luna - wolfssl/wolfcrypt/src/port/Renesas/renesas_fspsm

   1/* renesas_fspsm_util.c
   2 *
   3 * Copyright (C) 2006-2026 wolfSSL Inc.
   4 *
   5 * This file is part of wolfSSL.
   6 *
   7 * wolfSSL is free software; you can redistribute it and/or modify
   8 * it under the terms of the GNU General Public License as published by
   9 * the Free Software Foundation; either version 3 of the License, or
  10 * (at your option) any later version.
  11 *
  12 * wolfSSL is distributed in the hope that it will be useful,
  13 * but WITHOUT ANY WARRANTY; without even the implied warranty of
  14 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
  15 * GNU General Public License for more details.
  16 *
  17 * You should have received a copy of the GNU General Public License
  18 * along with this program; if not, write to the Free Software
  19 * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1335, USA
  20 */
  21
  22#ifdef HAVE_CONFIG_H
  23    #include <config.h>
  24#endif
  25
  26#include <wolfssl/wolfcrypt/types.h>
  27
  28#if defined(WOLFSSL_RENESAS_RSIP) || \
  29    defined(WOLFSSL_RENESAS_SCEPROTECT)
  30
  31#include <wolfssl/wolfcrypt/port/Renesas/renesas-fspsm-types.h>
  32
  33/* expect to have these variables defined at user application */
  34extern FSPSM_INSTANCE   gFSPSM_ctrl;
  35extern FSPSM_CONFIG     gFSPSM_cfg;
  36
  37#if defined(WOLFSSL_RENESAS_FSPSM)
  38
  39#include <wolfssl/wolfcrypt/wc_port.h>
  40#include <wolfssl/wolfcrypt/error-crypt.h>
  41
  42#include <wolfssl/wolfcrypt/port/Renesas/renesas_fspsm_internal.h>
  43#include <wolfssl/wolfcrypt/port/Renesas/renesas_cmn.h>
  44#include <wolfssl/wolfcrypt/memory.h>
  45#include <wolfssl/wolfcrypt/error-crypt.h>
  46#include <wolfssl/wolfcrypt/aes.h>
  47#include <wolfssl/ssl.h>
  48#include <wolfssl/internal.h>
  49#ifdef NO_INLINE
  50    #include <wolfssl/wolfcrypt/misc.h>
  51#else
  52    #define WOLFSSL_MISC_INCLUDED
  53    #include <wolfcrypt/src/misc.c>
  54#endif
  55
  56#include <stdio.h>
  57
  58#if defined(DEBUG_PK_CB)
  59    #define WOLFSSL_PKMSG(_f_, ...) printf(_f_, ##__VA_ARGS__)
  60#else
  61    #define WOLFSSL_PKMSG(_f_, ...) WC_DO_NOTHING
  62#endif
  63
  64#ifdef WOLFSSL_RENESAS_FSPSM_TLS
  65static const byte*  ca_cert_sig;
  66static fspsm_key_data g_user_key_info;
  67
  68static uint32_t     g_encrypted_publicCA_key[HW_SCE_SINST_WORD_SIZE];
  69extern uint32_t     g_CAscm_Idx;          /* index of CM table    */
  70#endif
  71
  72#endif /* WOLFSSL_RENESAS_FSPSM*/
  73
  74wolfSSL_Mutex       fspsm_mutex;
  75static int          fspsm_CryptHwMutexInit_ = 0;
  76
  77
  78/* Mutex Init */
  79static int fspsm_CryptHwMutexInit(wolfSSL_Mutex* mutex)
  80{
  81    return wc_InitMutex(mutex);
  82}
  83/* Mutex Lock */
  84static int fspsm_CryptHwMutexLock(wolfSSL_Mutex* mutex)
  85{
  86    return wc_LockMutex(mutex);
  87}
  88/* Mutex Unlock */
  89static int fspsm_CryptHwMutexUnLock(wolfSSL_Mutex* mutex)
  90{
  91    return wc_UnLockMutex(mutex);
  92}
  93
  94/*
  95* lock hw engine
  96* this should be called before using engine.
  97*/
  98int wc_fspsm_hw_lock()
  99{
 100    int ret = 0;
 101
 102    if (fspsm_CryptHwMutexInit_ == 0) {
 103
 104        ret = fspsm_CryptHwMutexInit(&fspsm_mutex);
 105
 106        if (ret == 0) {
 107            fspsm_CryptHwMutexInit_ = 1;
 108        }
 109        else {
 110            WOLFSSL_MSG(" mutex initialization failed.");
 111            return -1;
 112        }
 113    }
 114    if (fspsm_CryptHwMutexLock(&fspsm_mutex) != 0) {
 115        /* this should not happens */
 116        return -1;
 117    }
 118
 119    return ret;
 120}
 121
 122/*
 123* release hw engine
 124*/
 125void wc_fspsm_hw_unlock(void)
 126{
 127    fspsm_CryptHwMutexUnLock(&fspsm_mutex);
 128}
 129
 130/* Open sce driver for use */
 131int wc_fspsm_Open()
 132{
 133    WOLFSSL_ENTER("wc_fspsm_Open");
 134    int ret;
 135    if ((ret = wc_fspsm_hw_lock()) == 0) {
 136
 137        ret = FSPSM_OPEN(&gFSPSM_ctrl, &gFSPSM_cfg);
 138
 139        if (ret != FSP_SUCCESS) {
 140            WOLFSSL_MSG("RENESAS SCE Open failed");
 141        }
 142
 143    #if defined(WOLFSSL_RENESAS_FSPSM_TLS)
 144        if (ret == FSP_SUCCESS && g_user_key_info.encrypted_user_tls_key) {
 145
 146            ret = FSPSM_ROOTCA_RSA2048(
 147                    g_user_key_info.encrypted_provisioning_key,
 148                    g_user_key_info.iv,
 149                    g_user_key_info.encrypted_user_tls_key,
 150                    &g_user_key_info.user_rsa2048_tls_wrappedkey); /* OUT */
 151
 152            /* init vars */
 153             g_CAscm_Idx = (uint32_t)-1;
 154
 155        }
 156        else {
 157            WOLFSSL_MSG("Failed to lock sce hw ");
 158        }
 159    #endif
 160    }
 161
 162    /* unlock hw */
 163    wc_fspsm_hw_unlock();
 164
 165    WOLFSSL_LEAVE("wc_fspsm_Open", ret);
 166    return ret;
 167}
 168
 169/* close SCE driver */
 170void wc_fspsm_Close()
 171{
 172    WOLFSSL_ENTER("sce Close");
 173    int ret;
 174
 175    if ((ret = wc_fspsm_hw_lock()) == 0) {
 176        /* close SCE */
 177        ret = FSPSM_CLOSE(&gFSPSM_ctrl);
 178
 179        /* unlock hw */
 180        wc_fspsm_hw_unlock();
 181        if (ret != FSP_SUCCESS) {
 182            WOLFSSL_MSG("RENESAS SCE Close failed");
 183        }
 184    }
 185    else {
 186        WOLFSSL_MSG("Failed to unlock sce hw ");
 187    }
 188}
 189
 190#define RANDGEN_WORDS  4
 191int wc_fspsm_GenerateRandBlock(byte* output, word32 sz)
 192{
 193    /* Generate PRNG based on NIST SP800-90A AES CTR-DRBG */
 194    int ret = 0;
 195    uint32_t fspbuf[RANDGEN_WORDS];
 196
 197    while (sz > 0) {
 198        word32 len = sizeof(fspbuf);
 199
