luna - wolfssl/wolfcrypt/src/port/st/stm32.c

   1/* stm32.c
   2 *
   3 * Copyright (C) 2006-2026 wolfSSL Inc.
   4 *
   5 * This file is part of wolfSSL.
   6 *
   7 * wolfSSL is free software; you can redistribute it and/or modify
   8 * it under the terms of the GNU General Public License as published by
   9 * the Free Software Foundation; either version 3 of the License, or
  10 * (at your option) any later version.
  11 *
  12 * wolfSSL is distributed in the hope that it will be useful,
  13 * but WITHOUT ANY WARRANTY; without even the implied warranty of
  14 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
  15 * GNU General Public License for more details.
  16 *
  17 * You should have received a copy of the GNU General Public License
  18 * along with this program; if not, write to the Free Software
  19 * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1335, USA
  20 */
  21
  22/* Generic STM32 Hashing Function */
  23/* Supports CubeMX HAL or Standard Peripheral Library */
  24
  25#ifdef HAVE_CONFIG_H
  26    #include <config.h>
  27#endif
  28
  29#include <wolfssl/wolfcrypt/settings.h>
  30
  31#include <wolfssl/wolfcrypt/port/st/stm32.h>
  32#include <wolfssl/wolfcrypt/types.h>
  33#include <wolfssl/wolfcrypt/error-crypt.h>
  34
  35#ifdef NO_INLINE
  36    #include <wolfssl/wolfcrypt/misc.h>
  37#else
  38    #define WOLFSSL_MISC_INCLUDED
  39    #include <wolfcrypt/src/misc.c>
  40#endif
  41
  42#ifndef NO_AES
  43    #include <wolfssl/wolfcrypt/aes.h>
  44#endif
  45
  46#ifdef WOLFSSL_STM32_PKA
  47#include <stdint.h>
  48
  49#if defined(WOLFSSL_STM32L5)
  50#include <stm32l5xx_hal_conf.h>
  51#include <stm32l5xx_hal_pka.h>
  52#elif defined(WOLFSSL_STM32U5)
  53#include <stm32u5xx_hal_conf.h>
  54#include <stm32u5xx_hal_pka.h>
  55#elif defined(WOLFSSL_STM32WB)
  56#include <stm32wbxx_hal_conf.h>
  57#include <stm32wbxx_hal_pka.h>
  58#elif defined(WOLFSSL_STM32WL)
  59#include <stm32wlxx_hal_conf.h>
  60#include <stm32wlxx_hal_pka.h>
  61#elif defined(WOLFSSL_STM32MP13)
  62#include <stm32mp13xx_hal_conf.h>
  63#include <stm32mp13xx_hal_pka.h>
  64#elif defined(WOLFSSL_STM32H7S)
  65#include <stm32h7rsxx_hal_conf.h>
  66#include <stm32h7rsxx_hal_pka.h>
  67#elif defined(WOLFSSL_STM32WBA)
  68#include <stm32wbaxx_hal_conf.h>
  69#include <stm32wbaxx_hal_pka.h>
  70#elif defined(WOLFSSL_STM32N6)
  71#include <stm32n6xx_hal_conf.h>
  72#include <stm32n6xx_hal_pka.h>
  73#elif defined(WOLFSSL_STM32H5)
  74#include <stm32h5xx_hal_conf.h>
  75#include <stm32h5xx_hal_pka.h>
  76#else
  77#error Please add the hal_pk.h include
  78#endif
  79extern PKA_HandleTypeDef hpka;
  80
  81#if !defined(WOLFSSL_STM32_PKA_V2) && defined(PKA_ECC_SCALAR_MUL_IN_B_COEFF)
  82/* PKA hardware like in U5 added coefB and primeOrder */
  83#define WOLFSSL_STM32_PKA_V2
  84#endif
  85
  86#ifdef HAVE_ECC
  87#include <wolfssl/wolfcrypt/ecc.h>
  88
  89#ifndef WOLFSSL_HAVE_ECC_KEY_GET_PRIV
  90    /* FIPS build has replaced ecc.h. */
  91    #define wc_ecc_key_get_priv(key) (&((key)->k))
  92    #define WOLFSSL_HAVE_ECC_KEY_GET_PRIV
  93#endif
  94#endif /* HAVE_ECC */
  95#endif /* WOLFSSL_STM32_PKA */
  96
  97
  98#ifdef STM32_HASH
  99
 100/* #define DEBUG_STM32_HASH */
 101
 102/* User can override STM32_HASH_CLOCK_ENABLE and STM32_HASH_CLOCK_DISABLE */
 103#ifndef STM32_HASH_CLOCK_ENABLE
 104    static WC_INLINE void wc_Stm32_Hash_Clock_Enable(STM32_HASH_Context* stmCtx)
 105    {
 106    #ifdef WOLFSSL_STM32_CUBEMX
 107        __HAL_RCC_HASH_CLK_ENABLE();
 108    #else
 109        RCC_AHB2PeriphClockCmd(RCC_AHB2Periph_HASH, ENABLE);
 110    #endif
 111        (void)stmCtx;
 112    }
 113    #define STM32_HASH_CLOCK_ENABLE(ctx) wc_Stm32_Hash_Clock_Enable(ctx)
 114#endif
 115
 116#ifndef STM32_HASH_CLOCK_DISABLE
 117    static WC_INLINE void wc_Stm32_Hash_Clock_Disable(STM32_HASH_Context* stmCtx)
 118    {
 119    #ifdef WOLFSSL_STM32_CUBEMX
 120        __HAL_RCC_HASH_CLK_DISABLE();
 121    #else
 122        RCC_AHB2PeriphClockCmd(RCC_AHB2Periph_HASH, DISABLE);
 123    #endif
 124        (void)stmCtx;
 125    }
 126    #define STM32_HASH_CLOCK_DISABLE(ctx) wc_Stm32_Hash_Clock_Disable(ctx)
 127#endif
 128
 129
 130/* STM32 Port Internal Functions */
 131static void wc_Stm32_Hash_NumValidBits(word32 len)
 132{
 133    /* calculate number of valid bits in last word */
 134    /* NBLW = 0x00 (all 32-bits are valid) */
 135    word32 nbvalidbytesdata = (len % STM32_HASH_REG_SIZE);
 136    HASH->STR &= ~HASH_STR_NBW;
 137    HASH->STR |= (8 * nbvalidbytesdata) & HASH_STR_NBW;
 138
 139#ifdef DEBUG_STM32_HASH
 140    printf("STM Valid Last bits (%d)\n", 8 * nbvalidbytesdata);
 141#endif
 142}
 143
 144static void wc_Stm32_Hash_SaveContext(STM32_HASH_Context* ctx)
 145{
 146    int i;
 147
 148    /* save context registers */
 149    ctx->HASH_IMR = HASH->IMR;
 150    ctx->HASH_STR = HASH->STR;
 151    ctx->HASH_CR  = HASH->CR;
 152#ifdef STM32_HASH_SHA3
 153    ctx->SHA3CFGR  = HASH->SHA3CFGR;
 154#endif
 155    for (i=0; i<HASH_CR_SIZE; i++) {
 156        ctx->HASH_CSR[i] = HASH->CSR[i];
 157    }
 158
 159#ifdef DEBUG_STM32_HASH
 160    printf("STM Save CR %lx, IMR %lx, STR %lx\n",
 161        HASH->CR, HASH->IMR, HASH->STR);
 162#endif
 163}
 164
 165static void wc_Stm32_Hash_RestoreContext(STM32_HASH_Context* ctx, word32 algo,
 166    word32 mode)
 167{
 168    int i;
 169
 170    if (ctx->HASH_CR == 0) {
 171        /* init context */
 172
 173    #if defined(HASH_IMR_DINIE) && defined(HASH_IMR_DCIE)
 174        /* Disable IRQ's - wolfSSL does not use the HASH/RNG IRQ
 175         * If using the HAL hashing API's directly it will re-enable the IRQs */
 176        HASH->IMR &= ~(HASH_IMR_DINIE | HASH_IMR_DCIE);
 177    #endif
 178
 179        /* Configure algorithm, mode, data type and initialize HASH processor.
