1								Cryptographic core engines are busy

HASH_BUSY

Address offset: 0x91C

Status register for HASH engine activity.


Bit number				31	30	29	28	27	26	25	24	23	22	21	20	19	18	17	16	15	14	13	12	11	10	9	8	7	6	5	4	3	2	1	0
ID																																			A
Reset 0x00000000				0	0	0	0	0	0	0	0	0	0	0	0	0	0	0	0	0	0	0	0	0	0	0	0	0	0	0	0	0	0	0	0
ID	R/W	Field	Value ID	Value								Description
A	R	STATUS										Hash engine status.
			Idle	0								HASH engine is idle
			Busy	1								HASH engine is busy

CONTEXT_ID

Address offset: 0x930

A general-purpose read/write register.


Bit number				31	30	29	28	27	26	25	24	23	22	21	20	19	18	17	16	15	14	13	12	11	10	9	8	7	6	5	4	3	2	1	0
ID																												A	A	A	A	A	A	A	A
Reset 0x00000000				0	0	0	0	0	0	0	0	0	0	0	0	0	0	0	0	0	0	0	0	0	0	0	0	0	0	0	0	0	0	0	0
ID	R/W	Field	Value ID	Value								Description
A	RW	CONTEXT_ID										Context ID

DIN DMA engine

The Data IN (DIN) DMA engine transfers data into the CRYPTOCELL subsystem and its various cryptographic engines.

The DIN DMA engine provides a comprehensive interface for to facilitate the transfer of data from the CPU or memory to the cryptographic engines. It includes a variety of registers that control direct data buffering, DMA operations, and data flow management.

Maximum DMA transaction size is limited to 2¹⁶-1 bytes. If a DMA transaction is configured with a payload size above the maximum DMA transaction size limit, the DMA engine must be reset before being functional again using register DIN_SW_RESET.

The flow demonstrated in Cryptographic flow shows how the DIN DMA engine is configured to provide data to the AES engine using registers SRC_MEM_ADDR and SRC_MEM_SIZE to define the input source address and number of input bytes, respectively.

Registers

Instances


Instance	Base address	TrustZone			Split access	Description
Instance	Base address	Map	Att	DMA	Split access	Description
CC_DIN	0x50841000	HF	S	NSA	No	CRYPTOCELL DIN DMA engine

Register overview


Register	Offset	Description
DIN_BUFFER	0xC00	Used by CPU to write data directly to the DIN buffer, which is then sent to the cryptographic engines for processing.
DIN_DMA_MEM_BUSY	0xC20	Status register for DIN DMA engine activity when accessing memory.
SRC_MEM_ADDR	0xC28	Data source address in memory.
SRC_MEM_SIZE	0xC2C	The number of bytes to be read from memory. Writing to this register triggers the DMA operation.
SRC_SRAM_ADDR	0xC30	Data source address in RNG SRAM.
SRC_SRAM_SIZE	0xC34	The number of bytes to be read from RNG SRAM. Writing to this register triggers the DMA operation.
DIN_DMA_SRAM_BUSY	0xC38	Status register for DIN DMA engine activity when accessing RNG SRAM.
DIN_DMA_SRAM_ENDIANNESS	0xC3C	Configure the endianness of DIN DMA transactions towards RNG SRAM.
DIN_SW_RESET	0xC44	Reset the DIN DMA engine.
DIN_CPU_DATA	0xC48	Specifies the number of bytes the CPU will write to the DIN_BUFFER, ensuring the cryptographic engine processes the correct amount of data.
DIN_WRITE_ALIGN	0xC4C	Indicates that the next CPU write to the DIN_BUFFER is the last in the sequence. This is needed only when the data size is NOT modulo 4 (e.g. HASH padding).
DIN_FIFO_EMPTY	0xC50	Register indicating if DIN FIFO is empty and if more data can be accepted.
DIN_FIFO_RESET	0xC58	Reset the DIN FIFO, effectively clearing the FIFO for new data.

DIN_BUFFER

Address offset: 0xC00

Used by CPU to write data directly to the DIN buffer, which is then sent to the cryptographic engines for processing.

The number of bytes to write is defined in DIN_CPU_DATA.


Bit number				31	30	29	28	27	26	25	24	23	22	21	20	19	18	17	16	15	14	13	12	11	10	9	8	7	6	5	4	3	2	1	0
ID				A	A	A	A	A	A	A	A	A	A	A	A	A	A	A	A	A	A	A	A	A	A	A	A	A	A	A	A	A	A	A	A
Reset 0x00000000				0	0	0	0	0	0	0	0	0	0	0	0	0	0	0	0	0	0	0	0	0	0	0	0	0	0	0	0	0	0	0	0
ID	R/W	Field	Value ID	Value								Description
A	W	DATA										This register is mapped into 8 addresses in order to enable a CPU burst.

DIN_DMA_MEM_BUSY

Address offset: 0xC20

Status register for DIN DMA engine activity when accessing memory.


Bit number				31	30	29	28	27	26	25	24	23	22	21	20	19	18	17	16	15	14	13	12	11	10	9	8	7	6	5	4	3	2	1	0
ID																																			A
Reset 0x00000000				0	0	0	0	0	0	0	0	0	0	0	0	0	0	0	0	0	0	0	0	0	0	0	0	0	0	0	0	0	0	0	0
ID	R/W	Field	Value ID	Value								Description
A	R	STATUS										DIN memory DMA engine status.
			Idle	0								DIN memory DMA engine is idle
			Busy	1								DIN memory DMA engine is busy

SRC_MEM_ADDR

Address offset: 0xC28

Data source address in memory.


Bit number				31	30	29	28	27	26	25	24	23	22	21	20	19	18	17	16	15	14	13	12	11	10	9	8	7	6	5	4	3	2	1	0
ID				A	A	A	A	A	A	A	A	A	A	A	A	A	A	A	A	A	A	A	A	A	A	A	A	A	A	A	A	A	A	A	A
Reset 0x00000000				0	0	0	0	0	0	0	0	0	0	0	0	0	0	0	0	0	0	0	0	0	0	0	0	0	0	0	0	0	0	0	0
ID	R/W	Field	Value ID	Value								Description
A	W	ADDR										Source address in memory.

SRC_MEM_SIZE

Address offset: 0xC2C

The number of bytes to be read from memory. Writing to this register triggers the DMA operation.


