CSRNG HWIP Technical Specification
Overview
This document specifies the Cryptographically Secure Random Number Generator (CSRNG) hardware IP functionality. Due to the importance of secure random number generation (RNG), it is a topic which is extensively covered in security standards. This IP targets compliance with both BSI’s AIS31 recommendations for Common Criteria, as well as NIST’s SP 800-90A and NIST’s SP 800-90C (Second Draft), both of which are referenced in FIPS 140-3. Since these two standards use significantly different terminology, it is recommended that the reader refer to our RNG compliance strategy document for an overview of the various RNG classes and equivalencies between the two standards. The CSRNG IP supports both of these standards for both deterministic (DRNG) and true random number generation (TRNG). In NIST terms, it works with the Entropy Source IP to satisfy the requirements as a DRBG (deterministic random-bit-generator) or NRBG (non-deterministic random bit generator). In AIS31 language, this same implementation can be used to satisfy either the DRG.3 requirements for deterministic generation, or the PTG.3 requirements for cryptographically processed physical generation.
In this document the terms “DRNG” and “TRNG” are used most generally to refer to deterministic or true random number generation functionalities implemented to this specification. However, the terms “DRBG” or “NRBG” are specifically used when respectively referring to SP 800-90A or SP 800-90C requirements. Meanwhile, when addressing requirements which originate from AIS31 we refer to the specific DRG.3 or PTG.3 classes of RNGs.
This IP block is attached to the chip interconnect bus as a peripheral module conforming to the Comportable guideline for peripheral functionality, but also has direct hardware links to other IPs for secure and software-inaccessible transmission of random numbers. The bus connections to peripheral modules is done using the CSRNG application interface. This interface allows peripherals to manage CSRNG instances, and request for obfuscated entropy to be returned from the CSRNG module.
Features
- Provides support for both deterministic (DRNG) and true random number generation (TRNG), when combined with a secure entropy source (i.e. one constructed and implemented in compliance with SP 800-90A,B,C and AIS31).
- Compliant with NIST and BSI recommendations for random number generation.
- Hardware peripherals and software applications issue commands to dedicated RNG instances through a common application interface.
- In deterministic mode, meets the requirements given in AIS31 for a DRG.3 class deterministic random number generator (DRNG) meaning it provides Forward Secrecy and Enhanced Backward Secrecy.
- Utilizes the CTR_DRBG construction specified in NIST SP 800-90A, qualifying it as a NIST-approved DRBG (deterministic random bit generator).
- Operates at 256 bit security strength.
- Support for multiple separate CSRNG instances per IP block.
- Each instance has its own internal state, control, reseed counters and IO pins.
- The number of CSRNG instances is set via a module parameter.
- Software access to a dedicated CSRNG instance.
- One instance, Instance N-1, is always accessible from the bus through device registers,
- All other instances route to other hardware peripherals (e.g. the key manager, obfuscation engines etc.) and in normal operation these other instances are inaccessible from software.
- The IP may be configured to support “debug mode” wherein all instances can be accessed by software. For security reasons this mode may be permanently disabled using one-time programmable (OTP) memory.
- The IP interfaces with external entropy sources to obtain any required non-determinstic seed material (entropy) and nonces.
- Requires an external entropy source which is compliant with NIST SP 800-90B, and which also satisfies the requirements for a PTG.2 class physical non-deterministic random number generator as defined in AIS31.
- Dedicated hardware interface with external entropy source satisfies requirements for
get_entropy_input()
interface as defined in SP 800-90A. - When needed, utilizes the
Block_Cipher_df
derivation function (as defined in SP 800-90A) for assembling seed material. This allows the use of entropy sources which are not full-entropy (less than one bit of entropy per bit generated).
- Also supports the optional use of personalization strings or other application inputs (e.g. OTP memory values) during instantiation.
- Assuming a continuously-live entropy source, each instance can also optionally be used as a non-determinstic TRNG (true random number generator, also called a non-deterministic random bit generator or NRBG in SP 800-90C).
- In this mode, an instance also meets the requirements laid out for a PTG.3 class RNG, the strongest class laid out in AIS31.
- Implementation follows the NRBG “Oversampling Construction” approved by SP 800-90C, to meet both CC and FIPS TRNG constructions.
- In addition to the approved DRNG mode, any instance can also operate in “Fully Deterministic mode”, meaning the seed depends entirely on application inputs or personalization strings.