 180         * INIT must be written in the same register write as ALGO because
 181         * setting INIT resets ALGO bits to their default value (MD5). */
 182        HASH->CR = (algo | mode | HASH_DATATYPE_8B | HASH_CR_INIT);
 183
 184        /* by default mark all bits valid */
 185        wc_Stm32_Hash_NumValidBits(0);
 186
 187#ifdef DEBUG_STM32_HASH
 188        printf("STM Init algo %x, mode %x, CR %lx, SR %lx\n",
 189            (unsigned int)algo, (unsigned int)mode,
 190            HASH->CR, HASH->SR);
 191#endif
 192    }
 193    else {
 194        /* restore context registers */
 195        HASH->IMR = ctx->HASH_IMR;
 196        HASH->STR = ctx->HASH_STR;
 197#ifdef STM32_HASH_SHA3
 198        HASH->SHA3CFGR = ctx->SHA3CFGR;
 199#endif
 200
 201        /* Restore CR with INIT in a single write - setting INIT resets ALGO
 202         * bits, so we must include the saved CR value in the same write. */
 203        HASH->CR = ctx->HASH_CR | HASH_CR_INIT;
 204
 205        /* continue restoring context registers */
 206        for (i=0; i<HASH_CR_SIZE; i++) {
 207            HASH->CSR[i] = ctx->HASH_CSR[i];
 208        }
 209
 210#ifdef DEBUG_STM32_HASH
 211        printf("STM Restore CR %lx, IMR %lx, STR %lx\n",
 212            HASH->CR, HASH->IMR, HASH->STR);
 213#endif
 214    }
 215}
 216
 217static void wc_Stm32_Hash_GetDigest(byte* hash, int digestSize)
 218{
 219    word32 digest[HASH_MAX_DIGEST/sizeof(word32)];
 220    int i = 0, sz;
 221
 222    if (digestSize > HASH_MAX_DIGEST)
 223        digestSize = HASH_MAX_DIGEST;
 224
 225    sz = digestSize;
 226    while (sz > 0) {
 227        /* first 20 bytes come from instance HR */
 228        if (i < 5) {
 229            digest[i] = HASH->HR[i];
 230        }
 231    #ifdef HASH_DIGEST
 232        /* reset comes from HASH_DIGEST */
 233        else {
 234            digest[i] = HASH_DIGEST->HR[i];
 235        }
 236    #endif
 237        i++;
 238        sz -= 4;
 239    }
 240
 241    ByteReverseWords(digest, digest, digestSize);
 242
 243    XMEMCPY(hash, digest, digestSize);
 244
 245#ifdef DEBUG_STM32_HASH
 246    {
 247        word32 ii;
 248        printf("STM Digest %d\n", digestSize);
 249        for (ii=0; ii<digestSize/sizeof(word32); ii++) {
 250            printf("\tDIG 0x%04x\n", digest[ii]);
 251        }
 252    }
 253#endif
 254}
 255
 256static int wc_Stm32_Hash_WaitDataReady(STM32_HASH_Context* stmCtx)
 257{
 258    int timeout = 0;
 259    (void)stmCtx;
 260
 261    /* wait until not busy and data input buffer ready */
 262    while (((HASH->SR & HASH_SR_BUSY)
 263        #ifdef HASH_IMR_DINIE
 264            || (HASH->SR & HASH_SR_DINIS) == 0
 265        #endif
 266        ) && ++timeout < STM32_HASH_TIMEOUT) {
 267    };
 268
 269#ifdef DEBUG_STM32_HASH
 270    printf("STM Wait Data %d, HASH->SR %lx\n", timeout, HASH->SR);
 271#endif
 272
 273    /* verify timeout did not occur */
 274    if (timeout >= STM32_HASH_TIMEOUT) {
 275        return WC_TIMEOUT_E;
 276    }
 277    return 0;
 278}
 279
 280static int wc_Stm32_Hash_WaitCalcComp(STM32_HASH_Context* stmCtx)
 281{
 282    int timeout = 0;
 283    (void)stmCtx;
 284
 285    /* wait until not busy and hash digest calculation complete */
 286    while (((HASH->SR & HASH_SR_BUSY)
 287        #ifdef HASH_IMR_DCIE
 288            || (HASH->SR & HASH_SR_DCIS) == 0
 289        #endif
 290        ) && ++timeout < STM32_HASH_TIMEOUT) {
 291    };
 292
 293#ifdef DEBUG_STM32_HASH
 294    printf("STM Wait Calc %d, HASH->SR %lx\n", timeout, HASH->SR);
 295#endif
 296
 297    /* verify timeout did not occur */
 298    if (timeout >= STM32_HASH_TIMEOUT) {
 299        return WC_TIMEOUT_E;
 300    }
 301    return 0;
 302}
 303
 304static void wc_Stm32_Hash_Data(STM32_HASH_Context* stmCtx, word32 len)
 305{
 306    word32 i, blocks;
 307
 308    if (len > stmCtx->buffLen)
 309        len = stmCtx->buffLen;
 310
 311    /* calculate number of 32-bit blocks - round up */
 312    blocks = ((len + STM32_HASH_REG_SIZE-1) / STM32_HASH_REG_SIZE);
 313#ifdef DEBUG_STM32_HASH
 314    printf("STM DIN %d blocks\n", blocks);
 315#endif
 316    for (i=0; i<blocks; i++) {
 317    #ifdef DEBUG_STM32_HASH
 318        printf("\tDIN 0x%04x\n", stmCtx->buffer[i]);
 319    #endif
 320        HASH->DIN = stmCtx->buffer[i];
 321    }
 322    stmCtx->loLen += len; /* total */
 323    stmCtx->buffLen -= len;
 324    if (stmCtx->buffLen > 0) {
 325        XMEMMOVE(stmCtx->buffer, (byte*)stmCtx->buffer+len, stmCtx->buffLen);
 326    }
 327}
 328
 329
 330/* STM32 Port Exposed Functions */
 331void wc_Stm32_Hash_Init(STM32_HASH_Context* stmCtx)
 332{
 333    /* clear context */
 334    /* this also gets called after finish */
 335    XMEMSET(stmCtx, 0, sizeof(STM32_HASH_Context));
 336}
 337
 338int wc_Stm32_Hash_Update(STM32_HASH_Context* stmCtx, word32 algo,
 339    const byte* data, word32 len, word32 blockSize)
 340{
 341    int ret = 0;
 342    byte* local = (byte*)stmCtx->buffer;
 343    int wroteToFifo = 0;
 344    word32 chunkSz;
 345
 346#ifdef DEBUG_STM32_HASH
 347    printf("STM Hash Update: algo %x, len %d, buffLen %d, fifoBytes %d\n",
 348        algo, len, stmCtx->buffLen, stmCtx->fifoBytes);
 349#endif
 350    (void)blockSize;
 351
 352    /* check that internal buffLen is valid */
 353    if (stmCtx->buffLen > (word32)sizeof(stmCtx->buffer)) {
 354        return BUFFER_E;
 355    }
 356
 357    /* turn on hash clock */
 358    STM32_HASH_CLOCK_ENABLE(stmCtx);
 359
 360    /* restore hash context or init as new hash */
 361    wc_Stm32_Hash_RestoreContext(stmCtx, algo, HASH_ALGOMODE_HASH);
 362
 363    /* write blocks to FIFO */
 364    while (len) {
 365        word32 add;
 366
 367        chunkSz = blockSize;
 368        /* fill the FIFO plus one additional to flush the first block */
 369        if (!stmCtx->fifoBytes) {
 370            chunkSz += STM32_HASH_REG_SIZE;
 371        }
 372
 373        add = min(len, chunkSz - stmCtx->buffLen);
