diff --git a/nxp-se05x-middleware/README.md b/nxp-se05x-middleware/README.md index b10911bd..798a3423 100644 --- a/nxp-se05x-middleware/README.md +++ b/nxp-se05x-middleware/README.md @@ -56,6 +56,17 @@ $ make $ sudo make install ``` +When `PTMW_SE05X_Auth=PlatfSCP03`, the patched wolfSSL HostCrypto backend is +compiled in an SCP03-only mode. It keeps only the AES-CBC, CMAC, and RNG calls +used by platform SCP03, so unused RSA, ECC, HMAC, digest, DES3, HKDF, and AEAD +code is not pulled from a statically linked wolfSSL library. Combined +authentication modes (for example `ECKey_PlatfSCP03`) retain the full backend +because their non-platform authentication method needs additional algorithms. + +`--enable-cmac` is still required. `--enable-keygen` is not required by the +SCP03-only middleware path itself, but remains necessary if the application +uses wolfSSL key generation after the authenticated channel is established. + Then, build SE05x Middleware: ``` diff --git a/nxp-se05x-middleware/simw-top-v040200.patch b/nxp-se05x-middleware/simw-top-v040200.patch index 8ae62a90..9fb09b3c 100644 --- a/nxp-se05x-middleware/simw-top-v040200.patch +++ b/nxp-se05x-middleware/simw-top-v040200.patch @@ -3023,7 +3023,7 @@ diff -Naur simw-top/sss/src/keystore/keystore_pc.c /home/pi/se_mw/simw-top/sss/s diff -Naur simw-top/sss/src/wolfssl/fsl_sss_wolfssl_apis.c /home/pi/se_mw/simw-top/sss/src/wolfssl/fsl_sss_wolfssl_apis.c --- simw-top/sss/src/wolfssl/fsl_sss_wolfssl_apis.c 1969-12-31 17:00:00.000000000 -0700 +++ /home/pi/se_mw/simw-top/sss/src/wolfssl/fsl_sss_wolfssl_apis.c 2022-11-11 10:27:06.335662156 -0700 -@@ -0,0 +1,3298 @@ +@@ -0,0 +1,3423 @@ +/* + * + * Copyright 2018-2020 NXP @@ -3060,6 +3060,43 @@ diff -Naur simw-top/sss/src/wolfssl/fsl_sss_wolfssl_apis.c /home/pi/se_mw/simw-t + +#include "nxLog_sss.h" + ++/* Record the Aes layout before SCP03-only pruning removes HAVE_AESGCM. */ ++#if defined(WOLFSSL_SE050) && defined(HAVE_AESGCM) ++ #define SSS_WOLFSSL_AES_HAS_USESWCRYPT ++#endif ++ ++#define SSS_WOLFSSL_SCP03_ONLY SSS_HAVE_SE05X_AUTH_PLATFSCP03 ++ ++/* A pure Platform SCP03 build only needs AES-CBC, CMAC and the RNG used to ++ * create the host challenge. Keep the complete SSS API surface available, ++ * but do not make the unused implementations reference other wolfCrypt ++ * algorithms. This is intentionally done after the wolfSSL headers have been ++ * included so the library configuration and public type layouts stay intact. */ ++#if SSS_WOLFSSL_SCP03_ONLY ++ #undef SSSFTR_SW_ECC ++ #define SSSFTR_SW_ECC 0 ++ #undef SSSFTR_SW_RSA ++ #define SSSFTR_SW_RSA 0 ++ #ifndef NO_RSA ++ #define NO_RSA ++ #endif ++ #ifndef NO_HMAC ++ #define NO_HMAC ++ #endif ++ #ifndef NO_DES3 ++ #define NO_DES3 ++ #endif ++ #undef HAVE_ECC ++ #undef HAVE_CURVE25519 ++ #undef HAVE_CURVE448 ++ #undef HAVE_ED25519 ++ #undef HAVE_HKDF ++ #undef HAVE_AESGCM ++ #undef WOLFSSL_AESGCM ++ #undef HAVE_AESCCM ++ #undef WOLFSSL_CCM ++#endif ++ +#define MAX_KEY_OBJ_COUNT KS_N_ENTIRES +#define MAX_FILE_NAME_SIZE 255 +#define MAX_SHARED_SECRET_DERIVED_DATA 255 @@ -4474,6 +4511,7 @@ diff -Naur simw-top/sss/src/wolfssl/fsl_sss_wolfssl_apis.c /home/pi/se_mw/simw-t + uint8_t *destData, size_t *destLen) +{ + sss_status_t retval = kStatus_SSS_Fail; ++#if !SSS_WOLFSSL_SCP03_ONLY + sss_wolfssl_object_t *keyObj = context->keyObject; + int ret = 0; + int padding = 0; @@ -4506,6 +4544,13 @@ diff -Naur simw-top/sss/src/wolfssl/fsl_sss_wolfssl_apis.c /home/pi/se_mw/simw-t + } + + wc_FreeRng(&rng); ++#else ++ (void)context; ++ (void)srcData; ++ (void)srcLen; ++ (void)destData; ++ (void)destLen; ++#endif + + return retval; +} @@ -4515,6 +4560,7 @@ diff -Naur simw-top/sss/src/wolfssl/fsl_sss_wolfssl_apis.c /home/pi/se_mw/simw-t + uint8_t *destData, size_t *destLen) +{ + sss_status_t retval = kStatus_SSS_Fail; ++#if !SSS_WOLFSSL_SCP03_ONLY + sss_wolfssl_object_t *keyObj = context->keyObject; + int ret = 0; + int padding = 0; @@ -4539,6 +4585,13 @@ diff -Naur simw-top/sss/src/wolfssl/fsl_sss_wolfssl_apis.c /home/pi/se_mw/simw-t + *destLen = ret; + retval = kStatus_SSS_Success; + } ++#else ++ (void)context; ++ (void)srcData; ++ (void)srcLen; ++ (void)destData; ++ (void)destLen; ++#endif + + return retval; +} @@ -4548,6 +4601,7 @@ diff -Naur simw-top/sss/src/wolfssl/fsl_sss_wolfssl_apis.c /home/pi/se_mw/simw-t + uint8_t *signature, size_t *signatureLen) +{ + sss_status_t retval = kStatus_SSS_Fail; ++#if !SSS_WOLFSSL_SCP03_ONLY + int ret = 0; + int padding = 0; + int mgf = 0; @@ -4637,6 +4691,13 @@ diff -Naur simw-top/sss/src/wolfssl/fsl_sss_wolfssl_apis.c /home/pi/se_mw/simw-t + } + + wc_FreeRng(&rng); ++#else ++ (void)context; ++ (void)digest; ++ (void)digestLen; ++ (void)signature; ++ (void)signatureLen; ++#endif + + return retval; +} @@ -4646,6 +4707,7 @@ diff -Naur simw-top/sss/src/wolfssl/fsl_sss_wolfssl_apis.c /home/pi/se_mw/simw-t + uint8_t *signature, size_t signatureLen) +{ + sss_status_t retval = kStatus_SSS_Fail; ++#if !SSS_WOLFSSL_SCP03_ONLY + int ret = 0; + int padding = 0; + int mgf = 0; @@ -4746,6 +4808,13 @@ diff -Naur simw-top/sss/src/wolfssl/fsl_sss_wolfssl_apis.c /home/pi/se_mw/simw-t + LOG_E("Unsupported cipherType for digest sign"); + break; + } ++#else ++ (void)context; ++ (void)digest; ++ (void)digestLen; ++ (void)signature; ++ (void)signatureLen; ++#endif + + return retval; + @@ -4804,7 +4873,7 @@ diff -Naur simw-top/sss/src/wolfssl/fsl_sss_wolfssl_apis.c /home/pi/se_mw/simw-t + case kAlgorithm_SSS_AES_CBC: + case kAlgorithm_SSS_AES_CTR: + ret = wc_AesInit(&aes, NULL, INVALID_DEVID); -+ #ifdef WOLFSSL_SE050 ++ #ifdef SSS_WOLFSSL_AES_HAS_USESWCRYPT + if (ret == 0) { + /* HostCrypto should use software crypto, not SE05x */ + aes.useSWCrypt = 1; @@ -5084,7 +5153,7 @@ diff -Naur simw-top/sss/src/wolfssl/fsl_sss_wolfssl_apis.c /home/pi/se_mw/simw-t + if (context->algorithm == kAlgorithm_SSS_AES_GCM) { +#if !defined(NO_AES) && defined(HAVE_AESGCM) + ret = wc_AesInit(context->aes, NULL, INVALID_DEVID); -+ #ifdef WOLFSSL_SE050 ++ #ifdef SSS_WOLFSSL_AES_HAS_USESWCRYPT + if (ret == 0) { + /* HostCrypto should use software crypto, not SE05x */ + context->aes->useSWCrypt = 1; @@ -5118,7 +5187,7 @@ diff -Naur simw-top/sss/src/wolfssl/fsl_sss_wolfssl_apis.c /home/pi/se_mw/simw-t + else if (context->algorithm == kAlgorithm_SSS_AES_CCM) { +#if !defined(NO_AES) && defined(HAVE_AESCCM) + ret = wc_AesInit(context->aes, NULL, INVALID_DEVID); -+ #ifdef WOLFSSL_SE050 ++ #ifdef SSS_WOLFSSL_AES_HAS_USESWCRYPT + if (ret == 0) { + /* HostCrypto should use software crypto, not SE05x */ + context->aes->useSWCrypt = 1; @@ -5178,7 +5247,7 @@ diff -Naur simw-top/sss/src/wolfssl/fsl_sss_wolfssl_apis.c /home/pi/se_mw/simw-t + +#if !defined(NO_AES) && defined(HAVE_AESGCM) && defined(WOLFSSL_AESGCM_STREAM) + ret = wc_AesInit(context->aes, NULL, INVALID_DEVID); -+ #ifdef WOLFSSL_SE050 ++ #ifdef SSS_WOLFSSL_AES_HAS_USESWCRYPT + if (ret == 0) { + /* HostCrypto should use software crypto, not SE05x */ + context->aes->useSWCrypt = 1; @@ -5831,6 +5900,7 @@ diff -Naur simw-top/sss/src/wolfssl/fsl_sss_wolfssl_apis.c /home/pi/se_mw/simw-t +/* Functions : sss_wolfssl_md */ +/* ************************************************************************** */ + ++#if !SSS_WOLFSSL_SCP03_ONLY +sss_status_t sss_wolfssl_digest_context_init( + sss_wolfssl_digest_t *context, sss_wolfssl_session_t *session, + sss_algorithm_t algorithm, sss_mode_t mode) @@ -6003,6 +6073,61 @@ diff -Naur simw-top/sss/src/wolfssl/fsl_sss_wolfssl_apis.c /home/pi/se_mw/simw-t + } + memset(context, 0, sizeof(*context)); +} ++#else ++sss_status_t sss_wolfssl_digest_context_init( ++ sss_wolfssl_digest_t *context, sss_wolfssl_session_t *session, ++ sss_algorithm_t algorithm, sss_mode_t mode) ++{ ++ (void)context; ++ (void)session; ++ (void)algorithm; ++ (void)mode; ++ return kStatus_SSS_Fail; ++} ++ ++sss_status_t sss_wolfssl_digest_one_go( ++ sss_wolfssl_digest_t *context, const uint8_t *message, size_t messageLen, ++ uint8_t *digest, size_t *digestLen) ++{ ++ (void)context; ++ (void)message; ++ (void)messageLen; ++ (void)digest; ++ (void)digestLen; ++ return kStatus_SSS_Fail; ++} ++ ++sss_status_t sss_wolfssl_digest_init(sss_wolfssl_digest_t *context) ++{ ++ (void)context; ++ return kStatus_SSS_Fail; ++} ++ ++sss_status_t sss_wolfssl_digest_update(sss_wolfssl_digest_t *context, ++ const uint8_t *message, size_t messageLen) ++{ ++ (void)context; ++ (void)message; ++ (void)messageLen; ++ return kStatus_SSS_Fail; ++} ++ ++sss_status_t sss_wolfssl_digest_finish(sss_wolfssl_digest_t *context, ++ uint8_t *digest, size_t *digestLen) ++{ ++ (void)context; ++ (void)digest; ++ (void)digestLen; ++ return kStatus_SSS_Fail; ++} ++ ++void sss_wolfssl_digest_context_free(sss_wolfssl_digest_t *context) ++{ ++ if (context != NULL) { ++ memset(context, 0, sizeof(*context)); ++ } ++} ++#endif /* !SSS_WOLFSSL_SCP03_ONLY */ + +/* End: wolfssl_md */ + diff --git a/nxp-se05x-middleware/simw-top-v040701.patch b/nxp-se05x-middleware/simw-top-v040701.patch index 1272e1a4..85070bca 100644 --- a/nxp-se05x-middleware/simw-top-v040701.patch +++ b/nxp-se05x-middleware/simw-top-v040701.patch @@ -5179,10 +5179,10 @@ index 0000000..80a44f4 +#endif /* SSS_APIS_INC_FSL_SSS_WOLFSSL_TYPES_H_ */ diff --git a/sss/src/wolfssl/fsl_sss_wolfssl_apis.c b/sss/src/wolfssl/fsl_sss_wolfssl_apis.c new file mode 100644 -index 0000000..5a9aa2d +index 0000000..d1d1a78 --- /dev/null +++ b/sss/src/wolfssl/fsl_sss_wolfssl_apis.c -@@ -0,0 +1,3304 @@ +@@ -0,0 +1,3429 @@ +/* + * + * Copyright 