Bit number				31	30	29	28	27	26	25	24	23	22	21	20	19	18	17	16	15	14	13	12	11	10	9	8	7	6	5	4	3	2	1	0
ID				C	B	A	A	A	A	A	A	A	A	A	A	A	A	A	A	A	A	A	A	A	A	A	A	A	A	A	A	A	A	A	A
Reset 0x00000000				0	0	0	0	0	0	0	0	0	0	0	0	0	0	0	0	0	0	0	0	0	0	0	0	0	0	0	0	0	0	0	0
ID	R/W	Field	Value ID	Value								Description
A	W	SIZE										Total number of bytes to read from memory.
B	W	FIRST										This field is reserved
C	W	LAST										This field is reserved

SRC_SRAM_ADDR

Address offset: 0xC30

Data source address in RNG SRAM.


Bit number				31	30	29	28	27	26	25	24	23	22	21	20	19	18	17	16	15	14	13	12	11	10	9	8	7	6	5	4	3	2	1	0
ID				A	A	A	A	A	A	A	A	A	A	A	A	A	A	A	A	A	A	A	A	A	A	A	A	A	A	A	A	A	A	A	A
Reset 0x00000000				0	0	0	0	0	0	0	0	0	0	0	0	0	0	0	0	0	0	0	0	0	0	0	0	0	0	0	0	0	0	0	0
ID	R/W	Field	Value ID	Value								Description
A	RW	ADDR										Source address in RNG SRAM.

SRC_SRAM_SIZE

Address offset: 0xC34

The number of bytes to be read from RNG SRAM. Writing to this register triggers the DMA operation.


Bit number				31	30	29	28	27	26	25	24	23	22	21	20	19	18	17	16	15	14	13	12	11	10	9	8	7	6	5	4	3	2	1	0
ID				A	A	A	A	A	A	A	A	A	A	A	A	A	A	A	A	A	A	A	A	A	A	A	A	A	A	A	A	A	A	A	A
Reset 0x00000000				0	0	0	0	0	0	0	0	0	0	0	0	0	0	0	0	0	0	0	0	0	0	0	0	0	0	0	0	0	0	0	0
ID	R/W	Field	Value ID	Value								Description
A	W	SIZE										Total number of bytes to read from RNG SRAM.

DIN_DMA_SRAM_BUSY

Address offset: 0xC38

Status register for DIN DMA engine activity when accessing RNG SRAM.


Bit number				31	30	29	28	27	26	25	24	23	22	21	20	19	18	17	16	15	14	13	12	11	10	9	8	7	6	5	4	3	2	1	0
ID																																			A
Reset 0x00000000				0	0	0	0	0	0	0	0	0	0	0	0	0	0	0	0	0	0	0	0	0	0	0	0	0	0	0	0	0	0	0	0
ID	R/W	Field	Value ID	Value								Description
A	R	STATUS										DIN RNG SRAM DMA engine status.
			Idle	0								DIN RNG SRAM DMA engine is idle
			Busy	1								DIN RNG SRAM DMA engine is busy

DIN_DMA_SRAM_ENDIANNESS

Address offset: 0xC3C

Configure the endianness of DIN DMA transactions towards RNG SRAM.


Bit number				31	30	29	28	27	26	25	24	23	22	21	20	19	18	17	16	15	14	13	12	11	10	9	8	7	6	5	4	3	2	1	0
ID																																			A
Reset 0x00000000				0	0	0	0	0	0	0	0	0	0	0	0	0	0	0	0	0	0	0	0	0	0	0	0	0	0	0	0	0	0	0	0
ID	R/W	Field	Value ID	Value								Description
A	RW	ENDIAN										Endianness of DIN DMA transactions towards RNG SRAM. The default value is little-endian.
			LittleEndian	0								Use little-endian format for RNG SRAM DMA transactions
			BigEndian	1								Use big-endian format for RNG SRAM DMA transactions

DIN_SW_RESET

Address offset: 0xC44

Reset the DIN DMA engine.


Bit number				31	30	29	28	27	26	25	24	23	22	21	20	19	18	17	16	15	14	13	12	11	10	9	8	7	6	5	4	3	2	1	0
ID																																			A
Reset 0x00000000				0	0	0	0	0	0	0	0	0	0	0	0	0	0	0	0	0	0	0	0	0	0	0	0	0	0	0	0	0	0	0	0
ID	R/W	Field	Value ID	Value								Description
A	W	RESET										Writing any value to this address resets the DIN DMA engine. The reset takes 4 CPU clock cycles to complete.
			Enable	1								Reset DIN DMA engine.

DIN_CPU_DATA

Address offset: 0xC48

Specifies the number of bytes the CPU will write to the DIN_BUFFER, ensuring the cryptographic engine processes the correct amount of data.


Bit number				31	30	29	28	27	26	25	24	23	22	21	20	19	18	17	16	15	14	13	12	11	10	9	8	7	6	5	4	3	2	1	0
ID																				A	A	A	A	A	A	A	A	A	A	A	A	A	A	A	A
Reset 0x00000000				0	0	0	0	0	0	0	0	0	0	0	0	0	0	0	0	0	0	0	0	0	0	0	0	0	0	0	0	0	0	0	0
ID	R/W	Field	Value ID	Value								Description
A	W	SIZE										When using CPU direct write to the DIN_BUFFER, the size of input data in bytes should be written to this register.

DIN_WRITE_ALIGN

Address offset: 0xC4C

Indicates that the next CPU write to the DIN_BUFFER is the last in the sequence. This is needed only when the data size is NOT modulo 4 (e.g. HASH padding).


Bit number				31	30	29	28	27	26	25	24	23	22	21	20	19	18	17	16	15	14	13	12	11	10	9	8	7	6	5	4	3	2	1	0
ID																																			A
Reset 0x00000000				0	0	0	0	0	0	0	0	0	0	0	0	0	0	0	0	0	0	0	0	0	0	0	0	0	0	0	0	0	0	0	0
ID	R/W	Field	Value ID	Value								Description
A	W	LAST										Next CPU write to the DIN_BUFFER is the last word.
			Confirm	1								The next CPU write is the last in the sequence.

DIN_FIFO_EMPTY

Address offset: 0xC50


Bit number				31	30	29	28	27	26	25	24	23	22	21	20	19	18	17	16	15	14	13	12	11	10	9	8	7	6	5	4	3	2	1	0
ID																																			A
Reset 0x00000001				0	0	0	0	0	0	0	0	0	0	0	0	0	0	0	0	0	0	0	0	0	0	0	0	0	0	0	0	0	0	0	1
ID	R/W	Field	Value ID	Value								Description
A	R	STATUS										DIN FIFO status
			NotEmpty	0								DIN FIFO is not empty
			Empty	1								DIN FIFO is empty, and more data can be accepted

DIN_FIFO_RESET

Address offset: 0xC58

Reset the DIN FIFO, effectively clearing the FIFO for new data.


