luna - wolfssl/wolfcrypt/src/port/st/stsafe.c

   1/* stsafe.c
   2 *
   3 * Copyright (C) 2006-2026 wolfSSL Inc.
   4 *
   5 * This file is part of wolfSSL.
   6 *
   7 * wolfSSL is free software; you can redistribute it and/or modify
   8 * it under the terms of the GNU General Public License as published by
   9 * the Free Software Foundation; either version 3 of the License, or
  10 * (at your option) any later version.
  11 *
  12 * wolfSSL is distributed in the hope that it will be useful,
  13 * but WITHOUT ANY WARRANTY; without even the implied warranty of
  14 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
  15 * GNU General Public License for more details.
  16 *
  17 * You should have received a copy of the GNU General Public License
  18 * along with this program; if not, write to the Free Software
  19 * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1335, USA
  20 */
  21
  22#ifdef HAVE_CONFIG_H
  23    #include <config.h>
  24#endif
  25
  26#include <wolfssl/wolfcrypt/types.h>
  27#include <wolfssl/wolfcrypt/port/st/stsafe.h>
  28#include <wolfssl/wolfcrypt/logging.h>
  29#ifndef NO_ASN
  30    #include <wolfssl/wolfcrypt/asn.h>
  31#endif
  32
  33#ifndef STSAFE_INTERFACE_PRINTF
  34    #define STSAFE_INTERFACE_PRINTF(...) WC_DO_NOTHING
  35#endif
  36
  37/* Combined STSAFE macro - set in stsafe.h when either A100/A120 is defined */
  38#ifdef WOLFSSL_STSAFE
  39
  40/* ========================================================================== */
  41/* Internal Implementation (when NOT using external stsafe_interface.h)       */
  42/* ========================================================================== */
  43
  44/* When WOLFSSL_STSAFE_INTERFACE_EXTERNAL is defined, all internal
  45 * implementation is skipped and the customer provides their own
  46 * stsafe_interface.h with custom implementations. This maintains
  47 * backwards compatibility with older integration approaches. */
  48#ifndef WOLFSSL_STSAFE_INTERFACE_EXTERNAL
  49
  50/* ========================================================================== */
  51/* SDK-Specific Includes                                                      */
  52/* ========================================================================== */
  53
  54#ifdef WOLFSSL_STSAFEA120
  55    /* STSELib includes for A120 */
  56    #include "stse_platform_generic.h"
  57    #include "stselib.h"
  58#else /* WOLFSSL_STSAFEA100 */
  59    /* Legacy STSAFE-A1xx SDK includes */
  60    #include <stsafe_a_types.h>
  61    #include <stsafe_a_configuration.h>
  62    #include <stsafe_a_basic.h>
  63    #include <stsafe_a_tools.h>
  64    #include <stsafe_a_administrative.h>
  65    #include <stsafe_a_general_purpose.h>
  66    #include <stsafe_a_private_public_key.h>
  67    #include <stsafe_a_data_partition.h>
  68#endif
  69
  70/* ========================================================================== */
  71/* Global State                                                               */
  72/* ========================================================================== */
  73
  74#ifdef WOLFSSL_STSAFEA120
  75    /* STSELib handler */
  76    static stse_Handler_t g_stse_handler;
  77    static int g_stse_initialized = 0;
  78#else /* WOLFSSL_STSAFEA100 */
  79    /* Legacy SDK handle */
  80    static void* g_stsafe_handle = NULL;
  81
  82    /* Host MAC and Cipher Keys for secure communication */
  83    /* NOTE: These are example keys
  84     * - real implementations should store securely */
  85    #ifndef STSAFE_HOST_KEY_MAC
  86    static const uint8_t g_host_mac_key[16] = {
  87        0x00, 0x11, 0x22, 0x33, 0x44, 0x55, 0x66, 0x77,
  88        0x88, 0x99, 0xAA, 0xBB, 0xCC, 0xDD, 0xEE, 0xFF
  89    };
  90    #endif
  91    #ifndef STSAFE_HOST_KEY_CIPHER
  92    static const uint8_t g_host_cipher_key[16] = {
  93        0x11, 0x11, 0x22, 0x22, 0x33, 0x33, 0x44, 0x44,
  94        0x55, 0x55, 0x66, 0x66, 0x77, 0x77, 0x88, 0x88
  95    };
  96    #endif
  97#endif
  98
  99/* Current curve mode for signing operations */
 100static stsafe_curve_id_t g_stsafe_curve_mode = STSAFE_DEFAULT_CURVE;
 101
 102
 103/* ========================================================================== */
 104/* Internal Helper Functions                                                  */
 105/* ========================================================================== */
 106
 107/**
 108 * \brief Helper macros to store/retrieve slot number in devCtx
 109 * \details Slot number is stored directly in devCtx as void* to avoid
 110 *          dynamic memory allocation. Slot values are small (0, 1, 0xFF)
 111 *          so safe to cast to/from void*.
 112 */
 113#define STSAFE_SLOT_TO_DEVCXT(slot) ((void*)(uintptr_t)(slot))
 114#define STSAFE_DEVCXT_TO_SLOT(devCtx) ((stsafe_slot_t)(uintptr_t)(devCtx))
 115
 116
 117/**
 118 * \brief Get key size in bytes for a given curve
 119 */
 120static int stsafe_get_key_size(stsafe_curve_id_t curve_id)
 121{
 122    switch (curve_id) {
 123        case STSAFE_ECC_CURVE_P256:
 124    #if defined(HAVE_ECC_BRAINPOOL) && defined(STSE_CONF_ECC_BRAINPOOL_P_256)
 125        case STSAFE_ECC_CURVE_BP256:
 126    #endif
 127            return 32;
 128        case STSAFE_ECC_CURVE_P384:
 129    #if defined(HAVE_ECC_BRAINPOOL) && defined(STSE_CONF_ECC_BRAINPOOL_P_384)
 130        case STSAFE_ECC_CURVE_BP384:
 131    #endif
 132            return 48;
 133        default:
 134            break;
 135    }
 136    return 0;
 137}
 138
 139/**
 140 * \brief Convert wolfSSL ECC curve ID to STSAFE curve ID
 141 */
 142static stsafe_curve_id_t stsafe_get_ecc_curve_id(int ecc_curve)
 143{
 144    switch (ecc_curve) {
 145        case ECC_SECP256R1:
 146            return STSAFE_ECC_CURVE_P256;
 147        case ECC_SECP384R1:
 148            return STSAFE_ECC_CURVE_P384;
 149    #if defined(HAVE_ECC_BRAINPOOL) && defined(STSE_CONF_ECC_BRAINPOOL_P_256)
 150        case ECC_BRAINPOOLP256R1:
 151            return STSAFE_ECC_CURVE_BP256;
 152    #endif
 153    #if defined(HAVE_ECC_BRAINPOOL) && defined(STSE_CONF_ECC_BRAINPOOL_P_384)
 154        case ECC_BRAINPOOLP384R1:
 155            return STSAFE_ECC_CURVE_BP384;
 156    #endif
 157        default:
 158            break;
 159    }
 160    return STSAFE_DEFAULT_CURVE;
 161}
 162
 163/**
 164 * \brief Convert STSAFE curve ID to wolfSSL ECC curve ID
 165 */
 166#if !defined(WOLFCRYPT_ONLY) && defined(HAVE_PK_CALLBACKS)
 167static int stsafe_get_ecc_curve(stsafe_curve_id_t curve_id)
 168{
 169    switch (curve_id) {
 170        case STSAFE_ECC_CURVE_P256:
 171            return ECC_SECP256R1;
 172        case STSAFE_ECC_CURVE_P384:
 173            return ECC_SECP384R1;
 174    #if defined(HAVE_ECC_BRAINPOOL) && defined(STSE_CONF_ECC_BRAINPOOL_P_256)
 175        case STSAFE_ECC_CURVE_BP256:
 176            return ECC_BRAINPOOLP256R1;
 177    #endif
 178    #if defined(HAVE_ECC_BRAINPOOL) && defined(STSE_CONF_ECC_BRAINPOOL_P_384)
 179        case STSAFE_ECC_CURVE_BP384:
 180            return ECC_BRAINPOOLP384R1;
 181    #endif
 182        default:
 183            break;
 184    }
 185    return ECC_SECP256R1;
 186}
 187#endif
 188
 189/**
 190 * \brief Get current curve mode for signing
 191 */
 192static stsafe_curve_id_t stsafe_get_curve_mode(void)
 193{
 194    return g_stsafe_curve_mode;
 195}
 196
 197/**
 198 * \brief Set current curve mode for signing
 199 */
 200static int stsafe_set_curve_mode(stsafe_curve_id_t curve_id)
 201{
 202    g_stsafe_curve_mode = curve_id;
 203    return 0;
 204}
 205
 206/* Unused function workaround for some compilers */
 207#ifdef __GNUC__
 208__attribute__((unused))
 209#endif
 210static void stsafe_unused_funcs(void)
 211{
 212#if !defined(WOLFCRYPT_ONLY) && defined(HAVE_PK_CALLBACKS)
 213    (void)stsafe_get_ecc_curve;
 214#endif
 215    (void)stsafe_set_curve_mode;
 216}
 217
 218/* ========================================================================== */
 219/* Internal Interface Functions - SDK Specific Implementations               */
 220/* ========================================================================== */
 221
 222#ifdef WOLFSSL_STSAFEA120
 223/* -------------------------------------------------------------------------- */
 224/* STSELib (A120) Implementation                                              */
 225/* -------------------------------------------------------------------------- */
 226
 227/**
 228 * \brief Initialize STSAFE-A120 device using STSELib
 229 */
 230int stsafe_interface_init(void)
 231{
 232    int rc = 0;
 233    stse_ReturnCode_t ret;
 234
 235    if (g_stse_initialized) {
 236        return 0; /* Already initialized */
 237    }
 238
 239    /* Set default handler values */
 240    ret = stse_set_default_handler_value(&g_stse_handler);
 241    if (ret != STSE_OK) {
 242        STSAFE_INTERFACE_PRINTF("stse_set_default_handler_value error: %d\n",
 243            ret);
 244        rc = -1;
 245    }
 246
 247    if (rc == 0) {
 248        /* Configure for STSAFE-A120 on I2C bus 1 */
 249        g_stse_handler.device_type = STSAFE_A120;
 250    #ifdef STSAFE_I2C_BUS
 251        g_stse_handler.io.busID = STSAFE_I2C_BUS;
 252    #else
 253        g_stse_handler.io.busID = 1;
 254    #endif
 255        g_stse_handler.io.BusSpeed = 400; /* 400 kHz */
 256
 257        /* Initialize STSELib - this sets up I2C communication */
 258        ret = stse_init(&g_stse_handler);
 259        if (ret != STSE_OK) {
 260            STSAFE_INTERFACE_PRINTF("stse_init error: %d\n", ret);
 261            rc = -1;
 262        }
 263    }
 264
 265    if (rc == 0) {
 266        g_stse_initialized = 1;
 267    #ifdef USE_STSAFE_VERBOSE
 268        WOLFSSL_MSG("STSAFE-A120 (STSELib) initialized");
 269    #endif
 270    }
 271
 272    return rc;
 273}
 274
 275/**
 276 * \brief Generate ECC key pair on STSAFE-A120
 277 * \details Uses dedicated key slot for persistent keys (typically slot 0 or 1).
