Dev & Engineering ✓ NVIDIA · Official docaaes-gcmbluefield-dpuconnectxauthenticated-encryptionc-apihardware-acceleration

DOCA AES-GCM Acceleration

Configure, validate, and debug DOCA AES-GCM offload on BlueField DPUs and ConnectX NICs.

FollowSkills review · FSRS-2.0
Not recommended
57/ 100 5-point scale 2.9 / 5
Trust19 / 25 · 3.8/5

The documentation clearly scopes DOCA AES-GCM, requires minimal mmap permissions, user confirmation, no key logging or committing, poisoned-output handling after tag failure, and a limited context-destruction rollback path. Deductions apply because command execution, hardware access, logging, and external effects lack one unified permission-confirmation and recovery model; the prompt also reports NOASSERTION license metadata that conflicts with file-level declarations. NVIDIA provenance is governance evidence only and earns no brand-based points.

Reliability8 / 20 · 2.0/5

SKILL.md, CAPABILITIES.md, and TASKS.md provide a largely coherent lifecycle, capability-discovery, error-taxonomy, progress-engine, and failure-handling workflow. Deductions apply because this is a static review with no executed key-path reproduction; the benchmark dataset is unavailable, so its results cannot be verified, and hardware/API claims lack committed reproducible test coverage. Static calibration limits this score to 10 or below.

Adaptability12 / 15 · 4.0/5

The audience, trigger phrases, in-scope encryption/decryption scenarios, non-fit boundaries, and routing relationships are clearly described, including C/C++ and FFI consumers. Deductions apply because there is no Chinese-language guidance or localized example, and use requires an installed DOCA SDK, BlueField/ConnectX hardware, and a local installation; mainland-China reachability is only weakly addressed, although the core function does not entirely depend on overseas services.

Convention8 / 15 · 2.7/5

Information architecture, loading order, companion files, related skills, scope boundaries, and issue contacts are reasonably clear, and SKILL.md explicitly declares Apache-2.0. Deductions apply because BENCHMARK.md records missing Instructions, Examples, Author, and schema-conformance findings; version, signature, and scan fields remain TBD in SKILLCARD.yaml, while source-path, license, and maintenance metadata are inconsistent.

Effectiveness6 / 15 · 2.0/5

The skill directly guides capability probing, buffer sizing, mmap permissions, AEAD tag validation, and layered error diagnosis, so its core value is clear. Deductions apply because it intentionally ships no runnable source, build manifest, or test-vector bank, and the modification workflow depends on a future renderer, leaving substantial user-side work; static materials also do not verify representative usable outputs. Static calibration limits this score to 7 or below.

Verifiability4 / 10 · 2.0/5

The files contain auditable API names, commands, cross-references, and testing procedures, and BENCHMARK.md supplies an evaluation summary. Deductions apply because no committed test suite or CI coverage for key paths is shown, the evaluation dataset is unavailable, and SKILLCARD signing and scan fields are TBD, preventing independent reproduction. Static calibration limits this score to 5 or below.

Evidence confidence:Low Reviewed Jul 20, 2026 Reviewed revision 55f18499943e
The upstream repository has new commits since this review. The score still applies to the reviewed revision shown and may not cover the latest changes.
Before you use it
  • Do not treat the PASS verdict or benchmark percentages as independently verified execution evidence; the evaluation dataset is not supplied.
  • Before use, verify the installed DOCA version, device capabilities, public headers, and API semantics; the files alone do not establish all hardware/API claims.
  • Resolve the metadata inconsistencies among NOASSERTION, Apache-2.0, Apache-2.0 AND CC-BY-4.0, and the TBD signature/version fields.
  • For mainland-China users, confirm network reachability of the DOCA SDK, documentation, and any required mirrors or services in advance.
Review evidence [1][2][3][4][5][6][7][8][9]
See the full review method →

What does this skill do, and when should you use it?