Bit number				31	30	29	28	27	26	25	24	23	22	21	20	19	18	17	16	15	14	13	12	11	10	9	8	7	6	5	4	3	2	1	0
ID																																			A
Reset 0x00000000				0	0	0	0	0	0	0	0	0	0	0	0	0	0	0	0	0	0	0	0	0	0	0	0	0	0	0	0	0	0	0	0
ID	R/W	Field	Value ID	Value								Description
A	W	RESET										Writing any value to this address resets the DIN FIFO.
			Enable	1								Reset DIN FIFO.

DOUT DMA engine

The Data OUT (DOUT) DMA engine transfers data from the CRYPTOCELL subsystem and its various cryptographic engines.

The DOUT DMA engine provides a comprehensive interface for to facilitate the transfer of data to the CPU or memory from the cryptographic engines. It includes a variety of registers that control direct data buffering, DMA operations, and data flow management.

The flow demonstrated in Cryptographic flow shows how the DOUT DMA engine is configured to output data from the AES engine using registers DST_MEM_ADDR and DST_MEM_SIZE to define the output source address and number of output bytes, respectively.

Registers

Instances


Instance	Base address	TrustZone			Split access	Description
Instance	Base address	Map	Att	DMA	Split access	Description
CC_DOUT	0x50841000	HF	S	NSA	No	CRYPTOCELL DOUT DMA engine

Register overview


Register	Offset	Description
DOUT_BUFFER	0xC00	Cryptographic results directly accessible by the CPU.
DOUT_DMA_MEM_BUSY	0xD20	Status register for DOUT DMA engine activity when accessing memory.
DST_MEM_ADDR	0xD28	Data destination address in memory.
DST_MEM_SIZE	0xD2C	The number of bytes to be written to memory.
DST_SRAM_ADDR	0xD30	Data destination address in RNG SRAM.
DST_SRAM_SIZE	0xD34	The number of bytes to be written to RNG SRAM.
DOUT_DMA_SRAM_BUSY	0xD38	Status register for DOUT DMA engine activity when accessing RNG SRAM.
DOUT_DMA_SRAM_ENDIANNESS	0xD3C	Configure the endianness of DOUT DMA transactions towards RNG SRAM.
DOUT_READ_ALIGN	0xD44	Indication that the next CPU read from the DOUT_BUFFER is the last in the sequence. This is needed only when the data size is NOT modulo 4 (e.g. HASH padding).
DOUT_FIFO_EMPTY	0xD50	Register indicating if DOUT FIFO is empty or if more data will come.
DOUT_SW_RESET	0xD58	Reset the DOUT DMA engine.

DOUT_BUFFER

Address offset: 0xC00

Cryptographic results directly accessible by the CPU.


Bit number				31	30	29	28	27	26	25	24	23	22	21	20	19	18	17	16	15	14	13	12	11	10	9	8	7	6	5	4	3	2	1	0
ID				A	A	A	A	A	A	A	A	A	A	A	A	A	A	A	A	A	A	A	A	A	A	A	A	A	A	A	A	A	A	A	A
Reset 0x00000000				0	0	0	0	0	0	0	0	0	0	0	0	0	0	0	0	0	0	0	0	0	0	0	0	0	0	0	0	0	0	0	0
ID	R/W	Field	Value ID	Value								Description
A	R	DATA										This address can be used by the CPU to read data directly from the DOUT buffer.

DOUT_DMA_MEM_BUSY

Address offset: 0xD20

Status register for DOUT DMA engine activity when accessing memory.


Bit number				31	30	29	28	27	26	25	24	23	22	21	20	19	18	17	16	15	14	13	12	11	10	9	8	7	6	5	4	3	2	1	0
ID																																			A
Reset 0x00000000				0	0	0	0	0	0	0	0	0	0	0	0	0	0	0	0	0	0	0	0	0	0	0	0	0	0	0	0	0	0	0	0
ID	R/W	Field	Value ID	Value								Description
A	R	STATUS										DOUT memory DMA engine status.
			Idle	0								DOUT memory DMA engine is idle
			Busy	1								DOUT memory DMA engine is busy

DST_MEM_ADDR

Address offset: 0xD28

Data destination address in memory.


Bit number				31	30	29	28	27	26	25	24	23	22	21	20	19	18	17	16	15	14	13	12	11	10	9	8	7	6	5	4	3	2	1	0
ID				A	A	A	A	A	A	A	A	A	A	A	A	A	A	A	A	A	A	A	A	A	A	A	A	A	A	A	A	A	A	A	A
Reset 0x00000000				0	0	0	0	0	0	0	0	0	0	0	0	0	0	0	0	0	0	0	0	0	0	0	0	0	0	0	0	0	0	0	0
ID	R/W	Field	Value ID	Value								Description
A	W	ADDR										Destination address in memory.

DST_MEM_SIZE

Address offset: 0xD2C

The number of bytes to be written to memory.


Bit number				31	30	29	28	27	26	25	24	23	22	21	20	19	18	17	16	15	14	13	12	11	10	9	8	7	6	5	4	3	2	1	0
ID				C	B	A	A	A	A	A	A	A	A	A	A	A	A	A	A	A	A	A	A	A	A	A	A	A	A	A	A	A	A	A	A
Reset 0x00000000				0	0	0	0	0	0	0	0	0	0	0	0	0	0	0	0	0	0	0	0	0	0	0	0	0	0	0	0	0	0	0	0
ID	R/W	Field	Value ID	Value								Description
A	W	SIZE										Total number of bytes to write to memory.
B	W	FIRST										This field is reserved
C	W	LAST										This field is reserved

DST_SRAM_ADDR

Address offset: 0xD30

Data destination address in RNG SRAM.


Bit number				31	30	29	28	27	26	25	24	23	22	21	20	19	18	17	16	15	14	13	12	11	10	9	8	7	6	5	4	3	2	1	0
ID				A	A	A	A	A	A	A	A	A	A	A	A	A	A	A	A	A	A	A	A	A	A	A	A	A	A	A	A	A	A	A	A
Reset 0x00000000				0	0	0	0	0	0	0	0	0	0	0	0	0	0	0	0	0	0	0	0	0	0	0	0	0	0	0	0	0	0	0	0
ID	R/W	Field	Value ID	Value								Description
A	RW	ADDR										Destination address in RNG SRAM.

DST_SRAM_SIZE

Address offset: 0xD34

The number of bytes to be written to RNG SRAM.


Bit number				31	30	29	28	27	26	25	24	23	22	21	20	19	18	17	16	15	14	13	12	11	10	9	8	7	6	5	4	3	2	1	0
ID				A	A	A	A	A	A	A	A	A	A	A	A	A	A	A	A	A	A	A	A	A	A	A	A	A	A	A	A	A	A	A	A
Reset 0x00000000				0	0	0	0	0	0	0	0	0	0	0	0	0	0	0	0	0	0	0	0	0	0	0	0	0	0	0	0	0	0	0	0
ID	R/W	Field	Value ID	Value								Description
A	W	SIZE										Total number of bytes to write to RNG SRAM.

