Enable hardware acceleration for SHA1, SHA384 and SHA3 algorithms on PSoC6

[Pushyanth-Infineon]

Description

• Enable hardware acceleration for SHA1, SHA384 and SHA3 algorithms on PSoC6.
• Refactored the existing SHA256 and SHA512 code to use the same structure of implementation.
• psoc6_ecc_verify_hash_ex: Added public key creation functionality if only private key is provided.
• wolfcrypt/src/wc_mlkem_poly.c:mlkem_prf_init(): Use wc_InitShake256 to initialize SHAKE-256 instead of manually clearing the state. If PSoC6 acceleration is enabled for SHA3(PSOC6_HASH_SHA3), the wc_Shake will have different state structure and wc_InitShake256 will handle it correctly.
• Added missing README.md.

Testing

• Tested with CY8CPROTO-062-4343W board on ModusToolbox™ IDE with tests present in wolfcrypt/test/test.c:wolfcrypt_test()
• PSoC6 PDL library: mtb-pdl-cat1

Checklist

• added tests
• updated/added doxygen
• updated appropriate READMEs
• Updated manual and documentation

[devin-ai-integration]

🛟 Devin Lifeguard found 3 likely issues in this PR

• use-c-style-comments snippet snippet: Replace each “//” comment in the affected C and header files (e.g., psoc6_crypto.c line 86: “// Number of bits in a byte”) with the equivalent C-style comment “/* Number of bits in a byte */”.
• use-typedefs-not-stdint snippet snippet snippet: Replace occurrences of stdint types (e.g., uint8_t signature_buf[] → byte signature_buf[]) with the wolfSSL typedefs (byte, word16, word32, etc.) throughout psoc6_crypto.c and related header files.
• no-void-functions snippet: Change wc_Psoc6_Sha_Free to int wc_Psoc6_Sha_Free(void) and return an error/status code (e.g., return 0;) after the register-buffer clear/sync; update all call-sites accordingly.

@Pushyanth-Infineon
please take a look at the above issues which Devin flagged. Devin will not fix these issues automatically.

[wolfSSL-Bot]

Can one of the admins verify this patch?

[dgarske]

Hi @Pushyanth-Infineon ,

Thank you for this code contribution! The changes look great! I'll work on reviewing and testing this. In the mean-time please email support at wolfssl dot com to work on getting a signed contributor agreement setup.

Thanks,
David Garske, wolfSSL

[dgarske]

Okay to test

[embhorn]

@Pushyanth-Infineon is an approved contributor. ZD 20518

[embhorn]

retest this please

[Pushyanth-Infineon]

what happened in PRB-master-job?

[SparkiDev]

Error from testing:

