nrf_security: Add CCM* support to CRACEN

doc/nrf/security/crypto/crypto_supported_features.rst

@@ -2538,12 +2538,12 @@ The options are grouped by Series and drivers available for the device Series, a
                  - --
                * - CCM* no tag
                  - :kconfig:option:`CONFIG_PSA_WANT_ALG_CCM_STAR_NO_TAG`
-                 - --
-                 - --
-                 - --
-                 - --
-                 - --
-                 - --
+                 - Supported
+                 - Supported
+                 - Supported
+                 - Supported
+                 - Supported
+                 - Supported
                  - --
                  - --
                * - Stream cipher
@@ -2846,6 +2846,7 @@ Based on this setting, Oberon PSA Crypto selects the most appropriate driver for
                    | :kconfig:option:`CONFIG_PSA_WANT_ALG_CBC_NO_PADDING`
                    | :kconfig:option:`CONFIG_PSA_WANT_ALG_CBC_PKCS7`
                    | :kconfig:option:`CONFIG_PSA_WANT_ALG_CTR`
+                   | :kconfig:option:`CONFIG_PSA_WANT_ALG_CCM_STAR_NO_TAG`
                    | :kconfig:option:`CONFIG_PSA_WANT_ALG_STREAM_CIPHER`
 
          .. tab:: nrf_oberon

subsys/nrf_security/cmake/psa_crypto_config.cmake

@@ -32,6 +32,7 @@ kconfig_check_and_set_base_to_one(PSA_NEED_CRACEN_GCM_AES)
 kconfig_check_and_set_base_to_one(PSA_NEED_CRACEN_CHACHA20_POLY1305)
 kconfig_check_and_set_base_to_one(PSA_NEED_CRACEN_AEAD_DRIVER)
 kconfig_check_and_set_base_to_one(PSA_NEED_CRACEN_CTR_AES)
+kconfig_check_and_set_base_to_one(PSA_NEED_CRACEN_CCM_STAR_NO_TAG_AES)
 kconfig_check_and_set_base_to_one(PSA_NEED_CRACEN_CBC_PKCS7_AES)
 kconfig_check_and_set_base_to_one(PSA_NEED_CRACEN_CBC_NO_PADDING_AES)
 kconfig_check_and_set_base_to_one(PSA_NEED_CRACEN_ECB_NO_PADDING_AES)

subsys/nrf_security/configs/psa_crypto_config.h.template

@@ -315,6 +315,7 @@
 #cmakedefine PSA_NEED_CRACEN_GCM_AES                            @PSA_NEED_CRACEN_GCM_AES@
 #cmakedefine PSA_NEED_CRACEN_CHACHA20_POLY1305                  @PSA_NEED_CRACEN_CHACHA20_POLY1305@
 #cmakedefine PSA_NEED_CRACEN_CTR_AES                            @PSA_NEED_CRACEN_CTR_AES@
+#cmakedefine PSA_NEED_CRACEN_CCM_STAR_NO_TAG_AES                @PSA_NEED_CRACEN_CCM_STAR_NO_TAG_AES@
 #cmakedefine PSA_NEED_CRACEN_CBC_PKCS7_AES                      @PSA_NEED_CRACEN_CBC_PKCS7_AES@
 #cmakedefine PSA_NEED_CRACEN_CBC_NO_PADDING_AES                 @PSA_NEED_CRACEN_CBC_NO_PADDING_AES@
 #cmakedefine PSA_NEED_CRACEN_ECB_NO_PADDING_AES                 @PSA_NEED_CRACEN_ECB_NO_PADDING_AES@

subsys/nrf_security/src/drivers/cracen/cracen_sw/src/cracen_sw_aes_ccm.c

@@ -392,6 +392,10 @@ psa_status_t cracen_sw_aes_ccm_update(cracen_aead_operation_t *operation, const
 	size_t processed = 0;
 	size_t counter_size = CCM_Q_LEN_FROM_NONCE(operation->nonce_length);
 
+	if (output_size < input_length) {
+		return PSA_ERROR_BUFFER_TOO_SMALL;
+	}
+
 	operation->ad_finished = true;
 	status = initialize_cbc_mac(operation, &cipher);
 	if (status != PSA_SUCCESS) {
@@ -459,6 +463,12 @@ psa_status_t cracen_sw_aes_ccm_finish(cracen_aead_operation_t *operation, uint8_
 	struct sxblkcipher cipher;
 	psa_status_t status;
 
