AN4240
Application note
Introduction to the Cryptographic Service Engine (CSE) module for
SPC56ECxx and SPC564Bxx devices
Introduction
This application note provides an easy introduction to the usage of the CSE module inside the
SPC56ECxx and SPC564Bxx family of devices.
The CSE module implements the security functions described in the Secure Hardware Extension (SHE)
functional specification version 1.1.
Three examples show main the features of the cryptographic service engine and in the same time the
differences between the Electronic Code Book (ECB), and the Cipher Block Chaining (CBC) mode of the
Advanced Encryption Standard (AES) algorithm, defined by SHE specification.
In particular, first example shows how to load cryptographic keys into secure flash in order to permit the
usage of the cryptographic module. Second application code shows that if a data or an image has a low
variance, the CBC cipher mode provides a best performance in terms of message encryption in
comparison with the ECB cipher mode. Last example code shows how to release a Secure Boot in order
to prevent application code from being altered by an unauthorized party cipher.
September 2013
Doc ID024189 Rev 2
1/30
www.st.com
Contents
AN4240
Contents
1
2
CSE IP block overview . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 5
AES-128 encryption and decryption overview . . . . . . . . . . . . . . . . . . . . 7
2.1
2.2
2.3
Electronic Code Book (ECB) . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 7
Cipher Block Chaining (CBC) . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 8
CMAC (Cipherbased Message Authentication Code) . . . . . . . . . . . . . . . . 8
3
4
5
Secure Boot procedure . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 9
Secure storage for cryptographic keys . . . . . . . . . . . . . . . . . . . . . . . . . 11
Application code structure . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 13
5.1
5.2
Peripherals and tools used . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 13
Code Implementation . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 13
5.2.1
5.2.2
5.2.3
5.2.4
5.2.5
5.2.6
5.2.7
Disable Software Watchdog . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 14
Mode Init . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 14
PLL configuration function . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 15
CSE initialization function . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 16
Load Crypto Keys function . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 17
App code to be added to have a secure boot . . . . . . . . . . . . . . . . . . . . 17
Demo application code . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 19
6
7
Application demo results . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 21
Conclusion . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 25
Appendix A How to generate the M1-M5 parameters . . . . . . . . . . . . . . . . . . . . . 26
A.1
A.2
Memory update protocol . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 26
Cryptographic keys used. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 27
Appendix B References . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 28
B.1
Reference documents . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 28
Revision history . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 29
2/30
Doc ID024209 Rev 2
AN4240
List of tables
List of tables
Table 1.
Table 2.
Table 3.
Table 4.
Table 5.
Table 6.
Secure boot example structure to add at the start of boot sectorr . . . . . . . . . . . . . . . . . . . . 9
Memory Slots . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 11
Key attributes . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 11
Memory Update Policy . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 12
Examples of Keys used for the project . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 27
Revision history . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 29
Doc ID024209 Rev 2
3/30
List of figures
AN4240
List of figures
Figure 1.
Figure 2.
Figure 3.
Figure 4.
Figure 5.
Figure 6.
Figure 7.
Figure 8.
Figure 9.
Figure 10.
Figure 11.
Figure 12.
Figure 13.
Figure 14.
Figure 15.
Figure 16.
Figure 17.
Figure 18.
Figure 19.
Figure 20.
CSE IP block. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 5
ECB block diagram . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 7
CBC block diagram . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 8
CMAC Scheme . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 8
Secure Boot Mode procedure . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 10
Software Watchdog disable function . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 14
Mode Init function . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 15
PLL init function . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 16
CSE init function . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 16
Get UID function . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 17
Load Key function . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 17
Secure boot code . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 18
Locator file . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 18
Locator memory setup . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 19
Encryption/Decryption functions . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 20
Demo Starting point . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 21
ECB encryption. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 22
CBC encryption. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 23
ECB decryption. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 23
CBC decryption. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 24
4/30
Doc ID024209 Rev 2
AN4240
CSE IP block overview
1
CSE IP block overview
Cryptographic Service Engine (CSE) is a peripheral module that implements the security
functions described in the Secure Hardware Extension (SHE) Functional Specification
Version 1.1.
The CSE is an on-chip extension of the microcontroller. It is intended to move the control
over cryptographic keys from software domain into the hardware domain and therefore
protect those keys from software attacks.
CSE design includes a host interface (via peripheral bridge) with a set of memory mapped
registers used by CPU to issue commands (for example Get_ID, INIT_CSE, etc).
Furthermore a system bus interface (via xbar IF) allows the CSE to directly access the
system memory. Here the crypto module behaves like any other master. Through the host
interface the user configures and controls the CSE module, for example putting the module
into low power mode, enabling interrupts for finished command processing or suspending
command processing. The status and error register gives further system information.
Figure 1. CSE IP block
Two dedicated blocks of system flash memory are used by the CSE for secure key and
firmware storage. These blocks are not accessible by other masters from system and
therefore are called secure flash. The command processing is done by a 32-bit CSE core
with attached ROM and RAM running at system frequency of SoC. See
Figure 1.
Doc ID024209 Rev 2
5/30
LED专区
京公网安备 11010802033920号
Copyright © 2005-2026 EEWORLD.com.cn, Inc. All rights reserved
电子工程世界