 200        if (sz < len) {
 201            len = sz;
 202        }
 203        /* return 4 words random number*/
 204        ret = R_RANDOM_GEN(fspbuf);
 205        if (ret == FSP_SUCCESS) {
 206            XMEMCPY(output, &fspbuf, len);
 207            output += len;
 208            sz -= len;
 209         } else {
 210            WOLFSSL_MSG_EX("FSP SM Rnd Generate() Returned 0x%08x", ret);
 211            return WC_HW_E;
 212        }
 213    }
 214    return ret;
 215}
 216
 217#if defined(WOLFSSL_RENESAS_FSPSM) && \
 218    defined(WOLFSSL_RENESAS_FSPSM_TLS)
 219
 220#if defined(WOLFSSL_RENESAS_FSPSM_ECC)
 221/* Verify Server Key Exchange while doing ECDH key exchange */
 222static int fspsm_ServerKeyExVerify(uint32_t type, WOLFSSL* ssl,
 223                                   const uint8_t* sig,
 224                                   uint32_t sigSz, void* ctx)
 225{
 226    int ret = WOLFSSL_FAILURE;
 227    FSPSM_ST* cbInfo = (FSPSM_ST*)ctx;
 228    byte qx[MAX_ECC_BYTES], qy[MAX_ECC_BYTES];
 229    byte *peerkey = NULL;
 230
 231    word32 qxLen = sizeof(qx), qyLen = sizeof(qy);
 232    (void) sigSz;
 233
 234    /* sanity check */
 235    if (ssl == NULL || sig == NULL || cbInfo == NULL ||
 236            cbInfo->internal == NULL)
 237        return ret;
 238
 239    /* export public peer public key */
 240    ret = wc_ecc_export_public_raw(ssl->peerEccKey, qx, &qxLen, qy, &qyLen);
 241    WOLFSSL_PKMSG("qxLen %d qyLen %d\n", qxLen, qyLen);
 242    if (ret != 0) {
 243        WOLFSSL_MSG("failed to export peer ecc key");
 244        return ret;
 245    }
 246    /* make peer ecc key data for SCE */
 247    /* 0padding(24bit) || 04(8bit) || Qx(256bit) || Qy(256bit) */
 248    peerkey = (byte*)XMALLOC((3 + 1 + qxLen + qyLen), NULL,
 249                                                    DYNAMIC_TYPE_TMP_BUFFER);
 250    if (peerkey == NULL) {
 251        WOLFSSL_MSG("failed to malloc ecc key");
 252        return WOLFSSL_FAILURE;
 253    }
 254
 255    XMEMSET(peerkey, 0, (3 + 1 + qxLen + qyLen));
 256    peerkey[3] = ECC_POINT_UNCOMP;
 257    XMEMCPY(&peerkey[4], qx, qxLen);
 258    XMEMCPY(&peerkey[4+qxLen], qy, qyLen);
 259
 260    if ((ret = wc_fspsm_hw_lock()) == 0) {
 261        /* 0 : RSA 2048bit, 1 : Reserved, 2 : ECDSA P-256 */
 262        ret = FSPSM_TLS_SVRKEYExVfy(
 263            type,
 264            (uint8_t*) ssl->arrays->clientRandom,
 265            (uint8_t*) ssl->arrays->serverRandom,
 266            (uint8_t*) peerkey,
 267            (uint8_t*) sig,
 268            (uint32_t*)ssl->peerSceTsipEncRsaKeyIndex,
 269            (uint32_t*)cbInfo->internal->encrypted_ephemeral_ecdh_public_key);
 270
 271        if (ret != FSP_SUCCESS) {
 272            WOLFSSL_MSG("failed R_fspsm_TLS_ServerKeyExchangeVerify");
 273            cbInfo->internal->keyflgs_tls.bits.pk_key_set = 0;
 274        }
 275        else {
 276            ret = WOLFSSL_SUCCESS;
 277            cbInfo->internal->keyflgs_tls.bits.pk_key_set = 1;
 278        }
 279    }
 280    else {
 281        WOLFSSL_MSG("Failed to lock sce hw ");
 282    }
 283
 284    /* unlock hw */
 285    wc_fspsm_hw_unlock();
 286
 287    XFREE(peerkey, 0, DYNAMIC_TYPE_TMP_BUFFER);
 288    return ret;
 289}
 290/* Callback for Rsa Verify */
 291int wc_fspsm_RsaVerifyTLS(WOLFSSL* ssl, byte* sig, uint32_t sigSz,
 292        uint8_t** out, const byte* key, uint32_t keySz, void* ctx)
 293{
 294    int ret = WOLFSSL_FAILURE;
 295    (void) out;
 296    (void) key;
 297    (void) keySz;
 298
 299    WOLFSSL_PKMSG("SCE RSA Verify: sigSz %d, keySz %d\n", sigSz, keySz);
 300
 301    if (wc_fspsm_usable(ssl, 0))
 302      ret = fspsm_ServerKeyExVerify(0, ssl, sig, sigSz, ctx);
 303    else
 304      ret = CRYPTOCB_UNAVAILABLE;
 305
 306    if (ret == WOLFSSL_SUCCESS)
 307        ret = 0; /* 0 for success */
 308
 309    WOLFSSL_PKMSG("SCE RSA Verify: ret %d\n", ret);
 310
 311    return ret;
 312}
 313/* Callback for Ecc Verify */
 314int wc_fspsm_EccVerifyTLS(WOLFSSL* ssl, const uint8_t* sig,
 315        uint32_t sigSz,  const uint8_t* hash, uint32_t hashSz,
 316        const uint8_t* key, uint32_t keySz, int* result, void* ctx)
 317{
 318    int ret = WOLFSSL_FAILURE;
 319    uint8_t *sigforSCE;
 320    const byte rs_size = HW_SCE_ECDSA_DATA_BYTE_SIZE/2;
 321    byte offset = 0x3;
 322    (void) sigSz;
 323    (void) hash;
 324    (void) hashSz;
 325    (void) key;
 326    (void) keySz;
 327
 328    sigforSCE = NULL;
 329
 330    WOLFSSL_PKMSG("SCE ECC Verify: ssl->options.serverState = %d sigSz %d, hashSz %d, keySz %d\n",
 331                    ssl->options.serverState, sigSz, hashSz, keySz);
 332
 333    if (!wc_fspsm_usable(ssl, 0)) {
 334      WOLFSSL_PKMSG("Cannot handle cipher suite by SCE");
 335      return CRYPTOCB_UNAVAILABLE;
 336    }
 337
 338    if ((sigforSCE = (uint8_t*)XMALLOC(HW_SCE_ECDSA_DATA_BYTE_SIZE, NULL,
 339                                                  DYNAMIC_TYPE_TMP_BUFFER)) == NULL) {
 340        WOLFSSL_MSG("failed to malloc memory");
 341        return MEMORY_E;
 342    }
 343    /* initialization */
 344    XMEMSET(sigforSCE, 0, HW_SCE_ECDSA_DATA_BYTE_SIZE);
 345
 346    /* r */
 347    if (sig[offset] == 0x20) {
 348        XMEMCPY(sigforSCE, &sig[offset+1], rs_size);
 349
 350        offset = 0x25;
 351        /* s */
 352        if (sig[offset] == 0x20) {
 353          XMEMCPY(&sigforSCE[rs_size], &sig[offset+1], rs_size);
 354        }
 355        else {
 356          XMEMCPY(&sigforSCE[rs_size], &sig[offset+2], rs_size);
 357        }
 358    }
 359    else {
 360        XMEMCPY(sigforSCE, &sig[offset+2], rs_size);
 361
 362        offset = 0x26;
 363        /* s */
 364        if (sig[offset] == rs_size) {
 365          XMEMCPY(&sigforSCE[rs_size], &sig[offset+1], rs_size);