 278 *          For ephemeral ECDHE keys, use stsafe_create_ecdhe_key() instead.
 279 *
 280 *          Note: For ECDH operations on persistent slots, the key must be generated
 281 *          with appropriate usage settings. Per ST FAE: slot 0xFF with usage_limit=1
 282 *          is recommended for ephemeral ECDH (key establishment mode).
 283 *
 284 * \return STSAFE_A_OK on success.
 285 * \return Other value on failure.
 286 */
 287static int stsafe_create_key(stsafe_slot_t slot, stsafe_curve_id_t curve_id,
 288                             uint8_t* pPubKeyRaw)
 289{
 290    int rc = STSAFE_A_OK;
 291    stse_ReturnCode_t ret;
 292
 293    if (pPubKeyRaw == NULL) {
 294        return BAD_FUNC_ARG;
 295    }
 296
 297    /* Generate key pair - public key is X||Y concatenated
 298     * Note: stse_generate_ecc_key_pair expects stse_ecc_key_type_t,
 299     * but stsafe_curve_id_t values match stse_ecc_key_type_t enum values.
 300     *
 301     * For persistent keys: usage_limit=255 allows multiple operations (signing)
 302     * For ephemeral keys (slot 0xFF): usage_limit=1 for key establishment mode
 303     */
 304    ret = stse_generate_ecc_key_pair(&g_stse_handler, slot,
 305        (stse_ecc_key_type_t)curve_id,
 306        STSAFE_PERSISTENT_KEY_USAGE_LIMIT,
 307        pPubKeyRaw);
 308    if (ret != STSE_OK) {
 309        STSAFE_INTERFACE_PRINTF("stse_generate_ecc_key_pair error: %d\n", ret);
 310        rc = (int)ret;
 311    }
 312
 313    return rc;
 314}
 315
 316/**
 317 * \brief Generate ECDHE ephemeral key pair on STSAFE-A120
 318 * \details Uses stse_generate_ecc_key_pair() with slot 0xFF (ephemeral slot)
 319 *          and usage_limit=1 for key establishment mode.
 320 *          Per ST FAE recommendation: slot 0xFF must be used with mode of
 321 *          operation = key establishment and usage limit = 1 for ECDH operations.
 322 *          Public key is returned in X||Y format.
 323 *
 324 * \return STSAFE_A_OK on success.
 325 * \return Other value on failure.
 326 */
 327static int stsafe_create_ecdhe_key(stsafe_curve_id_t curve_id,
 328                                    uint8_t* pPubKeyRaw)
 329{
 330    int rc = STSAFE_A_OK;
 331    stse_ReturnCode_t ret;
 332
 333    if (pPubKeyRaw == NULL) {
 334        return BAD_FUNC_ARG;
 335    }
 336
 337    /* Generate ephemeral key pair in slot 0xFF with usage_limit=1
 338     * This configures the key for key establishment mode */
 339    ret = stse_generate_ecc_key_pair(&g_stse_handler,
 340        STSAFE_KEY_SLOT_EPHEMERAL,  /* slot 0xFF */
 341        (stse_ecc_key_type_t)curve_id,
 342        STSAFE_EPHEMERAL_KEY_USAGE_LIMIT,  /* usage_limit = 1 */
 343        pPubKeyRaw);
 344    if (ret != STSE_OK) {
 345        STSAFE_INTERFACE_PRINTF("stse_generate_ecc_key_pair (ephemeral) error: %d\n", ret);
 346        rc = (int)ret;
 347    }
 348
 349    return rc;
 350}
 351
 352/**
 353 * \brief ECDSA sign using STSAFE-A120
 354 *
 355 * \return STSAFE_A_OK on success.
 356 * \return Other value on failure.
 357 */
 358static int stsafe_sign(stsafe_slot_t slot, stsafe_curve_id_t curve_id,
 359                       uint8_t* pHash, uint8_t* pSigRS)
 360{
 361    int rc = STSAFE_A_OK;
 362    stse_ReturnCode_t ret;
 363    int key_sz = stsafe_get_key_size(curve_id);
 364
 365    if (pHash == NULL || pSigRS == NULL) {
 366        return BAD_FUNC_ARG;
 367    }
 368
 369    /* Sign hash - output is R || S concatenated */
 370    ret = stse_ecc_generate_signature(&g_stse_handler, slot, curve_id,
 371        pHash, (uint16_t)key_sz, pSigRS);
 372    if (ret != STSE_OK) {
 373        STSAFE_INTERFACE_PRINTF("stse_ecc_generate_signature error: %d\n", ret);
 374        rc = (int)ret;
 375    }
 376
 377    return rc;
 378}
 379
 380/**
 381 * \brief ECDSA verify using STSAFE-A120
 382 *
 383 * \return STSAFE_A_OK on success.
 384 * \return Other value on failure.
 385 */
 386static int stsafe_verify(stsafe_curve_id_t curve_id, uint8_t* pHash,
 387                         uint8_t* pSigRS, uint8_t* pPubKeyX, uint8_t* pPubKeyY,
 388                         int32_t* pResult)
 389{
 390    int rc = STSAFE_A_OK;
 391    stse_ReturnCode_t ret;
 392    int key_sz = stsafe_get_key_size(curve_id);
 393    uint8_t pubKey[STSAFE_MAX_PUBKEY_RAW_LEN];
 394    uint8_t validity = 0;
 395
 396    if (pHash == NULL || pSigRS == NULL || pPubKeyX == NULL ||
 397        pPubKeyY == NULL || pResult == NULL) {
 398        return BAD_FUNC_ARG;
 399    }
 400
 401    /* Combine X and Y into single buffer (X||Y) */
 402    XMEMCPY(pubKey, pPubKeyX, key_sz);
 403    XMEMCPY(pubKey + key_sz, pPubKeyY, key_sz);
 404
 405    /* Verify signature - pMessage is the hash, pSignature is R||S */
 406    ret = stse_ecc_verify_signature(&g_stse_handler, curve_id,
 407        pubKey,     /* public key X||Y */
 408        pSigRS,     /* signature R||S */
 409        pHash,      /* message (hash) */
 410        (uint16_t)key_sz,  /* message length */
 411        0,          /* eddsa_variant (0 for non-EdDSA) */
 412        &validity);
 413    if (ret != STSE_OK) {
 414        STSAFE_INTERFACE_PRINTF("stse_ecc_verify_signature error: %d\n", ret);
 415        *pResult = 0;
 416        rc = (int)ret;
 417    }
 418
 419    if (rc == STSAFE_A_OK) {
 420        *pResult = (validity != 0) ? 1 : 0;
 421    }
 422
 423    return rc;
 424}
 425
 426/**
 427 * \brief ECDH shared secret using STSAFE-A120
 428 *
 429 * \return STSAFE_A_OK on success.
 430 * \return Other value on failure.
 431 */
 432static int stsafe_shared_secret(stsafe_slot_t slot, stsafe_curve_id_t curve_id,
 433                                uint8_t* pPubKeyX, uint8_t* pPubKeyY,
 434                                uint8_t* pSharedSecret,
 435                                int32_t* pSharedSecretLen)
 436{
 437    int rc = STSAFE_A_OK;
 438    stse_ReturnCode_t ret;
 439    int key_sz = stsafe_get_key_size(curve_id);
 440#if defined(WOLFSSL_SMALL_STACK) && !defined(WOLFSSL_NO_MALLOC)
 441    uint8_t* peerPubKey = NULL;
 442#else
 443    uint8_t peerPubKey[STSAFE_MAX_PUBKEY_RAW_LEN];
 444#endif
 445
 446    if (pPubKeyX == NULL || pPubKeyY == NULL || pSharedSecret == NULL ||
 447        pSharedSecretLen == NULL) {
 448        return BAD_FUNC_ARG;
 449    }
 450
 451#if defined(WOLFSSL_SMALL_STACK) && !defined(WOLFSSL_NO_MALLOC)
 452    peerPubKey = (uint8_t*)XMALLOC(STSAFE_MAX_PUBKEY_RAW_LEN, NULL,
 453        DYNAMIC_TYPE_TMP_BUFFER);
 454    if (peerPubKey == NULL) {
 455        return MEMORY_E;
 456    }
 457#endif
 458
 459    /* Combine peer X and Y (X||Y format) */
 460    XMEMCPY(peerPubKey, pPubKeyX, key_sz);
 461    XMEMCPY(peerPubKey + key_sz, pPubKeyY, key_sz);
 462
 463    /* Compute shared secret
 464     * Note: stse_ecc_establish_shared_secret expects stse_ecc_key_type_t.
 465     * For STSAFE-A120, stsafe_curve_id_t values match stse_ecc_key_type_t enum values:
 466     *   STSAFE_ECC_CURVE_P256 (0) = STSE_ECC_KT_NIST_P_256 (0)
 467     *   STSAFE_ECC_CURVE_P384 (1) = STSE_ECC_KT_NIST_P_384 (1) */
 468    ret = stse_ecc_establish_shared_secret(&g_stse_handler, slot,
 469        (stse_ecc_key_type_t)curve_id, peerPubKey, pSharedSecret);
 470    if (ret != STSE_OK) {
 471        STSAFE_INTERFACE_PRINTF("stse_ecc_establish_shared_secret error: %d (slot: %d, curve_id: %d)\n",
 472            ret, slot, curve_id);
 473        rc = (int)ret;
 474    }
 475
 476    if (rc == STSAFE_A_OK) {
 477        *pSharedSecretLen = (int32_t)key_sz;
 478    }
 479
 480#if defined(WOLFSSL_SMALL_STACK) && !defined(WOLFSSL_NO_MALLOC)
 481    XFREE(peerPubKey, NULL, DYNAMIC_TYPE_TMP_BUFFER);
 482#endif
 483
 484    return rc;
 485}
 486
 487/**
 488 * \brief Read device certificate from STSAFE-A120
 489 *
 490 * \return STSAFE_A_OK on success.
 491 * \return Other value on failure.
