What does this skill do, and when should you use it?
This skill guides external developers using the NVIDIA DOCA AES-GCM library from C, C++, or FFI-based languages. It covers task configuration, runtime capability discovery, mmap permissions, buffer sizing, test-vector validation, completion handling, and layered error diagnosis. The library surface supports AES-128-GCM and AES-256-GCM, not AES-192-GCM. It assumes DOCA is already installed and does not cover installation or key management.
It guides the agent to inspect the DOCA installation under /opt/mellanox/doca, check the doca-aes-gcm pkg-config module, configure doca_aes_gcm_task_encrypt and doca_aes_gcm_task_decrypt, query task support, key-type support, and maximum buffer size, set source and destination mmap permissions, validate round trips with NIST GCMVS or RFC 5288 vectors, and diagnose DOCA_ERROR_* results including security-critical tag-verification failures. It also provides configure, build, modify, run, test, and debug workflows and routes out-of-scope questions to related DOCA skills.
- A C or C++ developer building AES-GCM offload applications on a BlueField DPU or ConnectX accelerator.
- An engineer checking whether the active device supports AES-128-GCM, AES-256-GCM, and the required encrypt or decrypt task.
- A developer investigating DOCA_ERROR_NOT_PERMITTED, oversized input, decrypt IO_FAILED, or authentication-tag failures.
- A team validating an accelerator implementation against a published NIST GCMVS or RFC 5288 test vector before processing production data.
- A Rust, Go, or Python developer wrapping the DOCA AES-GCM C ABI through FFI or language-specific bindings.
How do you install this skill?
- Do not treat the PASS verdict or benchmark percentages as independently verified execution evidence; the evaluation dataset is not supplied.
- Before use, verify the installed DOCA version, device capabilities, public headers, and API semantics; the files alone do not establish all hardware/API claims.
- Resolve the metadata inconsistencies among NOASSERTION, Apache-2.0, Apache-2.0 AND CC-BY-4.0, and the TBD signature/version fields.
- For mainland-China users, confirm network reachability of the DOCA SDK, documentation, and any required mirrors or services in advance.
- Shell / CLI
- Network access
- Local filesystem
DOCA SDK installed at /opt/mellanox/docaLinuxBlueField DPU or ConnectX NICUbuntu 22.04/24.04 or RHEL/SLESpkg-config module doca-aes-gcm
Install the individual skill with the NVIDIA skills CLI: npx skills add nvidia/skills --skill doca-aes-gcm --yes. This installs the agent skill, not the DOCA SDK; the source does not document DOCA SDK installation steps. The runtime still requires the stated DOCA, Linux, device, and pkg-config prerequisites.
tmp="$(mktemp -d)"
git clone --depth 1 https://github.com/NVIDIA/skills.git "$tmp"
mkdir -p ~/.claude/skills
cp -R "$tmp/skills/doca-aes-gcm" ~/.claude/skills/
rm -rf "$tmp"Generated from the source repository and skill path; it copies only this skill's folder. If the author's install steps above differ, follow those first. To scope it to one project, replace ~/.claude/skills with that project's .claude/skills.
How do you use this skill?
Once installed, send your agent any of these to trigger it:
- Configure doca_aes_gcm_task_decrypt on this BlueField, check AES-256 support and mmap permissions, and handle authentication-tag failures safely.
Give the agent a concrete DOCA AES-GCM task, such as: "Configure doca_aes_gcm_task_decrypt on this BlueField, check AES-256 support and mmap permissions, and handle authentication-tag failures safely." For configure, build, modify, run, test, or debug work, the skill routes to TASKS.md. For capability, limitation, or safety questions, it routes to CAPABILITIES.md. Never consume plaintext from a decrypt task whose authentication tag did not verify.
What are this skill's strengths and limitations?
- Covers the workflow from capability discovery through completion handling and layered debugging.
- Clearly distinguishes AES-128, AES-256, and unsupported AES-192 at the runtime capability boundary.
- Treats authentication-tag failure as a security-critical result with an explicit plaintext-safety rule.
