Skip to content

Commit ea322ee

Browse files
Harshal5Harshal5
committed
test(hal/crypto): Add HMAC and DS using Key Manager key tests
- Also updated the test app to use esp_crypto_periph_clk.h
1 parent 6ca4d62 commit ea322ee

File tree

16 files changed

+755
-422
lines changed

16 files changed

+755
-422
lines changed

‎components/hal/test_apps/crypto/main/aes/aes_block.c‎

Lines changed: 6 additions & 16 deletions
Original file line numberDiff line numberDiff line change
@@ -1,5 +1,5 @@
11
/*
2-
* SPDX-FileCopyrightText: 2023-2024 Espressif Systems (Shanghai) CO LTD
2+
* SPDX-FileCopyrightText: 2023-2025 Espressif Systems (Shanghai) CO LTD
33
*
44
* SPDX-License-Identifier: CC0-1.0
55
*/
@@ -8,7 +8,7 @@
88
#include <stdlib.h>
99
#include <string.h>
1010

11-
#include "esp_private/esp_crypto_lock_internal.h"
11+
#include "esp_crypto_periph_clk.h"
1212
#include "hal/aes_types.h"
1313
#include "hal/aes_hal.h"
1414
#include "hal/aes_ll.h"
@@ -30,10 +30,7 @@ void aes_crypt_cbc_block(int mode,
3030
uint32_t *iv_words = (uint32_t *)iv;
3131
unsigned char temp[16];
3232

33-
AES_RCC_ATOMIC() {
34-
aes_ll_enable_bus_clock(true);
35-
aes_ll_reset_register();
36-
}
33+
esp_crypto_aes_enable_periph_clk(true);
3734

3835
/* Sets the key used for AES encryption/decryption */
3936
aes_hal_setkey(key, key_bytes, mode);
@@ -71,9 +68,7 @@ void aes_crypt_cbc_block(int mode,
7168
}
7269
}
7370

74-
AES_RCC_ATOMIC() {
75-
aes_ll_enable_bus_clock(false);
76-
}
71+
esp_crypto_aes_enable_periph_clk(false);
7772
}
7873

7974

@@ -89,10 +84,7 @@ void aes_crypt_ctr_block(uint8_t key_bytes,
8984
int c, i;
9085
size_t n = *nc_off;
9186

92-
AES_RCC_ATOMIC() {
93-
aes_ll_enable_bus_clock(true);
94-
aes_ll_reset_register();
95-
}
87+
esp_crypto_aes_enable_periph_clk(true);
9688

9789
/* Sets the key used for AES encryption/decryption */
9890
aes_hal_setkey(key, key_bytes, ESP_AES_ENCRYPT);
@@ -113,9 +105,7 @@ void aes_crypt_ctr_block(uint8_t key_bytes,
113105

114106
*nc_off = n;
115107

116-
AES_RCC_ATOMIC() {
117-
aes_ll_enable_bus_clock(false);
118-
}
108+
esp_crypto_aes_enable_periph_clk(false);
119109
}
120110