 492 */
 493static int stsafe_read_certificate(uint8_t** ppCert, uint32_t* pCertLen)
 494{
 495#ifdef WOLFSSL_NO_MALLOC
 496    /* Certificate reading requires dynamic allocation */
 497    (void)ppCert;
 498    (void)pCertLen;
 499    return NOT_COMPILED_IN;
 500#else
 501    int rc = STSAFE_A_OK;
 502    stse_ReturnCode_t ret;
 503    uint16_t certLen = 0;
 504    uint8_t certZone = 0; /* Certificate zone 0 */
 505
 506    /* First, get certificate size */
 507    ret = stse_get_device_certificate_size(&g_stse_handler, certZone, &certLen);
 508    if (ret != STSE_OK) {
 509        STSAFE_INTERFACE_PRINTF("stse_get_device_certificate_size error: %d\n",
 510            ret);
 511        rc = (int)ret;
 512    }
 513    else if (certLen == 0) {
 514        /* Certificate size is 0 - invalid certificate data */
 515        STSAFE_INTERFACE_PRINTF("stse_get_device_certificate_size returned zero length\n");
 516        rc = ASN_PARSE_E;
 517    }
 518
 519    /* Allocate buffer */
 520    if (rc == STSAFE_A_OK) {
 521        *ppCert = (uint8_t*)XMALLOC(certLen, NULL, DYNAMIC_TYPE_TMP_BUFFER);
 522        if (*ppCert == NULL) {
 523            rc = MEMORY_E;
 524        }
 525    }
 526
 527    /* Read certificate */
 528    if (rc == STSAFE_A_OK) {
 529        ret = stse_get_device_certificate(&g_stse_handler, certZone, certLen,
 530            *ppCert);
 531        if (ret != STSE_OK) {
 532            XFREE(*ppCert, NULL, DYNAMIC_TYPE_TMP_BUFFER);
 533            *ppCert = NULL;
 534            STSAFE_INTERFACE_PRINTF("stse_get_device_certificate error: %d\n",
 535                ret);
 536            rc = (int)ret;
 537        }
 538    }
 539
 540    if (rc == STSAFE_A_OK) {
 541        *pCertLen = certLen;
 542    }
 543
 544    return rc;
 545#endif /* WOLFSSL_NO_MALLOC */
 546}
 547
 548#if !defined(WC_NO_RNG) && defined(USE_STSAFE_RNG_SEED)
 549/**
 550 * \brief Get random bytes from STSAFE-A120
 551 */
 552static int stsafe_get_random(uint8_t* pRandom, uint32_t size)
 553{
 554    int rc;
 555    stse_ReturnCode_t ret;
 556    uint16_t len = (size > 0xFFFF) ? 0xFFFF : (uint16_t)size;
 557
 558    ret = stse_generate_random(&g_stse_handler, pRandom, len);
 559    if (ret != STSE_OK) {
 560        rc = -1;
 561    }
 562    else {
 563        rc = (int)len;
 564    }
 565
 566    return rc;
 567}
 568#endif
 569
 570#else /* WOLFSSL_STSAFEA100 */
 571/* -------------------------------------------------------------------------- */
 572/* Legacy STSAFE-A1xx SDK (A100/A110) Implementation                          */
 573/* -------------------------------------------------------------------------- */
 574
 575/**
 576 * \brief Set host keys for secure communication
 577 */
 578static void stsafe_set_host_keys(void* handle)
 579{
 580    StSafeA_SetHostMacKey(handle, g_host_mac_key);
 581    StSafeA_SetHostCipherKey(handle, g_host_cipher_key);
 582}
 583
 584/**
 585 * \brief Check and initialize host keys
 586 */
 587static int stsafe_check_host_keys(void* handle)
 588{
 589    uint8_t status_code;
 590    StSafeA_HostKeySlotBuffer* pHostKeySlot;
 591
 592    status_code = StSafeA_HostKeySlotQuery(handle, &pHostKeySlot,
 593        STSAFE_A_NO_MAC);
 594
 595    if (status_code == STSAFE_A_OK && !pHostKeySlot->HostKeyPresenceFlag) {
 596        /* Host keys not set, initialize them */
 597        uint8_t hostKeys[32];
 598        XMEMCPY(hostKeys, g_host_mac_key, 16);
 599        XMEMCPY(hostKeys + 16, g_host_cipher_key, 16);
 600
 601        status_code = StSafeA_PutAttribute(handle, STSAFE_A_HOST_KEY_SLOT_TAG,
 602            hostKeys, sizeof(hostKeys), STSAFE_A_NO_MAC);
 603    }
 604
 605    return status_code;
 606}
 607
 608/**
 609 * \brief Initialize STSAFE-A100/A110 device
 610 *
 611 * \return STSAFE_A_OK on success.
 612 * \return Other value on failure.
 613 */
 614int stsafe_interface_init(void)
 615{
 616    int rc = 0;
 617    uint8_t status_code;
 618    const uint8_t echo_data[3] = {0x01, 0x02, 0x03};
 619    StSafeA_EchoBuffer* echo_resp = NULL;
 620
 621    if (g_stsafe_handle != NULL) {
 622        return 0; /* Already initialized */
 623    }
 624
 625    /* Create handle */
 626    status_code = StSafeA_CreateHandle(&g_stsafe_handle, STSAFE_I2C_ADDR);
 627    if (status_code != STSAFE_A_OK) {
 628        STSAFE_INTERFACE_PRINTF("StSafeA_CreateHandle error: %d\n",
 629            status_code);
 630        rc = -1;
 631    }
 632
 633    /* Echo test to verify communication */
 634    if (rc == 0) {
 635        status_code = StSafeA_Echo(g_stsafe_handle, (uint8_t*)echo_data, 3,
 636            &echo_resp, STSAFE_A_NO_MAC);
 637        if (status_code != STSAFE_A_OK ||
 638            XMEMCMP(echo_data, echo_resp->Data, 3) != 0) {
 639            STSAFE_INTERFACE_PRINTF("StSafeA_Echo error: %d\n", status_code);
 640            rc = -1;
 641        }
 642        XFREE(echo_resp, NULL, DYNAMIC_TYPE_TMP_BUFFER);
 643    }
 644
 645    /* Check/initialize host keys */
 646    if (rc == 0) {
 647        status_code = stsafe_check_host_keys(g_stsafe_handle);
 648        if (status_code != STSAFE_A_OK) {
 649            STSAFE_INTERFACE_PRINTF("stsafe_check_host_keys error: %d\n",
 650                status_code);
 651            rc = -1;
 652        }
 653    }
 654
 655#ifdef USE_STSAFE_VERBOSE
 656    if (rc == 0) {
 657        WOLFSSL_MSG("STSAFE-A100/A110 initialized");
 658    }
 659#endif
 660
 661    return rc;
 662}
 663
 664/**
 665 * \brief Generate ECC key pair on STSAFE-A100/A110
 666 *
 667 * \return STSAFE_A_OK on success.
 668 * \return Other value on failure.
 669 */
 670static int stsafe_create_key(stsafe_slot_t* pSlot, stsafe_curve_id_t curve_id,
 671                             uint8_t* pPubKeyRaw)
 672{
 673    int rc;
 674    uint8_t status_code;
 675    int key_sz = stsafe_get_key_size(curve_id);
 676    stsafe_slot_t slot = STSAFE_KEY_SLOT_1;
 677    StSafeA_CoordinateBuffer* pubX = NULL;
 678    StSafeA_CoordinateBuffer* pubY = NULL;
 679    uint8_t* pointRepId = NULL;
 680
 681    stsafe_set_host_keys(g_stsafe_handle);
 682
 683    status_code = StSafeA_GenerateKeyPair(g_stsafe_handle, slot, 0xFFFF, 1,
 684        (StSafeA_KeyUsageAuthorizationFlags)(
 685            STSAFE_A_COMMAND_RESPONSE_SIGNATURE |
 686            STSAFE_A_MESSAGE_DIGEST_SIGNATURE |
 687            STSAFE_A_KEY_ESTABLISHMENT),
 688        curve_id, &pointRepId, &pubX, &pubY, STSAFE_A_HOST_C_MAC);
 689
 690    if (status_code == STSAFE_A_OK && pointRepId != NULL &&
 691        *pointRepId == STSAFE_A_POINT_REPRESENTATION_ID &&
 692        pubX != NULL && pubY != NULL) {
 693        XMEMCPY(pPubKeyRaw, pubX->Data, pubX->Length);
 694        XMEMCPY(pPubKeyRaw + key_sz, pubY->Data, pubY->Length);
 695        rc = STSAFE_A_OK;
 696    }
 697    else {
 698        rc = (int)(uint8_t)-1;
 699    }
 700
 701    /* Free SDK-allocated buffers */
 702    XFREE(pubX, NULL, DYNAMIC_TYPE_TMP_BUFFER);
 703    XFREE(pubY, NULL, DYNAMIC_TYPE_TMP_BUFFER);
 704
 705    if (rc == STSAFE_A_OK && pSlot != NULL) {
 706        *pSlot = slot;
 707    }
 708
 709    return rc;
 710}
 711
 712/**
 713 * \brief ECDSA sign using STSAFE-A100/A110
 714 *
 715 * \return STSAFE_A_OK on success.
 716 * \return Other value on failure.
 717 */
 718static int stsafe_sign(stsafe_slot_t slot, stsafe_curve_id_t curve_id,
 719                       uint8_t* pHash, uint8_t* pSigRS)
 720{
 721    int rc;
 722    uint8_t status_code;
 723    int key_sz = stsafe_get_key_size(curve_id);
 724    StSafeA_SignatureBuffer* signature = NULL;
 725    StSafeA_HashTypes hashType;
 726    size_t r_length, s_length;
 727
 728    hashType = (curve_id == STSAFE_ECC_CURVE_P384 ||
 729                curve_id == STSAFE_ECC_CURVE_BP384) ?
 730                STSAFE_HASH_SHA384 : STSAFE_HASH_SHA256;
 731
 732    status_code = StSafeA_GenerateSignature(g_stsafe_handle, slot, pHash,
 733        hashType, &signature, STSAFE_A_NO_MAC);
 734
 735    if (status_code == STSAFE_A_OK && signature != NULL) {
 736        /* Parse signature - format is: len(2) || R || len(2) || S */
 737        r_length = ((uint16_t)signature->Data[0] << 8) | signature->Data[1];
 738
 739        /* Bounds check: r_length must be valid and fit within signature buffer */
 740        if (r_length > key_sz || r_length == 0 ||
 741            (size_t)(2 + r_length + 2) > signature->Length) {
 742            rc = ASN_PARSE_E;
 743        }
 744        else {
 745            s_length = ((uint16_t)signature->Data[2 + r_length] << 8) |
 746                       signature->Data[3 + r_length];
 747
 748            /* Bounds check: s_length must be valid and fit within signature buffer */
 749            if (s_length > key_sz || s_length == 0 ||
 750                (size_t)(4 + r_length + s_length) > signature->Length) {
 751                rc = ASN_PARSE_E;
 752            }
 753            else {
 754                /* Copy R and S to output (zero-padded) */
 755                XMEMSET(pSigRS, 0, key_sz * 2);
 756                XMEMCPY(pSigRS + (key_sz - r_length), &signature->Data[2], r_length);
 757                XMEMCPY(pSigRS + key_sz + (key_sz - s_length),
 758                        &signature->Data[4 + r_length], s_length);
 759                rc = STSAFE_A_OK;
 760            }
 761        }
 762    }
 763    else {
 764        rc = (int)status_code;
 765    }
 766
 767    /* Free SDK-allocated buffer */
 768    XFREE(signature, NULL, DYNAMIC_TYPE_TMP_BUFFER);
 769
 770    return rc;
 771}
 772
 773/**
 774 * \brief ECDSA verify using STSAFE-A100/A110
 775 *
 776 * \return STSAFE_A_OK on success.
 777 * \return Other value on failure.
