On-the-fly decryption engine

On-the-fly decryption engine FRTDEC allows to decrypt on-the-fly AXI traffic based on the read request address information. Four independent and non-overlapping encrypted regions can be defined in FRTDEC, with optional execute-only or execute-never enforcement per region. FRTDEC is using AES-128 in counter mode to achieve the lowest possible latency. As a consequence, each time the content of one encrypted region is changed the entire region must be re-encrypted with a different cryptographic context (key or initialization vector). This constraint makes FRTDEC suitable to decrypt read-only data or code, stored for example in external NOR Flash memory

• On-the-fly 128-bit decryption during SPI Controller memory-mapped read operations (single or multiple)
  • Use of AES in counter (CTR) mode, with keystream FIFO (depth=4)
  • Support for any read size
  • Physical address of the reads is used for the encryption/decryption
• Up to four independent encrypted regions
  • Granularity of the region definition: 4096 bytes
  • Region configuration write locking mechanism
  • Two optional decryption modes: execute-only and execute-never
  • Each region has its own 128-bit key, two bytes firmware version, and eight bytes application-defined nonce. At least one of those must be changed each time an encryption is performed by the application
• Encryption keys confidentiality and integrity protection
  • Write-only registers, with software locking mechanism
  • Availability of 8-bit CRC as public key information
• Support pre-fetching mechanism
• AMBA AHB slave peripheral, accessible through 32-bit word single accesses only (otherwise an AHB bus error is generated, and write accesses are ignored)