 366        }
 367        else {
 368          XMEMCPY(&sigforSCE[rs_size], &sig[offset+2], rs_size);
 369        }
 370    }
 371
 372    ret = fspsm_ServerKeyExVerify(2, ssl, sigforSCE, 64, ctx);
 373
 374    XFREE(sigforSCE, NULL, DYNAMIC_TYPE_TMP_BUFFER);
 375
 376    if (ret == WOLFSSL_SUCCESS) {
 377        *result = 1;
 378        ret = 0; /* for success */
 379    }
 380    else
 381        *result = 0;
 382
 383    WOLFSSL_PKMSG("SCE ECC Verify: ret %d, result %d\n", ret, *result);
 384
 385    return ret;
 386}
 387
 388#if defined(WOLFSSL_RENESAS_FSPSM_TLS) || \
 389    defined(WOLFSSL_RENESAS_FSPSM_CRYPTONLY)
 390
 391/* Callback for ECC shared secret */
 392int fspsm_EccSharedSecret(WOLFSSL* ssl, ecc_key* otherKey,
 393        uint8_t* pubKeyDer, unsigned int* pubKeySz,
 394        uint8_t* out, unsigned int* outlen, int side, void* ctx)
 395{
 396    int       ret = WOLFSSL_SUCCESS;
 397    (void) otherKey;
 398    (void) side;
 399
 400    FSPSM_ST* cbInfo = (FSPSM_ST*)ctx;
 401
 402    (void)ssl;
 403    (void)cbInfo;
 404
 405    /* sanity check */
 406    if (ssl == NULL || pubKeyDer == NULL || pubKeySz == NULL ||
 407        out == NULL || outlen == NULL || cbInfo == NULL ||
 408        cbInfo->internal == NULL)
 409      return WOLFSSL_FAILURE;
 410
 411    WOLFSSL_PKMSG("PK ECC PMS: Side %s, Peer Curve %d\n",
 412        side == WOLFSSL_CLIENT_END ? "client" : "server", otherKey->dp->id);
 413
 414    if (cbInfo->internal->keyflgs_tls.bits.pk_key_set == 1) {
 415        if ((ret = wc_fspsm_hw_lock()) == 0) {
 416            /* Generate ECC PUblic key pair */
 417            ret = FSPSM_TLS_ECCS256R1_KPG(
 418                &cbInfo->internal->ecc_p256_wrapped_key,
 419                /* Qx 32 bytes and Qy 32 bytes*/
 420                (uint8_t*)&cbInfo->internal->ecc_ecdh_public_key );
 421            if (ret != FSP_SUCCESS) {
 422                WOLFSSL_PKMSG("Failed secp256r1_EphemeralWrappedKeyPairGenerate"
 423                                " %d\n", ret);
 424                return ret;
 425            }
 426
 427            /* copy generated ecdh public key into buffer */
 428            pubKeyDer[0] = ECC_POINT_UNCOMP;
 429            *pubKeySz = 1 + sizeof(cbInfo->internal->ecc_ecdh_public_key);
 430            XMEMCPY(&pubKeyDer[1], &cbInfo->internal->ecc_ecdh_public_key,
 431                        sizeof(cbInfo->internal->ecc_ecdh_public_key));
 432
 433            /* Generate Premaster Secret */
 434            ret = FSPSM_TLS_PREMASTERGEN(
 435                (uint32_t*)
 436                    &cbInfo->internal->encrypted_ephemeral_ecdh_public_key,
 437                    &cbInfo->internal->ecc_p256_wrapped_key,
 438                    (uint32_t*)out/* pre-master secret 64 bytes */);
 439            if (ret != FSP_SUCCESS) {
 440                WOLFSSL_PKMSG("Failed PreMasterSecretGenerateForECC_secp256r1 %d\n", ret);
 441                return ret;
 442            }
 443            else {
 444                /* set master secret generation callback for use */
 445                wolfSSL_CTX_SetGenMasterSecretCb(ssl->ctx,
 446                                                Renesas_cmn_genMasterSecret);
 447                wolfSSL_SetGenMasterSecretCtx(ssl, cbInfo);
 448            }
 449        }
 450        else {
 451            WOLFSSL_MSG("Failed to lock sce hw ");
 452        }
 453
 454        /* unlock hw */
 455        wc_fspsm_hw_unlock();
 456
 457        *outlen = 64;
 458        WOLFSSL_PKMSG("PK ECC PMS: ret %d, PubKeySz %d, OutLen %d\n",
 459                                                ret, *pubKeySz, *outlen);
 460    }
 461
 462    return ret;
 463}
 464#endif
 465
 466/* Return tls cipher suite enumeration that is supported by SCE library */
 467static uint32_t GetSceCipherSuite(
 468                    uint8_t cipherSuiteFirst,
 469                    uint8_t cipherSuite)
 470{
 471    WOLFSSL_ENTER("GetSceCipherSuite");
 472    uint32_t sceCipher;
 473
 474    if (cipherSuiteFirst == CIPHER_BYTE)
 475    {
 476        switch(cipherSuite) {
 477            case TLS_RSA_WITH_AES_128_CBC_SHA256:
 478                sceCipher = SCE_TLS_RSA_WITH_AES_128_CBC_SHA256;
 479                break;
 480
 481            case TLS_RSA_WITH_AES_256_CBC_SHA256:
 482                sceCipher = SCE_TLS_RSA_WITH_AES_256_CBC_SHA256;
 483                break;
 484
 485            default:
 486                sceCipher = (uint32_t)WOLFSSL_FSPSM_ILLEGAL_CIPHERSUITE;
 487                break;
 488        }
 489        WOLFSSL_MSG("<< GetSceCipherSuite");
 490        return sceCipher;
 491    }
 492    else if (cipherSuiteFirst == ECC_BYTE)
 493    {
 494        sceCipher = (uint32_t)WOLFSSL_FSPSM_ILLEGAL_CIPHERSUITE;
 495        /* comment out until implementation completes */
 496        switch(cipherSuite) {
 497
 498            case TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA256:
 499                sceCipher = SCE_TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA256;
 500                break;
 501
 502            case TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256:
 503                sceCipher = SCE_TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256;
 504                break;
 505
 506            case TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256:
 507                sceCipher = SCE_TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256;
 508                break;
 509
 510            case TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256:
 511                sceCipher = SCE_TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256;
 512                break;
 513
 514            default:
 515                sceCipher = (uint32_t)WOLFSSL_FSPSM_ILLEGAL_CIPHERSUITE;