2018-2025 NXP @@ -5219,6 +5219,43 @@ index 0000000..5a9aa2d + +#include "nxLog_sss.h" + ++/* Record the Aes layout before SCP03-only pruning removes HAVE_AESGCM. */ ++#if defined(WOLFSSL_SE050) && defined(HAVE_AESGCM) ++ #define SSS_WOLFSSL_AES_HAS_USESWCRYPT ++#endif ++ ++#define SSS_WOLFSSL_SCP03_ONLY SSS_HAVE_SE05X_AUTH_PLATFSCP03 ++ ++/* A pure Platform SCP03 build only needs AES-CBC, CMAC and the RNG used to ++ * create the host challenge. Keep the complete SSS API surface available, ++ * but do not make the unused implementations reference other wolfCrypt ++ * algorithms. This is intentionally done after the wolfSSL headers have been ++ * included so the library configuration and public type layouts stay intact. */ ++#if SSS_WOLFSSL_SCP03_ONLY ++ #undef SSSFTR_SW_ECC ++ #define SSSFTR_SW_ECC 0 ++ #undef SSSFTR_SW_RSA ++ #define SSSFTR_SW_RSA 0 ++ #ifndef NO_RSA ++ #define NO_RSA ++ #endif ++ #ifndef NO_HMAC ++ #define NO_HMAC ++ #endif ++ #ifndef NO_DES3 ++ #define NO_DES3 ++ #endif ++ #undef HAVE_ECC ++ #undef HAVE_CURVE25519 ++ #undef HAVE_CURVE448 ++ #undef HAVE_ED25519 ++ #undef HAVE_HKDF ++ #undef HAVE_AESGCM ++ #undef WOLFSSL_AESGCM ++ #undef HAVE_AESCCM ++ #undef WOLFSSL_CCM ++#endif ++ +#define MAX_KEY_OBJ_COUNT KS_N_ENTIRES +#define MAX_FILE_NAME_SIZE 255 +#define MAX_SHARED_SECRET_DERIVED_DATA 255 @@ -6633,6 +6670,7 @@ index 0000000..5a9aa2d + uint8_t *destData, size_t *destLen) +{ + sss_status_t retval = kStatus_SSS_Fail; ++#if !SSS_WOLFSSL_SCP03_ONLY + sss_wolfssl_object_t *keyObj = context->keyObject; + int ret = 0; + int padding = 0; @@ -6665,6 +6703,13 @@ index 0000000..5a9aa2d + } + + wc_FreeRng(&rng); ++#else ++ (void)context; ++ (void)srcData; ++ (void)srcLen; ++ (void)destData; ++ (void)destLen; ++#endif + + return retval; +} @@ -6674,6 +6719,7 @@ index 0000000..5a9aa2d + uint8_t *destData, size_t *destLen) +{ + sss_status_t retval = kStatus_SSS_Fail; ++#if !SSS_WOLFSSL_SCP03_ONLY + sss_wolfssl_object_t *keyObj = context->keyObject; + int ret = 0; + int padding = 0; @@ -6698,6 +6744,13 @@ index 0000000..5a9aa2d + *destLen = ret; + retval = kStatus_SSS_Success; + } ++#else ++ (void)context; ++ (void)srcData; ++ (void)srcLen; ++ (void)destData; ++ (void)destLen; ++#endif + + return retval; +} @@ -6707,6 +6760,7 @@ index 0000000..5a9aa2d + uint8_t *signature, size_t *signatureLen) +{ + sss_status_t retval = kStatus_SSS_Fail; ++#if !SSS_WOLFSSL_SCP03_ONLY + int ret = 0; + int padding = 0; + int mgf = 0; @@ -6800,6 +6854,13 @@ index 0000000..5a9aa2d + } + + wc_FreeRng(&rng); ++#else ++ (void)context; ++ (void)digest; ++ (void)digestLen; ++ (void)signature; ++ (void)signatureLen; ++#endif + + return retval; +} @@ -6809,6 +6870,7 @@ index 0000000..5a9aa2d + uint8_t *signature, size_t signatureLen) +{ + sss_status_t retval = kStatus_SSS_Fail; ++#if !SSS_WOLFSSL_SCP03_ONLY + int ret = 0; + int padding = 0; + int mgf = 0; @@ -6909,6 +6971,13 @@ index 0000000..5a9aa2d + LOG_E("Unsupported cipherType for digest sign"); + break; + } ++#else ++ (void)context; ++ (void)digest; ++ (void)digestLen; ++ (void)signature; ++ (void)signatureLen; ++#endif + + return retval; + @@ -6967,7 +7036,7 @@ index 