From 1f0076dcf9d5aa23735b1db0e9f3c260050a3524 Mon Sep 17 00:00:00 2001 From: David Garske Date: Mon, 19 Jan 2026 19:53:46 +0000 Subject: [PATCH] Added tests for brainpool curves and proper macro checking --- stsafe/Makefile | 20 +- stsafe/platform/stse_conf.h | 2 + stsafe/user_settings.h | 4 + stsafe/wolfssl_stsafe_full_test.c | 202 ++++++++++++++++- stsafe/wolfssl_stsafe_test.c | 366 +++++++++++++++++++++++++++++- 5 files changed, 581 insertions(+), 13 deletions(-) diff --git a/stsafe/Makefile b/stsafe/Makefile index edf223c9..48267bf9 100644 --- a/stsafe/Makefile +++ b/stsafe/Makefile @@ -96,18 +96,16 @@ basic: $(TEST_SRC) $(PLATFORM_SRC) # wolfSSL crypto callback test build # Note: We compile stsafe.c directly since it's not built into libwolfssl by default -# IMPORTANT: Use WOLFSSL_USE_OPTIONS_H to get options.h included for proper wolfSSL settings -# We add -DWOLFSSL_STSAFEA120 -DUSE_STSAFE_RNG_SEED to enable STSAFE in stsafe.c -WOLFSSL_STSAFE_FLAGS = -DWOLFSSL_USE_OPTIONS_H -DWOLFSSL_STSAFEA120 -DUSE_STSAFE_RNG_SEED -Wno-strict-prototypes +WOLFSSL_STSAFE_FLAGS = -DWOLFSSL_USER_SETTINGS -Wno-strict-prototypes WOLFSSL_BASE_FLAGS = -Wall -Wextra -O2 -g wolfssl: $(WOLFSSL_TEST_SRC) $(PLATFORM_SRC) $(PLATFORM_CRYPTO_SRC) - $(CC) $(WOLFSSL_BASE_FLAGS) $(WOLFSSL_STSAFE_FLAGS) -I$(STSELIB_DIR) -I$(PLATFORM_DIR) -I$(WOLFSSL_DIR) \ + $(CC) $(WOLFSSL_BASE_FLAGS) $(WOLFSSL_STSAFE_FLAGS) -I. -I$(STSELIB_DIR) -I$(PLATFORM_DIR) -I$(WOLFSSL_DIR) \ -c $(WOLFSSL_STSAFE_SRC) -o stsafe.o - $(CC) $(WOLFSSL_BASE_FLAGS) $(WOLFSSL_STSAFE_FLAGS) -I$(STSELIB_DIR) -I$(PLATFORM_DIR) -I$(WOLFSSL_DIR) \ + $(CC) $(WOLFSSL_BASE_FLAGS) $(WOLFSSL_STSAFE_FLAGS) -I. -I$(STSELIB_DIR) -I$(PLATFORM_DIR) -I$(WOLFSSL_DIR) \ -c $(PLATFORM_SRC) -o stse_platform_linux.o - $(CC) $(WOLFSSL_BASE_FLAGS) $(WOLFSSL_STSAFE_FLAGS) -I$(STSELIB_DIR) -I$(PLATFORM_DIR) -I$(WOLFSSL_DIR) \ + $(CC) $(WOLFSSL_BASE_FLAGS) $(WOLFSSL_STSAFE_FLAGS) -I. -I$(STSELIB_DIR) -I$(PLATFORM_DIR) -I$(WOLFSSL_DIR) \ -c $(PLATFORM_CRYPTO_SRC) -o stse_platform_crypto.o - $(CC) $(WOLFSSL_BASE_FLAGS) $(WOLFSSL_STSAFE_FLAGS) -I$(STSELIB_DIR) -I$(PLATFORM_DIR) -I$(WOLFSSL_DIR) \ + $(CC) $(WOLFSSL_BASE_FLAGS) $(WOLFSSL_STSAFE_FLAGS) -I. -I$(STSELIB_DIR) -I$(PLATFORM_DIR) -I$(WOLFSSL_DIR) \ -o $(WOLFSSL_TARGET) \ $(WOLFSSL_TEST_SRC) \ stse_platform_linux.o stse_platform_crypto.o stsafe.o \ @@ -125,13 +123,13 @@ test-wolfssl: wolfssl # Full wolfSSL integration test with ECDH and benchmarks wolfssl-full: $(WOLFSSL_FULL_TEST_SRC) $(PLATFORM_SRC) $(PLATFORM_CRYPTO_SRC) - $(CC) $(WOLFSSL_BASE_FLAGS) $(WOLFSSL_STSAFE_FLAGS) -I$(STSELIB_DIR) -I$(PLATFORM_DIR) -I$(WOLFSSL_DIR) \ + $(CC) $(WOLFSSL_BASE_FLAGS) $(WOLFSSL_STSAFE_FLAGS) -I. -I$(STSELIB_DIR) -I$(PLATFORM_DIR) -I$(WOLFSSL_DIR) \ -c $(WOLFSSL_STSAFE_SRC) -o stsafe.o - $(CC) $(WOLFSSL_BASE_FLAGS) $(WOLFSSL_STSAFE_FLAGS) -I$(STSELIB_DIR) -I$(PLATFORM_DIR) -I$(WOLFSSL_DIR) \ + $(CC) $(WOLFSSL_BASE_FLAGS) $(WOLFSSL_STSAFE_FLAGS) -I. -I$(STSELIB_DIR) -I$(PLATFORM_DIR) -I$(WOLFSSL_DIR) \ -c $(PLATFORM_SRC) -o stse_platform_linux.o - $(CC) $(WOLFSSL_BASE_FLAGS) $(WOLFSSL_STSAFE_FLAGS) -I$(STSELIB_DIR) -I$(PLATFORM_DIR) -I$(WOLFSSL_DIR) \ + $(CC) $(WOLFSSL_BASE_FLAGS) $(WOLFSSL_STSAFE_FLAGS) -I. -I$(STSELIB_DIR) -I$(PLATFORM_DIR) -I$(WOLFSSL_DIR) \ -c $(PLATFORM_CRYPTO_SRC) -o stse_platform_crypto.o - $(CC) $(WOLFSSL_BASE_FLAGS) $(WOLFSSL_STSAFE_FLAGS) -I$(STSELIB_DIR) -I$(PLATFORM_DIR) -I$(WOLFSSL_DIR) \ + $(CC) $(WOLFSSL_BASE_FLAGS) $(WOLFSSL_STSAFE_FLAGS) -I. -I$(STSELIB_DIR) -I$(PLATFORM_DIR) -I$(WOLFSSL_DIR) \ -o $(WOLFSSL_FULL_TARGET) \ $(WOLFSSL_FULL_TEST_SRC) \ stse_platform_linux.o stse_platform_crypto.o stsafe.o \ diff --git a/stsafe/platform/stse_conf.h b/stsafe/platform/stse_conf.h index 5415a8a8..4db99395 100644 --- a/stsafe/platform/stse_conf.h +++ b/stsafe/platform/stse_conf.h @@ -41,6 +41,8 @@ extern "C" { /* STSAFE-A ECC services configuration - enable P-256 and P-384 for wolfSSL */ #define STSE_CONF_ECC_NIST_P_256 #define STSE_CONF_ECC_NIST_P_384 +//#define STSE_CONF_ECC_BRAINPOOL_P_256 +//#define STSE_CONF_ECC_BRAINPOOL_P_384 /* STSAFE-A HASH services configuration */ #define STSE_CONF_HASH_SHA_256 diff --git a/stsafe/user_settings.h b/stsafe/user_settings.h index 15a684e5..01f0ec91 100644 --- a/stsafe/user_settings.h +++ b/stsafe/user_settings.h @@ -67,6 +67,10 @@ extern "C" { #undef NO_ECC256 /* Enable P-256 */ #define HAVE_ECC384 /* Enable P-384 */ #define ECC_TIMING_RESISTANT +/* Brainpool curves require WOLFSSL_CUSTOM_CURVES */ +#define WOLFSSL_CUSTOM_CURVES +#define HAVE_ECC_BRAINPOOL +#define HAVE_ECC_CDH /* ECC key import/export functions */ #define WOLFSSL_PUBLIC_MP /* For mp_int access in ECC verify */ diff --git a/stsafe/wolfssl_stsafe_full_test.c b/stsafe/wolfssl_stsafe_full_test.c index ee449c72..9c82a489 100755 --- a/stsafe/wolfssl_stsafe_full_test.c +++ b/stsafe/wolfssl_stsafe_full_test.c @@ -1,7 +1,7 @@ /* wolfssl_stsafe_full_test.c * * Comprehensive wolfSSL integration tests with STSAFE-A120 - * Tests: RNG, ECC KeyGen, ECDSA Sign/Verify, ECDH, Benchmarks + * Tests: RNG, ECC KeyGen, ECDSA Sign/Verify, ECDH, Benchmarks, Brainpool curves * * Copyright (C) 2006-2026 wolfSSL Inc. * @@ -353,6 +353,200 @@ static int test_ecdh_p256(void) return 0; } +/*----------------------------------------------------------------------------- + * Test: ECDSA Brainpool P-256 Benchmark + *---------------------------------------------------------------------------*/ +#if defined(HAVE_ECC_BRAINPOOL) && defined(STSE_CONF_ECC_BRAINPOOL_P_256) +static int test_ecdsa_brainpool_p256_benchmark(void) +{ + ecc_key key; + WC_RNG rng; + int ret; + byte digest[32]; + byte sig[128]; + word32 sigLen; + int verified = 0; + int iterations = 10; + double start, end, elapsed; + int i; + + printf("\nTest: ECDSA Brainpool P-256 Benchmark (STSAFE-A120)\n"); + + ret = wc_InitRng(&rng); + if (ret != 0) { + printf(" Error: wc_InitRng failed: %d\n", ret); + TEST_FAIL("ECDSA Brainpool P-256 benchmark RNG init"); + return -1; + } + + memset(digest, 0xAB, sizeof(digest)); + + ret = wc_ecc_init_ex(&key, NULL, g_devId); + if (ret != 0) { + printf(" Error: wc_ecc_init_ex failed: %d\n", ret); + wc_FreeRng(&rng); + TEST_FAIL("ECDSA Brainpool P-256 benchmark key init"); + return -1; + } + + /* Benchmark key generation */ + start = get_time_us(); + ret = wc_ecc_make_key_ex(&rng, 32, &key, ECC_BRAINPOOLP256R1); + end = get_time_us(); + elapsed = (end - start) / 1000.0; + + if (ret != 0) { + printf(" Error: wc_ecc_make_key_ex failed: %d\n", ret); + wc_ecc_free(&key); + wc_FreeRng(&rng); + TEST_FAIL("ECDSA Brainpool P-256 keygen"); + return -1; + } + printf(" Key generation: %.2f ms\n", elapsed); + + /* Benchmark signing */ + start = get_time_us(); + for (i = 0; i < iterations; i++) { + sigLen = sizeof(sig); + ret = wc_ecc_sign_hash(digest, sizeof(digest), sig, &sigLen, &rng, &key); + if (ret != 0) break; + } + end = get_time_us(); + elapsed = (end - start) / 1000.0; + + if (ret != 0) { + printf(" Error: wc_ecc_sign_hash failed: %d\n", ret); + wc_ecc_free(&key); + wc_FreeRng(&rng); + TEST_FAIL("ECDSA Brainpool P-256 sign"); + return -1; + } + printf(" Signing: %d ops in %.2f ms (%.2f ops/sec)\n", + iterations, elapsed, iterations / (elapsed / 1000.0)); + + /* Benchmark verification */ + start = get_time_us(); + for (i = 0; i < iterations; i++) { + ret = wc_ecc_verify_hash(sig, sigLen, digest, sizeof(digest), &verified, &key); + if (ret != 0 || verified != 1) break; + } + end = get_time_us(); + elapsed = (end - start) / 1000.0; + + if (ret != 0 || verified != 1) { + printf(" Error: wc_ecc_verify_hash failed: %d, verified=%d\n", ret, verified); + wc_ecc_free(&key); + wc_FreeRng(&rng); + TEST_FAIL("ECDSA Brainpool P-256 verify"); + return -1; + } + printf(" Verification: %d ops in %.2f ms (%.2f ops/sec)\n", + iterations, elapsed, iterations / (elapsed / 1000.0)); + + wc_ecc_free(&key); + wc_FreeRng(&rng); + TEST_PASS("ECDSA Brainpool P-256 benchmark"); + return 0; +} +#endif /* HAVE_ECC_BRAINPOOL && STSE_CONF_ECC_BRAINPOOL_P_256 */ + +/*----------------------------------------------------------------------------- + * Test: ECDSA Brainpool P-384 Benchmark + *---------------------------------------------------------------------------*/ +#if defined(HAVE_ECC_BRAINPOOL) && defined(STSE_CONF_ECC_BRAINPOOL_P_384) +static int test_ecdsa_brainpool_p384_benchmark(void) +{ + ecc_key key; + WC_RNG rng; + int ret; + byte digest[48]; + byte sig[128]; + word32 sigLen; + int verified = 0; + int iterations = 10; + double start, end, elapsed; + int i; + + printf("\nTest: ECDSA Brainpool P-384 Benchmark (STSAFE-A120)\n"); + + ret = wc_InitRng(&rng); + if (ret != 0) { + printf(" Error: wc_InitRng failed: %d\n", ret); + TEST_FAIL("ECDSA Brainpool P-384 benchmark RNG init"); + return -1; + } + + memset(digest, 0xCD, sizeof(digest)); + + ret = wc_ecc_init_ex(&key, NULL, g_devId); + if (ret != 0) { + printf(" Error: wc_ecc_init_ex failed: %d\n", ret); + wc_FreeRng(&rng); + TEST_FAIL("ECDSA Brainpool P-384 benchmark key init"); + return -1; + } + + /* Benchmark key generation */ + start = get_time_us(); + ret = wc_ecc_make_key_ex(&rng, 48, &key, ECC_BRAINPOOLP384R1); + end = get_time_us(); + elapsed = (end - start) / 1000.0; + + if (ret != 0) { + printf(" Error: wc_ecc_make_key_ex failed: %d\n", ret); + wc_ecc_free(&key); + wc_FreeRng(&rng); + TEST_FAIL("ECDSA Brainpool P-384 keygen"); + return -1; + } + printf(" Key generation: %.2f ms\n", elapsed); + + /* Benchmark signing */ + start = get_time_us(); + for (i = 0; i < iterations; i++) { + sigLen = sizeof(sig); + ret = wc_ecc_sign_hash(digest, sizeof(digest), sig, &sigLen, &rng, &key); + if (ret != 0) break; + } + end = get_time_us(); + elapsed = (end - start) / 1000.0; + + if (ret != 0) { + printf(" Error: wc_ecc_sign_hash failed: %d\n", ret); + wc_ecc_free(&key); + wc_FreeRng(&rng); + TEST_FAIL("ECDSA Brainpool P-384 sign"); + return -1; + } + printf(" Signing: %d ops in %.2f ms (%.2f ops/sec)\n", + iterations, elapsed, iterations / (elapsed / 1000.0)); + + /* Benchmark verification */ + start = get_time_us(); + for (i = 0; i < iterations; i++) { + ret = wc_ecc_verify_hash(sig, sigLen, digest, sizeof(digest), &verified, &key); + if (ret != 0 || verified != 1) break; + } + end = get_time_us(); + elapsed = (end - start) / 1000.0; + + if (ret != 0 || verified != 1) { + printf(" Error: wc_ecc_verify_hash failed: %d, verified=%d\n", ret, verified); + wc_ecc_free(&key); + wc_FreeRng(&rng); + TEST_FAIL("ECDSA Brainpool P-384 verify"); + return -1; + } + printf(" Verification: %d ops in %.2f ms (%.2f ops/sec)\n", + iterations, elapsed, iterations / (elapsed / 1000.0)); + + wc_ecc_free(&key); + wc_FreeRng(&rng); + TEST_PASS("ECDSA Brainpool P-384 benchmark"); + return 0; +} +#endif /* HAVE_ECC_BRAINPOOL && STSE_CONF_ECC_BRAINPOOL_P_384 */ + /*----------------------------------------------------------------------------- * Test: Multiple Key Slots *---------------------------------------------------------------------------*/ @@ -479,6 +673,12 @@ int main(void) /* Run tests */ test_rng_benchmark(); test_ecdsa_p256_benchmark(); +#if defined(HAVE_ECC_BRAINPOOL) && defined(STSE_CONF_ECC_BRAINPOOL_P_256) + test_ecdsa_brainpool_p256_benchmark(); +#endif +#if defined(HAVE_ECC_BRAINPOOL) && defined(STSE_CONF_ECC_BRAINPOOL_P_384) + test_ecdsa_brainpool_p384_benchmark(); +#endif /* ECDH test - now uses ECDHE ephemeral keys */ test_ecdh_p256(); diff --git a/stsafe/wolfssl_stsafe_test.c b/stsafe/wolfssl_stsafe_test.c index ab4fcd3b..fde9916e 100755 --- a/stsafe/wolfssl_stsafe_test.c +++ b/stsafe/wolfssl_stsafe_test.c @@ -1,7 +1,7 @@ /* wolfssl_stsafe_test.c * * Test wolfSSL crypto callbacks with STSAFE-A120 - * Tests: RNG, ECC P-256, ECC P-384, ECDSA Sign/Verify + * Tests: RNG, ECC P-256, ECC P-384, ECDSA Sign/Verify, Brainpool curves * * Copyright (C) 2006-2026 wolfSSL Inc. * @@ -436,6 +436,362 @@ static int test_ecdsa_p384(void) return 0; } +/*----------------------------------------------------------------------------- + * Test: ECC Brainpool P-256 Key Generation with STSAFE-A120 + *---------------------------------------------------------------------------*/ +#if defined(HAVE_ECC_BRAINPOOL) && defined(STSE_CONF_ECC_BRAINPOOL_P_256) +static int test_ecc_keygen_brainpool_p256(void) +{ + ecc_key key; + WC_RNG rng; + int ret; + byte pubX[32], pubY[32]; + word32 pubX_len = sizeof(pubX), pubY_len = sizeof(pubY); + int i; + + printf("\nTest: ECC Brainpool P-256 Key Generation with STSAFE-A120\n"); + + ret = wc_InitRng(&rng); + if (ret != 0) { + printf(" Error: wc_InitRng failed: %d\n", ret); + TEST_FAIL("ECC Brainpool P-256 RNG init"); + return -1; + } + + ret = wc_ecc_init_ex(&key, NULL, g_devId); + if (ret != 0) { + printf(" Error: wc_ecc_init_ex failed: %d\n", ret); + wc_FreeRng(&rng); + TEST_FAIL("ECC Brainpool P-256 init"); + return -1; + } + + /* Generate Brainpool P-256 key pair - should use STSAFE via crypto callback */ + ret = wc_ecc_make_key_ex(&rng, 32, &key, ECC_BRAINPOOLP256R1); + if (ret != 0) { + printf(" Error: wc_ecc_make_key_ex failed: %d\n", ret); + wc_ecc_free(&key); + wc_FreeRng(&rng); + TEST_FAIL("ECC Brainpool P-256 key generation"); + return -1; + } + + /* Export public key */ + ret = wc_ecc_export_public_raw(&key, pubX, &pubX_len, pubY, &pubY_len); + if (ret != 0) { + printf(" Error: wc_ecc_export_public_raw failed: %d\n", ret); + wc_ecc_free(&key); + wc_FreeRng(&rng); + TEST_FAIL("ECC Brainpool P-256 export public key"); + return -1; + } + + printf(" Public Key X: "); + for (i = 0; i < 8; i++) printf("%02X", pubX[i]); + printf("...\n"); + printf(" Public Key Y: "); + for (i = 0; i < 8; i++) printf("%02X", pubY[i]); + printf("...\n"); + + wc_ecc_free(&key); + wc_FreeRng(&rng); + TEST_PASS("ECC Brainpool P-256 key generation"); + return 0; +} +#endif /* HAVE_ECC_BRAINPOOL && STSE_CONF_ECC_BRAINPOOL_P_256 */ + +/*----------------------------------------------------------------------------- + * Test: ECC Brainpool P-384 Key Generation with STSAFE-A120 + *---------------------------------------------------------------------------*/ +#if defined(HAVE_ECC_BRAINPOOL) && defined(STSE_CONF_ECC_BRAINPOOL_P_384) +static int test_ecc_keygen_brainpool_p384(void) +{ + ecc_key key; + WC_RNG rng; + int ret; + byte pubX[48], pubY[48]; + word32 pubX_len = sizeof(pubX), pubY_len = sizeof(pubY); + int i; + + printf("\nTest: ECC Brainpool P-384 Key Generation with STSAFE-A120\n"); + + ret = wc_InitRng(&rng); + if (ret != 0) { + printf(" Error: wc_InitRng failed: %d\n", ret); + TEST_FAIL("ECC Brainpool P-384 RNG init"); + return -1; + } + + ret = wc_ecc_init_ex(&key, NULL, g_devId); + if (ret != 0) { + printf(" Error: wc_ecc_init_ex failed: %d\n", ret); + wc_FreeRng(&rng); + TEST_FAIL("ECC Brainpool P-384 init"); + return -1; + } + + /* Generate Brainpool P-384 key pair - should use STSAFE via crypto callback */ + ret = wc_ecc_make_key_ex(&rng, 48, &key, ECC_BRAINPOOLP384R1); + if (ret != 0) { + printf(" Error: wc_ecc_make_key_ex failed: %d\n", ret); + wc_ecc_free(&key); + wc_FreeRng(&rng); + TEST_FAIL("ECC Brainpool P-384 key generation"); + return -1; + } + + /* Export public key */ + ret = wc_ecc_export_public_raw(&key, pubX, &pubX_len, pubY, &pubY_len); + if (ret != 0) { + printf(" Error: wc_ecc_export_public_raw failed: %d\n", ret); + wc_ecc_free(&key); + wc_FreeRng(&rng); + TEST_FAIL("ECC Brainpool P-384 export public key"); + return -1; + } + + printf(" Public Key X: "); + for (i = 0; i < 8; i++) printf("%02X", pubX[i]); + printf("...\n"); + printf(" Public Key Y: "); + for (i = 0; i < 8; i++) printf("%02X", pubY[i]); + printf("...\n"); + + wc_ecc_free(&key); + wc_FreeRng(&rng); + TEST_PASS("ECC Brainpool P-384 key generation"); + return 0; +} +#endif /* HAVE_ECC_BRAINPOOL && STSE_CONF_ECC_BRAINPOOL_P_384 */ + +/*----------------------------------------------------------------------------- + * Test: ECDSA Sign/Verify Brainpool P-256 with STSAFE-A120 + *---------------------------------------------------------------------------*/ +#if defined(HAVE_ECC_BRAINPOOL) && defined(STSE_CONF_ECC_BRAINPOOL_P_256) +static int test_ecdsa_brainpool_p256(void) +{ + ecc_key key; + WC_RNG rng; + int ret; + byte digest[32]; + byte sig[128]; + word32 sigLen = sizeof(sig); + int verified = 0; + int i; + + printf("\nTest: ECDSA Brainpool P-256 Sign/Verify with STSAFE-A120\n"); + + /* Initialize RNG */ + ret = wc_InitRng(&rng); + if (ret != 0) { + printf(" Error: wc_InitRng failed: %d\n", ret); + TEST_FAIL("ECDSA Brainpool P-256 RNG init"); + return -1; + } + + /* Create test digest */ + memset(digest, 0xAB, sizeof(digest)); + + ret = wc_ecc_init_ex(&key, NULL, g_devId); + if (ret != 0) { + printf(" Error: wc_ecc_init_ex failed: %d\n", ret); + wc_FreeRng(&rng); + TEST_FAIL("ECDSA Brainpool P-256 key init"); + return -1; + } + + /* Generate key pair using STSAFE */ + ret = wc_ecc_make_key_ex(&rng, 32, &key, ECC_BRAINPOOLP256R1); + if (ret != 0) { + printf(" Error: wc_ecc_make_key_ex failed: %d\n", ret); + wc_ecc_free(&key); + wc_FreeRng(&rng); + TEST_FAIL("ECDSA Brainpool P-256 key generation"); + return -1; + } + + printf(" Key pair generated.\n"); + + /* Sign the digest using STSAFE */ + ret = wc_ecc_sign_hash(digest, sizeof(digest), sig, &sigLen, &rng, &key); + if (ret != 0) { + printf(" Error: wc_ecc_sign_hash failed: %d\n", ret); + wc_ecc_free(&key); + wc_FreeRng(&rng); + TEST_FAIL("ECDSA Brainpool P-256 sign"); + return -1; + } + + printf(" Signature (%d bytes): ", sigLen); + for (i = 0; i < 8 && i < (int)sigLen; i++) printf("%02X", sig[i]); + printf("...\n"); + + /* Verify the signature using software (public key only, no hardware needed) */ + /* Clear devId to force software verification */ + key.devId = INVALID_DEVID; + ret = wc_ecc_verify_hash(sig, sigLen, digest, sizeof(digest), &verified, &key); + if (ret != 0) { + printf(" Error: wc_ecc_verify_hash failed: %d\n", ret); + wc_ecc_free(&key); + wc_FreeRng(&rng); + TEST_FAIL("ECDSA Brainpool P-256 verify"); + return -1; + } + + if (verified != 1) { + printf(" Error: Signature verification failed\n"); + wc_ecc_free(&key); + wc_FreeRng(&rng); + TEST_FAIL("ECDSA Brainpool P-256 verification result"); + return -1; + } + + printf(" Signature verified!\n"); + + /* Also verify using hardware (STSAFE) */ + printf(" Verifying signature using STSAFE hardware...\n"); + /* Restore devId for hardware verification */ + key.devId = g_devId; + ret = wc_ecc_verify_hash(sig, sigLen, digest, sizeof(digest), &verified, &key); + if (ret != 0) { + printf(" Error: wc_ecc_verify_hash (HW) failed: %d\n", ret); + wc_ecc_free(&key); + wc_FreeRng(&rng); + TEST_FAIL("ECDSA Brainpool P-256 verify HW"); + return -1; + } + + if (verified != 1) { + printf(" Error: Hardware signature verification failed\n"); + wc_ecc_free(&key); + wc_FreeRng(&rng); + TEST_FAIL("ECDSA Brainpool P-256 verification result HW"); + return -1; + } + + printf(" Hardware signature verified!\n"); + + wc_ecc_free(&key); + wc_FreeRng(&rng); + TEST_PASS("ECDSA Brainpool P-256 sign/verify"); + return 0; +} +#endif /* HAVE_ECC_BRAINPOOL && STSE_CONF_ECC_BRAINPOOL_P_256 */ + +/*----------------------------------------------------------------------------- + * Test: ECDSA Sign/Verify Brainpool P-384 with STSAFE-A120 + *---------------------------------------------------------------------------*/ +#if defined(HAVE_ECC_BRAINPOOL) && defined(STSE_CONF_ECC_BRAINPOOL_P_384) +static int test_ecdsa_brainpool_p384(void) +{ + ecc_key key; + WC_RNG rng; + int ret; + byte digest[48]; + byte sig[128]; + word32 sigLen = sizeof(sig); + int verified = 0; + int i; + + printf("\nTest: ECDSA Brainpool P-384 Sign/Verify with STSAFE-A120\n"); + + /* Initialize RNG */ + ret = wc_InitRng(&rng); + if (ret != 0) { + printf(" Error: wc_InitRng failed: %d\n", ret); + TEST_FAIL("ECDSA Brainpool P-384 RNG init"); + return -1; + } + + /* Create test digest */ + memset(digest, 0xCD, sizeof(digest)); + + ret = wc_ecc_init_ex(&key, NULL, g_devId); + if (ret != 0) { + printf(" Error: wc_ecc_init_ex failed: %d\n", ret); + wc_FreeRng(&rng); + TEST_FAIL("ECDSA Brainpool P-384 key init"); + return -1; + } + + /* Generate key pair using STSAFE */ + ret = wc_ecc_make_key_ex(&rng, 48, &key, ECC_BRAINPOOLP384R1); + if (ret != 0) { + printf(" Error: wc_ecc_make_key_ex failed: %d\n", ret); + wc_ecc_free(&key); + wc_FreeRng(&rng); + TEST_FAIL("ECDSA Brainpool P-384 key generation"); + return -1; + } + + printf(" Key pair generated.\n"); + + /* Sign the digest using STSAFE */ + ret = wc_ecc_sign_hash(digest, sizeof(digest), sig, &sigLen, &rng, &key); + if (ret != 0) { + printf(" Error: wc_ecc_sign_hash failed: %d\n", ret); + wc_ecc_free(&key); + wc_FreeRng(&rng); + TEST_FAIL("ECDSA Brainpool P-384 sign"); + return -1; + } + + printf(" Signature (%d bytes): ", sigLen); + for (i = 0; i < 8 && i < (int)sigLen; i++) printf("%02X", sig[i]); + printf("...\n"); + + /* Verify the signature using software (public key only, no hardware needed) */ + /* Clear devId to force software verification */ + key.devId = INVALID_DEVID; + ret = wc_ecc_verify_hash(sig, sigLen, digest, sizeof(digest), &verified, &key); + if (ret != 0) { + printf(" Error: wc_ecc_verify_hash failed: %d\n", ret); + wc_ecc_free(&key); + wc_FreeRng(&rng); + TEST_FAIL("ECDSA Brainpool P-384 verify"); + return -1; + } + + if (verified != 1) { + printf(" Error: Signature verification failed\n"); + wc_ecc_free(&key); + wc_FreeRng(&rng); + TEST_FAIL("ECDSA Brainpool P-384 verification result"); + return -1; + } + + printf(" Signature verified!\n"); + + /* Also verify using hardware (STSAFE) */ + printf(" Verifying signature using STSAFE hardware...\n"); + /* Restore devId for hardware verification */ + key.devId = g_devId; + ret = wc_ecc_verify_hash(sig, sigLen, digest, sizeof(digest), &verified, &key); + if (ret != 0) { + printf(" Error: wc_ecc_verify_hash (HW) failed: %d\n", ret); + wc_ecc_free(&key); + wc_FreeRng(&rng); + TEST_FAIL("ECDSA Brainpool P-384 verify HW"); + return -1; + } + + if (verified != 1) { + printf(" Error: Hardware signature verification failed\n"); + wc_ecc_free(&key); + wc_FreeRng(&rng); + TEST_FAIL("ECDSA Brainpool P-384 verification result HW"); + return -1; + } + + printf(" Hardware signature verified!\n"); + + wc_ecc_free(&key); + wc_FreeRng(&rng); + TEST_PASS("ECDSA Brainpool P-384 sign/verify"); + return 0; +} +#endif /* HAVE_ECC_BRAINPOOL && STSE_CONF_ECC_BRAINPOOL_P_384 */ + /*----------------------------------------------------------------------------- * Test: ECDHE P-256 Key Generation with STSAFE-A120 * Note: This tests ephemeral key generation using stse_generate_ECDHE_key_pair @@ -725,6 +1081,14 @@ int main(void) test_ecc_keygen_p384(); test_ecdsa_p256(); test_ecdsa_p384(); +#if defined(HAVE_ECC_BRAINPOOL) && defined(STSE_CONF_ECC_BRAINPOOL_P_256) + test_ecc_keygen_brainpool_p256(); + test_ecdsa_brainpool_p256(); +#endif +#if defined(HAVE_ECC_BRAINPOOL) && defined(STSE_CONF_ECC_BRAINPOOL_P_384) + test_ecc_keygen_brainpool_p384(); + test_ecdsa_brainpool_p384(); +#endif /* ECDHE tests */ test_ecdhe_keygen_p256();