This chapter introduces the GK7206 cipher API sample, sample_cipher. It demonstrates the hardware crypto module: AES symmetric encryption, RSA signing and encryption, HASH digests, random number generation, and efuse key management.
The source lives in sample/cipher/ in the SDK. It is a complete cryptographic reference for building security-related applications.
| Parameter | Value |
|---|---|
Supported algorithms |
AES, RSA, SHA1, SHA256, RNG |
AES working modes |
ECB, CBC, CTR, CFB, OFB |
AES key length |
128-bit, 256-bit |
AES data width |
128-bit |
RSA key length |
1024/2048-bit |
HASH algorithms |
SHA1, SHA256 |
Memory use |
minimal (no hardware dependency) |
NPU use |
none |
| index | Name | Command | Expected result (pass) | Possible failure cause |
|---|---|---|---|---|
| 1 | CIPHER | ./sample_cipher 1 |
AES CBC/CTR/ECB results match the plaintext -> TEST_END_PASS |
encryption or comparison failed |
| 2 | CIPHER-MULTI | ./sample_cipher 2 |
every AES block matches -> PASS | same as above |
| 3 | CIPHER-EFUSE | ./sample_cipher 3 |
efuse CA key round-trip matches -> PASS | no CA key burned in efuse (expected) |
| 4 | HASH | ./sample_cipher 4 |
fixed-length digest printed -> PASS | — |
| 5 | RNG | ./sample_cipher 5 |
random bytes printed -> PASS | — |
| 6 | RSA-SIGN | ./sample_cipher 6 |
sign and verify pass -> PASS | verification failed |
| 7 | RSA-ENC | ./sample_cipher 7 |
public-key encrypt / private-key decrypt match -> PASS | comparison failed |
| 8 | CIPHER-VIA | ./sample_cipher 8 |
virtual-address AES matches -> PASS | comparison failed |
sample/cipher/
├── Makefile # build script
└── sample_cipher.c # main program (with all test cases)
Before building this application, make sure the following are ready:
Tip
This sample has no hardware dependency. No sensor or other peripheral is needed, so you can run it in any situation.
# enter the sample directory
cd <SDK_PATH>/sample
# build the cipher sample
make -C cipher clean && make -C cipher
Or build it from the top level:
make -C sample all
A successful build produces the sample_cipher executable in sample/cipher/.
# transfer to the board over SCP
scp sample/cipher/sample_cipher root@<board-IP>:/tmp/
# or download it over TFTP
tftp -g -r sample_cipher <board-IP>
Note
The binary is very small, so you can run it straight from
/tmpwithout an SD card.
# make it executable
chmod +x /tmp/sample_cipher
# run the test cases (recommended order)
./sample_cipher 4 # HASH test
./sample_cipher 5 # RNG test
./sample_cipher 1 # basic AES test
./sample_cipher 7 # RSA encryption test
./sample_cipher 6 # RSA signature test
./sample_cipher 2 # multi-block batch test
./sample_cipher 8 # virtual-address test
./sample_cipher 3 # efuse test (may fail)
~~~~~~~~~~~~~~~~~~~~~ run sample_cipher ~~~~~~~~~~~~~~~~~~~
chnid 0x2818049
ECB-AES-256-ORI:
0x11 0x11 0x11 0x11 0x11 0x11 0x11 0x11 0x11 0x11 0x11 0x11 0x11 0x11 0x11 0x11