DOUT_DMA_SRAM_BUSY

Address offset: 0xD38

Status register for DOUT DMA engine activity when accessing RNG SRAM.


Bit number				31	30	29	28	27	26	25	24	23	22	21	20	19	18	17	16	15	14	13	12	11	10	9	8	7	6	5	4	3	2	1	0
ID																																			A
Reset 0x00000000				0	0	0	0	0	0	0	0	0	0	0	0	0	0	0	0	0	0	0	0	0	0	0	0	0	0	0	0	0	0	0	0
ID	R/W	Field	Value ID	Value								Description
A	R	STATUS										DOUT RNG SRAM DMA engine status.
			Idle	0								DOUT RNG SRAM DMA engine is idle
			Busy	1								DOUT RNG SRAM DMA engine is busy

DOUT_DMA_SRAM_ENDIANNESS

Address offset: 0xD3C

Configure the endianness of DOUT DMA transactions towards RNG SRAM.


Bit number				31	30	29	28	27	26	25	24	23	22	21	20	19	18	17	16	15	14	13	12	11	10	9	8	7	6	5	4	3	2	1	0
ID																																			A
Reset 0x00000000				0	0	0	0	0	0	0	0	0	0	0	0	0	0	0	0	0	0	0	0	0	0	0	0	0	0	0	0	0	0	0	0
ID	R/W	Field	Value ID	Value								Description
A	RW	ENDIAN										Endianness of DOUT DMA transactions towards RNG SRAM. The default value is little-endian.
			LittleEndian	0								Use little-endian format for RNG SRAM DMA transactions
			BigEndian	1								Use big-endian format for RNG SRAM DMA transactions

DOUT_READ_ALIGN

Address offset: 0xD44

Indication that the next CPU read from the DOUT_BUFFER is the last in the sequence. This is needed only when the data size is NOT modulo 4 (e.g. HASH padding).


Bit number				31	30	29	28	27	26	25	24	23	22	21	20	19	18	17	16	15	14	13	12	11	10	9	8	7	6	5	4	3	2	1	0
ID																																			A
Reset 0x00000000				0	0	0	0	0	0	0	0	0	0	0	0	0	0	0	0	0	0	0	0	0	0	0	0	0	0	0	0	0	0	0	0
ID	R/W	Field	Value ID	Value								Description
A	W	LAST										Next CPU read from the DOUT_BUFFER is the last word, and the remaining read aligned content can be flushed.
			Flush	1								Flush the remaining read aligned content.

DOUT_FIFO_EMPTY

Address offset: 0xD50


Bit number				31	30	29	28	27	26	25	24	23	22	21	20	19	18	17	16	15	14	13	12	11	10	9	8	7	6	5	4	3	2	1	0
ID																																			A
Reset 0x00000001				0	0	0	0	0	0	0	0	0	0	0	0	0	0	0	0	0	0	0	0	0	0	0	0	0	0	0	0	0	0	0	1
ID	R/W	Field	Value ID	Value								Description
A	R	STATUS										DOUT FIFO status
			NotEmpty	0								DOUT FIFO is not empty, and more data will come
			Empty	1								DOUT FIFO is empty

DOUT_SW_RESET

Address offset: 0xD58

Reset the DOUT DMA engine.


Bit number				31	30	29	28	27	26	25	24	23	22	21	20	19	18	17	16	15	14	13	12	11	10	9	8	7	6	5	4	3	2	1	0
ID																																			A
Reset 0x00000000				0	0	0	0	0	0	0	0	0	0	0	0	0	0	0	0	0	0	0	0	0	0	0	0	0	0	0	0	0	0	0	0
ID	R/W	Field	Value ID	Value								Description
A	W	RESET										Writing any value to this address resets the DOUT DMA engine. The reset takes 4 CPU clock cycles to complete.
			Enable	1								Reset DOUT DMA engine.

HOST register interface

The HOST_RGF interface contains registers for CRYPTOCELL interrupt handling, configuring CRYPTOCELL lifecycle state and CRYPTOCELL key management where different cryptographic key inputs can be connected to the AES engine.

Use of the CRYPTOCELL K_PRTL key or the device root key K_DR is selected using this interface. Availability and configuration of these two key types are typically controlled from an immutable bootloader. Once CRYPTOCELL has been correctly configured it will be possible for an application to either use session keys directly or perform cryptographic operations with the device root key key K_DR without having access to the key value.

Registers

Instances


Instance	Base address	TrustZone			Split access	Description
Instance	Base address	Map	Att	DMA	Split access	Description
CC_HOST_RGF	0x50841000	HF	S	NSA	No	CRYPTOCELL HOST register interface

Register overview


Register	Offset	Description
IRR	0xA00	Interrupt request register. Each bit of this register holds the interrupt status of a single interrupt source. If corresponding IMR bit is unmasked, an interrupt is generated.
IMR	0xA04	Interrupt mask register. Each bit of this register holds the mask of a single interrupt source.
ICR	0xA08	Interrupt clear register. Writing a 1 bit into a field in this register will clear the corresponding bit in IRR.
ENDIANNESS	0xA0C	This register defines the endianness of the Host-accessible registers, and can only be written once.
HOST_SIGNATURE	0xA24	This register holds the CRYPTOCELL subsystem signature. See reset value.
HOST_BOOT	0xA28	Hardware configuration of the CRYPTOCELL subsystem. Reset value holds the supported features.
HOST_CRYPTOKEY_SEL	0xA38	AES hardware key select.
HOST_IOT_KPRTL_LOCK	0xA4C	This write-once register is the K_PRTL lock register. When this register is set, K_PRTL cannot be used and a zeroed key will be used instead. The value of this register is saved in the CRYPTOCELL AO power domain.
HOST_IOT_KDR0	0xA50	This register holds bits 31:0 of K_DR. The value of this register is saved in the CRYPTOCELL AO power domain. Reading from this address returns the K_DR valid status indicating if K_DR is successfully retained.
HOST_IOT_KDR1	0xA54	This register holds bits 63:32 of K_DR. The value of this register is saved in the CRYPTOCELL AO power domain.
HOST_IOT_KDR2	0xA58	This register holds bits 95:64 of K_DR. The value of this register is saved in the CRYPTOCELL AO power domain.
HOST_IOT_KDR3	0xA5C	This register holds bits 127:96 of K_DR. The value of this register is saved in the CRYPTOCELL AO power domain.
HOST_IOT_LCS	0xA60	Controls life-cycle state (LCS) for CRYPTOCELL subsystem

IRR

Address offset: 0xA00

Interrupt request register. Each bit of this register holds the interrupt status of a single interrupt source. If corresponding IMR bit is unmasked, an interrupt is generated.


