Add AEAD with AES-CCM support for nRF54LM20A and remove size restrictions for nRF54LV10A #25514

degjorva · 2025-11-11T11:41:19Z

Add support for AES-CCM using ECB primitives when using cracen_need_multipart_workarounds and cracen_need_ctr_size_workarounds.

Se commits for details.

test_crypto: PR-890

Copilot

Pull Request Overview

This PR adds software-based AES-CCM AEAD support for nRF54LM20A and removes size restrictions for nRF54LV10A by implementing a workaround for hardware counter size limitations. The implementation uses ECB primitives to build CCM mode operations when hardware limitations are detected.

Key changes:

Introduces new Kconfig option CONFIG_CRACEN_NEED_CTR_SIZE_WORKAROUNDS to identify platforms requiring software workarounds
Implements complete software AES-CCM AEAD functionality using ECB primitives
Replaces SoC-specific checks with feature-based configuration flags throughout the codebase

Reviewed Changes

Copilot reviewed 12 out of 12 changed files in this pull request and generated 16 comments.

Show a summary per file

File	Description
`subsys/nrf_security/src/drivers/cracen/cracenpsa/src/cipher.c`	Replaces `CONFIG_SOC_NRF54LV10A` with `CONFIG_CRACEN_NEED_CTR_SIZE_WORKAROUNDS` for CTR mode routing
`subsys/nrf_security/src/drivers/cracen/cracenpsa/src/aead.c`	Routes AES-CCM operations to software implementation when workarounds are needed; removes blanket PSA_ERROR_NOT_SUPPORTED for nRF54LM20A
`subsys/nrf_security/src/drivers/cracen/cracenpsa/include/cracen_psa_primitives.h`	Increases `CRACEN_MAX_AEAD_BLOCK_SIZE` to 96 bytes; adds `cracen_sw_ccm_context_t` structure; removes CCM data size restriction
`subsys/nrf_security/src/drivers/cracen/cracenpsa/cracenpsa.cmake`	Conditionally excludes hardware AEAD when multipart workarounds are needed
`subsys/nrf_security/src/drivers/cracen/cracen_sw/src/cracen_sw_aes_ccm.c`	New file implementing complete software AES-CCM using CBC-MAC and CTR mode with ECB primitives
`subsys/nrf_security/src/drivers/cracen/cracen_sw/src/cracen_sw_aead.c`	New dispatcher layer for software AEAD implementations
`subsys/nrf_security/src/drivers/cracen/cracen_sw/include/cracen_sw_aes_ccm.h`	New header declaring software AES-CCM API
`subsys/nrf_security/src/drivers/cracen/cracen_sw/include/cracen_sw_aead.h`	New header for software AEAD dispatcher API
`subsys/nrf_security/src/drivers/cracen/cracen_sw/cracen_sw.cmake`	Updates build configuration to include software CCM implementation
`subsys/nrf_security/src/drivers/cracen/Kconfig`	Adds `CONFIG_CRACEN_NEED_CTR_SIZE_WORKAROUNDS` configuration option
`subsys/nrf_security/src/drivers/cracen/CMakeLists.txt`	Updates include logic for cracen_sw based on new configuration flags
`doc/nrf/releases_and_maturity/releases/release-notes-changelog.rst`	Documents new AES-CCM AEAD support for nRF54LM20 and sample support

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

subsys/nrf_security/src/drivers/cracen/cracen_sw/src/cracen_sw_aes_ccm.c

subsys/nrf_security/src/drivers/cracen/cracenpsa/src/aead.c

subsys/nrf_security/src/drivers/cracen/cracen_sw/src/cracen_sw_aes_ccm.c

subsys/nrf_security/src/drivers/cracen/cracenpsa/include/cracen_psa_primitives.h

subsys/nrf_security/src/drivers/cracen/cracen_sw/src/cracen_sw_aes_ccm.c

subsys/nrf_security/src/drivers/cracen/cracen_sw/src/cracen_sw_aead.c

doc/nrf/releases_and_maturity/releases/release-notes-changelog.rst

subsys/nrf_security/src/drivers/cracen/cracenpsa/cracenpsa.cmake

NordicBuilder · 2025-11-11T11:52:57Z

CI Information

^{To view the history of this post, click the 'edited' button above}
Build number: 29