- This provides an approved means of seed construction in FIPS 140-2 as described in the FIPS 140-2 Implementation Guidance, section 7.14, resolution point 2(a).
Description
Though the recommendations in AIS31 are based around broad functional requirements, the recommendations in SP 800-90 are very prescriptive in nature, outlining the exact constructs needed for approval. Thus the interface and implementation are largely driven by these explicit constructs, particularly the CTR_DBRG construct.
The CSRNG IP consists of four main components:
-
An AES primitive
-
The CTR_DRBG state-machine (
ctr_drbg_fsm
) which drives the AES primitive, performing the various encryption sequences prescribed for approved DRBGs in SP 800-90A. These include:- The Derivation Function: Part of the instantiation and reseed routines, this routine assembles the previous seed material (on reseed only), application inputs, and entropy.
- The Instantiation Routine: Combines application inputs, external entropy and nonce (more entropy) via the derivation function.
- The Reseed Routine: Combines the previous seed material with external entropy to generate a new seed.
- The Generate Routine: Generates up to CSRNG_MAX_GENERATE random bits. If called with prediction_resistance_flag, forces a reseed.
- The Update Routine: Updates the internal state of the DRNG instance after each generate call.
-
State vectors for each DRNG instance.
-
Interface logic and access control for each instance.
Note on the term “Entropy”
Every DRNG requires some initial seed material, and the requirements for the generation of that seed material varies greatly between standards, and potentially between CC security targets. In all standards considered, DRNG’s require some “entropy” from an external source to create the initial seed. However, the rules for obtaining said entropy differ. Furthermore the required delivery mechanisms differ. For this reason we must make a clear distinction between “Physical” (or “Live” or “True”) entropy and “Factory Entropy”. This distinction is most important when considering the creation of IP which is both compatible with both the relatively new SP 800-90 recommendations, as well as the well-established FIPS 140-2 guidelines.
-
Physical entropy is the only type of “entropy” described in SP 800-90. The means of generation is described in SP 800-90B. One statistical test requirement is that physical entropy must be unique between reboot cycles, ruling out sources such as one-time programmable (OTP) memories. In SP 800-90A, the delivery mechanism must come through a dedicated interface and “not be provided by the consuming application”.
-
Factory entropy is a type of entropy described in the FIPS 140-2 implementation guidance (IG) section 7.14, resolution point 2(a). It can be stored in a persistent memory, programmed at the factory. In some use cases, the consuming application needs to explicitly load this entropy itself and process it to establish the expected seed.
This document aims to make the distinction between physical entropy and factory entropy wherever possible. However, if used unqualified, the term “entropy” should be understood to refer to physical entropy strings which are obtained in accordance with SP 800-90C. That is either physical entropy, or the output of a DRNG which itself has been seeded (and possibly reseeded) with physical entropy. In CC terms, “entropy strings” (when used in this document without a qualifier) should be understood to come from either a PTG.2 or PTG.3 class RNG.
Compatibility
None.
Theory of Operations
The CSRNG block has been constructed to follow the NIST recommendation for a DRBG mechanism based on block ciphers. Specifically, it is a CTR_DRBG that uses an approved block cipher algorithm in counter mode. As such, the block diagram below makes reference to hardware blocks that either directly or closely follow NIST descriptions for the equivalent functions.
There are two major hardware interfaces: the application interface and the entropy request interface.
The application interface, which is described in more detail later, is provided for an application to manage an instance
in CSRNG.
Once setup, the application interface user can request for entropy bits to be generated, as well as other functions.
The application interface supports up to 15 hardware interfaces, and one software interface.
A walk through of how CSRNG generates entropy bits begins with the application interface.
An instantiate
command is issued from one of the application interfaces.
This request moves into the cmd_stage
block.
Here the request is arbitrated between all of the cmd_stage
blocks.
The winner will get its command moved into the command dispatch logic.
A common state machine will process all application interface commands in order of arbitration.
At this point, some seed entropy may be required depending on the command and any flags.
If needed, a request to the entropy source hardware interface will be made.
This step can take milliseconds if seed entropy is not immediately available.
Once all of the prerequisites have been collected, a CTR_DRBG command can be launched.
This command will go into the ctr_drbg_cmd
block.
This ctr_drbg_cmd
block uses two NIST-defined functions, the update and the block_encrypt functions.
If the command is a generate, the ctr_drbg_cmd
block will process the first half of the algorithm, and then pass it on to the ctr_drbg_gen
block.
Additionally, the ctr_drbg_gen
block also uses the update block and the block_encrypt block.
