Input/output data encryption

A non-transitory machine-readable storage medium comprising instructions executable by an Integrated Circuit (IC) in a computing device to:

• receive plaintext data;
• determine, based on a selector indication associated with the plaintext data, whether the plaintext data is to be sent to a memory in the computing device or to an Input/Output (I/O) device, wherein a first value of the selector indication indicates that the plaintext data is to be sent to the memory, and a second value of the selector indication indicates that the plaintext data is to be sent to the I/O device;
• in response to determining based on the selector indication that the plaintext data is to be sent to the I/O device:
• select a first technique from different techniques for generating an initialization vector, the different techniques comprising the first technique to use a random number in the initialization vector, and a second technique to use an address of the plaintext data in the initialization vector,
• apply an encryption primitive of an authenticated block cipher encryption algorithm to the plaintext data to create output encrypted data, wherein the initialization vector comprising the random number is applied to the encryption primitive, and
• generate an authentication tag for the output encrypted data;
• and
• generate a page in the memory of the computing device, the page comprising a data subpage storing the output encrypted data, and a metadata subpage storing the initialization vector.

A method comprising:

• receiving, by a processor on an Integrated Circuit (IC) of a computing device, plaintext data;
• determining, by the processor based on a selector indication associated with the plaintext data, whether the plaintext data is to be sent to a memory in the computing device or to an Input/Output (I/O) device, wherein a first value of the selector indication indicates that the plaintext data is to be sent to the memory, and a second value of the selector indication indicates that the plaintext data is to be sent to the I/O device;
• and
• in response to determining based on the selector indication that the plaintext data is to be sent to the I/O device:
• selecting, by the processor, a first technique from different techniques for generating an initialization vector, the different techniques comprising the first technique to use a random number in the initialization vector, and a second technique to use an address in the initialization vector, and
• applying, by the processor an encryption primitive of a block cipher encryption algorithm to the plaintext data to create output encrypted data, wherein the initialization vector that comprises the random number is applied to the encryption primitive;
• receiving, by the IC, a request to write the plaintext data to the I/O device, wherein the determining, the selecting, and the applying are performed in response to the request;
• storing, by the processor, the output encrypted data into a respective address of the memory;
• and
• sending, by the processor, a writing request to the I/O device including the respective address, to cause the I/O device to copy the output encrypted data from the memory to the I/O device.