0x11 0x11 0x11 0x11 0x11 0x11 0x11 0x11 0x11 0x11 0x11 0x11 0x11 0x11 0x11 0x11
ECB-AES-256-ENC:
0x86 0x3a 0xe9 0x1f 0xd4 0xcf 0x51 0x13 0x2d 0xc3 0xe4 0xed 0xf0 0x9d 0xbc 0x6e
0x86 0x3a 0xe9 0x1f 0xd4 0xcf 0x51 0x13 0x2d 0xc3 0xe4 0xed 0xf0 0x9d 0xbc 0x6e
ECB-AES-256-DEC:
0x11 0x11 0x11 0x11 0x11 0x11 0x11 0x11 0x11 0x11 0x11 0x11 0x11 0x11 0x11 0x11
0x11 0x11 0x11 0x11 0x11 0x11 0x11 0x11 0x11 0x11 0x11 0x11 0x11 0x11 0x11 0x11
****************** ecb_aes256 test PASS ******************
chnid 0x2818049
CBC-AES-256-ORI:
0x6b 0xc1 0xbe 0xe2 0x2e 0x40 0x9f 0x96 0xe9 0x3d 0x7e 0x11 0x73 0x93 0x17 0x2a
CBC-AES-256-ENC:
0xe0 0xfa 0xab 0x42 0xd5 0xa5 0x5c 0x18 0xb0 0x13 0x1f 0x47 0x6c 0xa5 0xd0 0x0a
CBC-AES-256-DEC:
0x6b 0xc1 0xbe 0xe2 0x2e 0x40 0x9f 0x96 0xe9 0x3d 0x7e 0x11 0x73 0x93 0x17 0x2a
****************** cbc_aes256 test PASS ******************
chnid 0x2818049
CBC-AES-192-ORI:
0x6b 0xc1 0xbe 0xe2 0x2e 0x40 0x9f 0x96 0xe9 0x3d 0x7e 0x11 0x73 0x93 0x17 0x2a
CBC-AES-192-ENC:
0x69 0x25 0x8f 0xc2 0x8d 0x58 0x8b 0x84 0x67 0x87 0x76 0x02 0x2f 0x9c 0x1c 0x91
CBC-AES-192-DEC:
0x6b 0xc1 0xbe 0xe2 0x2e 0x40 0x9f 0x96 0xe9 0x3d 0x7e 0x11 0x73 0x93 0x17 0x2a
****************** cbc_aes192 test PASS ******************
chnid 0x2818049
CBC-AES-128-ORI:
0x6b 0xc1 0xbe 0xe2 0x2e 0x40 0x9f 0x96 0xe9 0x3d 0x7e 0x11 0x73 0x93 0x17 0x2a
CBC-AES-128-ENC:
0x76 0x49 0xab 0xac 0x81 0x19 0xb2 0x46 0xce 0xe9 0x8e 0x9b 0x12 0xe9 0x19 0x7d
CBC-AES-128-DEC:
0x6b 0xc1 0xbe 0xe2 0x2e 0x40 0x9f 0x96 0xe9 0x3d 0x7e 0x11 0x73 0x93 0x17 0x2a
****************** cbc_aes128 test PASS ******************
CFB-AES-128-ORI:
0x6b 0xc1 0xbe 0xe2 0x2e 0x40 0x9f 0x96 0xe9 0x3d 0x7e 0x11 0x73 0x93 0x17 0x2a
0xae 0x2d 0x8a 0x57 0x1e 0x03 0xac 0x9c 0x9e 0xb7 0x6f 0xac 0x45 0xaf 0x8e 0x51
CFB-AES-128-ENC:
0x3b 0x3f 0xd9 0x2e 0xb7 0x2d 0xad 0x20 0x33 0x34 0x49 0xf8 0xe8 0x3c 0xfb 0x4a
0xc8 0xa6 0x45 0x37 0xa0 0xb3 0xa9 0x3f 0xcd 0xe3 0xcd 0xad 0x9f 0x1c 0xe5 0x8b
CFB-AES-128-DEC
0x6b 0xc1 0xbe 0xe2 0x2e 0x40 0x9f 0x96 0xe9 0x3d 0x7e 0x11 0x73 0x93 0x17 0x2a
0xae 0x2d 0x8a 0x57 0x1e 0x03 0xac 0x9c 0x9e 0xb7 0x6f 0xac 0x45 0xaf 0x8e 0x51
****************** cfb_aes128 test PASS ******************
CTR-AES-128-ORI:
0x00 0x01 0x02 0x03 0x04 0x05 0x06 0x07 0x08 0x09 0x0a 0x0b 0x0c 0x0d 0x0e 0x0f
0x10 0x11 0x12 0x13 0x14 0x15 0x16 0x17 0x18 0x19 0x1a 0x1b 0x1c 0x1d 0x1e 0x1f
CTR-AES-128-ENC:
0x51 0x04 0xa1 0x06 0x16 0x8a 0x72 0xd9 0x79 0x0d 0x41 0xee 0x8e 0xda 0xd3 0x88
0xeb 0x2e 0x1e 0xfc 0x46 0xda 0x57 0xc8 0xfc 0xe6 0x30 0xdf 0x91 0x41 0xbe 0x28
CTR-AES-128-DEC
0x00 0x01 0x02 0x03 0x04 0x05 0x06 0x07 0x08 0x09 0x0a 0x0b 0x0c 0x0d 0x0e 0x0f
0x10 0x11 0x12 0x13 0x14 0x15 0x16 0x17 0x18 0x19 0x1a 0x1b 0x1c 0x1d 0x1e 0x1f
****************** ctr_aes128 test PASS ******************
################# FUNCTION 1 RUN SUCCESS #################
Success marker: ################# FUNCTION 1 RUN SUCCESS #################, with ****************** test PASS ****************** for every sub-test.