To keep resources to a minimum, both of these blocks have arbiters to allow sharing between the ctr_drbg_cmd
and ctr_drbg_gen
blocks.
The command field called ccmd
(for current command) is sent along the pipeline to not only identify the command, but is also reused as a routing tag for the arbiters to use when returning the block response.
Once the command has traversed through all of the CTR_DRBG blocks, the result will eventually land into the state_db
block.
This block will hold the instance state for each application interface.
The specific state information held in the instance is documented below.
If the command was a generate
command, the genbits data word will be returned to the requesting cmd_stage
block.
Finally, an ack
response and status will be returned to the application interface once the command has been completely processed.
Block Diagram
Hardware Interfaces
Referring to the
Comportable guideline for peripheral device functionality,
the module csrng
has
the following hardware interfaces defined.
Primary Clock: clk_i
Other Clocks: none
Bus Device Interface: tlul
Bus Host Interface: none
Peripheral Pins for Chip IO: none
Interrupts:
Interrupt Name | Description |
---|---|
cs_cmd_req_done | Asserted when a command request is completed. |
cs_entropy_req | Asserted when a request for entropy has been made. |
cs_hw_inst_exc | Asserted when a hardware-attached CSRNG instance encounters a command exception |
cs_fatal_err | Asserted when a FIFO error or a fatal alert occurs. Check the |
Security Alerts:
Alert Name | Description |
---|---|
fatal_alert | This alert triggers if an illegal state machine state is reached, or if an AES fatal alert condition occurs. |
Design Details
Non-blocking Commands
Regarding command processing, all commands process immediately except for the generate command.
The command generate length count (glen
) is kept in the cmd_stage
block.
When the state_db block issues an ack to the cmd_stage
block, the cmd_stage
block increments an internal counter.
This process repeats until the glen
field value has been matched.
Because each request is pipelined, requests from other cmd_stage
blocks can be processed before the original generate command is completely done.
This provides some interleaving of commands since a generate command can be programmed to take a very long time.
Working State Values
The state_db has the follow attributes shown in the following table:
Bits | Name | Description |
---|---|---|
31:0 | Reseed Counter | Value required by NIST to be held in the state instance. |
159:32 | V | Value required by NIST to be held in the state instance, and is of size BlockLen. |
415:160 | Key | Value required by NIST to be held in the state instance, and is of size SeedLen. |
416 | Status | Set when instantiated. |
417 | Compliance | Set when FIPS/CC compliant entropy was used to seed this instance. |
AES Cipher
The block_encrypt
block is where the aes_cipher_core
block is located.
This is the same block used in the AES design.
Parameters are selected such that this is the unmasked version.
Software Support
The software application interface uses a set of TL-UL registers to send commands and receive generated bits. Since the registers are 32-bit words wide, some sequencing will need to be done by firmware to make this interface work properly.
Application Interface
This section describes the application interface, which is required for performing any operations using a CSRNG instance (i.e. instantiation, reseeding, RNG generation, or uninstantiation). Each CSRNG instance corresponds to a unique application interface port, which implements the application interface described here. Any hardware peripherals which require complete control of an instance may connect directly to a dedicated interface port. Meanwhile peripherals without any special requirements (i.e. personalization strings or non-FIPS-approved, fully-deterministic number sequences) may share access to an instance via the entropy distribution network (EDN) IP. The EDN’s manage the instantiation and reseeding of CSRNG instances for general use-cases, providing either on-demand or timed-delivery entropy streams to hardware peripherals. Firmware applications can obtain access to random bit sequences directly through application interface port 0, which is directly mapped to a set of TL-UL registers.
The total number of application interface ports (for TL-UL, directly attached peripherals or EDN instances) is determined by the NHwApp
parameter.
The command bus operates like a FIFO, in which a command is pushed into the interface.
An optional stream of additional data may follow, such as seed material for an instantiate
application command.
For the generate
application command, the obfuscated entropy will be returned on the genbits
bus.
This bus also operates like a FIFO, and the receiving module can provide back pressure to the genbits
bus.
There is one instance of a firmware application interface, and uses the TL-UL registers.
For more details on how the application interface works, see the Theory of Operations section above.
In general, users of the application interface are either firmware or some hardware module entity.
For hardware, a module can either directly control the application interface, or it can connect to an entropy distribution network
module (EDN).
Attaching to an EDN block allows for a simpler interface connection to a more layout-friendly distributed-chip network.
