Encryption and decryption

nRF54L15 | nRF54L10 | nRF54L05 Datasheet

CCM supports both packet encryption and decryption.

The following table shows the different CCM input/output and parameters supported by the CCM module for encryption and decryption:

Table 1. CCM Parameters
Parameter Valid input Description
M 0, 4, 6, 8, 10, 12, 14, 16 Number of bytes in the authentication field
L 2 (fixed) Number of bytes in the length field
l(a) 0-65279 Number of bytes in additional authenticated data
l(m) 0-(65535 - M) Number of bytes in the message to authenticate and encrypt
l(c) 0-65535 Number of bytes in the encrypted message; l(m) + M bytes
a l(a) number of bytes Additional authenticated data
m l(m) number of bytes Message to authenticate and encrypt
c l(c) number of bytes Encrypted message
In addition to the parameters listed above, the CCM requires two sets of data: a 128-bit key and a 128-bit nonce. These are supplied via dedicated register interfaces: KEY.VALUE registers for the 128-bit key, and NONCE.VALUE registers for the 128-bit nonce. The 128-bit key in the KEY.VALUE registers is stored in reverse byte order relative to the payload. For example, using the sample session key from the Bluetooth Core Specification v5.4, Volume 6, Part C, chapter 1.2:
  • Session Key (SK): 99AD1B5226A37E3E058E3B8E27C2C666
The KEY.VALUE registers are populated as follows: The same reverse byte order is used for the NONCE.VALUE registers. For the packet example "3. Data packet1" with the following values:
  • IV: DEAFBABEBADCAB24
  • Direction Bit: 1
  • Packet Counter: 1
The NONCE.VALUE registers are populated as follows:
Note: Although the NONCE in the example above is 13 bytes, it must be written as a 16-byte value with the first 3 bytes zero-padded.
Note: The KEY and NONCE byte order is reversed compared to the NRF52 and NRF53 series devices.