# LCP-DARE overview

LCP-DARE encrypts and integrity-protects DDR memory regions on Snapdragon^®^ X2 Linux Mobile PC platforms through a Last Level Cache Controller (LLCC) co-processor.

LCP is an LLCC co-processor that encrypts data sent to the memory controller (MC) and performs error detection and correction on data received from the MC. LCP-DARE consolidates the earlier pseudo internal memory (pIMEM) functionality into the LLCC co-processor and adds DARE protection. It replaces pIMEM and supports up to
approximately 512 MB of memory; with DRAM encryption (DE) or DRAM authentication encryption (DAE) configurations, you can protect more than 512 MB of DDR memory.

LCP-DARE addresses security use cases that need more than 64 MB of protected memory, which pIMEM can’t cover. It also lets original equipment manufacturers (OEMs) configure DDR memory with DE, DAE, or DARE protection based on their security requirements.

## LCP-DARE features

LCP-DARE provides selectable protection modes, per-region keys, and hardware-accelerated cryptography. Use these features to match the protection level to each memory region and to keep keys isolated per region and per boot.

You can configure each LCP DRAM region with one of the following security configurations:

- **DARE** – DRAM authentication replay-protection encryption
- **DAE** – DRAM authentication encryption
- **DE** – DRAM encryption
- **Plain DDR** – unprotected DDR memory

LCP-DARE uses separate algorithms for authentication, replay-protection, and encryption. Each region has its own key, configuration, and metadata, and keys are unique per boot and configured by secure exception level 3 (EL3) software.

The following table lists the cryptographic algorithm LCP-DARE uses for each protection function.

LCP-DARE protection algorithms

| Function | Algorithm |
| --- | --- |
| Authentication | SHA-3 (reduced to 12 rounds) |
| Replay-protection | Bonzai Merkle tree |
| Encryption | QARMA7-64 |

## pIMEM and LCP-DARE comparison

Compare pIMEM and LCP-DARE to choose the right protection for a region and to understand the runtime constraints of each. The comparison covers hardware security features, capacity, region limits, key handling, latency, window configuration, and the software that initializes each feature.

The following table compares the hardware and software characteristics of integrated circuit memory (ICMEM) pIMEM and LCP-DARE.

pIMEM and LCP-DARE comparison

| Category | Characteristic | Integrated circuit memory (ICMEM) pIMEM | LCP-DARE |
| --- | --- | --- | --- |
| Hardware | Security features | Authentication (SipHash 2-4), replay-protection (Bonzai Merkel<br>tree), encryption (PRINCE) | Authentication (SHA-3), replay-protection (Bonzai Merkel tree),<br>encryption (QARMA7-64) |
| Hardware | Maximum size | 64 MB | 512 MB |
| Hardware | Maximum configurable windows or regions | 4 | 32 |
| Hardware | Encryption key and metadata | Common for all regions | Separate for each region |
| Hardware | Latency | High | Low |
| Hardware | Window configuration | Static and dynamic (supports runtime window size increase or<br>decrease) | Static (set once at boot; region configuration and sizes can’t<br>change at runtime) |
| Software | Initialization driver | XBL\_SC (TrustZone) | XBL\_SC |
| Software | Intended software images | TrustZone and trusted applications | TrustZone, XBL\_SC, and CPUCP; OEM-configurable for TAs |

Last Published: Sep 08, 2026

[Previous Topic
LCP-DARE and debugging documentation](https://docs.qualcomm.com/bundle/publicresource/80-A0399-49/topics/snapdragon-x2-linux-mobile-pc-lcp-dare-debugging-home-page.md) [Next Topic
Get started with LCP-DARE configuration](https://docs.qualcomm.com/bundle/publicresource/80-A0399-49/topics/get-started-with-lcp-dare-configuration.md)