Bit number				31	30	29	28	27	26	25	24	23	22	21	20	19	18	17	16	15	14	13	12	11	10	9	8	7	6	5	4	3	2	1	0
ID																									G	F	E	D	C	B	A
Reset 0x00000000				0	0	0	0	0	0	0	0	0	0	0	0	0	0	0	0	0	0	0	0	0	0	0	0	0	0	0	0	0	0	0	0
ID	R/W	Field	Value ID	Value								Description
A	R	SRAM_TO_DIN_INT										The RNG SRAM to DIN DMA done interrupt status. This interrupt is asserted when all data was delivered from RNG SRAM to DIN buffer.
B	R	DOUT_TO_SRAM_INT										The DOUT to RNG SRAM DMA done interrupt status. This interrupt is asserted when all data was delivered from DOUT buffer to RNG SRAM.
C	R	MEM_TO_DIN_INT										The memory to DIN DMA done interrupt status. This interrupt is asserted when all data was delivered from memory to DIN buffer.
D	R	DOUT_TO_MEM_INT										The DOUT to memory DMA done interrupt status. This interrupt is asserted when all data was delivered from DOUT buffer to memory.
E	R	AHB_ERR_INT										The AHB error interrupt status.
F	R	PKA_INT										The PKA end of operation interrupt status.
G	R	RNG_INT										The RNG interrupt status.

IMR

Address offset: 0xA04

Interrupt mask register. Each bit of this register holds the mask of a single interrupt source.


Bit number				31	30	29	28	27	26	25	24	23	22	21	20	19	18	17	16	15	14	13	12	11	10	9	8	7	6	5	4	3	2	1	0
ID																									G	F	E	D	C	B	A
Reset 0x01FFFFFF				0	0	0	0	0	0	0	1	1	1	1	1	1	1	1	1	1	1	1	1	1	1	1	1	1	1	1	1	1	1	1	1
ID	R/W	Field	Value ID	Value								Description
A	RW	SRAM_TO_DIN_MASK										The RNG SRAM to DIN DMA done interrupt mask.
			IRQEnable	0								Do not mask RNG SRAM to DIN DMA done interrupt i.e. interrupt is generated
			IRQDisable	1								Mask RNG SRAM to DIN DMA done interrupt i.e. no interrupt is generated
B	RW	DOUT_TO_SRAM_MASK										The DOUT to RNG SRAM DMA done interrupt mask.
			IRQEnable	0								Do not mask DOUT to RNG SRAM DMA done interrupt i.e. interrupt is generated
			IRQDisable	1								Mask DOUT to RNG SRAM DMA done interrupt i.e. no interrupt is generated
C	RW	MEM_TO_DIN_MASK										The memory to DIN DMA done interrupt mask.
			IRQEnable	0								Do not mask memory to DIN DMA done interrupt i.e. interrupt is generated
			IRQDisable	1								Mask memory to DIN DMA done interrupt i.e. no interrupt is generated
D	RW	DOUT_TO_MEM_MASK										The DOUT to memory DMA done interrupt mask.
			IRQEnable	0								Do not mask DOUT to memory DMA done interrupt i.e. interrupt is generated
			IRQDisable	1								Mask DOUT to memory DMA done interrupt i.e. no interrupt is generated
E	RW	AHB_ERR_MASK										The AHB error interrupt mask.
			IRQEnable	0								Do not mask AHB error interrupt i.e. interrupt is generated
			IRQDisable	1								Mask AHB error interrupt i.e. no interrupt is generated
F	RW	PKA_MASK										The PKA end of operation interrupt mask.
			IRQEnable	0								Do not mask PKA end of operation interrupt i.e. interrupt is generated
			IRQDisable	1								Mask PKA end of operation interrupt i.e. no interrupt is generated
G	RW	RNG_MASK										The RNG interrupt mask.
			IRQEnable	0								Do not mask RNG interrupt i.e. interrupt is generated
			IRQDisable	1								Mask RNG interrupt i.e. no interrupt is generated

ICR

Address offset: 0xA08

Interrupt clear register. Writing a 1 bit into a field in this register will clear the corresponding bit in IRR.


Bit number				31	30	29	28	27	26	25	24	23	22	21	20	19	18	17	16	15	14	13	12	11	10	9	8	7	6	5	4	3	2	1	0
ID																									G	F	E	D	C	B	A
Reset 0x00000000				0	0	0	0	0	0	0	0	0	0	0	0	0	0	0	0	0	0	0	0	0	0	0	0	0	0	0	0	0	0	0	0
ID	R/W	Field	Value ID	Value								Description
A	W	SRAM_TO_DIN_CLEAR										The RNG SRAM to DIN DMA done interrupt clear.
B	W	DOUT_TO_SRAM_CLEAR										The DOUT to RNG SRAM DMA done interrupt clear.
C	W	MEM_TO_DIN_CLEAR										The memory to DIN DMA done interrupt clear.
D	W	DOUT_TO_MEM_CLEAR										The DOUT to memory DMA done interrupt clear.
E	W	AHB_ERR_CLEAR										The AHB error interrupt clear.
F	W	PKA_CLEAR										The PKA end of operation interrupt clear.
G	W	RNG_CLEAR										The RNG interrupt clear. Register RNG_ISR in the RNG engine must be cleared before this interrupt can be cleared.

ENDIANNESS

Address offset: 0xA0C

This register defines the endianness of the Host-accessible registers, and can only be written once.


Bit number				31	30	29	28	27	26	25	24	23	22	21	20	19	18	17	16	15	14	13	12	11	10	9	8	7	6	5	4	3	2	1	0
ID																				D				C				B				A
Reset 0x00000000				0	0	0	0	0	0	0	0	0	0	0	0	0	0	0	0	0	0	0	0	0	0	0	0	0	0	0	0	0	0	0	0
ID	R/W	Field	Value ID	Value								Description
A	RW	DOUT_WR_BG										DOUT write endianness.
			LittleEndian	0								Configure DOUT write as little-endian
			BigEndian	1								Configure DOUT write as big-endian
B	RW	DIN_RD_BG										DIN read endianness.
			LittleEndian	0								Configure DIN read as little-endian
			BigEndian	1								Configure DIN read as big-endian
C	RW	DOUT_WR_WBG										DOUT write word endianness.
			LittleEndian	0								Configure DOUT write word as little-endian
			BigEndian	1								Configure DOUT write word as big-endian
D	RW	DIN_RD_WBG										DIN read word endianness.
			LittleEndian	0								Configure DIN read word as little-endian
			BigEndian	1								Configure DIN read word as big-endian

HOST_SIGNATURE

Address offset: 0xA24

This register holds the CRYPTOCELL subsystem signature. See reset value.


