Added tests for brainpool curves and proper macro checking

stsafe/Makefile

@@ -96,18 +96,16 @@ basic: $(TEST_SRC) $(PLATFORM_SRC)
 
 # wolfSSL crypto callback test build
 # Note: We compile stsafe.c directly since it's not built into libwolfssl by default
-# IMPORTANT: Use WOLFSSL_USE_OPTIONS_H to get options.h included for proper wolfSSL settings
+WOLFSSL_STSAFE_FLAGS = -DWOLFSSL_USER_SETTINGS -Wno-strict-prototypes
-# We add -DWOLFSSL_STSAFEA120 -DUSE_STSAFE_RNG_SEED to enable STSAFE in stsafe.c
-WOLFSSL_STSAFE_FLAGS = -DWOLFSSL_USE_OPTIONS_H -DWOLFSSL_STSAFEA120 -DUSE_STSAFE_RNG_SEED -Wno-strict-prototypes
 WOLFSSL_BASE_FLAGS = -Wall -Wextra -O2 -g
 wolfssl: $(WOLFSSL_TEST_SRC) $(PLATFORM_SRC) $(PLATFORM_CRYPTO_SRC)
-	$(CC) $(WOLFSSL_BASE_FLAGS) $(WOLFSSL_STSAFE_FLAGS) -I$(STSELIB_DIR) -I$(PLATFORM_DIR) -I$(WOLFSSL_DIR) \
+	$(CC) $(WOLFSSL_BASE_FLAGS) $(WOLFSSL_STSAFE_FLAGS) -I. -I$(STSELIB_DIR) -I$(PLATFORM_DIR) -I$(WOLFSSL_DIR) \
 		-c $(WOLFSSL_STSAFE_SRC) -o stsafe.o
-	$(CC) $(WOLFSSL_BASE_FLAGS) $(WOLFSSL_STSAFE_FLAGS) -I$(STSELIB_DIR) -I$(PLATFORM_DIR) -I$(WOLFSSL_DIR) \
+	$(CC) $(WOLFSSL_BASE_FLAGS) $(WOLFSSL_STSAFE_FLAGS) -I. -I$(STSELIB_DIR) -I$(PLATFORM_DIR) -I$(WOLFSSL_DIR) \
 		-c $(PLATFORM_SRC) -o stse_platform_linux.o
-	$(CC) $(WOLFSSL_BASE_FLAGS) $(WOLFSSL_STSAFE_FLAGS) -I$(STSELIB_DIR) -I$(PLATFORM_DIR) -I$(WOLFSSL_DIR) \
+	$(CC) $(WOLFSSL_BASE_FLAGS) $(WOLFSSL_STSAFE_FLAGS) -I. -I$(STSELIB_DIR) -I$(PLATFORM_DIR) -I$(WOLFSSL_DIR) \
 		-c $(PLATFORM_CRYPTO_SRC) -o stse_platform_crypto.o
-	$(CC) $(WOLFSSL_BASE_FLAGS) $(WOLFSSL_STSAFE_FLAGS) -I$(STSELIB_DIR) -I$(PLATFORM_DIR) -I$(WOLFSSL_DIR) \
+	$(CC) $(WOLFSSL_BASE_FLAGS) $(WOLFSSL_STSAFE_FLAGS) -I. -I$(STSELIB_DIR) -I$(PLATFORM_DIR) -I$(WOLFSSL_DIR) \
 		-o $(WOLFSSL_TARGET) \
 		$(WOLFSSL_TEST_SRC) \
 		stse_platform_linux.o stse_platform_crypto.o stsafe.o \
@@ -125,13 +123,13 @@ test-wolfssl: wolfssl
 