 374        XMEMCPY(&local[stmCtx->buffLen], data, add);
 375
 376        stmCtx->buffLen += add;
 377        data            += add;
 378        len             -= add;
 379
 380        if (stmCtx->buffLen == chunkSz) {
 381            wc_Stm32_Hash_Data(stmCtx, stmCtx->buffLen);
 382            wroteToFifo = 1;
 383            stmCtx->fifoBytes += chunkSz;
 384        }
 385    }
 386
 387    if (wroteToFifo) {
 388        /* make sure hash operation is done */
 389        ret = wc_Stm32_Hash_WaitDataReady(stmCtx);
 390
 391        /* save hash state for next operation */
 392        wc_Stm32_Hash_SaveContext(stmCtx);
 393    }
 394
 395    /* turn off hash clock */
 396    STM32_HASH_CLOCK_DISABLE(stmCtx);
 397
 398    return ret;
 399}
 400
 401int wc_Stm32_Hash_Final(STM32_HASH_Context* stmCtx, word32 algo,
 402    byte* hash, word32 digestSize)
 403{
 404    int ret = 0;
 405
 406#ifdef DEBUG_STM32_HASH
 407    printf("STM Hash Final: algo %x, digestSz %d, buffLen %d, fifoBytes %d\n",
 408        algo, digestSize, stmCtx->buffLen, stmCtx->fifoBytes);
 409#endif
 410
 411    /* turn on hash clock */
 412    STM32_HASH_CLOCK_ENABLE(stmCtx);
 413
 414    /* restore hash context or init as new hash */
 415    wc_Stm32_Hash_RestoreContext(stmCtx, algo, HASH_ALGOMODE_HASH);
 416
 417    /* finish reading any trailing bytes into FIFO */
 418    if (stmCtx->buffLen > 0) {
 419        /* send remainder of data */
 420        wc_Stm32_Hash_Data(stmCtx, stmCtx->buffLen);
 421    }
 422
 423    /* calculate number of valid bits in last word */
 424    wc_Stm32_Hash_NumValidBits(stmCtx->loLen + stmCtx->buffLen);
 425
 426    /* start hash processor */
 427    HASH->STR |= HASH_STR_DCAL;
 428
 429    /* wait for hash done */
 430    ret = wc_Stm32_Hash_WaitCalcComp(stmCtx);
 431    if (ret == 0) {
 432        /* read message digest */
 433        wc_Stm32_Hash_GetDigest(hash, digestSize);
 434    }
 435
 436    /* turn off hash clock */
 437    STM32_HASH_CLOCK_DISABLE(stmCtx);
 438
 439    return ret;
 440}
 441
 442#if defined(STM32_HMAC) && !defined(NO_HMAC)
 443
 444/* STM32 Port HMAC Functions */
 445#include <wolfssl/wolfcrypt/hmac.h>
 446
 447int wc_Stm32_Hmac_GetAlgoInfo(int macType, word32* algo, word32* blockSize,
 448    word32* digestSize)
 449{
 450    int ret = 0;
 451
 452    switch (macType) {
 453    #if !defined(NO_MD5) && !defined(STM32_NOMD5)
 454        case WC_MD5:
 455            if (algo)       *algo = HASH_AlgoSelection_MD5;
 456            if (blockSize)  *blockSize = WC_MD5_BLOCK_SIZE;
 457            if (digestSize) *digestSize = WC_MD5_DIGEST_SIZE;
 458            break;
 459    #endif
 460    #ifndef NO_SHA
 461        case WC_SHA:
 462            if (algo)       *algo = HASH_AlgoSelection_SHA1;
 463            if (blockSize)  *blockSize = WC_SHA_BLOCK_SIZE;
 464            if (digestSize) *digestSize = WC_SHA_DIGEST_SIZE;
 465            break;
 466    #endif
 467    #ifdef WOLFSSL_SHA224
 468        case WC_SHA224:
 469            if (algo)       *algo = HASH_AlgoSelection_SHA224;
 470            if (blockSize)  *blockSize = WC_SHA224_BLOCK_SIZE;
 471            if (digestSize) *digestSize = WC_SHA224_DIGEST_SIZE;
 472            break;
 473    #endif
 474    #ifndef NO_SHA256
 475        case WC_SHA256:
 476            if (algo)       *algo = HASH_AlgoSelection_SHA256;
 477            if (blockSize)  *blockSize = WC_SHA256_BLOCK_SIZE;
 478            if (digestSize) *digestSize = WC_SHA256_DIGEST_SIZE;
 479            break;
 480    #endif
 481    #if defined(STM32_HASH_SHA384) && defined(WOLFSSL_SHA384)
 482        case WC_SHA384:
 483            if (algo)       *algo = HASH_ALGOSELECTION_SHA384;
 484            if (blockSize)  *blockSize = WC_SHA384_BLOCK_SIZE;
 485            if (digestSize) *digestSize = WC_SHA384_DIGEST_SIZE;
 486            break;
 487    #endif
 488    #if defined(STM32_HASH_SHA512) && defined(WOLFSSL_SHA512)
 489        case WC_SHA512:
 490            if (algo)       *algo = HASH_ALGOSELECTION_SHA512;
 491            if (blockSize)  *blockSize = WC_SHA512_BLOCK_SIZE;
 492            if (digestSize) *digestSize = WC_SHA512_DIGEST_SIZE;
 493            break;
 494    #endif
 495        default:
 496            ret = BAD_FUNC_ARG;
 497            break;
 498    }
 499
 500    return ret;
 501}
 502
 503static void wc_Stm32_Hmac_FeedKey(const byte* key, word32 keySz)
 504{
 505    word32 i, blocks;
 506    word32 tmp;
 507
 508    /* feed key words into HASH->DIN */
 509    blocks = keySz / STM32_HASH_REG_SIZE;
 510    for (i = 0; i < blocks; i++) {
 511        XMEMCPY(&tmp, key + (i * STM32_HASH_REG_SIZE), STM32_HASH_REG_SIZE);
 512        HASH->DIN = tmp;
 513    }
 514    /* handle remaining bytes in last partial word */
 515    if (keySz % STM32_HASH_REG_SIZE) {
 516        tmp = 0;
 517        XMEMCPY(&tmp, key + (blocks * STM32_HASH_REG_SIZE),
 518            keySz % STM32_HASH_REG_SIZE);
 519        HASH->DIN = tmp;
 520    }
 521    ForceZero(&tmp, sizeof(tmp));
 522
 523#ifdef DEBUG_STM32_HASH
 524    printf("STM HMAC FeedKey %d bytes\n", (int)keySz);
 525#endif
 526}
 527
 528
 529/* STM32 HMAC Exposed Functions */
 530
 531int wc_Stm32_Hmac_SetKey(STM32_HASH_Context* stmCtx, int macType,
 532    const byte* key, word32 keySz)
 533{
 534    int ret;
 535    word32 algo, blockSize, digestSize;
 536    word32 mode;
 537
 538    if (stmCtx == NULL || key == NULL)
 539        return BAD_FUNC_ARG;
 540
 541    ret = wc_Stm32_Hmac_GetAlgoInfo(macType, &algo, &blockSize, &digestSize);
 542    if (ret != 0)
 543        return ret;
 544
 545#ifdef DEBUG_STM32_HASH
 546    printf("STM HMAC SetKey: macType %d, keySz %d\n", macType, (int)keySz);
 547#endif
 548
 549    /* clear context for fresh HMAC */
 550    wc_Stm32_Hash_Init(stmCtx);
 551
 552    /* turn on hash clock */
 553    STM32_HASH_CLOCK_ENABLE(stmCtx);
 554
 555    /* initialize hardware for HMAC mode.
