AES-GCM - AES-GCM - 2026.1 English - UG643

Standalone Library Documentation: BSP and Libraries Document Collection (UG643)
Document ID
UG643
Release Date
2026-06-23
Version
2026.1 English

This software uses AES-GCM hardened cryptographic accelerator to encrypt or decrypt the provided data and requires a key of size 256 bits and initialization vector(IV) of size 96 bits.

XilSecure library supports the following features:

  • Encryption of data with provided key and IV
  • Decryption of data with provided key and IV
  • Authentication using a GCM tag.
  • Key loading based on key selection, the key can be either the user provided key loaded into the KUP key or the device key used during boot.

For either encryption or decryption, initialize the AES-GCM engine first using the XSecure_AesInitialize function.

AES Encryption Function Usage

When all the data to be encrypted is available, the XSecure_AesEncryptData() can be used. When all the data is not available, use the following functions in the suggested order:
  1. XSecure_AesEncryptInit()
  2. XSecure_AesEncryptUpdate() - This function can be called multiple times till input data is completed.

AES Decryption Function Usage

When all the data for decryption is available, the XSecure_AesDecryptData() is used. When all the data is not available, use the following functions in the suggested order:

  1. XSecure_AesDecryptInit()
  2. XSecure_AesDecryptUpdate() - This function can be called multiple times till input data is completed.

During decryption, the provided GCM tag is compared to the GCM tag calculated by the engine. The two tags are then compared in the software and returned to the user as to whether or not the tags matched.

CAUTION:
Carefully consider the key storage location when using the KUP key for encryption/decryption of the data. Ensure that the key is placed in an internal memory region that has access controls. Not following this practice results in the security vulnerability.