121111
#endif

‎components/hal/test_apps/crypto/main/ds/ds_types.h‎

Lines changed: 47 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,47 @@
1+
/*
2+
* SPDX-FileCopyrightText: 2025 Espressif Systems (Shanghai) CO LTD
3+
*
4+
* SPDX-License-Identifier: Unlicense OR CC0-1.0
5+
*/
6+
#include <stdint.h>
7+
#include "soc/soc_caps.h"
8+
9+
#define ESP_ERR_HW_CRYPTO_DS_HMAC_FAIL (0x1) /*!< HMAC peripheral problem */
10+
#define ESP_ERR_HW_CRYPTO_DS_INVALID_KEY (0x2) /*!< given HMAC key isn't correct, HMAC peripheral problem */
11+
#define ESP_ERR_HW_CRYPTO_DS_INVALID_DIGEST (0x4) /*!< message digest check failed, result is invalid */
12+
#define ESP_ERR_HW_CRYPTO_DS_INVALID_PADDING (0x5) /*!< padding check failed, but result is produced anyway and can be read*/
13+
14+
#define ESP_DS_IV_BIT_LEN 128
15+
#define ESP_DS_IV_LEN (ESP_DS_IV_BIT_LEN / 8)
16+
#define ESP_DS_SIGNATURE_MAX_BIT_LEN SOC_RSA_MAX_BIT_LEN
17+
#define ESP_DS_SIGNATURE_MD_BIT_LEN 256
18+
#define ESP_DS_SIGNATURE_M_PRIME_BIT_LEN 32
19+
#define ESP_DS_SIGNATURE_L_BIT_LEN 32
20+
#define ESP_DS_SIGNATURE_PADDING_BIT_LEN 64
21+
22+
#define ESP_DS_C_LEN (((ESP_DS_SIGNATURE_MAX_BIT_LEN * 3 \
23+
+ ESP_DS_SIGNATURE_MD_BIT_LEN \
24+
+ ESP_DS_SIGNATURE_M_PRIME_BIT_LEN \
25+
+ ESP_DS_SIGNATURE_L_BIT_LEN \
26+
+ ESP_DS_SIGNATURE_PADDING_BIT_LEN) / 8))
27+
28+
typedef enum {
29+
ESP_DS_RSA_1024 = (1024 / 32) - 1,
30+
ESP_DS_RSA_2048 = (2048 / 32) - 1,
31+
ESP_DS_RSA_3072 = (3072 / 32) - 1,
32+
ESP_DS_RSA_4096 = (4096 / 32) - 1
33+
} esp_digital_signature_length_t;
34+
35+
typedef struct esp_digital_signature_data {
36+
esp_digital_signature_length_t rsa_length;
37+
uint32_t iv[ESP_DS_IV_BIT_LEN / 32];
38+
uint8_t c[ESP_DS_C_LEN];
39+
} esp_ds_data_t;
40+
41+
typedef struct {
42+
uint32_t Y[ESP_DS_SIGNATURE_MAX_BIT_LEN / 32];
43+
uint32_t M[ESP_DS_SIGNATURE_MAX_BIT_LEN / 32];
44+
uint32_t Rb[ESP_DS_SIGNATURE_MAX_BIT_LEN / 32];
45+
uint32_t M_prime;
46+
uint32_t length;
47+
} esp_ds_p_data_t;

‎components/hal/test_apps/crypto/main/ds/test_ds.c‎

Lines changed: 39 additions & 109 deletions
Original file line numberDiff line numberDiff line change
@@ -13,85 +13,24 @@
1313

1414
#include "soc/soc_caps.h"
1515
#include "esp_log.h"
16+
#include "ds_types.h"
1617

1718
const static char *TAG = "test_ds";
1819

1920
#include "rom/efuse.h"
21+
#include "rom/sha.h"
22+
#include "rom/digital_signature.h"
23+
#include "rom/aes.h"
24+
#include "rom/hmac.h"
25+
26+
#if SOC_KEY_MANAGER_DS_KEY_DEPLOY
27+
#include "hal/key_mgr_ll.h"
28+
#endif
29+
2030
#if CONFIG_IDF_TARGET_ESP32S2
21-
#include "esp32s2/rom/digital_signature.h"
22-
#include "esp32s2/rom/aes.h"
23-
#include "esp32s2/rom/sha.h"
24-
#include "esp32s2/rom/hmac.h"
2531
#include "soc/soc_memory_layout.h"
26-
#elif CONFIG_IDF_TARGET_ESP32C3
27-
#include "esp32c3/rom/digital_signature.h"
28-
#include "esp32c3/rom/hmac.h"
29-
#elif CONFIG_IDF_TARGET_ESP32S3
30-
#include "esp32s3/rom/digital_signature.h"
31-
#include "esp32s3/rom/aes.h"
32-
#include "esp32s3/rom/sha.h"
33-
#elif CONFIG_IDF_TARGET_ESP32C6
34-
#include "esp32c6/rom/digital_signature.h"
35-
#include "esp32c6/rom/aes.h"
36-
#include "esp32c6/rom/sha.h"
37-
#elif CONFIG_IDF_TARGET_ESP32H2
38-
#include "esp32h2/rom/digital_signature.h"
39-
#include "esp32h2/rom/aes.h"
40-
#include "esp32h2/rom/sha.h"
41-
#elif CONFIG_IDF_TARGET_ESP32P4
42-
#include "esp32p4/rom/digital_signature.h"
43-
#include "esp32p4/rom/aes.h"
44-
#include "esp32p4/rom/sha.h"
45-
#elif CONFIG_IDF_TARGET_ESP32C5
46-
#include "esp32c5/rom/digital_signature.h"
47-
#include "esp32c5/rom/aes.h"
48-
#include "esp32c5/rom/sha.h"
49-
#elif CONFIG_IDF_TARGET_ESP32H21
50-
#include "esp32h21/rom/digital_signature.h"
51-
#include "esp32h21/rom/aes.h"
52-
#include "esp32h21/rom/sha.h"
5332
#endif
5433