0000000..5a9aa2d + case kAlgorithm_SSS_AES_CBC: + case kAlgorithm_SSS_AES_CTR: + ret = wc_AesInit(&aes, NULL, INVALID_DEVID); -+ #ifdef WOLFSSL_SE050 ++ #ifdef SSS_WOLFSSL_AES_HAS_USESWCRYPT + if (ret == 0) { + /* HostCrypto should use software crypto, not SE05x */ + aes.useSWCrypt = 1; @@ -7247,7 +7316,7 @@ index 0000000..5a9aa2d + if (context->algorithm == kAlgorithm_SSS_AES_GCM) { +#if !defined(NO_AES) && defined(HAVE_AESGCM) + ret = wc_AesInit(context->aes, NULL, INVALID_DEVID); -+ #ifdef WOLFSSL_SE050 ++ #ifdef SSS_WOLFSSL_AES_HAS_USESWCRYPT + if (ret == 0) { + /* HostCrypto should use software crypto, not SE05x */ + context->aes->useSWCrypt = 1; @@ -7281,7 +7350,7 @@ index 0000000..5a9aa2d + else if (context->algorithm == kAlgorithm_SSS_AES_CCM) { +#if !defined(NO_AES) && defined(HAVE_AESCCM) + ret = wc_AesInit(context->aes, NULL, INVALID_DEVID); -+ #ifdef WOLFSSL_SE050 ++ #ifdef SSS_WOLFSSL_AES_HAS_USESWCRYPT + if (ret == 0) { + /* HostCrypto should use software crypto, not SE05x */ + context->aes->useSWCrypt = 1; @@ -7341,7 +7410,7 @@ index 0000000..5a9aa2d + +#if !defined(NO_AES) && defined(HAVE_AESGCM) && defined(WOLFSSL_AESGCM_STREAM) + ret = wc_AesInit(context->aes, NULL, INVALID_DEVID); -+ #ifdef WOLFSSL_SE050 ++ #ifdef SSS_WOLFSSL_AES_HAS_USESWCRYPT + if (ret == 0) { + /* HostCrypto should use software crypto, not SE05x */ + context->aes->useSWCrypt = 1; @@ -7996,6 +8065,7 @@ index 0000000..5a9aa2d +/* Functions : sss_wolfssl_md */ +/* ************************************************************************** */ + ++#if !SSS_WOLFSSL_SCP03_ONLY +sss_status_t sss_wolfssl_digest_context_init( + sss_wolfssl_digest_t *context, sss_wolfssl_session_t *session, + sss_algorithm_t algorithm, sss_mode_t mode) @@ -8168,6 +8238,61 @@ index 0000000..5a9aa2d + } + memset(context, 0, sizeof(*context)); +} ++#else ++sss_status_t sss_wolfssl_digest_context_init( ++ sss_wolfssl_digest_t *context, sss_wolfssl_session_t *session, ++ sss_algorithm_t algorithm, sss_mode_t mode) ++{ ++ (void)context; ++ (void)session; ++ (void)algorithm; ++ (void)mode; ++ return kStatus_SSS_Fail; ++} ++ ++sss_status_t sss_wolfssl_digest_one_go( ++ sss_wolfssl_digest_t *context, const uint8_t *message, size_t messageLen, ++ uint8_t *digest, size_t *digestLen) ++{ ++ (void)context; ++ (void)message; ++ (void)messageLen; ++ (void)digest; ++ (void)digestLen; ++ return kStatus_SSS_Fail; ++} ++ ++sss_status_t sss_wolfssl_digest_init(sss_wolfssl_digest_t *context) ++{ ++ (void)context; ++ return kStatus_SSS_Fail; ++} ++ ++sss_status_t sss_wolfssl_digest_update(sss_wolfssl_digest_t *context, ++ const uint8_t *message, size_t messageLen) ++{ ++ (void)context; ++ (void)message; ++ (void)messageLen; ++ return kStatus_SSS_Fail; ++} ++ ++sss_status_t sss_wolfssl_digest_finish(sss_wolfssl_digest_t *context, ++ uint8_t *digest, size_t *digestLen) ++{ ++ (void)context; ++ (void)digest; ++ (void)digestLen; ++ return kStatus_SSS_Fail; ++} ++ ++void sss_wolfssl_digest_context_free(sss_wolfssl_digest_t *context) ++{ ++ if (context != NULL) { ++ memset(context, 0, sizeof(*context)); ++ } ++} ++#endif /* !SSS_WOLFSSL_SCP03_ONLY */ + +/* End: wolfssl_md */ +