 778 */
 779static int stsafe_verify(stsafe_curve_id_t curve_id, uint8_t* pHash,
 780                         uint8_t* pSigRS, uint8_t* pPubKeyX, uint8_t* pPubKeyY,
 781                         int32_t* pResult)
 782{
 783    int rc = (int)(uint8_t)-1;
 784    uint8_t status_code;
 785    int key_sz = stsafe_get_key_size(curve_id);
 786#if defined(WOLFSSL_SMALL_STACK) && !defined(WOLFSSL_NO_MALLOC)
 787    StSafeA_CoordinateBuffer* X = NULL;
 788    StSafeA_CoordinateBuffer* Y = NULL;
 789    StSafeA_SignatureBuffer* R = NULL;
 790    StSafeA_SignatureBuffer* S = NULL;
 791    StSafeA_SignatureBuffer* Hash = NULL;
 792#else
 793    /* Stack buffers: 2 bytes for Length + STSAFE_MAX_KEY_LEN for Data */
 794    byte R_buf[2 + STSAFE_MAX_KEY_LEN];
 795    byte S_buf[2 + STSAFE_MAX_KEY_LEN];
 796    byte Hash_buf[2 + STSAFE_MAX_KEY_LEN];
 797    byte X_buf[2 + STSAFE_MAX_KEY_LEN];
 798    byte Y_buf[2 + STSAFE_MAX_KEY_LEN];
 799    StSafeA_SignatureBuffer* R = (StSafeA_SignatureBuffer*)R_buf;
 800    StSafeA_SignatureBuffer* S = (StSafeA_SignatureBuffer*)S_buf;
 801    StSafeA_SignatureBuffer* Hash = (StSafeA_SignatureBuffer*)Hash_buf;
 802    StSafeA_CoordinateBuffer* X = (StSafeA_CoordinateBuffer*)X_buf;
 803    StSafeA_CoordinateBuffer* Y = (StSafeA_CoordinateBuffer*)Y_buf;
 804#endif
 805    StSafeA_VerifySignatureBuffer* Verif = NULL;
 806
 807    *pResult = 0;
 808
 809#if defined(WOLFSSL_SMALL_STACK) && !defined(WOLFSSL_NO_MALLOC)
 810    /* Allocate buffers */
 811    R = (StSafeA_SignatureBuffer*)XMALLOC(key_sz + 2, NULL,
 812        DYNAMIC_TYPE_TMP_BUFFER);
 813    S = (StSafeA_SignatureBuffer*)XMALLOC(key_sz + 2, NULL,
 814        DYNAMIC_TYPE_TMP_BUFFER);
 815    Hash = (StSafeA_SignatureBuffer*)XMALLOC(key_sz + 2, NULL,
 816        DYNAMIC_TYPE_TMP_BUFFER);
 817    X = (StSafeA_CoordinateBuffer*)XMALLOC(key_sz + 2, NULL,
 818        DYNAMIC_TYPE_TMP_BUFFER);
 819    Y = (StSafeA_CoordinateBuffer*)XMALLOC(key_sz + 2, NULL,
 820        DYNAMIC_TYPE_TMP_BUFFER);
 821
 822    if (X == NULL || Y == NULL || R == NULL || S == NULL || Hash == NULL) {
 823        XFREE(R, NULL, DYNAMIC_TYPE_TMP_BUFFER);
 824        XFREE(S, NULL, DYNAMIC_TYPE_TMP_BUFFER);
 825        XFREE(Hash, NULL, DYNAMIC_TYPE_TMP_BUFFER);
 826        XFREE(X, NULL, DYNAMIC_TYPE_TMP_BUFFER);
 827        XFREE(Y, NULL, DYNAMIC_TYPE_TMP_BUFFER);
 828        return MEMORY_E;
 829    }
 830#endif
 831
 832    R->Length = key_sz;
 833    S->Length = key_sz;
 834    Hash->Length = key_sz;
 835    X->Length = key_sz;
 836    Y->Length = key_sz;
 837
 838    XMEMCPY(R->Data, pSigRS, key_sz);
 839    XMEMCPY(S->Data, pSigRS + key_sz, key_sz);
 840    XMEMCPY(Hash->Data, pHash, key_sz);
 841    XMEMCPY(X->Data, pPubKeyX, key_sz);
 842    XMEMCPY(Y->Data, pPubKeyY, key_sz);
 843
 844    status_code = StSafeA_VerifyMessageSignature(g_stsafe_handle,
 845        curve_id, X, Y, R, S, Hash, &Verif, STSAFE_A_NO_MAC);
 846
 847    if (status_code == STSAFE_A_OK && Verif != NULL) {
 848        *pResult = Verif->SignatureValidity ? 1 : 0;
 849        if (Verif->SignatureValidity) {
 850            rc = STSAFE_A_OK;
 851        }
 852    }
 853#ifndef WOLFSSL_NO_MALLOC
 854    /* Free SDK-allocated buffer */
 855    XFREE(Verif, NULL, DYNAMIC_TYPE_TMP_BUFFER);
 856#endif
 857
 858#if defined(WOLFSSL_SMALL_STACK) && !defined(WOLFSSL_NO_MALLOC)
 859    XFREE(R, NULL, DYNAMIC_TYPE_TMP_BUFFER);
 860    XFREE(S, NULL, DYNAMIC_TYPE_TMP_BUFFER);
 861    XFREE(Hash, NULL, DYNAMIC_TYPE_TMP_BUFFER);
 862    XFREE(X, NULL, DYNAMIC_TYPE_TMP_BUFFER);
 863    XFREE(Y, NULL, DYNAMIC_TYPE_TMP_BUFFER);
 864#endif
 865
 866    return rc;
 867}
 868
 869/**
 870 * \brief ECDH shared secret using STSAFE-A100/A110
 871 *
 872 * \return STSAFE_A_OK on success.
 873 * \return Other value on failure.
 874 */
 875static int stsafe_shared_secret(stsafe_slot_t slot, stsafe_curve_id_t curve_id,
 876                                uint8_t* pPubKeyX, uint8_t* pPubKeyY,
 877                                uint8_t* pSharedSecret,
 878                                int32_t* pSharedSecretLen)
 879{
 880    int rc = (int)(uint8_t)-1;
 881    uint8_t status_code;
 882    int key_sz = stsafe_get_key_size(curve_id);
 883#if defined(WOLFSSL_SMALL_STACK) && !defined(WOLFSSL_NO_MALLOC)
 884    StSafeA_CoordinateBuffer* peerX = NULL;
 885    StSafeA_CoordinateBuffer* peerY = NULL;
 886#else
 887    /* Stack buffers: 2 bytes for Length + STSAFE_MAX_KEY_LEN for Data */
 888    byte peerX_buf[2 + STSAFE_MAX_KEY_LEN];
 889    byte peerY_buf[2 + STSAFE_MAX_KEY_LEN];
 890    StSafeA_CoordinateBuffer* peerX = (StSafeA_CoordinateBuffer*)peerX_buf;
 891    StSafeA_CoordinateBuffer* peerY = (StSafeA_CoordinateBuffer*)peerY_buf;
 892#endif
 893    StSafeA_SharedSecretBuffer* sharedSecret = NULL;
 894
 895    stsafe_set_host_keys(g_stsafe_handle);
 896
 897#if defined(WOLFSSL_SMALL_STACK) && !defined(WOLFSSL_NO_MALLOC)
 898    peerX = (StSafeA_CoordinateBuffer*)XMALLOC(key_sz + 2, NULL,
 899        DYNAMIC_TYPE_TMP_BUFFER);
 900    peerY = (StSafeA_CoordinateBuffer*)XMALLOC(key_sz + 2, NULL,
 901        DYNAMIC_TYPE_TMP_BUFFER);
 902
 903    if (peerX == NULL || peerY == NULL) {
 904        XFREE(peerX, NULL, DYNAMIC_TYPE_TMP_BUFFER);
 905        XFREE(peerY, NULL, DYNAMIC_TYPE_TMP_BUFFER);
 906        return MEMORY_E;
 907    }
 908#endif
 909
 910    peerX->Length = key_sz;
 911    peerY->Length = key_sz;
 912    XMEMCPY(peerX->Data, pPubKeyX, key_sz);
 913    XMEMCPY(peerY->Data, pPubKeyY, key_sz);
 914
 915    status_code = StSafeA_EstablishKey(g_stsafe_handle, slot,
 916        peerX, peerY, &sharedSecret, STSAFE_A_HOST_C_MAC);
 917
 918    if (status_code == STSAFE_A_OK && sharedSecret != NULL) {
 919        *pSharedSecretLen = sharedSecret->SharedSecret.Length;
 920        XMEMCPY(pSharedSecret, sharedSecret->SharedSecret.Data,
 921                sharedSecret->SharedSecret.Length);
 922        rc = STSAFE_A_OK;
 923    }
 924#ifndef WOLFSSL_NO_MALLOC
 925    /* Free SDK-allocated buffer */
 926    XFREE(sharedSecret, NULL, DYNAMIC_TYPE_TMP_BUFFER);
 927#endif
 928
 929#if defined(WOLFSSL_SMALL_STACK) && !defined(WOLFSSL_NO_MALLOC)
 930    XFREE(peerX, NULL, DYNAMIC_TYPE_TMP_BUFFER);
 931    XFREE(peerY, NULL, DYNAMIC_TYPE_TMP_BUFFER);
 932#endif
 933
 934    return rc;
 935}
 936
 937/**
 938 * \brief Read device certificate from STSAFE-A100/A110
 939 *
 940 * \return STSAFE_A_OK on success.
 941 * \return Other value on failure.
 942 */
 943static int stsafe_read_certificate(uint8_t** ppCert, uint32_t* pCertLen)
 944{
 945#ifdef WOLFSSL_NO_MALLOC
 946    /* Certificate reading requires dynamic allocation */
 947    (void)ppCert;
 948    (void)pCertLen;
 949    return NOT_COMPILED_IN;
 950#else
 951    int rc = STSAFE_A_OK;
 952    uint8_t status_code;
 953    StSafeA_ReadBuffer* readBuf = NULL;
 954    struct stsafe_a* stsafe_a = (struct stsafe_a*)g_stsafe_handle;
 955    uint8_t step;
 956    uint16_t i;
 957
 958    *pCertLen = 0;
 959
 960    /* Read first 4 bytes to determine certificate length */
 961    status_code = StSafeA_Read(g_stsafe_handle, 0, 0, STSAFE_A_ALWAYS,
 962        0, 0, 4, &readBuf, STSAFE_A_NO_MAC);
 963
 964    if (status_code == STSAFE_A_OK && readBuf != NULL && readBuf->Length == 4) {
 965        /* Parse ASN.1 DER certificate header */
 966        /* 0x30 = ASN_SEQUENCE | ASN_CONSTRUCTED (certificate is a SEQUENCE) */
 967        if (readBuf->Data[0] == (ASN_SEQUENCE | ASN_CONSTRUCTED)) {
 968            /* Parse ASN.1 length encoding */
 969            switch (readBuf->Data[1]) {
 970                case (ASN_LONG_LENGTH | 0x01):  /* Length encoded in 1 byte */
 971                    *pCertLen = readBuf->Data[2] + 3;
 972                    break;
 973                case (ASN_LONG_LENGTH | 0x02):  /* Length encoded in 2 bytes */
 974                    *pCertLen = ((uint16_t)readBuf->Data[2] << 8) +
 975                                       readBuf->Data[3] + 4;
 976                    break;
 977                default:
 978                    /* Short form: length < 128, encoded directly */
 979                    if (readBuf->Data[1] < ASN_LONG_LENGTH) {
 980                        *pCertLen = readBuf->Data[1] + 2;
 981                    }
 982                    break;
 983            }
 984            /* Check if length parsing succeeded */
 985            if (*pCertLen == 0) {
 986                rc = ASN_PARSE_E;
 987            }
 988        }
 989        else {
 990            /* Invalid ASN.1 header - expected SEQUENCE tag */
 991            rc = ASN_PARSE_E;
 992        }
 993    }
 994    else {
 995        rc = (int)status_code;
 996    }
 997    XFREE(readBuf, NULL, DYNAMIC_TYPE_TMP_BUFFER);
 998    readBuf = NULL;
 999
1000    if (rc == STSAFE_A_OK && *pCertLen > 0) {
1001        *ppCert = (uint8_t*)XMALLOC(*pCertLen, NULL, DYNAMIC_TYPE_TMP_BUFFER);
1002        if (*ppCert == NULL) {
1003            rc = MEMORY_E;
1004        }
1005    }
1006
1007    if (rc == STSAFE_A_OK && *pCertLen > 0) {
1008        /* STSAFE-A100/A110 maximum read size is 225 bytes per command.