 556     * Keys are always pre-hashed in software before reaching this point
 557     * (see hmac.c), so keySz will always be <= blockSize here. */
 558    mode = HASH_ALGOMODE_HMAC;
 559    wc_Stm32_Hash_RestoreContext(stmCtx, algo, mode);
 560
 561    /* Phase 1: Feed key into HASH->DIN */
 562    wc_Stm32_Hmac_FeedKey(key, keySz);
 563
 564    /* set number of valid bits in last word and trigger DCAL */
 565    wc_Stm32_Hash_NumValidBits(keySz);
 566    HASH->STR |= HASH_STR_DCAL;
 567
 568    /* wait for data input ready (phase 1 complete) */
 569    ret = wc_Stm32_Hash_WaitDataReady(stmCtx);
 570
 571    if (ret == 0) {
 572        /* save context for context switching */
 573        wc_Stm32_Hash_SaveContext(stmCtx);
 574    }
 575
 576    /* turn off hash clock */
 577    STM32_HASH_CLOCK_DISABLE(stmCtx);
 578
 579    return ret;
 580}
 581
 582int wc_Stm32_Hmac_Final(STM32_HASH_Context* stmCtx, word32 algo,
 583    const byte* key, word32 keySz, byte* hash, word32 digestSize)
 584{
 585    int ret;
 586
 587    if (stmCtx == NULL || key == NULL || hash == NULL)
 588        return BAD_FUNC_ARG;
 589
 590#ifdef DEBUG_STM32_HASH
 591    printf("STM HMAC Final: algo %x, keySz %d, buffLen %d, fifoBytes %d\n",
 592        (unsigned int)algo, (int)keySz, (int)stmCtx->buffLen,
 593        (int)stmCtx->fifoBytes);
 594#endif
 595
 596    /* turn on hash clock */
 597    STM32_HASH_CLOCK_ENABLE(stmCtx);
 598
 599    /* restore HMAC context */
 600    wc_Stm32_Hash_RestoreContext(stmCtx, algo, HASH_ALGOMODE_HMAC);
 601
 602    /* finish reading any trailing bytes into FIFO */
 603    if (stmCtx->buffLen > 0) {
 604        wc_Stm32_Hash_Data(stmCtx, stmCtx->buffLen);
 605    }
 606
 607    /* Phase 2 complete: set valid bits and trigger DCAL */
 608    wc_Stm32_Hash_NumValidBits(stmCtx->loLen + stmCtx->buffLen);
 609    HASH->STR |= HASH_STR_DCAL;
 610
 611    /* wait for data input ready (phase 2 complete, ready for phase 3) */
 612    ret = wc_Stm32_Hash_WaitDataReady(stmCtx);
 613    if (ret != 0) {
 614        STM32_HASH_CLOCK_DISABLE(stmCtx);
 615        return ret;
 616    }
 617
 618    /* Phase 3: Feed key again into HASH->DIN */
 619    wc_Stm32_Hmac_FeedKey(key, keySz);
 620
 621    /* set valid bits for key and trigger DCAL */
 622    wc_Stm32_Hash_NumValidBits(keySz);
 623    HASH->STR |= HASH_STR_DCAL;
 624
 625    /* wait for hash done (digest computation complete) */
 626    ret = wc_Stm32_Hash_WaitCalcComp(stmCtx);
 627    if (ret == 0) {
 628        /* read message digest */
 629        wc_Stm32_Hash_GetDigest(hash, digestSize);
 630    }
 631
 632    /* turn off hash clock */
 633    STM32_HASH_CLOCK_DISABLE(stmCtx);
 634
 635    return ret;
 636}
 637
 638#endif /* STM32_HMAC && !NO_HMAC */
 639
 640#endif /* STM32_HASH */
 641
 642
 643#ifdef STM32_CRYPTO
 644
 645#ifndef NO_AES
 646#ifdef WOLFSSL_STM32_CUBEMX
 647
 648#if defined(WOLFSSL_STM32U5_DHUK)
 649/* Set the DHUK IV to be used when unwrapping an AES key
 650 * return 0 on success */
 651int wc_Stm32_Aes_SetDHUK_IV(struct Aes* aes, const byte* iv, int ivSz)
 652{
 653    if (ivSz != sizeof(aes->dhukIV)) {
 654        return BAD_FUNC_ARG;
 655    }
 656
 657    XMEMCPY(aes->dhukIV, iv, ivSz);
 658    aes->dhukIVLen = ivSz;
 659    return 0;
 660}
 661
 662/* Wrap an AES key using the DHUK */
 663int wc_Stm32_Aes_Wrap(struct Aes* aes, const byte* in, word32 inSz, byte* out,
 664    word32* outSz, const byte* iv, int ivSz)
 665{
 666    CRYP_HandleTypeDef hcryp;
 667    int ret = 0;
 668    byte key[AES_256_KEY_SIZE];
 669
 670    /* SAES requires use of the RNG -- HAL_RNG_DeInit() calls from random.c
 671        turn off the RNG clock -- re-enable the clock here */
 672    __HAL_RCC_RNG_CLK_ENABLE();
 673    ByteReverseWords((word32*)key, (word32*)in, inSz);
 674    XMEMSET(&hcryp, 0, sizeof(CRYP_HandleTypeDef));
 675    if (ret == 0) {
 676        hcryp.Instance       = SAES;
 677        hcryp.Init.DataType  = CRYP_DATATYPE_8B;
 678        hcryp.Init.KeySize   = CRYP_KEYSIZE_256B;
 679        hcryp.Init.DataWidthUnit = CRYP_DATAWIDTHUNIT_BYTE;
 680        hcryp.Init.KeySelect = CRYP_KEYSEL_HW; /* use DHUK to unwrap with use */
 681        hcryp.Init.KeyMode   = CRYP_KEYMODE_WRAPPED;
 682        if (iv != NULL) {
 683            hcryp.Init.pInitVect = (uint32_t *)iv;
 684            hcryp.Init.Algorithm = CRYP_AES_CBC;
 685        }
 686        else {
 687            hcryp.Init.Algorithm = CRYP_AES_ECB;
 688        }
 689        ret = HAL_CRYP_Init(&hcryp);
 690    }
 691
 692    if (ret == HAL_OK) {
 693        ret = HAL_CRYPEx_WrapKey(&hcryp, (uint32_t*)key, (uint32_t*)out, 100);
 694        HAL_CRYP_DeInit(&hcryp);
 695    }
 696    ForceZero(key, sizeof(key));
 697
 698    ByteReverseWords((word32*)out, (word32*)out, inSz);
 699    *outSz = inSz;
 700    (void)aes;
 701    return ret;
 702}
 703
 704
 705int wc_Stm32_Aes_UnWrap(struct Aes* aes, CRYP_HandleTypeDef* hcryp,
 706        const byte* in, word32 inSz, const byte* iv, int ivSz)
 707{
 708    int ret = 0;
 709
 710    /* SAES requires use of the RNG -- HAL_RNG_DeInit() calls from random.c
 711    turn off the RNG clock -- re-enable the clock here */
 712    __HAL_RCC_RNG_CLK_ENABLE();
 713
 714    /* setup for key unwrapping */
 715    XMEMSET(hcryp, 0, sizeof(CRYP_HandleTypeDef));
 716    hcryp->Instance       = SAES;
 717    hcryp->Init.DataType  = CRYP_DATATYPE_8B;
 718    hcryp->Init.KeySize   = CRYP_KEYSIZE_256B;
 719    hcryp->Init.DataWidthUnit = CRYP_DATAWIDTHUNIT_BYTE;
 720    if (ivSz > 0 && iv != NULL) {
 721        hcryp->Init.pInitVect = (uint32_t *)iv;
 722        hcryp->Init.Algorithm = CRYP_AES_CBC;