 516                break;
 517        }
 518    }
 519    else{
 520        sceCipher = (uint32_t)WOLFSSL_FSPSM_ILLEGAL_CIPHERSUITE;
 521    }
 522
 523    WOLFSSL_MSG("<< GetSceCipherSuite");
 524
 525    return sceCipher;
 526}
 527/* check if sce tls functions can be used for the cipher       */
 528/*                                                             */
 529/* ssl     : a pointer to WOLFSSL object                       */
 530/* session_key_generated : if session key has been generated   */
 531/* return  1 for usable, 0 for unusable                        */
 532int wc_fspsm_usable(const WOLFSSL *ssl,
 533                                                uint8_t session_key_generated)
 534{
 535    WOLFSSL_ENTER("fspsm_usable");
 536    uint32_t sceCipher;
 537    byte side;
 538    const Ciphers *enc;
 539    const Ciphers *dec;
 540
 541    /* sanity check */
 542    if (ssl == NULL)
 543        return BAD_FUNC_ARG;
 544
 545    /* when rsa key index == NULL, SCE isn't used for cert verification. */
 546    /* in the case, we cannot use TSIP.                                  */
 547    if (!ssl->peerSceTsipEncRsaKeyIndex)
 548        return 0;
 549
 550    /* when enabled Extended Master Secret, we cannot use SCE.            */
 551    if (ssl->options.haveEMS)
 552        return 0;
 553
 554    /* when session_key_generated is set as 1, expects to be created      */
 555    /* session key already.                                               */
 556    if (session_key_generated) {
 557        enc = &ssl->encrypt;
 558        dec = &ssl->decrypt;
 559        if (enc == NULL || dec == NULL) {
 560            /* something wrong */
 561            return 0;
 562        }
 563        if (enc->aes == NULL || dec->aes == NULL) {
 564            return 0;
 565        }
 566        if (enc->aes->ctx.setup == 0) {
 567            /* session key for SCE is not created */
 568            return 0;
 569        }
 570    }
 571    /* retrieve cipher suite if SCE supports */
 572    sceCipher = GetSceCipherSuite(ssl->options.cipherSuite0,
 573                                     ssl->options.cipherSuite);
 574    side = ssl->options.side;
 575
 576    if (sceCipher != (uint32_t)WOLFSSL_FSPSM_ILLEGAL_CIPHERSUITE
 577                                   && side == WOLFSSL_CLIENT_END)
 578        return 1;
 579    else
 580        return 0;
 581}
 582
 583/* Generate Hmac by sha256*/
 584int wc_fspsm_Sha256GenerateHmac(const WOLFSSL *ssl,
 585                const uint8_t* myInner, uint32_t innerSz,const uint8_t* in,
 586                uint32_t sz, byte* digest)
 587{
 588    WOLFSSL_ENTER("fspsm_Sha256HmacGenerate");
 589
 590    FSPSM_HMAC_HANDLE _handle;
 591    FSPSM_HMAC_WKEY wrapped_key;
 592    int ret;
 593
 594    if ((ssl == NULL) || (myInner == NULL) || (in == NULL) ||
 595        (digest == NULL))
 596      return BAD_FUNC_ARG;
 597
 598    wrapped_key = ssl->keys.fspsm_client_write_MAC_secret;
 599
 600    if ((ret = wc_fspsm_hw_lock()) != 0) {
 601        WOLFSSL_MSG("hw lock failed");
 602        return ret;
 603    }
 604
 605    ret = FSPSM_S256HMAC_GInt(
 606                &_handle,
 607                &wrapped_key);
 608
 609    if (ret == FSP_SUCCESS)
 610        ret = FSPSM_S256HMAC_GUp(
 611                &_handle,
 612                (uint8_t*)myInner,
 613                innerSz);
 614
 615    if (ret == FSP_SUCCESS)
 616        ret = FSPSM_S256HMAC_GUp(
 617                &_handle,
 618                (uint8_t*)in,
 619                sz);
 620
 621    if (ret == FSP_SUCCESS)
 622        ret = FSPSM_S256HMAC_GFnl(
 623                &_handle,
 624                digest);
 625
 626    if (ret != FSP_SUCCESS)
 627        ret = WOLFSSL_FAILURE;
 628
 629    /* unlock hw */
 630    wc_fspsm_hw_unlock();
 631    WOLFSSL_LEAVE("fspsm_Sha256HmacGenerate", ret);
 632    return ret;
 633}
 634
 635/* Verify hmac */
 636int wc_fspsm_Sha256VerifyHmac(const WOLFSSL *ssl,
 637        const uint8_t* message, uint32_t messageSz,
 638        uint32_t macSz, uint32_t content)
 639{
 640    WOLFSSL_ENTER("fspsm_Sha256HmacVerify");
 641
 642    FSPSM_HMAC_HANDLE _handle;
 643    FSPSM_HMAC_WKEY wrapped_key;
 644    byte   myInner[WOLFSSL_TLS_HMAC_INNER_SZ];
 645    int ret;
 646
 647    if ((ssl == NULL) || (message == NULL))
 648        return BAD_FUNC_ARG;
 649
 650    wrapped_key = ssl->keys.fspsm_server_write_MAC_secret;
 651
 652    if ((ret = wc_fspsm_hw_lock()) != 0) {
 653        WOLFSSL_MSG("hw lock failed");
 654        return ret;
 655    }
 656
 657    wolfSSL_SetTlsHmacInner((WOLFSSL*)ssl, myInner,
 658                        (word32)messageSz, (int)content, 1);
 659
 660    ret = FSPSM_S256HMAC_VInt(
 661                &_handle,
 662                &wrapped_key);
 663
 664    if (ret == FSP_SUCCESS)
 665        ret = FSPSM_S256HMAC_VUp(
 666                &_handle,
 667                (uint8_t*)myInner,
 668                WOLFSSL_TLS_HMAC_INNER_SZ);
 669
 670    if (ret == FSP_SUCCESS)
 671        ret = FSPSM_S256HMAC_VUp(
 672                &_handle,
 673                (uint8_t*)message,
 674                (uint32_t)messageSz);
 675
 676    if (ret == FSP_SUCCESS)
 677        ret = FSPSM_S256HMAC_VFnl(
 678                &_handle,
 679                (uint8_t*)(message+messageSz),
 680                (uint32_t)macSz);
 681
 682    if (ret != FSP_SUCCESS) {
 683        WOLFSSL_MSG("FSP SM Mac verification failed");
 684    }
 685
 686    /* unlock hw */
 687    wc_fspsm_hw_unlock();
 688    WOLFSSL_LEAVE("fspsm_Sha256HmacVerify", ret);
 689    return ret;
 690}
 691
 692/* generate Verify Data based on master secret */
 693int wc_fspsm_generateVerifyData(
 694                            const uint8_t *ms, /* master secret */
