nRF7002 stream cipher

The data transactions between the master and the slave can be protected using stream cipher encryption. Encryption can be configured and enabled with the CIPHER_INIT command.

The following figure shows the stream cipher block with the configuration inputs. The stream cipher uses an AES 128 encryption operation to form the keystream from key, nonce, and external memory address. The keystream then combines each 32-bit plaintext digit one at a time with the corresponding digit of the keystream.

The same nonce and key must be used for both encryption and decryption of the same memory address. Stream ciphers are symmetric. They do not differentiate between encrypting or decrypting, reading or writing.

Figure 1. Stream cipher

Table 1. Stream cipher configuration
Stream cipher	Value
ENC.KEY [127:0]	{CIPHER_KEY3[31:0], CIPHER_KEY2[31:0], CIPHER_KEY1[31:0], CIPHER_KEY0[31:0]}
ENC.NONCE [95:0]	{NONCE_CNT[31:0], NONCE_CFG[31:0], CIPHER_NONCE0[31:0]}
ADRESS IN [31:0]	{8’h00, SPI Address [23:0]}
ENC.ENABLE	CIPHER ENABLE
Notes: CIPHER_KEY3, CIPHER_KEY2, CIPHER_KEY1, CIPHER_KEY0, CIPHER_NONCE0 : IP parameters (32 bit). NONCE_CFG : The NONCE Configuration register. Initialized with the CIPHER_INIT command. NONCE_CNT: The NONCE Counter register. Initialized to d0 with the CIPHER_INIT command. A pre-increment is done to the NONCE_CNT register at the start of the QSPI transaction (FAST_READ, READ4, PP, PP4). Single read/write mode : increment always. Multiple read/write mode : increment only if the received SPI address differs from the next expected SPI address (last SPI address +1) or if the last transaction was not in multiple mode. CIPHER ENABLE : The Cipher Enable register is 1’b0 by default and it is set to 1’b1 with the CIPHER_INIT command.