trailing whitespace:
./wolfcrypt/src/port/cypress/psoc6_crypto.c:101: if ((res == CY_CRYPTO_SUCCESS) && (init_hash == 1))·
./wolfcrypt/src/port/cypress/psoc6_crypto.c:111: if ((res == CY_CRYPTO_SUCCESS) && (init_hash == 1))·
./wolfcrypt/src/port/cypress/psoc6_crypto.c:117: if ((res == CY_CRYPTO_SUCCESS) && (init_hash == 1))·
./wolfcrypt/src/port/cypress/psoc6_crypto.c:125: if ((res == CY_CRYPTO_SUCCESS) && (init_hash == 1))·
./wolfcrypt/src/port/cypress/psoc6_crypto.c:133: if ((res == CY_CRYPTO_SUCCESS) && (init_hash == 1))·
./wolfcrypt/src/port/cypress/psoc6_crypto.c:140: if ((res == CY_CRYPTO_SUCCESS) && (init_hash == 1))·
./wolfcrypt/src/port/cypress/psoc6_crypto.c:148: if ((res == CY_CRYPTO_SUCCESS) && (init_hash == 1))·
./wolfcrypt/src/port/cypress/psoc6_crypto.c:776:····
./wolfcrypt/src/port/cypress/psoc6_crypto.c:859: Cy_Crypto_Core_V2_FFStart(crypto_base, CY_CRYPTO_V2_RB_FF_STORE, hash + offset + PSOC6_CRYPTO_SHA3_RB_LOWER,·
./wolfcrypt/src/port/cypress/psoc6_crypto.c:979:···
no ending newline:
./wolfcrypt/src/port/cypress/README.md
weird control chars, hard tabs, CRs, trailing whitespace:
./wolfcrypt/src/port/cypress/README.md:1:# PSoC6 Hardware Crypto Port for wolfSSL©
./wolfcrypt/src/port/cypress/README.md:2:©
./wolfcrypt/src/port/cypress/README.md:3:This directory provides a hardware-accelerated cryptography port for Cypress PSoC6 devices, integrating the PSoC6 hardware crypto block with the wolfSSL cryptography library. The implementation leverages the PSoC6 hardware to accelerate various cryptographic hash and ECC operations, improving performance and reducing CPU load.©
./wolfcrypt/src/port/cypress/README.md:4:©
./wolfcrypt/src/port/cypress/README.md:5:## Implemented Features©
./wolfcrypt/src/port/cypress/README.md:6:©
./wolfcrypt/src/port/cypress/README.md:7:### 1. Hardware-Accelerated Hash Functions©
./wolfcrypt/src/port/cypress/README.md:8:©
./wolfcrypt/src/port/cypress/README.md:9:The following hash algorithms are implemented using the PSoC6 hardware crypto block:©
./wolfcrypt/src/port/cypress/README.md:10:©
[...and more...]
C++-style comments:
./wolfcrypt/src/sha3.c:931: // Lock the mutex to perform crypto operations
./wolfcrypt/src/sha3.c:934: // Initialize hash state for SHA-3 operation
./wolfcrypt/src/sha3.c:936: // Release the lock
./wolfcrypt/src/sha3.c:956: // Lock the mutex to perform crypto operations
./wolfcrypt/src/sha3.c:959: // Perform SHA3 on the input data and update the hash state
./wolfcrypt/src/sha3.c:961: // Release the lock
./wolfcrypt/src/sha3.c:976: // Lock the mutex to perform crypto operations
./wolfcrypt/src/sha3.c:979: // Finalize SHA3 operations and produce digest
./wolfcrypt/src/sha3.c:982: // Initialize hash state for SHA-3 operation
./wolfcrypt/src/sha3.c:985: // Release the lock
[...and more...]
unneeded entries in .wolfssl_known_macro_extras:
WOLFSSL_PSOC6_CRYPTO
unrecognized macros used:
NO_WOLFSSL_PSOC6_HASH

[Pushyanth-Infineon]

It make sense to have WOLFSSL_PSOC6_CRYPTO in the .wolfssl_known_macro_extras file. Doesn't it? Any other errors from PRB-master-job?

[SparkiDev]

C++-style comments:
./wolfcrypt/src/port/cypress/psoc6_crypto.c:53:// Number of bits in a byte
./wolfcrypt/src/port/cypress/psoc6_crypto.c:56:// Number of bytes of SHA3 to store in 1st partition of register buffer (reg_buff[1023:0])
./wolfcrypt/src/port/cypress/psoc6_crypto.c:59:// Number of bytes of SHA3 to store in 2nd partition of register buffer (reg_buff[2047:1024])
./wolfcrypt/src/port/cypress/psoc6_crypto.c:88: // Enable CRYPTO block if not enabled
./wolfcrypt/src/port/cypress/psoc6_crypto.c:98: // Initialize the PSoC6 hash state and configure the SHA mode
./wolfcrypt/src/port/cypress/psoc6_crypto.c:100: // Initialize the hash state to the SHA1 initial values if requested (init_hash set to 1)
./wolfcrypt/src/port/cypress/psoc6_crypto.c:170: // Clear the register buffer
./wolfcrypt/src/port/cypress/psoc6_crypto.c:173: // Wait until the instruction is complete
./wolfcrypt/src/port/cypress/psoc6_crypto.c:188: // Lock the mutex to perform crypto operations
./wolfcrypt/src/port/cypress/psoc6_crypto.c:191: // Initialize the PSoC6 hash buffers for SHA1
[...and more...]
unneeded entries in .wolfssl_known_macro_extras:
WOLFSSL_PSOC6_CRYPTO

Please change C++ style comments.
Remove WOLFSSL_PSOC6_CRYPTO - it found it referenced somewhere important.

[Pushyanth-Infineon]

Replaced C++ style comments with C style comments. Removed WOLFSSL_PSOC6_CRYPTO macro from .wolfssl_known_macro_extras

[dgarske]

Jenkins retest this please

[dgarske]

Jenkins retest this please.

[dgarske]

These changes look great! I will also build and test on the PSoC6 next.

[Copilot]

Pull Request Overview

This PR enables hardware acceleration for SHA1, SHA384, and SHA3 algorithms on PSoC6 platforms by extending the existing PSoC6 crypto port and refactoring the implementation structure. It also adds public key creation functionality to the ECC verification function and fixes an ML-KEM SHAKE256 initialization issue.

