Implementation of AES-GCM Encryption Using the NUCLEO-U5A5ZJ-Q Hardware Accelerator

[y_yamamoto]

I am implementing encryption and decryption using AES-GCM mode on the STM32 NUCLEO-U5A5ZJ-Q.

I have successfully encrypted and decrypted the string "Hello", but I am having issues with tag authentication.

I am using the function HAL_CRYPEx_AESGCM_GenerateAuthTAG to obtain the tag after the encyption process.

However, I cannot find a function to verify the tag.

I have two questions:

1. Do I need to implement the tag verification myself?
2. If I need to implement it myself, is it correct to call HAL_CRYPEx_AESGCM_GenerateAuthTAG after both the encryption and decryption processes and then compare the tags?

I obtained the tags from both the encryption and decryption processes, but different values were returned. Below is a portion of the implemented source code.

#define AES_KEY_SIZE 16
#define AES_IV_SIZE  12
#define AES_TAG_SIZE 16

CRYP_HandleTypeDef hcryp;
uint8_t aesKey[AES_KEY_SIZE] = {0x11, 0x11, 0x22, 0x22, 0x33, 0x33, 0x44, 0x44, 0x55, 0x55, 0x66, 0x66, 0x77, 0x77, 0x88, 0x88};
uint8_t aesIV[AES_IV_SIZE] = {0x00, 0x01, 0x02, 0x03, 0x04, 0x05, 0x06, 0x07, 0x08, 0x09, 0x0a, 0x0b};

uint8_t plaintext[] = "Hello";
uint8_t ciphertext[sizeof(plaintext)];
uint8_t decryptedtext[sizeof(plaintext)];
uint8_t tag[AES_TAG_SIZE];

void AES_GCM_Encrypt(void)
{
	HAL_StatusTypeDef status;

	HAL_CRYP_DeInit(&hcryp);
	hcryp.Instance = AES;
	hcryp.Init.DataType = CRYP_DATATYPE_8B;
	hcryp.Init.KeySize = CRYP_KEYSIZE_128B;
	hcryp.Init.Algorithm = CRYP_AES_GCM_GMAC;
	hcryp.Init.pKey = (uint32_t *)aesKey;
	hcryp.Init.pInitVect = (uint32_t *)aesIV;
	hcryp.Init.HeaderSize = 0;
	hcryp.Init.Header = NULL;
	hcryp.Init.DataWidthUnit = CRYP_DATAWIDTHUNIT_BYTE;

	status = HAL_CRYP_Init(&hcryp);
	if (status != HAL_OK)
	{
		printf("AES Init Failed\r\n");
		return;
	}

	status = HAL_CRYP_Encrypt(&hcryp,
			(uint32_t *)plaintext,
			(uint16_t)sizeof(plaintext),
			(uint32_t *)ciphertext,
			HAL_MAX_DELAY);
	if (status != HAL_OK)
	{
		printf("Encryption Failed\r\n");
		return;
	}

	status = HAL_CRYPEx_AESGCM_GenerateAuthTAG(&hcryp, (uint32_t *)tag, HAL_MAX_DELAY);
	if (status != HAL_OK)
	{
		printf("Auth Tag Generation Failed\r\n");
		return;
	}

	printf("Encryption Success!\r\n");
}

void AES_GCM_Decrypt(void)
{
    HAL_StatusTypeDef status;
    uint8_t _tag[AES_TAG_SIZE];

    HAL_CRYP_DeInit(&hcryp);
    hcryp.Instance = AES;
    hcryp.Init.DataType = CRYP_DATATYPE_8B;
    hcryp.Init.KeySize = CRYP_KEYSIZE_128B;
    hcryp.Init.Algorithm = CRYP_AES_GCM_GMAC;
    hcryp.Init.pKey = (uint32_t *)aesKey;
    hcryp.Init.pInitVect = (uint32_t *)aesIV;
    hcryp.Init.HeaderSize = 0;
    hcryp.Init.Header = NULL;
    hcryp.Init.DataWidthUnit = CRYP_DATAWIDTHUNIT_BYTE;

    status = HAL_CRYP_Init(&hcryp);
    if (status != HAL_OK)
    {
        printf("AES Init Failed\r\n");
        return;
    }

    status = HAL_CRYP_Decrypt(&hcryp,
    		(uint32_t *)ciphertext,
			(uint16_t)sizeof(ciphertext),
			(uint32_t *)decryptedtext,
			HAL_MAX_DELAY);
    if (status != HAL_OK)
    {
    	printf("Decryption Failed\r\n");
    	return;
    }

    status = HAL_CRYPEx_AESGCM_GenerateAuthTAG(&hcryp, (uint32_t *)_tag, HAL_MAX_DELAY);
    if (status != HAL_OK)
    {
    	printf("Auth Tag Generation Failed\r\n");
    	return;
    }

    // The values of `tag` and `_tag` do not match here.
    if (memcmp(tag, _tag, AES_TAG_SIZE) != 0) {
    	printf("Auth Tag mismatch\r\n");
    	return;
    }

    printf("Decryption Success! Decrypted Text: %s\r\n", decryptedtext);
}

int main(void)
{

  // ...

  AES_GCM_Encrypt();

  AES_GCM_Decrypt();

  // ...
}

Thank you in advance for your assitance.