This skill guides external developers using the NVIDIA DOCA AES-GCM library from C, C++, or FFI-based languages. It covers task configuration, runtime capability discovery, mmap permissions, buffer sizing, test-vector validation, completion handling, and layered error diagnosis. The library surface supports AES-128-GCM and AES-256-GCM, not AES-192-GCM. It assumes DOCA is already installed and does not cover installation or key management.

It guides the agent to inspect the DOCA installation under /opt/mellanox/doca, check the doca-aes-gcm pkg-config module, configure doca_aes_gcm_task_encrypt and doca_aes_gcm_task_decrypt, query task support, key-type support, and maximum buffer size, set source and destination mmap permissions, validate round trips with NIST GCMVS or RFC 5288 vectors, and diagnose DOCA_ERROR_* results including security-critical tag-verification failures. It also provides configure, build, modify, run, test, and debug workflows and routes out-of-scope questions to related DOCA skills.

  1. A C or C++ developer building AES-GCM offload applications on a BlueField DPU or ConnectX accelerator.
  2. An engineer checking whether the active device supports AES-128-GCM, AES-256-GCM, and the required encrypt or decrypt task.
  3. A developer investigating DOCA_ERROR_NOT_PERMITTED, oversized input, decrypt IO_FAILED, or authentication-tag failures.
  4. A team validating an accelerator implementation against a published NIST GCMVS or RFC 5288 test vector before processing production data.
  5. A Rust, Go, or Python developer wrapping the DOCA AES-GCM C ABI through FFI or language-specific bindings.

What are this skill's strengths and limitations?

Pros
  • Covers the workflow from capability discovery through completion handling and layered debugging.
  • Clearly distinguishes AES-128, AES-256, and unsupported AES-192 at the runtime capability boundary.
  • Treats authentication-tag failure as a security-critical result with an explicit plaintext-safety rule.
  • Applies to C/C++ and other languages using the same public C ABI through FFI.
Limitations
  • Requires an existing DOCA SDK, supported Linux environment, and BlueField DPU or ConnectX NIC.
  • Does not ship application source code, test vectors, keys, build manifests, or bindings.
  • Does not cover DOCA installation, key management, non-GCM AES modes, SHA, or general AEAD background.
  • The supplied material provides no independent test suite or evidence for specific hardware-model coverage.

How do you install this skill?

Install the individual skill with the NVIDIA skills CLI: npx skills add nvidia/skills --skill doca-aes-gcm --yes. This installs the agent skill, not the DOCA SDK; the source does not document DOCA SDK installation steps. The runtime still requires the stated DOCA, Linux, device, and pkg-config prerequisites.

How do you use this skill?

Give the agent a concrete DOCA AES-GCM task, such as: "Configure doca_aes_gcm_task_decrypt on this BlueField, check AES-256 support and mmap permissions, and handle authentication-tag failures safely." For configure, build, modify, run, test, or debug work, the skill routes to TASKS.md. For capability, limitation, or safety questions, it routes to CAPABILITIES.md. Never consume plaintext from a decrypt task whose authentication tag did not verify.

How does this skill compare with similar options?

For non-GCM AES modes such as CBC, CTR, or XTS, the skill directs users to CPU OpenSSL. Key management belongs to the user's KMS, HSM, or other secure process. SHA acceleration belongs to a separate DOCA skill such as doca-sha.

FAQ

Does it support AES-192-GCM?
No. The library exposes only DOCA_AES_GCM_KEY_128 and DOCA_AES_GCM_KEY_256. AES-192-GCM should be handled with a CPU library.
Can I use plaintext after decrypt authentication fails?
No. A tag mismatch indicates tampering or corruption, so the plaintext output of that task must be treated as poisoned.
Does this skill install DOCA or create keys?
No. It assumes DOCA is installed and does not generate, store, rotate, or distribute AES-GCM keys.
Can it help with Python, Go, or Rust?
Yes, for lifecycle, capability, permission, error, and AEAD guidance through FFI or bindings. It does not provide ready-made bindings, and the C ABI remains authoritative.