General Command Format
The general format for the application interface is a 32-bit command header, optionally followed by additional data, such as a personalization string, typically twelve 32-bit words in length. Depending on the command, these strings are typically required to be 384-bits in length, to match the size of the seed-length when operating with 256-bit security-strength. The exact function of the additional data field depends in the command. However, in general, the additional data can be any length as specified by the command length field. The command header is defined below.
Command Header
The application interface requires that a 32-bit command header be provided to instruct the CSRNG how to manage the internal working states. Below is a description of the fields of this header:
Bits | Name | Description |
---|---|---|
3:0 | acmd | Application Command: Selects one of five operations to perform. The commands supported are instantiate, reseed, generate, update, and uninstantiate. Each application interface port used by peripheral hardware commands a unique instance number in CSRNG. |
7:4 | clen | Command Length: Number of 32-bit words that can optionally be appended to the command. A value of zero will only transfer the command header. A value of 4'hc will transfer the header plus an additional twelve 32-bit words of data. |
11:8 | flags | Command Flags: Specific flags associated with a command. Used to allow additional features per command. Flags are defined as flag0, flag1, flag2, and flag3, where flag0 is bit 8, and flag1 is bit 9, etc. Note that flag0 is used for the instantiate command. All others are reserved. |
30:12 | glen | Generate Length: Only defined for the generate command, this field is the total number of crytographic entropy bits requested. The NIST reference name is max_number_of_bit_per_request, and this field size supports the maximum size allowed. Each unit represents 128 bits of entropy returned. For example, a value of 8 would return a total of 1024 bits. The maximum value for this field is 219. |
31 | resv | Unused and reserved. |
Command Description
The command field of the application command header is described in detail in the table below. The actions performed by each command, as well as which flags are supported, are described in this table.
Command Name | Encoded Value | Description |
---|---|---|
Instantiate | 0x1 | Initializes an instance in CSRNG. When seeding, if flag0 is not set and clen is zero, then a seed of only the entropy source seed will be used. If flag0 is not set and clen is non-zero, then the seed will xor'ed with the provided additional data. If flag0 is set and clen is zero, then a seed of zero with no entropy source seed material will be used. If flag0 is set and clen is non-zero, then only the provided additional data will be used as the seed. WARNING: Though flag0 may be useful for generating fully-determininistic bit sequences, the use of this flag will render the instance non-FIPS compliant until it is re-instantiated. When the instantiate command is completed, the active bit in the CSRNG working state will be set. |
Reseed | 0x2 | Reseeds an existing instance in CSRNG. When clen is set to zero for this command, only the entropy source seed will be used to reseed the instance. If clen is set to non-zero (up to twelve), the additional data provided with be xor'ed with the entropy source seed. |
Generate | 0x3 | Starts a request to CSRNG to generate crytographic entropy bits. The glen field represents how many 128-bit words are to be returned to the application interface. The glen field needs to be a minimum value of one. The NIST reference to the prediction_resistance_flag is not directly supported as a flag. It is the resposibility of the calling application to reseed as needed before the generate command to properly support prediction resistance. |
Update | 0x4 | Updates an existing instance in CSRNG.
This command does the same function as the reseed command, except that:
|
Uninstantiate | 0x5 | Resets an instance in CSRNG. Values in the instance are zeroed out. When the uninstantiate comand is completed, the active bit in the CSRNG working state will be cleared. Uninstantiating an instance effectively resets it, clearing any errors that it may have encountered due to bad command syntax or entropy source failures. |
Reserved | 0x0,0x6-0xf | Unused and reserved. |
Command Response
Once a command has been completed, successfully or unsuccessfully, the CSRNG responds with a single cycle pulse on the csrng_rsp_ack
signal associated with the same application interface port.
If the command is successful the csrng_rsp_sts
signal will indicate the value 0 (CSRNG_OK
) in the same cycle.
Otherwise the application will receive the value 1 (CSRNG_ERROR
) on the csrng_rsp_sts
signal.
A number of exception cases to be considered are enumerated in NIST SP 800-90A, and may include events such as:
- Failure of the entropy source
- Attempts to use an instance which has not been properly instantiated, or
- Attempts to generate data when an instance has exceeded its maximum seed.life.
In such cases, a 32-bit exception message will be propagated to firmware via the
hw_exc_sts
register, and acs_hw_inst_exc
interrupt will be raised.
Generated Bits (genbits
) Interface
In addition to the command response signals there is all the bus for returning the generated bits.
