Product Specs

Table Of Contents
29 CCM AES CCM mode encryption
Page
268
Scratch area
29.1 Shared resources
The CCM shares registers and other resources with other peripherals that have the same ID as the CCM.
The user must therefore disable all peripherals that have the same ID as the CCM before the CCM can be
configured and used.
Disabling a peripheral that have the same ID as the CCM will not reset any of the registers that are shared
with the CCM. It is therefore important to configure all relevant CCM registers explicitly to secure that it
operates correctly.
See the Instantiation table in Instantiation on page 24 for details on peripherals and their IDs.
29.2 Encryption
During packet encryption, the AES CCM will read the unencrypted packet located in RAM at the address
specified in the INPTR pointer, encrypt the packet and append a four byte long Message Integrity Check
(MIC) field to the packet.
The AES CCM will also modify the length field of the packet to adjust for the appended MIC field, that is,
add four bytes to the length, and store the resulting packet back into RAM at the address specified in the
OUTPTR pointer, see Figure 60: Encryption on page 268.
Empty packets (length field is set to 0) will not be encrypted but instead moved unmodified through the AES
CCM.
INPTR
SCRATCH PTR
OUTPTR
Unencrypted packet
Encrypted packet
MODE = ENCRYP TION
H: Header (S0)
L: Length
RFU: reserved for future use (S1)
PL: unencrypted payload
EPL: encrypted payload
H
L+4
RFU
EPL
MIC
CNF
Figure 60: Encryption
29.3 Decryption
During packet decryption, the AES CCM will read the encrypted packet located in RAM at the address
specified in the INPTR pointer, decrypt the packet, authenticate the packet’s MIC field and generate the
appropriate MIC status.
The AES CCM will also modify the length field of the packet to adjust for the MIC field, that is, subtract
four bytes from the length, and then store the decrypted packet into RAM at the address pointed to by the
OUTPTR pointer, see Figure 61: Decryption on page 269.
The CCM is only able to decrypt packets that are at least 5 bytes long, that is, 1 byte or more encrypted
payload (EPL) and 4 bytes of MIC. The CCM will therefore generate a MIC error for packets where the length
field is set to 1, 2, 3 or 4.
Empty packets (length field is set to 0) will not be decrypted but instead moved unmodified through the AES
CCM, these packets will always pass the MIC check.
CCM data
structure
PTR
AES CCM
H
L
RFU
PL