SPRUJB6B November 2024 – May 2025 AM2612
Figure 7-110 XTS Pre-calculationsXTS operations require a single AES pre-calculation with an independent key, which must be done to create the initial IV. Normally a ‘j’ indicating the block number in a unit starts with ‘0’. If that is the case, no initial polynomial multiplication is required to calculate the first IV. Sequential IVs are generated with a dedicated LFSR, as shown in the right section of Figure 7-110.
In the case that ‘j’ is not zero; Tj must be calculated internally; ‘j’ is decremented once per clock cycle until it is zero. Each cycle Tj will be shift-XOR-ed, resulting in Tj+1. Supported values for loading ‘j’ are: 0 <= j < 2^28. Loading a ‘j’ not equal to zero will take ‘j’ clock cycles to calculate Tj, which is used to encrypt/decrypt the related data block. Instead, it is suggested to load Tj or Tj-1 such that pre-calculation time is limited. Refer to Table 7-118 for more details regarding the tweak value loading options for XTS.
After initialization, a new value will be generated once per block with the shift-XOR operation. More formally: Tj+1 = Tj ⊗ a = (Tj << 1) ⊕ {(0120|10000111) & Tj [127]128}, byte ‘0’ is located on the most right position.
The XTS loading options are shown in Table 7-118; the last line is a more general representation of the four lines above. The Wide-bus Engine uses the loaded values to calculate Tj. T0 represents the tweak value for the first data block of a unit with 128-bit tweak ‘i’.
| Loaded values | Formal representation / calculation of required Tj | mode | iv_in[127:0] | aad_len[31:4] |
|---|---|---|---|---|
| i and key2 (j=0) | T0 = E(key2, i) | 1 | i | 0 |
| i, j and key2 | Tj = E(key2, i) ˟ αj | 1 | i | j |
| T0 (j=0) | T0 | 0 | T0 | 0 |
| T0 and j | Tj = T0 ˟ αj | 0 | T0 | j |
| Tj | Tj | 0 | Tj | 0 |
| Tj-1 and 1 | Tj = Tj-1 ˟ α | 0 | Tj-1 | 1 |
| Tj-x and x | Tj = Tj-x ˟ αx = T0 ˟ αj | 0 | Tj-x | x |