Fixed vs variable output
- Fixed: all AES results (for the fixed test data and key)
- Variable:
chnid(channel ID, may differ between runs)
~~~~~~~~~~~~~~~~~~~~~ run sample_multicipher ~~~~~~~~~~~~~~~~~~~
GOLD
0x76 0x49 0xab 0xac 0x81 0x19 0xb2 0x46 0xce 0xe9 0x8e 0x9b 0x12 0xe9 0x19 0x7d
0x4c 0xbb 0xc8 0x58 0x75 0x6b 0x35 0x81 0x25 0x52 0x9e 0x96 0x98 0xa3 0x8f 0x44
****************** multicipher_aes_cbc_enc test PASS ******************
****************** multicipher_aes_cbc_dec test PASS ******************
################# FUNCTION 2 RUN SUCCESS #################
Success marker: ################# FUNCTION 2 RUN SUCCESS #################, with results matching the GOLD reference values.
Fixed vs variable output
- Fixed: all results (for the fixed test data and key)
- Variable: none (the output is fully deterministic)
~~~~~~~~~~~~~~~~~~~~~ run sample_cipher_efuse ~~~~~~~~~~~~~~~~~~~
clear text:
0x6b 0xc1 0xbe 0xe2 0x2e 0x40 0x9f 0x96 0xe9 0x3d 0x7e 0x11 0x73 0x93 0x17 0x2a
encrypted text:
0xf0 0xb7 0x6a 0x0c 0x16 0x06 0xd4 0xde 0x79 0xcb 0x5c 0x66 0xd3 0x51 0x0c 0xab
before decrypt:
0xf0 0xb7 0x6a 0x0c 0x16 0x06 0xd4 0xde 0x79 0xcb 0x5c 0x66 0xd3 0x51 0x0c 0xab
decrypted text:
0x6b 0xc1 0xbe 0xe2 0x2e 0x40 0x9f 0x96 0xe9 0x3d 0x7e 0x11 0x73 0x93 0x17 0x2a
****************** sample_cipher_efuse_vir test PASS ******************
clear text:
0x6b 0xc1 0xbe 0xe2 0x2e 0x40 0x9f 0x96 0xe9 0x3d 0x7e 0x11 0x73 0x93 0x17 0x2a
encrypted text:
0xf0 0xb7 0x6a 0x0c 0x16 0x06 0xd4 0xde 0x79 0xcb 0x5c 0x66 0xd3 0x51 0x0c 0xab
before decrypt:
0xf0 0xb7 0x6a 0x0c 0x16 0x06 0xd4 0xde 0x79 0xcb 0x5c 0x66 0xd3 0x51 0x0c 0xab
decrypted text:
0x6b 0xc1 0xbe 0xe2 0x2e 0x40 0x9f 0x96 0xe9 0x3d 0x7e 0x11 0x73 0x93 0x17 0x2a
****************** sample_cipher_efuse_phy test PASS ******************
################# FUNCTION 3 RUN SUCCESS #################
Success marker: ################# FUNCTION 3 RUN SUCCESS #################, with the decrypted plaintext matching the original. Failure case: if no CA key is burned into efuse, the test fails with an error, which is expected.
