CRACEN (Cryptographic accelerator engine) is a dedicated hardware peripheral that provides a comprehensive set of cryptographic primitives and services to accelerate and harden cryptographic operations on the device.
CRACEN integrates symmetric ciphers, authenticated encryption, public-key arithmetic engines, and high-quality random number generation. It also includes an isolated key generator (IKG) to provision and hold keys securely, reducing exposure of sensitive material to the host CPU and software.
CRACEN is intended to offload compute-intensive and security-sensitive tasks from the main processor: encrypting and decrypting data, computing digests and message authentication codes, performing signature generation and verification, and carrying out key-exchange protocols such as Diffie-Hellman.
The main features of the CRACEN peripheral are the following:
- AES – supports 128- and 256- bit keys, but excludes multi-part operations . Up to 1 MB operation size for AES-CCM and AES-CTR.
- Chacha20-Poly1305, but without multi-part operations
- SHA – SHA1, SHA3, SHA-224, SHA-256, SHA-384, SHA-512
- Public key cryptographic engine (PKE)
- Modular exponentiation – RSA with 4096-bit maximum operand size
- Elliptic curve cryptography (ECC) with 640-bit maximum operand size
- Digital signature algorithm (DSA) and Elliptic curve digital signature algorithm (ECDSA), with 4096-bit maximum operand size
- Diffie-Hellman (D-H and ECD-H) key exchange
- Random number generators (RNG) – NDRNG, including TRNG
- Deterministic random bit generator (DRBG)
- Isolated key generator (IKG) – One asymmetric key and two symmetric (AES) keys
- Counter measures against side channel analysis for PKE and AES