This 129-bit bus consists of 128-bits, genbits_bus
, for the random bit sequence itself, along with a single bit flag, genbits_fips
, indicating whether the bits were considered fully in accordance with FIPS standards.
There are two cases when the sequence will not be FIPS compliant:
- Early in the boot sequence, the
entropy_src
generates a seed from the first 384 bits pulled from the noise source. This initial seed is tested to ensure some minimum quality for obfuscation use- cases, but this boot seed is not expected to be full-entropy nor do these health checks meet the 1024-bit requirement for start-up health checks required by NIST 800-90B. - If
flag0
is asserted during instantiation, the resulting DRBG instance will have a fully-deterministic seed, determined only by user input data. Such a seed will be created only using factory-entropy and will lack the physical-entropy required by NIST SP 800-90A, and thus this DRBG instance will not be FIPS compliant.
Handshaking signals
The application command signal csrng_req_bus
is accompanied by a csrng_valid_signal
, which is asserted by the requester when the command is valid.
CSRNG may stall incoming commands by desserting the csrng_req_ready
signal.
A command is considered received whenever both csrng_req_valid
and csrng_req_ready
are asserted in the same clock cycle.
Likewise a requester must only consider data on the genbits
bus to be valid when the genbits_valid
signal is asserted, and should assert genbits_ready
whenever it is ready to accept the genbits
data.
The genbits
data is considered successfully transmitted whenever genbits_valid
and genbits_ready
are asserted in the same clock cycle.
A requester must always be ready to receive csrng_req_sts
signals.
(There is no “ready” signal for command response messages sent to hardware.)
Waveforms
Application Interface: Instantiate Request
Application Interface: Reseed Request
Application Interface: Generate Request
Application Interface: Update Request
Application Interface: Uninstantiate Request
Entropy Source Hardware Interface
The following waveform shows an example of how the entropy source hardware interface works.
Interrupts
The cs_cmd_req_done
interrupt will assert when a csrng command has been completed.
The cs_entropy_req
interrupt will assert when csrng requests for entropy from ENTROPY_SRC.
The cs_hw_inst_exc
interrupt will assert when any of the hardware-controlled CSRNG instances encounters an exception while executing a command, either due to errors on the command sequencing, or an exception within the entropy_src
IP.
The cs_fifo_err
interrupt will assert when any of the csrng FIFOs has a malfunction.
The conditions that cause this to happen are either when there is a push to a full FIFO or a pull from an empty FIFO.
Programmers Guide
Initialization
The following code snippet demonstrates initializing the CSRNG block.
void csrng_init(unsigned int enable) {
// set the control register enable bit
*CTRL_REG = enable; // should be 0x1 by default
// the CSRNG interrupts can optionally be enabled
}
Register Table
csrng.INTR_STATE @ 0x0
Interrupt State Register Reset default = 0x0, mask 0xf
|
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
| ||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
Bits | Type | Reset | Name | Description | ||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
0 | rw1c | 0x0 | cs_cmd_req_done | Asserted when a command request is completed. | ||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
1 | rw1c | 0x0 | cs_entropy_req | Asserted when a request for entropy has been made. | ||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
2 | rw1c | 0x0 | cs_hw_inst_exc | Asserted when a hardware-attached CSRNG instance encounters a command exception | ||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
3 | rw1c | 0x0 | cs_fatal_err | Asserted when a FIFO error or a fatal alert occurs. Check the |
csrng.INTR_ENABLE @ 0x4
Interrupt Enable Register Reset default = 0x0, mask 0xf
|
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
| ||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
Bits | Type | Reset | Name | Description | ||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
0 | rw | 0x0 | cs_cmd_req_done | Enable interrupt when | ||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
1 | rw | 0x0 | cs_entropy_req | Enable interrupt when | ||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
2 | rw | 0x0 | cs_hw_inst_exc | Enable interrupt when | ||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
3 | rw | 0x0 | cs_fatal_err | Enable interrupt when |
csrng.INTR_TEST @ 0x8
Interrupt Test Register Reset default = 0x0, mask 0xf
|
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
| ||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
Bits | Type | Reset | Name | Description | ||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
0 | wo | 0x0 | cs_cmd_req_done | Write 1 to force | ||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
1 | wo | 0x0 | cs_entropy_req | Write 1 to force | ||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
2 | wo | 0x0 | cs_hw_inst_exc | Write 1 to force | ||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
3 | wo | 0x0 | cs_fatal_err | Write 1 to force |
csrng.ALERT_TEST @ 0xc
Alert Test Register Reset default = 0x0, mask 0x1
|
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
| ||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
Bits | Type | Reset | Name | Description | ||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
0 | wo | 0x0 | fatal_alert | Write 1 to trigger one alert event of this kind. |
csrng.REGWEN @ 0x10
Register write enable for all control registers Reset default = 0x1, mask 0x1
|
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