 695                            const uint8_t *side, const uint8_t *handshake_hash,
 696                            uint8_t *hashes /* out */)
 697{
 698    WOLFSSL_ENTER("fspsm_generateVerifyData");
 699    int ret ;
 700    uint32_t l_side = SCE_TLS_GENERATE_CLIENT_VERIFY;
 701
 702    if ((ms == NULL) || (side == NULL) || (handshake_hash == NULL) ||
 703        (hashes == NULL))
 704      return BAD_FUNC_ARG;
 705
 706    if (XSTRNCMP((const char*)side, (const char*)kTlsServerFinStr,
 707                                                FINISHED_LABEL_SZ) == 0)
 708    {
 709        l_side = SCE_TLS_GENERATE_SERVER_VERIFY;
 710    }
 711
 712    if ((ret = wc_fspsm_hw_lock()) == 0) {
 713        ret = FSPSM_VERIFY_DATA_FUNC(l_side, (uint32_t*)ms,
 714                       (uint8_t*)handshake_hash, hashes/* out */);
 715        if (ret != FSP_SUCCESS) {
 716            WOLFSSL_MSG("R_fspsm_TLS_VerifyDataGenerate failed");
 717        }
 718    }
 719    /* unlock hw */
 720    wc_fspsm_hw_unlock();
 721    WOLFSSL_LEAVE("fspsm_generateVerifyData", ret);
 722    return ret;
 723}
 724
 725/* generate keys for TLS communication */
 726int wc_fspsm_generateSessionKey(WOLFSSL *ssl,
 727                FSPSM_ST* cbInfo, int devId)
 728{
 729    WOLFSSL_MSG("fspsm_generateSessionKey()");
 730    int ret;
 731    Ciphers *enc;
 732    Ciphers *dec;
 733    FSPSM_HMAC_WKEY key_client_mac;
 734    FSPSM_HMAC_WKEY key_server_mac;
 735
 736    FSPSM_AES_PWKEY key_client_aes = NULL;
 737    FSPSM_AES_PWKEY key_server_aes = NULL;
 738
 739    uint32_t sceCS = GetSceCipherSuite(ssl->options.cipherSuite0,
 740                                         ssl->options.cipherSuite);
 741
 742    if (ssl== NULL || cbInfo == NULL || cbInfo->internal == NULL)
 743      return BAD_FUNC_ARG;
 744
 745
 746    if ((ret = wc_fspsm_hw_lock()) == 0) {
 747        if (sceCS == TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256 ||
 748                sceCS == TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256)
 749        {
 750            WOLFSSL_MSG("Session key for AES-GCM generation skipped.");
 751
 752            wolfSSL_KeepArrays(ssl);
 753            ret = FSP_SUCCESS;
 754
 755        }
 756        else {
 757            key_client_aes = (FSPSM_AES_PWKEY)XMALLOC(sizeof(FSPSM_AES_WKEY),
 758                                            ssl->heap, DYNAMIC_TYPE_AES);
 759            key_server_aes = (FSPSM_AES_PWKEY)XMALLOC(sizeof(FSPSM_AES_WKEY),
 760                                            ssl->heap, DYNAMIC_TYPE_AES);
 761            if (key_client_aes == NULL || key_server_aes == NULL) {
 762                return MEMORY_E;
 763            }
 764
 765            ret = FSPSM_SESSIONKEY_GEN_FUNC(
 766                    GetSceCipherSuite(
 767                        ssl->options.cipherSuite0,
 768                        ssl->options.cipherSuite),
 769                    (uint32_t*)ssl->arrays->fspsm_masterSecret,
 770                    (uint8_t*) ssl->arrays->clientRandom,
 771                    (uint8_t*) ssl->arrays->serverRandom,
 772                    NULL,
 773                    &key_client_mac,
 774                    &key_server_mac,
 775                    key_client_aes,
 776                    key_server_aes,
 777                    NULL, NULL);
 778        }
 779
 780        if (ret != FSP_SUCCESS) {
 781            WOLFSSL_MSG("R_fspsm_TLS_SessionKeyGenerate failed");
 782        }
 783        else {
 784            /* succeeded creating session keys */
 785            /* alloc aes instance for both enc and dec */
 786            enc = &ssl->encrypt;
 787            dec = &ssl->decrypt;
 788
 789            if (enc) {
 790                if (enc->aes == NULL) {
 791                    enc->aes = (Aes*)XMALLOC(sizeof(Aes), ssl->heap,
 792                                                    DYNAMIC_TYPE_CIPHER);
 793                    if (enc->aes == NULL)
 794                        return MEMORY_E;
 795                }
 796                XMEMSET(enc->aes, 0, sizeof(Aes));
 797                enc->aes->ctx.wrapped_key = (FSPSM_AES_PWKEY)XMALLOC
 798                                            (sizeof(FSPSM_AES_WKEY),
 799                                            ssl->heap, DYNAMIC_TYPE_AES);
 800                if (enc->aes->ctx.wrapped_key == NULL)
 801                    return MEMORY_E;
 802            }
 803            if (dec) {
 804                if (dec->aes == NULL) {
 805                    dec->aes = (Aes*)XMALLOC(sizeof(Aes), ssl->heap,
 806                                                    DYNAMIC_TYPE_CIPHER);
 807                    if (dec->aes == NULL) {
 808                        if (enc) {
 809                            XFREE(enc->aes, NULL, DYNAMIC_TYPE_CIPHER);
 810                        }
 811                        return MEMORY_E;
 812                    }
 813                    XMEMSET(dec->aes, 0, sizeof(Aes));
 814
 815                    dec->aes->ctx.wrapped_key = (FSPSM_AES_PWKEY)XMALLOC
 816                                            (sizeof(FSPSM_AES_WKEY),
 817                                            ssl->heap, DYNAMIC_TYPE_AES);
 818                    if (dec->aes->ctx.wrapped_key == NULL)
 819                        return MEMORY_E;
 820                    }
 821            }
 822            /* copy key index into aes */
 823            if (ssl->options.side == PROVISION_CLIENT) {
 824                XMEMCPY(enc->aes->ctx.wrapped_key, key_client_aes,
 825                                                    sizeof(FSPSM_AES_WKEY));
 826                XMEMCPY(dec->aes->ctx.wrapped_key, key_server_aes,
 827                                                    sizeof(FSPSM_AES_WKEY));