 723    }
 724    else {
 725        hcryp->Init.Algorithm = CRYP_AES_ECB;
 726    }
 727    hcryp->Init.KeyIVConfigSkip = CRYP_KEYIVCONFIG_ALWAYS;
 728    hcryp->Init.KeySelect = CRYP_KEYSEL_HW; /* use DHUK to unwrap with use */
 729    hcryp->Init.KeyMode   = CRYP_KEYMODE_WRAPPED;
 730    ret = HAL_CRYP_Init(hcryp);
 731    if (ret == HAL_OK) {
 732        /* On success the key is placed into a location where the next encrypt/decrypt
 733         * calls using hcryp make use of the key */
 734        ret = HAL_CRYPEx_UnwrapKey(hcryp, (uint32_t*)in, 100);
 735    }
 736    return ret;
 737}
 738
 739#endif
 740
 741int wc_Stm32_Aes_Init(Aes* aes, CRYP_HandleTypeDef* hcryp, int useSaes)
 742{
 743    int ret;
 744    word32 keySize;
 745#ifdef STM32_HW_CLOCK_AUTO
 746    /* enable the peripheral clock */
 747    __HAL_RCC_CRYP_CLK_ENABLE();
 748#endif
 749
 750    ret = wc_AesGetKeySize(aes, &keySize);
 751    if (ret != 0)
 752        return ret;
 753
 754    XMEMSET(hcryp, 0, sizeof(CRYP_HandleTypeDef));
 755    switch (keySize) {
 756        case 16: /* 128-bit key */
 757            hcryp->Init.KeySize = CRYP_KEYSIZE_128B;
 758            break;
 759    #ifdef CRYP_KEYSIZE_192B
 760        case 24: /* 192-bit key */
 761            hcryp->Init.KeySize = CRYP_KEYSIZE_192B;
 762            break;
 763    #endif
 764        case 32: /* 256-bit key */
 765            hcryp->Init.KeySize = CRYP_KEYSIZE_256B;
 766            break;
 767        default:
 768            break;
 769    }
 770
 771#ifdef WOLFSSL_STM32U5_DHUK
 772    /* Use hardware key */
 773    if (useSaes && (aes->devId == WOLFSSL_STM32U5_DHUK_DEVID ||
 774            aes->devId == WOLFSSL_STM32U5_SAES_DEVID)) {
 775
 776            /* SAES requires use of the RNG -- HAL_RNG_DeInit() calls from
 777               random.c turn off the RNG clock -- re-enable the clock here */
 778            __HAL_RCC_RNG_CLK_ENABLE();
 779
 780            hcryp->Instance       = SAES;
 781            hcryp->Init.DataType  = CRYP_DATATYPE_8B;
 782
 783            /* Key select (HW, or Normal) */
 784            if (aes->devId == WOLFSSL_STM32U5_DHUK_DEVID) {
 785                hcryp->Init.KeySelect = CRYP_KEYSEL_HW;
 786            }
 787            else {
 788                hcryp->Init.KeySelect = CRYP_KEYSEL_NORMAL;
 789                hcryp->Init.KeyMode   = CRYP_KEYMODE_NORMAL;
 790                hcryp->Init.pKey      = (uint32_t*)aes->key;
 791            }
 792    } else
 793#endif
 794    {
 795        hcryp->Instance = CRYP;
 796        hcryp->Init.DataType = CRYP_DATATYPE_8B;
 797        hcryp->Init.pKey = (STM_CRYPT_TYPE*)aes->key;
 798    }
 799#ifdef STM32_HAL_V2
 800    hcryp->Init.DataWidthUnit = CRYP_DATAWIDTHUNIT_BYTE;
 801    #if defined(CRYP_HEADERWIDTHUNIT_BYTE) && defined(STM_CRYPT_HEADER_WIDTH)
 802    hcryp->Init.HeaderWidthUnit =
 803            (STM_CRYPT_HEADER_WIDTH == 4) ?
 804                CRYP_HEADERWIDTHUNIT_WORD :
 805                CRYP_HEADERWIDTHUNIT_BYTE;
 806    #endif
 807#endif
 808
 809    return 0;
 810}
 811
 812void wc_Stm32_Aes_Cleanup(void)
 813{
 814#ifdef STM32_HW_CLOCK_AUTO
 815    /* disable the peripheral clock */
 816    __HAL_RCC_CRYP_CLK_DISABLE();
 817#endif
 818}
 819#else /* Standard Peripheral Library */
 820
 821int wc_Stm32_Aes_Init(Aes* aes, CRYP_InitTypeDef* cryptInit,
 822    CRYP_KeyInitTypeDef* keyInit)
 823{
 824    int ret;
 825    word32 keySize;
 826    word32* aes_key;
 827
 828    ret = wc_AesGetKeySize(aes, &keySize);
 829    if (ret != 0)
 830        return ret;
 831
 832    aes_key = aes->key;
 833
 834    /* crypto structure initialization */
 835    CRYP_KeyStructInit(keyInit);
 836    CRYP_StructInit(cryptInit);
 837
 838    /* load key into correct registers */
 839    switch (keySize) {
 840        case 16: /* 128-bit key */
 841            cryptInit->CRYP_KeySize = CRYP_KeySize_128b;
 842            keyInit->CRYP_Key2Left  = aes_key[0];
 843            keyInit->CRYP_Key2Right = aes_key[1];
 844            keyInit->CRYP_Key3Left  = aes_key[2];
 845            keyInit->CRYP_Key3Right = aes_key[3];
 846            break;
 847
 848        case 24: /* 192-bit key */
 849            cryptInit->CRYP_KeySize = CRYP_KeySize_192b;
 850            keyInit->CRYP_Key1Left  = aes_key[0];
 851            keyInit->CRYP_Key1Right = aes_key[1];
 852            keyInit->CRYP_Key2Left  = aes_key[2];
 853            keyInit->CRYP_Key2Right = aes_key[3];
 854            keyInit->CRYP_Key3Left  = aes_key[4];
 855            keyInit->CRYP_Key3Right = aes_key[5];
 856            break;
 857
 858        case 32: /* 256-bit key */
 859            cryptInit->CRYP_KeySize = CRYP_KeySize_256b;
 860            keyInit->CRYP_Key0Left  = aes_key[0];
 861            keyInit->CRYP_Key0Right = aes_key[1];
 862            keyInit->CRYP_Key1Left  = aes_key[2];
 863            keyInit->CRYP_Key1Right = aes_key[3];
 864            keyInit->CRYP_Key2Left  = aes_key[4];
 865            keyInit->CRYP_Key2Right = aes_key[5];
 866            keyInit->CRYP_Key3Left  = aes_key[6];
 867            keyInit->CRYP_Key3Right = aes_key[7];
 868            break;
 869
 870        default:
 871            break;
 872    }
 873    cryptInit->CRYP_DataType = CRYP_DataType_8b;
 874
 875    return 0;
 876}
 877
 878void wc_Stm32_Aes_Cleanup(void)
 879{
 880}
 881#endif /* WOLFSSL_STM32_CUBEMX */
 882#endif /* !NO_AES */
 883#endif /* STM32_CRYPTO */
 884
 885#ifdef WOLFSSL_STM32_PKA
 886
 887/* Reverse array in memory (in place) */
 888#ifdef HAVE_ECC
 889
 890/* convert from mp_int to STM32 PKA HAL integer, as array of bytes of size sz.
