Agent skill · software engineering · nvidia
doca-aes-gcm
Use this skill when the user is doing hands-on DOCA AES-GCM work on a BlueField DPU or ConnectX NIC — configuring `doca_aes_gcm_task_encrypt` / `_task_decrypt`, querying `doca_aes_gcm_cap_*` for per-key-type (only `DOCA_AES_GCM_KEY_128` / `_256` — AES-192 not supported) and per-task support, sizing plaintext against the max-buf cap, setting source / destination mmap permissions, validating with a NIST GCMVS or RFC 5288 vector, or debugging DOCA_ERROR_* including the security-critical tag-verification-failed outcome on decrypt. Trigger even when the user does not explicitly mention "DOCA AES-GCM" or "AEAD" — typical implicit phrasings: "decrypt completion IO_FAILED", "auth tag isn't verifying", "NOT_PERMITTED on my encrypt buffer", "is AES-192-GCM on this BlueField" (no), or "encrypted record came back tampered". Refuse and route elsewhere for non-GCM AES modes (CBC / CTR / XTS — CPU OpenSSL), key management (KMS / HSM / rotation), SHA (doca-sha), or general AEAD background.
Why this skill is useful
Adds specific commands and configurations for AES-GCM on DOCA that are not widely known or documented.
What it needs
Requires doca installed locally. About 10k tokens when loaded. Last updated 2026-08-07. 2,816 stars on the source repository.
What this skill does
DOCA AES-GCM Examples "Auth tag isn't verifying on decrypt." — this is in scope. Treat tag-verification-failed as a security outcome, not a retryable size error. "Is AES-192-GCM on this BlueField?" — no. Only key-128 and key-256 exist; do not invent AES-192 or CBC/CTR offload. Instructions Follow Loading order below. Open the tasks companion for configure / test / debug. Open the capabilities companion for key types and the AEAD safety note. Do not open every companion file. Where to start: This skill assumes DOCA is already installed and the user is doing hands-on AES-GCM-acceleration work on a BlueField / ConnectX / host with DOCA. Open the tasks companion if the user wants to do something (configure / build / modify / run / test / debug); open the capabilities companion when the question is what can DOCA AES-GCM express on this version. If the user has not installed DOCA yet, route to doca-setup/SKILL.md first. If the user is asking "should I even use the accelerator for this encryption?", the path-selection rule in Capabilities and modes is the first stop. If the user is treating AES-GCM as a confidentiality-only primitive (raw AES-CTR / AES-CBC style), stop and read the AEAD note in ## Safety policy first — AES-GCM is authenticated encryption, and confusing the two is the most expensive failure mode this skill exists to prevent. Example questions this skill answers well The CLASSES of DOCA AES-GCM questions this skill is built to answer, each with one worked example. The agent should treat the class as the load-bearing piece — the worked example is a single instance. "Should I offload this AES-GCM encryption to DOCA AES-GCM, or just do it on the CPU with OpenSSL?" — worked example: "I am encrypting 4 KiB TLS records at line rate; is doca-aes-gcm worth the setup vs OpenSSL EVPaes256gcm on the CPU?". Answered by the path-selection table in Capabilities and modes the "when NOT to use doca-aes-gcm" bullets in Safety policy. …
How to use it
Reference it in AdaL, Claude Code, Cursor or any coding agent — nothing to install:
@skills nvidia/doca-aes-gcm