Fixed vs variable output
- Fixed: the plaintext, ciphertext, and encryption result (for the fixed test data and key)
- Variable: none (the output is fully deterministic)
~~~~~~~~~~~~~~~~~~~~~ run sample_hash ~~~~~~~~~~~~~~~~~~~
****************** sha1 test PASS ******************
****************** sha256 test PASS ******************
hmac-Sha1 result:
0xac 0xd4 0x9a 0xdd 0x87 0xba 0x3b 0xe2 0x93 0xdc 0x39 0xc1 0x72 0x06 0xbf 0xab
0x8b 0xde 0x59 0xe7
hmac-Sha1 result:
0xfc 0x66 0xa4 0xcb 0x9e 0xf4 0xe6 0x88 0x19 0xf3 0xe9 0x40 0xae 0xf0 0x7a 0x59
0x5b 0x72 0x7a 0x0f
hmac-Sha1 result:
0x73 0xd3 0x86 0xe3 0x0e 0x42 0x1a 0x27 0xc7 0x53 0xfa 0x45 0xa4 0x78 0x31 0x34
0xc0 0x2a 0x71 0x2b
****************** hmac_sha1 test PASS ******************
hmac-Sha256 result:
0xf1 0x2b 0xdb 0x85 0xbd 0x31 0xaa 0x46 0x84 0x3d 0xca 0x9b 0xde 0x9c 0xbf 0x63
0xba 0x00 0x55 0x02 0x60 0xdb 0xbf 0xc4 0xad 0x03 0xc4 0xdf 0x98 0x82 0x2c 0x57
hmac-Sha256 result:
0xef 0x03 0xc8 0xb5 0x2f 0xfc 0x02 0x3b 0x7a 0x99 0x69 0xf7 0x0e 0xf6 0x03 0x22
0x90 0x2b 0x47 0x98 0x1f 0x9b 0x8f 0xaf 0xfe 0x43 0xe5 0x61 0x33 0x8a 0xe3 0x44
hmac-Sha256 result:
0x4b 0x3b 0xf5 0xa2 0x57 0xb6 0xf9 0x10 0x35 0x9e 0xf4 0x8d 0x8a 0x3b 0xe1 0x6e
0x0a 0x09 0x3a 0x96 0x53 0x51 0x72 0xbd 0x6f 0x82 0x0d 0xbc 0xfb 0x1d 0x9b 0x00
****************** hmac_sha256 test PASS ******************
****************** sha224 test PASS ******************
################# FUNCTION 4 RUN SUCCESS #################
Success marker: ################# FUNCTION 4 RUN SUCCESS #################, with ****************** test PASS ****************** for every hash test.
Fixed vs variable output
- Fixed: all SHA1/SHA256/SHA224 and HMAC results (for the fixed test data and key)
- Variable: none (the output is fully deterministic)
~~~~~~~~~~~~~~~~~~~~~ run sample_rng ~~~~~~~~~~~~~~~~~~~
Random number: 0aeec5a2
Random number: 659363bd
Random number: 1ef83f38
Random number: fdd0708f
Random number: 8765b4e3
Random number: 25ac881e
Random number: 07cee115
Random number: 1c75e1b0
Random number: 88631d1a
Random number: c0e9987e
################# FUNCTION 5 RUN SUCCESS #################
Success marker: ################# FUNCTION 5 RUN SUCCESS #################, with 10 random numbers generated.
Fixed vs variable output
- Fixed: the output format (10 random numbers)
- Variable: each number's value (different on every run)
~~~~~~~~~~~~~~~~~~~~~ run sample_rsa_sign ~~~~~~~~~~~~~~~~~~~
****************** rsa_sign_verify test PASS ******************
****************** rsa_sign_verify test PASS ******************
****************** rsa_sign_verify_crt test PASS ******************
****************** rsa_sign_verify_crt test PASS ******************
################# FUNCTION 6 RUN SUCCESS #################
Success marker: ################# FUNCTION 6 RUN SUCCESS #################, with ****************** test PASS ****************** for every signature test. Failure case: FAILED instead of PASS means the signature did not verify.