Inputs:

Sources:

sdk-nrf: PR head: cc16bc45497951a49cf1cfd60b52dcbbde8c0997

more details

sdk-nrf:

PR head: cc16bc45497951a49cf1cfd60b52dcbbde8c0997
merge base: 4dc5927dade98b6bc5cbdfd1e96facb3c414ab43
target head (main): 52ea3d71c4e7837acf2c83f44c7338eae835169b
Diff

Github labels

Enabled	Name	Description
	ci-disabled	Disable the ci execution
	ci-all-test	Run all of ci, no test spec filtering will be done
	ci-force-downstream	Force execution of downstream even if twister fails
	ci-run-twister	Force run twister
	ci-run-zephyr-twister	Force run zephyr twister

List of changed files detected by CI (15)

doc
│  ├── nrf
│  │  ├── releases_and_maturity
│  │  │  ├── releases
│  │  │  │  │ release-notes-changelog.rst
│  │  ├── security
│  │  │  ├── crypto
│  │  │  │  │ crypto_supported_features.rst
subsys
│  ├── nrf_security
│  │  ├── cmake
│  │  │  │ psa_crypto_config.cmake
│  │  ├── configs
│  │  │  │ psa_crypto_config.h.template
│  │  ├── src
│  │  │  ├── drivers
│  │  │  │  ├── cracen
│  │  │  │  │  ├── CMakeLists.txt
│  │  │  │  │  ├── Kconfig
│  │  │  │  │  ├── cracen_sw
│  │  │  │  │  │  ├── cracen_sw.cmake
│  │  │  │  │  │  ├── include
│  │  │  │  │  │  │  ├── cracen_sw_aead.h
│  │  │  │  │  │  │  │ cracen_sw_aes_ccm.h
│  │  │  │  │  │  ├── src
│  │  │  │  │  │  │  ├── cracen_sw_aead.c
│  │  │  │  │  │  │  │ cracen_sw_aes_ccm.c
│  │  │  │  │  ├── cracenpsa
│  │  │  │  │  │  ├── cracenpsa.cmake
│  │  │  │  │  │  ├── include
│  │  │  │  │  │  │  │ cracen_psa_primitives.h
│  │  │  │  │  │  ├── src
│  │  │  │  │  │  │  ├── aead.c
│  │  │  │  │  │  │  │ cipher.c

Outputs:

Toolchain

Version: 43683a87ea
Build docker image: docker-dtr.nordicsemi.no/sw-production/ncs-build:43683a87ea_5ea73affbf

Test Spec & Results: ✅ Success; ❌ Failure; 🟠 Queued; 🟡 Progress; ◻️ Skipped; ⚠️ Quarantine

◻️ Toolchain - Skipped: existing toolchain is used
✅ Build twister
- sdk-nrf test count: 2571
✅ Integration tests
- ✅ test-fw-nrfconnect-chip
- ✅ test-fw-nrfconnect-nrf-iot_cloud
- ✅ test-fw-nrfconnect-nrf_crypto
- ✅ test-fw-nrfconnect-rs
- ✅ test-fw-nrfconnect-tfm
- ✅ test-sdk-find-my
- ✅ test-sdk-mcuboot
- ✅ test-sdk-dfu
- ⚠️ test_ble_nrf_config