 891 * if mp_int has less bytes than sz, add zero bytes at most significant byte
 892 * positions.
 893 * This is when for example modulus is 32 bytes (P-256 curve)
 894 * and mp_int has only 31 bytes, we add leading zeros
 895 * so that result array has 32 bytes, same as modulus (sz).
 896 */
 897static int stm32_get_from_mp_int(uint8_t *dst, const mp_int *a, int sz)
 898{
 899    int res, szbin, offset;
 900
 901    if (dst == NULL || a == NULL || sz < 0)
 902        return BAD_FUNC_ARG;
 903
 904    /* check how many bytes are in the mp_int */
 905    szbin = mp_unsigned_bin_size(a);
 906    if (szbin < 0 || szbin > sz)
 907        return BUFFER_E;
 908
 909    /* compute offset from dst */
 910    offset = sz - szbin;
 911    if (offset < 0)
 912        offset = 0;
 913    if (offset > sz)
 914        offset = sz;
 915
 916    /* add leading zeroes */
 917    if (offset)
 918        XMEMSET(dst, 0, offset);
 919
 920    /* convert mp_int to array of bytes */
 921    res = mp_to_unsigned_bin(a, dst + offset);
 922    return res;
 923}
 924
 925static int stm32_getabs_from_mp_int(uint8_t *dst, const mp_int *a, int sz,
 926    uint32_t* abs_sign)
 927{
 928    int res;
 929    mp_int x;
 930
 931    if (dst == NULL || a == NULL || sz < 0 || abs_sign == NULL)
 932        return BAD_FUNC_ARG;
 933
 934    res = mp_init(&x);
 935    if (res == MP_OKAY) {
 936        /* make abs(x) and capture sign */
 937    #if defined(USE_FAST_MATH) || defined(USE_INTEGER_HEAP_MATH) || \
 938        ((defined(WOLFSSL_SP_MATH) || defined(WOLFSSL_SP_MATH_ALL)) && \
 939            defined(WOLFSSL_SP_INT_NEGATIVE))
 940        *abs_sign = x.sign;
 941    #else
 942        *abs_sign = 1; /* default to negative */
 943    #endif
 944        res = mp_abs((mp_int*)a, &x);
 945        if (res == MP_OKAY)
 946            res = stm32_get_from_mp_int(dst, &x, sz);
 947        mp_clear(&x);
 948    }
 949    return res;
 950}
 951
 952/* convert hex string to unsigned char */
 953static int stm32_getabs_from_hexstr(const char* hex, uint8_t* dst, int sz,
 954    uint32_t *abs_sign)
 955{
 956    int res;
 957    mp_int x;
 958
 959    if (hex == NULL || dst == NULL || sz < 0)
 960        return BAD_FUNC_ARG;
 961
 962    res = mp_init(&x);
 963    if (res == MP_OKAY) {
 964        res = mp_read_radix(&x, hex, MP_RADIX_HEX);
 965        /* optionally make abs(x) and capture sign */
 966        if (res == MP_OKAY && abs_sign != NULL) {
 967        #if defined(USE_FAST_MATH) || defined(USE_INTEGER_HEAP_MATH) || \
 968            ((defined(WOLFSSL_SP_MATH) || defined(WOLFSSL_SP_MATH_ALL)) && \
 969                defined(WOLFSSL_SP_INT_NEGATIVE))
 970            *abs_sign = x.sign;
 971        #else
 972            *abs_sign = 1; /* default to negative */
 973        #endif
 974            res = mp_abs(&x, &x);
 975        }
 976        if (res == MP_OKAY)
 977            res = stm32_get_from_mp_int(dst, &x, sz);
 978        mp_clear(&x);
 979    }
 980    return res;
 981}
 982static int stm32_get_from_hexstr(const char* hex, uint8_t* dst, int sz)
 983{
 984    return stm32_getabs_from_hexstr(hex, dst, sz, NULL);
 985}
 986
 987/* STM32 PKA supports up to 640-bit numbers */
 988#define STM32_MAX_ECC_SIZE (80)
 989
 990#ifdef WOLFSSL_STM32_PKA_V2
 991/* find curve based on prime/modulus and return order/coefB */
 992static int stm32_get_curve_params(mp_int* modulus,
 993    uint8_t* order, uint8_t* coefB)
 994{
 995    int res, i, found = 0;
 996    mp_int modulusChk;
 997    res = mp_init(&modulusChk);
 998    if (res != MP_OKAY)
 999        return res;
1000    for (i = 0; ecc_sets[i].size != 0 && ecc_sets[i].name != NULL; i++) {
1001        const ecc_set_type* curve = &ecc_sets[i];
1002        /* match based on curve prime */
1003        if ((res = mp_read_radix(&modulusChk, curve->prime, MP_RADIX_HEX)) ==
1004                MP_OKAY && (mp_cmp(modulus, &modulusChk) == MP_EQ))
1005        {
1006            found = 1;
1007            if (order) {
1008                res = stm32_get_from_hexstr(curve->order, order, curve->size);
1009            }
1010            if (coefB) {
1011                res = stm32_get_from_hexstr(curve->Bf, coefB, curve->size);
1012            }
1013            break;
1014        }
1015    }
1016    mp_clear(&modulusChk);
1017    if (!found && res == MP_OKAY) {
1018        res = MP_RANGE;
1019    }
1020    return res;
1021}
1022#endif /* WOLFSSL_STM32_PKA_V2 */
1023
1024
1025/**
1026   Perform a point multiplication  (timing resistant)
1027   k    The scalar to multiply by
1028   G    The base point
1029   R    [out] Destination for kG
1030   a    ECC curve parameter a
1031   modulus  The modulus of the field the ECC curve is in
1032   order    curve order
1033   rng      Random Generator struct (not used)
1034   map      Boolean whether to map back to affine or not
1035                (1==map, 0 == leave in projective)
1036   return MP_OKAY on success
1037*/
1038
1039int wc_ecc_mulmod_ex2(const mp_int* k, ecc_point *G, ecc_point *R, mp_int* a,
1040                      mp_int* modulus, mp_int* o, WC_RNG* rng, int map,
1041                      void* heap)
1042{
1043    PKA_ECCMulInTypeDef pka_mul;
1044    PKA_ECCMulOutTypeDef pka_mul_res;
1045    int szModulus;
1046    int status;
1047    int res;
1048    uint8_t Gxbin[STM32_MAX_ECC_SIZE];
1049    uint8_t Gybin[STM32_MAX_ECC_SIZE];
1050    uint8_t kbin[STM32_MAX_ECC_SIZE];
1051    uint8_t PtXbin[STM32_MAX_ECC_SIZE];
1052    uint8_t PtYbin[STM32_MAX_ECC_SIZE];
1053    uint8_t prime[STM32_MAX_ECC_SIZE];
1054    uint8_t coefA[STM32_MAX_ECC_SIZE];
1055#ifdef WOLFSSL_STM32_PKA_V2
1056    uint8_t coefB[STM32_MAX_ECC_SIZE];
1057    uint8_t order[STM32_MAX_ECC_SIZE];
1058#endif
1059    uint32_t coefA_sign = 1;
1060
1061    (void)rng;
1062
1063    XMEMSET(&pka_mul, 0x00, sizeof(PKA_ECCMulInTypeDef));
1064    XMEMSET(&pka_mul_res, 0x00, sizeof(PKA_ECCMulOutTypeDef));
