ica_aes_xts

Purpose

Encrypt or decrypt data with an AES key using the XEX Tweakable Block Cipher with Ciphertext Stealing (XTS) mode, as described in NIST Special Publication 800-38E and IEEE standard 1619-2007. This function supports single-part operation only.

Required hardware support

• KM-XTS-AES-128, or KM-XTS-AES-256
• PCC-Compute-XTS-Parameter-Using-AES-128, or PCC-Compute-XTS-Parameter-Using-AES-256

Parameters

const unsigned char *in_data

Pointer to a readable buffer that contains the message to be encrypted or decrypted. The size of the message in bytes is data_length. The size of this buffer must be at least as large as data_length.

unsigned char *out_data

Pointer to a writable buffer to contain the resulting encrypted or decrypted message. The size of this buffer in bytes must be at least as large as data_length.

unsigned long data_length

Length in bytes of the message to be encrypted or decrypted, which resides at the beginning of in_data. The minimal data_length must be at least 16 bytes (16, 17, 18 ...) and needs not be a multiple of 16 (which is the AES cipher block size).

const unsigned char *key1

Pointer to a buffer containing a valid AES key. key1 is used for the actual encryption of the message buffer, combined with some vector computed from the tweak value (Key1 in IEEE Std 1619-2007).

const unsigned char *key2

Pointer to a buffer containing a valid AES key. key2 is used to encrypt the tweak (Key2 in IEEE Std 1619-2007).

unsigned int key_length

The length in bytes of the AES key. XTS-supported AES key sizes are 16 and 32, for AES-128 and AES-256 respectively. Therefore, you can use:

2 * AES_KEY_LEN128 and 2 * AES_KEY_LEN256.

unsigned char *tweak

Pointer to a valid 16-byte tweak value (as in IEEE standard 1619-2007). This tweak is overwritten during the function. If data_length is a multiple of the cipher block size (a multiple of 16 for AES), the result value in tweak can be used as the tweak value for a chained ica_aes_xts call with the same key pair.

unsigned int direction

Can be 0 or 1:

0

Use the decrypt function.

1

Use the encrypt function.

Return codes

0

Success

For return codes indicating exceptions, see Return codes.