+	*ciphertext_length = 0;
+
+	if (tag_size < operation->tag_size) {
+		return PSA_ERROR_BUFFER_TOO_SMALL;
+	}
+
 	status = initialize_cbc_mac(operation, &cipher);
 	if (status != PSA_SUCCESS) {
 		return status;

subsys/nrf_security/src/drivers/cracen/cracenpsa/src/cracen_psa_aead.c

@@ -256,8 +256,8 @@ static void create_aead_ccmheader(cracen_aead_operation_t *operation,
 	size_t m, l;
 
 	/* RFC3610 paragraph 2.2 defines the formatting of the first block.
-	 * M, CCM TAG size is one of {4,6,8,10,12,14,16}, CCM* not supported
-	 * (MAC size 0)
+	 * M, CCM TAG size is one of {4,6,8,10,12,14,16}, or 0 for CCM* (IEEE
+	 * P802.15-4/0537r2), in which case the M field is zero.
 	 * L must be between 2 and 8.
 	 * Nonce size should be between 7 and 13 bytes.
 	 * The first block contains:
@@ -275,7 +275,8 @@ static void create_aead_ccmheader(cracen_aead_operation_t *operation,
 	l = 15 - operation->nonce_length;
 
 	flags = (operation->ad_length > 0) ? (1 << 6) : 0;
-	m = (operation->tag_size - 2) / 2;
+	/* CCM* encodes M=0 as a zero M field; (0 - 2) / 2 would underflow. */
+	m = operation->tag_size ? (operation->tag_size - 2) / 2 : 0;
 
 	flags |= (m & 0x7) << 3;
 	flags |= ((l - 1) & 0x7);

subsys/nrf_security/src/drivers/cracen/cracenpsa/src/cracen_psa_cipher.c

@@ -32,6 +32,16 @@
 #include <cracen_sw_aes_ctr.h>
 #endif
 
+/* CCM* is only defined for L = 2, so its nonce is 15 - L octets and the counter
+ * field it leaves inside the 16-octet block is exactly 16 bits wide
+ * (IEEE P802.15-4/0537r2 clause 2.2.2 and clause 2.3.1).
+ *
+ * PSA_NEED_CRACEN_CTR_SIZE_WORKAROUNDS not needed because CCM* wants precisely the hardware CTR
+ * width. Adding CCM* to those blocks would replace working hardware with software.
+ */
+#define CCM_STAR_L	      2
+#define CCM_STAR_NONCE_LENGTH (SX_BLKCIPHER_IV_SZ - 1 - CCM_STAR_L)
+
 static bool is_alg_supported(psa_algorithm_t alg, const psa_key_attributes_t *attributes)
 {
 	bool is_supported = false;
@@ -60,6 +70,10 @@
 		IF_ENABLED(PSA_NEED_CRACEN_CTR_AES,
 			   (is_supported = psa_get_key_type(attributes) == PSA_KEY_TYPE_AES));
 		break;
+	case PSA_ALG_CCM_STAR_NO_TAG:
+		IF_ENABLED(PSA_NEED_CRACEN_CCM_STAR_NO_TAG_AES,
+			   (is_supported = psa_get_key_type(attributes) == PSA_KEY_TYPE_AES));
+		break;
 	case PSA_ALG_ECB_NO_PADDING:
 		IF_ENABLED(PSA_NEED_CRACEN_ECB_NO_PADDING_AES,
 			   (is_supported = psa_get_key_type(attributes) == PSA_KEY_TYPE_AES));
@@ -240,6 +254,22 @@
 			   output_length);
 }
 
+static size_t single_part_iv_size(psa_algorithm_t alg)
+{
+	if (alg == PSA_ALG_STREAM_CIPHER) {
+		return 12;
+	}
+
+	/* CCM* has a 13-octet nonce because L is fixed at 2; everything else prepends a full cipher
+	 * block.
+	 */
+	if (IS_ENABLED(PSA_NEED_CRACEN_CCM_STAR_NO_TAG_AES) && alg == PSA_ALG_CCM_STAR_NO_TAG) {
+		return CCM_STAR_NONCE_LENGTH;
+	}
+
+	return SX_BLKCIPHER_IV_SZ;
+}
+
 psa_status_t cracen_cipher_decrypt(const psa_key_attributes_t *attributes,
 				   const uint8_t *key_buffer, size_t key_buffer_size,
 				   psa_algorithm_t alg, const uint8_t *input, size_t input_length,
@@ -251,8 +281,7 @@
 
 	cracen_cipher_operation_t operation = {0};
 	psa_status_t status;
-	/* ChaCha20 only supports 12 bytes IV in the single part decryption function */
-	const size_t iv_size = (alg == PSA_ALG_STREAM_CIPHER) ? 12 : SX_BLKCIPHER_IV_SZ;
+	const size_t iv_size = single_part_iv_size(alg);
 	*output_length = 0;
 