Bit number				31	30	29	28	27	26	25	24	23	22	21	20	19	18	17	16	15	14	13	12	11	10	9	8	7	6	5	4	3	2	1	0
ID				A	A	A	A	A	A	A	A	A	A	A	A	A	A	A	A	A	A	A	A	A	A	A	A	A	A	A	A	A	A	A	A
Reset 0x20E00000				0	0	1	0	0	0	0	0	1	1	1	0	0	0	0	0	0	0	0	0	0	0	0	0	0	0	0	0	0	0	0	0
ID	R/W	Field	Value ID	Value								Description
A	R	VALUE										Fixed-value identification signature used by host driver to verify CRYPTOCELL presence at this address.

HOST_BOOT

Address offset: 0xA28

Hardware configuration of the CRYPTOCELL subsystem. Reset value holds the supported features.


Bit number				31	30	29	28	27	26	25	24	23	22	21	20	19	18	17	16	15	14	13	12	11	10	9	8	7	6	5	4	3	2	1	0
ID					b	a	Z	Y	X	W	V	U	T	S	R	Q	P	O	N	M	L	K	J	I	H	G	F	F	F	E		D	C	B	A
Reset 0x4622982C				0	1	0	0	0	1	1	0	0	0	1	0	0	0	1	0	1	0	0	1	1	0	0	0	0	0	1	0	1	1	0	0
ID	R/W	Field	Value ID	Value								Description
A	R	POWER_GATING_EXISTS_LOCAL										If this flag is set, full power gating is implemented
B	R	LARGE_RKEK_LOCAL										If this flag is set, large RKEK is supported
C	R	HASH_IN_FUSES_LOCAL										If this flag is set, HASH in fuses is supported
D	R	EXT_MEM_SECURED_LOCAL										If this flag is set, external secure memory is supported
E	R	RKEK_ECC_EXISTS_LOCAL_N										If this flag is set, RKEK ECC is supported
F	R	SRAM_SIZE_LOCAL										SRAM size
G	R	DSCRPTR_EXISTS_LOCAL										If this flag is set, Descriptors are supported
H	R	PAU_EXISTS_LOCAL										If this flag is set, PAU is supported
I	R	RNG_EXISTS_LOCAL										If this flag is set, the RNG engine is present
J	R	PKA_EXISTS_LOCAL										If this flag is set, the PKA engine is present
K	R	RC4_EXISTS_LOCAL										If this flag is set, the RC4 engine is present
L	R	SHA_512_PRSNT_LOCAL										If this flag is set, the HASH engine supports SHA512
M	R	SHA_256_PRSNT_LOCAL										If this flag is set, the HASH engine supports SHA256
N	R	MD5_PRSNT_LOCAL										If this flag is set, the HASH engine supports MD5
O	R	HASH_EXISTS_LOCAL										If this flag is set, the HASH engine is present
P	R	C2_EXISTS_LOCAL										If this flag is set, the C2 engine is present
Q	R	DES_EXISTS_LOCAL										If this flag is set, the DES engine is present
R	R	AES_XCBC_MAC_EXISTS_LOCAL										If this flag is set, AES XCBC-MAC mode is supported
S	R	AES_CMAC_EXISTS_LOCAL										If this flag is set, AES CMAC mode is supported
T	R	AES_CCM_EXISTS_LOCAL										If this flag is set, AES CCM mode is supported
U	R	AES_XEX_HW_T_CALC_LOCAL										If this flag is set, AES XEX mode T-value calculation in HW is supported
V	R	AES_XEX_EXISTS_LOCAL										If this flag is set, AES XEX mode is supported
W	R	CTR_EXISTS_LOCAL										If this flag is set, AES CTR mode is supported
X	R	AES_DIN_BYTE_RESOLUTION_LOCAL										If this flag is set, the AES engine data input support byte size resolution
Y	R	TUNNELING_ENB_LOCAL										If this flag is set, the AES engine supports tunneling operations
Z	R	SUPPORT_256_192_KEY_LOCAL										If this flag is set, the AES engine supports 192/256 bits key sizes
a	R	ONLY_ENCRYPT_LOCAL										If this flag is set, the AES engine only support encryption
b	R	AES_EXISTS_LOCAL										If this flag is set, the AES engine is present

HOST_CRYPTOKEY_SEL

Address offset: 0xA38

AES hardware key select.

If the HOST_IOT_KPRTL_LOCK register is set, and the HOST_CRYPTOKEY_SEL register set to 1, then the HW key that is connected to the AES engine is zero


Bit number				31	30	29	28	27	26	25	24	23	22	21	20	19	18	17	16	15	14	13	12	11	10	9	8	7	6	5	4	3	2	1	0
ID																																		A	A
Reset 0x00000000				0	0	0	0	0	0	0	0	0	0	0	0	0	0	0	0	0	0	0	0	0	0	0	0	0	0	0	0	0	0	0	0
ID	R/W	Field	Value ID	Value								Description
A	RW	HOST_CRYPTOKEY_SEL										Select the source of the HW key that is used by the AES engine
			K_DR	0								Use device root key K_DR from CRYPTOCELL AO power domain
			K_PRTL	1								Use hard-coded RTL key K_PRTL
			Session	2								Use provided session key

HOST_IOT_KPRTL_LOCK

Address offset: 0xA4C

This write-once register is the K_PRTL lock register. When this register is set, K_PRTL cannot be used and a zeroed key will be used instead. The value of this register is saved in the CRYPTOCELL AO power domain.


Bit number				31	30	29	28	27	26	25	24	23	22	21	20	19	18	17	16	15	14	13	12	11	10	9	8	7	6	5	4	3	2	1	0
ID																																			A
Reset 0x00000000				0	0	0	0	0	0	0	0	0	0	0	0	0	0	0	0	0	0	0	0	0	0	0	0	0	0	0	0	0	0	0	0
ID	R/W	Field	Value ID	Value								Description
A	RW1	HOST_IOT_KPRTL_LOCK										This register is the K_PRTL lock register. When this register is set, K_PRTL cannot be used and a zeroed key will be used instead. The value of this register is saved in the CRYPTOCELL AO power domain.
			Disabled	0								K_PRTL can be selected for use from register HOST_CRYPTOKEY_SEL
			Enabled	1								K_PRTL has been locked until next power-on reset (POR). If K_PRTL is selected anyway, a zeroed key will be used instead.

