CryptoCell CC310 AES CCM* CRYS_FATAL_ERROR after 2nd decrypt operation

[chris-ho]

Hello guys,

During implementation of a test set for CryptoCell AES CCM* functionality i'm facing some issue with the CryptoCell.

Encryption works fine without any issue. When it comes to the decryption parts only first test set passed whereas the second fails with error code 0x00F5000, CRYS_FATAL_ERROR.

Initialization covers following steps:

NRF_CRYPTOCELL->ENABLE = 1;

SaSi_LibInit()

CRYS_AESCCMStar_Init()

the test cases are the following 2 where it does not matter if you swap them.

   aes_ccms_dec_suite_t aes_ccms_dec_suite[] = {

    {
        { 0x12, 0x34, 0x56, 0x78, 0x9a, 0xbc, 0xde, 0xf0, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00 }, /* key */
        0, /* tag len */
        { 0x00, 0x00, 0xf0, 0xe0, 0xd0, 0xc0, 0xb0, 0xa0, 0x00, 0x00, 0x00, 0x00, 0x04 }, /* nonce */
        { 0x69, 0x98, 0x03, 0x33, 0x63, 0xbb, 0xaa, 0x01, 0x00, 0x0d, 0x00, 0x00, 0x00, 0x00, 0x03}, /* a vector */
        { 0x92, 0xe8, 0xad, 0xca, 0x53, 0x81, 0xbf, 0xd0, 0x5b, 0xdd, 0xf3, 0x61, 0x09, 0x09, 0x82, 0xe6, 0x2c,
           0x61, 0x01, 0x4e, 0x7b, 0x34, 0x4f, 0x09}, /* c vector (m + tag) */
        0, /* len_a */
        20, /* len_m */
        2, /* CCM L */
        { 0x14, 0xaa, 0xbb, 0x00, 0x00, 0x01, 0x02, 0x03, 0x04, 0x05, 0x06, 0x07, 0x08, 0x09, 0x0a, 0x0b,
            0x0c, 0x0d, 0x0e, 0x0f } /* expected plaintext */
    },
      {
        { 0x12, 0x34, 0x56, 0x78, 0x9a, 0xbc, 0xde, 0xf0, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00 }, /* key */
        4, /* tag len */
        { 0x00, 0x00, 0xf0, 0xe0, 0xd0, 0xc0, 0xb0, 0xa0, 0x00, 0x00, 0x00, 0x00, 0x05 }, /* nonce */
        { 0x69, 0x98, 0x03, 0x33, 0x63, 0xbb, 0xaa, 0x01, 0x00, 0x0d, 0x00, 0x00, 0x00, 0x00, 0x03 }, /* a vector */
        { 0x92, 0xe8, 0xad, 0xca, 0x53, 0x81, 0xbf, 0xd0, 0x5b, 0xdd, 0xf3, 0x61, 0x09, 0x09, 0x82, 0xe6, 0x2c,
            0x61, 0x01, 0x4e, 0x7b, 0x34, 0x4f, 0x09 }, /* c vector (m + tag) */
        15, /* len_a */
        24, /* len_c */
        2, /* CCM L */
        { 0x14, 0xaa, 0xbb, 0x00, 0x00, 0x01, 0x02, 0x03, 0x04, 0x05, 0x06, 0x07, 0x08, 0x09, 0x0a, 0x0b,
            0x0c, 0x0d, 0x0e, 0x0f } /* expected plaintext */
      },
   };
   
foreach aes_ccms_dec_suite[]
 
CRYS_AESCCMStar(
                SASI_AES_DECRYPT,
                key,
                CRYS_AES_Key128BitSize,
                nonce,
                (15-l), 
                a,
                len_a,
                m,
                *len_m,
                m,
                len_mac,
                &m[*len_m]
);

Calling SaSi_LibFini makes no sense for me. And somesthing like CRYS_AESCCM_Finish is not existing.

I also tried to initialze the user context again before i call any crypto operation using CRYS_AESCCMStar_Init with Encrypt or Decrypt respectivly - without success. Which brought me to the point leaving that call aside which had no consequences so far.

Any considerations what might be issue, or do i miss something? Is there any other documentation of the library API than https://infocenter.nordicsemi.com/index.jsp?topic=%2Fcom.nordic.infocenter.sdk5.v14.2.0%2Fgroup__cryptocell__api.html ?

Best regards

Chris

[chris-ho]

Hi Jakub Rzeszutko,

Sorry for the inconvinience, when I packed the project i deleted to much files. Thanks also for clarification regarding the intialisation process.

this is the state running the 2nd test set for decrypt, thats is cause why run_aes_ccms_dec_suite fails later

[Jakub Rzeszutko]

Please do test with modification I've proposed and let me know if there is any difference. So all arguments to function cryptoengine_aes_ccms_dec shall be changed from suite[i] to suite[0]

[Jakub Rzeszutko]

But when len was set to 24 you were passing cipher text length == 24 to crypto library and in addition you were passing tag_len = 4. So 28 bytes in total.

So CRYS_AESCCMStar were using 28 bytes on 24 bytes array. This might cause some memory corruption.

[chris-ho]

okay understood, meanwhile i came to the same thought

what is then the reason why decryption fails for suite[0] where tag_len is 0 and cipher text length is 20 which i posted above?

[Jakub Rzeszutko]

Second test suit is decrypting fine (success++). I am checking first one.

[Jakub Rzeszutko]

Ok,

This is much complex problem. In fact you are NOT checking if first test suit was sucessfully encrypted. And... it was not. I don't know why yet but len_m == 0 when using memory compare function. I am trying to investigate that.

[Jakub Rzeszutko]

OK, I found a bug in the code - you have bad memory alignment!

CRYS_AESCCMStar expect to have 16 byte for Mac_Res. You are not passing that.

So you need to increase your arrays in structures aes_ccms_enc_suite_t and aes_ccms_dec_suite_t:

uint8_t m[20 + 16];

and 

uint8_t c[20 + 16];

Once this is done you will observe that your encryption test vector (suit[0]) is broken. Cipher text is not matching expected ciper text.

Test vector suit[1] is fine for encryption and decryption.

[chris-ho]

I will check that with memory alignement.

The example vectors have been taken from an AES CCM implementation, which according to the specification of CCM* coincides. But is not able to handle encryption without authentication.

The test vectors from IEEE802.15.4-2015 i couln't test see:

devzone.nordicsemi.com/.../cryptocell-cc310-aes-ccm-arbitrary-nonce