Encryption in nrf52840, hardware or software?

[Omid]

Hello my friends,

I was reading the nrf52840 documentation regarding the encryption.

I have realized there are two specifications which point to the fact that there are dedicated pieces of hardware for encyrption/dycrption goals

•  ARM TrustZone Cryptocell 310 cryptographic accelerator

•  128 bit AES/ECB/CCM/AAR co-processor (on-the-fly packet encryption)

I can see there are several peripherals being mentioned in the documentation such as CCM-AES, CRYPTOCELL, ECB - AES. Reading the materials, I realized it is mentioned that all the said peripherals are using the same "AES core and that ECB has the lowest priority for using this shared resource. So, my first question/conclusion is that what here is meant by "AES-Core" is literally a hardware computation core separate from the CPU. Is the correct?

If so, then if all the encryption/decryption tasks are done through this computation core and using the easyDMA?

Is there any encryption/decryption done in software using the CPU instead of using the AES core?

If there is also the cpu-based cryptography then how does that compare in terms of energy consumption and computation speed with respect to the AES-based chryptography? 

Also, I realized there are several examples in the crypto folder such as 

• aes_cbc
• aes_ccm
• aes_ctr
• aes_gcm

Could you please tell if these examples use ECB peripheral? If not, how they can perform chrytographic task while being detached from the radio?

[Amanda Hsieh]

Hi,

what here is meant by "AES-Core" is literally a hardware computation core separate from the CPU. Is the correct?

The AES-Core means the General-purpose AES engine in the CRYPTOCELL — ARM TrustZone CryptoCell 310.  

If so, then if all the encryption/decryption tasks are done through this computation core and using the easyDMA?

The CCM and ECB implement an EasyDMA mechanism for reading and writing to the Data RAM.

Is there any encryption/decryption done in software using the CPU instead of using the AES core?

If there is also the cpu-based cryptography then how does that compare in terms of energy consumption and computation speed with respect to the AES-based chryptography? 

There is no sample such as your requirement, but I think you could implement by yourself. 

Could you please tell if these examples use ECB peripheral? If not, how they can perform chrytographic task while being detached from the radio?

Example usage of ECB peripheral:
1) https://github.com/nrfconnect/sdk-zephyr/blob/main/subsys/bluetooth/controller/ll_sw/nordic/hal/nrf5/ecb.c
2) https://github.com/nrfconnect/sdk-zephyr/blob/main/drivers/crypto/crypto_nrf_ecb.c

Regards,
Amanda H.

[Omid]

Thanks for the answer, but I feel like I do not receive the answer to my questions completely. Could you answer to the following original questions of mine?

Omid said:

is literally a hardware computation core separate from the CPU. Is the correct?

Omid said:

If so, then if all the encryption/decryption tasks are done through this computation core

Omid said:

Could you please tell if these examples use ECB peripheral?

Omid said:

If not, how they can perform chrytographic task while being detached from the radio?

[Amanda Hsieh]

Omid said:

is literally a hardware computation core separate from the CPU. Is the correct?

Yes.

Omid said:

If so, then if all the encryption/decryption tasks are done through this computation core

Not all, only the encryption/decryption are supported by the AES. 

Omid said:

Could you please tell if these examples use ECB peripheral?

Those examples demonstrate the encryption and decryption of a sample plaintext without using ECB.

Omid said:

If not, how they can perform chrytographic task while being detached from the radio?

See
Encrypting packets on-the-fly in radio transmit mode

Decrypting packets on-the-fly in rado receive mode

Just note that ECB peripheral can only be accessed through the Softdevice controller API if you use BLE: https://developer.nordicsemi.com/nRF_Connect_SDK/doc/latest/nrfxlib/softdevice_controller/doc/api.html#c.sdc_soc_ecb_block_encrypt 

-Amanda H.