 # Full wolfSSL integration test with ECDH and benchmarks
 wolfssl-full: $(WOLFSSL_FULL_TEST_SRC) $(PLATFORM_SRC) $(PLATFORM_CRYPTO_SRC)
-	$(CC) $(WOLFSSL_BASE_FLAGS) $(WOLFSSL_STSAFE_FLAGS) -I$(STSELIB_DIR) -I$(PLATFORM_DIR) -I$(WOLFSSL_DIR) \
+	$(CC) $(WOLFSSL_BASE_FLAGS) $(WOLFSSL_STSAFE_FLAGS) -I. -I$(STSELIB_DIR) -I$(PLATFORM_DIR) -I$(WOLFSSL_DIR) \
 		-c $(WOLFSSL_STSAFE_SRC) -o stsafe.o
-	$(CC) $(WOLFSSL_BASE_FLAGS) $(WOLFSSL_STSAFE_FLAGS) -I$(STSELIB_DIR) -I$(PLATFORM_DIR) -I$(WOLFSSL_DIR) \
+	$(CC) $(WOLFSSL_BASE_FLAGS) $(WOLFSSL_STSAFE_FLAGS) -I. -I$(STSELIB_DIR) -I$(PLATFORM_DIR) -I$(WOLFSSL_DIR) \
 		-c $(PLATFORM_SRC) -o stse_platform_linux.o
-	$(CC) $(WOLFSSL_BASE_FLAGS) $(WOLFSSL_STSAFE_FLAGS) -I$(STSELIB_DIR) -I$(PLATFORM_DIR) -I$(WOLFSSL_DIR) \
+	$(CC) $(WOLFSSL_BASE_FLAGS) $(WOLFSSL_STSAFE_FLAGS) -I. -I$(STSELIB_DIR) -I$(PLATFORM_DIR) -I$(WOLFSSL_DIR) \
 		-c $(PLATFORM_CRYPTO_SRC) -o stse_platform_crypto.o
-	$(CC) $(WOLFSSL_BASE_FLAGS) $(WOLFSSL_STSAFE_FLAGS) -I$(STSELIB_DIR) -I$(PLATFORM_DIR) -I$(WOLFSSL_DIR) \
+	$(CC) $(WOLFSSL_BASE_FLAGS) $(WOLFSSL_STSAFE_FLAGS) -I. -I$(STSELIB_DIR) -I$(PLATFORM_DIR) -I$(WOLFSSL_DIR) \
 		-o $(WOLFSSL_FULL_TARGET) \
 		$(WOLFSSL_FULL_TEST_SRC) \
 		stse_platform_linux.o stse_platform_crypto.o stsafe.o \

stsafe/platform/stse_conf.h

@@ -41,6 +41,8 @@ extern "C" {
 /* STSAFE-A ECC services configuration - enable P-256 and P-384 for wolfSSL */
 #define STSE_CONF_ECC_NIST_P_256
 #define STSE_CONF_ECC_NIST_P_384
+//#define STSE_CONF_ECC_BRAINPOOL_P_256
+//#define STSE_CONF_ECC_BRAINPOOL_P_384
 
 /* STSAFE-A HASH services configuration */
 #define STSE_CONF_HASH_SHA_256

stsafe/user_settings.h

@@ -67,6 +67,10 @@ extern "C" {
 #undef NO_ECC256               /* Enable P-256 */
 #define HAVE_ECC384            /* Enable P-384 */
 #define ECC_TIMING_RESISTANT
+/* Brainpool curves require WOLFSSL_CUSTOM_CURVES */
+#define WOLFSSL_CUSTOM_CURVES
+#define HAVE_ECC_BRAINPOOL
+#define HAVE_ECC_CDH
 
 /* ECC key import/export functions */
 #define WOLFSSL_PUBLIC_MP      /* For mp_int access in ECC verify */

stsafe/wolfssl_stsafe_full_test.c

@@ -1,7 +1,7 @@
 /* wolfssl_stsafe_full_test.c
  *
  * Comprehensive wolfSSL integration tests with STSAFE-A120
- * Tests: RNG, ECC KeyGen, ECDSA Sign/Verify, ECDH, Benchmarks
+ * Tests: RNG, ECC KeyGen, ECDSA Sign/Verify, ECDH, Benchmarks, Brainpool curves
  *
  * Copyright (C) 2006-2026 wolfSSL Inc.
  *
@@ -353,6 +353,200 @@ static int test_ecdh_p256(void)
     return 0;
 }
 
