For GCM three cases need to be distinguished.
-
The first one is Autonomous GCM Mode where both H and Y0-encrypted are calculated internally. This mode requires that a 128-bit Y0 be provided to the core via the IV together with the mode.
Note:
GCM mode bits must be set to 2’b11.
- The second case is the scenario where H is pre-calculated and Y0 still needs to be encrypted by the engine on a per packet basis. This can be useful when multiple packets use the same AES-key. Since H is constant for all packets using the same key, a pre-calculation saves cycles for each packet using that key. H can simply be calculated by performing a basic AES-ECB encryption with the AES-key and a data block containing all zeros or more formally: H=E(K, {}). Once H is calculated, it
can be loaded with the control data every time a packet is processed that requires the same AES-key.
Note:
GCM mode bits must be set to 2’b10.
- In the last case, neither H nor Y0-encrypted are calculated by the core. In this case, Y0-encrypted is forced to zeros, such that the hash result is not encrypted but provided plain via the TAG output registers. This scenario can be selected if a hash (GHASH) only operation needs to be performed. A scenario where this setting can be used is GCM IV-truncation. The GCM specification [GCM] allows an IV that has a length other than 96-bits. In this case, a basic GHASH operation needs to be
performed to calculate a 128-bit Y0. For a basic GHASH operation, H needs to be pre-calculated (as explained in the previous paragraph). If H is available, the GHASH operation is similar to that of a general GCM operation with H pre-calculated, only the crypto input data will not be encrypted or decrypted.
Note: In the default case a 96-bit IV is combined with a 32-bit counter to create a 128-bit Y0 (meaning: Y0 = {IV||031||1}).
Note: GCM mode bits must be set to 2’b01.