55-
#define ESP_ERR_HW_CRYPTO_DS_HMAC_FAIL (0x1) /*!< HMAC peripheral problem */
56-
#define ESP_ERR_HW_CRYPTO_DS_INVALID_KEY (0x2) /*!< given HMAC key isn't correct, HMAC peripheral problem */
57-
#define ESP_ERR_HW_CRYPTO_DS_INVALID_DIGEST (0x4) /*!< message digest check failed, result is invalid */
58-
#define ESP_ERR_HW_CRYPTO_DS_INVALID_PADDING (0x5) /*!< padding check failed, but result is produced anyway and can be read*/
59-
60-
#define ESP_DS_IV_BIT_LEN 128
61-
#define ESP_DS_IV_LEN (ESP_DS_IV_BIT_LEN / 8)
62-
#define ESP_DS_SIGNATURE_MAX_BIT_LEN SOC_RSA_MAX_BIT_LEN
63-
#define ESP_DS_SIGNATURE_MD_BIT_LEN 256
64-
#define ESP_DS_SIGNATURE_M_PRIME_BIT_LEN 32
65-
#define ESP_DS_SIGNATURE_L_BIT_LEN 32
66-
#define ESP_DS_SIGNATURE_PADDING_BIT_LEN 64
67-
68-
#define ESP_DS_C_LEN (((ESP_DS_SIGNATURE_MAX_BIT_LEN * 3 \
69-
+ ESP_DS_SIGNATURE_MD_BIT_LEN \
70-
+ ESP_DS_SIGNATURE_M_PRIME_BIT_LEN \
71-
+ ESP_DS_SIGNATURE_L_BIT_LEN \
72-
+ ESP_DS_SIGNATURE_PADDING_BIT_LEN) / 8))
73-
74-
typedef enum {
75-
ESP_DS_RSA_1024 = (1024 / 32) - 1,
76-
ESP_DS_RSA_2048 = (2048 / 32) - 1,
77-
ESP_DS_RSA_3072 = (3072 / 32) - 1,
78-
ESP_DS_RSA_4096 = (4096 / 32) - 1
79-
} esp_digital_signature_length_t;
80-
81-
typedef struct esp_digital_signature_data {
82-
esp_digital_signature_length_t rsa_length;
83-
uint32_t iv[ESP_DS_IV_BIT_LEN / 32];
84-
uint8_t c[ESP_DS_C_LEN];
85-
} esp_ds_data_t;
86-
87-
typedef struct {
88-
uint32_t Y[ESP_DS_SIGNATURE_MAX_BIT_LEN / 32];
89-
uint32_t M[ESP_DS_SIGNATURE_MAX_BIT_LEN / 32];
90-
uint32_t Rb[ESP_DS_SIGNATURE_MAX_BIT_LEN / 32];
91-
uint32_t M_prime;
92-
uint32_t length;
93-
} esp_ds_p_data_t;
94-
9534
#define NUM_RESULTS 10
9635

9736
#if CONFIG_IDF_TARGET_ESP32S2 || CONFIG_IDF_TARGET_ESP32S3
@@ -128,55 +67,46 @@ _Static_assert(NUM_RESULTS == NUM_MESSAGES, "expected_results size should be the
12867
#include "hal/hmac_hal.h"
12968
#include "hal/hmac_ll.h"
13069
#include "hal/sha_ll.h"
131-
70+
#include "esp_crypto_periph_clk.h"
13271