| ||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
Bits | Type | Reset | Name | Description | ||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
0 | rw0c | 0x1 | REGWEN | When true, the writeable registers can be modified. When false, they become read-only. Defaults true, write one to clear. Note that this needs to be cleared after initial configuration at boot in order to lock in the listed register settings. |
csrng.CTRL @ 0x14
Control register Reset default = 0x0, mask 0xf0003
Register enable = REGWEN
|
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
| ||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
Bits | Type | Reset | Name | Description | ||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
0 | rw | x | ENABLE | Setting this bit will enable the CSRNG module. The application interface for software (register based) will be enabled only if the respective efuse input is enabled. | ||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
1 | rw | x | AES_CIPHER_DISABLE | Setting this bit will disable the AES cipher core module. If set, then commands will bypass the AES cipher core, but still move through the logical flow of CSRNG. This mode is primarily for debug purposes. | ||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
15:2 | Reserved | |||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
19:16 | rw | x | FIFO_DEPTH_STS_SEL | This field will select which FIFO depth will be read out for diagnostic purposes. |
csrng.SUM_STS @ 0x18
Summary status register Reset default = 0x0, mask 0x80ffffff
|
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
| ||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
Bits | Type | Reset | Name | Description | ||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
23:0 | ro | x | FIFO_DEPTH_STS | These bits show the current status of the CRSNG FIFO depths. | ||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
30:24 | Reserved | |||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
31 | ro | x | DIAG | This this an internal generic diagnostic bit. |
csrng.CMD_REQ @ 0x1c
Command request register Reset default = 0x0, mask 0xffffffff
Register enable = REGWEN
|
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
| ||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
Bits | Type | Reset | Name | Description | ||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
31:0 | wo | x | CMD_REQ | Writing this request with defined CSRNG commands will initiate all possible CSRNG actions. The application interface must wait for the "ack" to return before issuing new commands. |
csrng.SW_CMD_STS @ 0x20
Application interface command status register Reset default = 0x1, mask 0x3
|
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
| ||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
Bits | Type | Reset | Name | Description | ||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
0 | ro | 0x1 | CMD_RDY | This bit indicates when the command interface is ready to accept commands. | ||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
1 | ro | 0x0 | CMD_STS | This one bit field is the status code returned with the application command ack. It is updated each time a command ack is asserted on the internal application interface for software use. 0b0: Request completed successfully 0b1: Request completed with an error |
csrng.GENBITS_VLD @ 0x24
Generate bits returned valid register Reset default = 0x0, mask 0x3
|
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
| ||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
Bits | Type | Reset | Name | Description | ||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
0 | ro | x | GENBITS_VLD | This bit is set when genbits are available on this application interface. | ||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
1 | ro | x | GENBITS_FIPS | This bit is set when genbits are FIPS/CC compliant. |
csrng.GENBITS @ 0x28
Generate bits returned register Reset default = 0x0, mask 0xffffffff
|
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
| ||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
Bits | Type | Reset | Name | Description | ||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
31:0 | ro | x | GENBITS | Reading this register will get the generated bits that were requested with
the generate request. This register must be four times for each request
number made. For example, a application command generate request with
a |
csrng.HALT_MAIN_SM @ 0x2c
Halt the CSRNG main state machine register Reset default = 0x0, mask 0x1
Register enable = REGWEN
|
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
| ||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
Bits | Type | Reset | Name | Description | ||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
0 | wo | x | HALT_MAIN_SM | Setting this bit halts the main state machine that processes csrng application commands. The purpose of this register is to allow reading the internal state registers in a controlled manner. After this bit is set, the status bit should be polled to determine if the state machine has halted. Once halted, the internal state can be read out. To resume operation, this bit should be reset. |
csrng.MAIN_SM_STS @ 0x30
CSRNG main state machine status register Reset default = 0x0, mask 0x1
|
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
| ||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
Bits | Type | Reset | Name | Description | ||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
0 | ro | 0x0 | MAIN_SM_STS | This bit indicates when the CSRNG main state machine has been halted. When the halt bit is set, this bit should be polled until this status bit is set. When set, it is safe to read the internal state registers. When the halt bit is cleared, this register can be polled to make sure the main state machine is operational again. |