Fixed vs variable output
- Fixed: the test count and pass status (for the fixed test key)
- Variable: none (the output is fully deterministic)
~~~~~~~~~~~~~~~~~~~~~ run sample_rsa_enc ~~~~~~~~~~~~~~~~~~~
****************** pkcs_crt_dec test PASS ******************
****************** pkcs_pub_enc test PASS ******************
****************** pkcs_pub_enc test PASS ******************
****************** pkcs_pub_enc test PASS ******************
****************** pkcs_pub_enc test PASS ******************
****************** pkcs_pub_enc test PASS ******************
****************** pkcs_pub_enc test PASS ******************
****************** pkcs_pri_enc test PASS ******************
################# FUNCTION 7 RUN SUCCESS #################
Success marker: ################# FUNCTION 7 RUN SUCCESS #################, with ****************** test PASS ****************** for every encrypt/decrypt test. Failure case: FAILED instead of PASS means the data did not round-trip.
Fixed vs variable output
- Fixed: the test count and pass status (for the fixed test key)
- Variable: none (the output is fully deterministic)
~~~~~~~~~~~~~~~~~~~~~ run sample_cipher_via ~~~~~~~~~~~~~~~~~~~
chnid 0x2818049
CBC-AES-128-ORI:
0x6b 0xc1 0xbe 0xe2 0x2e 0x40 0x9f 0x96 0xe9 0x3d 0x7e 0x11 0x73 0x93 0x17 0x2a
CBC-AES-128-ENC:
0x76 0x49 0xab 0xac 0x81 0x19 0xb2 0x46 0xce 0xe9 0x8e 0x9b 0x12 0xe9 0x19 0x7d
CBC-AES-128-DEC:
0x6b 0xc1 0xbe 0xe2 0x2e 0x40 0x9f 0x96 0xe9 0x3d 0x7e 0x11 0x73 0x93 0x17 0x2a
****************** cbc_aes128 test PASS ******************
CFB-AES-128-ORI:
0x6b 0xc1 0xbe 0xe2 0x2e 0x40 0x9f 0x96 0xe9 0x3d 0x7e 0x11 0x73 0x93 0x17 0x2a
0xae 0x2d 0x8a 0x57 0x1e 0x03 0xac 0x9c 0x9e 0xb7 0x6f 0xac 0x45 0xaf 0x8e 0x51
CFB-AES-128-ENC:
0x3b 0x3f 0xd9 0x2e 0xb7 0x2d 0xad 0x20 0x33 0x34 0x49 0xf8 0xe8 0x3c 0xfb 0x4a
0xc8 0xa6 0x45 0x37 0xa0 0xb3 0xa9 0x3f 0xcd 0xe3 0xcd 0xad 0x9f 0x1c 0xe5 0x8b
CFB-AES-128-DEC
0x6b 0xc1 0xbe 0xe2 0x2e 0x40 0x9f 0x96 0xe9 0x3d 0x7e 0x11 0x73 0x93 0x17 0x2a
0xae 0x2d 0x8a 0x57 0x1e 0x03 0xac 0x9c 0x9e 0xb7 0x6f 0xac 0x45 0xaf 0x8e 0x51
****************** cfb_aes128 test PASS ******************
CTR-AES-128-ORI:
0x00 0x01 0x02 0x03 0x04 0x05 0x06 0x07 0x08 0x09 0x0a 0x0b 0x0c 0x0d 0x0e 0x0f
0x10 0x11 0x12 0x13 0x14 0x15 0x16 0x17 0x18 0x19 0x1a 0x1b 0x1c 0x1d 0x1e 0x1f
CTR-AES-128-ENC:
0x51 0x04 0xa1 0x06 0x16 0x8a 0x72 0xd9 0x79 0x0d 0x41 0xee 0x8e 0xda 0xd3 0x88
0xeb 0x2e 0x1e 0xfc 0x46 0xda 0x57 0xc8 0xfc 0xe6 0x30 0xdf 0x91 0x41 0xbe 0x28
CTR-AES-128-DEC
0x00 0x01 0x02 0x03 0x04 0x05 0x06 0x07 0x08 0x09 0x0a 0x0b 0x0c 0x0d 0x0e 0x0f
0x10 0x11 0x12 0x13 0x14 0x15 0x16 0x17 0x18 0x19 0x1a 0x1b 0x1c 0x1d 0x1e 0x1f
****************** ctr_aes128 test PASS ******************
################# FUNCTION 8 RUN SUCCESS #################
Success marker: ################# FUNCTION 8 RUN SUCCESS #################, meaning virtual-address mode encrypted and decrypted successfully. Failure case: FAILED instead of PASS means the virtual-address data did not match.
