R01UH0823EJ0100 Rev.1.00
Page 1480 of 1823
Jul 31, 2019
RX23W Group
42. Trusted Secure IP (TSIP-Lite)
42.
Trusted Secure IP (TSIP-Lite)
This MCU incorporates a Trusted Secure IP Lite (TSIP-Lite) module to provide security functions. The module consists
of an access management circuit, encryption engine, and random number generator. In combination with the TSIP-Lite
library, the TSIP-Lite can prevent eavesdropping (confidentiality), falsification of information (integrity), and
impersonation (authenticity).
Key information to be used in encrypting and decrypting data is only stored within the TSIP-Lite, and any external
access can be shut out to obtain a system with strong security.
42.1
Overview
summarizes the specifications of the TSIP-Lite.
shows a block diagram of the TSIP-Lite.
Note 1. This does not include the overhead for calling functions of the TSIP-Lite library.
Table 42.1
Specifications of TSIP-Lite
Item
Description
Access control
Access management circuit
In case of irregular access to the TSIP-Lite due to a falsified program or runaway execution of a program,
this circuit blocks all subsequent access and stops the output of data from the TSIP-Lite.
Encryption engine
AES: Compliant with NIST FIPS PUB 197 algorithm
Key sizes: 128 or 256 bits
Block sizes: 128 bits
Block cipher mode of operation
ECB, CBC, CTR: Compliant with NIST SP 800-38A
CMAC: Compliant with NIST SP 800-38B
CCM: Compliant with NIST SP 800-38C
GCM: Compliant with NIST SP 800-38D
XTS: Compliant with NIST SP 800-38E
GCTR
Number of cycles for execution*
ECB, CBC, CTR, CMAC, GCTR, XTS:
44 cycles of PCLKB for 128-bit keys, 61 cycles of PCLKB for 256-bit keys
CCM:
88 cycles of PCLKB for 128-bit keys
AES-GCM
AES-GCM is realized by combining AES-GCTR and GHASH.
Key management
Keys are only valid within the TSIP-Lite.
Only key generation information is output from the TSIP-Lite.
Keys can be regenerated by the input of key generation information to the TSIP-Lite.
Endian
Big or little
Generation of random
numbers
32-bit true random number generator
The TSIP-Lite library can assemble 32-bit true random numbers to generate 128- or 256-bit true random
numbers.
The generated 128-bit and 256-bit true random numbers are used as keys in encrypting and decrypting
data.
Protection against illicit
key copying
An ID unique to the MCU (unique ID) is accessible from the access management circuit through the
dedicated bus.
Combining the unique ID with the key generation information prevents the illicit copying of the key to
another MCU.
Supervisor mode
The supervisor mode signal is connected to the access management circuit and is used to limit control of
the TSIP-Lite module to supervisor mode only.
Interrupt sources
Three
These can be used as triggers for data transfer by the DMAC or DTC.
Low power
consumption
Setting of the module stop state is possible.