Disabled integration tests

- test-fw-nrfconnect-nrf_lrcs_mosh
- test-fw-nrfconnect-nrf_lrcs_positioning
- desktop52_verification
- test-fw-nrfconnect-apps
- test-fw-nrfconnect-ble_mesh
- test-fw-nrfconnect-ble_samples
- test-fw-nrfconnect-fem
- test-fw-nrfconnect-nfc
- test-fw-nrfconnect-nrf-iot_libmodem-nrf
- test-fw-nrfconnect-nrf-iot_lwm2m
- test-fw-nrfconnect-nrf-iot_samples
- test-fw-nrfconnect-nrf-iot_thingy91
- test-fw-nrfconnect-nrf-iot_zephyr_lwm2m
- test-fw-nrfconnect-ps-main
- test-fw-nrfconnect-rpc
- test-fw-nrfconnect-thread-main
- test-low-level
- test-sdk-audio
- test-sdk-wifi
- test-secdom-samples-public

Note: This message is automatically posted and updated by the CI

Copilot

Pull Request Overview

Copilot reviewed 12 out of 12 changed files in this pull request and generated 1 comment.

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

doc/nrf/releases_and_maturity/releases/release-notes-changelog.rst

github-actions · 2025-11-11T15:53:03Z

You can find the documentation preview for this PR here.

Preview links for modified nRF Connect SDK documents:

https://ncsdoc.z6.web.core.windows.net/PR-25514/nrf/releases_and_maturity/releases/release-notes-changelog.html
https://ncsdoc.z6.web.core.windows.net/PR-25514/nrf/security/crypto/crypto_supported_features.html

Copilot

Pull Request Overview

Copilot reviewed 12 out of 12 changed files in this pull request and generated no new comments.

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

greg-fer · 2025-11-12T10:09:30Z

subsys/nrf_security/src/drivers/cracen/cracen_sw/include/cracen_sw_aead.h

+					  psa_algorithm_t alg);
+
+/**
+ * @brief Setup software AEAD decryption operation.


Suggested change

* @brief Setup software AEAD decryption operation.

* @brief Set up the software AEAD decryption operation.

greg-fer · 2025-11-12T10:09:46Z

subsys/nrf_security/src/drivers/cracen/cracen_sw/include/cracen_sw_aead.h

+ * @brief Dispatcher layer for software AEAD implementations.
+ *
+ * This module provides a common interface that dispatches to specific
+ * software AEAD implementations (e.g., AES-CCM) as a workaround for


Suggested change

* software AEAD implementations (e.g., AES-CCM) as a workaround for

* software AEAD implementations (such as AES-CCM) as a workaround for

greg-fer · 2025-11-12T10:10:18Z

subsys/nrf_security/src/drivers/cracen/cracen_sw/include/cracen_sw_aead.h

+/**
+ * @brief Set lengths for software AEAD operation.
+ *
+ * Some AEAD algorithms (e.g., CCM) require lengths to be known upfront.


Suggested change

* Some AEAD algorithms (e.g., CCM) require lengths to be known upfront.

* Some AEAD algorithms (such as CCM) require lengths to be known up-front.

greg-fer · 2025-11-12T10:11:22Z

subsys/nrf_security/src/drivers/cracen/cracen_sw/include/cracen_sw_aead.h

+psa_status_t cracen_aead_abort(cracen_aead_operation_t *operation);
+
+/**
+ * @brief Single-shot software AEAD encryption.


Can you replace "single-shot" with something less colloquial? Also, start the brief with a verb, like "Perform a ..." in cracen_sw_aes_ccm.h.
Applies to other instances in the file too.

I changed it to single-part. That is the terminology the PSA documentation uses

greg-fer · 2025-11-12T10:11:39Z

subsys/nrf_security/src/drivers/cracen/cracen_sw/include/cracen_sw_aes_ccm.h

+#include "cracen_psa_primitives.h"
+
+/**
+ * @brief Setup software AES-CCM encryption operation.


Suggested change

* @brief Setup software AES-CCM encryption operation.

* @brief Set up the software AES-CCM encryption operation.

greg-fer · 2025-11-12T10:18:03Z

subsys/nrf_security/src/drivers/cracen/cracen_sw/include/cracen_sw_aes_ccm.h

+ * @param[in] tag_size Size of the tag buffer.
+ * @param[out] tag_length Pointer to store the actual tag length.
+ *
+ * @retval PSA_SUCCESS Operation finished successfully, tag generated.


Suggested change

* @retval PSA_SUCCESS Operation finished successfully, tag generated.

* @retval PSA_SUCCESS Operation finished successfully; tag generated.

Or :, as mentioned earlier.

greg-fer · 2025-11-12T10:18:18Z

subsys/nrf_security/src/drivers/cracen/cracen_sw/include/cracen_sw_aes_ccm.h

+				      uint8_t *tag, size_t tag_size, size_t *tag_length);
+
+/**
+ * @brief Verify and finish the software AES-CCM decryption operation.


Suggested change

* @brief Verify and finish the software AES-CCM decryption operation.

* @brief Verify the tag and finish the software AES-CCM decryption operation.

greg-fer · 2025-11-12T10:19:47Z

subsys/nrf_security/src/drivers/cracen/cracen_sw/include/cracen_sw_aes_ccm.h

+				       size_t ciphertext_size, size_t *ciphertext_length);
+
+/**
+ * @brief Perform a single-shot software AES-CCM decryption.


Suggested change

* @brief Perform a single-shot software AES-CCM decryption.

* @brief Perform a single software AES-CCM decryption.

To avoid the colloquialism.

greg-fer · 2025-11-12T10:20:02Z

subsys/nrf_security/src/drivers/cracen/cracen_sw/include/cracen_sw_aes_ccm.h

+ * @retval PSA_SUCCESS Decryption and verification completed successfully.
+ * @retval PSA_ERROR_INVALID_SIGNATURE Authentication tag verification failed.
+ * @retval PSA_ERROR_BUFFER_TOO_SMALL Output buffer too small.
+ * @retval PSA_ERROR_INVALID_ARGUMENT Invalid nonce length, key size, or ciphertext too short.


Suggested change

* @retval PSA_ERROR_INVALID_ARGUMENT Invalid nonce length, key size, or ciphertext too short.

* @retval PSA_ERROR_INVALID_ARGUMENT Invalid nonce length, invalid key size, or ciphertext too short.

greg-fer · 2025-11-12T10:23:44Z

doc/nrf/releases_and_maturity/releases/release-notes-changelog.rst

@@ -140,6 +140,8 @@ Security

  * Support for AES in counter mode using CRACEN for the :zephyr:board:`nrf54lm20dk`.

+  * Support for AES-CCM AEAD using CRACEN for the :zephyr:board:`nrf54lm20dk`.


Please check if we need to update https://github.com/nrfconnect/sdk-nrf/blob/main/doc/nrf/security/crypto/crypto_supported_features.rst?plain=1#L4195 and https://github.com/nrfconnect/sdk-nrf/blob/main/doc/nrf/security/crypto/crypto_supported_features.rst?plain=1#L4222

I updated the supported features for both LM20 and LV10, or rather I just removed the note which should cover it

nordicjm · 2025-11-13T09:08:35Z

subsys/nrf_security/src/drivers/cracen/cracen_sw/include/cracen_sw_aead.h

+ * @retval PSA_ERROR_INVALID_ARGUMENT Invalid key size.
+ */
+psa_status_t cracen_aead_encrypt_setup(cracen_aead_operation_t *operation,
+					  const psa_key_attributes_t *attributes,


spacing on all of these is not consistent with the previous line

nordicjm · 2025-11-13T09:09:24Z

subsys/nrf_security/src/drivers/cracen/cracen_sw/src/cracen_sw_aead.c

+#endif
+
+psa_status_t cracen_aead_encrypt_setup(cracen_aead_operation_t *operation,
+					  const psa_key_attributes_t *attributes,


this file too

nordicjm · 2025-11-13T09:09:51Z

subsys/nrf_security/src/drivers/cracen/cracen_sw/src/cracen_sw_aes_ccm.c

+}
+
+psa_status_t cracen_sw_aes_ccm_encrypt_setup(cracen_aead_operation_t *operation,
+					      const psa_key_attributes_t *attributes,


here three...