 #if defined(PSA_NEED_CRACEN_CTR_SIZE_WORKAROUNDS) && defined(PSA_NEED_CRACEN_CTR_AES)
@@ -309,7 +338,7 @@
 			   output, output_size, output_length);
 }
 
 static psa_status_t initialize_cipher(cracen_cipher_operation_t *operation)
 {
 	int sx_status = SX_ERR_UNINITIALIZED_OBJ;
 
@@ -353,6 +382,17 @@
 									     operation->iv);
 		}
 		break;
+	case PSA_ALG_CCM_STAR_NO_TAG:
+		if (IS_ENABLED(PSA_NEED_CRACEN_CCM_STAR_NO_TAG_AES)) {
+			sx_status = operation->dir == CRACEN_DECRYPT
+					    ? sx_blkcipher_create_aesctr_dec(&operation->cipher,
+									     &operation->keyref,
+									     operation->iv)
+					    : sx_blkcipher_create_aesctr_enc(&operation->cipher,
+									     &operation->keyref,
+									     operation->iv);
+		}
+		break;
 	case PSA_ALG_STREAM_CIPHER:
 		if (IS_ENABLED(PSA_NEED_CRACEN_STREAM_CIPHER_CHACHA20)) {
 			sx_status = operation->dir == CRACEN_DECRYPT
@@ -440,6 +480,26 @@
 		}
 	}
 
+	/* CCM* with a zero-length authentication field is AES-CTR over the
+	 * counter blocks A_i = Flags || Nonce || i, starting at i = 1, where
+	 * Flags holds L-1 in its low three bits and zero elsewhere (IEEE
+	 * P802.15-4/0537r2 clause 2.3.1.3). CCM* fixes L = 2, hence the
+	 * 13-octet nonce that PSA_CIPHER_IV_LENGTH reports for this algorithm.
+	 */
+	if (IS_ENABLED(PSA_NEED_CRACEN_CCM_STAR_NO_TAG_AES) &&
+	    operation->alg == PSA_ALG_CCM_STAR_NO_TAG) {
+		if (iv_length != CCM_STAR_NONCE_LENGTH) {
+			return PSA_ERROR_INVALID_ARGUMENT;
+		}
+
+		operation->iv[0] = CCM_STAR_L - 1;
+		memcpy(&operation->iv[1], iv, CCM_STAR_NONCE_LENGTH);
+		operation->iv[14] = 0;
+		operation->iv[15] = 1;
+
+		return PSA_SUCCESS;
+	}
+
 	if (iv_length != SX_BLKCIPHER_IV_SZ) {
 		return PSA_ERROR_INVALID_ARGUMENT;
 	}

subsys/nrf_security/src/drivers/cracen/psa_driver.Kconfig

@@ -56,6 +56,19 @@ config PSA_NEED_CRACEN_CTR_AES
 	depends on PSA_WANT_KEY_TYPE_AES
 	depends on PSA_USE_CRACEN_CIPHER_DRIVER
 
+config PSA_NEED_CRACEN_CCM_STAR_NO_TAG_AES
+	bool
+	default y
+	select PSA_ACCEL_CCM_STAR_NO_TAG_AES_128
+	select PSA_ACCEL_CCM_STAR_NO_TAG_AES_192 if !CRACEN_HW_VERSION_LITE
+	select PSA_ACCEL_CCM_STAR_NO_TAG_AES_256
+	depends on PSA_WANT_AES_KEY_SIZE_128 || \
+		PSA_WANT_AES_KEY_SIZE_192 || \
+		PSA_WANT_AES_KEY_SIZE_256
+	depends on PSA_WANT_ALG_CCM_STAR_NO_TAG
+	depends on PSA_WANT_KEY_TYPE_AES
+	depends on PSA_USE_CRACEN_CIPHER_DRIVER
+
 config PSA_NEED_CRACEN_CBC_PKCS7_AES
 	bool
 	default y
@@ -101,11 +114,12 @@ config PSA_NEED_CRACEN_STREAM_CIPHER_CHACHA20
 config PSA_NEED_CRACEN_CIPHER_DRIVER
 	bool
 	default y
-	depends on PSA_NEED_CRACEN_CTR_AES            || \
-		   PSA_NEED_CRACEN_CBC_PKCS7_AES      || \
-		   PSA_NEED_CRACEN_CBC_NO_PADDING_AES || \
-		   PSA_NEED_CRACEN_ECB_NO_PADDING_AES || \
-		   PSA_NEED_CRACEN_STREAM_CIPHER_CHACHA20
+	depends on PSA_NEED_CRACEN_CTR_AES || \
+		PSA_NEED_CRACEN_CCM_STAR_NO_TAG_AES || \
+		PSA_NEED_CRACEN_CBC_PKCS7_AES || \
+		PSA_NEED_CRACEN_CBC_NO_PADDING_AES || \
+		PSA_NEED_CRACEN_ECB_NO_PADDING_AES || \
+		PSA_NEED_CRACEN_STREAM_CIPHER_CHACHA20
 