 828            }
 829            else {
 830                XMEMCPY(enc->aes->ctx.wrapped_key, key_server_aes,
 831                                                    sizeof(FSPSM_AES_WKEY));
 832                XMEMCPY(dec->aes->ctx.wrapped_key, key_client_aes,
 833                                                    sizeof(FSPSM_AES_WKEY));
 834            }
 835            /* copy mac key index into keys */
 836            ssl->keys.fspsm_client_write_MAC_secret = key_client_mac;
 837            ssl->keys.fspsm_server_write_MAC_secret = key_server_mac;
 838
 839            /* set up key size and marked ready */
 840            if (enc) {
 841                enc->aes->ctx.keySize = ssl->specs.key_size;
 842                enc->aes->ctx.setup = 1;
 843                /* ready-for-use flag will be set when SetKeySide() is called */
 844            }
 845            /* set up key size and marked ready */
 846            if (dec) {
 847                dec->aes->ctx.keySize = ssl->specs.key_size;
 848                dec->aes->ctx.setup = 1;
 849                /* ready-for-use flag will be set when SetKeySide() is called */
 850            }
 851
 852            if (cbInfo->internal->cipher ==
 853                    SCE_TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256 ||
 854                cbInfo->internal->cipher ==
 855                    SCE_TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256) {
 856                enc->aes->nonceSz = AEAD_NONCE_SZ;
 857                dec->aes->nonceSz = AEAD_NONCE_SZ;
 858             }
 859             enc->aes->devId = devId;
 860             dec->aes->devId = devId;
 861
 862            /* marked as session key is set */
 863            cbInfo->internal->keyflgs_tls.bits.session_key_set = 1;
 864        }
 865
 866        XFREE(key_client_aes, ssl->heap, DYNAMIC_TYPE_AES);
 867        XFREE(key_server_aes, ssl->heap, DYNAMIC_TYPE_AES);
 868
 869        /* unlock hw */
 870        wc_fspsm_hw_unlock();
 871
 872    }
 873    else {
 874        WOLFSSL_LEAVE("hw lock failed", ret);
 875    }
 876
 877    WOLFSSL_LEAVE("fspsm_generateSessionKey", ret);
 878    return ret;
 879}
 880
 881/* generate master secret based on pre-master which is generated by SCE */
 882int wc_fspsm_generateMasterSecret(
 883        uint8_t        cipherSuiteFirst,
 884        uint8_t        cipherSuite,
 885        const uint8_t *pr, /* pre-master    */
 886        const uint8_t *cr, /* client random */
 887        const uint8_t *sr, /* server random */
 888        uint8_t *ms)
 889{
 890    WOLFSSL_ENTER("fspsm_generateMasterSecretEx");
 891    int ret;
 892
 893    if ((pr == NULL) || (cr == NULL) || (sr == NULL) ||
 894        (ms == NULL))
 895      return BAD_FUNC_ARG;
 896
 897    uint32_t sceCS = GetSceCipherSuite(cipherSuiteFirst, cipherSuite);
 898    if (sceCS == 0xffffffff)
 899        return BAD_FUNC_ARG;
 900
 901    if ((ret = wc_fspsm_hw_lock()) == 0) {
 902        ret = FSPSM_MASTERSECRET_GEN_FUNC(
 903            sceCS,
 904            (uint32_t*)pr,
 905            (uint8_t*)cr, (uint8_t*)sr, (uint32_t*)ms);
 906        if (ret != FSP_SUCCESS) {
 907            WOLFSSL_MSG("R_fspsm_TLS_MasterSecretGenerate failed");
 908        }
 909        /* unlock hw */
 910        wc_fspsm_hw_unlock();
 911    }
 912    else {
 913        WOLFSSL_MSG(" hw lock failed ");
 914    }
 915    WOLFSSL_LEAVE("fspsm_generateMasterSecret", ret);
 916    return ret;
 917}
 918
 919/* generate pre-Master secrete by SCE */
 920int wc_fspsm_generatePremasterSecret(uint8_t *premaster,
 921                                                        uint32_t preSz)
 922{
 923    WOLFSSL_ENTER("fspsm_generatePremasterSecret");
 924    int ret;
 925
 926    if (premaster == NULL)
 927      return BAD_FUNC_ARG;
 928
 929    if ((ret = wc_fspsm_hw_lock()) == 0 && preSz >=
 930                                    (SCE_TLS_MASTER_SECRET_WORD_SIZE*4)) {
 931            /* generate pre-master, 80 bytes */
 932            ret = FSPSM_PREGEN_FUNC((uint32_t*)premaster);
 933            if (ret != FSP_SUCCESS) {
 934                WOLFSSL_MSG(" R_fspsm_TLS_GeneratePreMasterSecret failed");
 935            }
 936        /* unlock hw */
 937        wc_fspsm_hw_unlock();
 938    }
 939    else {
 940        WOLFSSL_MSG(" hw lock failed or preSz is smaller than 80");
 941    }
 942
 943    WOLFSSL_LEAVE("fspsm_generatePremasterSecret", ret);
 944    return ret;
 945}
 946
 947
 948/*
 949* generate encrypted pre-Master secrete by SCE
 950*/
 951int wc_fspsm_generateEncryptPreMasterSecret(
 952        WOLFSSL*    ssl,
 953        uint8_t*       out,
 954        uint32_t*     outSz)
 955{
 956    WOLFSSL_MSG("fspsm_generateEncryptPreMasterSecret");
 957    int ret;
 958
 959    if ((ssl == NULL) || (out == NULL) || (outSz == NULL))
 960      return BAD_FUNC_ARG;
 961
 962    if ((ret = wc_fspsm_hw_lock()) == 0) {
 963        if (*outSz >= 256)
 964            ret = FSPSM_PREGENENC_FUNC(
 965                        (uint32_t*)ssl->peerSceTsipEncRsaKeyIndex,
 966                        (uint32_t*)ssl->arrays->preMasterSecret,
 967                        (uint8_t*)out);
 968        else
 969            ret = -1;
 970
 971        if (ret != FSP_SUCCESS) {
 972            WOLFSSL_MSG("R_fspsm_TLS_PreMasterSecretEncryptWithRSA2048 failed");
 973        }
 974        else {
 975            *outSz = 256; /* SCE can only handles 2048 RSA */
 976            /* set GenMaster Callback for Master secret generation */
 977            void* ctx = wolfSSL_GetRsaVerifyCtx(ssl);
 978            wolfSSL_CTX_SetGenMasterSecretCb(ssl->ctx,
 979                                                Renesas_cmn_genMasterSecret);
 980            wolfSSL_SetGenMasterSecretCtx(ssl, ctx);