+/*-----------------------------------------------------------------------------
+ * Test: ECDSA Brainpool P-256 Benchmark
+ *---------------------------------------------------------------------------*/
+#if defined(HAVE_ECC_BRAINPOOL) && defined(STSE_CONF_ECC_BRAINPOOL_P_256)
+static int test_ecdsa_brainpool_p256_benchmark(void)
+{
+    ecc_key key;
+    WC_RNG rng;
+    int ret;
+    byte digest[32];
+    byte sig[128];
+    word32 sigLen;
+    int verified = 0;
+    int iterations = 10;
+    double start, end, elapsed;
+    int i;
+
+    printf("\nTest: ECDSA Brainpool P-256 Benchmark (STSAFE-A120)\n");
+
+    ret = wc_InitRng(&rng);
+    if (ret != 0) {
+        printf("  Error: wc_InitRng failed: %d\n", ret);
+        TEST_FAIL("ECDSA Brainpool P-256 benchmark RNG init");
+        return -1;
+    }
+
+    memset(digest, 0xAB, sizeof(digest));
+
+    ret = wc_ecc_init_ex(&key, NULL, g_devId);
+    if (ret != 0) {
+        printf("  Error: wc_ecc_init_ex failed: %d\n", ret);
+        wc_FreeRng(&rng);
+        TEST_FAIL("ECDSA Brainpool P-256 benchmark key init");
+        return -1;
+    }
+
+    /* Benchmark key generation */
+    start = get_time_us();
+    ret = wc_ecc_make_key_ex(&rng, 32, &key, ECC_BRAINPOOLP256R1);
+    end = get_time_us();
+    elapsed = (end - start) / 1000.0;
+
+    if (ret != 0) {
+        printf("  Error: wc_ecc_make_key_ex failed: %d\n", ret);
+        wc_ecc_free(&key);
+        wc_FreeRng(&rng);
+        TEST_FAIL("ECDSA Brainpool P-256 keygen");
+        return -1;
+    }
+    printf("  Key generation: %.2f ms\n", elapsed);
+
+    /* Benchmark signing */
+    start = get_time_us();
+    for (i = 0; i < iterations; i++) {
+        sigLen = sizeof(sig);
+        ret = wc_ecc_sign_hash(digest, sizeof(digest), sig, &sigLen, &rng, &key);
+        if (ret != 0) break;
+    }
+    end = get_time_us();
+    elapsed = (end - start) / 1000.0;
+
+    if (ret != 0) {
+        printf("  Error: wc_ecc_sign_hash failed: %d\n", ret);
+        wc_ecc_free(&key);
+        wc_FreeRng(&rng);
+        TEST_FAIL("ECDSA Brainpool P-256 sign");
+        return -1;
+    }
+    printf("  Signing: %d ops in %.2f ms (%.2f ops/sec)\n",
+           iterations, elapsed, iterations / (elapsed / 1000.0));
+
+    /* Benchmark verification */
+    start = get_time_us();
+    for (i = 0; i < iterations; i++) {
+        ret = wc_ecc_verify_hash(sig, sigLen, digest, sizeof(digest), &verified, &key);
+        if (ret != 0 || verified != 1) break;
+    }
+    end = get_time_us();
+    elapsed = (end - start) / 1000.0;
+
+    if (ret != 0 || verified != 1) {
+        printf("  Error: wc_ecc_verify_hash failed: %d, verified=%d\n", ret, verified);
+        wc_ecc_free(&key);
+        wc_FreeRng(&rng);
+        TEST_FAIL("ECDSA Brainpool P-256 verify");
+        return -1;
+    }
+    printf("  Verification: %d ops in %.2f ms (%.2f ops/sec)\n",
+           iterations, elapsed, iterations / (elapsed / 1000.0));
+
+    wc_ecc_free(&key);
+    wc_FreeRng(&rng);
+    TEST_PASS("ECDSA Brainpool P-256 benchmark");
+    return 0;
+}
+#endif /* HAVE_ECC_BRAINPOOL && STSE_CONF_ECC_BRAINPOOL_P_256 */
+
+/*-----------------------------------------------------------------------------
+ * Test: ECDSA Brainpool P-384 Benchmark
+ *---------------------------------------------------------------------------*/
+#if defined(HAVE_ECC_BRAINPOOL) && defined(STSE_CONF_ECC_BRAINPOOL_P_384)
+static int test_ecdsa_brainpool_p384_benchmark(void)
+{
+    ecc_key key;
+    WC_RNG rng;
+    int ret;
+    byte digest[48];
+    byte sig[128];
+    word32 sigLen;
+    int verified = 0;
+    int iterations = 10;
+    double start, end, elapsed;
+    int i;
+
+    printf("\nTest: ECDSA Brainpool P-384 Benchmark (STSAFE-A120)\n");
+
+    ret = wc_InitRng(&rng);
+    if (ret != 0) {
+        printf("  Error: wc_InitRng failed: %d\n", ret);
+        TEST_FAIL("ECDSA Brainpool P-384 benchmark RNG init");
+        return -1;
+    }
+
+    memset(digest, 0xCD, sizeof(digest));
+
+    ret = wc_ecc_init_ex(&key, NULL, g_devId);
+    if (ret != 0) {
+        printf("  Error: wc_ecc_init_ex failed: %d\n", ret);
+        wc_FreeRng(&rng);
+        TEST_FAIL("ECDSA Brainpool P-384 benchmark key init");
+        return -1;
+    }
+
+    /* Benchmark key generation */
+    start = get_time_us();
+    ret = wc_ecc_make_key_ex(&rng, 48, &key, ECC_BRAINPOOLP384R1);
+    end = get_time_us();
+    elapsed = (end - start) / 1000.0;
+
+    if (ret != 0) {
+        printf("  Error: wc_ecc_make_key_ex failed: %d\n", ret);
+        wc_ecc_free(&key);
+        wc_FreeRng(&rng);
+        TEST_FAIL("ECDSA Brainpool P-384 keygen");
+        return -1;
+    }
+    printf("  Key generation: %.2f ms\n", elapsed);
+
+    /* Benchmark signing */
+    start = get_time_us();
+    for (i = 0; i < iterations; i++) {
+        sigLen = sizeof(sig);
+        ret = wc_ecc_sign_hash(digest, sizeof(digest), sig, &sigLen, &rng, &key);
+        if (ret != 0) break;
+    }
+    end = get_time_us();
+    elapsed = (end - start) / 1000.0;
+
+    if (ret != 0) {
+        printf("  Error: wc_ecc_sign_hash failed: %d\n", ret);
+        wc_ecc_free(&key);
+        wc_FreeRng(&rng);
+        TEST_FAIL("ECDSA Brainpool P-384 sign");
+        return -1;
+    }
+    printf("  Signing: %d ops in %.2f ms (%.2f ops/sec)\n",
+           iterations, elapsed, iterations / (elapsed / 1000.0));
+
+    /* Benchmark verification */
+    start = get_time_us();
+    for (i = 0; i < iterations; i++) {
+        ret = wc_ecc_verify_hash(sig, sigLen, digest, sizeof(digest), &verified, &key);
+        if (ret != 0 || verified != 1) break;
+    }
+    end = get_time_us();
+    elapsed = (end - start) / 1000.0;
+
+    if (ret != 0 || verified != 1) {
+        printf("  Error: wc_ecc_verify_hash failed: %d, verified=%d\n", ret, verified);
+        wc_ecc_free(&key);
+        wc_FreeRng(&rng);
+        TEST_FAIL("ECDSA Brainpool P-384 verify");
+        return -1;
+    }
+    printf("  Verification: %d ops in %.2f ms (%.2f ops/sec)\n",
+           iterations, elapsed, iterations / (elapsed / 1000.0));
+
+    wc_ecc_free(&key);
+    wc_FreeRng(&rng);
+    TEST_PASS("ECDSA Brainpool P-384 benchmark");
+    return 0;
+}
+#endif /* HAVE_ECC_BRAINPOOL && STSE_CONF_ECC_BRAINPOOL_P_384 */
+
 /*-----------------------------------------------------------------------------
  * Test: Multiple Key Slots
  *---------------------------------------------------------------------------*/
@@ -479,6 +673,12 @@ int main(void)
     /* Run tests */
     test_rng_benchmark();
     test_ecdsa_p256_benchmark();
+#if defined(HAVE_ECC_BRAINPOOL) && defined(STSE_CONF_ECC_BRAINPOOL_P_256)
+    test_ecdsa_brainpool_p256_benchmark();
+#endif
+#if defined(HAVE_ECC_BRAINPOOL) && defined(STSE_CONF_ECC_BRAINPOOL_P_384)
+    test_ecdsa_brainpool_p384_benchmark();
+#endif
 
     /* ECDH test - now uses ECDHE ephemeral keys */
     test_ecdh_p256();

stsafe/wolfssl_stsafe_test.c

@@ -1,7 +1,7 @@
 /* wolfssl_stsafe_test.c
  *
  * Test wolfSSL crypto callbacks with STSAFE-A120
- * Tests: RNG, ECC P-256, ECC P-384, ECDSA Sign/Verify
+ * Tests: RNG, ECC P-256, ECC P-384, ECDSA Sign/Verify, Brainpool curves
  *
  * Copyright (C) 2006-2026 wolfSSL Inc.
  *
@@ -436,6 +436,362 @@ static int test_ecdsa_p384(void)
     return 0;
 }
 
+/*-----------------------------------------------------------------------------
+ * Test: ECC Brainpool P-256 Key Generation with STSAFE-A120
+ *---------------------------------------------------------------------------*/
+#if defined(HAVE_ECC_BRAINPOOL) && defined(STSE_CONF_ECC_BRAINPOOL_P_256)
+static int test_ecc_keygen_brainpool_p256(void)
+{
+    ecc_key key;
+    WC_RNG rng;
+    int ret;
+    byte pubX[32], pubY[32];
+    word32 pubX_len = sizeof(pubX), pubY_len = sizeof(pubY);
+    int i;
+
+    printf("\nTest: ECC Brainpool P-256 Key Generation with STSAFE-A120\n");
+
+    ret = wc_InitRng(&rng);
+    if (ret != 0) {
+        printf("  Error: wc_InitRng failed: %d\n", ret);
+        TEST_FAIL("ECC Brainpool P-256 RNG init");
+        return -1;
+    }
+
+    ret = wc_ecc_init_ex(&key, NULL, g_devId);
+    if (ret != 0) {
+        printf("  Error: wc_ecc_init_ex failed: %d\n", ret);
+        wc_FreeRng(&rng);
+        TEST_FAIL("ECC Brainpool P-256 init");
+        return -1;
+    }
+
+    /* Generate Brainpool P-256 key pair - should use STSAFE via crypto callback */
+    ret = wc_ecc_make_key_ex(&rng, 32, &key, ECC_BRAINPOOLP256R1);
+    if (ret != 0) {
+        printf("  Error: wc_ecc_make_key_ex failed: %d\n", ret);
+        wc_ecc_free(&key);
+        wc_FreeRng(&rng);
+        TEST_FAIL("ECC Brainpool P-256 key generation");
+        return -1;
+    }
+
+    /* Export public key */
+    ret = wc_ecc_export_public_raw(&key, pubX, &pubX_len, pubY, &pubY_len);
+    if (ret != 0) {
+        printf("  Error: wc_ecc_export_public_raw failed: %d\n", ret);
+        wc_ecc_free(&key);
+        wc_FreeRng(&rng);
+        TEST_FAIL("ECC Brainpool P-256 export public key");
+        return -1;
+    }
+
+    printf("  Public Key X: ");
+    for (i = 0; i < 8; i++) printf("%02X", pubX[i]);
+    printf("...\n");
+    printf("  Public Key Y: ");
+    for (i = 0; i < 8; i++) printf("%02X", pubY[i]);
+    printf("...\n");
+
+    wc_ecc_free(&key);
+    wc_FreeRng(&rng);
+    TEST_PASS("ECC Brainpool P-256 key generation");
+    return 0;
+}
+#endif /* HAVE_ECC_BRAINPOOL && STSE_CONF_ECC_BRAINPOOL_P_256 */
+
+/*-----------------------------------------------------------------------------
+ * Test: ECC Brainpool P-384 Key Generation with STSAFE-A120
+ *---------------------------------------------------------------------------*/
+#if defined(HAVE_ECC_BRAINPOOL) && defined(STSE_CONF_ECC_BRAINPOOL_P_384)
+static int test_ecc_keygen_brainpool_p384(void)
+{
+    ecc_key key;
+    WC_RNG rng;
+    int ret;
+    byte pubX[48], pubY[48];
+    word32 pubX_len = sizeof(pubX), pubY_len = sizeof(pubY);
+    int i;
+
+    printf("\nTest: ECC Brainpool P-384 Key Generation with STSAFE-A120\n");
+
+    ret = wc_InitRng(&rng);
+    if (ret != 0) {
+        printf("  Error: wc_InitRng failed: %d\n", ret);
+        TEST_FAIL("ECC Brainpool P-384 RNG init");
+        return -1;
+    }
+
+    ret = wc_ecc_init_ex(&key, NULL, g_devId);
+    if (ret != 0) {
+        printf("  Error: wc_ecc_init_ex failed: %d\n", ret);
+        wc_FreeRng(&rng);
+        TEST_FAIL("ECC Brainpool P-384 init");
+        return -1;
+    }
+
+    /* Generate Brainpool P-384 key pair - should use STSAFE via crypto callback */
+    ret = wc_ecc_make_key_ex(&rng, 48, &key, ECC_BRAINPOOLP384R1);
+    if (ret != 0) {
+        printf("  Error: wc_ecc_make_key_ex failed: %d\n", ret);
+        wc_ecc_free(&key);
+        wc_FreeRng(&rng);
+        TEST_FAIL("ECC Brainpool P-384 key generation");
+        return -1;
+    }
+
+    /* Export public key */
+    ret = wc_ecc_export_public_raw(&key, pubX, &pubX_len, pubY, &pubY_len);
+    if (ret != 0) {
+        printf("  Error: wc_ecc_export_public_raw failed: %d\n", ret);
+        wc_ecc_free(&key);
+        wc_FreeRng(&rng);
+        TEST_FAIL("ECC Brainpool P-384 export public key");
+        return -1;
+    }
+
+    printf("  Public Key X: ");
+    for (i = 0; i < 8; i++) printf("%02X", pubX[i]);
+    printf("...\n");
+    printf("  Public Key Y: ");
+    for (i = 0; i < 8; i++) printf("%02X", pubY[i]);
+    printf("...\n");
+
+    wc_ecc_free(&key);
+    wc_FreeRng(&rng);
+    TEST_PASS("ECC Brainpool P-384 key generation");
+    return 0;
+}
+#endif /* HAVE_ECC_BRAINPOOL && STSE_CONF_ECC_BRAINPOOL_P_384 */
+
+/*-----------------------------------------------------------------------------
+ * Test: ECDSA Sign/Verify Brainpool P-256 with STSAFE-A120
+ *---------------------------------------------------------------------------*/
+#if defined(HAVE_ECC_BRAINPOOL) && defined(STSE_CONF_ECC_BRAINPOOL_P_256)
+static int test_ecdsa_brainpool_p256(void)
+{
+    ecc_key key;
+    WC_RNG rng;
+    int ret;
+    byte digest[32];
+    byte sig[128];
+    word32 sigLen = sizeof(sig);
+    int verified = 0;
+    int i;
+
+    printf("\nTest: ECDSA Brainpool P-256 Sign/Verify with STSAFE-A120\n");
+
+    /* Initialize RNG */
+    ret = wc_InitRng(&rng);
+    if (ret != 0) {
+        printf("  Error: wc_InitRng failed: %d\n", ret);
+        TEST_FAIL("ECDSA Brainpool P-256 RNG init");
+        return -1;
+    }
+
+    /* Create test digest */
+    memset(digest, 0xAB, sizeof(digest));
+
+    ret = wc_ecc_init_ex(&key, NULL, g_devId);
+    if (ret != 0) {
+        printf("  Error: wc_ecc_init_ex failed: %d\n", ret);
+        wc_FreeRng(&rng);
+        TEST_FAIL("ECDSA Brainpool P-256 key init");
+        return -1;
+    }
+
+    /* Generate key pair using STSAFE */
+    ret = wc_ecc_make_key_ex(&rng, 32, &key, ECC_BRAINPOOLP256R1);
+    if (ret != 0) {
+        printf("  Error: wc_ecc_make_key_ex failed: %d\n", ret);
+        wc_ecc_free(&key);
+        wc_FreeRng(&rng);
+        TEST_FAIL("ECDSA Brainpool P-256 key generation");
+        return -1;
+    }
+
+    printf("  Key pair generated.\n");
+
+    /* Sign the digest using STSAFE */
+    ret = wc_ecc_sign_hash(digest, sizeof(digest), sig, &sigLen, &rng, &key);
+    if (ret != 0) {
+        printf("  Error: wc_ecc_sign_hash failed: %d\n", ret);
+        wc_ecc_free(&key);
+        wc_FreeRng(&rng);
+        TEST_FAIL("ECDSA Brainpool P-256 sign");
+        return -1;
+    }
+
+    printf("  Signature (%d bytes): ", sigLen);
+    for (i = 0; i < 8 && i < (int)sigLen; i++) printf("%02X", sig[i]);
+    printf("...\n");
+
+    /* Verify the signature using software (public key only, no hardware needed) */
+    /* Clear devId to force software verification */
+    key.devId = INVALID_DEVID;
+    ret = wc_ecc_verify_hash(sig, sigLen, digest, sizeof(digest), &verified, &key);
+    if (ret != 0) {
+        printf("  Error: wc_ecc_verify_hash failed: %d\n", ret);
+        wc_ecc_free(&key);
+        wc_FreeRng(&rng);
+        TEST_FAIL("ECDSA Brainpool P-256 verify");
+        return -1;
+    }
+
+    if (verified != 1) {
+        printf("  Error: Signature verification failed\n");
+        wc_ecc_free(&key);
+        wc_FreeRng(&rng);
+        TEST_FAIL("ECDSA Brainpool P-256 verification result");
+        return -1;
+    }
+
+    printf("  Signature verified!\n");
+
+    /* Also verify using hardware (STSAFE) */
+    printf("  Verifying signature using STSAFE hardware...\n");
+    /* Restore devId for hardware verification */
+    key.devId = g_devId;
+    ret = wc_ecc_verify_hash(sig, sigLen, digest, sizeof(digest), &verified, &key);
+    if (ret != 0) {
+        printf("  Error: wc_ecc_verify_hash (HW) failed: %d\n", ret);
+        wc_ecc_free(&key);
+        wc_FreeRng(&rng);
+        TEST_FAIL("ECDSA Brainpool P-256 verify HW");
+        return -1;
+    }
+
+    if (verified != 1) {
+        printf("  Error: Hardware signature verification failed\n");
+        wc_ecc_free(&key);
+        wc_FreeRng(&rng);
+        TEST_FAIL("ECDSA Brainpool P-256 verification result HW");
+        return -1;
+    }
+
+    printf("  Hardware signature verified!\n");
+
+    wc_ecc_free(&key);
+    wc_FreeRng(&rng);
+    TEST_PASS("ECDSA Brainpool P-256 sign/verify");
+    return 0;
+}
+#endif /* HAVE_ECC_BRAINPOOL && STSE_CONF_ECC_BRAINPOOL_P_256 */
+
+/*-----------------------------------------------------------------------------
+ * Test: ECDSA Sign/Verify Brainpool P-384 with STSAFE-A120
+ *---------------------------------------------------------------------------*/
+#if defined(HAVE_ECC_BRAINPOOL) && defined(STSE_CONF_ECC_BRAINPOOL_P_384)
+static int test_ecdsa_brainpool_p384(void)
+{
+    ecc_key key;
+    WC_RNG rng;
+    int ret;
+    byte digest[48];
+    byte sig[128];
+    word32 sigLen = sizeof(sig);
+    int verified = 0;
+    int i;
+
+    printf("\nTest: ECDSA Brainpool P-384 Sign/Verify with STSAFE-A120\n");
+
+    /* Initialize RNG */
+    ret = wc_InitRng(&rng);
+    if (ret != 0) {
+        printf("  Error: wc_InitRng failed: %d\n", ret);
+        TEST_FAIL("ECDSA Brainpool P-384 RNG init");
+        return -1;
+    }
+
+    /* Create test digest */
+    memset(digest, 0xCD, sizeof(digest));
+
+    ret = wc_ecc_init_ex(&key, NULL, g_devId);
+    if (ret != 0) {
+        printf("  Error: wc_ecc_init_ex failed: %d\n", ret);
+        wc_FreeRng(&rng);
+        TEST_FAIL("ECDSA Brainpool P-384 key init");
+        return -1;
+    }
+
+    /* Generate key pair using STSAFE */
+    ret = wc_ecc_make_key_ex(&rng, 48, &key, ECC_BRAINPOOLP384R1);
