Module saes 

Secure Advanced Encryption Standard (SAES) hardware accelerator

SAES provides the same cipher modes as AES but with enhanced security features for key management and protection. It’s particularly useful in secure boot scenarios and applications requiring hardware root of trust.

Key Differences from AES

Feature	AES	SAES
Key Sources	Software only	Software + Hardware (DHUK, BHK)
Key Protection	Basic	KEYPROT + isolation
Key Sharing	No	Yes (with AES, other peripherals)
Key Wrapping	No	Yes (wrapped/encrypted keys)
Security Context	Standard	Enhanced/Secure

Hardware Key Sources

• DHUK (Derived Hardware Unique Key): Device-unique key derived from UID
• BHK (Boot Hardware Key): Key loaded during secure boot
• XOR: XOR combination of DHUK and BHK

These keys are never exposed to software and remain in secure hardware.

Examples

Using Software Keys (Same as AES)

use embassy_stm32::saes::{Saes, AesGcm, Direction};

let key = [0u8; 16];
let iv = [0u8; 12];
let cipher = AesGcm::new(&key, &iv);

let mut saes = Saes::new_blocking(p.SAES, Irqs);
let mut ctx = saes.start(&cipher, Direction::Encrypt);
// ... same as AES

Using Hardware-Derived Keys

use embassy_stm32::saes::{Saes, AesGcm, Direction, HardwareKeySource};

let iv = [0u8; 12];
let cipher = AesGcm::new(&[], &iv); // No software key needed

let mut saes = Saes::new_blocking(p.SAES, Irqs);

// Use device-unique hardware key
let mut ctx = saes.start_with_hw_key(
    HardwareKeySource::DHUK,
    &cipher,
    Direction::Encrypt
);

// Hardware key is used automatically - never exposed to software
saes.payload_blocking(&mut ctx, &plaintext, &mut ciphertext, true);
saes.finish_blocking(ctx);

Key Sharing Between Peripherals

use embassy_stm32::saes::{Saes, KeyShareTarget};

// After unwrapping a key with SAES, share it with AES peripheral
saes.share_key_with(KeyShareTarget::AES);
// Now AES peripheral can use the unwrapped key

Security Features

• Key Protection: KEYPROT flag prevents key readback
• Hardware Keys: Never exposed to software, immune to memory dumps
• Key Wrapping: Import encrypted keys securely
• Peripheral Isolation: Keys can be shared without software access

Hardware revisions

• saes_v1a (STM32H5, WBA5x/WBA6x, C5): ECB, CBC, CTR, GCM, GMAC and CCM.
• saes_v1b (STM32U3, U5): ECB and CBC only. CTR is accepted by the hardware but behaves as ECB, and the authenticated modes do not exist, so start panics if given anything else.
• saes_n6 (STM32N6).

RNG dependency

The SAES fetches random numbers from the RNG for its countermeasures every time it is reset or its key size changes, and never leaves its busy state if the RNG is not running: create an Rng before the Saes and keep it alive. On STM32WBA6 and C5 the constructors take it as a parameter.

On STM32U5 the SAES also runs off a kernel clock of its own, the SHSI oscillator, which the driver turns on. Stop mode turns it off again, so a Saes must not be used across a stop.

embassy-crypto

With the embassy-crypto-saes feature, the SAES serves the embassy-crypto-aes* operations instead of the AES peripheral. See aes.

See Also

• aes - Standard AES implementation
• pka - Public Key Accelerator

Structs

AesCbc

AES-CBC Cipher Mode

AesCcm

AES-CCM Cipher Mode (Counter with CBC-MAC)

AesCtr

AES-CTR Cipher Mode

AesEcb

AES-ECB Cipher Mode

AesGcm

AES-GCM Cipher Mode

AesGmac

AES-GMAC Cipher Mode (Galois Message Authentication Code)

Context

Stores the state of the AES peripheral for a cipher operation.

InterruptHandler

SAES interrupt handler.

Saes

SAES driver.

Enums

Direction

AES cipher direction

Error

AES error

HardwareKeySource

Hardware key source for SAES

KeyMode

Key mode for SAES

KeyShareTarget

Peripheral to share key with

KeySize

AES key size

Traits

Cipher

This trait encapsulates all cipher-specific behavior.

CipherAuthenticated

This trait enables restriction of a header phase to authenticated ciphers only.

CipherSized

This trait enables restriction of ciphers to specific key sizes.

DmaIn

DmaIn DMA request trait

DmaOut

DmaOut DMA request trait

IVSized

This trait enables restriction of initialization vectors to sizes compatible with a cipher mode.

Instance

SAES instance trait.