 # CRACEN Key Agreement Driver
 config PSA_NEED_CRACEN_ECDH_BRAINPOOL_P_R1_256

subsys/nrf_security/src/drivers/cracen/sxsymcrypt/include/sxsymcrypt/aead.h

@@ -322,8 +322,9 @@ int sx_aead_status(struct sxaead *c);
  * @pre - one of the sx_aead_create_*()functions must be called first
  *
  * @remark - AES/SM4 CCM tag size is user provided and it must be between 4 and
- * 16 bytes, multiple of 2. If this function is called, the new tag size must be
- * between 4 and the value specified during create, sx_aead_create_*ccm_*().
+ * 16 bytes, multiple of 2, or 0 to select CCM* (IEEE P802.15-4/0537r2). If this
+ * function is called, the new tag size must be between 4 and the value
+ * specified during create, sx_aead_create_*ccm_*().
  */
 int sx_aead_truncate_tag(struct sxaead *c, const size_t tagsz);
 

subsys/nrf_security/src/drivers/cracen/sxsymcrypt/include/sxsymcrypt/aes.h

@@ -317,7 +317,9 @@ int sx_aead_create_aesgcm_dec(struct sxaead *c, const struct sxkeyref *key, cons
  * @param[in] noncesz size, in bytes, of the nonce, between 7 and 13 bytes
  * @param[in] nonce nonce used for the AEAD operation, with size \p noncesz
  * @param[in] tagsz size, in bytes, of the tag used for the AEAD operation,
- *            must be a value in {4, 6, 8, 10, 12, 14, 16}
+ *            must be 0 or a value in {4, 6, 8, 10, 12, 14, 16}. A tag size
+ *            of 0 selects CCM* (IEEE P802.15-4/0537r2), in which no
+ *            authentication field is produced or verified.
  * @param[in] aadsz size, in bytes, of the additional authenticated data(AAD)
  * @param[in] datasz size, in bytes, of the data to be processed
  * @return ::SX_OK
@@ -336,7 +338,8 @@ int sx_aead_create_aesgcm_dec(struct sxaead *c, const struct sxkeyref *key, cons
  *           operation is completed.
  * @remark - This does not create the CCM B_0 and B_1 header block, it must be
  *           created according to RFC3610 2.2 and provided via
- *           sx_aead_feed_aad()
+ *           sx_aead_feed_aad(). For CCM* the M field of the B_0 flags octet
+ *           must encode the same tag size that is passed here, i.e. zero.
  */
 int sx_aead_create_aesccm_enc(struct sxaead *c, const struct sxkeyref *key, const uint8_t *nonce,
 			      size_t noncesz, size_t tagsz, size_t datasz);
@@ -356,7 +359,9 @@ int sx_aead_create_aesccm_enc(struct sxaead *c, const struct sxkeyref *key, cons
  * @param[in] noncesz size, in bytes, of the nonce, between 7 and 13 bytes
  * @param[in] nonce nonce used for the AEAD operation, with size \p noncesz
  * @param[in] tagsz size, in bytes, of the tag used for the AEAD operation,
- *            must be a value in {4, 6, 8, 10, 12, 14, 16}
+ *            must be 0 or a value in {4, 6, 8, 10, 12, 14, 16}. A tag size
+ *            of 0 selects CCM* (IEEE P802.15-4/0537r2), in which no
+ *            authentication field is produced or verified.
  * @param[in] aadsz size, in bytes, of the additional authenticated data(AAD)
  * @param[in] datasz size, in bytes, of the data to be processed
  * @return ::SX_OK
@@ -375,7 +380,8 @@ int sx_aead_create_aesccm_enc(struct sxaead *c, const struct sxkeyref *key, cons
  *           operation is completed.
  * @remark - This does not create the CCM B_0 and B_1 header block, it must be
  *           created according to RFC3610 2.2 and provided via
- *           sx_aead_feed_aad()
+ *           sx_aead_feed_aad(). For CCM* the M field of the B_0 flags octet
+ *           must encode the same tag size that is passed here, i.e. zero.
  */
 int sx_aead_create_aesccm_dec(struct sxaead *c, const struct sxkeyref *key, const uint8_t *nonce,
 			      size_t noncesz, size_t tagsz, size_t datasz);