 981        }
 982        wc_fspsm_hw_unlock();
 983
 984    }
 985    else {
 986        WOLFSSL_MSG(" hw lock failed ");
 987    }
 988    WOLFSSL_LEAVE("fspsm_generateEncryptPreMasterSecret", ret);
 989    return ret;
 990}
 991
 992
 993/* Certificate verification by SCE */
 994int wc_fspsm_tls_CertVerify(
 995        const uint8_t* cert,       uint32_t certSz,
 996        const uint8_t* signature,  uint32_t sigSz,
 997        uint32_t      key_n_start,uint32_t key_n_len,
 998        uint32_t      key_e_start,uint32_t key_e_len,
 999        uint8_t*      fspsm_encPublickey)
1000{
1001    WOLFSSL_ENTER("fspsm_tls_CertVerify");
1002    int ret;
1003    uint8_t *sigforSCE;
1004    uint8_t *pSig;
1005    const byte rs_size = 0x20;
1006    byte offset = 0x3;
1007    (void)sigSz;
1008
1009    sigforSCE = NULL;
1010    pSig = NULL;
1011
1012    if (cert == NULL)
1013      return BAD_FUNC_ARG;
1014
1015    if (!signature) {
1016        WOLFSSL_MSG(" signature for ca verification is not set");
1017        return -1;
1018    }
1019    if (!fspsm_encPublickey) {
1020        WOLFSSL_MSG(" fspsm_encPublickey is NULL.");
1021        return -1;
1022    }
1023
1024    if (g_user_key_info.encrypted_user_tls_key_type ==
1025                                SCE_TLS_PUBLIC_KEY_TYPE_ECDSA_P256/*ECDSA*/) {
1026
1027      if ((sigforSCE = (uint8_t*)XMALLOC(HW_SCE_ECDSA_DATA_BYTE_SIZE, NULL,
1028                                                  DYNAMIC_TYPE_TMP_BUFFER)) == NULL) {
1029        WOLFSSL_MSG("failed to malloc memory");
1030        return MEMORY_E;
1031      }
1032      /* initialization */
1033      XMEMSET(sigforSCE, 0, HW_SCE_ECDSA_DATA_BYTE_SIZE);
1034
1035      if (signature[offset] == 0x20) {
1036        XMEMCPY(sigforSCE, &signature[offset+1], rs_size);
1037
1038        offset = 0x25;
1039        if (signature[offset] == 0x20) {
1040          XMEMCPY(&sigforSCE[rs_size], &signature[offset+1], rs_size);
1041        }
1042        else {
1043          XMEMCPY(&sigforSCE[rs_size], &signature[offset+2], rs_size);
1044        }
1045      }
1046      else {
1047        XMEMCPY(sigforSCE, &signature[offset+2], rs_size);
1048        offset = 0x26;
1049
1050        if (signature[offset] == rs_size) {
1051          XMEMCPY(&sigforSCE[rs_size], &signature[offset+1], rs_size);
1052        }
1053        else {
1054          XMEMCPY(&sigforSCE[rs_size], &signature[offset+2], rs_size);
1055        }
1056      }
1057      pSig = sigforSCE;
1058    }
1059    else {
1060      pSig = (uint8_t*)signature;
1061    }
1062
1063
1064    if ((ret = wc_fspsm_hw_lock()) == 0) {
1065        ret = FSPSM_TLSCERT_VRY(
1066                g_user_key_info.encrypted_user_tls_key_type,
1067                (uint32_t*)g_encrypted_publicCA_key,/* encrypted public key  */
1068                (uint8_t*)cert,                 /* certificate der        */
1069                certSz,                         /* length of der          */
1070                (uint8_t*)pSig,                 /* sign data by RSA PSS   */
1071                key_n_start,  /* start position of public key n in bytes     */
1072                (key_n_start + key_n_len),     /* length of the public key n */
1073                key_e_start,                   /* start pos, key e in bytes  */
1074                (key_e_start + key_e_len),     /* length of the public key e */
1075                (uint32_t*)fspsm_encPublickey  /* returned encrypted key     */
1076                );
1077        if (ret != FSP_SUCCESS) {
1078            WOLFSSL_MSG(" R_XXX_TlsCertificateVerification() failed");
1079        }
1080        XFREE(sigforSCE, NULL, DYNAMIC_TYPE_TMP_BUFFER);
1081        wc_fspsm_hw_unlock();
1082    }
1083    else {
1084        WOLFSSL_MSG(" hw lock failed ");
1085    }
1086    WOLFSSL_LEAVE("fspsm_tls_CertVerify", ret);
1087    return ret;
1088}
1089
1090/* Root Certificate verification */
1091int wc_fspsm_tls_RootCertVerify(
1092        const uint8_t* cert,        uint32_t cert_len,
1093        uint32_t      key_n_start,    uint32_t key_n_len,
1094        uint32_t      key_e_start,    uint32_t key_e_len,
1095        uint32_t      cm_row)
1096{
1097    int ret;
1098    /* call to generate encrypted public key for certificate verification */
1099    uint8_t *signature = (uint8_t*)ca_cert_sig;
1100
1101    WOLFSSL_ENTER("wc_fspsm_tls_RootCertVerify");
1102
1103    if (cert == NULL)
1104      return BAD_FUNC_ARG;
1105
1106    if (!signature) {
1107        WOLFSSL_MSG(" signature for ca verification is not set");
1108        return -1;
1109    }
1110
1111    if ((ret = wc_fspsm_hw_lock()) == 0) {
1112        ret = FSPSM_TLSROOTCERT_VRY(
1113                g_user_key_info.encrypted_user_tls_key_type,
1114                (uint8_t*)cert,             /* CA cert */
1115                (uint32_t)cert_len,         /* length of CA cert */
1116                key_n_start,                /* Byte position of public key */
1117                (key_n_start + key_n_len),
1118                key_e_start,
1119                (key_e_start + key_e_len),
1120                (uint8_t*)ca_cert_sig,      /* RSA 2048 PSS with SHA256 */
1121                g_encrypted_publicCA_key);  /* RSA-2048 public key 560 bytes */
1122                                            /* ECDSA 96 bytes */
1123        if (ret != FSP_SUCCESS) {
1124            WOLFSSL_MSG(" R_fspsm_TLS_RootCertificateVerify() failed");
1125        }
1126        else {
1127            g_CAscm_Idx = cm_row;
1128        }
1129        wc_fspsm_hw_unlock();
1130    }
1131    else {
1132        WOLFSSL_MSG(" hw lock failed ");
1133    }
1134    WOLFSSL_LEAVE("wc_fspsm_tls_RootCertVerify", ret);
1135    return ret;
1136}
1137
1138/*  store elements for session key generation into ssl->keys.
