The following cryptographic functions using
energy efficient accelerators and RNG functions are accelerated by the HSM:
- Key Agreement Schemes
- Elliptic Curve Diffie-Hellman with static or ephemeral keys (ECDH and
ECDHE)
- Elliptic Curve Password Authenticated Key Exchange by Juggling
(ECJ-PAKE)
- Diffie Hellman with static or ephemeral keys (DH, and DHE)
- Key Derivation Methods:
- Random (from DRBG)
- SHA2 HMAC PRF (Pseudorandom Function)
- AES CMAC PRF
- Signature Processing
- Elliptic Curve Diffie-Hellman Digital Signature Algorithm (ECDSA)
- Edwards-curve Digital Signature Algorithm (EdDSA)
- RSA PKCS #1 v1.5
- RSA PSS
- Message Authentication Codes
- AES CBC-MAC
- AES CMAC
- HMAC with SHA2-224, SHA2-256, SHA2-384, and SHA2-512
- HMAC with SHA3-224, SHA2-256, SHA2-384, and SHA2-512
- Block Cipher Modes of Operation
- AES CCM and AES CCM* (CCM-Star)
- AES GCM
- AES ECB
- AES CBC
- AES CTR
- Hash Algorithms
- SHA3-224
- SHA3-256
- SHA3-384
- SHA3-512
- SHA2-224
- SHA2-256
- SHA2-384
- SHA2-512
- Random Number Generation:
- NIST SP800-90B compliant TRNG (True Random Number Generator)
- AES-CTR DRBG (Deterministic Random Bit Generator)
Cryptographic key sizes and types include:
- Advanced Encryption Standard (AES) key sizes of 128, 192, and 256bits
- RSA key sizes up to 3072-bits (Sign and Verify supported), and up to 4096-bits
(Verify only)
- Diffie-Hellman key sizes of 2048-bits and 3072-bits
- Elliptic Curve Support
- Short Weierstrass
- NIST-P224 (secp224r1), NIST-P256 (secp256r1), NIST-P384
(secp384r1), NIST-P521 (secp521r1)
- Brainpool-256R1, Brainpool-384R1, Brainpool-512R1
- Montgomery
- Twisted Edwards form, such as:
DPA countermeasures are implemented for:
- AES operations
- ECDH operations involving private key material
- ECDSA and EdDSA sign operations
- RSA sign operations on 2048-bit and smaller keys
The HSM also has its own data RAM
region that is not accessible to the rest of the system (system CPU, DMA, debug
access, etc.). The data RAM region is retained in low power modes, supporting quick
power up of the HSM and retention of key material. In addition to the storage of key
material in data RAM, the HSM supports importing and exporting wrapped key material
(NIST SP800-38F) with a key unique to the device, known as a HW Unique Key (HUK).
This allows the wrapped keys to be securely stored anywhere in the system’s
nonvolatile (Flash) memory.
The HSM is accessible to the
application running on the system CPU in a controlled manner via the HSM mailbox
interface. The HSM is a bus controller in the device and can access the system
memory directly enabling better efficiency for moving data in and out during
cryptographic operations.
The HSM supports master DMA with AHB
I/F to device memory mapping. The DMA access to memory is controlled by firewall
that classify access according to mailbox task type and operation policy