[aes/doc] Document Galois/Counter Mode (GCM) implementation + hardening

Signed-off-by: Pirmin Vogel <[email protected]>

Author: vogelpi

hw/ip/aes/README.md

@@ -28,10 +28,13 @@ The AES unit supports the following features:
   - Electronic Codebook (ECB) mode,
   - Cipher Block Chaining (CBC) mode,
   - Cipher Feedback (CFB) mode (fixed data segment size of 128 bits, i.e., CFB-128),
-  - Output Feedback (OFB) mode, and
-  - Counter (CTR) mode.
+  - Output Feedback (OFB) mode,
+  - Counter (CTR) mode, and
+  - Galois/Counter Mode (GCM) (fixed IV length of 96 bits, fixed tag length of 128 bits) including support for context switching (via saving and restoring).
+- Support for GCM can be removed to save area, and is enabled/disabled using a compile-time Verilog parameter
 - Support for AES-192 can be removed to save area, and is enabled/disabled using a compile-time Verilog parameter
 - First-order masking of the cipher core using domain-oriented masking (DOM) to deter side-channel analysis (SCA), can optionally be disabled using compile-time Verilog parameters (for more details see [Security Hardening](./doc/theory_of_operation.md#side-channel-analysis))
+- First-order masking of the GHASH operation involved in GCM (for more details see [Security Hardening](./doc/theory_of_operation.md#side-channel-analysis))
 - Latency per 16 byte data block of 12/14/16 clock cycles (unmasked implementation) and 56/66/72 clock cycles (DOM) in AES-128/192/256 mode
 - Automatic as well as software-initiated reseeding of internal pseudo-random number generators (PRNGs) with configurable reseeding rate resulting in max entropy consumption rates ranging from 343 Mbit/s to 0.042 Mbit/s (at 100 MHz).
 - Countermeasures for deterring fault injection (FI) on the control path (for more details see [Security Hardening](./doc/theory_of_operation.md#fault-injection))
@@ -42,19 +45,19 @@ The AES unit supports the following features:
 This AES unit targets medium performance (16 parallel S-Boxes, \~1 cycle per round for the unmasked implementation, \~5 cycles per round for the DOM implementation).
 High-speed, single-cycle operation for high-bandwidth data streaming is not required.
 
-Cipher modes other than ECB, CBC, CFB, OFB and CTR are beyond this version of the AES unit but might be supported in future versions.
-Galois/Counter Mode (GCM) can be implemented by leveraging [Ibex](../rv_core_ibex/README.md) for the GHASH operation as demonstrated in [OpenTitan's library of cryptographic implementations](https://github.com/lowRISC/opentitan/tree/master/sw/device/lib/crypto).
+Cipher modes other than ECB, CBC, CFB, OFB, CTR and GCM are beyond this version of the AES unit but might be supported in future versions.
+If hardware support for GCM is disabled, it can be implemented by leveraging [Ibex](../rv_core_ibex/README.md) for the GHASH operation as demonstrated in [OpenTitan's library of cryptographic implementations](https://github.com/lowRISC/opentitan/tree/master/sw/device/lib/crypto).
 
 
 ## Description
 
 The AES unit is a cryptographic accelerator that accepts requests from the processor to encrypt or decrypt 16B blocks of data.
-It supports AES-128/192/256 in Electronic Codebook (ECB) mode, Cipher Block Chaining (CBC) mode, Cipher Feedback (CFB) mode (fixed data segment size of 128 bits, i.e., CFB-128), Output Feedback (OFB) mode and Counter (CTR) mode.
+It supports AES-128/192/256 in Electronic Codebook (ECB) mode, Cipher Block Chaining (CBC) mode, Cipher Feedback (CFB) mode (fixed data segment size of 128 bits, i.e., CFB-128), Output Feedback (OFB) mode, Counter (CTR) mode and Galois/Counter Mode (GCM) (fixed IV length of 96 bits, fixed tag length of 128 bits).
 For more information on these cipher modes, refer to [Recommendation for Block Cipher Modes of Operation](https://nvlpubs.nist.gov/nistpubs/Legacy/SP/nistspecialpublication800-38a.pdf).
-Galois/Counter Mode (GCM) can be implemented using [Ibex](../rv_core_ibex/README.md) for the GHASH operation as demonstrated in the [OpenTitan Cryptography Library](../../../doc/security/cryptolib/README.md).
-To improve the performance of GCM, instructions of the [RISC-V Bit-Manipulation Extension of Ibex](https://ibex-core.readthedocs.io/en/latest/03_reference/instruction_decode_execute.html#arithmetic-logic-unit-alu) can be leveraged.
-In particular, carry-less multiply instructions can help to speed up the GHASH operation.
 For details on GCM, refer to [Recommendation for Block Cipher Modes of Operation: Galois/Counter Mode (GCM) and GMAC](https://nvlpubs.nist.gov/nistpubs/Legacy/SP/nistspecialpublication800-38d.pdf).
+If hardware support for GCM is disabled, it can be implemented using [Ibex](../rv_core_ibex/README.md) for the GHASH operation as demonstrated in the [OpenTitan Cryptography Library](../../../doc/security/cryptolib/README.md).
+To improve the performance of such an implementation, instructions of the [RISC-V Bit-Manipulation Extension of Ibex](https://ibex-core.readthedocs.io/en/latest/03_reference/instruction_decode_execute.html#arithmetic-logic-unit-alu) can be leveraged.
+In particular, carry-less multiply instructions can help to speed up the GHASH operation.
 Other cipher modes might be added in future versions.
 
 The AES unit is attached to the chip interconnect bus as a peripheral module.

hw/ip/aes/data/aes.hjson

@@ -9,7 +9,7 @@
   one_line_desc:      "AES encryption and decryption engine with SCA and FI countermeasures",
   one_paragraph_desc: '''
   [Advanced Encryption Standard (AES)][nist-aes] is the primary symmetric encryption and decryption mechanism used in OpenTitan protocols.
-  AES Accelerator supports encryption/decryption using AES-128/192/256 in ECB, CBC, CFB, OFB, and CTR block cipher modes.
+  AES Accelerator supports encryption/decryption using AES-128/192/256 in ECB, CBC, CFB, OFB, CTR, and GCM block cipher modes.
   Its cipher core uses first-order domain-oriented masking (DOM) to deter side-channel analysis (SCA).
   To save area, the masking can optionally be disabled using a compile-time Verilog parameter.
   In addition, AES Accelerator features several countermeasures to deter fault injection (FI) attacks on the control path.
@@ -50,11 +50,20 @@
       local:   "false",
       expose:  "false"
     },
+    { name:    "AESGCMEnable",
+      type:    "bit",
+      default: "1'b1",
+      desc:    '''
+        Disable (0) or enable (1) support for Galois/Counter Mode (GCM) in hardware.
+      '''
+      local:   "false",
+      expose:  "false"
+    },
     { name:    "SecMasking",
       type:    "bit",
       default: "1'b1",
       desc:    '''
-        Disable (0) or enable (1) first-order masking of the AES cipher core.
+        Disable (0) or enable (1) first-order masking of the AES cipher core and the GHASH operation of GCM.
         Masking requires the use of a masked S-Box, see SecSBoxImpl parameter.
       '''
       local:   "false",