Guides agents through DOCA AES-GCM hardware-accelerated encryption and decryption on BlueField DPUs.
npx skills add https://github.com/NVIDIA/skills --skill doca-aes-gcm
Please help me install this Agent Skill. Skill: doca-aes-gcm Source: https://github.com/NVIDIA/skills/tree/main/skills/doca-aes-gcm Command: npx skills add https://github.com/NVIDIA/skills --skill doca-aes-gcm
Developers offloading AES-GCM authenticated encryption to BlueField DPU or ConnectX accelerators face a complex API surface: capability queries, mmap permission flags, key-size constraints, and security-critical tag-verification handling. This Skill teaches AI agents the correct DOCA AES-GCM workflows so they avoid common failures like inventing AES-192 support, skipping capability checks, or consuming plaintext after a failed tag verification.
doca_aes_gcm_cap_* functions to verify task-type support, per-key-type support (only DOCA_AES_GCM_KEY_128 and _256), and maximum plaintext buffer size before configuring anything.DOCA_ERROR_* codes to AES-GCM root causes and treats decrypt tag-verification failure as a tampering signal whose plaintext output must never be consumed.Ask your agent to help configure doca_aes_gcm_task_encrypt on your BlueField, including checking which key sizes the device supports and setting the correct mmap permissions.
High-intent search queries and answers about installing and using this skill.
Configure a doca_aes_gcm context by enabling doca_aes_gcm_task_encrypt and/or doca_aes_gcm_task_decrypt before doca_ctx_start, then set source mmap permissions to DOCA_ACCESS_FLAG_LOCAL_READ_ONLY and destination to LOCAL_READ_WRITE. Validate with a published NIST or RFC 5288 test vector before submitting bulk data.
No, the DOCA AES-GCM library only exposes DOCA_AES_GCM_KEY_128 and DOCA_AES_GCM_KEY_256 in its enum; AES-192-GCM is not expressible at all. For the two supported key types, confirm per-device support with doca_aes_gcm_cap_task_encrypt_is_key_type_supported before sizing key material.
Use doca-aes-gcm when input is bulk (a few KiB or more per record), sustained, or already pinned in doca_mmap memory, such as line-rate TLS record encryption. For tiny one-shot messages or non-GCM modes like CBC, CTR, or XTS, CPU with OpenSSL is the right answer.
An IO_FAILED-class error on a decrypt completion means auth tag verification failed, indicating the ciphertext was tampered with or corrupted. The plaintext output is poisoned and must not be consumed; do not silently retry, and route to your application-layer policy for tampered input.
NOT_PERMITTED on first submission means the mmap permissions are wrong: the source buffer needs at least DOCA_ACCESS_FLAG_LOCAL_READ_ONLY and the destination needs DOCA_ACCESS_FLAG_LOCAL_READ_WRITE. Both permissions must be set before the first task submission.
The library covers only AES-GCM (no CBC, CTR, or XTS), only 128-bit and 256-bit keys, and does not auto-fragment inputs larger than the per-device max buffer size. Key management such as generation, rotation, and HSM integration is out of scope and belongs to your KMS.
NVIDIAConfigure and troubleshoot NVIDIA networking deployments on Kubernetes.
joelhooksEncrypts agent records with AES-GCM and wraps DEKs using X25519 public keys via Web Crypto.
pax-kConverts user requests into executable engineering specifications with goals and acceptance criteria.
igbuendIdentifies weak encryption algorithms, insecure modes, and improper nonce/IV usage in code.