SAES using wrapped key

[AKova.3]

I am working with SAES on STM32U585. I am trying to make use of wrapping/unwrappinng my encryption key with  hardware-secret key DHUK . 

This in the SAES initialization I am using

	hcryp.Instance = SAES;
	hcryp.Init.DataType = CRYP_BYTE_SWAP;
	hcryp.Init.KeySize = CRYP_KEYSIZE_128B;
	hcryp.Init.pInitVect = (uint32_t *)iv;
	hcryp.Init.pKey = (uint32_t *)key;
	hcryp.Init.Algorithm = CRYP_AES_CBC;
	hcryp.Init.DataWidthUnit = CRYP_DATAWIDTHUNIT_WORD;
	hcryp.Init.KeyIVConfigSkip = CRYP_KEYNOCONFIG;
	hcryp.Init.KeyMode = CRYP_KEYMODE_WRAPPED;
	hcryp.Init.KeySelect = CRYP_KEYSEL_HW;
	hcryp.Init.KeyProtection = CRYP_KEYPROT_DISABLE;

 I make the encryption key available to SAES with 

	  HAL_CRYPEx_WrapKey(&hcryp, key, encrypted_key, 100);
	  HAL_CRYPEx_UnwrapKey(&hcryp, encrypted_key, 100);

If I make a simple test with

	  HAL_CRYP_Encrypt(&hcryp, (uint32_t*)test, 4, (uint32_t*)wbuf, 100);
	  HAL_CRYP_Decrypt(&hcryp, (uint32_t*)wbuf, 4, (uint32_t*)dbuf, 100);

i get the expected results. The encrypted text is what it shoud be and decrypt returns the original text. 

If I however call HAL_CRYP_Decrypt for the second time following the first call, passing it the same encypted text as the first time, it returns incorrect result. Also, a call to HAL_CRYP_Encrypt following a previous HAL_CRYP_Decrypt produces different result if passed the same plain text each time. I have found that all successive calls to HAL_CRYP_Encrypt produce the same result, which is correct if HAL_CRYP_Decrypt hasn't been called before, or incorrect if HAL_CRYP_Decrypt has previously been called. KEYVALID bit in SAES->CR register is set for the whole time and no error flags are raised. I have stepped through both HAL_CRYP_Encrypt and HAL_CRYP_Decrypt functions making sure that software doesn't try to load KEY registers since a valid key is already present there from wrapping/unwrapping procedure. I have observed the same thing when using ECB or CBC mode.

If I do a sequence of denit, init and key unwrapping, the next call to either HAL_CRYP_Encrypt or HAL_CRYP_Decrypt produces expected results. 

It sort of looks like that some state is carried over from decryption on to the next operation.

I did not observe this behaviour if I didn't use key wrapping/unwrapping but was loading the encryption key with software.

Any help would be appriciated.

[AKova.3]

With this piece of code in place, the program behaves the same as before.

[Jocelyn RICARD]

Hello @AKova.3 ,

I attach the main.c file I used for testing.

I'm not using CBC to wrap the key. Is this really what you want to do ?

I mean using CBC for key wrapping with an IV. And then using again CBC for decryption with the same IV ?

In the example I provide, I use AES_ECB for wrapping.

Then AES CBC with specific IV to decrypt.

Best regards

Jocelyn

[AKova.3]

Fair point about key wrapping, but I wasn't really concerned about it at this point. 

I tried running your code. What is there works fine. If I however add another exactly the same call to HAL_CRYP_Decrypt after the first one, it produces different result compared to first one. Correct me if I am wrong but I was working under the assumption that each call to HAL_CRYP_Decrypt would be independant from another for both EBC and CBC modes and therefore I would expect all to them to produce the same result given the same inputs.

[Jocelyn RICARD]

Hi @AKova.3 ,

here you are using AES CBC. This is Cypher Block Chaining. This is exactly the purpose to not being able to decrypt twice the same thing, as the initial vector propagates.

To get same output, you would need to reset the decryption to start with initial vector again.

Another way to check is to encrypt with CBC more than one buffer.

Then use same buffer sequence for decryption.

Best regards

Jocelyn

[AKova.3]

I understand that there is chaining between blocks of a single message, but is there also chaining between subsequent messages, that is subsequent calls to, for instance HAL_CRYP_Decrypt funtion because the peripheral retains some internal state between HAL function calls?

You mentioned that decryption needs to be reset to get the same output with the same inputs. Should this be done with calls to HAL_CRYP_DeInit, HAL_CRYP_Init and wrapping/unwrapping the key again or is there a more appropriate way? I have tried that and it does work but I can't imagine this is the way it was meant to be done.