- Applies to C/C++ and other languages using the same public C ABI through FFI.
- Requires an existing DOCA SDK, supported Linux environment, and BlueField DPU or ConnectX NIC.
- Does not ship application source code, test vectors, keys, build manifests, or bindings.
- Does not cover DOCA installation, key management, non-GCM AES modes, SHA, or general AEAD background.
- The supplied material provides no independent test suite or evidence for specific hardware-model coverage.
How does this skill compare with similar options?
Side by side with related skills; every score comes from the same FSRS standard.
| Skill | FS score | Stars | Last updated | License |
|---|---|---|---|---|
| DOCA AES-GCM Acceleration this page ✓ NVIDIA · Official | 57 · Use with care | ★ 3.8k | today | Apache-2.0 |
| DOCA SHA Acceleration ✓ NVIDIA · Official | 56 · Use with care | ★ 3.8k | today | Apache-2.0 |
| DOCA Erasure Coding Development Skill ✓ NVIDIA · Official | 49 · Use with care | ★ 3.8k | today | Apache-2.0 |
| DOCA Compress Hardware Offload ✓ NVIDIA · Official | 58 · Recommended | ★ 3.8k | today | Apache-2.0 |
| DOCA Arg Parser CLI ✓ NVIDIA · Official | 55 · Use with care | ★ 3.8k | today | Apache-2.0 |
For non-GCM AES modes such as CBC, CTR, or XTS, the skill directs users to CPU OpenSSL. Key management belongs to the user's KMS, HSM, or other secure process. SHA acceleration belongs to a separate DOCA skill such as doca-sha.
How did FollowSkills review this skill?
The documentation clearly scopes DOCA AES-GCM, requires minimal mmap permissions, user confirmation, no key logging or committing, poisoned-output handling after tag failure, and a limited context-destruction rollback path. Deductions apply because command execution, hardware access, logging, and external effects lack one unified permission-confirmation and recovery model; the prompt also reports NOASSERTION license metadata that conflicts with file-level declarations. NVIDIA provenance is governance evidence only and earns no brand-based points.
SKILL.md, CAPABILITIES.md, and TASKS.md provide a largely coherent lifecycle, capability-discovery, error-taxonomy, progress-engine, and failure-handling workflow. Deductions apply because this is a static review with no executed key-path reproduction; the benchmark dataset is unavailable, so its results cannot be verified, and hardware/API claims lack committed reproducible test coverage. Static calibration limits this score to 10 or below.
The audience, trigger phrases, in-scope encryption/decryption scenarios, non-fit boundaries, and routing relationships are clearly described, including C/C++ and FFI consumers. Deductions apply because there is no Chinese-language guidance or localized example, and use requires an installed DOCA SDK, BlueField/ConnectX hardware, and a local installation; mainland-China reachability is only weakly addressed, although the core function does not entirely depend on overseas services.
Information architecture, loading order, companion files, related skills, scope boundaries, and issue contacts are reasonably clear, and SKILL.md explicitly declares Apache-2.0. Deductions apply because BENCHMARK.md records missing Instructions, Examples, Author, and schema-conformance findings; version, signature, and scan fields remain TBD in SKILLCARD.yaml, while source-path, license, and maintenance metadata are inconsistent.
The skill directly guides capability probing, buffer sizing, mmap permissions, AEAD tag validation, and layered error diagnosis, so its core value is clear. Deductions apply because it intentionally ships no runnable source, build manifest, or test-vector bank, and the modification workflow depends on a future renderer, leaving substantial user-side work; static materials also do not verify representative usable outputs. Static calibration limits this score to 7 or below.
The files contain auditable API names, commands, cross-references, and testing procedures, and BENCHMARK.md supplies an evaluation summary. Deductions apply because no committed test suite or CI coverage for key paths is shown, the evaluation dataset is unavailable, and SKILLCARD signing and scan fields are TBD, preventing independent reproduction. Static calibration limits this score to 5 or below.
Open a dimension to read why it scored that way
Evidence confidence：Low — Mostly static review, author material or a limited demo; useful for discovery, not high-risk decisions.
See the full review method →