1065    pka_mul_res.ptX = PtXbin;
1066    pka_mul_res.ptY = PtYbin;
1067
1068    if (k == NULL || G == NULL || R == NULL || modulus == NULL) {
1069        return ECC_BAD_ARG_E;
1070    }
1071
1072    szModulus = mp_unsigned_bin_size(modulus);
1073
1074    res = stm32_get_from_mp_int(kbin, k, szModulus);
1075    if (res == MP_OKAY)
1076        res = stm32_get_from_mp_int(Gxbin, G->x, szModulus);
1077    if (res == MP_OKAY)
1078        res = stm32_get_from_mp_int(Gybin, G->y, szModulus);
1079    if (res == MP_OKAY)
1080        res = stm32_get_from_mp_int(prime, modulus, szModulus);
1081    if (res == MP_OKAY)
1082        res = stm32_getabs_from_mp_int(coefA, a, szModulus, &coefA_sign);
1083#ifdef WOLFSSL_STM32_PKA_V2
1084    XMEMSET(order, 0, sizeof(order));
1085    XMEMSET(coefB, 0, sizeof(coefB));
1086    if (res == MP_OKAY) {
1087        if (o != NULL) {
1088            /* use provided order and get coefB */
1089            res = stm32_get_from_mp_int(order, o, szModulus);
1090            if (res == MP_OKAY) {
1091                res = stm32_get_curve_params(modulus, NULL, coefB);
1092            }
1093        }
1094        else {
1095            /* get order and coefB for matching prime */
1096            res = stm32_get_curve_params(modulus, order, coefB);
1097        }
1098    }
1099#endif
1100    if (res != MP_OKAY) {
1101        ForceZero(kbin, sizeof(kbin));
1102        return res;
1103    }
1104
1105    pka_mul.modulusSize = szModulus;
1106    pka_mul.coefSign = coefA_sign;
1107    pka_mul.coefA = coefA;
1108    pka_mul.modulus = prime;
1109    pka_mul.pointX = Gxbin;
1110    pka_mul.pointY = Gybin;
1111    pka_mul.scalarMulSize = szModulus;
1112    pka_mul.scalarMul = kbin;
1113#ifdef WOLFSSL_STM32_PKA_V2
1114    pka_mul.coefB = coefB;
1115    pka_mul.primeOrder = order;
1116#endif
1117
1118    status = HAL_PKA_ECCMul(&hpka, &pka_mul, HAL_MAX_DELAY);
1119    if (status != HAL_OK) {
1120        ForceZero(kbin, sizeof(kbin));
1121        HAL_PKA_RAMReset(&hpka);
1122        return WC_HW_E;
1123    }
1124    pka_mul_res.ptX = Gxbin;
1125    pka_mul_res.ptY = Gybin;
1126    HAL_PKA_ECCMul_GetResult(&hpka, &pka_mul_res);
1127    ForceZero(kbin, sizeof(kbin));
1128    res = mp_read_unsigned_bin(R->x, Gxbin, szModulus);
1129    if (res == MP_OKAY) {
1130        res = mp_read_unsigned_bin(R->y, Gybin, szModulus);
1131
1132#if defined(USE_FAST_MATH) || defined(USE_INTEGER_HEAP_MATH) || \
1133    ((defined(WOLFSSL_SP_MATH) || defined(WOLFSSL_SP_MATH_ALL)) && \
1134        defined(WOLFSSL_SP_INT_NEGATIVE))
1135        /* if k is negative, we compute the multiplication with abs(-k)
1136         * with result (x, y) and modify the result to (x, -y)
1137         */
1138        R->y->sign = k->sign;
1139#endif
1140    }
1141    if (res == MP_OKAY)
1142        res = mp_set(R->z, 1);
1143    HAL_PKA_RAMReset(&hpka);
1144
1145    (void)heap;
1146
1147    return res;
1148}
1149
1150int wc_ecc_mulmod_ex(const mp_int *k, ecc_point *G, ecc_point *R, mp_int* a,
1151    mp_int *modulus, int map, void* heap)
1152{
1153    return wc_ecc_mulmod_ex2(k, G, R, a, modulus, NULL, NULL, map, heap);
1154}
1155
1156int ecc_map_ex(ecc_point* P, mp_int* modulus, mp_digit mp, int ct)
1157{
1158    /* this is handled in hardware, so no projective mapping needed */
1159    (void)P;
1160    (void)modulus;
1161    (void)mp;
1162    (void)ct;
1163    return MP_OKAY;
1164}
1165
1166int stm32_ecc_verify_hash_ex(mp_int *r, mp_int *s, const byte* hash,
1167                    word32 hashlen, int* res, ecc_key* key)
1168{
1169    PKA_ECDSAVerifInTypeDef pka_ecc;
1170    int size;
1171    int status;
1172    uint8_t Rbin[STM32_MAX_ECC_SIZE];
1173    uint8_t Sbin[STM32_MAX_ECC_SIZE];
1174    uint8_t Qxbin[STM32_MAX_ECC_SIZE];
1175    uint8_t Qybin[STM32_MAX_ECC_SIZE];
1176    uint8_t Hashbin[STM32_MAX_ECC_SIZE];
1177    uint8_t prime[STM32_MAX_ECC_SIZE];
1178    uint8_t coefA[STM32_MAX_ECC_SIZE];
1179    uint8_t gen_x[STM32_MAX_ECC_SIZE];
1180    uint8_t gen_y[STM32_MAX_ECC_SIZE];
1181    uint8_t order[STM32_MAX_ECC_SIZE];
1182    uint32_t coefA_sign = 1;
1183
1184    XMEMSET(&pka_ecc, 0x00, sizeof(PKA_ECDSAVerifInTypeDef));
1185
1186    if (r == NULL || s == NULL || hash == NULL || res == NULL || key == NULL ||
1187            key->dp == NULL) {
1188        return ECC_BAD_ARG_E;
1189    }
1190    *res = 0; /* default to failure */
1191    size = wc_ecc_size(key); /* get key size in bytes */
1192
1193    /* load R/S and public X/Y using key size */
1194    status = stm32_get_from_mp_int(Rbin, r, size);
1195    if (status == MP_OKAY)
1196        status = stm32_get_from_mp_int(Sbin, s, size);
1197    if (status == MP_OKAY)
1198        status = stm32_get_from_mp_int(Qxbin, key->pubkey.x, size);
1199    if (status == MP_OKAY)
1200        status = stm32_get_from_mp_int(Qybin, key->pubkey.y, size);
1201    if (status != MP_OKAY)
1202        return status;
1203
1204
1205    /* find parameters for the selected curve */
1206    status = stm32_get_from_hexstr(key->dp->prime, prime, size);
1207    if (status == MP_OKAY)
1208        status = stm32_get_from_hexstr(key->dp->order, order, size);
1209    if (status == MP_OKAY)
1210        status = stm32_get_from_hexstr(key->dp->Gx, gen_x, size);
1211    if (status == MP_OKAY)
1212        status = stm32_get_from_hexstr(key->dp->Gy, gen_y, size);
1213    if (status == MP_OKAY)
1214        status = stm32_getabs_from_hexstr(key->dp->Af, coefA, size, &coefA_sign);
1215    if (status != MP_OKAY)
1216        return status;
1217
1218    pka_ecc.primeOrderSize =  size;
1219    pka_ecc.modulusSize =     size;
1220    pka_ecc.coefSign =        coefA_sign;
1221    pka_ecc.coef =            coefA;
1222    pka_ecc.modulus =         prime;
1223    pka_ecc.basePointX =      gen_x;
1224    pka_ecc.basePointY =      gen_y;
1225    pka_ecc.primeOrder =      order;
1226    pka_ecc.pPubKeyCurvePtX = Qxbin;