1009         * When CRC is supported, 2 bytes are used for CRC, leaving 223 bytes
1010         * for data. Without CRC, we can read up to 225 bytes, but use 223
1011         * for consistency and to leave room for protocol overhead. */
1012        step = 223 - (stsafe_a->CrcSupport ? 2 : 0);
1013
1014        for (i = 0; rc == STSAFE_A_OK && i < *pCertLen / step; i++) {
1015            status_code = StSafeA_Read(g_stsafe_handle, 0, 0,
1016                STSAFE_A_ALWAYS, 0, i * step, step, &readBuf,
1017                STSAFE_A_NO_MAC);
1018            if (status_code == STSAFE_A_OK) {
1019                XMEMCPY(*ppCert + (i * step), readBuf->Data, readBuf->Length);
1020            }
1021            else {
1022                rc = (int)status_code;
1023            }
1024            XFREE(readBuf, NULL, DYNAMIC_TYPE_TMP_BUFFER);
1025            readBuf = NULL;
1026        }
1027
1028        if (rc == STSAFE_A_OK && (*pCertLen % step)) {
1029            status_code = StSafeA_Read(g_stsafe_handle, 0, 0,
1030                STSAFE_A_ALWAYS, 0, i * step, *pCertLen % step,
1031                &readBuf, STSAFE_A_NO_MAC);
1032            if (status_code == STSAFE_A_OK) {
1033                XMEMCPY(*ppCert + (i * step), readBuf->Data, readBuf->Length);
1034            }
1035            else {
1036                rc = (int)status_code;
1037            }
1038            XFREE(readBuf, NULL, DYNAMIC_TYPE_TMP_BUFFER);
1039            readBuf = NULL;
1040        }
1041    }
1042
1043    return rc;
1044#endif /* WOLFSSL_NO_MALLOC */
1045}
1046
1047#if !defined(WC_NO_RNG) && defined(USE_STSAFE_RNG_SEED)
1048/**
1049 * \brief Get random bytes from STSAFE-A100/A110
1050 */
1051static int stsafe_get_random(uint8_t* pRandom, uint32_t size)
1052{
1053    int rc;
1054    uint8_t status_code;
1055    StSafeA_GenerateRandomBuffer* rndBuf = NULL;
1056    uint8_t reqSize = (size > 255) ? 255 : (uint8_t)size;
1057
1058    status_code = StSafeA_GenerateRandom(g_stsafe_handle, STSAFE_A_EPHEMERAL,
1059        reqSize, &rndBuf, STSAFE_A_NO_MAC);
1060
1061    if (status_code == STSAFE_A_OK && rndBuf != NULL) {
1062        rc = (int)rndBuf->Length;
1063        XMEMCPY(pRandom, rndBuf->Data, rndBuf->Length);
1064    }
1065    else {
1066        rc = -1;
1067    }
1068
1069    XFREE(rndBuf, NULL, DYNAMIC_TYPE_TMP_BUFFER);
1070
1071    return rc;
1072}
1073#endif
1074
1075#endif /* WOLFSSL_STSAFEA120 */
1076
1077#endif /* !WOLFSSL_STSAFE_INTERFACE_EXTERNAL */
1078
1079
1080/* ========================================================================== */
1081/* Public API Functions                                                       */
1082/* ========================================================================== */
1083
1084/**
1085 * \brief Load device certificate from STSAFE
1086 */
1087int SSL_STSAFE_LoadDeviceCertificate(byte** pRawCertificate,
1088    word32* pRawCertificateLen)
1089{
1090    int err = 0;
1091
1092    if (pRawCertificate == NULL || pRawCertificateLen == NULL) {
1093        err = BAD_FUNC_ARG;
1094    }
1095
1096#ifdef USE_STSAFE_VERBOSE
1097    if (err == 0) {
1098        WOLFSSL_MSG("SSL_STSAFE_LoadDeviceCertificate");
1099    }
1100#endif
1101
1102    if (err == 0) {
1103        err = stsafe_read_certificate(pRawCertificate, pRawCertificateLen);
1104        if (err != STSAFE_A_OK) {
1105            err = WC_HW_E;
1106        }
1107    }
1108
1109    return err;
1110}
1111
1112
1113/* ========================================================================== */
1114/* PK Callbacks                                                               */
1115/* ========================================================================== */
1116
1117#if !defined(WOLFCRYPT_ONLY) && defined(HAVE_PK_CALLBACKS)
1118
1119/**
1120 * \brief Key Gen Callback (used by TLS server for ECDHE)
1121 */
1122int SSL_STSAFE_CreateKeyCb(WOLFSSL* ssl, ecc_key* key, word32 keySz,
1123    int ecc_curve, void* ctx)
1124{
1125    int err = 0;
1126#if defined(WOLFSSL_SMALL_STACK) && !defined(WOLFSSL_NO_MALLOC)
1127    byte* pubKeyRaw = NULL;
1128#else
1129    byte pubKeyRaw[STSAFE_MAX_PUBKEY_RAW_LEN];
1130#endif
1131    stsafe_slot_t slot;
1132    stsafe_curve_id_t curve_id;
1133
1134    (void)ssl;
1135    (void)ctx;
1136
1137#ifdef USE_STSAFE_VERBOSE
1138    WOLFSSL_MSG("CreateKeyCb: STSAFE (ECDHE)");
1139#endif
1140
1141#if defined(WOLFSSL_SMALL_STACK) && !defined(WOLFSSL_NO_MALLOC)
1142    pubKeyRaw = (byte*)XMALLOC(STSAFE_MAX_PUBKEY_RAW_LEN, NULL,
1143        DYNAMIC_TYPE_TMP_BUFFER);
1144    if (pubKeyRaw == NULL) {
1145        err = MEMORY_E;
1146    }
1147#endif
1148
1149    if (err == 0) {
1150        curve_id = stsafe_get_ecc_curve_id(ecc_curve);
1151
1152#ifdef WOLFSSL_STSAFEA120
1153        /* Use ECDHE ephemeral key generation for A120 */
1154        err = stsafe_create_ecdhe_key(curve_id, pubKeyRaw);
1155        if (err != STSAFE_A_OK) {
1156            STSAFE_INTERFACE_PRINTF("stsafe_create_ecdhe_key error: %d\n", err);
1157            err = WC_HW_E;
1158        }
1159        /* For ECDHE, slot is not used (ephemeral key stored internally) */
1160        slot = STSAFE_KEY_SLOT_EPHEMERAL;
1161#else
1162        /* Legacy A100/A110 uses slot-based key generation */
1163        err = stsafe_create_key(&slot, curve_id, pubKeyRaw);
1164        if (err != STSAFE_A_OK) {
1165            STSAFE_INTERFACE_PRINTF("stsafe_create_key error: %d\n", err);
1166            err = WC_HW_E;
1167        }
1168#endif
1169    }
1170
1171    if (err == 0) {
1172        err = wc_ecc_import_unsigned(key, pubKeyRaw, &pubKeyRaw[keySz],
1173            NULL, ecc_curve);
1174    }
1175
1176#if defined(WOLFSSL_SMALL_STACK) && !defined(WOLFSSL_NO_MALLOC)
1177    XFREE(pubKeyRaw, NULL, DYNAMIC_TYPE_TMP_BUFFER);
1178#endif
1179
1180    (void)slot; /* May be unused for A120 ECDHE */
1181
1182    return err;
1183}
1184
1185/**
1186 * \brief Verify Peer Cert Callback
1187 */
1188int SSL_STSAFE_VerifyPeerCertCb(WOLFSSL* ssl,
1189                                const unsigned char* sig, unsigned int sigSz,
1190                                const unsigned char* hash, unsigned int hashSz,
1191                                const unsigned char* keyDer, unsigned int keySz,
1192                                int* result, void* ctx)
1193{
1194    int err = 0;
1195    int eccKeyInit = 0;
1196#if defined(WOLFSSL_SMALL_STACK) && !defined(WOLFSSL_NO_MALLOC)
1197    byte* sigRS = NULL;
1198    byte* pubKeyX = NULL;
1199    byte* pubKeyY = NULL;
1200#else
1201    byte sigRS[STSAFE_MAX_SIG_LEN];
1202    byte pubKeyX[STSAFE_MAX_PUBKEY_RAW_LEN/2];
1203    byte pubKeyY[STSAFE_MAX_PUBKEY_RAW_LEN/2];
1204#endif
1205    byte* r = NULL;
1206    byte* s = NULL;
1207    word32 r_len = STSAFE_MAX_SIG_LEN/2, s_len = STSAFE_MAX_SIG_LEN/2;
1208    word32 pubKeyX_len = STSAFE_MAX_PUBKEY_RAW_LEN/2;
1209    word32 pubKeyY_len = STSAFE_MAX_PUBKEY_RAW_LEN/2;
1210    ecc_key eccKey;
1211    word32 inOutIdx = 0;
1212    stsafe_curve_id_t curve_id = STSAFE_ECC_CURVE_P256;
1213    int ecc_curve;
1214    int key_sz = 0;
1215
1216    (void)ssl;
1217    (void)ctx;
1218    (void)hashSz;
1219
1220#ifdef USE_STSAFE_VERBOSE
1221    WOLFSSL_MSG("VerifyPeerCertCB: STSAFE");
1222#endif
1223
1224#if defined(WOLFSSL_SMALL_STACK) && !defined(WOLFSSL_NO_MALLOC)
1225    sigRS = (byte*)XMALLOC(STSAFE_MAX_SIG_LEN, NULL, DYNAMIC_TYPE_TMP_BUFFER);
1226    pubKeyX = (byte*)XMALLOC(STSAFE_MAX_PUBKEY_RAW_LEN/2, NULL,
1227        DYNAMIC_TYPE_TMP_BUFFER);
1228    pubKeyY = (byte*)XMALLOC(STSAFE_MAX_PUBKEY_RAW_LEN/2, NULL,
1229        DYNAMIC_TYPE_TMP_BUFFER);
1230    if (sigRS == NULL || pubKeyX == NULL || pubKeyY == NULL) {
1231        err = MEMORY_E;
1232    }
1233#endif
1234
1235    if (err == 0) {
1236        err = wc_ecc_init(&eccKey);
1237        if (err == 0) {
1238            eccKeyInit = 1;
1239        }
1240    }
1241
1242    if (err == 0) {
1243        err = wc_EccPublicKeyDecode(keyDer, &inOutIdx, &eccKey, keySz);
1244    }
1245    if (err == 0) {
1246        err = wc_ecc_export_public_raw(&eccKey, pubKeyX, &pubKeyX_len,
1247            pubKeyY, &pubKeyY_len);
1248    }
1249    if (err == 0) {
1250        ecc_curve = eccKey.dp->id;
1251        curve_id = stsafe_get_ecc_curve_id(ecc_curve);
1252        key_sz = stsafe_get_key_size(curve_id);
1253        if (key_sz <= 0 || key_sz > STSAFE_MAX_KEY_LEN) {
1254            err = BAD_FUNC_ARG;
1255        }
1256    }
1257    if (err == 0) {
1258        XMEMSET(sigRS, 0, STSAFE_MAX_SIG_LEN);
1259        r = &sigRS[0];
1260        s = &sigRS[key_sz];
1261        err = wc_ecc_sig_to_rs(sig, sigSz, r, &r_len, s, &s_len);
1262    }
1263    if (err == 0) {