Fixed vs variable output
- Fixed: all AES results (for the fixed test data and key)
- Variable:
chnid(channel ID, may differ between runs)
The sample takes a simple command-line index; the argument to main() selects the test case:
int main(int argc, char *argv[])
{
int index = 0;
if (argc < 2) {
usage(); // print usage
return -1;
}
index = atoi(argv[1]);
switch(index) {
case 1: sample_cipher_test(); break; // basic AES test
case 2: sample_cipher_mult_test(); break; // multi-block batch test
case 3: sample_cipher_ca_test(); break; // efuse CA key test
case 4: sample_hash_test(); break; // HASH test
case 5: sample_rng_test(); break; // RNG test
case 6: sample_rsa_sign_test(); break; // RSA signature test
case 7: sample_rsa_enc_test(); break; // RSA encryption test
case 8: sample_cipher_via_test(); break; // virtual-address test
default: usage(); break;
}
return 0;
}
The AES test (index 1) covers encryption and decryption in ECB/CBC/CTR mode:
// Step 1: initialize the cipher module
xmedia_cipher_init();
// Step 2: create a cipher channel
xmedia_cipher_create_handle(&chnid);
// Step 3: configure the cipher parameters
xmedia_cipher_ctrl ctrl;
ctrl.alg = XMEDIA_CIPHER_ALG_AES; // algorithm: AES
ctrl.mode = XMEDIA_CIPHER_WORK_MODE_CBC; // working mode: CBC
ctrl.aes_ctrl.bit_width = XMEDIA_CIPHER_BIT_WIDTH_128BIT;
ctrl.aes_ctrl.key_len = XMEDIA_CIPHER_KEY_AES_128BIT;
memcpy(ctrl.aes_ctrl.key, aes_key, 16); // key
memcpy(ctrl.aes_ctrl.iv, aes_iv, 16); // IV (required for CBC/CTR)
xmedia_cipher_config_handle(chnid, &ctrl);
// Step 4: allocate input/output buffers (MMZ physically contiguous memory)
input_phy = xmedia_mmz_alloc(NULL, "CIPHER_BufIn", data_len);
input_vir = xmedia_mmz_map(input_phy, data_len, cached);
output_phy = xmedia_mmz_alloc(NULL, "CIPHER_BufOut", data_len);
output_vir = xmedia_mmz_map(output_phy, data_len, cached);
// Step 5: encrypt
memcpy(input_vir, aes_src, data_len);
xmedia_cipher_encrypt(chnid, input_phy, output_phy, data_len);
// Step 6: decrypt
xmedia_cipher_decrypt(chnid, output_phy, input_phy, data_len);
// Step 7: verify
if (memcmp(input_vir, aes_src, data_len) == 0) {
printf("memcmp decrypt and src OK!\n");
}
// Step 8: release resources
xmedia_mmz_unmap(input_vir);
xmedia_mmz_free(input_phy);
xmedia_cipher_destroy_handle(chnid);
xmedia_cipher_exit();
The RSA signature test (index 6) signs with the private key and verifies with the public key:
// Step 1: initialize the cipher module
xmedia_cipher_init();
// Step 2: create a cipher channel
xmedia_cipher_create_handle(&chnid);
// Step 3: configure the RSA parameters
xmedia_cipher_ctrl ctrl;
ctrl.alg = XMEDIA_CIPHER_ALG_RSA;
ctrl.rsa_ctrl.rsa_len = XMEDIA_CIPHER_RSA_2048; // 2048-bit RSA
// ... configure the public/private key ...