HOST_IOT_KDR0

Address offset: 0xA50

This register holds bits 31:0 of K_DR. The value of this register is saved in the CRYPTOCELL AO power domain. Reading from this address returns the K_DR valid status indicating if K_DR is successfully retained.


Bit number				31	30	29	28	27	26	25	24	23	22	21	20	19	18	17	16	15	14	13	12	11	10	9	8	7	6	5	4	3	2	1	0
ID				A	A	A	A	A	A	A	A	A	A	A	A	A	A	A	A	A	A	A	A	A	A	A	A	A	A	A	A	A	A	A	A
Reset 0x00000000				0	0	0	0	0	0	0	0	0	0	0	0	0	0	0	0	0	0	0	0	0	0	0	0	0	0	0	0	0	0	0	0
ID	R/W	Field	Value ID	Value								Description
A	RW1	HOST_IOT_KDR0										This register holds bits 31:0 of K_DR. The value of this register is saved in the CRYPTOCELL AO power domain. Reading from this address returns the K_DR valid status indicating if K_DR is successfully retained. Write: K_DR bits 31:0.
			NotRetained	0								Read: 128 bits K_DR key value is not yet retained in the CRYPTOCELL AO power domain.
			Retained	1								Read: 128 bits K_DR key value is successfully retained in the CRYPTOCELL AO power domain.

HOST_IOT_KDR1

Address offset: 0xA54

This register holds bits 63:32 of K_DR. The value of this register is saved in the CRYPTOCELL AO power domain.


Bit number				31	30	29	28	27	26	25	24	23	22	21	20	19	18	17	16	15	14	13	12	11	10	9	8	7	6	5	4	3	2	1	0
ID				A	A	A	A	A	A	A	A	A	A	A	A	A	A	A	A	A	A	A	A	A	A	A	A	A	A	A	A	A	A	A	A
Reset 0x00000000				0	0	0	0	0	0	0	0	0	0	0	0	0	0	0	0	0	0	0	0	0	0	0	0	0	0	0	0	0	0	0	0
ID	R/W	Field	Value ID	Value								Description
A	W1	HOST_IOT_KDR1										K_DR bits 63:32

HOST_IOT_KDR2

Address offset: 0xA58

This register holds bits 95:64 of K_DR. The value of this register is saved in the CRYPTOCELL AO power domain.


Bit number				31	30	29	28	27	26	25	24	23	22	21	20	19	18	17	16	15	14	13	12	11	10	9	8	7	6	5	4	3	2	1	0
ID				A	A	A	A	A	A	A	A	A	A	A	A	A	A	A	A	A	A	A	A	A	A	A	A	A	A	A	A	A	A	A	A
Reset 0x00000000				0	0	0	0	0	0	0	0	0	0	0	0	0	0	0	0	0	0	0	0	0	0	0	0	0	0	0	0	0	0	0	0
ID	R/W	Field	Value ID	Value								Description
A	W1	HOST_IOT_KDR2										K_DR bits 95:64

HOST_IOT_KDR3

Address offset: 0xA5C

This register holds bits 127:96 of K_DR. The value of this register is saved in the CRYPTOCELL AO power domain.


Bit number				31	30	29	28	27	26	25	24	23	22	21	20	19	18	17	16	15	14	13	12	11	10	9	8	7	6	5	4	3	2	1	0
ID				A	A	A	A	A	A	A	A	A	A	A	A	A	A	A	A	A	A	A	A	A	A	A	A	A	A	A	A	A	A	A	A
Reset 0x00000000				0	0	0	0	0	0	0	0	0	0	0	0	0	0	0	0	0	0	0	0	0	0	0	0	0	0	0	0	0	0	0	0
ID	R/W	Field	Value ID	Value								Description
A	W1	HOST_IOT_KDR3										K_DR bits 127:96

HOST_IOT_LCS

Address offset: 0xA60

Controls life-cycle state (LCS) for CRYPTOCELL subsystem


Bit number				31	30	29	28	27	26	25	24	23	22	21	20	19	18	17	16	15	14	13	12	11	10	9	8	7	6	5	4	3	2	1	0
ID																											B						A	A	A
Reset 0x00000002				0	0	0	0	0	0	0	0	0	0	0	0	0	0	0	0	0	0	0	0	0	0	0	0	0	0	0	0	0	0	1	0
ID	R/W	Field	Value ID	Value								Description
A	RW1	LCS										Life-cycle state value. This field is write-once per reset.
			DebugEnable	0								CC310 operates in debug mode
			Secure	2								CC310 operates in secure mode
B	R	LCS_IS_VALID										Read-only field. Indicates if CRYPTOCELL LCS has been successfully configured since last reset.
			Invalid	0								Valid LCS not yet retained in the CRYPTOCELL AO power domain
			Valid	1								Valid LCS successfully retained in the CRYPTOCELL AO power domain

RNG SRAM interface

The RNG_SRAM interface enable reading and writing data to RNG SRAM.

Registers

Instances


Instance	Base address	TrustZone			Split access	Description
Instance	Base address	Map	Att	DMA	Split access	Description
CC_RNG_SRAM	0x50841000	HF	S	NSA	No	CRYPTOCELL RNG SRAM interface

Register overview


Register	Offset	Description
SRAM_DATA	0xF00	Read/Write data from RNG SRAM
SRAM_ADDR	0xF04	First address given to RNG SRAM DMA for read/write transactions from/to RNG SRAM.
SRAM_DATA_READY	0xF08	RNG SRAM DMA engine is ready to read/write from/to RNG SRAM.

SRAM_DATA

Address offset: 0xF00

Read/Write data from RNG SRAM


Bit number				31	30	29	28	27	26	25	24	23	22	21	20	19	18	17	16	15	14	13	12	11	10	9	8	7	6	5	4	3	2	1	0
ID				A	A	A	A	A	A	A	A	A	A	A	A	A	A	A	A	A	A	A	A	A	A	A	A	A	A	A	A	A	A	A	A
Reset 0x00000000				0	0	0	0	0	0	0	0	0	0	0	0	0	0	0	0	0	0	0	0	0	0	0	0	0	0	0	0	0	0	0	0
ID	R/W	Field	Value ID	Value								Description
A	RW	SRAM_DATA										32 bits DMA read/write from/to RNG SRAM. A 'read' or 'write' operation to this register will trigger the DMA address to be automatically incremented.

SRAM_ADDR

Address offset: 0xF04

First address given to RNG SRAM DMA for read/write transactions from/to RNG SRAM.