More skills from this repository

All from NVIDIA/skills

Dev & Engineering ✓ NVIDIA · Official

DOCA SHA Acceleration

Guidance for offloading SHA hashing to NVIDIA BlueField and ConnectX hardware.

Dev & Engineering ✓ NVIDIA · Official

DOCA Erasure Coding Development Skill

Guides hands-on DOCA Reed-Solomon resilience development and debugging on NVIDIA hardware.

Dev & Engineering ✓ NVIDIA · Official

DOCA Compress Hardware Offload

Guides hands-on DEFLATE and LZ4 decompression development and debugging on BlueField and ConnectX platforms.

Dev & Engineering ✓ NVIDIA · Official

DOCA Arg Parser CLI

Guides developers in building and debugging standard CLIs for DOCA applications.

Dev & Engineering ✓ NVIDIA · Official

DOCA DMA Development Guide

Guides hands-on DOCA DMA memory-copy development on BlueField and ConnectX systems.

Dev & Engineering ✓ NVIDIA · Official

DOCA Flow Tune

Guides engineers through snapshotting, analyzing, and optimizing live or captured DOCA Flow pipelines.

Dev & Engineering ✓ NVIDIA · Official

DOCA Device Management Development Skill

Programmatically manage BlueField and ConnectX state through the DOCA C API.

Dev & Engineering ✓ NVIDIA · Official

DOCA SHA OpenSSL Offload Engine

Adds DOCA SHA hardware acceleration to existing OpenSSL pipelines without rewriting the application around the doca-sha C API.

Dev & Engineering ✓ NVIDIA · Official

DOCA Telemetry Exporter Development

Guides DOCA applications in defining, emitting, and debugging structured telemetry for external consumers.

Dev & Engineering ✓ NVIDIA · Official

DOCA GPI GPU-Initiated RDMA Skill

Helps CUDA kernels drive RDMA queues directly from GPU memory without host-CPU mediation.

Dev & Engineering ✓ NVIDIA · Official

DOCA Rivermax Receive Development

Guides developers through building, validating, and debugging DOCA Rivermax receive applications for real-time network streams.

Automation & Ops ✓ NVIDIA · Official

DOCA Capabilities Inspector

Inspect what DOCA can see on a host through a read-only device and capability CLI.

Automation & Ops ✓ NVIDIA · Official

DOCA PCC Diagnostic Counters

Read fixed firmware and hardware PCC congestion diagnostics on ConnectX and BlueField devices.

Automation & Ops ✓ NVIDIA · Official

DOCA Socket Relay

Bridge an existing socket application to a BlueField DPU without rewriting it

Dev & Engineering ✓ NVIDIA · Official

DOCA Device Emulation Development

Guides developers in building custom PCIe devices on BlueField whose backend runs on the DPU and is visible to the host.

Dev & Engineering ✓ NVIDIA · Official

DOCA Hardware Telemetry Counter Reader

Guides developers in reading per-domain hardware counters from BlueField and ConnectX devices.

Dev & Engineering ✓ NVIDIA · Official

DOCA Common Foundation

A shared programming foundation for DOCA applications on BlueField and ConnectX.

Dev & Engineering ✓ NVIDIA · Official

DOCA Ethernet Queue Development

Develop and debug DOCA Ethernet RX/TX queues on BlueField DPUs and ConnectX NICs.

Dev & Engineering ✓ NVIDIA · Official

DOCA PCC Custom Congestion Control

Guides host-side loading and troubleshooting of custom PCC algorithms on BlueField

Dev & Engineering ✓ NVIDIA · Official

DOCA RDMA Programming Guide

Helps developers build, configure, and debug DOCA RDMA applications on BlueField, ConnectX, and DOCA hosts.

Related skills