The Advanced Encryption Standard (AES) hardware engine is designed according to FIPS197 for use in encrypt/decrypt and sign/verify operations for 128 bits, 192 bits, and 256 bits key sizes.
The following cipher modes are supported:
- ECB
- CBC
- CBC-MAC
- CMAC
- CTR
- CCM
- CCM*
- GCM
- XEX/XTS
- XCBC-MAC
- OFB
The AES engine supports both non-tunneling and tunneling operations. In tunneling operation the AES engine can process data using one set of Key/Mode/IV values, and then immediately process the result from the first operating using another set of Key/Mode/IV values. This enables the engine to process both a data stream and the corresponding message authentication code (MAC) handling in parallel.
Note:
To ensure proper operation when writing 128 bits, 192 bits, and 256 bits AES keys,
the write-only key registers of the AES engine must be written in ascending order,
starting with:
For 192 bits and 256 bits AES keys, this must be followed by:
For 256 bits AES keys, this must be followed by:
Additionally, for tunneling operations using 128 bits, 192 bits, and 256 bits AES keys,
the write-only key registers for the second stage must also be written in ascending order,
starting with:
For 192 bits and 256 bits second stage AES tunneling keys, this must be followed by:
For 256 bits second stage AES tunneling keys, this must be followed by: