WolfSSL
/
wolfssl-examples
mirror of https://github.com/wolfSSL/wolfssl-examples.git
1
0
Fork 0
Code Issues Releases Wiki Activity

Merge pull request #559 from danielinux/uefi-library 

Added `uefi-library`: wolfCrypt as UEFI driver
pull/554/head
Kaleb Himes 2026-02-19 09:50:56 -07:00 committed by GitHub
parent 8e47edbf64 c92a922aea
commit 1e3c2a204a
No known key found for this signature in database
GPG Key ID: B5690EEEBB952194
19 changed files with 5610 additions and 3 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

4
.gitignore vendored
View File

@ -6,6 +6,7 @@
*.ko
*.obj
*.elf
*.efi
# Libraries
*.lib
@ -407,3 +408,6 @@ kernel/bsdkm/x86
stsafe/stsafe_test
stsafe/wolfssl_stsafe_test
stsafe/wolfssl_stsafe_full_test
# uefi-library generated filesystem content
uefi-library/efifs

16
README.md
View File

@ -381,11 +381,22 @@ details.
<br />
#### UEFI (wolfCrypt UEFI application Example)
#### uefi-static (wolfCrypt UEFI application Example)
This directory contains an example UEFI application that runs wolfcrypt test.
Please see the [uefi/README.md](uefi/README.md) for further usage and
Please see the [uefi-static/README.md](uefi-static/README.md) for further usage and
details.
<br />
#### uefi-library (wolfCrypt UEFI boot module and test app)
This directory contains a UEFI wolfCrypt protocol driver (`libwolfcrypt.efi`)
and a companion test application (`test.efi`). Examples run on qemu.
Please see the [uefi-library/README.md](uefi-library/README.md) for further usage and
details.
@ -406,4 +417,3 @@ To generate your own cert text, see the [DER to C script](https://github.com/wol
Please contact wolfSSL at support@wolfssl.com with any questions, bug fixes,
or suggested feature additions.

348
uefi-library/Makefile 100644
View File

@ -0,0 +1,348 @@
uC = gcc
LD = ld
OBJCOPY = objcopy
SIZE = size
# Path to the wolfssl source tree (sibling of wolfssl-examples by default)
WOLFSSL_PATH ?= $(abspath $(CURDIR)/../../wolfssl)
# QEMU configuration
QEMU_CPU ?= qemu64
# Use a named Intel CPU model so CPUID leaf 0 reports "GenuineIntel".
# wolfSSL's cpuid_flag() only sets AES-NI when the vendor is Intel or AMD;
# the generic "qemu64" model reports "TCGTCGTCGTCG" and fails that check
# even when +aes is passed. "Broadwell" includes AES-NI and PCLMULQDQ by
# default and works with both KVM and TCG (accel=kvm:tcg falls back cleanly).
QEMU_CPU_HW ?= host,migratable=off
QEMU_ACCEL ?=
# -----------------------------------------------------------------------
# x86_64 paths / flags common to all 64-bit variants
# -----------------------------------------------------------------------
GNU_EFI_LIB_PATH ?= /usr/lib
GNU_EFI_CRT0_X64 := $(GNU_EFI_LIB_PATH)/crt0-efi-x86_64.o
GNU_EFI_LSCRIPT_X64 := $(GNU_EFI_LIB_PATH)/elf_x86_64_efi.lds
EFI_DRIVER_TARGET_X64 := efi-bsdrv-x86_64
EFI_APP_TARGET_X64 := efi-app-x86_64
LIBGCC_X64 := $(shell $(CC) -print-libgcc-file-name)
# -----------------------------------------------------------------------
# i386 paths / flags
# -----------------------------------------------------------------------
GNU_EFI_LIB_PATH32 ?= /usr/lib32
GNU_EFI_CRT0_I32 := $(GNU_EFI_LIB_PATH32)/crt0-efi-ia32.o
GNU_EFI_LSCRIPT_I32 := $(GNU_EFI_LIB_PATH32)/elf_ia32_efi.lds
EFI_DRIVER_TARGET_I32 := efi-bsdrv-ia32
EFI_APP_TARGET_I32 := efi-app-ia32
LIBGCC_I32 := /usr/lib/gcc-cross/i686-linux-gnu/14/libgcc.a
# -----------------------------------------------------------------------
# Common CFLAGS (base)
# -----------------------------------------------------------------------
CFLAGS_COMMON := \
-fpic -ffreestanding -fno-stack-protector -fno-stack-check \
-fshort-wchar -mno-red-zone -maccumulate-outgoing-args \
-DUEFI -DGNUEFI -DWOLFSSL_USER_SETTINGS -DNEED_DYNAMIC_TYPE_FIX_UEFI \
-I. -I/usr/include/efi -I/usr/include/efi/x86_64 \
-I$(WOLFSSL_PATH) \
-DTARGET_X86_64_EFI
CFLAGS_HW := $(CFLAGS_COMMON) -maes -mpclmul -DUEFI_HW_ACCEL
CFLAGS_NOHW := $(CFLAGS_COMMON)
CFLAGS_I32 := \
-m32 -fpic -ffreestanding -fno-stack-protector -fno-stack-check \
-fshort-wchar -mno-red-zone -maccumulate-outgoing-args \
-fno-asynchronous-unwind-tables -fno-unwind-tables \
-DUEFI -DGNUEFI -DWOLFSSL_USER_SETTINGS -DNEED_DYNAMIC_TYPE_FIX_UEFI \
-I. -I/usr/include/efi -I/usr/include/efi/ia32 \
-I$(WOLFSSL_PATH) \
-DTARGET_IA32_EFI -DEFI_FUNCTION_WRAPPER -DTARGET_IA32_EFI
# -----------------------------------------------------------------------
# wolfcrypt object list
# -----------------------------------------------------------------------
OBJS_WOLFCRYPT := \
$(WOLFSSL_PATH)/wolfcrypt/src/aes.o \
$(WOLFSSL_PATH)/wolfcrypt/src/asn.o \
$(WOLFSSL_PATH)/wolfcrypt/src/coding.o \
$(WOLFSSL_PATH)/wolfcrypt/src/logging.o \
$(WOLFSSL_PATH)/wolfcrypt/src/cpuid.o \
$(WOLFSSL_PATH)/wolfcrypt/src/memory.o \
$(WOLFSSL_PATH)/wolfcrypt/src/rsa.o \
$(WOLFSSL_PATH)/wolfcrypt/src/dilithium.o \
$(WOLFSSL_PATH)/wolfcrypt/src/falcon.o \
$(WOLFSSL_PATH)/wolfcrypt/src/dh.o \
$(WOLFSSL_PATH)/wolfcrypt/src/kdf.o \
$(WOLFSSL_PATH)/wolfcrypt/src/ecc.o \
$(WOLFSSL_PATH)/wolfcrypt/src/misc.o \
$(WOLFSSL_PATH)/wolfcrypt/src/sha.o \
$(WOLFSSL_PATH)/wolfcrypt/src/sha256.o \
$(WOLFSSL_PATH)/wolfcrypt/src/sha512.o \
$(WOLFSSL_PATH)/wolfcrypt/src/sha3.o \
$(WOLFSSL_PATH)/wolfcrypt/src/hash.o \
$(WOLFSSL_PATH)/wolfcrypt/src/hmac.o \
$(WOLFSSL_PATH)/wolfcrypt/src/cmac.o \
$(WOLFSSL_PATH)/wolfcrypt/src/pwdbased.o \
$(WOLFSSL_PATH)/wolfcrypt/src/pkcs7.o \
$(WOLFSSL_PATH)/wolfcrypt/src/pkcs12.o \
$(WOLFSSL_PATH)/wolfcrypt/src/wolfmath.o \
$(WOLFSSL_PATH)/wolfcrypt/src/tfm.o \
$(WOLFSSL_PATH)/wolfcrypt/src/wc_encrypt.o \
$(WOLFSSL_PATH)/wolfcrypt/src/error.o \
$(WOLFSSL_PATH)/wolfcrypt/src/random.o \
$(WOLFSSL_PATH)/wolfcrypt/src/wc_port.o \
$(WOLFSSL_PATH)/wolfcrypt/src/wc_mlkem.o \
$(WOLFSSL_PATH)/wolfcrypt/src/wc_mlkem_poly.o \
$(WOLFSSL_PATH)/wolfcrypt/src/chacha.o \
$(WOLFSSL_PATH)/wolfcrypt/src/chacha20_poly1305.o \
$(WOLFSSL_PATH)/wolfcrypt/src/poly1305.o \
$(WOLFSSL_PATH)/wolfcrypt/src/curve25519.o \
$(WOLFSSL_PATH)/wolfcrypt/src/ed25519.o \
$(WOLFSSL_PATH)/wolfcrypt/src/fe_operations.o \
$(WOLFSSL_PATH)/wolfcrypt/src/ge_operations.o \
src/driver.o \
src/utility_wolf.o
# AES-NI assembly objects (hw variant only)
OBJS_HW := \
$(WOLFSSL_PATH)/wolfcrypt/src/aes_asm.o \
$(WOLFSSL_PATH)/wolfcrypt/src/aes_gcm_asm.o
# Test app objects
OBJS_TEST := \
src/test_app.o
# -----------------------------------------------------------------------
# LDFLAGS helpers
# -----------------------------------------------------------------------
LDFLAGS_X64 = -shared -Bsymbolic -L$(GNU_EFI_LIB_PATH) -T$(GNU_EFI_LSCRIPT_X64)
LD_GROUP_X64 = --start-group $(GNU_EFI_CRT0_X64) $(OBJS_WOLFCRYPT) --end-group -lgnuefi -lefi $(LIBGCC_X64)
LD_GROUP_X64_HW = --start-group $(GNU_EFI_CRT0_X64) $(OBJS_WOLFCRYPT) $(OBJS_HW) --end-group -lgnuefi -lefi $(LIBGCC_X64)
LD_GROUP_X64_TEST = --start-group $(GNU_EFI_CRT0_X64) $(OBJS_TEST) --end-group -lgnuefi -lefi $(LIBGCC_X64)
LDFLAGS_I32 = -shared -Bsymbolic -L$(GNU_EFI_LIB_PATH32) -m elf_i386 -T$(GNU_EFI_LSCRIPT_I32)
LD_GROUP_I32 = --start-group $(GNU_EFI_CRT0_I32) $(OBJS_WOLFCRYPT) --end-group \
$(GNU_EFI_LIB_PATH32)/libgnuefi.a $(GNU_EFI_LIB_PATH32)/libefi.a $(LIBGCC_I32)
LD_GROUP_I32_TEST = --start-group $(GNU_EFI_CRT0_I32) $(OBJS_TEST) --end-group \
$(GNU_EFI_LIB_PATH32)/libgnuefi.a $(GNU_EFI_LIB_PATH32)/libefi.a $(LIBGCC_I32)
EFI_EH_FRAME ?= -j .eh_frame
EFI_REMOVE_EH ?=
# -----------------------------------------------------------------------
# Main targets
# -----------------------------------------------------------------------
.PHONY: all clean
all: run-fallback-nohw
# -----------------------------------------------------------------------
# Pattern rules
# -----------------------------------------------------------------------
%.o: %.c
$(CC) $(CFLAGS) -c -o $@ $<
%.o: %.S
$(CC) $(CFLAGS) -c -o $@ $<
# sha3.o must always have SHAKE128/256 enabled
$(WOLFSSL_PATH)/wolfcrypt/src/sha3.o: $(WOLFSSL_PATH)/wolfcrypt/src/sha3.c
$(CC) $(CFLAGS) -DWOLFSSL_SHAKE128 -DWOLFSSL_SHAKE256 \
-UWOLFSSL_NO_SHAKE128 -UWOLFSSL_NO_SHAKE256 -c -o $@ $<
# AES-NI assembly: compile without -DWOLFSSL_USER_SETTINGS to prevent user_settings.h
# from pulling in EFI C headers that the assembler cannot parse. Only define the
# macros the .S file actually needs: WOLFSSL_X86_64_BUILD triggers the x86_64 path.
CFLAGS_ASM := -ffreestanding -fno-stack-protector -fpic -mno-red-zone \
-DWOLFSSL_X86_64_BUILD -maes -mpclmul
$(WOLFSSL_PATH)/wolfcrypt/src/aes_asm.o: $(WOLFSSL_PATH)/wolfcrypt/src/aes_asm.S
$(CC) $(CFLAGS_ASM) -c -o $@ $<
$(WOLFSSL_PATH)/wolfcrypt/src/aes_gcm_asm.o: $(WOLFSSL_PATH)/wolfcrypt/src/aes_gcm_asm.S
$(CC) $(CFLAGS_ASM) -c -o $@ $<
# -----------------------------------------------------------------------
# EFI image rules
# -----------------------------------------------------------------------
libwolfcrypt.elf: $(OBJS_WOLFCRYPT) $(EXTRA_OBJS)
$(LD) $(LDFLAGS) --defsym=EFI_SUBSYSTEM=11 -o $@ $(LD_GROUPS)
libwolfcrypt.efi: libwolfcrypt.elf
@echo Creating $@
$(OBJCOPY) -j .rodata -j .text -j .sdata -j .data \
-j .dynamic -j .dynsym -j .rel \
-j .rela -j .reloc $(EFI_EH_FRAME) \
--target=$(EFI_DRV_TGT) --subsystem=11 $(EFI_REMOVE_EH) $^ $@
@echo Size:
$(SIZE) $@
test.elf: $(OBJS_TEST) $(EXTRA_TEST_OBJS)
$(LD) $(LDFLAGS) --defsym=EFI_SUBSYSTEM=10 -o $@ $(LD_GROUPS_TEST)
test.efi: test.elf
@echo Creating $@
$(OBJCOPY) -j .rodata -j .text -j .sdata -j .data \
-j .dynamic -j .dynsym -j .rel \
-j .rela -j .reloc $(EFI_EH_FRAME) \
--target=$(EFI_APP_TGT) --subsystem=10 $(EFI_REMOVE_EH) $^ $@
@echo Size:
$(SIZE) $@
# -----------------------------------------------------------------------
# install
# -----------------------------------------------------------------------
install: libwolfcrypt.efi test.efi
mkdir -p efifs
cp libwolfcrypt.efi efifs/
cp test.efi efifs/
cp startup-single.nsh efifs/startup.nsh
cp NvVars efifs/ 2>/dev/null || true
install-dual: libwolfcrypt.efi libwolfcrypt-nohw.efi test.efi
mkdir -p efifs
cp libwolfcrypt.efi efifs/
cp libwolfcrypt-nohw.efi efifs/
cp test.efi efifs/
cp startup.nsh efifs/
cp NvVars efifs/ 2>/dev/null || true
# -----------------------------------------------------------------------
# lib — x86_64 with AES-NI (hw)
# -----------------------------------------------------------------------
.PHONY: lib
lib:
@$(MAKE) CFLAGS="$(CFLAGS_HW)" LDFLAGS="$(LDFLAGS_X64)" \
LD_GROUPS="$(LD_GROUP_X64_HW)" LD_GROUPS_TEST="$(LD_GROUP_X64_TEST)" \
EXTRA_OBJS="$(OBJS_HW)" EXTRA_TEST_OBJS="$(GNU_EFI_CRT0_X64)" \
EFI_DRV_TGT="$(EFI_DRIVER_TARGET_X64)" EFI_APP_TGT="$(EFI_APP_TARGET_X64)" \
libwolfcrypt.efi test.efi install
# -----------------------------------------------------------------------
# lib-nohw — x86_64 software-only
# -----------------------------------------------------------------------
.PHONY: lib-nohw
lib-nohw: CFLAGS = $(CFLAGS_NOHW)
lib-nohw: LDFLAGS = $(LDFLAGS_X64)
lib-nohw: LD_GROUPS = $(LD_GROUP_X64)
lib-nohw: LD_GROUPS_TEST = $(LD_GROUP_X64_TEST)
lib-nohw: EXTRA_TEST_OBJS = $(GNU_EFI_CRT0_X64)
lib-nohw: EFI_DRV_TGT = $(EFI_DRIVER_TARGET_X64)
lib-nohw: EFI_APP_TGT = $(EFI_APP_TARGET_X64)
lib-nohw: libwolfcrypt.efi test.efi install
# -----------------------------------------------------------------------
# lib32 — i386, software-only
# -----------------------------------------------------------------------
.PHONY: lib32
lib32: CFLAGS = $(CFLAGS_I32)
lib32: LDFLAGS = $(LDFLAGS_I32)
lib32: LD_GROUPS = $(LD_GROUP_I32)
lib32: LD_GROUPS_TEST = $(LD_GROUP_I32_TEST)
lib32: EXTRA_TEST_OBJS =
lib32: EFI_DRV_TGT = $(EFI_DRIVER_TARGET_I32)
lib32: EFI_APP_TGT = $(EFI_APP_TARGET_I32)
lib32: EFI_EH_FRAME =
lib32: EFI_REMOVE_EH = --remove-section .eh_frame
lib32: libwolfcrypt.efi test.efi install
# -----------------------------------------------------------------------
# lib32-nohw — alias for lib32 (i386 has no hw accel)
# -----------------------------------------------------------------------
.PHONY: lib32-nohw
lib32-nohw: lib32
# -----------------------------------------------------------------------
# run targets
# -----------------------------------------------------------------------
.PHONY: run
run: lib
qemu-system-x86_64 -machine q35,accel=kvm -m 512 -net none -serial stdio \
-display none -cpu $(QEMU_CPU_HW) \
-bios /usr/share/ovmf/OVMF.fd \
-drive format=raw,file=fat:rw:./efifs \
-object rng-random,id=rng0,filename=/dev/urandom \
-device virtio-rng-pci,rng=rng0
.PHONY: run-nohw
run-nohw: lib-nohw
qemu-system-x86_64 -machine q35,accel=kvm -m 512 -net none -serial stdio \
-display none -cpu $(QEMU_CPU) \
-bios /usr/share/ovmf/OVMF.fd \
-drive format=raw,file=fat:rw:./efifs \
-object rng-random,id=rng0,filename=/dev/urandom \
-device virtio-rng-pci,rng=rng0
.PHONY: run32
run32: lib32
qemu-system-i386 -m 512 -machine q35,accel=kvm -net none -serial stdio \
-display none -cpu $(QEMU_CPU_HW) \
-drive if=pflash,format=raw,readonly=on,file=/usr/share/OVMF/OVMF32_CODE_4M.fd \
-drive format=raw,file=fat:rw:./efifs
.PHONY: run32-nohw
run32-nohw: lib32-nohw
qemu-system-i386 -m 512 -machine q35,accel=kvm -net none -serial stdio \
-display none -cpu qemu32 \
-drive if=pflash,format=raw,readonly=on,file=/usr/share/OVMF/OVMF32_CODE_4M.fd \
-drive format=raw,file=fat:rw:./efifs
# -----------------------------------------------------------------------
# run-fallback-nohw
# Build hw + nohw drivers, install both; run QEMU without AES-NI so the
# hw driver exits EFI_UNSUPPORTED and startup.nsh loads the nohw driver.
# -----------------------------------------------------------------------
.PHONY: run-fallback-nohw
run-fallback-nohw:
@echo "=== Building hw driver (with AES-NI) ==="
@$(MAKE) CFLAGS="$(CFLAGS_HW)" LDFLAGS="$(LDFLAGS_X64)" \
LD_GROUPS="$(LD_GROUP_X64_HW)" LD_GROUPS_TEST="$(LD_GROUP_X64_TEST)" \
EXTRA_OBJS="$(OBJS_HW)" EXTRA_TEST_OBJS="$(GNU_EFI_CRT0_X64)" \
EFI_DRV_TGT="$(EFI_DRIVER_TARGET_X64)" EFI_APP_TGT="$(EFI_APP_TARGET_X64)" \
libwolfcrypt.efi test.efi
@echo "=== Saving hw driver ==="
@cp libwolfcrypt.efi libwolfcrypt-hw-tmp.efi
@echo "=== Cleaning objects ==="
@$(MAKE) clean-objs
@echo "=== Building nohw driver ==="
@$(MAKE) CFLAGS="$(CFLAGS_NOHW)" LDFLAGS="$(LDFLAGS_X64)" \
LD_GROUPS="$(LD_GROUP_X64)" LD_GROUPS_TEST="$(LD_GROUP_X64_TEST)" \
EXTRA_TEST_OBJS="$(GNU_EFI_CRT0_X64)" \
EFI_DRV_TGT="$(EFI_DRIVER_TARGET_X64)" EFI_APP_TGT="$(EFI_APP_TARGET_X64)" \
libwolfcrypt.efi
@mv libwolfcrypt.efi libwolfcrypt-nohw.efi
@mv libwolfcrypt-hw-tmp.efi libwolfcrypt.efi
@echo "=== Installing dual build to efifs ==="
@mkdir -p efifs
@cp libwolfcrypt.efi efifs/
@cp libwolfcrypt-nohw.efi efifs/
@cp test.efi efifs/
@cp startup.nsh efifs/
@cp NvVars efifs/ 2>/dev/null || true
@echo "=== Running QEMU without AES-NI (fallback test) ==="
qemu-system-x86_64 -m 512 -net none -serial stdio -display none \
-cpu $(QEMU_CPU) \
-bios /usr/share/ovmf/OVMF.fd \
-drive format=raw,file=fat:rw:./efifs \
-object rng-random,id=rng0,filename=/dev/urandom \
-device virtio-rng-pci,rng=rng0
# -----------------------------------------------------------------------
# clean
# -----------------------------------------------------------------------
.PHONY: clean
clean:
rm -f *.elf *.efi *.o libwolfcrypt-hw-tmp.efi libwolfcrypt-nohw.efi
rm -f $(WOLFSSL_PATH)/wolfcrypt/src/*.o src/*.o
.PHONY: clean-objs
clean-objs:
rm -f $(WOLFSSL_PATH)/wolfcrypt/src/*.o src/*.o
.PHONY: all
all: lib-nohw

BIN
uefi-library/NvVars 100644
View File

Binary file not shown.

175
uefi-library/README.md 100644
View File

@ -0,0 +1,175 @@
# wolfCrypt UEFI Library
## wolfCrypt as a UEFI Boot-Service Driver
A UEFI boot-services driver that exposes wolfCrypt cryptographic operations to
other UEFI applications and drivers via an EFI protocol interface.
Applications running in efi after loading the wolfcrypt driver can use the
`wolfcrypt_protocol` to call wolfCrypt functions directly from UEFI.
See `test_app.c` for example usage.
### Directory Structure
```
uefi-library/
├── Makefile
├── user_settings.h wolfSSL platform/feature configuration
├── wolfcrypt_api.h EFI protocol GUID + WOLFCRYPT_PROTOCOL struct
├── utility_wolf.h UEFI utility function declarations
├── NvVars OVMF NVRAM state file (boot order, etc.)
├── startup.nsh Dual-build fallback NSH script
├── startup-single.nsh Single-build NSH script
├── src/
│ ├── driver.c EFI driver entry point + EFIAPI wrappers
│ ├── test_app.c Smoke-test UEFI application
│ └── utility_wolf.c UEFI platform utility implementations
└── README.md
```
---
## Prerequisites (Linux)
| Package | Purpose |
|---------|---------|
| `gnu-efi` | EFI CRT0, linker scripts, headers (`/usr/include/efi`) |
| `gcc-multilib` | 32-bit cross-build support (`-m32`) |
| `qemu-system-x86` | x86_64 and i386 UEFI emulation |
| `ovmf` | UEFI firmware for QEMU (`/usr/share/ovmf/OVMF.fd`) |
| wolfssl source | wolfCrypt source tree (see `WOLFSSL_PATH` below) |
Install on Debian/Ubuntu:
```bash
sudo apt install gnu-efi gcc-multilib qemu-system-x86 ovmf
```
---
## Build Targets
| Target | Architecture | AES-NI | Description |
|--------|-------------|--------|-------------|
| `lib` | x86_64 | yes | Driver with AES-NI acceleration |
| `lib-nohw` | x86_64 | no | Pure software driver |
| `lib32` | i386 | no | 32-bit driver (software only) |
| `lib32-nohw` | i386 | no | Alias for lib32 |
| `run` | x86_64 | yes | Build + QEMU (KVM, host CPU) |
| `run-nohw` | x86_64 | no | Build + QEMU (qemu64 CPU, no AES-NI) |
| `run32` | i386 | no | Build + QEMU i386 |
| `run32-nohw` | i386 | no | Alias for run32 |
| `run-fallback-nohw` | x86_64 | both | Build hw+nohw, run QEMU without AES-NI |
| `clean` | — | — | Remove all build artifacts |
---
## WOLFSSL_PATH Variable
The Makefile defaults to:
```makefile
WOLFSSL_PATH ?= $(abspath $(CURDIR)/../../wolfssl)
```
This resolves to the `wolfssl` directory that is a sibling of `wolfssl-examples`.
Override on the command line:
```bash
make run-nohw WOLFSSL_PATH=/path/to/wolfssl
```
The wolfssl source does not need to be configured or compiled separately — the
Makefile compiles only the required `.c` files from the wolfssl tree directly.
---
## hw vs nohw Builds
**`lib` (hw)** compiles with `-maes -mpclmul -DUEFI_HW_ACCEL`, enabling AES-NI
intrinsics. At runtime the driver checks CPUID for AES-NI support in `efi_main`.
If AES-NI is absent the driver prints a message and returns `EFI_UNSUPPORTED`,
staying unloaded. This enables the CPUID-based fallback mechanism.
**`lib-nohw`** compiles without hardware intrinsics, using portable C
implementations. It loads on any x86_64 CPU regardless of AES-NI.
---
## CPUID-Based Fallback Mechanism
The `run-fallback-nohw` target demonstrates automatic driver selection:
1. Both `libwolfcrypt.efi` (hw) and `libwolfcrypt-nohw.efi` (software-only) are
built and copied to the `efifs/` FAT image.
2. `startup.nsh` is installed in `efifs/`:
```
fs0:
load libwolfcrypt.efi
if %lasterror% == 0 then
goto loaded
endif
echo Falling back to software-only driver...
load libwolfcrypt-nohw.efi
:loaded
test.efi
```
3. QEMU is launched with `-cpu qemu64` (no AES-NI).
4. The hw driver detects the missing capability and returns `EFI_UNSUPPORTED`.
5. The shell sees a non-zero `%lasterror%` and loads the nohw driver instead.
6. `test.efi` runs against whichever driver is resident.
This mirrors real-world deployment where a single firmware image ships both
variants, choosing at boot time based on hardware capability.
---
## Example Invocations
```bash
# Safest — software only, no KVM or AES-NI required
make run-nohw
# Hardware accelerated (requires KVM host with AES-NI), runs in KVM/qemu
make run
# Demonstrate fallback on qemu64: CPU does not support AES-NI
# hw driver `load` fails, exits with EFI_UNSUPPORTED, nohw driver loaded
# as fallback via startup.nsh
make run-fallback-nohw
# 32-bit build, software only, run in qemu32
make run32-nohw
# Build only, no QEMU (full HW accelerated build)
make lib-nohw
```
---
## Protocol Interface
The driver installs a `WOLFCRYPT_PROTOCOL` on its image handle. Consumer
applications locate it via:
```c
#include "wolfcrypt_api.h"
static EFI_GUID gWolfCryptProtocolGuid = WOLFCRYPT_PROTOCOL_GUID;
WOLFCRYPT_PROTOCOL *wc = NULL;
Status = BS->LocateProtocol(&gWolfCryptProtocolGuid, NULL, (VOID **)&wc);
```
The protocol struct provides function pointers for:
- **Symmetric**: AES (ECB/CBC/CFB/CTR/OFB/GCM/CCM), ChaCha20, Poly1305,
ChaCha20-Poly1305 AEAD, CMAC
- **Hash**: SHA-1, SHA-224, SHA-256, SHA-384, SHA-512, SHA-3 (256/384/512),
SHAKE-128, SHAKE-256
- **MAC**: HMAC
- **Asymmetric**: RSA, ECC, DH, Curve25519, Ed25519
- **Post-quantum**: ML-KEM (Kyber), Dilithium (ML-DSA), Falcon, SPHINCS+, XMSS, LMS
- **KDF**: PBKDF2, PKCS12-PBKDF, HKDF
- **RNG**: hardware-seeded DRBG via UEFI `EFI_RNG_PROTOCOL`
- **Misc**: logging, error strings, version
See `wolfcrypt_api.h` for the complete `WOLFCRYPT_PROTOCOL` definition.

825
uefi-library/src/driver.c 100644
View File

@ -0,0 +1,825 @@
/* driver.c
*
* wolfCrypt as standalone bootloader driver for UEFI
*
* Copyright (C) 2026 wolfSSL Inc.
*
* This file is part of wolfSSL. (formerly known as CyaSSL)
*
* wolfSSL is free software; you can redistribute it and/or modify
* it under the terms of the GNU General Public License as published by
* the Free Software Foundation; either version 2 of the License, or
* (at your option) any later version.
*
* wolfSSL is distributed in the hope that it will be useful,
* but WITHOUT ANY WARRANTY; without even the implied warranty of
* MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
* GNU General Public License for more details.
*
* You should have received a copy of the GNU General Public License
* along with this program; if not, write to the Free Software
* Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301, USA
*/
#include <efi.h>
#include <efilib.h>
#include <wolfssl/wolfcrypt/logging.h>
#include <wolfssl/wolfcrypt/memory.h>
#include <wolfssl/wolfcrypt/misc.h>
#include <wolfssl/version.h>
#include <wolfssl/wolfcrypt/pwdbased.h>
#include <wolfssl/wolfcrypt/aes.h>
#include <wolfssl/wolfcrypt/pkcs7.h>
#include <wolfssl/wolfcrypt/rsa.h>
#include <wolfssl/wolfcrypt/sha3.h>
#include <wolfssl/wolfcrypt/ecc.h>
#include <wolfssl/wolfcrypt/dh.h>
#include <wolfssl/wolfcrypt/chacha.h>
#include <wolfssl/wolfcrypt/poly1305.h>
#include <wolfssl/wolfcrypt/chacha20_poly1305.h>
#include <wolfssl/wolfcrypt/curve25519.h>
#include <wolfssl/wolfcrypt/ed25519.h>
#include <wolfssl/wolfcrypt/cmac.h>
#include <wolfssl/wolfcrypt/kdf.h>
#ifdef HAVE_DILITHIUM
#include <wolfssl/wolfcrypt/dilithium.h>
#endif
#ifdef HAVE_FALCON
#include <wolfssl/wolfcrypt/falcon.h>
#endif
#ifdef UEFI_HW_ACCEL
#include <wolfssl/wolfcrypt/cpuid.h>
#endif
#include "wolfcrypt_api.h"
#ifdef GNUEFI
#define EFI_API_TAG EFIAPI
#else
#define EFI_API_TAG __attribute__((ms_abi))
#endif
#define WRAP_FUNC(ret_type, name, args, call_args) \
static ret_type EFI_API_TAG name##_EfiAPI args { \
return name call_args; \
}
#define WRAP_VOID(name, args, call_args) \
static void EFI_API_TAG name##_EfiAPI args { \
name call_args; \
}
#define WRAP_FUNC_ALIAS(ret_type, alias, target, args, call_args) \
static ret_type EFI_API_TAG alias##_EfiAPI args { \
return target call_args; \
}
#define WRAP_VOID_ALIAS(alias, target, args, call_args) \
static void EFI_API_TAG alias##_EfiAPI args { \
target call_args; \
}
#define WC_UNUSED(x) ((void)(x))
WOLFSSL_API int wc_RsaSetRNG(RsaKey* key, WC_RNG* rng);
static EFI_HANDLE g_wolfcrypt_handle = NULL;
EFI_GUID g_wolfcrypt_protocol_guid = WOLFCRYPT_PROTOCOL_GUID;
/* ------------------------------------------------------------------ */
/* AES wrappers */
/* ------------------------------------------------------------------ */
WRAP_FUNC(int, wc_AesInit, (Aes* aes, void* heap, int devId), (aes, heap, devId))
WRAP_FUNC(int, wc_AesSetKey, (Aes* aes, const byte* key, word32 len, const byte* iv, int dir),
(aes, key, len, iv, dir))
WRAP_FUNC(int, wc_AesEcbEncrypt, (Aes* aes, byte* out, const byte* in, word32 sz),
(aes, out, in, sz))
WRAP_FUNC(int, wc_AesEcbDecrypt, (Aes* aes, byte* out, const byte* in, word32 sz),
(aes, out, in, sz))
WRAP_FUNC(int, wc_AesCbcEncrypt, (Aes* aes, byte* out, const byte* in, word32 sz),
(aes, out, in, sz))
WRAP_FUNC(int, wc_AesCbcDecrypt, (Aes* aes, byte* out, const byte* in, word32 sz),
(aes, out, in, sz))
WRAP_FUNC(int, wc_AesCfbEncrypt, (Aes* aes, byte* out, const byte* in, word32 sz),
(aes, out, in, sz))
WRAP_FUNC(int, wc_AesCfbDecrypt, (Aes* aes, byte* out, const byte* in, word32 sz),
(aes, out, in, sz))
WRAP_FUNC(int, wc_AesSetIV, (Aes* aes, const byte* iv), (aes, iv))
WRAP_VOID(wc_AesFree, (Aes* aes), (aes))
WRAP_FUNC(int, wc_AesGcmSetKey, (Aes* aes, const byte* key, word32 len), (aes, key, len))
WRAP_FUNC(int, wc_AesGcmEncrypt, (Aes* aes, byte* out, const byte* in, word32 sz,
const byte* iv, word32 ivSz, byte* authTag, word32 authTagSz,
const byte* authIn, word32 authInSz),
(aes, out, in, sz, iv, ivSz, authTag, authTagSz, authIn, authInSz))
WRAP_FUNC(int, wc_AesGcmDecrypt, (Aes* aes, byte* out, const byte* in, word32 sz,
const byte* iv, word32 ivSz, const byte* authTag, word32 authTagSz,
const byte* authIn, word32 authInSz),
(aes, out, in, sz, iv, ivSz, authTag, authTagSz, authIn, authInSz))
WRAP_FUNC(int, wc_AesCcmSetKey, (Aes* aes, const byte* key, word32 keySz), (aes, key, keySz))
WRAP_FUNC(int, wc_AesCcmEncrypt, (Aes* aes, byte* out, const byte* in, word32 inSz,
const byte* nonce, word32 nonceSz, byte* authTag, word32 authTagSz,
const byte* authIn, word32 authInSz),
(aes, out, in, inSz, nonce, nonceSz, authTag, authTagSz, authIn, authInSz))
WRAP_FUNC(int, wc_AesCcmDecrypt, (Aes* aes, byte* out, const byte* in, word32 inSz,
const byte* nonce, word32 nonceSz, const byte* authTag, word32 authTagSz,
const byte* authIn, word32 authInSz),
(aes, out, in, inSz, nonce, nonceSz, authTag, authTagSz, authIn, authInSz))
WRAP_FUNC(int, wc_AesCtrEncrypt, (Aes* aes, byte* out, const byte* in, word32 sz),
(aes, out, in, sz))
WRAP_FUNC(int, wc_AesOfbEncrypt, (Aes* aes, byte* out, const byte* in, word32 sz),
(aes, out, in, sz))
/* ------------------------------------------------------------------ */
/* RNG wrappers */
/* ------------------------------------------------------------------ */
WRAP_FUNC(int, wc_InitRng, (WC_RNG* rng), (rng))
WRAP_FUNC(int, wc_FreeRng, (WC_RNG* rng), (rng))
WRAP_FUNC(int, wc_RNG_GenerateBlock, (WC_RNG* rng, byte* output, word32 sz), (rng, output, sz))
WRAP_FUNC(int, wc_RNG_GenerateByte, (WC_RNG* rng, byte* b), (rng, b))
WRAP_FUNC(int, wc_SetSeed_Cb, (wc_RngSeed_Cb cb), (cb))
WRAP_FUNC(int, wc_RNG_TestSeed, (const byte* seed, word32 seedSz), (seed, seedSz))
WRAP_FUNC(int, wc_GenerateSeed, (OS_Seed* os, byte* output, word32 sz), (os, output, sz))
static int EFIAPI wc_GenerateSeed_IntelRD_EfiAPI(OS_Seed* os, byte* output, word32 sz)
{
return wc_GenerateSeed(os, output, sz);
}
static int EFIAPI wc_GenerateRand_IntelRD_EfiAPI(OS_Seed* os, byte* output, word32 sz)
{
return wc_GenerateSeed(os, output, sz);
}
static void EFIAPI wc_InitRng_IntelRD_EfiAPI(void)
{
/* All entropy sources are assumed ready in this configuration. */
}
/* ------------------------------------------------------------------ */
/* RSA wrappers */
/* ------------------------------------------------------------------ */
WRAP_FUNC(int, wc_InitRsaKey, (RsaKey* key, void* heap), (key, heap))
WRAP_FUNC(int, wc_MakeRsaKey, (RsaKey* key, int size, long e, WC_RNG* rng), (key, size, e, rng))
WRAP_FUNC(int, wc_RsaKeyToDer, (RsaKey* key, byte* output, word32 inLen), (key, output, inLen))
WRAP_FUNC(int, wc_FreeRsaKey, (RsaKey* key), (key))
WRAP_FUNC(int, wc_RsaEncryptSize, (const RsaKey* key), (key))
WRAP_FUNC(int, wc_RsaPrivateKeyDecode, (const byte* input, word32* inOutIdx, RsaKey* key, word32 inSz),
(input, inOutIdx, key, inSz))
WRAP_FUNC(int, wc_RsaPublicKeyDecode, (const byte* input, word32* inOutIdx, RsaKey* key, word32 inSz),
(input, inOutIdx, key, inSz))
WRAP_FUNC(int, wc_RsaPrivateDecrypt_ex,
(const byte* in, word32 inLen, byte* out, word32 outLen, RsaKey* key, int type,
enum wc_HashType hash, int mgf, byte* label, word32 labelSz),
(in, inLen, out, outLen, key, type, hash, mgf, label, labelSz))
WRAP_FUNC(int, wc_RsaPrivateDecrypt, (const byte* in, word32 inLen, byte* out, word32 outLen, RsaKey* key),
(in, inLen, out, outLen, key))
WRAP_FUNC(int, wc_RsaPublicEncrypt, (const byte* in, word32 inLen, byte* out, word32 outLen, RsaKey* key, WC_RNG* rng),
(in, inLen, out, outLen, key, rng))
WRAP_FUNC(int, wc_RsaPublicEncrypt_ex,
(const byte* in, word32 inLen, byte* out, word32 outLen, RsaKey* key, WC_RNG* rng,
int type, enum wc_HashType hash, int mgf, byte* label, word32 labelSz),
(in, inLen, out, outLen, key, rng, type, hash, mgf, label, labelSz))
WRAP_FUNC(int, wc_RsaExportKey,
(RsaKey* key, byte* e, word32* eSz, byte* n, word32* nSz,
byte* d, word32* dSz, byte* p, word32* pSz, byte* q, word32* qSz),
(key, e, eSz, n, nSz, d, dSz, p, pSz, q, qSz))
WRAP_FUNC(int, wc_CheckRsaKey, (RsaKey* key), (key))
WRAP_FUNC(int, wc_RsaPublicKeyDerSize, (RsaKey* key, int withHeader), (key, withHeader))
WRAP_FUNC(int, wc_RsaKeyToPublicDer, (RsaKey* key, byte* output, word32 inLen), (key, output, inLen))
WRAP_FUNC(int, wc_RsaSetRNG, (RsaKey* key, WC_RNG* rng), (key, rng))
static void EFIAPI wc_RsaCleanup_EfiAPI(RsaKey* key)
{
if (key == NULL) {
return;
}
if (key->data != NULL && key->dataLen > 0 &&
(key->type == RSA_PRIVATE_DECRYPT || key->type == RSA_PRIVATE_ENCRYPT)) {
ForceZero(key->data, key->dataLen);
}
if (key->dataIsAlloc) {
XFREE(key->data, key->heap, DYNAMIC_TYPE_WOLF_BIGINT);
key->dataIsAlloc = 0;
}
key->data = NULL;
key->dataLen = 0;
}
/* ------------------------------------------------------------------ */
/* HMAC wrappers */
/* ------------------------------------------------------------------ */
WRAP_FUNC(int, wc_HmacSetKey, (Hmac* hmac, int type, const byte* key, word32 length), (hmac, type, key, length))
WRAP_FUNC(int, wc_HmacUpdate, (Hmac* hmac, const byte* msg, word32 length), (hmac, msg, length))
WRAP_FUNC(int, wc_HmacFinal, (Hmac* hmac, byte* hash), (hmac, hash))
/* ------------------------------------------------------------------ */
/* SHA-1 wrappers */
/* ------------------------------------------------------------------ */
WRAP_FUNC(int, wc_InitSha, (wc_Sha* sha), (sha))
WRAP_FUNC(int, wc_ShaUpdate, (wc_Sha* sha, const byte* data, word32 len), (sha, data, len))
WRAP_FUNC(int, wc_ShaFinal, (wc_Sha* sha, byte* hash), (sha, hash))
WRAP_VOID(wc_ShaFree, (wc_Sha* sha), (sha))
/* ------------------------------------------------------------------ */
/* SHA-224 wrappers */
/* ------------------------------------------------------------------ */
WRAP_FUNC(int, wc_InitSha224, (wc_Sha224* sha), (sha))
WRAP_FUNC(int, wc_Sha224Update, (wc_Sha224* sha, const byte* data, word32 len), (sha, data, len))
WRAP_FUNC(int, wc_Sha224Final, (wc_Sha224* sha, byte* hash), (sha, hash))
WRAP_VOID(wc_Sha224Free, (wc_Sha224* sha), (sha))
/* ------------------------------------------------------------------ */
/* SHA-256 wrappers */
/* ------------------------------------------------------------------ */
WRAP_FUNC(int, wc_InitSha256, (wc_Sha256* sha), (sha))
WRAP_FUNC(int, wc_InitSha256_ex, (wc_Sha256* sha, void* heap, int devId), (sha, heap, devId))
WRAP_FUNC(int, wc_Sha256Update, (wc_Sha256* sha, const byte* data, word32 len), (sha, data, len))
WRAP_FUNC(int, wc_Sha256Final, (wc_Sha256* sha256, byte* hash), (sha256, hash))
WRAP_VOID(wc_Sha256Free, (wc_Sha256* sha), (sha))
/* ------------------------------------------------------------------ */
/* SHA-384 wrappers */
/* ------------------------------------------------------------------ */
WRAP_FUNC(int, wc_InitSha384, (wc_Sha384* sha), (sha))
WRAP_FUNC(int, wc_Sha384Update, (wc_Sha384* sha, const byte* data, word32 len), (sha, data, len))
WRAP_FUNC(int, wc_Sha384Final, (wc_Sha384* sha, byte* hash), (sha, hash))
WRAP_VOID(wc_Sha384Free, (wc_Sha384* sha), (sha))
/* ------------------------------------------------------------------ */
/* SHA-512 wrappers */
/* ------------------------------------------------------------------ */
WRAP_FUNC(int, wc_InitSha512, (wc_Sha512* sha), (sha))
WRAP_FUNC(int, wc_Sha512Update, (wc_Sha512* sha, const byte* data, word32 len), (sha, data, len))
WRAP_FUNC(int, wc_Sha512Final, (wc_Sha512* sha, byte* hash), (sha, hash))
WRAP_VOID(wc_Sha512Free, (wc_Sha512* sha), (sha))
/* ------------------------------------------------------------------ */
/* SHA-3 wrappers */
/* ------------------------------------------------------------------ */
WRAP_FUNC(int, wc_InitSha3_256, (wc_Sha3* sha, void* heap, int devId), (sha, heap, devId))
WRAP_FUNC(int, wc_Sha3_256_Update, (wc_Sha3* sha, const byte* data, word32 len), (sha, data, len))
WRAP_FUNC(int, wc_Sha3_256_Final, (wc_Sha3* sha, byte* hash), (sha, hash))
WRAP_VOID(wc_Sha3_256_Free, (wc_Sha3* sha), (sha))
WRAP_FUNC(int, wc_InitSha3_384, (wc_Sha3* sha, void* heap, int devId), (sha, heap, devId))
WRAP_FUNC(int, wc_Sha3_384_Update, (wc_Sha3* sha, const byte* data, word32 len), (sha, data, len))
WRAP_FUNC(int, wc_Sha3_384_Final, (wc_Sha3* sha, byte* hash), (sha, hash))
WRAP_VOID(wc_Sha3_384_Free, (wc_Sha3* sha), (sha))
WRAP_FUNC(int, wc_InitSha3_512, (wc_Sha3* sha, void* heap, int devId), (sha, heap, devId))
WRAP_FUNC(int, wc_Sha3_512_Update, (wc_Sha3* sha, const byte* data, word32 len), (sha, data, len))
WRAP_FUNC(int, wc_Sha3_512_Final, (wc_Sha3* sha, byte* hash), (sha, hash))
WRAP_VOID(wc_Sha3_512_Free, (wc_Sha3* sha), (sha))
/* ------------------------------------------------------------------ */
/* SHAKE128/256 wrappers */
/* ------------------------------------------------------------------ */
WRAP_FUNC(int, wc_InitShake128, (wc_Shake* shake, void* heap, int devId), (shake, heap, devId))
WRAP_FUNC(int, wc_Shake128_Update, (wc_Shake* shake, const byte* data, word32 len), (shake, data, len))
WRAP_FUNC(int, wc_Shake128_Final, (wc_Shake* shake, byte* hash, word32 hashLen), (shake, hash, hashLen))
WRAP_FUNC(int, wc_Shake128_SqueezeBlocks, (wc_Shake* shake, byte* out, word32 blockCnt), (shake, out, blockCnt))
WRAP_VOID(wc_Shake128_Free, (wc_Shake* shake), (shake))
WRAP_FUNC(int, wc_InitShake256, (wc_Shake* shake, void* heap, int devId), (shake, heap, devId))
WRAP_FUNC(int, wc_Shake256_Update, (wc_Shake* shake, const byte* data, word32 len), (shake, data, len))
WRAP_FUNC(int, wc_Shake256_Final, (wc_Shake* shake, byte* hash, word32 hashLen), (shake, hash, hashLen))
WRAP_FUNC(int, wc_Shake256_SqueezeBlocks, (wc_Shake* shake, byte* out, word32 blockCnt), (shake, out, blockCnt))
WRAP_VOID(wc_Shake256_Free, (wc_Shake* shake), (shake))
/* ------------------------------------------------------------------ */
/* ECC wrappers */
/* ------------------------------------------------------------------ */
WRAP_FUNC(int, wc_ecc_init, (ecc_key* key), (key))
WRAP_VOID(wc_ecc_free, (ecc_key* key), (key))
WRAP_FUNC(int, wc_ecc_make_key, (WC_RNG* rng, int keysize, ecc_key* key), (rng, keysize, key))
WRAP_FUNC(int, wc_ecc_set_rng, (ecc_key* key, WC_RNG* rng), (key, rng))
WRAP_FUNC(int, wc_ecc_shared_secret, (ecc_key* priv, ecc_key* pub, byte* out, word32* outlen),
(priv, pub, out, outlen))
WRAP_FUNC(int, wc_ecc_sign_hash, (const byte* in, word32 inlen, byte* out, word32* outlen,
WC_RNG* rng, ecc_key* key), (in, inlen, out, outlen, rng, key))
WRAP_FUNC(int, wc_ecc_verify_hash, (const byte* sig, word32 siglen, const byte* hash,
word32 hashlen, int* stat, ecc_key* key), (sig, siglen, hash, hashlen, stat, key))
WRAP_FUNC(int, wc_ecc_export_x963, (ecc_key* key, byte* out, word32* outLen), (key, out, outLen))
WRAP_FUNC(int, wc_ecc_import_x963, (const byte* in, word32 inLen, ecc_key* key), (in, inLen, key))
WRAP_FUNC(int, wc_EccKeyToDer, (ecc_key* key, byte* output, word32 inLen), (key, output, inLen))
WRAP_FUNC(int, wc_EccPublicKeyDecode, (const byte* input, word32* inOutIdx, ecc_key* key, word32 inSz),
(input, inOutIdx, key, inSz))
WRAP_FUNC(int, wc_EccPrivateKeyDecode, (const byte* input, word32* inOutIdx, ecc_key* key, word32 inSz),
(input, inOutIdx, key, inSz))
/* ------------------------------------------------------------------ */
/* DH wrappers */
/* ------------------------------------------------------------------ */
WRAP_FUNC(int, wc_DhGenerateParams, (WC_RNG* rng, int modSz, DhKey* key), (rng, modSz, key))
WRAP_FUNC(int, wc_DhGenerateKeyPair, (DhKey* key, WC_RNG* rng, byte* priv, word32* privSz,
byte* pub, word32* pubSz), (key, rng, priv, privSz, pub, pubSz))
WRAP_FUNC(int, wc_DhAgree, (DhKey* key, byte* agree, word32* agreeSz,
const byte* priv, word32 privSz, const byte* otherPub, word32 pubSz),
(key, agree, agreeSz, priv, privSz, otherPub, pubSz))
/* ------------------------------------------------------------------ */
/* ChaCha20 wrappers */
/* ------------------------------------------------------------------ */
WRAP_FUNC(int, wc_Chacha_SetKey, (ChaCha* ctx, const byte* key, word32 keySz), (ctx, key, keySz))
WRAP_FUNC(int, wc_Chacha_Process, (ChaCha* ctx, byte* output, const byte* input, word32 msglen),
(ctx, output, input, msglen))
/* ------------------------------------------------------------------ */
/* Poly1305 wrappers */
/* ------------------------------------------------------------------ */
WRAP_FUNC(int, wc_Poly1305SetKey, (Poly1305* ctx, const byte* key, word32 keySz), (ctx, key, keySz))
WRAP_FUNC(int, wc_Poly1305Update, (Poly1305* ctx, const byte* m, word32 bytes), (ctx, m, bytes))
WRAP_FUNC(int, wc_Poly1305Final, (Poly1305* ctx, byte* tag), (ctx, tag))
/* ------------------------------------------------------------------ */
/* ChaCha20-Poly1305 AEAD wrappers */
/* ------------------------------------------------------------------ */
WRAP_FUNC(int, wc_ChaCha20Poly1305_Encrypt,
(const byte* inKey, const byte* inIV,
const byte* inAAD, word32 inAADLen,
const byte* inPlaintext, word32 inPlaintextLen,
byte* outCiphertext, byte* outAuthTag),
(inKey, inIV, inAAD, inAADLen, inPlaintext, inPlaintextLen,
outCiphertext, outAuthTag))
WRAP_FUNC(int, wc_ChaCha20Poly1305_Decrypt,
(const byte* inKey, const byte* inIV,
const byte* inAAD, word32 inAADLen,
const byte* inCiphertext, word32 inCiphertextLen,
const byte* inAuthTag, byte* outPlaintext),
(inKey, inIV, inAAD, inAADLen, inCiphertext, inCiphertextLen,
inAuthTag, outPlaintext))
/* ------------------------------------------------------------------ */
/* Curve25519 wrappers */
/* ------------------------------------------------------------------ */
WRAP_FUNC(int, wc_curve25519_init, (curve25519_key* key), (key))
WRAP_VOID(wc_curve25519_free, (curve25519_key* key), (key))
WRAP_FUNC(int, wc_curve25519_make_key, (WC_RNG* rng, int keysize, curve25519_key* key),
(rng, keysize, key))
WRAP_FUNC(int, wc_curve25519_shared_secret, (curve25519_key* priv, curve25519_key* pub,
byte* out, word32* outlen), (priv, pub, out, outlen))
WRAP_FUNC(int, wc_curve25519_export_key_raw, (curve25519_key* key, byte* priv, word32* privSz,
byte* pub, word32* pubSz), (key, priv, privSz, pub, pubSz))
WRAP_FUNC(int, wc_curve25519_import_public, (const byte* in, word32 inLen, curve25519_key* key),
(in, inLen, key))
/* ------------------------------------------------------------------ */
/* Ed25519 wrappers */
/* ------------------------------------------------------------------ */
WRAP_FUNC(int, wc_ed25519_init, (ed25519_key* key), (key))
WRAP_VOID(wc_ed25519_free, (ed25519_key* key), (key))
WRAP_FUNC(int, wc_ed25519_make_key, (WC_RNG* rng, int keysize, ed25519_key* key),
(rng, keysize, key))
WRAP_FUNC(int, wc_ed25519_sign_msg, (const byte* in, word32 inlen, byte* out, word32* outlen,
ed25519_key* key), (in, inlen, out, outlen, key))
WRAP_FUNC(int, wc_ed25519_verify_msg, (const byte* sig, word32 siglen, const byte* msg,
word32 msglen, int* stat, ed25519_key* key), (sig, siglen, msg, msglen, stat, key))
WRAP_FUNC(int, wc_ed25519_export_key, (ed25519_key* key, byte* priv, word32* privSz,
byte* pub, word32* pubSz), (key, priv, privSz, pub, pubSz))
WRAP_FUNC(int, wc_ed25519_import_public, (const byte* in, word32 inLen, ed25519_key* key),
(in, inLen, key))
/* ------------------------------------------------------------------ */
/* ML-KEM wrappers */
/* ------------------------------------------------------------------ */
#ifdef WOLFSSL_HAVE_MLKEM
WRAP_FUNC(int, wc_MlKemKey_Init, (MlKemKey* key, int type, void* heap, int devId), (key, type, heap, devId))
WRAP_FUNC(int, wc_MlKemKey_Free, (MlKemKey* key), (key))
WRAP_FUNC(int, wc_MlKemKey_MakeKey, (MlKemKey* key, WC_RNG* rng), (key, rng))
WRAP_FUNC(int, wc_MlKemKey_CipherTextSize, (MlKemKey* key, word32* len), (key, len))
WRAP_FUNC(int, wc_MlKemKey_SharedSecretSize, (MlKemKey* key, word32* len), (key, len))
WRAP_FUNC(int, wc_MlKemKey_Encapsulate,
(MlKemKey* key, unsigned char* ct, unsigned char* ss, WC_RNG* rng),
(key, ct, ss, rng))
WRAP_FUNC(int, wc_MlKemKey_Decapsulate,
(MlKemKey* key, unsigned char* ss, const unsigned char* ct, word32 len),
(key, ss, ct, len))
WRAP_FUNC(int, wc_MlKemKey_DecodePrivateKey,
(MlKemKey* key, const unsigned char* in, word32 len), (key, in, len))
WRAP_FUNC(int, wc_MlKemKey_DecodePublicKey,
(MlKemKey* key, const unsigned char* in, word32 len), (key, in, len))
WRAP_FUNC(int, wc_MlKemKey_PrivateKeySize, (MlKemKey* key, word32* len), (key, len))
WRAP_FUNC(int, wc_MlKemKey_PublicKeySize, (MlKemKey* key, word32* len), (key, len))
WRAP_FUNC(int, wc_MlKemKey_EncodePrivateKey,
(MlKemKey* key, unsigned char* out, word32 len), (key, out, len))
WRAP_FUNC(int, wc_MlKemKey_EncodePublicKey,
(MlKemKey* key, unsigned char* out, word32 len), (key, out, len))
#endif /* WOLFSSL_HAVE_MLKEM */
/* ------------------------------------------------------------------ */
/* Dilithium wrappers */
/* ------------------------------------------------------------------ */
#ifdef HAVE_DILITHIUM
WRAP_FUNC(int, wc_dilithium_init, (dilithium_key* key), (key))
WRAP_VOID(wc_dilithium_free, (dilithium_key* key), (key))
WRAP_FUNC(int, wc_dilithium_set_level, (dilithium_key* key, byte level), (key, level))
WRAP_FUNC(int, wc_dilithium_make_key, (dilithium_key* key, WC_RNG* rng), (key, rng))
WRAP_FUNC(int, wc_dilithium_sign_msg, (const byte* in, word32 inLen, byte* out, word32* outLen,
dilithium_key* key, WC_RNG* rng), (in, inLen, out, outLen, key, rng))
WRAP_FUNC(int, wc_dilithium_verify_msg, (const byte* sig, word32 sigLen, const byte* msg,
word32 msgLen, int* res, dilithium_key* key), (sig, sigLen, msg, msgLen, res, key))
WRAP_FUNC(int, wc_dilithium_export_key, (dilithium_key* key, byte* priv, word32* privSz,
byte* pub, word32* pubSz), (key, priv, privSz, pub, pubSz))
WRAP_FUNC(int, wc_dilithium_import_key, (const byte* priv, word32 privSz,
const byte* pub, word32 pubSz, dilithium_key* key),
(priv, privSz, pub, pubSz, key))
#endif /* HAVE_DILITHIUM */
/* ------------------------------------------------------------------ */
/* Falcon wrappers */
/* ------------------------------------------------------------------ */
#ifdef HAVE_FALCON
WRAP_FUNC(int, wc_falcon_init, (falcon_key* key), (key))
WRAP_VOID(wc_falcon_free, (falcon_key* key), (key))
WRAP_FUNC(int, wc_falcon_make_key, (falcon_key* key, WC_RNG* rng), (key, rng))
WRAP_FUNC(int, wc_falcon_sign_msg, (const byte* in, word32 inLen, byte* out, word32* outLen,
falcon_key* key, WC_RNG* rng), (in, inLen, out, outLen, key, rng))
WRAP_FUNC(int, wc_falcon_verify_msg, (const byte* sig, word32 sigLen, const byte* msg,
word32 msgLen, int* res, falcon_key* key), (sig, sigLen, msg, msgLen, res, key))
WRAP_FUNC(int, wc_falcon_export_key, (falcon_key* key, byte* priv, word32* privSz,
byte* pub, word32* pubSz), (key, priv, privSz, pub, pubSz))
WRAP_FUNC(int, wc_falcon_import_key, (const byte* priv, word32 privSz,
const byte* pub, word32 pubSz, falcon_key* key),
(priv, privSz, pub, pubSz, key))
#endif /* HAVE_FALCON */
/* ------------------------------------------------------------------ */
/* CMAC wrappers */
/* ------------------------------------------------------------------ */
WRAP_FUNC(int, wc_InitCmac, (Cmac* cmac, const byte* key, word32 keySz, int type, void* unused),
(cmac, key, keySz, type, unused))
WRAP_FUNC(int, wc_CmacUpdate, (Cmac* cmac, const byte* in, word32 inSz), (cmac, in, inSz))
WRAP_FUNC(int, wc_CmacFinal, (Cmac* cmac, byte* out, word32* outSz), (cmac, out, outSz))
/* ------------------------------------------------------------------ */
/* KDF / PKCS wrappers */
/* ------------------------------------------------------------------ */
WRAP_FUNC(int, wc_PBKDF2,
(byte* output, const byte* passwd, int pLen, const byte* salt, int sLen,
int iterations, int kLen, int hashType),
(output, passwd, pLen, salt, sLen, iterations, kLen, hashType))
WRAP_FUNC(int, wc_PKCS12_PBKDF,
(byte* output, const byte* passwd, int passLen, const byte* salt, int saltLen,
int iterations, int kLen, int hashType, int id),
(output, passwd, passLen, salt, saltLen, iterations, kLen, hashType, id))
WRAP_FUNC(int, wc_PKCS7_PadData, (byte* in, word32 inSz, byte* out, word32 outSz, word32 blockSz),
(in, inSz, out, outSz, blockSz))
WRAP_FUNC(int, wc_HKDF, (int type, const byte* inKey, word32 inKeySz,
const byte* salt, word32 saltSz, const byte* info, word32 infoSz,
byte* out, word32 outSz),
(type, inKey, inKeySz, salt, saltSz, info, infoSz, out, outSz))
/* ------------------------------------------------------------------ */
/* Logging / Error wrappers */
/* ------------------------------------------------------------------ */
WRAP_FUNC(int, wolfSSL_Debugging_ON, (void), ())
WRAP_FUNC(int, wolfSSL_SetLoggingCb, (wolfSSL_Logging_cb cb), (cb))
WRAP_FUNC(wolfSSL_Logging_cb, wolfSSL_GetLoggingCb, (void), ())
WRAP_VOID(wolfSSL_Debugging_OFF, (void), ())
WRAP_FUNC(const char*, wc_GetErrorString, (int error), (error))
WRAP_VOID(wc_ErrorString, (int err, char* buff), (err, buff))
/* ------------------------------------------------------------------ */
/* Protocol instance */
/* ------------------------------------------------------------------ */
static WOLFCRYPT_PROTOCOL g_wolfcrypt_api = {
.Version = LIBWOLFSSL_VERSION_HEX,
/* AES */
.wc_AesInit = wc_AesInit_EfiAPI,
.wc_AesSetKey = wc_AesSetKey_EfiAPI,
.wc_AesEcbEncrypt = wc_AesEcbEncrypt_EfiAPI,
.wc_AesEcbDecrypt = wc_AesEcbDecrypt_EfiAPI,
.wc_AesCbcEncrypt = wc_AesCbcEncrypt_EfiAPI,
.wc_AesCbcDecrypt = wc_AesCbcDecrypt_EfiAPI,
.wc_AesCfbEncrypt = wc_AesCfbEncrypt_EfiAPI,
.wc_AesCfbDecrypt = wc_AesCfbDecrypt_EfiAPI,
.wc_AesSetIV = wc_AesSetIV_EfiAPI,
.wc_AesFree = wc_AesFree_EfiAPI,
.wc_AesGcmSetKey = wc_AesGcmSetKey_EfiAPI,
.wc_AesGcmEncrypt = wc_AesGcmEncrypt_EfiAPI,
.wc_AesGcmDecrypt = wc_AesGcmDecrypt_EfiAPI,
.wc_AesCcmSetKey = wc_AesCcmSetKey_EfiAPI,
.wc_AesCcmEncrypt = wc_AesCcmEncrypt_EfiAPI,
.wc_AesCcmDecrypt = wc_AesCcmDecrypt_EfiAPI,
.wc_AesCtrEncrypt = wc_AesCtrEncrypt_EfiAPI,
.wc_AesOfbEncrypt = wc_AesOfbEncrypt_EfiAPI,
/* RNG */
.wc_InitRng = wc_InitRng_EfiAPI,
.wc_FreeRng = wc_FreeRng_EfiAPI,
.wc_RNG_GenerateBlock = wc_RNG_GenerateBlock_EfiAPI,
.wc_RNG_GenerateByte = wc_RNG_GenerateByte_EfiAPI,
.wc_SetSeed_Cb = wc_SetSeed_Cb_EfiAPI,
.wc_RNG_TestSeed = wc_RNG_TestSeed_EfiAPI,
.wc_GenerateSeed_IntelRD = wc_GenerateSeed_IntelRD_EfiAPI,
.wc_GenerateSeed = wc_GenerateSeed_EfiAPI,
.wc_GenerateRand_IntelRD = wc_GenerateRand_IntelRD_EfiAPI,
.wc_InitRng_IntelRD = wc_InitRng_IntelRD_EfiAPI,
/* RSA */
.wc_InitRsaKey = wc_InitRsaKey_EfiAPI,
.wc_MakeRsaKey = wc_MakeRsaKey_EfiAPI,
.wc_RsaKeyToDer = wc_RsaKeyToDer_EfiAPI,
.wc_FreeRsaKey = wc_FreeRsaKey_EfiAPI,
.wc_RsaEncryptSize = wc_RsaEncryptSize_EfiAPI,
.wc_RsaPrivateKeyDecode = wc_RsaPrivateKeyDecode_EfiAPI,
.wc_RsaPublicKeyDecode = wc_RsaPublicKeyDecode_EfiAPI,
.wc_RsaPrivateDecryptEx = wc_RsaPrivateDecrypt_ex_EfiAPI,
.wc_RsaPrivateDecrypt = wc_RsaPrivateDecrypt_EfiAPI,
.wc_RsaPublicEncrypt = wc_RsaPublicEncrypt_EfiAPI,
.wc_RsaPublicEncryptEx = wc_RsaPublicEncrypt_ex_EfiAPI,
.wc_RsaExportKey = wc_RsaExportKey_EfiAPI,
.wc_RsaCleanup = wc_RsaCleanup_EfiAPI,
.wc_CheckRsaKey = wc_CheckRsaKey_EfiAPI,
.wc_RsaPublicKeyDerSize = wc_RsaPublicKeyDerSize_EfiAPI,
.wc_RsaKeyToPublicDer = wc_RsaKeyToPublicDer_EfiAPI,
.wc_RsaSetRNG = wc_RsaSetRNG_EfiAPI,
/* HMAC */
.wc_HmacSetKey = wc_HmacSetKey_EfiAPI,
.wc_HmacUpdate = wc_HmacUpdate_EfiAPI,
.wc_HmacFinal = wc_HmacFinal_EfiAPI,
/* SHA-1 */
.wc_InitSha = wc_InitSha_EfiAPI,
.wc_ShaUpdate = wc_ShaUpdate_EfiAPI,
.wc_ShaFinal = wc_ShaFinal_EfiAPI,
.wc_ShaFree = wc_ShaFree_EfiAPI,
/* SHA-224 */
.wc_InitSha224 = wc_InitSha224_EfiAPI,
.wc_Sha224Update = wc_Sha224Update_EfiAPI,
.wc_Sha224Final = wc_Sha224Final_EfiAPI,
.wc_Sha224Free = wc_Sha224Free_EfiAPI,
/* SHA-256 */
.wc_InitSha256 = wc_InitSha256_EfiAPI,
.wc_InitSha256_ex = wc_InitSha256_ex_EfiAPI,
.wc_Sha256Update = wc_Sha256Update_EfiAPI,
.wc_Sha256Final = wc_Sha256Final_EfiAPI,
.wc_Sha256Free = wc_Sha256Free_EfiAPI,
/* SHA-384 */
.wc_InitSha384 = wc_InitSha384_EfiAPI,
.wc_Sha384Update = wc_Sha384Update_EfiAPI,
.wc_Sha384Final = wc_Sha384Final_EfiAPI,
.wc_Sha384Free = wc_Sha384Free_EfiAPI,
/* SHA-512 */
.wc_InitSha512 = wc_InitSha512_EfiAPI,
.wc_Sha512Update = wc_Sha512Update_EfiAPI,
.wc_Sha512Final = wc_Sha512Final_EfiAPI,
.wc_Sha512Free = wc_Sha512Free_EfiAPI,
/* SHA-3 */
.wc_InitSha3_256 = wc_InitSha3_256_EfiAPI,
.wc_Sha3_256_Update = wc_Sha3_256_Update_EfiAPI,
.wc_Sha3_256_Final = wc_Sha3_256_Final_EfiAPI,
.wc_Sha3_256_Free = wc_Sha3_256_Free_EfiAPI,
.wc_InitSha3_384 = wc_InitSha3_384_EfiAPI,
.wc_Sha3_384_Update = wc_Sha3_384_Update_EfiAPI,
.wc_Sha3_384_Final = wc_Sha3_384_Final_EfiAPI,
.wc_Sha3_384_Free = wc_Sha3_384_Free_EfiAPI,
.wc_InitSha3_512 = wc_InitSha3_512_EfiAPI,
.wc_Sha3_512_Update = wc_Sha3_512_Update_EfiAPI,
.wc_Sha3_512_Final = wc_Sha3_512_Final_EfiAPI,
.wc_Sha3_512_Free = wc_Sha3_512_Free_EfiAPI,
/* SHAKE */
.wc_InitShake128 = wc_InitShake128_EfiAPI,
.wc_Shake128_Update = wc_Shake128_Update_EfiAPI,
.wc_Shake128_Final = wc_Shake128_Final_EfiAPI,
.wc_Shake128_SqueezeBlocks = wc_Shake128_SqueezeBlocks_EfiAPI,
.wc_Shake128_Free = wc_Shake128_Free_EfiAPI,
.wc_InitShake256 = wc_InitShake256_EfiAPI,
.wc_Shake256_Update = wc_Shake256_Update_EfiAPI,
.wc_Shake256_Final = wc_Shake256_Final_EfiAPI,
.wc_Shake256_SqueezeBlocks = wc_Shake256_SqueezeBlocks_EfiAPI,
.wc_Shake256_Free = wc_Shake256_Free_EfiAPI,
/* ECC */
.wc_ecc_init = wc_ecc_init_EfiAPI,
.wc_ecc_free = wc_ecc_free_EfiAPI,
.wc_ecc_make_key = wc_ecc_make_key_EfiAPI,
.wc_ecc_set_rng = wc_ecc_set_rng_EfiAPI,
.wc_ecc_shared_secret = wc_ecc_shared_secret_EfiAPI,
.wc_ecc_sign_hash = wc_ecc_sign_hash_EfiAPI,
.wc_ecc_verify_hash = wc_ecc_verify_hash_EfiAPI,
.wc_ecc_export_x963 = wc_ecc_export_x963_EfiAPI,
.wc_ecc_import_x963 = wc_ecc_import_x963_EfiAPI,
.wc_EccKeyToDer = wc_EccKeyToDer_EfiAPI,
.wc_EccPublicKeyDecode = wc_EccPublicKeyDecode_EfiAPI,
.wc_EccPrivateKeyDecode = wc_EccPrivateKeyDecode_EfiAPI,
/* DH */
.wc_DhGenerateParams = wc_DhGenerateParams_EfiAPI,
.wc_DhGenerateKeyPair = wc_DhGenerateKeyPair_EfiAPI,
.wc_DhAgree = wc_DhAgree_EfiAPI,
/* ChaCha20 */
.wc_Chacha_SetKey = wc_Chacha_SetKey_EfiAPI,
.wc_Chacha_Process = wc_Chacha_Process_EfiAPI,
/* Poly1305 */
.wc_Poly1305SetKey = wc_Poly1305SetKey_EfiAPI,
.wc_Poly1305Update = wc_Poly1305Update_EfiAPI,
.wc_Poly1305Final = wc_Poly1305Final_EfiAPI,
/* ChaCha20-Poly1305 AEAD */
.wc_ChaCha20Poly1305_Encrypt = wc_ChaCha20Poly1305_Encrypt_EfiAPI,
.wc_ChaCha20Poly1305_Decrypt = wc_ChaCha20Poly1305_Decrypt_EfiAPI,
/* Curve25519 */
.wc_curve25519_init = wc_curve25519_init_EfiAPI,
.wc_curve25519_free = wc_curve25519_free_EfiAPI,
.wc_curve25519_make_key = wc_curve25519_make_key_EfiAPI,
.wc_curve25519_shared_secret = wc_curve25519_shared_secret_EfiAPI,
.wc_curve25519_export_key_raw = wc_curve25519_export_key_raw_EfiAPI,
.wc_curve25519_import_public = wc_curve25519_import_public_EfiAPI,
/* Ed25519 */
.wc_ed25519_init = wc_ed25519_init_EfiAPI,
.wc_ed25519_free = wc_ed25519_free_EfiAPI,
.wc_ed25519_make_key = wc_ed25519_make_key_EfiAPI,
.wc_ed25519_sign_msg = wc_ed25519_sign_msg_EfiAPI,
.wc_ed25519_verify_msg = wc_ed25519_verify_msg_EfiAPI,
.wc_ed25519_export_key = wc_ed25519_export_key_EfiAPI,
.wc_ed25519_import_public = wc_ed25519_import_public_EfiAPI,
/* ML-KEM */
#ifdef WOLFSSL_HAVE_MLKEM
.wc_MlKemKey_Init = wc_MlKemKey_Init_EfiAPI,
.wc_MlKemKey_Free = wc_MlKemKey_Free_EfiAPI,
.wc_MlKemKey_MakeKey = wc_MlKemKey_MakeKey_EfiAPI,
.wc_MlKemKey_CipherTextSize = wc_MlKemKey_CipherTextSize_EfiAPI,
.wc_MlKemKey_SharedSecretSize = wc_MlKemKey_SharedSecretSize_EfiAPI,
.wc_MlKemKey_Encapsulate = wc_MlKemKey_Encapsulate_EfiAPI,
.wc_MlKemKey_Decapsulate = wc_MlKemKey_Decapsulate_EfiAPI,
.wc_MlKemKey_DecodePrivateKey = wc_MlKemKey_DecodePrivateKey_EfiAPI,
.wc_MlKemKey_DecodePublicKey = wc_MlKemKey_DecodePublicKey_EfiAPI,
.wc_MlKemKey_PrivateKeySize = wc_MlKemKey_PrivateKeySize_EfiAPI,
.wc_MlKemKey_PublicKeySize = wc_MlKemKey_PublicKeySize_EfiAPI,
.wc_MlKemKey_EncodePrivateKey = wc_MlKemKey_EncodePrivateKey_EfiAPI,
.wc_MlKemKey_EncodePublicKey = wc_MlKemKey_EncodePublicKey_EfiAPI,
#endif
/* Dilithium */
#ifdef HAVE_DILITHIUM
.wc_dilithium_init = wc_dilithium_init_EfiAPI,
.wc_dilithium_free = wc_dilithium_free_EfiAPI,
.wc_dilithium_set_level = wc_dilithium_set_level_EfiAPI,
.wc_dilithium_make_key = wc_dilithium_make_key_EfiAPI,
.wc_dilithium_sign_msg = wc_dilithium_sign_msg_EfiAPI,
.wc_dilithium_verify_msg = wc_dilithium_verify_msg_EfiAPI,
.wc_dilithium_export_key = wc_dilithium_export_key_EfiAPI,
.wc_dilithium_import_key = wc_dilithium_import_key_EfiAPI,
#endif
/* Falcon */
#ifdef HAVE_FALCON
.wc_falcon_init = wc_falcon_init_EfiAPI,
.wc_falcon_free = wc_falcon_free_EfiAPI,
.wc_falcon_make_key = wc_falcon_make_key_EfiAPI,
.wc_falcon_sign_msg = wc_falcon_sign_msg_EfiAPI,
.wc_falcon_verify_msg = wc_falcon_verify_msg_EfiAPI,
.wc_falcon_export_key = wc_falcon_export_key_EfiAPI,
.wc_falcon_import_key = wc_falcon_import_key_EfiAPI,
#endif
/* CMAC */
.wc_InitCmac = wc_InitCmac_EfiAPI,
.wc_CmacUpdate = wc_CmacUpdate_EfiAPI,
.wc_CmacFinal = wc_CmacFinal_EfiAPI,
/* KDF / PKCS */
.wc_PBKDF2 = wc_PBKDF2_EfiAPI,
.wc_PKCS12_PBKDF = wc_PKCS12_PBKDF_EfiAPI,
.wc_PKCS7_PadData = wc_PKCS7_PadData_EfiAPI,
.wc_HKDF = wc_HKDF_EfiAPI,
/* Logging / Error */
.wolfSSL_Debugging_ON = wolfSSL_Debugging_ON_EfiAPI,
.wolfSSL_SetLoggingCb = wolfSSL_SetLoggingCb_EfiAPI,
.wolfSSL_GetLoggingCb = wolfSSL_GetLoggingCb_EfiAPI,
.wolfSSL_Debugging_OFF = wolfSSL_Debugging_OFF_EfiAPI,
.wc_GetErrorString = wc_GetErrorString_EfiAPI,
.wc_ErrorString = wc_ErrorString_EfiAPI,
};
EFI_STATUS EFIAPI efi_main(EFI_HANDLE ImageHandle, EFI_SYSTEM_TABLE *SystemTable)
{
EFI_LOADED_IMAGE *loaded_image = NULL;
volatile int halted = 1;
EFI_STATUS status;
InitializeLib(ImageHandle, SystemTable);
wolfSSL_Debugging_ON();
wolfSSL_SetLoggingCb(logging_cb);
#ifdef UEFI_HW_ACCEL
/* hw build requires AES-NI; exit gracefully if absent so startup.nsh can
* fall back to the nohw driver. */
{
cpuid_flags_t cpu_flags = 0;
cpuid_get_flags_ex(&cpu_flags);
if (!IS_INTEL_AESNI(cpu_flags)) {
Print(L"Error: hw driver requires AES-NI support (not detected)\n");
Print(L"Please load libwolfcrypt-nohw.efi instead\n");
return EFI_UNSUPPORTED;
}
Print(L"CPU AES-NI support detected, loading hw driver\n");
}
#endif
status = uefi_call_wrapper(SystemTable->BootServices->HandleProtocol,
3,
ImageHandle,
&LoadedImageProtocol,
(void **)&loaded_image);
Print(L"wolfCrypt image loaded.\n");
if (loaded_image != NULL) {
Print(L"Image size: 0x%lx\n", loaded_image->ImageSize);
Print(L"Image base: 0x%lx\n", loaded_image->ImageBase);
}
Print(L"status: 0x%lx\n", status);
#if WAIT_FOR_GDB
Print(L"Debugging is enabled. Type the following in gdb to continue\n");
if (loaded_image != NULL) {
Print(L"symbol-file libwolfcrypt.elf -o 0x%lx\n", loaded_image->ImageBase);
}
Print(L"set halted = 0\n");
while (halted) {
}
#else
WC_UNUSED(halted);
#endif
/* Runtime relocation guard for API pointers.
* If pointers are already relocated by the EFI loader we leave them as-is.
* If pointers still look unrelocated, apply image-base adjustment once. */
{
UINTN *wc_api_ptr = (UINTN *)&g_wolfcrypt_api;
UINTN wc_api_size = (sizeof(g_wolfcrypt_api) / sizeof(UINTN));
UINTN image_base = (UINTN)loaded_image->ImageBase;
UINTN relocated_count = 0;
UINTN unrelocated_count = 0;
int apply_fixup = 0;
int i;
for (i = 1; i < (int)wc_api_size; i++) {
UINTN p = wc_api_ptr[i];
if (p == 0) {
continue;
}
if (p >= image_base) {
relocated_count++;
}
else {
unrelocated_count++;
}
}
/* If most non-zero API entries are still below ImageBase, treat the
* table as unrelocated and apply image-base adjustment. */
apply_fixup = (unrelocated_count > relocated_count);
if (apply_fixup) {
for (i = 1; i < (int)wc_api_size; i++) {
if (wc_api_ptr[i] != 0 && wc_api_ptr[i] < image_base) {
wc_api_ptr[i] += image_base;
}
}
Print(L"wolfCrypt API symbols adjusted to image base\n");
}
else {
Print(L"wolfCrypt API symbols verified at correct location\n");
}
}
status = uefi_call_wrapper(BS->InstallProtocolInterface, 4,
&g_wolfcrypt_handle,
&g_wolfcrypt_protocol_guid,
EFI_NATIVE_INTERFACE,
&g_wolfcrypt_api);
Print(L"InstallProtocolInterface status: 0x%lx\n", status);
if (EFI_ERROR(status)) {
Print(L"ERROR: Failed to install wolfCrypt protocol\n");
return status;
}
Print(L"wolfCrypt driver loaded successfully (version 0x%08x)\n",
g_wolfcrypt_api.Version);
return EFI_SUCCESS;
}

1362
uefi-library/src/test_app.c 100644
View File

File diff suppressed because it is too large Load Diff

1651
uefi-library/src/utility_wolf.c 100644
View File

File diff suppressed because it is too large Load Diff

3
uefi-library/startup-single.nsh 100644
View File

@ -0,0 +1,3 @@
fs0:
load libwolfcrypt.efi
test.efi

9
uefi-library/startup.nsh 100644
View File

@ -0,0 +1,9 @@
fs0:
load libwolfcrypt.efi
if %lasterror% == 0 then
goto loaded
endif
echo Falling back to software-only driver...
load libwolfcrypt-nohw.efi
:loaded
test.efi

425
uefi-library/user_settings.h 100644
View File

@ -0,0 +1,425 @@
#ifndef USER_H
#define USER_H
#include <stddef.h>
#include <utility_wolf.h>
extern int uefi_snprintf_wolfssl(char* buffer, size_t n, const char* format, ...);
#define XSNPRINTF uefi_snprintf_wolfssl
extern int uefi_printf_wolfssl(const char*, ...);
#define XPRINTF uefi_printf_wolfssl
extern void* uefi_memcpy_wolfssl(void* dest, const void* src, size_t len);
#define XMEMCPY uefi_memcpy_wolfssl
extern void* uefi_memset_wolfssl(void* str, int c, size_t n);
#define XMEMSET uefi_memset_wolfssl
extern int uefi_strncmp_wolfssl(const char* s1, const char* s2, size_t n);
#define XSTRNCMP uefi_strncmp_wolfssl
#define XFFLUSH uefi_wolfssl_fflush
#define XMALLOC XMALLOC
#define XFREE XFREE
#define XREALLOC XREALLOC
#define SINGLE_THREADED
#define NO_FILESYSTEM
#define STRING_USER
#define NO_DSA
#define NO_MD4
#define WOLFSSL_AES_CFB
#define HAVE_PKCS7
#define WC_RNG_SEED_CB
#undef HAVE_INTEL_RDRAND
#undef HAVE_INTEL_RDSEED
#undef USE_INTEL_SPEEDUP
#undef WOLFSSL_ASM
#define WOLFSSL_SHA3
#define WC_SHA3_NO_ASM
#define WC_MLKEM_NO_ASM
#define WOLFSSL_HAVE_MLKEM
#define HAVE_PBKDF2
/* ChaCha20 / Poly1305 */
#define HAVE_CHACHA
#define HAVE_POLY1305
#define HAVE_ONE_TIME_AUTH
/* Curve25519 / Ed25519 */
#define HAVE_CURVE25519
#define HAVE_ED25519
/* Curve448 / Ed448 */
#define HAVE_CURVE448
#define HAVE_ED448
/* Post-quantum: Dilithium (ML-DSA) — native wolfSSL implementation */
#define HAVE_DILITHIUM
#define WOLFSSL_WC_DILITHIUM
/* All levels enabled by default (use WOLFSSL_NO_ML_DSA_44/65/87 to disable) */
/* Falcon requires liboqs; omit unless liboqs is available */
/* #define HAVE_FALCON */
/* SHA-224 */
#define WOLFSSL_SHA224
#ifdef WOLFSSL_HAVE_MLKEM
#define WOLFSSL_MLKEM_KYBER
#define WOLFSSL_WC_MLKEM
#define WC_MLKEM_NO_ASM
#define WC_SHA3_NO_ASM
#ifndef WOLFSSL_SHAKE128
#define WOLFSSL_SHAKE128
#endif
#ifndef WOLFSSL_SHAKE256
#define WOLFSSL_SHAKE256
#endif
#else
#define WOLFSSL_NO_SHAKE128
#define WOLFSSL_NO_SHAKE256
#endif
#define XPRINTF uefi_printf_wolfssl
#define XFPRINTF uefi_fprintf_wolfssl
#define XSNPRINTF uefi_snprintf_wolfssl
#define XVSNPRINTF uefi_vsnprintf_wolfssl
#define XSTRNCMP uefi_strncmp_wolfssl
#define XSTRCMP uefi_strcmp_wolfssl
#define XSTRLEN uefi_strlen_wolfssl
#define XSTRNCPY uefi_strncpy_wolfssl
#define XSTRCASECMP uefi_strcasecmp_wolfssl
#define XSTRNCASECMP uefi_strncasecmp_wolfssl
#define XSTRNSTR uefi_strnstr_wolfssl
#define XSTRNCAT uefi_strncat_wolfssl
#define XMEMCMP uefi_memcmp_wolfssl
#define XMEMMOVE uefi_memmove_wolfssl
/* Only Matter for the test */
#define CERT_PREFIX "\\" /* Assume everything needs is at the root of device */
#define CERT_PATH_SEP "\\"
/* Debugging UEFI (for example code only not wolfSSL proper) */
#if 1
#undef UEFI_VERBOSE_DEBUG
#define UEFI_VERBOSE_DEBUG
#endif
/* AES-NI hardware acceleration (hw build only) */
#ifdef UEFI_HW_ACCEL
#define WOLFSSL_AESNI
#endif
/* ------------------------------------------------------------------------- */
/* Platform */
/* ------------------------------------------------------------------------- */
#undef WOLFSSL_GENERAL_ALIGNMENT
#define WOLFSSL_GENERAL_ALIGNMENT 4
#if 1
#undef SINGLE_THREADED
#define SINGLE_THREADED
#else
#define HAVE_THREAD_LS
#endif
#ifdef SINGLE_THREADED
#undef NO_THREAD_LS
#define NO_THREAD_LS
#endif
#undef WOLFSSL_USER_IO
#define WOLFSSL_USER_IO
#undef WOLFSSL_SMALL_STACK
//#define WOLFSSL_SMALL_STACK
/* ------------------------------------------------------------------------- */
/* Math Configuration */
/* ------------------------------------------------------------------------- */
#undef SIZEOF_LONG_LONG
#define SIZEOF_LONG_LONG 8
#undef USE_FAST_MATH
#if 1
#define USE_FAST_MATH
#define FP_MAX_BITS 16384
#undef TFM_TIMING_RESISTANT
#define TFM_TIMING_RESISTANT
#else
#define WOLFSSL_SP_MATH_ALL
#define WOLFSSL_SP_INT_NEGATIVE
#define WOLFSSL_SP_SMALL /* use smaller version of code */
/* Maximum math bits (largest supported key bits) */
#undef SP_INT_BITS
#define SP_INT_BITS 8192
#endif
/* ------------------------------------------------------------------------- */
/* Crypto */
/* ------------------------------------------------------------------------- */
/* RSA */
#undef NO_RSA
#if 1
/* half as much memory but twice as slow */
#undef RSA_LOW_MEM
#define RSA_LOW_MEM
/* Enables blinding mode, to prevent timing attacks */
#if 1
#undef WC_RSA_BLINDING
#define WC_RSA_BLINDING
#else
#undef WC_NO_HARDEN
#define WC_NO_HARDEN
#endif
/* RSA PSS Support */
#if 1
#undef WC_RSA_PSS
#define WC_RSA_PSS
#undef WOLFSSL_PSS_LONG_SALT
#define WOLFSSL_PSS_LONG_SALT
#undef WOLFSSL_PSS_SALT_LEN_DISCOVER
#define WOLFSSL_PSS_SALT_LEN_DISCOVER
#endif
#if 1
#define WC_RSA_NO_PADDING
#endif
#define WOLFSSL_KEY_GEN
#define WOLFSSL_RSA_KEY_CHECK
#else
#define NO_RSA
#endif
/* ECC */
#undef HAVE_ECC
#if 1
#define HAVE_ECC
/* Manually define enabled curves */
#undef ECC_USER_CURVES
#define ECC_USER_CURVES
#ifdef ECC_USER_CURVES
/* Manual Curve Selection */
#define HAVE_ECC192
#define HAVE_ECC224
#undef NO_ECC256
#define HAVE_ECC256
#define HAVE_ECC384
#define HAVE_ECC521
#endif
/* Fixed point cache (speeds repeated operations against same private key) */
#undef FP_ECC
//#define FP_ECC
#ifdef FP_ECC
/* Bits / Entries */
#undef FP_ENTRIES
#define FP_ENTRIES 2
#undef FP_LUT
#define FP_LUT 4
#endif
/* Optional ECC calculation method */
/* Note: doubles heap usage, but slightly faster */
#undef ECC_SHAMIR
//#define ECC_SHAMIR
/* Reduces heap usage, but slower */
#undef ECC_TIMING_RESISTANT
#define ECC_TIMING_RESISTANT
/* Use alternate ECC size for ECC math */
#ifdef USE_FAST_MATH
#undef ALT_ECC_SIZE
#define ALT_ECC_SIZE
/* Speedups specific to curve */
#ifndef NO_ECC256
#undef TFM_ECC256
#define TFM_ECC256
#endif
#endif
#endif
/* DH */
#undef NO_DH
#if 1
#define HAVE_DH
/* Use table for DH instead of -lm (math) lib dependency */
#if 1
#define HAVE_DH_DEFAULT_PARAMS
#define WOLFSSL_DH_CONST
#define HAVE_FFDHE_2048
#define HAVE_FFDHE_3072
#define HAVE_FFDHE_4096
#define HAVE_FFDHE_6144
#define HAVE_FFDHE_8192
#endif
#else
#define NO_DH
#endif
/* AES */
#undef NO_AES
#if 1
#undef HAVE_AES_CBC
#define HAVE_AES_CBC
#undef HAVE_AESGCM
#define HAVE_AESGCM
/* GCM Method (slowest to fastest): GCM_SMALL, GCM_WORD32, GCM_TABLE or
* GCM_TABLE_4BIT */
#define GCM_TABLE_4BIT
#undef WOLFSSL_AES_DIRECT
#define WOLFSSL_AES_DIRECT
#undef HAVE_AES_ECB
#define HAVE_AES_ECB
#undef WOLFSSL_AES_COUNTER
#define WOLFSSL_AES_COUNTER
#undef HAVE_AESCCM
#define HAVE_AESCCM
#undef WOLFSSL_AES_OFB
#define WOLFSSL_AES_OFB
#else
#define NO_AES
#endif
#undef NO_DES3
#define NO_DES3
/* ------------------------------------------------------------------------- */
/* Hashing */
/* ------------------------------------------------------------------------- */
/* Sha */
#undef NO_SHA
#if 1
/* 1k smaller, but 25% slower */
// #define USE_SLOW_SHA
#else
#define NO_SHA
#endif
/* Sha256 */
#undef NO_SHA256
#if 1
/* Sha224 */
#if 1
#define WOLFSSL_SHA224
#endif
#else
#define NO_SHA256
#endif
/* Sha512 */
#undef WOLFSSL_SHA512
#if 1
#define WOLFSSL_SHA512
/* Sha384 */
#undef WOLFSSL_SHA384
#if 1
#define WOLFSSL_SHA384
#endif
#endif
/* MD5 */
#undef NO_MD5
#define NO_MD5
/* HKDF / PRF */
#undef HAVE_HKDF
#if 1
#define HAVE_HKDF
#define WOLFSSL_HAVE_PRF
#endif
/* CMAC */
#undef WOLFSSL_CMAC
#if 1
#define WOLFSSL_CMAC
#endif
/* ------------------------------------------------------------------------- */
/* RNG */
/* ------------------------------------------------------------------------- */
/* Choose RNG method */
#if 1
/* Use built-in P-RNG (SHA256 based) with HW RNG */
/* P-RNG + HW RNG (P-RNG is ~8K) */
#undef HAVE_HASHDRBG
#define HAVE_HASHDRBG
#else
#undef WC_NO_HASHDRBG
#define WC_NO_HASHDRBG
#endif
/* Bypass P-RNG and use only HW RNG */
#if 1
#define CUSTOM_RAND_TYPE unsigned int
extern int uefi_random_gen(char* output, unsigned int sz);
#undef CUSTOM_RAND_GENERATE_SEED
#define CUSTOM_RAND_GENERATE_SEED uefi_random_gen
#endif
/* ------------------------------------------------------------------------- */
/* Debugging */
/* ------------------------------------------------------------------------- */
#undef DEBUG_WOLFSSL
#undef NO_ERROR_STRINGS
#if 0
#define DEBUG_WOLFSSL
#else
#if 0
#define NO_ERROR_STRINGS
#endif
#endif
/* ------------------------------------------------------------------------- */
/* Enable features */
/* ------------------------------------------------------------------------- */
#define XMALLOC_USER
#define WOLFSSL_IGNORE_FILE_WARN
/* ------------------------------------------------------------------------- */
/* Disable features */
/* ------------------------------------------------------------------------- */
#define WOLFCRYPT_ONLY
#define NO_ASN_TIME
#define NO_OLD_TLS
#define NO_INLINE
#define NO_SIG_WRAPPER
#define NO_CRYPT_BENCHMARK
#define NO_MAIN_DRIVER
#endif /* USER_H */

113
uefi-library/utility_wolf.h 100644
View File

@ -0,0 +1,113 @@
#ifndef UTILITY_WOLF_H
#define UTILITY_WOLF_H
#include <efi.h>
#include <efilib.h>
#include <stdarg.h>
#include <string.h>
#include <stdio.h>
#include <uchar.h>
#include <dirent.h>
#include <sys/types.h>
#include <sys/stat.h>
/* Custom Types */
typedef enum {
READ,
WRITE,
READWRITE,
OPENDIR,
NONE,
NULL_ARG,
} FILE_OPS;
/* UEFI RNG */
int uefi_random_gen(char* output, unsigned int sz);
/* Logging Functions */
/* These use AsciiPrint and AsciiVSprint and simply wrap to produce a result */
/* as an int instead of a unsigned int */
int uefi_printf_wolfssl(const char* msg, ...);
int uefi_snprintf_wolfssl(char* buffer, size_t n, const char* format, ...);
int uefi_vsnprintf_wolfssl(char* buffer, size_t size, const char* format,
va_list args);
int uefi_vprintf_wolfssl(const char* msg, va_list args);
int uefi_fprintf_wolfssl(FILE* stream, const char* format, ...);
int uefi_wolfssl_fflush(FILE* stream);
/* Memory Allocation Functions */
void* uefi_malloc_wolfssl(size_t n);
void* uefi_realloc_wolfssl(void* ptr, size_t n);
void uefi_free_wolfssl(void* ptr);
void* XMALLOC(size_t n, void* heap, int type);
void* XREALLOC(void *p, size_t n, void* heap, int type);
void XFREE(void *p, void* heap, int type);
void* uefi_memcpy_wolfssl(void* dest, const void* src, size_t len);
void* uefi_memset_wolfssl(void* str, int c, size_t n);
int uefi_memcmp_wolfssl(const void* s1, const void* s2, size_t n);
void *uefi_memmove_wolfssl(void* dest, const void* src, size_t n);
char* uefi_strncpy_wolfssl(char* dest, const char* src, size_t len);
int uefi_strncmp_wolfssl(const char* s1, const char* s2, size_t n);
int uefi_strcmp_wolfssl(const char* s1, const char* s2);
int uefi_strlen_wolfssl(const char *s);
int uefi_strcasecmp_wolfssl(const char* s1, const char* s2);
int uefi_strncasecmp_wolfssl(const char* s1, const char* s2, size_t n);
char *uefi_strncat_wolfssl(char* dest, const char* src, size_t len);
char *uefi_strnstr_wolfssl(const char* haystack, const char* needle, size_t len);
/* Utility Functions */
unsigned long uefi_time_wolfssl(unsigned long* timer);
unsigned long convertToEpochUefi(EFI_TIME ts);
int uefi_timeStruct_wolfssl(EFI_TIME* timeStruct);
int parseAndReplace(const char* msg, char* temp, const char* search, const char* replace);
void char8_to_char16(const char* str8, char16_t* str16);
void char8_to_char16_ex(const char* str8, char16_t* str16, int n);
unsigned int calculateBufferSize(const char* msg, va_list args);
/* Logging Functions */
void logging_cb(const int logLevel, const char *const logMessage);
/* Not Implemented Functions */
int create(char *filename, mode_t mode);
int open (const char *__file, int __oflag);
int close(int __fd);
/* Needed for USER IO functions */
/* Functional */
FILE_OPS getFileOperation(const char* mode);
EFI_FILE_HANDLE getVolume(void);
uint64_t fileSize(EFI_FILE_HANDLE FileHandle);
/* TODO */
ssize_t read(int fd, void *buf, size_t cnt);
ssize_t write(int fd, const void* buf, size_t cnt);
FILE* fopen(const char* filename, const char* mode);
int fclose(FILE* stream);
int fseek(FILE* stream, long offset, int whence);
long ftell(FILE* stream);
size_t fread(void* ptr, size_t size, size_t count, FILE* stream);
size_t fwrite(const void* ptr, size_t size, size_t count, FILE* stream);
DIR* opendir(const char* name);
struct dirent* readdir(DIR* dirp);
int closedir(DIR* dirp);
int stat(const char* path, struct stat* buf);
void uefi_strerr(const char* message);
static int write_integer(FILE* stream, int value);
static int write_string(FILE* stream, const char* str);
unsigned long long current_time(int reset);
#endif

682
uefi-library/wolfcrypt_api.h 100644
View File

@ -0,0 +1,682 @@
#ifndef WOLFCRYPT_API_H_INCLUDED
#define WOLFCRYPT_API_H_INCLUDED
#include <efi.h>
#include <efilib.h>
#include <wolfssl/wolfcrypt/settings.h>
#include <wolfssl/wolfcrypt/aes.h>
#include <wolfssl/wolfcrypt/random.h>
#include <wolfssl/wolfcrypt/rsa.h>
#include <wolfssl/wolfcrypt/hmac.h>
#include <wolfssl/wolfcrypt/pwdbased.h>
#include <wolfssl/wolfcrypt/pkcs7.h>
#include <wolfssl/wolfcrypt/sha.h>
#include <wolfssl/wolfcrypt/sha256.h>
#include <wolfssl/wolfcrypt/sha512.h>
#include <wolfssl/wolfcrypt/sha3.h>
#include <wolfssl/wolfcrypt/logging.h>
#include <wolfssl/wolfcrypt/error-crypt.h>
#include <wolfssl/wolfcrypt/asn_public.h>
#include <wolfssl/wolfcrypt/mlkem.h>
#include <wolfssl/wolfcrypt/ecc.h>
#include <wolfssl/wolfcrypt/dh.h>
#include <wolfssl/wolfcrypt/chacha.h>
#include <wolfssl/wolfcrypt/poly1305.h>
#include <wolfssl/wolfcrypt/chacha20_poly1305.h>
#include <wolfssl/wolfcrypt/curve25519.h>
#include <wolfssl/wolfcrypt/ed25519.h>
#include <wolfssl/wolfcrypt/cmac.h>
#ifdef HAVE_DILITHIUM
#include <wolfssl/wolfcrypt/dilithium.h>
#endif
#ifdef HAVE_FALCON
#include <wolfssl/wolfcrypt/falcon.h>
#endif
/* UUID: generated via uuidgen -r */
/* UUID: a3f2c1d7-8e4b-4f9a-b6c3-1d5e7f0a2b48 */
#define WOLFCRYPT_PROTOCOL_GUID \
{ 0xa3f2c1d7, 0x8e4b, 0x4f9a, { 0xb6, 0xc3, 0x1d, 0x5e, 0x7f, 0x0a, 0x2b, 0x48 } }
#ifndef WC_RNG_SEED_CB
typedef int (*wc_RngSeed_Cb)(OS_Seed* os, byte* seed, word32 sz);
#endif
#ifndef WOLFSSL_HAVE_MLKEM
typedef struct MlKemKey MlKemKey;
#endif
/* ------------------------------------------------------------------ */
/* AES */
/* ------------------------------------------------------------------ */
typedef int (EFIAPI *wc_AesInit_API)(Aes* aes, void* heap, int devId);
typedef int (EFIAPI *wc_AesSetKey_API)(Aes* aes, const byte* key, word32 len,
const byte* iv, int dir);
typedef int (EFIAPI *wc_AesEcbEncrypt_API)(Aes* aes, byte* out, const byte* in,
word32 sz);
typedef int (EFIAPI *wc_AesEcbDecrypt_API)(Aes* aes, byte* out, const byte* in,
word32 sz);
typedef int (EFIAPI *wc_AesCbcEncrypt_API)(Aes* aes, byte* out, const byte* in,
word32 sz);
typedef int (EFIAPI *wc_AesCbcDecrypt_API)(Aes* aes, byte* out, const byte* in,
word32 sz);
typedef int (EFIAPI *wc_AesCfbEncrypt_API)(Aes* aes, byte* out, const byte* in,
word32 sz);
typedef int (EFIAPI *wc_AesCfbDecrypt_API)(Aes* aes, byte* out, const byte* in,
word32 sz);
typedef int (EFIAPI *wc_AesSetIV_API)(Aes* aes, const byte* iv);
typedef void (EFIAPI *wc_AesFree_API)(Aes* aes);
typedef int (EFIAPI *wc_AesGcmSetKey_API)(Aes* aes, const byte* key, word32 len);
typedef int (EFIAPI *wc_AesGcmEncrypt_API)(Aes* aes, byte* out, const byte* in,
word32 sz, const byte* iv, word32 ivSz,
byte* authTag, word32 authTagSz,
const byte* authIn, word32 authInSz);
typedef int (EFIAPI *wc_AesGcmDecrypt_API)(Aes* aes, byte* out, const byte* in,
word32 sz, const byte* iv, word32 ivSz,
const byte* authTag, word32 authTagSz,
const byte* authIn, word32 authInSz);
typedef int (EFIAPI *wc_AesCcmSetKey_API)(Aes* aes, const byte* key, word32 keySz);
typedef int (EFIAPI *wc_AesCcmEncrypt_API)(Aes* aes, byte* out, const byte* in,
word32 inSz, const byte* nonce, word32 nonceSz,
byte* authTag, word32 authTagSz,
const byte* authIn, word32 authInSz);
typedef int (EFIAPI *wc_AesCcmDecrypt_API)(Aes* aes, byte* out, const byte* in,
word32 inSz, const byte* nonce, word32 nonceSz,
const byte* authTag, word32 authTagSz,
const byte* authIn, word32 authInSz);
typedef int (EFIAPI *wc_AesCtrEncrypt_API)(Aes* aes, byte* out, const byte* in,
word32 sz);
typedef int (EFIAPI *wc_AesOfbEncrypt_API)(Aes* aes, byte* out, const byte* in,
word32 sz);
/* ------------------------------------------------------------------ */
/* RNG */
/* ------------------------------------------------------------------ */
typedef int (EFIAPI *wc_InitRng_API)(WC_RNG* rng);
typedef int (EFIAPI *wc_FreeRng_API)(WC_RNG* rng);
typedef int (EFIAPI *wc_RNG_GenerateBlock_API)(WC_RNG* rng, byte* output,
word32 sz);
typedef int (EFIAPI *wc_RNG_GenerateByte_API)(WC_RNG* rng, byte* b);
typedef int (EFIAPI *wc_SetSeed_Cb_API)(wc_RngSeed_Cb cb);
typedef int (EFIAPI *wc_RNG_TestSeed_API)(const byte* seed, word32 seedSz);
typedef int (EFIAPI *wc_GenerateSeed_IntelRD_API)(OS_Seed* os, byte* output,
word32 sz);
typedef int (EFIAPI *wc_GenerateSeed_API)(OS_Seed* os, byte* output,
word32 sz);
typedef int (EFIAPI *wc_GenerateRand_IntelRD_API)(OS_Seed* os, byte* output,
word32 sz);
typedef void (EFIAPI *wc_InitRng_IntelRD_API)(void);
/* ------------------------------------------------------------------ */
/* RSA */
/* ------------------------------------------------------------------ */
typedef int (EFIAPI *wc_InitRsaKey_API)(RsaKey* key, void* heap);
typedef int (EFIAPI *wc_MakeRsaKey_API)(RsaKey* key, int size, long e,
WC_RNG* rng);
typedef int (EFIAPI *wc_RsaKeyToDer_API)(RsaKey* key, byte* output,
word32 inLen);
typedef int (EFIAPI *wc_FreeRsaKey_API)(RsaKey* key);
typedef int (EFIAPI *wc_RsaEncryptSize_API)(const RsaKey* key);
typedef int (EFIAPI *wc_RsaPrivateKeyDecode_API)(const byte* input,
word32* inOutIdx,
RsaKey* key, word32 inSz);
typedef int (EFIAPI *wc_RsaPublicKeyDecode_API)(const byte* input,
word32* inOutIdx,
RsaKey* key, word32 inSz);
typedef int (EFIAPI *wc_RsaPrivateDecryptEx_API)(const byte* in, word32 inLen,
byte* out, word32 outLen,
RsaKey* key, int type,
enum wc_HashType hash, int mgf,
byte* label, word32 labelSz);
typedef int (EFIAPI *wc_RsaPrivateDecrypt_API)(const byte* in, word32 inLen,
byte* out, word32 outLen,
RsaKey* key);
typedef int (EFIAPI *wc_RsaPublicEncrypt_API)(const byte* in, word32 inLen,
byte* out, word32 outLen,
RsaKey* key, WC_RNG* rng);
typedef int (EFIAPI *wc_RsaPublicEncryptEx_API)(const byte* in, word32 inLen,
byte* out, word32 outLen,
RsaKey* key, WC_RNG* rng,
int type, enum wc_HashType hash,
int mgf, byte* label,
word32 labelSz);
typedef int (EFIAPI *wc_RsaExportKey_API)(RsaKey* key,
byte* e, word32* eSz,
byte* n, word32* nSz,
byte* d, word32* dSz,
byte* p, word32* pSz,
byte* q, word32* qSz);
typedef void (EFIAPI *wc_RsaCleanup_API)(RsaKey* key);
typedef int (EFIAPI *wc_CheckRsaKey_API)(RsaKey* key);
typedef int (EFIAPI *wc_RsaPublicKeyDerSize_API)(RsaKey* key, int withHeader);
typedef int (EFIAPI *wc_RsaKeyToPublicDer_API)(RsaKey* key, byte* output,
word32 inLen);
typedef int (EFIAPI *wc_RsaSetRNG_API)(RsaKey* key, WC_RNG* rng);
/* ------------------------------------------------------------------ */
/* HMAC */
/* ------------------------------------------------------------------ */
typedef int (EFIAPI *wc_HmacSetKey_API)(Hmac* hmac, int type, const byte* key,
word32 length);
typedef int (EFIAPI *wc_HmacUpdate_API)(Hmac* hmac, const byte* msg,
word32 length);
typedef int (EFIAPI *wc_HmacFinal_API)(Hmac* hmac, byte* hash);
/* ------------------------------------------------------------------ */
/* SHA-1 */
/* ------------------------------------------------------------------ */
typedef int (EFIAPI *wc_InitSha_API)(wc_Sha* sha);
typedef int (EFIAPI *wc_ShaUpdate_API)(wc_Sha* sha, const byte* data,
word32 len);
typedef int (EFIAPI *wc_ShaFinal_API)(wc_Sha* sha, byte* hash);
typedef void (EFIAPI *wc_ShaFree_API)(wc_Sha* sha);
/* ------------------------------------------------------------------ */
/* SHA-256 / SHA-224 */
/* ------------------------------------------------------------------ */
typedef int (EFIAPI *wc_InitSha256_API)(wc_Sha256* sha);
typedef int (EFIAPI *wc_InitSha256_ex_API)(wc_Sha256* sha, void* heap,
int devId);
typedef int (EFIAPI *wc_Sha256Update_API)(wc_Sha256* sha, const byte* data,
word32 len);
typedef int (EFIAPI *wc_Sha256Final_API)(wc_Sha256* sha256, byte* hash);
typedef void (EFIAPI *wc_Sha256Free_API)(wc_Sha256* sha256);
/* SHA-224 reuses wc_Sha256 struct with different init */
typedef int (EFIAPI *wc_InitSha224_API)(wc_Sha224* sha);
typedef int (EFIAPI *wc_Sha224Update_API)(wc_Sha224* sha, const byte* data,
word32 len);
typedef int (EFIAPI *wc_Sha224Final_API)(wc_Sha224* sha, byte* hash);
typedef void (EFIAPI *wc_Sha224Free_API)(wc_Sha224* sha);
/* ------------------------------------------------------------------ */
/* SHA-384 / SHA-512 */
/* ------------------------------------------------------------------ */
typedef int (EFIAPI *wc_InitSha384_API)(wc_Sha384* sha);
typedef int (EFIAPI *wc_Sha384Update_API)(wc_Sha384* sha, const byte* data,
word32 len);
typedef int (EFIAPI *wc_Sha384Final_API)(wc_Sha384* sha, byte* hash);
typedef void (EFIAPI *wc_Sha384Free_API)(wc_Sha384* sha);
typedef int (EFIAPI *wc_InitSha512_API)(wc_Sha512* sha);
typedef int (EFIAPI *wc_Sha512Update_API)(wc_Sha512* sha, const byte* data,
word32 len);
typedef int (EFIAPI *wc_Sha512Final_API)(wc_Sha512* sha, byte* hash);
typedef void (EFIAPI *wc_Sha512Free_API)(wc_Sha512* sha);
/* ------------------------------------------------------------------ */
/* SHA-3 (256/384/512) and SHAKE128/256 */
/* ------------------------------------------------------------------ */
typedef int (EFIAPI *wc_InitSha3_256_API)(wc_Sha3* sha, void* heap, int devId);
typedef int (EFIAPI *wc_Sha3_256_Update_API)(wc_Sha3* sha, const byte* data, word32 len);
typedef int (EFIAPI *wc_Sha3_256_Final_API)(wc_Sha3* sha, byte* hash);
typedef void (EFIAPI *wc_Sha3_256_Free_API)(wc_Sha3* sha);
typedef int (EFIAPI *wc_InitSha3_384_API)(wc_Sha3* sha, void* heap, int devId);
typedef int (EFIAPI *wc_Sha3_384_Update_API)(wc_Sha3* sha, const byte* data, word32 len);
typedef int (EFIAPI *wc_Sha3_384_Final_API)(wc_Sha3* sha, byte* hash);
typedef void (EFIAPI *wc_Sha3_384_Free_API)(wc_Sha3* sha);
typedef int (EFIAPI *wc_InitSha3_512_API)(wc_Sha3* sha, void* heap, int devId);
typedef int (EFIAPI *wc_Sha3_512_Update_API)(wc_Sha3* sha, const byte* data, word32 len);
typedef int (EFIAPI *wc_Sha3_512_Final_API)(wc_Sha3* sha, byte* hash);
typedef void (EFIAPI *wc_Sha3_512_Free_API)(wc_Sha3* sha);
typedef int (EFIAPI *wc_InitShake128_API)(wc_Shake* shake, void* heap, int devId);
typedef int (EFIAPI *wc_Shake128_Update_API)(wc_Shake* shake, const byte* data, word32 len);
typedef int (EFIAPI *wc_Shake128_Final_API)(wc_Shake* shake, byte* hash, word32 hashLen);
typedef int (EFIAPI *wc_Shake128_SqueezeBlocks_API)(wc_Shake* shake, byte* out, word32 blockCnt);
typedef void (EFIAPI *wc_Shake128_Free_API)(wc_Shake* shake);
typedef int (EFIAPI *wc_InitShake256_API)(wc_Shake* shake, void* heap, int devId);
typedef int (EFIAPI *wc_Shake256_Update_API)(wc_Shake* shake, const byte* data, word32 len);
typedef int (EFIAPI *wc_Shake256_Final_API)(wc_Shake* shake, byte* hash, word32 hashLen);
typedef int (EFIAPI *wc_Shake256_SqueezeBlocks_API)(wc_Shake* shake, byte* out, word32 blockCnt);
typedef void (EFIAPI *wc_Shake256_Free_API)(wc_Shake* shake);
/* ------------------------------------------------------------------ */
/* ECC */
/* ------------------------------------------------------------------ */
typedef int (EFIAPI *wc_ecc_init_API)(ecc_key* key);
typedef void (EFIAPI *wc_ecc_free_API)(ecc_key* key);
typedef int (EFIAPI *wc_ecc_make_key_API)(WC_RNG* rng, int keysize, ecc_key* key);
typedef int (EFIAPI *wc_ecc_set_rng_API)(ecc_key* key, WC_RNG* rng);
typedef int (EFIAPI *wc_ecc_shared_secret_API)(ecc_key* priv, ecc_key* pub,
byte* out, word32* outlen);
typedef int (EFIAPI *wc_ecc_sign_hash_API)(const byte* in, word32 inlen,
byte* out, word32* outlen,
WC_RNG* rng, ecc_key* key);
typedef int (EFIAPI *wc_ecc_verify_hash_API)(const byte* sig, word32 siglen,
const byte* hash, word32 hashlen,
int* stat, ecc_key* key);
typedef int (EFIAPI *wc_ecc_export_x963_API)(ecc_key* key, byte* out, word32* outLen);
typedef int (EFIAPI *wc_ecc_import_x963_API)(const byte* in, word32 inLen,
ecc_key* key);
typedef int (EFIAPI *wc_EccKeyToDer_API)(ecc_key* key, byte* output, word32 inLen);
typedef int (EFIAPI *wc_EccPublicKeyDecode_API)(const byte* input, word32* inOutIdx,
ecc_key* key, word32 inSz);
typedef int (EFIAPI *wc_EccPrivateKeyDecode_API)(const byte* input, word32* inOutIdx,
ecc_key* key, word32 inSz);
/* ------------------------------------------------------------------ */
/* DH */
/* ------------------------------------------------------------------ */
typedef int (EFIAPI *wc_DhGenerateParams_API)(WC_RNG* rng, int modSz, DhKey* key);
typedef int (EFIAPI *wc_DhGenerateKeyPair_API)(DhKey* key, WC_RNG* rng,
byte* priv, word32* privSz,
byte* pub, word32* pubSz);
typedef int (EFIAPI *wc_DhAgree_API)(DhKey* key, byte* agree, word32* agreeSz,
const byte* priv, word32 privSz,
const byte* otherPub, word32 pubSz);
/* ------------------------------------------------------------------ */
/* ChaCha20 */
/* ------------------------------------------------------------------ */
typedef int (EFIAPI *wc_Chacha_SetKey_API)(ChaCha* ctx, const byte* key, word32 keySz);
typedef int (EFIAPI *wc_Chacha_Process_API)(ChaCha* ctx, byte* output,
const byte* input, word32 msglen);
/* ------------------------------------------------------------------ */
/* Poly1305 */
/* ------------------------------------------------------------------ */
typedef int (EFIAPI *wc_Poly1305SetKey_API)(Poly1305* ctx, const byte* key, word32 keySz);
typedef int (EFIAPI *wc_Poly1305Update_API)(Poly1305* ctx, const byte* m, word32 bytes);
typedef int (EFIAPI *wc_Poly1305Final_API)(Poly1305* ctx, byte* tag);
/* ------------------------------------------------------------------ */
/* ChaCha20-Poly1305 AEAD */
/* ------------------------------------------------------------------ */
typedef int (EFIAPI *wc_ChaCha20Poly1305_Encrypt_API)(
const byte* inKey, const byte* inIV,
const byte* inAAD, word32 inAADLen,
const byte* inPlaintext, word32 inPlaintextLen,
byte* outCiphertext, byte* outAuthTag);
typedef int (EFIAPI *wc_ChaCha20Poly1305_Decrypt_API)(
const byte* inKey, const byte* inIV,
const byte* inAAD, word32 inAADLen,
const byte* inCiphertext, word32 inCiphertextLen,
const byte* inAuthTag, byte* outPlaintext);
/* ------------------------------------------------------------------ */
/* Curve25519 */
/* ------------------------------------------------------------------ */
typedef int (EFIAPI *wc_curve25519_init_API)(curve25519_key* key);
typedef void (EFIAPI *wc_curve25519_free_API)(curve25519_key* key);
typedef int (EFIAPI *wc_curve25519_make_key_API)(WC_RNG* rng, int keysize,
curve25519_key* key);
typedef int (EFIAPI *wc_curve25519_shared_secret_API)(curve25519_key* priv,
curve25519_key* pub,
byte* out, word32* outlen);
typedef int (EFIAPI *wc_curve25519_export_key_raw_API)(curve25519_key* key,
byte* priv, word32* privSz,
byte* pub, word32* pubSz);
typedef int (EFIAPI *wc_curve25519_import_public_API)(const byte* in, word32 inLen,
curve25519_key* key);
/* ------------------------------------------------------------------ */
/* Ed25519 */
/* ------------------------------------------------------------------ */
typedef int (EFIAPI *wc_ed25519_init_API)(ed25519_key* key);
typedef void (EFIAPI *wc_ed25519_free_API)(ed25519_key* key);
typedef int (EFIAPI *wc_ed25519_make_key_API)(WC_RNG* rng, int keysize,
ed25519_key* key);
typedef int (EFIAPI *wc_ed25519_sign_msg_API)(const byte* in, word32 inlen,
byte* out, word32* outlen,
ed25519_key* key);
typedef int (EFIAPI *wc_ed25519_verify_msg_API)(const byte* sig, word32 siglen,
const byte* msg, word32 msglen,
int* stat, ed25519_key* key);
typedef int (EFIAPI *wc_ed25519_export_key_API)(ed25519_key* key,
byte* priv, word32* privSz,
byte* pub, word32* pubSz);
typedef int (EFIAPI *wc_ed25519_import_public_API)(const byte* in, word32 inLen,
ed25519_key* key);
/* ------------------------------------------------------------------ */
/* ML-KEM */
/* ------------------------------------------------------------------ */
#ifdef WOLFSSL_HAVE_MLKEM
typedef int (EFIAPI *wc_MlKemKey_Init_API)(MlKemKey* key, int type, void* heap,
int devId);
typedef int (EFIAPI *wc_MlKemKey_Free_API)(MlKemKey* key);
typedef int (EFIAPI *wc_MlKemKey_MakeKey_API)(MlKemKey* key, WC_RNG* rng);
typedef int (EFIAPI *wc_MlKemKey_CipherTextSize_API)(MlKemKey* key, word32* len);
typedef int (EFIAPI *wc_MlKemKey_SharedSecretSize_API)(MlKemKey* key,
word32* len);
typedef int (EFIAPI *wc_MlKemKey_Encapsulate_API)(MlKemKey* key,
unsigned char* ct,
unsigned char* ss,
WC_RNG* rng);
typedef int (EFIAPI *wc_MlKemKey_Decapsulate_API)(MlKemKey* key,
unsigned char* ss,
const unsigned char* ct,
word32 len);
typedef int (EFIAPI *wc_MlKemKey_DecodePrivateKey_API)(MlKemKey* key,
const unsigned char* in,
word32 len);
typedef int (EFIAPI *wc_MlKemKey_DecodePublicKey_API)(MlKemKey* key,
const unsigned char* in,
word32 len);
typedef int (EFIAPI *wc_MlKemKey_PrivateKeySize_API)(MlKemKey* key,
word32* len);
typedef int (EFIAPI *wc_MlKemKey_PublicKeySize_API)(MlKemKey* key,
word32* len);
typedef int (EFIAPI *wc_MlKemKey_EncodePrivateKey_API)(MlKemKey* key,
unsigned char* out,
word32 len);
typedef int (EFIAPI *wc_MlKemKey_EncodePublicKey_API)(MlKemKey* key,
unsigned char* out,
word32 len);
#endif /* WOLFSSL_HAVE_MLKEM */
/* ------------------------------------------------------------------ */
/* Dilithium (ML-DSA) */
/* ------------------------------------------------------------------ */
#ifdef HAVE_DILITHIUM
typedef int (EFIAPI *wc_dilithium_init_API)(dilithium_key* key);
typedef void (EFIAPI *wc_dilithium_free_API)(dilithium_key* key);
typedef int (EFIAPI *wc_dilithium_set_level_API)(dilithium_key* key, byte level);
typedef int (EFIAPI *wc_dilithium_make_key_API)(dilithium_key* key, WC_RNG* rng);
typedef int (EFIAPI *wc_dilithium_sign_msg_API)(const byte* in, word32 inLen,
byte* out, word32* outLen,
dilithium_key* key, WC_RNG* rng);
typedef int (EFIAPI *wc_dilithium_verify_msg_API)(const byte* sig, word32 sigLen,
const byte* msg, word32 msgLen,
int* res, dilithium_key* key);
typedef int (EFIAPI *wc_dilithium_export_key_API)(dilithium_key* key,
byte* priv, word32* privSz,
byte* pub, word32* pubSz);
typedef int (EFIAPI *wc_dilithium_import_key_API)(const byte* priv, word32 privSz,
const byte* pub, word32 pubSz,
dilithium_key* key);
#endif /* HAVE_DILITHIUM */
/* ------------------------------------------------------------------ */
/* Falcon */
/* ------------------------------------------------------------------ */
#ifdef HAVE_FALCON
typedef int (EFIAPI *wc_falcon_init_API)(falcon_key* key);
typedef void (EFIAPI *wc_falcon_free_API)(falcon_key* key);
typedef int (EFIAPI *wc_falcon_make_key_API)(falcon_key* key, WC_RNG* rng);
typedef int (EFIAPI *wc_falcon_sign_msg_API)(const byte* in, word32 inLen,
byte* out, word32* outLen,
falcon_key* key, WC_RNG* rng);
typedef int (EFIAPI *wc_falcon_verify_msg_API)(const byte* sig, word32 sigLen,
const byte* msg, word32 msgLen,
int* res, falcon_key* key);
typedef int (EFIAPI *wc_falcon_export_key_API)(falcon_key* key,
byte* priv, word32* privSz,
byte* pub, word32* pubSz);
typedef int (EFIAPI *wc_falcon_import_key_API)(const byte* priv, word32 privSz,
const byte* pub, word32 pubSz,
falcon_key* key);
#endif /* HAVE_FALCON */
/* ------------------------------------------------------------------ */
/* CMAC */
/* ------------------------------------------------------------------ */
typedef int (EFIAPI *wc_InitCmac_API)(Cmac* cmac, const byte* key, word32 keySz,
int type, void* unused);
typedef int (EFIAPI *wc_CmacUpdate_API)(Cmac* cmac, const byte* in, word32 inSz);
typedef int (EFIAPI *wc_CmacFinal_API)(Cmac* cmac, byte* out, word32* outSz);
/* ------------------------------------------------------------------ */
/* PBKDF2 / PKCS12 / PKCS7 / HKDF */
/* ------------------------------------------------------------------ */
typedef int (EFIAPI *wc_PBKDF2_API)(byte* output, const byte* passwd, int pLen,
const byte* salt, int sLen, int iterations,
int kLen, int hashType);
typedef int (EFIAPI *wc_PKCS12_PBKDF_API)(byte* output, const byte* passwd,
int passLen, const byte* salt,
int saltLen, int iterations,
int kLen, int hashType, int id);
typedef int (EFIAPI *wc_PKCS7_PadData_API)(byte* in, word32 inSz, byte* out,
word32 outSz, word32 blockSz);
typedef int (EFIAPI *wc_HKDF_API)(int type, const byte* inKey, word32 inKeySz,
const byte* salt, word32 saltSz,
const byte* info, word32 infoSz,
byte* out, word32 outSz);
/* ------------------------------------------------------------------ */
/* Logging / Error / Version */
/* ------------------------------------------------------------------ */
typedef int (EFIAPI *wolfSSL_Debugging_ON_API)(void);
typedef int (EFIAPI *wolfSSL_SetLoggingCb_API)(wolfSSL_Logging_cb cb);
typedef wolfSSL_Logging_cb (EFIAPI *wolfSSL_GetLoggingCb_API)(void);
typedef void (EFIAPI *wolfSSL_Debugging_OFF_API)(void);
typedef const char* (EFIAPI *wc_GetErrorString_API)(int error);
typedef void (EFIAPI *wc_ErrorString_API)(int err, char* buff);
/* ------------------------------------------------------------------ */
/* Protocol struct */
/* ------------------------------------------------------------------ */
extern EFI_GUID g_wolfcrypt_protocol_guid;
typedef struct {
UINT32 Version;
/* AES */
wc_AesInit_API wc_AesInit;
wc_AesSetKey_API wc_AesSetKey;
wc_AesEcbEncrypt_API wc_AesEcbEncrypt;
wc_AesEcbDecrypt_API wc_AesEcbDecrypt;
wc_AesCbcEncrypt_API wc_AesCbcEncrypt;
wc_AesCbcDecrypt_API wc_AesCbcDecrypt;
wc_AesCfbEncrypt_API wc_AesCfbEncrypt;
wc_AesCfbDecrypt_API wc_AesCfbDecrypt;
wc_AesSetIV_API wc_AesSetIV;
wc_AesFree_API wc_AesFree;
wc_AesGcmSetKey_API wc_AesGcmSetKey;
wc_AesGcmEncrypt_API wc_AesGcmEncrypt;
wc_AesGcmDecrypt_API wc_AesGcmDecrypt;
wc_AesCcmSetKey_API wc_AesCcmSetKey;
wc_AesCcmEncrypt_API wc_AesCcmEncrypt;
wc_AesCcmDecrypt_API wc_AesCcmDecrypt;
wc_AesCtrEncrypt_API wc_AesCtrEncrypt;
wc_AesOfbEncrypt_API wc_AesOfbEncrypt;
/* RNG */
wc_InitRng_API wc_InitRng;
wc_FreeRng_API wc_FreeRng;
wc_RNG_GenerateBlock_API wc_RNG_GenerateBlock;
wc_RNG_GenerateByte_API wc_RNG_GenerateByte;
wc_SetSeed_Cb_API wc_SetSeed_Cb;
wc_RNG_TestSeed_API wc_RNG_TestSeed;
wc_GenerateSeed_IntelRD_API wc_GenerateSeed_IntelRD;
wc_GenerateSeed_API wc_GenerateSeed;
wc_GenerateRand_IntelRD_API wc_GenerateRand_IntelRD;
wc_InitRng_IntelRD_API wc_InitRng_IntelRD;
/* RSA */
wc_InitRsaKey_API wc_InitRsaKey;
wc_MakeRsaKey_API wc_MakeRsaKey;
wc_RsaKeyToDer_API wc_RsaKeyToDer;
wc_FreeRsaKey_API wc_FreeRsaKey;
wc_RsaEncryptSize_API wc_RsaEncryptSize;
wc_RsaPrivateKeyDecode_API wc_RsaPrivateKeyDecode;
wc_RsaPublicKeyDecode_API wc_RsaPublicKeyDecode;
wc_RsaPrivateDecryptEx_API wc_RsaPrivateDecryptEx;
wc_RsaPrivateDecrypt_API wc_RsaPrivateDecrypt;
wc_RsaPublicEncrypt_API wc_RsaPublicEncrypt;
wc_RsaPublicEncryptEx_API wc_RsaPublicEncryptEx;
wc_RsaExportKey_API wc_RsaExportKey;
wc_RsaCleanup_API wc_RsaCleanup;
wc_CheckRsaKey_API wc_CheckRsaKey;
wc_RsaPublicKeyDerSize_API wc_RsaPublicKeyDerSize;
wc_RsaKeyToPublicDer_API wc_RsaKeyToPublicDer;
wc_RsaSetRNG_API wc_RsaSetRNG;
/* HMAC */
wc_HmacSetKey_API wc_HmacSetKey;
wc_HmacUpdate_API wc_HmacUpdate;
wc_HmacFinal_API wc_HmacFinal;
/* SHA-1 */
wc_InitSha_API wc_InitSha;
wc_ShaUpdate_API wc_ShaUpdate;
wc_ShaFinal_API wc_ShaFinal;
wc_ShaFree_API wc_ShaFree;
/* SHA-224 */
wc_InitSha224_API wc_InitSha224;
wc_Sha224Update_API wc_Sha224Update;
wc_Sha224Final_API wc_Sha224Final;
wc_Sha224Free_API wc_Sha224Free;
/* SHA-256 */
wc_InitSha256_API wc_InitSha256;
wc_InitSha256_ex_API wc_InitSha256_ex;
wc_Sha256Update_API wc_Sha256Update;
wc_Sha256Final_API wc_Sha256Final;
wc_Sha256Free_API wc_Sha256Free;
/* SHA-384 */
wc_InitSha384_API wc_InitSha384;
wc_Sha384Update_API wc_Sha384Update;
wc_Sha384Final_API wc_Sha384Final;
wc_Sha384Free_API wc_Sha384Free;
/* SHA-512 */
wc_InitSha512_API wc_InitSha512;
wc_Sha512Update_API wc_Sha512Update;
wc_Sha512Final_API wc_Sha512Final;
wc_Sha512Free_API wc_Sha512Free;
/* SHA-3 */
wc_InitSha3_256_API wc_InitSha3_256;
wc_Sha3_256_Update_API wc_Sha3_256_Update;
wc_Sha3_256_Final_API wc_Sha3_256_Final;
wc_Sha3_256_Free_API wc_Sha3_256_Free;
wc_InitSha3_384_API wc_InitSha3_384;
wc_Sha3_384_Update_API wc_Sha3_384_Update;
wc_Sha3_384_Final_API wc_Sha3_384_Final;
wc_Sha3_384_Free_API wc_Sha3_384_Free;
wc_InitSha3_512_API wc_InitSha3_512;
wc_Sha3_512_Update_API wc_Sha3_512_Update;
wc_Sha3_512_Final_API wc_Sha3_512_Final;
wc_Sha3_512_Free_API wc_Sha3_512_Free;
/* SHAKE128/256 */
wc_InitShake128_API wc_InitShake128;
wc_Shake128_Update_API wc_Shake128_Update;
wc_Shake128_Final_API wc_Shake128_Final;
wc_Shake128_SqueezeBlocks_API wc_Shake128_SqueezeBlocks;
wc_Shake128_Free_API wc_Shake128_Free;
wc_InitShake256_API wc_InitShake256;
wc_Shake256_Update_API wc_Shake256_Update;
wc_Shake256_Final_API wc_Shake256_Final;
wc_Shake256_SqueezeBlocks_API wc_Shake256_SqueezeBlocks;
wc_Shake256_Free_API wc_Shake256_Free;
/* ECC */
wc_ecc_init_API wc_ecc_init;
wc_ecc_free_API wc_ecc_free;
wc_ecc_make_key_API wc_ecc_make_key;
wc_ecc_set_rng_API wc_ecc_set_rng;
wc_ecc_shared_secret_API wc_ecc_shared_secret;
wc_ecc_sign_hash_API wc_ecc_sign_hash;
wc_ecc_verify_hash_API wc_ecc_verify_hash;
wc_ecc_export_x963_API wc_ecc_export_x963;
wc_ecc_import_x963_API wc_ecc_import_x963;
wc_EccKeyToDer_API wc_EccKeyToDer;
wc_EccPublicKeyDecode_API wc_EccPublicKeyDecode;
wc_EccPrivateKeyDecode_API wc_EccPrivateKeyDecode;
/* DH */
wc_DhGenerateParams_API wc_DhGenerateParams;
wc_DhGenerateKeyPair_API wc_DhGenerateKeyPair;
wc_DhAgree_API wc_DhAgree;
/* ChaCha20 */
wc_Chacha_SetKey_API wc_Chacha_SetKey;
wc_Chacha_Process_API wc_Chacha_Process;
/* Poly1305 */
wc_Poly1305SetKey_API wc_Poly1305SetKey;
wc_Poly1305Update_API wc_Poly1305Update;
wc_Poly1305Final_API wc_Poly1305Final;
/* ChaCha20-Poly1305 AEAD */
wc_ChaCha20Poly1305_Encrypt_API wc_ChaCha20Poly1305_Encrypt;
wc_ChaCha20Poly1305_Decrypt_API wc_ChaCha20Poly1305_Decrypt;
/* Curve25519 */
wc_curve25519_init_API wc_curve25519_init;
wc_curve25519_free_API wc_curve25519_free;
wc_curve25519_make_key_API wc_curve25519_make_key;
wc_curve25519_shared_secret_API wc_curve25519_shared_secret;
wc_curve25519_export_key_raw_API wc_curve25519_export_key_raw;
wc_curve25519_import_public_API wc_curve25519_import_public;
/* Ed25519 */
wc_ed25519_init_API wc_ed25519_init;
wc_ed25519_free_API wc_ed25519_free;
wc_ed25519_make_key_API wc_ed25519_make_key;
wc_ed25519_sign_msg_API wc_ed25519_sign_msg;
wc_ed25519_verify_msg_API wc_ed25519_verify_msg;
wc_ed25519_export_key_API wc_ed25519_export_key;
wc_ed25519_import_public_API wc_ed25519_import_public;
/* ML-KEM */
#ifdef WOLFSSL_HAVE_MLKEM
wc_MlKemKey_Init_API wc_MlKemKey_Init;
wc_MlKemKey_Free_API wc_MlKemKey_Free;
wc_MlKemKey_MakeKey_API wc_MlKemKey_MakeKey;
wc_MlKemKey_CipherTextSize_API wc_MlKemKey_CipherTextSize;
wc_MlKemKey_SharedSecretSize_API wc_MlKemKey_SharedSecretSize;
wc_MlKemKey_Encapsulate_API wc_MlKemKey_Encapsulate;
wc_MlKemKey_Decapsulate_API wc_MlKemKey_Decapsulate;
wc_MlKemKey_DecodePrivateKey_API wc_MlKemKey_DecodePrivateKey;
wc_MlKemKey_DecodePublicKey_API wc_MlKemKey_DecodePublicKey;
wc_MlKemKey_PrivateKeySize_API wc_MlKemKey_PrivateKeySize;
wc_MlKemKey_PublicKeySize_API wc_MlKemKey_PublicKeySize;
wc_MlKemKey_EncodePrivateKey_API wc_MlKemKey_EncodePrivateKey;
wc_MlKemKey_EncodePublicKey_API wc_MlKemKey_EncodePublicKey;
#endif
/* Dilithium */
#ifdef HAVE_DILITHIUM
wc_dilithium_init_API wc_dilithium_init;
wc_dilithium_free_API wc_dilithium_free;
wc_dilithium_set_level_API wc_dilithium_set_level;
wc_dilithium_make_key_API wc_dilithium_make_key;
wc_dilithium_sign_msg_API wc_dilithium_sign_msg;
wc_dilithium_verify_msg_API wc_dilithium_verify_msg;
wc_dilithium_export_key_API wc_dilithium_export_key;
wc_dilithium_import_key_API wc_dilithium_import_key;
#endif
/* Falcon */
#ifdef HAVE_FALCON
wc_falcon_init_API wc_falcon_init;
wc_falcon_free_API wc_falcon_free;
wc_falcon_make_key_API wc_falcon_make_key;
wc_falcon_sign_msg_API wc_falcon_sign_msg;
wc_falcon_verify_msg_API wc_falcon_verify_msg;
wc_falcon_export_key_API wc_falcon_export_key;
wc_falcon_import_key_API wc_falcon_import_key;
#endif
/* CMAC */
wc_InitCmac_API wc_InitCmac;
wc_CmacUpdate_API wc_CmacUpdate;
wc_CmacFinal_API wc_CmacFinal;
/* PBKDF2 / PKCS12 / PKCS7 / HKDF */
wc_PBKDF2_API wc_PBKDF2;
wc_PKCS12_PBKDF_API wc_PKCS12_PBKDF;
wc_PKCS7_PadData_API wc_PKCS7_PadData;
wc_HKDF_API wc_HKDF;
/* Logging / Error */
wolfSSL_Debugging_ON_API wolfSSL_Debugging_ON;
wolfSSL_SetLoggingCb_API wolfSSL_SetLoggingCb;
wolfSSL_GetLoggingCb_API wolfSSL_GetLoggingCb;
wolfSSL_Debugging_OFF_API wolfSSL_Debugging_OFF;
wc_GetErrorString_API wc_GetErrorString;
wc_ErrorString_API wc_ErrorString;
} WOLFCRYPT_PROTOCOL;
#endif /* WOLFCRYPT_API_H_INCLUDED */

0
uefi/Makefile → uefi-static/Makefile
View File

0
uefi/README.md → uefi-static/README.md
View File

0
uefi/main.c → uefi-static/main.c
View File

0
uefi/startup.nsh → uefi-static/startup.nsh
View File

0
uefi/string.c → uefi-static/string.c
View File

0
uefi/user_settings.h → uefi-static/user_settings.h
View File