nordicjm · 2025-11-13T09:10:53Z

subsys/nrf_security/src/drivers/cracen/cracenpsa/include/cracen_psa_primitives.h

+	uint8_t ctr_block[SX_BLKCIPHER_AES_BLK_SZ];   /* Counter block for CTR mode */
+	uint8_t keystream[SX_BLKCIPHER_AES_BLK_SZ];   /* Generated keystream */
+	uint8_t partial_block[SX_BLKCIPHER_AES_BLK_SZ]; /* Buffer for partial blocks */
+	size_t keystream_offset;                       /* Position in keystream buffer */


(non-blocking suggestion) why not put the /* directly one space after the ; so it's easy to see what these are?

Copilot

Pull request overview

Copilot reviewed 15 out of 15 changed files in this pull request and generated 3 comments.

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

subsys/nrf_security/src/drivers/cracen/cracenpsa/src/aead.c

doc/nrf/security/crypto/crypto_supported_features.rst

greg-fer · 2025-11-27T13:02:10Z

doc/nrf/security/crypto/crypto_supported_features.rst

                  * CCM cipher mode:

-                    * Multi-part encrypt and decrypt APIs are not supported.
-                    * A maximum of 1 MB of plaintext or ciphertext is supported.


This section is now empty. Do we need this entry for CCM?

We don't, but lets fix that in another PR later so we don't have to rerun CI on this

Will fix in #25849

frkv

LGTM

degjorva · 2025-12-02T14:15:24Z

Rebase

Copilot

Pull request overview

Copilot reviewed 15 out of 15 changed files in this pull request and generated 3 comments.

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

Copilot · 2025-12-02T14:21:18Z

subsys/nrf_security/src/drivers/cracen/cracen_sw/src/cracen_sw_aes_ccm.c

+static psa_status_t initialize_cbc_mac(cracen_aead_operation_t *operation,
+				       struct sxblkcipher *cipher)
+{
+	cracen_sw_ccm_context_t *ccm_ctx = &operation->sw_ccm_ctx;
+	uint8_t b0[SX_BLKCIPHER_AES_BLK_SZ];
+	psa_status_t status;
+
+	if (ccm_ctx->cbc_mac_initialized) {
+		return PSA_SUCCESS;
+	}
+	format_ccm_b0(b0, operation->nonce_length, operation->nonce, operation->plaintext_length,
+		      operation->ad_length, operation->tag_size);
+	status = cracen_aes_primitive(cipher, &operation->keyref, b0, ccm_ctx->cbc_mac);
+	if (status != PSA_SUCCESS) {
+		return status;
+	}
+	if (operation->ad_length > 0) {
+		size_t ad_len_size =
+			encode_ccm_ad_length(ccm_ctx->partial_block, operation->ad_length);
+		ccm_ctx->has_partial_ad_block = true;
+		ccm_ctx->total_ad_fed = ad_len_size;
+	}
+	ccm_ctx->cbc_mac_initialized = true;
+	return PSA_SUCCESS;
+}


The b0 buffer contains sensitive cryptographic material (including plaintext/AD lengths and tag size) but is not securely cleared after use. This could potentially leak information. Consider using safe_memzero(b0, sizeof(b0)); before the function returns to ensure secure cleanup.

