Datasheet

3. Last Output Data Mode (LOD)
This mode is used to generate message authentication code (MAC) on data in CCM mode of
operation. The CCM mode combines counter mode for encryption and CBC-MAC generation for
authentication.
When LOD is disabled in CCM mode then counter mode of encryption is performed on the input data
block.
When LOD is enabled in CCM mode then CBC-MAC generation is performed. Zero block is used as the
initialization vector by the hardware. Also software read from the Output Data Register (DATA) is not
required to clear the ENCCMP flag. The ENCCMP flag is automatically cleared by writing into the Input
Data Register (DATA). This allows retrieval of only the last data in several encryption/decryption
processes. No output data register reads are necessary between each block of encryption/decryption
process.
Note that assembling message depending on the security level identifier in CCM* has to be done in
software.
42.6.2.5 Computation of last Nk words of expanded key
The AES algorithm takes the cryptographic key provided by the user and performs a Key Expansion
routine to generate an expanded key. The expanded key contains a total of 4(Nr + 1) 32-bit words, where
the first Nk (4/6/8 for a 128-/192-/256-bit key) words are the user-provided key. For data encryption, the
expanded key is used in the forward direction, i.e., the first four words are used in the initial round of data
processing, the second four words in the first round, the third four words in the second round, and so on.
On the other hand, for data decryption, the expanded key is used in the reverse direction, i.e.,the last four
words are used in the initial round of data processing, the last second four words in the first round, the
last third four words in the second round, and so on.
To reduce gate count, the AES module does not generate and store the entire expanded key prior to data
processing. Instead, it computes on-the-fly the round key (four 32-bit words) required for the current
round of data processing. In general, the round key for the current round of data processing can be
computed from the Nk words of the expanded key generated in the previous rounds. When AES module
is operating in the encryption mode, the round key for the initial round of data processing is simply the
user-provided key written to the KEY registers. On the other hand, when AES module is operating in the
decryption mode, the round key for the initial round of data processing is the last four words of the
expanded key, which is not available unless AES module has performed at least one encryption process
prior to operating in the decryption mode.
In general, the last Nk words of the expanded key must be available before decryption can start. If
desired, AES module can be instructed to compute the last Nk words of the expanded key in advance by
writing a one to the Key Generate (KEYGEN) bit in the CTRLA register (CTRLA.KEYGEN). The
computation takes Nr clock cycles. Alternatively, the last Nk words of the expanded key can be
automatically computed by AES module when a decryption process is initiated if they have not been
computed in advance or have become invalid. Note that this will introduce a latency of Nr clock cycles to
the first decryption process.
42.6.2.6 Hardware Countermeasures against Differential Power Analysis Attacks
The AES module features four types of hardware countermeasures that are useful for protecting data
against differential power analysis attacks:
• Type 1: Randomly add one cycle to data processing
• Type 2: Randomly add one cycle to data processing (other version)
SAM D5x/E5x Family Data Sheet
AES – Advanced Encryption Standard
© 2019 Microchip Technology Inc.
Datasheet
DS60001507E-page 1418