csrng.INT_STATE_NUM @ 0x34
Internal state number register Reset default = 0x0, mask 0xf
Register enable = REGWEN
|
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
| ||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
Bits | Type | Reset | Name | Description | ||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
3:0 | rw | x | INT_STATE_NUM | Setting this field will set the number for which internal state can be selected for a read access. Up to 16 internal state values can be chosen from this register. The actual number of valid internal state fields is set by NHwApps plus 1 software app. For those selections that point to reserved locations (greater than NHwApps plus 1), the returned value will be zero. Writing this register will also reset the internal read pointer for the INT_STATE_VAL register. |
csrng.INT_STATE_VAL @ 0x38
Internal state read access register Reset default = 0x0, mask 0xffffffff
|
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
| ||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
Bits | Type | Reset | Name | Description | ||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
31:0 | ro | x | INT_STATE_VAL | Reading this register will dump out the contents of the selected internal state field. Since the internal state field is 448 bits wide, it will require 14 reads from this register to gather the entire field. Once 14 reads have been done, the internal read pointer (selects 32 bits of the 448 bit field) will reset to zero. The INT_STATE_NUM can be re-written at this time (internal read pointer is also reset), and then another internal state field can be read. Also, the life cycle state must be one where the signal "lc_hw_debug_en" is asserted in order to read any internal state field. |
csrng.HW_EXC_STS @ 0x3c
Hardware instance exception status register Reset default = 0x0, mask 0x7fff
|
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
| ||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
Bits | Type | Reset | Name | Description | ||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
14:0 | rw | x | HW_EXC_STS | Reading this register indicates whether one of the CSRNG HW instances has encountered an exception. Each bit corresponds to a particular hardware instance, with bit 0 corresponding to instance HW0, bit 1 corresponding to instance HW1, and so forth. (To monitor the status of requests made to the SW instance, check the CMD_STS register). Writing a zero to this register resets the status bits. |
csrng.ERR_CODE @ 0x40
Hardware detection of error conditions status register Reset default = 0x0, mask 0x73f0ffff
|
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
| ||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
Bits | Type | Reset | Name | Description | ||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
0 | ro | x | SFIFO_CMD_ERR | This bit will be set to one when an error has been detected for the command stage command FIFO. The type of error is reflected in the type status bits (bits 28 through 30 of this register). This bit will stay set until firmware clears it. | ||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
1 | ro | x | SFIFO_GENBITS_ERR | This bit will be set to one when an error has been detected for the command stage genbits FIFO. The type of error is reflected in the type status bits (bits 28 through 30 of this register). This bit will stay set until firmware clears it. | ||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
2 | ro | x | SFIFO_CMDREQ_ERR | This bit will be set to one when an error has been detected for the cmdreq FIFO. The type of error is reflected in the type status bits (bits 28 through 30 of this register). This bit will stay set until firmware clears it. | ||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
3 | ro | x | SFIFO_RCSTAGE_ERR | This bit will be set to one when an error has been detected for the rcstage FIFO. The type of error is reflected in the type status bits (bits 28 through 30 of this register). This bit will stay set until firmware clears it. | ||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
4 | ro | x | SFIFO_KEYVRC_ERR | This bit will be set to one when an error has been detected for the keyvrc FIFO. The type of error is reflected in the type status bits (bits 28 through 30 of this register). This bit will stay set until firmware clears it. | ||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
5 | ro | x | SFIFO_UPDREQ_ERR | This bit will be set to one when an error has been detected for the updreq FIFO. The type of error is reflected in the type status bits (bits 28 through 30 of this register). This bit will stay set until firmware clears it. | ||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
6 | ro | x | SFIFO_BENCREQ_ERR | This bit will be set to one when an error has been detected for the bencreq FIFO. The type of error is reflected in the type status bits (bits 28 through 30 of this register). This bit will stay set until firmware clears it. | ||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
7 | ro | x | SFIFO_BENCACK_ERR | This bit will be set to one when an error has been detected for the bencack FIFO. The type of error is reflected in the type status bits (bits 28 through 30 of this register). This bit will stay set until firmware clears it. | ||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
8 | ro | x | SFIFO_PDATA_ERR | This bit will be set to one when an error has been detected for the pdata FIFO. The type of error is reflected in the type status bits (bits 28 through 30 of this register). This bit will stay set until firmware clears it. | ||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
