| Second Auth |
Adds a second authentication tier using on-chip SRAM for second-level
MAC storage. First-level MACs continue to be stored in DRAM. The
second-level MACs prevent DRAM replay attacks. DRAM metadata
bandwidth is not eliminated. |
64 MB maximum protected data total across all protected
regions. |
| Countermeasures |
Adds hardware masking to the Crypto Engine power signature to resist
DPA key-extraction attacks. Refer to DPA Countermeasures. |
- Increases power
- Reduces key-rolling thresholds
|
| Inline ECC (on GCM controller) |
Enables inline ECC on the GCM controller simultaneously. Adds
Metadata ILC Size = Metadata/8 overhead when both active. |
Both features active; refer to the combined partition formula in
AES-GCM-256 Specifics and Memory Partitioning. |