13372
static void ds_acquire_enable(void)
13473
{
135-
HMAC_RCC_ATOMIC() {
136-
hmac_ll_enable_bus_clock(true);
137-
hmac_ll_reset_register();
138-
}
139-
140-
SHA_RCC_ATOMIC() {
141-
sha_ll_enable_bus_clock(true);
142-
sha_ll_reset_register();
143-
}
144-
145-
DS_RCC_ATOMIC() {
146-
ds_ll_enable_bus_clock(true);
147-
ds_ll_reset_register();
148-
}
149-
150-
hmac_hal_start();
74+
// We also enable SHA and HMAC here. SHA is used by HMAC, HMAC is used by DS.
75+
esp_crypto_hmac_enable_periph_clk(true);
76+
esp_crypto_sha_enable_periph_clk(true);
77+
esp_crypto_mpi_enable_periph_clk(true);
78+
esp_crypto_ds_enable_periph_clk(true);
15179
}
15280

15381
static void ds_disable_release(void)
15482
{
155-
ds_hal_finish();
156-
157-
DS_RCC_ATOMIC() {
158-
ds_ll_enable_bus_clock(false);
159-
}
160-
161-
SHA_RCC_ATOMIC() {
162-
sha_ll_enable_bus_clock(false);
163-
}
164-
165-
HMAC_RCC_ATOMIC() {
166-
hmac_ll_enable_bus_clock(false);
167-
}
83+
esp_crypto_mpi_enable_periph_clk(false);
84+
esp_crypto_sha_enable_periph_clk(false);
85+
esp_crypto_hmac_enable_periph_clk(false);
86+
esp_crypto_ds_enable_periph_clk(false);
16887
}
16988

17089

17190
static esp_err_t esp_ds_start_sign(const void *message, const esp_ds_data_t *data, uint32_t key_id)
17291
{
17392
ds_acquire_enable();
17493

175-
uint32_t conf_error = hmac_hal_configure(HMAC_OUTPUT_DS, key_id);
176-
if (conf_error) {
177-
ds_disable_release();
178-
return ESP_ERR_HW_CRYPTO_DS_HMAC_FAIL;
94+
#if SOC_KEY_MANAGER_DS_KEY_DEPLOY
95+
if (key_id == HMAC_KEY_KM) {
96+
ds_hal_set_key_source(DS_KEY_SOURCE_KEY_MGR);
97+
} else {
98+
ds_hal_set_key_source(DS_KEY_SOURCE_EFUSE);
99+
#endif
100+
hmac_hal_start();
101+
uint32_t conf_error = hmac_hal_configure(HMAC_OUTPUT_DS, key_id);
102+
if (conf_error) {
103+
ds_disable_release();
104+
ESP_LOGE(TAG, "HMAC configure failed");
105+
return ESP_ERR_HW_CRYPTO_DS_HMAC_FAIL;
106+
}
107+
#if SOC_KEY_MANAGER_DS_KEY_DEPLOY
179108
}
109+
#endif
180110

181111
ds_hal_start();
182112

@@ -211,13 +141,13 @@ static esp_err_t esp_ds_finish_sign(void *signature, const esp_ds_data_t *data)
211141
}
212142

213143
hmac_hal_clean();
214-
144+
ds_hal_finish();
215145
ds_disable_release();
216146

217147
return return_value;
218148
}
219149

220-
static esp_err_t esp_ds_sign(const void *message,
150+
esp_err_t esp_ds_sign(const void *message,
221151
const esp_ds_data_t *data,
222152
uint32_t key_id,
223153
void *signature)
@@ -287,8 +217,8 @@ static void ds_disable_release(void)
287217
}
288218

289219
static esp_err_t esp_ds_start_sign(const void *message,
290-
const esp_ds_data_t *data,
291-
uint32_t key_id)
220+
const esp_ds_data_t *data,
221+
uint32_t key_id)
292222
{
293223
ds_acquire_enable();
294224

0 commit comments

Comments
 (0)