+    if (ret != 0) {
+        printf("  Error: wc_ecc_make_key_ex failed: %d\n", ret);
+        wc_ecc_free(&key);
+        wc_FreeRng(&rng);
+        TEST_FAIL("ECDSA Brainpool P-384 key generation");
+        return -1;
+    }
+
+    printf("  Key pair generated.\n");
+
+    /* Sign the digest using STSAFE */
+    ret = wc_ecc_sign_hash(digest, sizeof(digest), sig, &sigLen, &rng, &key);
+    if (ret != 0) {
+        printf("  Error: wc_ecc_sign_hash failed: %d\n", ret);
+        wc_ecc_free(&key);
+        wc_FreeRng(&rng);
+        TEST_FAIL("ECDSA Brainpool P-384 sign");
+        return -1;
+    }
+
+    printf("  Signature (%d bytes): ", sigLen);
+    for (i = 0; i < 8 && i < (int)sigLen; i++) printf("%02X", sig[i]);
+    printf("...\n");
+
+    /* Verify the signature using software (public key only, no hardware needed) */
+    /* Clear devId to force software verification */
+    key.devId = INVALID_DEVID;
+    ret = wc_ecc_verify_hash(sig, sigLen, digest, sizeof(digest), &verified, &key);
+    if (ret != 0) {
+        printf("  Error: wc_ecc_verify_hash failed: %d\n", ret);
+        wc_ecc_free(&key);
+        wc_FreeRng(&rng);
+        TEST_FAIL("ECDSA Brainpool P-384 verify");
+        return -1;
+    }
+
+    if (verified != 1) {
+        printf("  Error: Signature verification failed\n");
+        wc_ecc_free(&key);
+        wc_FreeRng(&rng);
+        TEST_FAIL("ECDSA Brainpool P-384 verification result");
+        return -1;
+    }
+
+    printf("  Signature verified!\n");
+
+    /* Also verify using hardware (STSAFE) */
+    printf("  Verifying signature using STSAFE hardware...\n");
+    /* Restore devId for hardware verification */
+    key.devId = g_devId;
+    ret = wc_ecc_verify_hash(sig, sigLen, digest, sizeof(digest), &verified, &key);
+    if (ret != 0) {
+        printf("  Error: wc_ecc_verify_hash (HW) failed: %d\n", ret);
+        wc_ecc_free(&key);
+        wc_FreeRng(&rng);
+        TEST_FAIL("ECDSA Brainpool P-384 verify HW");
+        return -1;
+    }
+
+    if (verified != 1) {
+        printf("  Error: Hardware signature verification failed\n");
+        wc_ecc_free(&key);
+        wc_FreeRng(&rng);
+        TEST_FAIL("ECDSA Brainpool P-384 verification result HW");
+        return -1;
+    }
+
+    printf("  Hardware signature verified!\n");
+
+    wc_ecc_free(&key);
+    wc_FreeRng(&rng);
+    TEST_PASS("ECDSA Brainpool P-384 sign/verify");
+    return 0;
+}
+#endif /* HAVE_ECC_BRAINPOOL && STSE_CONF_ECC_BRAINPOOL_P_384 */
+
 /*-----------------------------------------------------------------------------
  * Test: ECDHE P-256 Key Generation with STSAFE-A120
  * Note: This tests ephemeral key generation using stse_generate_ECDHE_key_pair
@@ -725,6 +1081,14 @@ int main(void)
     test_ecc_keygen_p384();
     test_ecdsa_p256();
     test_ecdsa_p384();
+#if defined(HAVE_ECC_BRAINPOOL) && defined(STSE_CONF_ECC_BRAINPOOL_P_256)
+    test_ecc_keygen_brainpool_p256();
+    test_ecdsa_brainpool_p256();
+#endif
+#if defined(HAVE_ECC_BRAINPOOL) && defined(STSE_CONF_ECC_BRAINPOOL_P_384)
+    test_ecc_keygen_brainpool_p384();
+    test_ecdsa_brainpool_p384();
+#endif
 
     /* ECDHE tests */
     test_ecdhe_keygen_p256();