Crypto: AES CTR
The AES CTR sample demonstrates how to use the PSA Crypto API to perform AES encryption and decryption operations using the CTR block cipher mode and a 128-bit AES key.
Requirements
The sample supports the following development kits:
Hardware platforms |
PCA |
Board name |
|
|---|---|---|---|
PCA10153 |
|
||
PCA10090 |
|
||
PCA10171 |
|
||
nRF7120 DK |
nrf7120dk |
|
|
nRF54LV10 DK |
PCA10188 |
|
|
nRF54LS05 DK |
PCA10214 |
nrf54ls05dk |
|
PCA10184 |
|
||
nRF54LC10 DK |
PCA10226 |
nrf54lc10dk |
|
PCA10156 |
|
||
PCA10156 |
|
||
PCA10156 |
|
||
PCA10175 |
|
||
PCA10095 |
|
||
PCA10056 |
|
For more security, it is recommended to use the */ns variant of the board target.
When built for this variant, the sample is configured to compile and run as a non-secure application using security by separation.
Therefore, it automatically includes Trusted Firmware-M that prepares the required peripherals and secure services to be available for the application.
Overview
The sample enables PSA Crypto API and configures the following Kconfig options for the cryptographic features:
CONFIG_PSA_WANT_KEY_TYPE_AES- Used to enable support for AES key types from among the supported cryptographic operations for Key types and key management.CONFIG_PSA_WANT_ALG_CTR- Used to enable support for the CTR cipher mode from among the supported cryptographic operations for Cipher modes.CONFIG_PSA_WANT_GENERATE_RANDOM- Used to enable random number generation for key and IV generation from among the supported cryptographic operations for RNG algorithms.
The sample also configures the cryptographic drivers for each board target using Kconfig options in the overlay files in the boards directory.
These Kconfig options are then used by the build system to compile the required cryptographic PSA directives and make the configured cryptographic drivers available at runtime. See Driver selection for more information about this process.
Once built and run, the sample performs the following operations:
Initialization:
The PSA Crypto API is initialized using
psa_crypto_init().A random 128-bit AES key is generated using
psa_generate_key()and stored in the PSA crypto keystore. The key is configured with usage flags for both encryption and decryption.
Encryption and decryption of a sample plaintext:
An encryption operation is set up using
psa_cipher_encrypt_setup()with thePSA_ALG_CTRalgorithm.A random initialization vector (IV) is generated using
psa_cipher_generate_iv().Encryption is performed using
psa_cipher_update()and finalized withpsa_cipher_finish().A decryption operation is set up using
psa_cipher_decrypt_setup().The IV from the encryption step is set using
psa_cipher_set_iv().Decryption is performed using
psa_cipher_update()and finalized withpsa_cipher_finish().The decrypted text is compared with the original plaintext to verify correctness.
Cleanup:
The AES key is removed from the PSA crypto keystore using
psa_destroy_key().
Building and running
This sample can be found under samples/crypto/aes_ctr in the nRF Connect SDK folder structure.
For more security, it is recommended to use the */ns variant of the board target (see the Requirements section above.)
When built for this variant, the sample is configured to compile and run as a non-secure application using security by separation.
Therefore, it automatically includes Trusted Firmware-M that prepares the required peripherals and secure services to be available for the application.
To build the sample, follow the instructions in Building an application for your preferred building environment. See also Programming an application for programming steps and Testing and optimization for general information about testing and debugging in the nRF Connect SDK.
Note
When building repository applications in the SDK repositories, building with sysbuild is enabled by default.
If you work with out-of-tree freestanding applications, you need to manually pass the --sysbuild parameter to every build command or configure west to always use it.
Testing
After programming the sample to your development kit, complete the following steps to test it:
Connect to the kit with a terminal emulator (for example, the Serial Terminal app). See Testing and optimization for the required settings and steps.
Build and program the application.
Observe the logs from the application using the terminal emulator. For example, the log output should look like this:
*** Booting nRF Connect SDK v3.1.0-6c6e5b32496e ***
*** Using Zephyr OS v4.1.99-1612683d4010 ***
[00:00:00.123,456] <inf> aes_ctr: Starting AES CTR example...
[00:00:00.123,489] <inf> aes_ctr: Generating random AES key...
[00:00:00.123,512] <inf> aes_ctr: AES key generated successfully!
[00:00:00.123,545] <inf> aes_ctr: Encrypting using the AES CTR mode...
[00:00:00.123,567] <inf> aes_ctr: Encryption successful!
[00:00:00.123,589] <inf> aes_ctr: ---- IV (len: 16): ----
[00:00:00.123,611] <inf> aes_ctr: Content:
01 02 03 04 05 06 07 08 09 0a 0b 0c 0d 0e 0f 10 |................
[00:00:00.123,633] <inf> aes_ctr: ---- IV end ----
[00:00:00.123,655] <inf> aes_ctr: ---- Encrypted text (len: 56): ----
[00:00:00.123,677] <inf> aes_ctr: Content:
5e 3a a2 c6 2f 8d 57 89 3c 90 1e a0 b2 d5 6c 48 |^:../.W.<.....lH
d8 61 aa 35 4b da 09 83 a4 f6 18 e3 0b dd 92 0c |.a.5K...........
7b 61 95 44 09 64 ea ef ad b8 72 59 65 4f 6a 7c |{a.D.d....rYeOj|
7f 81 f4 2a 3b 9d 3e 66 42 e5 db 87 4c 16 |...*;..fB...L.
[00:00:00.123,699] <inf> aes_ctr: ---- Encrypted text end ----
[00:00:00.123,721] <inf> aes_ctr: Decrypting using the AES CTR mode...
[00:00:00.123,743] <inf> aes_ctr: ---- Decrypted text (len: 56): ----
[00:00:00.123,765] <inf> aes_ctr: Content:
Example string to demonstrate basic usage of AES CTR mode.
[00:00:00.123,787] <inf> aes_ctr: ---- Decrypted text end ----
[00:00:00.123,809] <inf> aes_ctr: Decryption successful!
[00:00:00.123,831] <inf> aes_ctr: Example finished successfully!