Bit number				31	30	29	28	27	26	25	24	23	22	21	20	19	18	17	16	15	14	13	12	11	10	9	8	7	6	5	4	3	2	1	0
ID																					A	A	A	A	A	A	A	A	A	A	A	A	A	A	A
Reset 0x00000000				0	0	0	0	0	0	0	0	0	0	0	0	0	0	0	0	0	0	0	0	0	0	0	0	0	0	0	0	0	0	0	0
ID	R/W	Field	Value ID	Value								Description
A	W	SRAM_ADDR										RNG SRAM starting address

SRAM_DATA_READY

Address offset: 0xF08

RNG SRAM DMA engine is ready to read/write from/to RNG SRAM.


Bit number				31	30	29	28	27	26	25	24	23	22	21	20	19	18	17	16	15	14	13	12	11	10	9	8	7	6	5	4	3	2	1	0
ID																																			A
Reset 0x00000001				0	0	0	0	0	0	0	0	0	0	0	0	0	0	0	0	0	0	0	0	0	0	0	0	0	0	0	0	0	0	0	1
ID	R/W	Field	Value ID	Value								Description
A	R	SRAM_READY										RNG SRAM DMA status.
			Busy	0								DMA is busy
			Idle	1								DMA is idle

MISC interface

The MISC interface controls clocks for the individual engines within the CRYPTOCELL subsystem.

Each cryptographic engine has an individual register for performing clock gating. Engine clock status is displayed in register CLK_STATUS.

Note: Clock control for the RNG engine is handled by register RNG_CLK and not through the MISC interface.

Registers

Instances


Instance	Base address	TrustZone			Split access	Description
Instance	Base address	Map	Att	DMA	Split access	Description
CC_MISC	0x50841000	HF	S	NSA	No	CRYPTOCELL MISC interface

Register overview


Register	Offset	Description
AES_CLK	0x810	Clock control for the AES engine.
HASH_CLK	0x818	Clock control for the HASH engine.
PKA_CLK	0x81C	Clock control for the PKA engine.
DMA_CLK	0x820	Clock control for the DMA engines.
CLK_STATUS	0x824	CRYPTOCELL clocks status register.
CHACHA_CLK	0x858	Clock control for the CHACHA engine.

AES_CLK

Address offset: 0x810

Clock control for the AES engine.


Bit number				31	30	29	28	27	26	25	24	23	22	21	20	19	18	17	16	15	14	13	12	11	10	9	8	7	6	5	4	3	2	1	0
ID																																			A
Reset 0x00000000				0	0	0	0	0	0	0	0	0	0	0	0	0	0	0	0	0	0	0	0	0	0	0	0	0	0	0	0	0	0	0	0
ID	R/W	Field	Value ID	Value								Description
A	W	ENABLE										Enables clock for the AES engine.
			Disable	0								Disable clock for the AES engine.
			Enable	1								Enable clock for the AES engine.

HASH_CLK

Address offset: 0x818

Clock control for the HASH engine.


Bit number				31	30	29	28	27	26	25	24	23	22	21	20	19	18	17	16	15	14	13	12	11	10	9	8	7	6	5	4	3	2	1	0
ID																																			A
Reset 0x00000000				0	0	0	0	0	0	0	0	0	0	0	0	0	0	0	0	0	0	0	0	0	0	0	0	0	0	0	0	0	0	0	0
ID	R/W	Field	Value ID	Value								Description
A	W	ENABLE										Enables clock for the HASH engine.
			Disable	0								Disable clock for the HASH engine.
			Enable	1								Enable clock for the HASH engine.

PKA_CLK

Address offset: 0x81C

Clock control for the PKA engine.


Bit number				31	30	29	28	27	26	25	24	23	22	21	20	19	18	17	16	15	14	13	12	11	10	9	8	7	6	5	4	3	2	1	0
ID																																			A
Reset 0x00000000				0	0	0	0	0	0	0	0	0	0	0	0	0	0	0	0	0	0	0	0	0	0	0	0	0	0	0	0	0	0	0	0
ID	R/W	Field	Value ID	Value								Description
A	W	ENABLE										Enables clock for the PKA engine.
			Disable	0								Disable clock for the PKA engine.
			Enable	1								Enable clock for the PKA engine.

DMA_CLK

Address offset: 0x820

Clock control for the DMA engines.


Bit number				31	30	29	28	27	26	25	24	23	22	21	20	19	18	17	16	15	14	13	12	11	10	9	8	7	6	5	4	3	2	1	0
ID																																			A
Reset 0x00000000				0	0	0	0	0	0	0	0	0	0	0	0	0	0	0	0	0	0	0	0	0	0	0	0	0	0	0	0	0	0	0	0
ID	R/W	Field	Value ID	Value								Description
A	W	ENABLE										Enables clock for the DMA engines.
			Disable	0								Disable clock for the DMA engines.
			Enable	1								Enable clock for the DMA engines.

CLK_STATUS

Address offset: 0x824

CRYPTOCELL clocks status register.


Bit number				31	30	29	28	27	26	25	24	23	22	21	20	19	18	17	16	15	14	13	12	11	10	9	8	7	6	5	4	3	2	1	0
ID																											E	D				C	B		A
Reset 0x00000100				0	0	0	0	0	0	0	0	0	0	0	0	0	0	0	0	0	0	0	0	0	0	0	1	0	0	0	0	0	0	0	0
ID	R/W	Field	Value ID	Value								Description
A	R	AES_CLK										Status of AES engine clock.
			Disabled	0								Clock for AES engine is disabled
			Enabled	1								Clock for AES engine is enabled
B	R	HASH_CLK										Status of HASH engine clock.
			Disabled	0								Clock for HASH engine is disabled
			Enabled	1								Clock for HASH engine is enabled
C	R	PKA_CLK										Status of PKA engine clock.
			Disabled	0								Clock for PKA engine is disabled
			Enabled	1								Clock for PKA engine is enabled
D	R	CHACHA_CLK										Status of CHACHA engine clock.
			Disabled	0								Clock for CHACHA engine is disabled
			Enabled	1								Clock for CHACHA engine is enabled
E	R	DMA_CLK										Status of DMA engines clock.
			Disabled	0								Clocks for DMA engines are disabled
			Enabled	1								Clocks for DMA engines are enabled

CHACHA_CLK

Address offset: 0x858

Clock control for the CHACHA engine.


Bit number				31	30	29	28	27	26	25	24	23	22	21	20	19	18	17	16	15	14	13	12	11	10	9	8	7	6	5	4	3	2	1	0
ID																																			A
Reset 0x00000000				0	0	0	0	0	0	0	0	0	0	0	0	0	0	0	0	0	0	0	0	0	0	0	0	0	0	0	0	0	0	0	0
ID	R/W	Field	Value ID	Value								Description
A	W	ENABLE										Enables clock for the CHACHA engine.
			Disable	0								Disable clock for the CHACHA engine.
			Enable	1								Enable clock for the CHACHA engine.