• Extends PSoC6 hardware acceleration support to SHA1, SHA384, and SHA3 algorithms
• Refactors existing SHA256/SHA512 code to use a unified implementation structure
• Adds public key creation capability to psoc6_ecc_verify_hash_ex when only private key is provided
• Fixes ML-KEM SHAKE256 initialization to use proper API instead of manual memory clearing

Reviewed Changes

Copilot reviewed 13 out of 13 changed files in this pull request and generated 4 comments.

Show a summary per file

File	Description
wolfssl/wolfcrypt/sha512.h	Updates conditional compilation for PSoC6 SHA2 support
wolfssl/wolfcrypt/sha3.h	Adds PSoC6 hardware acceleration structure for SHA3
wolfssl/wolfcrypt/sha256.h	Refactors PSoC6 conditional compilation structure
wolfssl/wolfcrypt/sha.h	Adds PSoC6 hardware acceleration structure for SHA1
wolfssl/wolfcrypt/port/cypress/psoc6_crypto.h	Refactors header to support unified hash implementation
wolfcrypt/src/wc_mlkem_poly.c	Fixes SHAKE256 initialization to use proper API
wolfcrypt/src/sha512.c	Adds PSoC6 conditional compilation support
wolfcrypt/src/sha3.c	Implements PSoC6 hardware acceleration for SHA3
wolfcrypt/src/sha256.c	Updates PSoC6 conditional compilation structure
wolfcrypt/src/sha.c	Implements PSoC6 hardware acceleration for SHA1
wolfcrypt/src/port/cypress/psoc6_crypto.c	Major refactoring and extension of PSoC6 crypto implementation
wolfcrypt/src/port/cypress/README.md	Adds comprehensive documentation for PSoC6 crypto port
.wolfssl_known_macro_extras	Removes obsolete macro entry

---

_{Tip: Customize your code reviews with copilot-instructions.md. Create the file or learn how to get started.}

[dgarske]

Jenkins retest this please: "AgentOfflineException"

[dgarske]

Hi @Pushyanth-Infineon these changes look good! I've been trying to figure out how to test them. Do you have an example project you can share or point me to? I've got all the ModusToolBox tools setup and I also have a PSoC 62S2 board with LWB5+ wifi module.

[Pushyanth-Infineon]

Hi @dgarske, I've used wolfCrypt Test to test the implementation. This is the ModusToolbox project that I've used for testing:
wolfcrypt_psoc6.zip

Setup:
ModusToolbox version 3.5

Let me know if you need further help in setting up for testing.

[dgarske]

@Pushyanth-Infineon thank you for the example, I'll try it tomorrow. We merged a PSoC fix for SHA512/SHA384 that conflicts. Can you rebase and resolve? Thank you

[dgarske]

Jenkins retest this please

[dgarske]

Hi @Pushyanth-Infineon ,

I'm getting an error trying to use your provided example. I tried on Ubuntu 24 and MacOS and get the same error. Both systems have previously had ModusToolbox working correctly. Please let me know if you have some ideas.

davidgarske@i9w680:~/Downloads/wolfcrypt_psoc6$ make getlibs
Tools Directory: /opt/Tools/ModusToolbox/tools_3.6
Searching installed tools in progress...
Searching installed tools complete

==============================================================================
= Importing libraries =
==============================================================================
mtbgetlibs: retreived MTBQueryAPI interface
mtbgetlibs: running in 'Direct' mode
0: Loading the application in directory '/home/davidgarske/Downloads/wolfcrypt_psoc6' for creating a new one
0: using cached data from file '/home/davidgarske/Downloads/wolfcrypt_psoc6/.mtbqueryapi'
0: Finished loading the application data (1 ms total, 0 make)
0: Loading the ModusToolbox Technology Packs and Early Access Packs
0: Finished loading the ModusToolbox Technology Packs and Early Access Packs (0 ms)
0: Loading the tools information
0: Finished loading the tools information (1 ms)
0: Loading the manifest data
0: Finished loading the manifest data (1058 ms)
0: No SDK-based filtering is applied to the manifest database contents.
0: Loaded ModusToolbox 3.x single core application
0: ToolsDir is '/opt/Tools/ModusToolbox/tools_3.6'
0: loaded asset 'retarget-io'
0: loaded asset 'wolfssl'
mtbgetlibs: changes committed
mtbgetlibs: completed in 1256 milliseconds
==============================================================================
= Import complete =
==============================================================================

davidgarske@i9w680:~/Downloads/wolfcrypt_psoc6$ make build
Tools Directory: /opt/Tools/ModusToolbox/tools_3.6
Searching installed tools in progress...
Searching installed tools complete
/opt/Tools/ModusToolbox/tools_3.6/make/core_version3/startex-v3.mk:163: *** Libraries: "bsp core-make recipe-make" not found. Run "make getlibs" to ensure all required build and code dependencies are present..  Stop.

