Product Specs

29 CCM — AES CCM mode encryption
Page
267
ENDKSGEN
CRYPT
encryption / decryption
key-stream
generation
29 CCM — AES CCM mode encryption
Cipher block chaining - message authentication code (CCM) mode is an authenticated encryption algorithm
designed to provide both authentication and confidentiality during data transfer. CCM combines counter
mode encryption and CBC-MAC authentication. The CCM terminology "Message authentication code
(MAC)" is called the "Message integrity check (MIC)" in 'Bluetooth terminology and also in this document.
The CCM block generates an encrypted keystream that is applied to input data using the XOR operation
and generates the 4 byte MIC field in one operation. The CCM and radio can be configured to work
synchronously. The CCM will encrypt in time for transmission and decrypt after receiving bytes into memory
from the Radio. All operations can complete within the packet RX or TX time. CCM on this device is
implemented according to Bluetooth requirements and the algorithm as defined in IETF RFC3610, and
depends on the AES-128 block cipher. A description of the CCM algorithm can also be found in NIST Special
Publication 800-38C. The Bluetooth specification describes the configuration of counter mode blocks and
encryption blocks to implement compliant encryption for BLE.
The CCM block uses EasyDMA to load key, counter mode blocks (including the nonce required), and to
read/write plain text and cipher text.
The AES CCM supports three operations: key-stream generation, packet encryption, and packet decryption.
All these operations are done in compliance with the Bluetooth specification.
23
A new key-stream must be
generated before a new packet encryption or packet decryption operation can be started.
A key-stream is generated by triggering the KSGEN task. An ENDKSGEN event will be generated when the
new key-stream has been generated. The key-stream will be stored in the AES CCM’s temporary memory
area, specified by the SCRATCHPTR, where it will be used in subsequent encryption and decryption
operations.
Encryption is started by triggering the CRYPT task with the MODE register set to ENCRYPTION. Similarly,
decryption is started by triggering the same task with MODE set to DECRYPTION. An ENDCRYPT event
will be generated when packet encryption is completed as well as when packet decryption is completed, see
Figure 59: Key-stream generation followed by encryption or decryption. The shortcut is optional. on page
267.
KSGEN ENDCRYPT
SHORTCUT
Figure 59: Key-stream generation followed by encryption or decryption. The shortcut is optional.
Key-stream generation, packet encryption, and packet decryption operations utilize the configuration
specified in the data structure pointed to by the CNFPTR pointer. It is necessary to configure this pointer and
its underlying data structure, and the MODE register before the KSGEN task is triggered. It is also necessary
to configure the INPTR pointer and the OUTPTR pointer before the CRYPT task is triggered.
If a shortcut is used between ENDKSGEN event and CRYPT task, the INPTR pointer and the OUTPTR
pointer must be configured before the KSGEN task is triggered.
The AES CCM supports different packet lengths, this is configured via the PACKETLENGTH field in the
MODE register.
23
Bluetooth AES CCM 128 bit block encryption, see Bluetooth Core specification Version 4.0.