US 12,615,249 B2Granted

AES-GCM engine optimized for execute-in-place authenticated decryption

AssigneeSilicon Laboratories Inc.

InventorsHeng Wee Cheng, Joshua Norem, Steven Cooreman, Phil Matthews

Life of this patent

Estimating the term…

Loading patent…

Abstract

A system and method for performing execute-in-place is disclosed, wherein the code is encrypted using AES-GCM and stored in an external memory device. The system includes only one cipher function that is used to encrypt the three counter values that are used to decrypted the encrypted code and to validate the Message Authentication Code (MAC). In some embodiments, the system precalculates a hash subkey so that generation of the Counter 0 value can begin as soon as a valid memory address is available. In addition, the cipher function is modified to utilized two or more cipher generation circuits and only one key expansion circuit. This improves the speed of the operation without a complete duplication of the cipher function hardware. In another embodiment, the cipher function is unrolled so that two or more rounds of key expansion and cipher generation are performed each clock cycle.

Claims13

Dependent claims

A wireless network device, comprising:

a network interface;
a processing unit;
an Advanced Encryption Standard (AES) engine, utilizing Advanced Encryption Standard-Galois/Counter Mode (AES-GCM), adapted to interface with an external memory device, utilizing a Serial Peripheral Interface (SPI) interface and comprising:
exactly one Galois Hash (GHASH) function, wherein an encrypted Hash subkey value is precalculated and stored in a register and is used during each transaction, in combination with a memory address, to generate a value for Counter 0;
exactly one cipher function, wherein the exactly one cipher function comprises exactly one key expansion circuit and one or more cipher generation circuits;
wherein the AES engine is configured to:
use the GHASH function to generate a Counter 0 value using the encrypted Hash subkey value, wherein the GHASH function begins execution when a valid memory address is available;
increment the Counter 0 value to generate a Counter 1 value and a Counter 2 value;
use the exactly one cipher function to encrypt the Counter 0 value, the Counter 1 value and the Counter 2 value to generate an encrypted Counter 0 value, an encrypted Counter 1 value and an encrypted Counter 2 value;
receive encrypted code from the external memory device as eight doublewords and a Message authentication code (MAC) having two doublewords;
decrypt the eight doublewords by XORing the encrypted Counter 1 value and the encrypted Counter 2 value with the encrypted data to obtain plaintext data;
perform the GHASH function on the encrypted data and XOR with the encrypted Counter 0 value to generate an authentication tag;
and
authenticate the MAC within eight clock cycles after receiving the MAC by comparing it with the authentication tag, so as to allow execute-in-place.

11 more elements

A method of decrypting encrypted data and authenticating a message authentication code (MAC) read from an external memory device, wherein the encrypted data comprises 8 doublewords and the MAC comprises 2 doublewords, comprising:

calculating a hash subkey prior to reading the encrypted data from the external memory device;
using a Galois Hash (GHASH) function to generate a Counter 0 value using the hash subkey, wherein the GHASH function begins execution when a valid memory address is available;
incrementing the Counter 0 value to generate a Counter 1 value and a Counter 2 value;
using exactly one cipher function to encrypt the Counter 0 value, the Counter 1 value and the Counter 2 value to generate an encrypted Counter 0 value, an encrypted Counter 1 value and an encrypted Counter 2 value, wherein the exactly one cipher function comprises a circuit that includes exactly one key expansion circuit and one or more cipher generation circuits and the same circuit is used to encrypt the Counter 0 value, the Counter 1 value and the Counter 2 value;
decrypting the encrypted data by XORing the encrypted Counter 1 value and the encrypted Counter 2 value with the encrypted data to obtain plaintext data;
performing the GHASH function on the encrypted data and XORing with the encrypted Counter 0 value to generate an authentication tag;
and
comparing the authentication tag with the MAC to authenticate the MAC, wherein the authentication is performed within eight clock cycles after receiving the MAC, so as to allow execute-in-place.

5 more elements

Dependencies are inferred from the claim text.