1139 *  return 0 on success, negative value on failure
1140 */
1141int wc_fspsm_storeKeyCtx(WOLFSSL* ssl, FSPSM_ST* info)
1142{
1143    int ret = 0;
1144
1145    WOLFSSL_ENTER("fspsm_storeKeyCtx");
1146
1147    if (ssl == NULL || info == NULL || info->internal == NULL)
1148        ret = BAD_FUNC_ARG;
1149
1150    if (ret == 0) {
1151        XMEMCPY(info->internal->masterSecret,
1152                        ssl->arrays->fspsm_masterSecret,
1153                        FSPSM_TLS_MASTERSECRET_SIZE);
1154        XMEMCPY(info->internal->clientRandom,
1155                        ssl->arrays->clientRandom, 32);
1156        XMEMCPY(info->internal->serverRandom,
1157                        ssl->arrays->serverRandom, 32);
1158
1159        info->internal->cipher = (uint8_t)GetSceCipherSuite(
1160                                ssl->options.cipherSuite0,
1161                                ssl->options.cipherSuite);
1162    }
1163    WOLFSSL_LEAVE("fspsm_storeKeyCtx", ret);
1164    return ret;
1165}
1166
1167/* to inform ca certificate sign */
1168/* signature format expects RSA 2048 PSS with SHA256 */
1169#if defined(WOLFSSL_RENESAS_SCEPROTECT)
1170WOLFSSL_API void wc_sce_inform_cert_sign(const uint8_t *sign)
1171#else
1172WOLFSSL_API void wc_fspsm_inform_cert_sign(const uint8_t *sign)
1173#endif
1174{
1175    if (sign)
1176        ca_cert_sig = sign;
1177}
1178
1179/* let wolfSSL know user key information using TLS operation by SCE */
1180#if defined(WOLFSSL_RENESAS_SCEPROTECT)
1181WOLFSSL_API void wc_sce_inform_user_keys(
1182#else
1183WOLFSSL_API void wc_fspsm_inform_user_keys(
1184#endif
1185    uint8_t* encrypted_provisioning_key,
1186    uint8_t* iv,
1187    uint8_t* encrypted_user_tls_key,
1188    uint32_t encrypted_user_tls_key_type)
1189{
1190    WOLFSSL_ENTER("sce_inform_user_keys");
1191    g_user_key_info.encrypted_provisioning_key = NULL;
1192    g_user_key_info.iv = NULL;
1193    g_user_key_info.encrypted_user_tls_key = NULL;
1194
1195    if (encrypted_provisioning_key ) {
1196        g_user_key_info.encrypted_provisioning_key = encrypted_provisioning_key;
1197    }
1198    if (iv) {
1199        g_user_key_info.iv = iv;
1200    }
1201    if (encrypted_user_tls_key) {
1202        g_user_key_info.encrypted_user_tls_key = encrypted_user_tls_key;
1203    }
1204
1205    g_user_key_info.encrypted_user_tls_key_type = encrypted_user_tls_key_type;
1206
1207    /* set callback for ECC */
1208    WOLFSSL_MSG("sce_inform_user_keys_ex");
1209}
1210
1211
1212/* Set callbacks needed for sce TLS api handling */
1213#if defined(WOLFSSL_RENESAS_SCEPROTECT)
1214WOLFSSL_API void wc_sce_set_callbacks(WOLFSSL_CTX* ctx)
1215#else
1216WOLFSSL_API void wc_fspsm_set_callbacks(WOLFSSL_CTX* ctx)
1217#endif
1218{
1219    wolfSSL_CTX_SetEccVerifyCb(ctx, Renesas_cmn_EccVerify);
1220    wolfSSL_CTX_SetRsaVerifyCb(ctx, Renesas_cmn_RsaVerify);
1221    wolfSSL_CTX_SetGenPreMasterCb(ctx, Renesas_cmn_generatePremasterSecret);
1222    wolfSSL_CTX_SetRsaEncCb(ctx, Renesas_cmn_RsaEnc);
1223    wolfSSL_CTX_SetVerifyMacCb(ctx, Renesas_cmn_VerifyHmac);
1224
1225    /* reset callbacks */
1226    wolfSSL_CTX_SetEccSharedSecretCb(ctx, NULL);
1227}
1228/*
1229* Clean up Renesas Ctx
1230* ssl WOLFSSL object
1231* return 0 successful
1232*/
1233int wc_fspsm_TlsCleanup(WOLFSSL* ssl)
1234{
1235    int ret = 0;
1236    FSPSM_ST* tuc = NULL;
1237
1238    if (ssl == NULL)
1239        return ret;
1240
1241    tuc = ssl->RenesasUserCtx;
1242
1243    if (tuc == NULL)
1244        return ret;
1245    /* free internal structure */
1246    if (tuc->internal) {
1247        XFREE(tuc->internal, ssl->heap, DYNAMIC_TYPE_TMP_BUFFER);
1248        tuc->internal = NULL;
1249    }
1250
1251    /* zero clear */
1252    ForceZero(tuc, sizeof(FSPSM_ST));
1253    ssl->RenesasUserCtx = NULL;
1254
1255    return ret;
1256}
1257/* Set callback contexts needed for sce TLS api handling */
1258#if defined(WOLFSSL_RENESAS_SCEPROTECT)
1259WOLFSSL_API int wc_sce_set_callback_ctx(WOLFSSL* ssl, void* user_ctx)
1260#else
1261WOLFSSL_API int wc_fspsm_set_callback_ctx(WOLFSSL* ssl, void* user_ctx)
1262#endif
1263{
1264    FSPSM_ST* uCtx = (FSPSM_ST*)user_ctx;
1265
1266    if (ssl == NULL || user_ctx == NULL) {
1267        return BAD_FUNC_ARG;
1268    }
1269
1270    ForceZero(uCtx, sizeof(FSPSM_ST));
1271    uCtx->internal = (FSPSM_ST_Internal*)XMALLOC(sizeof(FSPSM_ST_Internal),
1272                                        ssl->heap,
1273                                        DYNAMIC_TYPE_TMP_BUFFER);
1274    if (!uCtx->internal) {
1275        WOLFSSL_MSG("Failed to allocate memory for user ctx internal");
1276        return MEMORY_E;
1277    }
1278
1279    ForceZero(uCtx->internal, sizeof(FSPSM_ST_Internal));
1280
1281    uCtx->internal->ssl  = ssl;
1282    uCtx->internal->ctx  = ssl->ctx;
1283    uCtx->internal->heap = ssl->heap;
1284    uCtx->internal->side = ssl->ctx->method->side;
1285
1286    ssl->RenesasUserCtx = user_ctx;     /* ssl doesn't own user_ctx */
1287
1288    wolfSSL_SetEccVerifyCtx(ssl, user_ctx);
1289    wolfSSL_SetRsaEncCtx(ssl, user_ctx);
1290    wolfSSL_SetRsaVerifyCtx(ssl, user_ctx);
1291    wolfSSL_SetGenPreMasterCtx(ssl, user_ctx);
1292    wolfSSL_SetEccSharedSecretCtx(ssl, NULL);
1293    wolfSSL_SetVerifyMacCtx(ssl, user_ctx);
1294
1295    /* set up crypt callback */
1296    wc_CryptoCb_CryptInitRenesasCmn(ssl, user_ctx);
1297
1298    return 0;
1299}
1300#endif /*  !WOLFSSL_RENESAS_FSPSM_CRYPTONLY */
1301
1302#endif /* WOLFSSL_RENESAS_FSPSM_TLS || WOLFSSL_RENESAS_FSPSM_CRYPTONLY */
1303#endif /* WOLFSSL_RENESAS_FSPSM) &&  WOLFSSL_RENESAS_FSPSM_TLS */