1264        if ((int)r_len > key_sz || (int)s_len > key_sz) {
1265            err = BAD_FUNC_ARG;
1266        }
1267    }
1268    if (err == 0) {
1269        /* Zero-pad R and S */
1270        XMEMMOVE(&sigRS[key_sz - r_len], r, r_len);
1271        XMEMSET(&sigRS[0], 0, key_sz - r_len);
1272        XMEMMOVE(&sigRS[key_sz + (key_sz - s_len)], s, s_len);
1273        XMEMSET(&sigRS[key_sz], 0, key_sz - s_len);
1274
1275        err = stsafe_verify(curve_id, (uint8_t*)hash, sigRS,
1276            pubKeyX, pubKeyY, (int32_t*)result);
1277        if (err != STSAFE_A_OK) {
1278            STSAFE_INTERFACE_PRINTF("stsafe_verify error: %d\n", err);
1279            err = WC_HW_E;
1280        }
1281    }
1282
1283    if (eccKeyInit) {
1284        wc_ecc_free(&eccKey);
1285    }
1286
1287#if defined(WOLFSSL_SMALL_STACK) && !defined(WOLFSSL_NO_MALLOC)
1288    XFREE(sigRS, NULL, DYNAMIC_TYPE_TMP_BUFFER);
1289    XFREE(pubKeyX, NULL, DYNAMIC_TYPE_TMP_BUFFER);
1290    XFREE(pubKeyY, NULL, DYNAMIC_TYPE_TMP_BUFFER);
1291#endif
1292
1293    return err;
1294}
1295
1296/**
1297 * \brief Sign Certificate Callback
1298 */
1299int SSL_STSAFE_SignCertificateCb(WOLFSSL* ssl, const byte* in,
1300                                 word32 inSz, byte* out, word32* outSz,
1301                                 const byte* key, word32 keySz, void* ctx)
1302{
1303    int err = 0;
1304#if defined(WOLFSSL_SMALL_STACK) && !defined(WOLFSSL_NO_MALLOC)
1305    byte* digest = NULL;
1306    byte* sigRS = NULL;
1307#else
1308    byte digest[STSAFE_MAX_KEY_LEN];
1309    byte sigRS[STSAFE_MAX_SIG_LEN];
1310#endif
1311    byte* r;
1312    byte* s;
1313    stsafe_curve_id_t curve_id;
1314    int key_sz;
1315
1316    (void)ssl;
1317    (void)ctx;
1318    (void)key;
1319    (void)keySz;
1320
1321#ifdef USE_STSAFE_VERBOSE
1322    WOLFSSL_MSG("SignCertificateCb: STSAFE");
1323#endif
1324
1325#if defined(WOLFSSL_SMALL_STACK) && !defined(WOLFSSL_NO_MALLOC)
1326    digest = (byte*)XMALLOC(STSAFE_MAX_KEY_LEN, NULL, DYNAMIC_TYPE_TMP_BUFFER);
1327    sigRS = (byte*)XMALLOC(STSAFE_MAX_SIG_LEN, NULL, DYNAMIC_TYPE_TMP_BUFFER);
1328    if (digest == NULL || sigRS == NULL) {
1329        err = MEMORY_E;
1330    }
1331#endif
1332
1333    if (err == 0) {
1334        curve_id = stsafe_get_curve_mode();
1335        key_sz = stsafe_get_key_size(curve_id);
1336
1337        if ((int)inSz > key_sz)
1338            inSz = key_sz;
1339
1340        XMEMSET(digest, 0, STSAFE_MAX_KEY_LEN);
1341        XMEMCPY(&digest[key_sz - inSz], in, inSz);
1342
1343        XMEMSET(sigRS, 0, STSAFE_MAX_SIG_LEN);
1344        err = stsafe_sign(STSAFE_KEY_SLOT_0, curve_id, digest, sigRS);
1345        if (err != STSAFE_A_OK) {
1346            STSAFE_INTERFACE_PRINTF("stsafe_sign error: %d\n", err);
1347            err = WC_HW_E;
1348        }
1349    }
1350
1351    if (err == 0) {
1352        r = &sigRS[0];
1353        s = &sigRS[key_sz];
1354        err = wc_ecc_rs_raw_to_sig(r, key_sz, s, key_sz, out, outSz);
1355        if (err != 0) {
1356            WOLFSSL_MSG("Error converting RS to Signature");
1357        }
1358    }
1359
1360#if defined(WOLFSSL_SMALL_STACK) && !defined(WOLFSSL_NO_MALLOC)
1361    XFREE(digest, NULL, DYNAMIC_TYPE_TMP_BUFFER);
1362    XFREE(sigRS, NULL, DYNAMIC_TYPE_TMP_BUFFER);
1363#endif
1364
1365    return err;
1366}
1367
1368/**
1369 * \brief Shared Secret Callback (ECDHE)
1370 */
1371int SSL_STSAFE_SharedSecretCb(WOLFSSL* ssl, ecc_key* otherKey,
1372                              unsigned char* pubKeyDer, unsigned int* pubKeySz,
1373                              unsigned char* out, unsigned int* outlen,
1374                              int side, void* ctx)
1375{
1376    int err = 0;
1377    int tmpKeyInit = 0;
1378#if defined(WOLFSSL_SMALL_STACK) && !defined(WOLFSSL_NO_MALLOC)
1379    byte* otherKeyX = NULL;
1380    byte* otherKeyY = NULL;
1381    byte* pubKeyRaw = NULL;
1382#else
1383    byte otherKeyX[STSAFE_MAX_KEY_LEN];
1384    byte otherKeyY[STSAFE_MAX_KEY_LEN];
1385    byte pubKeyRaw[STSAFE_MAX_PUBKEY_RAW_LEN];
1386#endif
1387    word32 otherKeyX_len = STSAFE_MAX_KEY_LEN;
1388    word32 otherKeyY_len = STSAFE_MAX_KEY_LEN;
1389    stsafe_slot_t slot = STSAFE_KEY_SLOT_0;
1390    stsafe_curve_id_t curve_id;
1391    ecc_key tmpKey;
1392    int ecc_curve;
1393    int key_sz;
1394
1395    (void)ssl;
1396    (void)ctx;
1397
1398#ifdef USE_STSAFE_VERBOSE
1399    WOLFSSL_MSG("SharedSecretCb: STSAFE (ECDHE)");
1400#endif
1401
1402#if defined(WOLFSSL_SMALL_STACK) && !defined(WOLFSSL_NO_MALLOC)
1403    otherKeyX = (byte*)XMALLOC(STSAFE_MAX_KEY_LEN, NULL,
1404        DYNAMIC_TYPE_TMP_BUFFER);
1405    otherKeyY = (byte*)XMALLOC(STSAFE_MAX_KEY_LEN, NULL,
1406        DYNAMIC_TYPE_TMP_BUFFER);
1407    pubKeyRaw = (byte*)XMALLOC(STSAFE_MAX_PUBKEY_RAW_LEN, NULL,
1408        DYNAMIC_TYPE_TMP_BUFFER);
1409    if (otherKeyX == NULL || otherKeyY == NULL || pubKeyRaw == NULL) {
1410        err = MEMORY_E;
1411    }
1412#endif
1413
1414    if (err == 0) {
1415        err = wc_ecc_init(&tmpKey);
1416        if (err == 0) {
1417            tmpKeyInit = 1;
1418        }
1419    }
1420
1421    if (err == 0) {
1422        ecc_curve = otherKey->dp->id;
1423        curve_id = stsafe_get_ecc_curve_id(ecc_curve);
1424        key_sz = stsafe_get_key_size(curve_id);
1425
1426        if (side == WOLFSSL_CLIENT_END) {
1427            err = wc_ecc_export_public_raw(otherKey, otherKeyX, &otherKeyX_len,
1428                otherKeyY, &otherKeyY_len);
1429
1430            if (err == 0) {
1431#ifdef WOLFSSL_STSAFEA120
1432                /* Use ECDHE ephemeral key generation for A120 */
1433                err = stsafe_create_ecdhe_key(curve_id, pubKeyRaw);
1434                if (err != STSAFE_A_OK) {
1435                    STSAFE_INTERFACE_PRINTF("stsafe_create_ecdhe_key error: %d\n",
1436                        err);
1437                    err = WC_HW_E;
1438                }
1439                slot = STSAFE_KEY_SLOT_EPHEMERAL;
1440#else
1441                /* Legacy A100/A110 uses slot-based key generation */
1442                err = stsafe_create_key(&slot, curve_id, pubKeyRaw);
1443                if (err != STSAFE_A_OK) {
1444                    STSAFE_INTERFACE_PRINTF("stsafe_create_key error: %d\n",
1445                        err);
1446                    err = WC_HW_E;
1447                }
1448#endif
1449            }
1450
1451            if (err == 0) {
1452                err = wc_ecc_import_unsigned(&tmpKey, pubKeyRaw,
1453                    &pubKeyRaw[key_sz], NULL, ecc_curve);
1454            }
1455            if (err == 0) {
1456                err = wc_ecc_export_x963(&tmpKey, pubKeyDer, pubKeySz);
1457            }
1458        }
1459        else if (side == WOLFSSL_SERVER_END) {
1460            err = wc_ecc_import_x963_ex(pubKeyDer, *pubKeySz, &tmpKey,
1461                ecc_curve);
1462            if (err == 0) {
1463                err = wc_ecc_export_public_raw(&tmpKey, otherKeyX,
1464                    &otherKeyX_len, otherKeyY, &otherKeyY_len);
1465            }
1466        }
1467        else {
1468            err = BAD_FUNC_ARG;
1469        }
1470    }
1471
1472    if (err == 0) {
1473        err = stsafe_shared_secret(slot, curve_id, otherKeyX, otherKeyY,
1474            out, (int32_t*)outlen);
1475        if (err != STSAFE_A_OK) {
1476            STSAFE_INTERFACE_PRINTF("stsafe_shared_secret error: %d\n", err);
1477            err = WC_HW_E;
1478        }
1479    }
1480
1481    if (tmpKeyInit) {
1482        wc_ecc_free(&tmpKey);
1483    }
1484
1485#if defined(WOLFSSL_SMALL_STACK) && !defined(WOLFSSL_NO_MALLOC)
1486    XFREE(otherKeyX, NULL, DYNAMIC_TYPE_TMP_BUFFER);
1487    XFREE(otherKeyY, NULL, DYNAMIC_TYPE_TMP_BUFFER);
1488    XFREE(pubKeyRaw, NULL, DYNAMIC_TYPE_TMP_BUFFER);
1489#endif
1490
1491    return err;
1492}
1493
1494/**
1495 * \brief Setup PK callbacks for STSAFE
1496 */
1497int SSL_STSAFE_SetupPkCallbacks(WOLFSSL_CTX* ctx)
1498{
1499    wolfSSL_CTX_SetEccKeyGenCb(ctx, SSL_STSAFE_CreateKeyCb);
1500    wolfSSL_CTX_SetEccSignCb(ctx, SSL_STSAFE_SignCertificateCb);
1501    wolfSSL_CTX_SetEccVerifyCb(ctx, SSL_STSAFE_VerifyPeerCertCb);
1502    wolfSSL_CTX_SetEccSharedSecretCb(ctx, SSL_STSAFE_SharedSecretCb);
1503    wolfSSL_CTX_SetDevId(ctx, 0);
1504    return 0;
1505}
1506
1507/**
1508 * \brief Setup PK callback context
1509 */
1510int SSL_STSAFE_SetupPkCallbackCtx(WOLFSSL* ssl, void* user_ctx)
1511{
1512    wolfSSL_SetEccKeyGenCtx(ssl, user_ctx);
1513    wolfSSL_SetEccSharedSecretCtx(ssl, user_ctx);
1514    wolfSSL_SetEccSignCtx(ssl, user_ctx);
1515    wolfSSL_SetEccVerifyCtx(ssl, user_ctx);
1516    return 0;
1517}
1518
1519#endif /* HAVE_PK_CALLBACKS */
1520
1521