Copilot · 2025-12-02T14:21:18Z

subsys/nrf_security/src/drivers/cracen/cracen_sw/src/cracen_sw_aes_ccm.c

+		safe_memzero(s0, sizeof(s0));
+		return status;
+	}
+	memcpy(tag, operation->sw_ccm_ctx.cbc_mac, operation->tag_size);
+	cracen_xorbytes(tag, s0, operation->tag_size);
+	safe_memzero(s0, sizeof(s0));


The a0_block buffer contains sensitive cryptographic material (nonce and counter) but is not securely cleared after use. Consider using safe_memzero(a0_block, sizeof(a0_block)); before returning to ensure secure cleanup of all temporary buffers.

Suggested change

safe_memzero(s0, sizeof(s0));

return status;

}

memcpy(tag, operation->sw_ccm_ctx.cbc_mac, operation->tag_size);

cracen_xorbytes(tag, s0, operation->tag_size);

safe_memzero(s0, sizeof(s0));

safe_memzero(s0, sizeof(s0));

safe_memzero(a0_block, sizeof(a0_block));

return status;

}

memcpy(tag, operation->sw_ccm_ctx.cbc_mac, operation->tag_size);

cracen_xorbytes(tag, s0, operation->tag_size);

safe_memzero(s0, sizeof(s0));

safe_memzero(a0_block, sizeof(a0_block));

Copilot · 2025-12-02T14:21:19Z

subsys/nrf_security/src/drivers/cracen/cracen_sw/src/cracen_sw_aes_ccm.c

+		tag_mismatch |= computed_tag[i] ^ tag[i];
+	}
+	if (tag_mismatch != 0) {
+		status = PSA_ERROR_INVALID_SIGNATURE;


[nitpick] For better code clarity and maintainability, consider explicitly setting status = PSA_SUCCESS; when tag_mismatch == 0 (i.e., add an else clause to the if (tag_mismatch != 0) check). While the current code is functionally correct (status remains PSA_SUCCESS from generate_tag), making it explicit improves readability and prevents potential bugs if the code flow changes in the future.

Suggested change

status = PSA_ERROR_INVALID_SIGNATURE;

status = PSA_ERROR_INVALID_SIGNATURE;

} else {

status = PSA_SUCCESS;

greg-fer · 2025-12-04T13:07:49Z

doc/nrf/releases_and_maturity/releases/release-notes-changelog.rst

+* Added:
+  * Support for AES-CCM AEAD using CRACEN for the :zephyr:board:`nrf54lm20dk`.


Suggested change

* Added:

* Support for AES-CCM AEAD using CRACEN for the :zephyr:board:`nrf54lm20dk`.

* Added:

* Support for AES-CCM AEAD using CRACEN for the :zephyr:board:`nrf54lm20dk`.

Add config for the workarounds required for socs which have a reduced ctr register size. Update existing workarounds to use this kconfig Signed-off-by: Dag Erik Gjørvad <[email protected]>

Copilot

Pull request overview

Copilot reviewed 15 out of 15 changed files in this pull request and generated 1 comment.

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

subsys/nrf_security/src/drivers/cracen/cracen_sw/src/cracen_sw_aead.c

Add support for AES-CCM using ECB primitives when using cracen_need_multipart_workarounds or cracen_need_ctr_size_workarounds Add AEAD to cracen_sw with AES-CCM support. Signed-off-by: Dag Erik Gjørvad <[email protected]>

Copilot AI review requested due to automatic review settings November 11, 2025 11:41

degjorva requested review from a team as code owners November 11, 2025 11:41

NordicBuilder added the doc-required PR must not be merged without tech writer approval. label Nov 11, 2025

Copilot started reviewing on behalf of degjorva November 11, 2025 11:41 View session

Copilot finished reviewing on behalf of degjorva November 11, 2025 11:44

Copilot AI reviewed Nov 11, 2025

View reviewed changes

degjorva force-pushed the lm20-aes-ccm branch from eccb724 to 5fcfd19 Compare November 11, 2025 12:41

degjorva requested review from Copilot and greg-fer November 11, 2025 13:26

degjorva force-pushed the lm20-aes-ccm branch from 5fcfd19 to ec04d74 Compare November 11, 2025 15:13