9 | ro | x | SFIFO_FINAL_ERR | This bit will be set to one when an error has been detected for the final FIFO. The type of error is reflected in the type status bits (bits 28 through 30 of this register). This bit will stay set until firmware clears it. | ||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
10 | ro | x | SFIFO_GBENCACK_ERR | This bit will be set to one when an error has been detected for the gbencack FIFO. The type of error is reflected in the type status bits (bits 28 through 30 of this register). This bit will stay set until firmware clears it. | ||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
11 | ro | x | SFIFO_GRCSTAGE_ERR | This bit will be set to one when an error has been detected for the grcstage FIFO. The type of error is reflected in the type status bits (bits 28 through 30 of this register). This bit will stay set until firmware clears it. | ||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
12 | ro | x | SFIFO_GGENREQ_ERR | This bit will be set to one when an error has been detected for the ggenreq FIFO. The type of error is reflected in the type status bits (bits 28 through 30 of this register). This bit will stay set until firmware clears it. | ||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
13 | ro | x | SFIFO_GADSTAGE_ERR | This bit will be set to one when an error has been detected for the gadstage FIFO. The type of error is reflected in the type status bits (bits 28 through 30 of this register). This bit will stay set until firmware clears it. | ||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
14 | ro | x | SFIFO_GGENBITS_ERR | This bit will be set to one when an error has been detected for the ggenbits FIFO. The type of error is reflected in the type status bits (bits 28 through 30 of this register). This bit will stay set until firmware clears it. | ||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
15 | ro | x | SFIFO_BLKENC_ERR | This bit will be set to one when an error has been detected for the blkenc FIFO. The type of error is reflected in the type status bits (bits 28 through 30 of this register). This bit will stay set until firmware clears it. | ||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
19:16 | Reserved | |||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
20 | ro | x | CMD_STAGE_SM_ERR | This bit will be set to one when an illegal state has been detected for the command stage state machine. This error will signal a fatal alert, and also an interrupt if enabled. This bit will stay set until firmware clears it. | ||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
21 | ro | x | MAIN_SM_ERR | This bit will be set to one when an illegal state has been detected for the main state machine. This error will signal a fatal alert, and also an interrupt if enabled. This bit will stay set until firmware clears it. | ||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
22 | ro | x | DRBG_GEN_SM_ERR | This bit will be set to one when an illegal state has been detected for the ctr_dbrg gen state machine. This error will signal a fatal alert, and also an interrupt if enabled. This bit will stay set until firmware clears it. | ||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
23 | ro | x | DRBG_UPDBE_SM_ERR | This bit will be set to one when an illegal state has been detected for the ctr_dbrg update block encode state machine. This error will signal a fatal alert, and also an interrupt if enabled. This bit will stay set until firmware clears it. | ||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
24 | ro | x | DRBG_UPDOB_SM_ERR | This bit will be set to one when an illegal state has been detected for the ctr_dbrg update out block state machine. This error will signal a fatal alert, and also an interrupt if enabled. This bit will stay set until firmware clears it. | ||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
25 | ro | x | AES_CIPHER_SM_ERR | This bit will be set to one when an AES fatal error has been detected. This error will signal a fatal alert, and also an interrupt if enabled. This bit will stay set until firmware clears it. | ||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
27:26 | Reserved | |||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
28 | ro | x | FIFO_WRITE_ERR | This bit will be set to one when any of the source bits (bits 0 through 15 of this this register) are asserted as a result of an error pulse generated from any full FIFO that has been recieved a write pulse. This bit will stay set until firmware clears it. | ||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
29 | ro | x | FIFO_READ_ERR | This bit will be set to one when any of the source bits (bits 0 through 15 of this this register) are asserted as a result of an error pulse generated from any empty FIFO that has recieved a read pulse. This bit will stay set until firmware clears it. | ||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
30 | ro | x | FIFO_STATE_ERR | This bit will be set to one when any of the source bits (bits 0 through 15 of this this register) are asserted as a result of an error pulse generated from any FIFO where both the empty and full status bits are set. This bit will stay set until firmware clears it. |
csrng.ERR_CODE_TEST @ 0x44
Test error conditions register Reset default = 0x0, mask 0x1f
Register enable = REGWEN
|
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
| ||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
Bits | Type | Reset | Name | Description | ||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
4:0 | rw | x | ERR_CODE_TEST | Setting this field will set the bit number for which an error
will be forced in the hardware. This bit number is that same one
found in the |