1522/* ========================================================================== */
1523/* Crypto Callbacks                                                           */
1524/* ========================================================================== */
1525
1526#ifdef WOLF_CRYPTO_CB
1527
1528int wolfSSL_STSAFE_CryptoDevCb(int devId, wc_CryptoInfo* info, void* ctx)
1529{
1530    int rc = CRYPTOCB_UNAVAILABLE;
1531    wolfSTSAFE_CryptoCb_Ctx* stsCtx = (wolfSTSAFE_CryptoCb_Ctx*)ctx;
1532
1533    if (info == NULL || ctx == NULL) {
1534        rc = BAD_FUNC_ARG;
1535    }
1536
1537    (void)devId;
1538    (void)stsCtx;
1539
1540    if (rc != BAD_FUNC_ARG && info->algo_type == WC_ALGO_TYPE_SEED) {
1541    #if !defined(WC_NO_RNG) && defined(USE_STSAFE_RNG_SEED)
1542        rc = 0;
1543        while (rc == 0 && info->seed.sz > 0) {
1544            int len = stsafe_get_random(info->seed.seed, info->seed.sz);
1545            if (len < 0) {
1546                rc = len;
1547            }
1548            else {
1549                info->seed.seed += len;
1550                info->seed.sz -= len;
1551            }
1552        }
1553    #else
1554        rc = CRYPTOCB_UNAVAILABLE;
1555    #endif
1556    }
1557#ifdef HAVE_ECC
1558    else if (rc != BAD_FUNC_ARG && info->algo_type == WC_ALGO_TYPE_PK) {
1559    #ifdef USE_STSAFE_VERBOSE
1560        STSAFE_INTERFACE_PRINTF("STSAFE Pk: Type %d\n", info->pk.type);
1561    #endif
1562
1563        if (info->pk.type == WC_PK_TYPE_EC_KEYGEN) {
1564        #if defined(WOLFSSL_SMALL_STACK) && !defined(WOLFSSL_NO_MALLOC)
1565            byte* pubKeyRaw = NULL;
1566        #else
1567            byte pubKeyRaw[STSAFE_MAX_PUBKEY_RAW_LEN];
1568        #endif
1569            stsafe_slot_t slot;
1570            stsafe_curve_id_t curve_id;
1571            int ecc_curve, key_sz;
1572
1573            WOLFSSL_MSG("STSAFE: ECC KeyGen");
1574
1575            rc = 0;
1576        #if defined(WOLFSSL_SMALL_STACK) && !defined(WOLFSSL_NO_MALLOC)
1577            pubKeyRaw = (byte*)XMALLOC(STSAFE_MAX_PUBKEY_RAW_LEN, NULL,
1578                DYNAMIC_TYPE_TMP_BUFFER);
1579            if (pubKeyRaw == NULL) {
1580                rc = MEMORY_E;
1581            }
1582        #endif
1583
1584            if (rc == 0) {
1585                ecc_curve = info->pk.eckg.curveId;
1586                curve_id = stsafe_get_ecc_curve_id(ecc_curve);
1587                key_sz = stsafe_get_key_size(curve_id);
1588
1589                /* For A120: Use ephemeral slot (0xFF) for ECDH/ECDHE operations.
1590                 * Use persistent slots (0-4) for ECDSA signing operations.
1591                 * Note: Persistent slots require key establishment to be enabled
1592                 * in their mode of operation flags via put_attribute command. */
1593#ifdef WOLFSSL_STSAFEA120
1594                /* Check if this is for ECDH by looking at devCtx hint */
1595                if (info->pk.eckg.key != NULL && info->pk.eckg.key->devCtx != NULL) {
1596                    slot = STSAFE_DEVCXT_TO_SLOT(info->pk.eckg.key->devCtx);
1597                } else {
1598                    /* Default: Use slot 1 for ECDSA signing */
1599                    slot = STSAFE_KEY_SLOT_1;
1600                }
1601
1602                STSAFE_INTERFACE_PRINTF("STSAFE: KeyGen slot %d, curve_id %d\n",
1603                    slot, curve_id);
1604
1605                /* Always use ephemeral slot (0xFF) for ECDH operations */
1606                if (slot == STSAFE_KEY_SLOT_EPHEMERAL) {
1607                    rc = stsafe_create_ecdhe_key(curve_id, pubKeyRaw);
1608                } else {
1609                    /* Persistent slot for signing */
1610                    rc = stsafe_create_key(slot, curve_id, pubKeyRaw);
1611                }
1612                if (rc != STSE_OK) {
1613                    STSAFE_INTERFACE_PRINTF("STSAFE: KeyGen (slot %d) error: %d\n", slot, rc);
1614                    rc = WC_HW_E;
1615                } else {
1616                    rc = STSAFE_A_OK;
1617                }
1618#else
1619                /* Legacy A100/A110 uses slot-based key generation */
1620                rc = stsafe_create_key(&slot, curve_id, pubKeyRaw);
1621                if (rc != STSAFE_A_OK) {
1622                    STSAFE_INTERFACE_PRINTF("stsafe_create_key error: %d\n",
1623                        rc);
1624                    rc = WC_HW_E;
1625                }
1626#endif
1627            }
1628
1629            if (rc == 0) {
1630                /* Import public key */
1631                rc = wc_ecc_import_unsigned(info->pk.eckg.key, pubKeyRaw,
1632                    &pubKeyRaw[key_sz], NULL, ecc_curve);
1633            }
1634
1635            if (rc == 0) {
1636                /* Store slot number directly in devCtx */
1637                info->pk.eckg.key->devCtx = STSAFE_SLOT_TO_DEVCXT(slot);
1638            }
1639
1640
1641        #if defined(WOLFSSL_SMALL_STACK) && !defined(WOLFSSL_NO_MALLOC)
1642            XFREE(pubKeyRaw, NULL, DYNAMIC_TYPE_TMP_BUFFER);
1643        #endif
1644        }
1645        else if (info->pk.type == WC_PK_TYPE_ECDSA_SIGN) {
1646        #if defined(WOLFSSL_SMALL_STACK) && !defined(WOLFSSL_NO_MALLOC)
1647            byte* digest = NULL;
1648            byte* sigRS = NULL;
1649        #else
1650            byte digest[STSAFE_MAX_KEY_LEN];
1651            byte sigRS[STSAFE_MAX_SIG_LEN];
1652        #endif
1653            byte* r;
1654            byte* s;
1655            stsafe_slot_t slot;
1656            stsafe_curve_id_t curve_id;
1657            int ecc_curve;
1658            word32 inSz = info->pk.eccsign.inlen;
1659            int key_sz;
1660
1661            WOLFSSL_MSG("STSAFE: ECC Sign");
1662
1663            rc = 0;
1664        #if defined(WOLFSSL_SMALL_STACK) && !defined(WOLFSSL_NO_MALLOC)
1665            digest = (byte*)XMALLOC(STSAFE_MAX_KEY_LEN, NULL,
1666                DYNAMIC_TYPE_TMP_BUFFER);
1667            sigRS = (byte*)XMALLOC(STSAFE_MAX_SIG_LEN, NULL,
1668                DYNAMIC_TYPE_TMP_BUFFER);
1669            if (digest == NULL || sigRS == NULL) {
1670                rc = MEMORY_E;
1671            }
1672        #endif
1673
1674            if (rc == 0) {
1675                /* Get curve from signing key */
1676                if (info->pk.eccsign.key != NULL &&
1677                    info->pk.eccsign.key->dp != NULL) {
1678                    ecc_curve = info->pk.eccsign.key->dp->id;
1679                    curve_id = stsafe_get_ecc_curve_id(ecc_curve);
1680                } else {
1681                    curve_id = stsafe_get_curve_mode();
1682                }
1683                key_sz = stsafe_get_key_size(curve_id);
1684
1685                if ((int)inSz > key_sz)
1686                    inSz = key_sz;
1687
1688                XMEMSET(digest, 0, STSAFE_MAX_KEY_LEN);
1689                XMEMCPY(&digest[key_sz - inSz], info->pk.eccsign.in, inSz);
1690
1691                XMEMSET(sigRS, 0, STSAFE_MAX_SIG_LEN);
1692                /* Retrieve slot from devCtx if available, otherwise use default */
1693                slot = STSAFE_KEY_SLOT_1; /* Default fallback */
1694                if (info->pk.eccsign.key != NULL && info->pk.eccsign.key->devCtx != NULL) {
1695                    slot = STSAFE_DEVCXT_TO_SLOT(info->pk.eccsign.key->devCtx);
1696                    STSAFE_INTERFACE_PRINTF("STSAFE: Sign using slot %d\n", slot);
1697                } else {
1698                    WOLFSSL_MSG("STSAFE: Sign using default slot 1");
1699                }
1700                rc = stsafe_sign(slot, curve_id, digest, sigRS);
1701                if (rc != STSAFE_A_OK) {
1702                    STSAFE_INTERFACE_PRINTF("stsafe_sign error: %d\n", rc);
1703                    rc = WC_HW_E;
1704                }
1705            }
1706
1707            if (rc == 0) {
1708                r = &sigRS[0];
1709                s = &sigRS[key_sz];
1710                rc = wc_ecc_rs_raw_to_sig(r, key_sz, s, key_sz,
1711                    info->pk.eccsign.out, info->pk.eccsign.outlen);
1712                if (rc != 0) {
1713                    WOLFSSL_MSG("Error converting RS to Signature");
1714                }
1715            }
1716
1717        #if defined(WOLFSSL_SMALL_STACK) && !defined(WOLFSSL_NO_MALLOC)
1718            XFREE(digest, NULL, DYNAMIC_TYPE_TMP_BUFFER);
1719            XFREE(sigRS, NULL, DYNAMIC_TYPE_TMP_BUFFER);
1720        #endif
1721        }
1722        else if (info->pk.type == WC_PK_TYPE_ECDSA_VERIFY) {
1723        #if defined(WOLFSSL_SMALL_STACK) && !defined(WOLFSSL_NO_MALLOC)
1724            byte* sigRS = NULL;
1725            byte* pubKeyX = NULL;
1726            byte* pubKeyY = NULL;
1727        #else