Copilot started reviewing on behalf of degjorva November 11, 2025 15:13 View session

Copilot finished reviewing on behalf of degjorva November 11, 2025 15:14

Copilot AI reviewed Nov 11, 2025

View reviewed changes

doc/nrf/releases_and_maturity/releases/release-notes-changelog.rst Show resolved Hide resolved

degjorva changed the title ~~Add AEAD with AES-CCM support for nRF54LM20A and remove size restrictions for nnRF54LV10A~~ Add AEAD with AES-CCM support for nRF54LM20A and remove size restrictions for nRF54LV10A Nov 11, 2025

degjorva force-pushed the lm20-aes-ccm branch from ec04d74 to 3b31f03 Compare November 12, 2025 07:59

Copilot AI review requested due to automatic review settings November 12, 2025 09:09

degjorva force-pushed the lm20-aes-ccm branch from 3b31f03 to 56219e3 Compare November 12, 2025 09:09

Copilot started reviewing on behalf of degjorva November 12, 2025 09:09 View session

Copilot finished reviewing on behalf of degjorva November 12, 2025 09:12

Copilot AI reviewed Nov 12, 2025

View reviewed changes

greg-fer requested changes Nov 12, 2025

View reviewed changes

nordicjm previously requested changes Nov 13, 2025

View reviewed changes

degjorva force-pushed the lm20-aes-ccm branch from 56219e3 to 50f9035 Compare November 14, 2025 11:25

degjorva requested a review from a team as a code owner November 14, 2025 11:25

Copilot AI review requested due to automatic review settings November 14, 2025 11:38

degjorva force-pushed the lm20-aes-ccm branch from 50f9035 to 6c540f9 Compare November 14, 2025 11:38

Copilot AI review requested due to automatic review settings November 26, 2025 21:21

degjorva force-pushed the lm20-aes-ccm branch from 9e13ad8 to 64b21a9 Compare November 26, 2025 21:21

Copilot started reviewing on behalf of degjorva November 26, 2025 21:22 View session

Copilot finished reviewing on behalf of degjorva November 26, 2025 21:24

Copilot AI reviewed Nov 26, 2025

View reviewed changes

subsys/nrf_security/src/drivers/cracen/cracenpsa/src/aead.c Show resolved Hide resolved

subsys/nrf_security/src/drivers/cracen/cracenpsa/src/aead.c Show resolved Hide resolved

doc/nrf/security/crypto/crypto_supported_features.rst Outdated Show resolved Hide resolved

degjorva force-pushed the lm20-aes-ccm branch from 64b21a9 to f2fe57e Compare November 27, 2025 11:23

greg-fer requested changes Nov 27, 2025

View reviewed changes

greg-fer approved these changes Nov 28, 2025

View reviewed changes

frkv approved these changes Nov 28, 2025

View reviewed changes

degjorva mentioned this pull request Nov 28, 2025

doc: security: update for v3.2.0 #25849

Merged

Copilot AI review requested due to automatic review settings December 2, 2025 14:15

degjorva force-pushed the lm20-aes-ccm branch from f2fe57e to 24df256 Compare December 2, 2025 14:15

Copilot started reviewing on behalf of degjorva December 2, 2025 14:15 View session

Copilot finished reviewing on behalf of degjorva December 2, 2025 14:19

Copilot AI reviewed Dec 2, 2025

View reviewed changes

degjorva force-pushed the lm20-aes-ccm branch from 24df256 to 25071c1 Compare December 3, 2025 14:11

greg-fer requested changes Dec 4, 2025

View reviewed changes

nrf_security: cracen_sw: Add config for ctr size workarounds

c5e0ae8

Add config for the workarounds required for socs which have a reduced ctr register size. Update existing workarounds to use this kconfig Signed-off-by: Dag Erik Gjørvad <[email protected]>

