Encryption in rfWSN example cc1310

Hi Sebastian,

you usually encrypt only the payload and create an encrypted fingerprint of the header (message authentication code, MAC). I suggest to use CBC-MAC + AES. Here is an excerpt from the Crypto driver documentation that will be part of the next TI-RTOS release:

CryptoCC26XX AES-CCM Transaction.

The Counter with CBC-MAC (CCM) mode of operation is a generic authenticated
encryption block cipher mode. It can be used with any 128-bit block cipher.
AES-CCM combines CBC-MAC with an AES block cipher.

AES-CCM encryption has the following inputs and outputs:
Encryption                 | Decryption
--------------------------------------------------------
                         Input
--------------------------------------------------------
Shared AES key             | Shared AES key
Nonce                      | Nonce
Cleartext                  | Ciphertext (encrypted cleartext + MAC)
AAD (optional)             | AAD (optional)
--------------------------------------------------------
                         Output
-------------------------------------------------------- 
Ciphertext                 | 
(encrypted cleatext + MAC) | Cleatext

The AES key is a shared secret between the two parties and has a length of 128
Bit. The key is stored in a dedicated RAM of the AES hardware unit before the
crypto operation.

The nonce is generated by the party performing the authenticated encryption
operation. Within the scope of any authenticated encryption key, the nonce
value must be unique. That is, the set of nonce values used with any given key
must not contain any duplicate values. Using the same nonce for two different
messages encrypted with the same key destroys the security properties.

The optional AAD is authenticated, but not encrypted. Thus, the AAD is not
included in the AES-CCM output. It can be used to authenticate packet headers
for transport layer security.

After the encryption operation, the ciphertext contains the encrypted data and
the message authentication code (MAC). The MAC can be seen as an encrypted
fingerprint of the message header and content.

AES-CCM works in both ways: encryption and decryption. When a message is
decrypted, then ciphertext, AAD, nonce and MAC are used as inputs while the
output comprises the cleatext only. The decryption operation is successful,
when the received ciphertext, the nonce and the AAD can reproduce the
containing MAC.

The CryptoCC26XX_AESCCM_Transaction structure defines all necessary parameters
for a AES-CCM transaction.

#include <ti/drivers/crypto/CryptoCC26XX.h>

#define macLength           (4)
#define clearTextLength     (16)
#define cipherTextLength    (macLength + clearTextLength)
#define nonceLength         (12)
#define hdrLength           (14)

// Holds the AES-CCM setup for this example
typedef struct
{
    uint8_t key[16];                                // A 128 Bit AES key
    CryptoCC26XX_KeyLocation keyLocation;           // One of 8 key locations in the hardware
    uint8_t clearAndCipherText[cipherTextLength];   // Holds the cleartext before, and the ciphertext
                                                    // after the encryption operation.
                                                    // Ciphertext = encrypted text + message authentication code (MAC).
    uint8_t nonce[nonceLength];                     // A value that is used only once (cryptographic term 'nonce')
    uint8_t header[hdrLength];                   // A header that is not encrypted but is authenticated in the operation.
} AesCcmExample;

AesCcmExample ccmSetup =
{
    .key = { 0x2B, 0x7E, 0x15, 0x16, 0x28, 0xAE, 0xD2, 0xA6,
             0xAB, 0xF7, 0x15, 0x88, 0x09, 0xCF, 0x4F, 0x3C },
    .keyLocation = CRYPTOCC26XX_KEY_0,
    .clearAndCipherText = { 't','h','i','s','i','s','a','p','l','a','i','n','t','e','x','t','0','0','0','0' },
    .nonce  = { 't','h','i','s','i','s','a','n','o','n','c','e' },
    .header = { 't','h','i','s','i','s','a','h','e','a','d','e','r','1' }
};

CryptoCC26XX_Handle             handle;
int32_t                         keyIndex;
CryptoCC26XX_AESCCM_Transaction trans;
int32_t                         status;

// Initialize Crypto driver structures
CryptoCC26XX_init();

// Open the crypto hardware with non-exclusive access and default parameters.
handle = CryptoCC26XX_open(Board_CRYPTO, false, NULL);
if (handle == NULL) {
    System_abort("CryptoCC26XX did not open");
}

// Allocate a key storage location in the hardware
keyIndex = CryptoCC26XX_allocateKey(handle, ccmSetup.keyLocation, (const uint32_t *) ccmSetup.key);
if (keyIndex == CRYPTOCC26XX_STATUS_ERROR) {
    System_abort("Key Location was not allocated.");
}

// Encrypt and authenticate the message
CryptoCC26XX_Transac_init((CryptoCC26XX_Transaction *) &trans, CRYPTOCC26XX_OP_AES_CCM);
trans.keyIndex   = keyIndex;
trans.authLength = macLength;
trans.nonce  = (char *) ccmSetup.nonce;
trans.header = (char *) ccmSetup.header;
trans.fieldLength  = 3;
trans.msgInLength  = clearTextLength;
trans.headerLength = hdrLength;
trans.msgIn  = (char *) &(ccmSetup.clearAndCipherText[0]);                // Message is encrypted in place
trans.msgOut = (char *) &(ccmSetup.clearAndCipherText[clearTextLength]);  // MAC will be written to this position
status = CryptoCC26XX_transact(handle, (CryptoCC26XX_Transaction *) &trans);
if (status != CRYPTOCC26XX_STATUS_SUCCESS) {
    System_abort("Encryption and signing failed.");
}

// Decrypt and authenticate message
CryptoCC26XX_Transac_init((CryptoCC26XX_Transaction *) &trans, CRYPTOCC26XX_OP_AES_CCMINV);
trans.keyIndex   = keyIndex;
trans.authLength = macLength;
trans.nonce  = (char *) ccmSetup.nonce;
trans.header = (char *) ccmSetup.header;
trans.fieldLength  = 3;
trans.msgInLength  = cipherTextLength;
trans.headerLength = hdrLength;
trans.msgIn  = (char *) &(ccmSetup.clearAndCipherText[0]);                // Message is decrypted in place
trans.msgOut = (char *) &(ccmSetup.clearAndCipherText[clearTextLength]);  // Points to the MAC, is used as input here

// Do AES-CCM decryption and authentication
status = CryptoCC26XX_transact(handle, (CryptoCC26XX_Transaction *) &trans);
if(status != CRYPTOCC26XX_STATUS_SUCCESS){
    System_abort("Decryption and authentication failed.");
}

// Release the key location
status = CryptoCC26XX_releaseKey(handle, &keyIndex);
if (status != CRYPTOCC26XX_STATUS_SUCCESS) {
    System_abort("Key release was not successful.");
}