1728            byte sigRS[STSAFE_MAX_SIG_LEN];
1729            byte pubKeyX[STSAFE_MAX_PUBKEY_RAW_LEN/2];
1730            byte pubKeyY[STSAFE_MAX_PUBKEY_RAW_LEN/2];
1731        #endif
1732            byte* r = NULL;
1733            byte* s = NULL;
1734            word32 r_len = STSAFE_MAX_SIG_LEN/2, s_len = STSAFE_MAX_SIG_LEN/2;
1735            word32 pubKeyX_len = STSAFE_MAX_PUBKEY_RAW_LEN/2;
1736            word32 pubKeyY_len = STSAFE_MAX_PUBKEY_RAW_LEN/2;
1737            stsafe_curve_id_t curve_id;
1738            int ecc_curve, key_sz;
1739
1740            WOLFSSL_MSG("STSAFE: ECC Verify");
1741
1742            rc = 0;
1743            if (info->pk.eccverify.key == NULL ||
1744                info->pk.eccverify.key->dp == NULL) {
1745                rc = BAD_FUNC_ARG;
1746            }
1747
1748        #if defined(WOLFSSL_SMALL_STACK) && !defined(WOLFSSL_NO_MALLOC)
1749            if (rc == 0) {
1750                sigRS = (byte*)XMALLOC(STSAFE_MAX_SIG_LEN, NULL,
1751                    DYNAMIC_TYPE_TMP_BUFFER);
1752                pubKeyX = (byte*)XMALLOC(STSAFE_MAX_PUBKEY_RAW_LEN/2, NULL,
1753                    DYNAMIC_TYPE_TMP_BUFFER);
1754                pubKeyY = (byte*)XMALLOC(STSAFE_MAX_PUBKEY_RAW_LEN/2, NULL,
1755                    DYNAMIC_TYPE_TMP_BUFFER);
1756                if (sigRS == NULL || pubKeyX == NULL || pubKeyY == NULL) {
1757                    rc = MEMORY_E;
1758                }
1759            }
1760        #endif
1761
1762            if (rc == 0) {
1763                ecc_curve = info->pk.eccverify.key->dp->id;
1764                curve_id = stsafe_get_ecc_curve_id(ecc_curve);
1765                key_sz = stsafe_get_key_size(curve_id);
1766                if (key_sz <= 0 || key_sz > STSAFE_MAX_KEY_LEN) {
1767                    rc = BAD_FUNC_ARG;
1768                }
1769            }
1770
1771            if (rc == 0) {
1772                rc = wc_ecc_export_public_raw(info->pk.eccverify.key,
1773                    pubKeyX, &pubKeyX_len, pubKeyY, &pubKeyY_len);
1774            }
1775            if (rc == 0) {
1776                XMEMSET(sigRS, 0, STSAFE_MAX_SIG_LEN);
1777                r = &sigRS[0];
1778                s = &sigRS[key_sz];
1779                rc = wc_ecc_sig_to_rs(info->pk.eccverify.sig,
1780                    info->pk.eccverify.siglen, r, &r_len, s, &s_len);
1781            }
1782            if (rc == 0) {
1783                if ((int)r_len > key_sz || (int)s_len > key_sz) {
1784                    rc = BAD_FUNC_ARG;
1785                }
1786            }
1787            if (rc == 0) {
1788                XMEMMOVE(&sigRS[key_sz - r_len], r, r_len);
1789                XMEMSET(&sigRS[0], 0, key_sz - r_len);
1790                XMEMMOVE(&sigRS[key_sz + (key_sz - s_len)], s, s_len);
1791                XMEMSET(&sigRS[key_sz], 0, key_sz - s_len);
1792
1793                rc = stsafe_verify(curve_id, (uint8_t*)info->pk.eccverify.hash,
1794                    sigRS, pubKeyX, pubKeyY, (int32_t*)info->pk.eccverify.res);
1795                if (rc != STSAFE_A_OK) {
1796                    STSAFE_INTERFACE_PRINTF("stsafe_verify error: %d\n", rc);
1797                    rc = WC_HW_E;
1798                }
1799            }
1800
1801        #if defined(WOLFSSL_SMALL_STACK) && !defined(WOLFSSL_NO_MALLOC)
1802            XFREE(sigRS, NULL, DYNAMIC_TYPE_TMP_BUFFER);
1803            XFREE(pubKeyX, NULL, DYNAMIC_TYPE_TMP_BUFFER);
1804            XFREE(pubKeyY, NULL, DYNAMIC_TYPE_TMP_BUFFER);
1805        #endif
1806        }
1807        else if (info->pk.type == WC_PK_TYPE_ECDH) {
1808        #if defined(WOLFSSL_SMALL_STACK) && !defined(WOLFSSL_NO_MALLOC)
1809            byte* otherKeyX = NULL;
1810            byte* otherKeyY = NULL;
1811        #else
1812            byte otherKeyX[STSAFE_MAX_KEY_LEN];
1813            byte otherKeyY[STSAFE_MAX_KEY_LEN];
1814        #endif
1815            word32 otherKeyX_len = STSAFE_MAX_KEY_LEN;
1816            word32 otherKeyY_len = STSAFE_MAX_KEY_LEN;
1817            stsafe_curve_id_t curve_id;
1818            stsafe_slot_t slot;
1819            int ecc_curve;
1820
1821            WOLFSSL_MSG("STSAFE: ECDH");
1822
1823            rc = 0;
1824            if (info->pk.ecdh.public_key == NULL) {
1825                rc = BAD_FUNC_ARG;
1826            }
1827
1828        #if defined(WOLFSSL_SMALL_STACK) && !defined(WOLFSSL_NO_MALLOC)
1829            if (rc == 0) {
1830                otherKeyX = (byte*)XMALLOC(STSAFE_MAX_KEY_LEN, NULL,
1831                    DYNAMIC_TYPE_TMP_BUFFER);
1832                otherKeyY = (byte*)XMALLOC(STSAFE_MAX_KEY_LEN, NULL,
1833                    DYNAMIC_TYPE_TMP_BUFFER);
1834                if (otherKeyX == NULL || otherKeyY == NULL) {
1835                    rc = MEMORY_E;
1836                }
1837            }
1838        #endif
1839
1840            if (rc == 0) {
1841                /* Get curve from private_key (hardware key), not public_key (peer key) */
1842                if (info->pk.ecdh.private_key != NULL &&
1843                    info->pk.ecdh.private_key->dp != NULL) {
1844                    ecc_curve = info->pk.ecdh.private_key->dp->id;
1845                } else if (info->pk.ecdh.public_key != NULL &&
1846                           info->pk.ecdh.public_key->dp != NULL) {
1847                    /* Fallback to public_key if private_key not available */
1848                    ecc_curve = info->pk.ecdh.public_key->dp->id;
1849                } else {
1850                    rc = BAD_FUNC_ARG;
1851                }
1852                if (rc == 0) {
1853                    curve_id = stsafe_get_ecc_curve_id(ecc_curve);
1854                    /* Note: STSAFE_ECC_CURVE_P256 is 0, so we can't use STSAFE_DEFAULT_CURVE check.
1855                     * Instead, verify the curve_id is valid by checking it's one of the supported curves */
1856                    if (curve_id != STSAFE_ECC_CURVE_P256 && curve_id != STSAFE_ECC_CURVE_P384
1857                    #if defined(HAVE_ECC_BRAINPOOL) && defined(STSE_CONF_ECC_BRAINPOOL_P_256)
1858                        && curve_id != STSAFE_ECC_CURVE_BP256
1859                    #endif
1860                    #if defined(HAVE_ECC_BRAINPOOL) && defined(STSE_CONF_ECC_BRAINPOOL_P_384)
1861                        && curve_id != STSAFE_ECC_CURVE_BP384
1862                    #endif
1863                    ) {
1864                        rc = BAD_FUNC_ARG;
1865                    }
1866                }
1867
1868                if (rc == 0) {
1869                    rc = wc_ecc_export_public_raw(info->pk.ecdh.public_key,
1870                        otherKeyX, &otherKeyX_len, otherKeyY, &otherKeyY_len);
1871                }
1872            }
1873            if (rc == 0) {
1874                *info->pk.ecdh.outlen = 0;
1875
1876                if (rc == 0) {
1877                    /* For ECDH operations, use the slot from devCtx. */
1878                    slot = STSAFE_KEY_SLOT_EPHEMERAL;
1879                    if (info->pk.ecdh.private_key != NULL &&
1880                        info->pk.ecdh.private_key->devCtx != NULL) {
1881                        slot = STSAFE_DEVCXT_TO_SLOT(info->pk.ecdh.private_key->devCtx);
1882                    }
1883
1884                    STSAFE_INTERFACE_PRINTF("STSAFE: ECDH with slot %d, curve_id %d\n",
1885                        slot, curve_id);
1886
1887                    rc = stsafe_shared_secret(slot, curve_id,
1888                        otherKeyX, otherKeyY,
1889                        info->pk.ecdh.out, (int32_t*)info->pk.ecdh.outlen);
1890                    if (rc != STSAFE_A_OK) {
1891                        WOLFSSL_MSG("STSAFE: stsafe_shared_secret failed");
1892                        STSAFE_INTERFACE_PRINTF("stsafe_shared_secret "
1893                            "error: %d (slot: %d, curve_id: %d)\n",
1894                            rc, slot, curve_id);
1895                        rc = WC_HW_E;
1896                    }
1897                }
1898            }
1899
1900        #if defined(WOLFSSL_SMALL_STACK) && !defined(WOLFSSL_NO_MALLOC)
1901            XFREE(otherKeyX, NULL, DYNAMIC_TYPE_TMP_BUFFER);
1902            XFREE(otherKeyY, NULL, DYNAMIC_TYPE_TMP_BUFFER);
1903        #endif
1904        }
1905    }
1906#endif /* HAVE_ECC */
1907
1908    if (rc != 0 && rc != WC_NO_ERR_TRACE(CRYPTOCB_UNAVAILABLE)) {
1909        WOLFSSL_MSG("STSAFE: CryptoCb failed");
1910    #ifdef USE_STSAFE_VERBOSE
1911        STSAFE_INTERFACE_PRINTF("STSAFE: CryptoCb failed %d\n", rc);
1912    #endif
1913        rc = WC_HW_E;
1914    }
1915
1916    return rc;
1917}
1918
1919#endif /* WOLF_CRYPTO_CB */
1920
1921#endif /* WOLFSSL_STSAFE */