Copilot AI review requested due to automatic review settings December 4, 2025 14:07

degjorva force-pushed the lm20-aes-ccm branch from 25071c1 to 526b9d8 Compare December 4, 2025 14:07

Copilot started reviewing on behalf of degjorva December 4, 2025 14:07 View session

Copilot finished reviewing on behalf of degjorva December 4, 2025 14:09

Copilot AI reviewed Dec 4, 2025

View reviewed changes

subsys/nrf_security/src/drivers/cracen/cracen_sw/src/cracen_sw_aead.c Show resolved Hide resolved

degjorva requested a review from greg-fer December 5, 2025 11:13

nrf_security: cracen_sw: Add support for aead with AES-CCM

cc16bc4

Add support for AES-CCM using ECB primitives when using cracen_need_multipart_workarounds or cracen_need_ctr_size_workarounds Add AEAD to cracen_sw with AES-CCM support. Signed-off-by: Dag Erik Gjørvad <[email protected]>

degjorva force-pushed the lm20-aes-ccm branch from 526b9d8 to cc16bc4 Compare December 5, 2025 14:52

greg-fer approved these changes Dec 5, 2025

View reviewed changes

nordicjm approved these changes Dec 8, 2025

View reviewed changes

nordicjm merged commit 0590959 into nrfconnect:main Dec 8, 2025
20 checks passed

	* @brief Setup software AEAD decryption operation.
	* @brief Set up the software AEAD decryption operation.

	* software AEAD implementations (e.g., AES-CCM) as a workaround for
	* software AEAD implementations (such as AES-CCM) as a workaround for

	* Some AEAD algorithms (e.g., CCM) require lengths to be known upfront.
	* Some AEAD algorithms (such as CCM) require lengths to be known up-front.

	* @brief Setup software AES-CCM encryption operation.
	* @brief Set up the software AES-CCM encryption operation.

	* @retval PSA_SUCCESS Operation finished successfully, tag generated.
	* @retval PSA_SUCCESS Operation finished successfully; tag generated.

	* @brief Verify and finish the software AES-CCM decryption operation.
	* @brief Verify the tag and finish the software AES-CCM decryption operation.

	* @brief Perform a single-shot software AES-CCM decryption.
	* @brief Perform a single software AES-CCM decryption.

	* @retval PSA_ERROR_INVALID_ARGUMENT Invalid nonce length, key size, or ciphertext too short.
	* @retval PSA_ERROR_INVALID_ARGUMENT Invalid nonce length, invalid key size, or ciphertext too short.

		@@ -140,6 +140,8 @@ Security

		* Support for AES in counter mode using CRACEN for the :zephyr:board:`nrf54lm20dk`.

		* Support for AES-CCM AEAD using CRACEN for the :zephyr:board:`nrf54lm20dk`.

		* Added:
		* Support for AES-CCM AEAD using CRACEN for the :zephyr:board:`nrf54lm20dk`.

Add AEAD with AES-CCM support for nRF54LM20A and remove size restrictions for nRF54LV10A #25514

Add AEAD with AES-CCM support for nRF54LM20A and remove size restrictions for nRF54LV10A #25514

Conversation

degjorva commented Nov 11, 2025 • edited by magnev Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull Request Overview

Reviewed Changes

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

NordicBuilder commented Nov 11, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

CI Information

Inputs:

Sources:

Github labels

Outputs:

Toolchain

Test Spec & Results: ✅ Success; ❌ Failure; 🟠 Queued; 🟡 Progress; ◻️ Skipped; ⚠️ Quarantine

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull Request Overview

Uh oh!

Uh oh!

github-actions bot commented Nov 11, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull Request Overview

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

degjorva commented Nov 11, 2025 •

edited by magnev

Loading

NordicBuilder commented Nov 11, 2025 •

edited

Loading

github-actions bot commented Nov 11, 2025 •

edited

Loading