subsys/nrf_security/src/drivers/cracen/sxsymcrypt/src/aead.c

@@ -207,7 +207,7 @@ static int sx_aead_create_aesccm(struct sxaead *aead_ctx, const struct sxkeyref
 			return SX_ERR_INVALID_KEY_SZ;
 		}
 	}
-	if ((tagsz & 1) || (tagsz < 4) || (tagsz > 16)) {
+	if ((tagsz != 0) && ((tagsz & 1) || (tagsz < 4) || (tagsz > 16))) {
 		return SX_ERR_INVALID_TAG_SIZE;
 	}
 
@@ -251,8 +251,11 @@ static int sx_aead_create_aesccm(struct sxaead *aead_ctx, const struct sxkeyref
 	 * identical, the outputted tag will be an array of zeros with tagsz
 	 * length. For encryption, expectedtag will be set to NULL by
 	 * sx_aead_crypt() to disable verification.
+	 *
+	 * CCM* (tagsz == 0) has no authentication field at all, so expectedtag
+	 * stays NULL and sx_aead_status() skips the comparison.
 	 */
-	aead_ctx->expectedtag = aead_ctx->cfg->verifier;
+	aead_ctx->expectedtag = tagsz ? aead_ctx->cfg->verifier : NULL;
 
 	return SX_OK;
 }
@@ -352,7 +355,10 @@ int sx_aead_produce_tag(struct sxaead *aead_ctx, uint8_t *tagout)
 
 	sx_aead_discard_aad(aead_ctx);
 
-	ADD_OUTDESCA(aead_ctx->dma, tagout, aead_ctx->tagsz, 0xf);
+	/* With Tlen=0 the engine does not generate the tag block */
+	if (aead_ctx->tagsz) {
+		ADD_OUTDESCA(aead_ctx->dma, tagout, aead_ctx->tagsz, 0xf);
+	}
 
 	aead_ctx->expectedtag = NULL;
 
@@ -375,6 +381,12 @@ int sx_aead_verify_tag(struct sxaead *aead_ctx, const uint8_t *tagin)
 		return sx_handle_nested_error(sx_aead_free(aead_ctx), SX_ERR_INCOMPATIBLE_HW);
 	}
 
+	/* CCM*: no authentication field to feed and no verification */
+	if (aead_ctx->tagsz == 0) {
+		sx_aead_discard_aad(aead_ctx);
+		return sx_aead_run(aead_ctx);
+	}
+
 	if (aead_ctx->cfg->lenAlenC(aead_ctx->totalaadsz, aead_ctx->dataintotalsz,
 				    &aead_ctx->extramem[0])) {
 		ADD_INDESC_PRIV(aead_ctx->dma, OFFSET_EXTRAMEM(aead_ctx), AEAD_LENA_LENC_SZ,

tests/tfm/tfm_psa_test/prj.conf

@@ -42,6 +42,7 @@ CONFIG_PSA_WANT_ALG_ECB_NO_PADDING=y
 CONFIG_PSA_WANT_ALG_CBC_NO_PADDING=y
 CONFIG_PSA_WANT_ALG_CBC_PKCS7=y
 CONFIG_PSA_WANT_ALG_CTR=y
+CONFIG_PSA_WANT_ALG_CCM_STAR_NO_TAG=y
 CONFIG_PSA_WANT_ALG_STREAM_CIPHER=y
 
 # Key derivation functions

west.yml

@@ -158,7 +158,7 @@ manifest:
     - name: psa-arch-tests
       repo-path: sdk-psa-arch-tests
       path: modules/tee/tf-m/psa-arch-tests
-      revision: 2deff6bec6560a250c62c2def6531fe6937356d3
+      revision: pull/12/head
     - name: nrf-802154
       repo-path: sdk-nrf-802154
       path: nrf-802154