[dgarske]

Jenkins retest this please: Periodic issues with FIPSv2-regression due to failed apt install.

[Pushyanth-Infineon]

The zip file is only the template file from which the project should be created using project creator. Also use the template file attached in this comment instead of the old one.
wolfcrypt_psoc6.zip

1. Use the project-creator-cli tool to import the tool, it will download all the shared dependencies for the project.

   unzip wolfcrypt_psoc6.zip
   mkdir ~/mtw3.6/psoc6-wolfcrypt
   /opt/Tools/ModusToolbox/tools_3.6/project-creator/project-creator-cli --board-id CY8CEVAL-062S2 --app-path wolfcrypt_psoc6/  --target-dir ~/mtw3.6/psoc6-wolfcrypt
   cd ~/mtw3.6/psoc6-wolfcrypt/wolfcrypt_psoc6/

2. The default stack size is not sufficient for testing, increase the stack size to 0x2000 bytes.
   Edit the file <project_directory>/bsps/TARGET_APP_CY8CEVAL-062S2/COMPONENT_CM4/TOOLCHAIN_GCC_ARM/linker.ld at line 44:

   STACK_SIZE = 0x2000;

3. While building this test project, pass the flag -Wno-error=implicit-function-declaration to the compiler to avoid errors due to implicit function declarations. Few functions are not defined (for eg. gettimeofday, clock_gettime), as they are not used in this project.

   make CFLAGS="-Wno-error=implicit-function-declaration" program -j6

[dgarske]

Hi @Pushyanth-Infineon ,

Thank you! It all tests out and works! There are some unused functions in ecc.c with WOLFSSL_PSOC6_CRYPTO defined. Can you please apply this small patch?

$ git diff
diff --git a/wolfcrypt/src/ecc.c b/wolfcrypt/src/ecc.c
index 29a208605..5b54bc641 100644
--- a/wolfcrypt/src/ecc.c
+++ b/wolfcrypt/src/ecc.c
@@ -232,7 +232,8 @@ ECC Curve Sizes:
 #if !defined(WOLFSSL_ATECC508A) && !defined(WOLFSSL_ATECC608A) && \
     !defined(WOLFSSL_CRYPTOCELL) && !defined(WOLFSSL_SILABS_SE_ACCEL) && \
     !defined(WOLFSSL_KCAPI_ECC) && !defined(WOLFSSL_SE050) && \
-    !defined(WOLFSSL_XILINX_CRYPT_VERSAL) && !defined(WOLFSSL_STM32_PKA)
+    !defined(WOLFSSL_XILINX_CRYPT_VERSAL) && !defined(WOLFSSL_STM32_PKA) && \
+    !defined(WOLFSSL_PSOC6_CRYPTO)
     #undef  HAVE_ECC_VERIFY_HELPER
     #define HAVE_ECC_VERIFY_HELPER
 #endif

 Compiling ext file ecc.c
../mtb_shared/wolfssl/wolfssl-psoc6/wolfcrypt/src/ecc.c:8882:12: warning: 'ecc_verify_hash' defined but not used [-Wunused-function]
 8882 | static int ecc_verify_hash(mp_int *r, mp_int *s, const byte* hash,
      |            ^~~~~~~~~~~~~~~
../mtb_shared/wolfssl/wolfssl-psoc6/wolfcrypt/src/ecc.c:8724:12: warning: 'ecc_verify_hash_sp' defined but not used [-Wunused-function]
 8724 | static int ecc_verify_hash_sp(mp_int *r, mp_int *s, const byte* hash,
      |            ^~~~~~~~~~~~~~~~~~
    Linking output file mtb-example-hal-hello-world.elf

[dgarske]

Hi @Pushyanth-Infineon also can you please squash your changes on the next push? If you would like my help with that patch or squash let me know.

[Pushyanth-Infineon]

Applied the patch and squashed the commits.

[dgarske]

Jenkins retest this please

[dgarske]

Jenkins retest this please: "PRB-single-flag.txt_25'"