1227    pka_ecc.pPubKeyCurvePtY = Qybin;
1228    pka_ecc.RSign =           Rbin;
1229    pka_ecc.SSign =           Sbin;
1230
1231    XMEMSET(Hashbin, 0, STM32_MAX_ECC_SIZE);
1232    if (hashlen > STM32_MAX_ECC_SIZE) {
1233        return ECC_BAD_ARG_E;
1234    }
1235    else if ((int)hashlen > size) {
1236        /* in the case that hashlen is larger than key size place hash at
1237         * beginning of buffer */
1238        XMEMCPY(Hashbin, hash, size);
1239    }
1240    else {
1241        /* in all other cases where hashlen is equal to or less than the key
1242         * size pad the Hashbin buffer with leading zero's */
1243        XMEMCPY(Hashbin + (size - hashlen), hash, hashlen);
1244    }
1245    pka_ecc.hash =            Hashbin;
1246
1247    status = HAL_PKA_ECDSAVerif(&hpka, &pka_ecc, HAL_MAX_DELAY);
1248    if (status != HAL_OK) {
1249        HAL_PKA_RAMReset(&hpka);
1250        return WC_HW_E;
1251    }
1252    *res = HAL_PKA_ECDSAVerif_IsValidSignature(&hpka);
1253    HAL_PKA_RAMReset(&hpka);
1254    return status;
1255}
1256
1257int stm32_ecc_sign_hash_ex(const byte* hash, word32 hashlen, WC_RNG* rng,
1258                     ecc_key* key, mp_int *r, mp_int *s)
1259{
1260    PKA_ECDSASignInTypeDef pka_ecc;
1261    PKA_ECDSASignOutTypeDef pka_ecc_out;
1262    int size;
1263    int status;
1264    mp_int gen_k;
1265    mp_int order_mp;
1266    uint8_t Keybin[STM32_MAX_ECC_SIZE];
1267    uint8_t Intbin[STM32_MAX_ECC_SIZE];
1268    uint8_t Rbin[STM32_MAX_ECC_SIZE];
1269    uint8_t Sbin[STM32_MAX_ECC_SIZE];
1270    uint8_t Hashbin[STM32_MAX_ECC_SIZE];
1271    uint8_t prime[STM32_MAX_ECC_SIZE];
1272    uint8_t coefA[STM32_MAX_ECC_SIZE];
1273#ifdef WOLFSSL_STM32_PKA_V2
1274    uint8_t coefB[STM32_MAX_ECC_SIZE];
1275#endif
1276    uint8_t gen_x[STM32_MAX_ECC_SIZE];
1277    uint8_t gen_y[STM32_MAX_ECC_SIZE];
1278    uint8_t order[STM32_MAX_ECC_SIZE];
1279    uint32_t coefA_sign = 1;
1280
1281    XMEMSET(&pka_ecc, 0x00, sizeof(PKA_ECDSASignInTypeDef));
1282    XMEMSET(&pka_ecc_out, 0x00, sizeof(PKA_ECDSASignOutTypeDef));
1283
1284    if (r == NULL || s == NULL || hash == NULL || key == NULL ||
1285            key->dp == NULL) {
1286        return ECC_BAD_ARG_E;
1287    }
1288
1289    size = wc_ecc_size(key);
1290
1291    /* find parameters for the selected curve */
1292    status = stm32_get_from_hexstr(key->dp->prime, prime, size);
1293    if (status == MP_OKAY)
1294        status = stm32_get_from_hexstr(key->dp->order, order, size);
1295    if (status == MP_OKAY)
1296        status = stm32_get_from_hexstr(key->dp->Gx, gen_x, size);
1297    if (status == MP_OKAY)
1298        status = stm32_get_from_hexstr(key->dp->Gy, gen_y, size);
1299    if (status == MP_OKAY)
1300        status = stm32_getabs_from_hexstr(key->dp->Af, coefA, size, &coefA_sign);
1301#ifdef WOLFSSL_STM32_PKA_V2
1302    if (status == MP_OKAY)
1303        status = stm32_get_from_hexstr(key->dp->Bf, coefB, size);
1304#endif
1305    if (status != MP_OKAY)
1306        return status;
1307
1308    /* generate random part of "k" */
1309    mp_init(&gen_k);
1310    mp_init(&order_mp);
1311    status = mp_read_unsigned_bin(&order_mp, order, size);
1312    if (status == MP_OKAY)
1313        status = wc_ecc_gen_k(rng, size, &gen_k, &order_mp);
1314    if (status == MP_OKAY)
1315        status = stm32_get_from_mp_int(Intbin, &gen_k, size);
1316    mp_clear(&gen_k);
1317    mp_clear(&order_mp);
1318    if (status != MP_OKAY) {
1319        ForceZero(Intbin, sizeof(Intbin));
1320        return status;
1321     }
1322
1323    /* get private part of "k" */
1324    status = stm32_get_from_mp_int(Keybin, wc_ecc_key_get_priv(key), size);
1325    if (status != MP_OKAY) {
1326        ForceZero(Keybin, sizeof(Keybin));
1327        ForceZero(Intbin, sizeof(Intbin));
1328        return status;
1329    }
1330
1331    pka_ecc.primeOrderSize =  size;
1332    pka_ecc.modulusSize =     size;
1333    pka_ecc.coefSign =        coefA_sign;
1334    pka_ecc.coef =            coefA;
1335#ifdef WOLFSSL_STM32_PKA_V2
1336    pka_ecc.coefB =           coefB;
1337#endif
1338    pka_ecc.modulus =         prime;
1339    pka_ecc.basePointX =      gen_x;
1340    pka_ecc.basePointY =      gen_y;
1341    pka_ecc.primeOrder =      order;
1342
1343    XMEMSET(Hashbin, 0, STM32_MAX_ECC_SIZE);
1344    if (hashlen > STM32_MAX_ECC_SIZE) {
1345        ForceZero(Keybin, sizeof(Keybin));
1346        ForceZero(Intbin, sizeof(Intbin));
1347        return ECC_BAD_ARG_E;
1348    }
1349    else if ((int)hashlen > size) {
1350        /* in the case that hashlen is larger than key size place hash at
1351         * beginning of buffer */
1352        XMEMCPY(Hashbin, hash, size);
1353    }
1354    else {
1355        /* in all other cases where hashlen is equal to or less than the key
1356         * size pad the Hashbin buffer with leading zero's */
1357        XMEMCPY(Hashbin + (size - hashlen), hash, hashlen);
1358    }
1359    pka_ecc.hash =            Hashbin;
1360    pka_ecc.integer =         Intbin;
1361    pka_ecc.privateKey =      Keybin;
1362
1363    /* Assign R, S static buffers */
1364    pka_ecc_out.RSign = Rbin;
1365    pka_ecc_out.SSign = Sbin;
1366
1367    status = HAL_PKA_ECDSASign(&hpka, &pka_ecc, HAL_MAX_DELAY);
1368    if (status != HAL_OK) {
1369        ForceZero(Keybin, sizeof(Keybin));
1370        ForceZero(Intbin, sizeof(Intbin));
1371        HAL_PKA_RAMReset(&hpka);
1372        return WC_HW_E;
1373    }
1374    HAL_PKA_ECDSASign_GetResult(&hpka, &pka_ecc_out, NULL);
1375    ForceZero(Keybin, sizeof(Keybin));
1376    ForceZero(Intbin, sizeof(Intbin));
1377    status = mp_read_unsigned_bin(r, pka_ecc_out.RSign, size);
1378    if (status == MP_OKAY)
1379        status = mp_read_unsigned_bin(s, pka_ecc_out.SSign, size);
1380    HAL_PKA_RAMReset(&hpka);
1381    return status;
1382}
1383
1384#endif /* HAVE_ECC */
1385#endif /* WOLFSSL_STM32_PKA */