xmedia_cipher_config_handle(chnid, &ctrl);
// Step 4: sign (private key)
xmedia_cipher_sign(chnid, digest_phy, signature_phy);
// Step 5: verify the signature (public key)
xmedia_cipher_verify(chnid, digest_phy, signature_phy);
The efuse CA key test (index 3) reads the CA key from the chip efuse and uses it for encryption:
// configure cipher to use the efuse CA key
ctrl.key_by_ca = XMEDIA_TRUE; // use the CA key stored in efuse
xmedia_cipher_config_handle(chnid, &ctrl);
// the rest of the encrypt/decrypt flow is the same as plain AES
xmedia_cipher_encrypt(chnid, input_phy, output_phy, data_len);
Note
If no CA key is burned into efuse, this test fails. That is expected.
The HASH test (index 4) and the RNG test (index 5) are straightforward:
// HASH digest
xmedia_cipher_init();
xmedia_cipher_create_handle(&chnid);
ctrl.alg = XMEDIA_CIPHER_ALG_SHA256;
xmedia_cipher_config_handle(chnid, &ctrl);
xmedia_cipher_hash(chnid, input_phy, input_len, output_phy);
// RNG random number generation
xmedia_cipher_init();
xmedia_cipher_create_handle(&chnid);
xmedia_cipher_rng(chnid, output_phy, output_len);
The multi-block test (index 2) processes several blocks in one call:
// allocate a large buffer
data_len = 32 * 10; // 10 blocks of 32 bytes each
input_phy = xmedia_mmz_alloc(NULL, "CIPHER_BufIn", data_len);
output_phy = xmedia_mmz_alloc(NULL, "CIPHER_BufOut", data_len);
// encrypt/decrypt in one pass
xmedia_cipher_encrypt(chnid, input_phy, output_phy, data_len);
xmedia_cipher_decrypt(chnid, output_phy, input_phy, data_len);
The virtual-address test (index 8) runs the crypto operations on virtual addresses:
// use virtual addresses instead of physical ones
xmedia_cipher_encrypt_via(chnid, input_vir, output_vir, data_len);
xmedia_cipher_decrypt_via(chnid, output_vir, input_vir, data_len);
Tip
Virtual-address mode is easier to use, but it can run into cache-coherency issues.
Crypto operations need physically contiguous memory (MMZ); plain malloc() cannot be used:
// allocate physical memory
xmedia_ulong phy = xmedia_mmz_alloc(NULL, "name", size);
// map into the virtual address space
void *vir = xmedia_mmz_map(phy, size, cached);
// when done
xmedia_mmz_unmap(vir);
xmedia_mmz_free(phy);
CBC, CTR, CFB, and OFB need an IV (initialization vector); ECB does not:
if (mode != XMEDIA_CIPHER_WORK_MODE_ECB) {
memcpy(ctrl.aes_ctrl.iv, aes_iv, AES_IV_LENGTH);
}
ctrl.aes_ctrl.bit_width = XMEDIA_CIPHER_BIT_WIDTH_128BIT; // fixed at 128-bit
ctrl.aes_ctrl.key_len = XMEDIA_CIPHER_KEY_AES_128BIT; // 128-bit key
// or XMEDIA_CIPHER_KEY_AES_256BIT // 256-bit key
Check the return value of every API call:
ret = xmedia_cipher_init();
if (XMEDIA_SUCCESS != ret) {
printf("cipher init failed!\n");
return ret;
}
| Problem | Likely cause | Fix |
|---|---|---|
| Test 3 fails | No CA key burned in efuse | Expected; the other features are unaffected |
| Ciphertext differs | IV not set correctly | CBC/CTR require the correct IV |
| MMZ allocation fails | Out of system memory | Free memory held by other processes |
| RSA signature verification fails | Public and private keys do not match | Check the key configuration |