WolfSSL
/
wolfssl-examples
mirror of https://github.com/wolfSSL/wolfssl-examples.git
1
0
Fork 0
Code Issues Releases Wiki Activity

Merge pull request #392 from billphipps/add_vaultic 

Add CryptoCB support for Wisekey VaultIC420
pull/398/head
JacobBarthelmeh 2023-08-23 14:03:20 -06:00 committed by GitHub
parent 7d373b14fe 2ad6723d26
commit a633d60b83
No known key found for this signature in database
GPG Key ID: 4AEE18F83AFDEB23
15 changed files with 1992 additions and 104 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

6
.gitignore vendored
View File

@ -319,5 +319,7 @@ tpm/evp_tpm
/ESP32/**/*.sln
# auto-created CMake backups
**/CMakeLists.txt.old
**/CMakeLists.txt.old
# MacOS
.DS_Store

83
android/wolfssljni-ndk-gradle/app/CMakeLists.txt
View File

@ -60,14 +60,15 @@ if ("${WOLFSSL_PKG_TYPE}" MATCHES "normal")
-DTFM_TIMING_RESISTANT -DECC_TIMING_RESISTANT
-DHAVE_AESGCM -DSIZEOF_LONG=4 -DSIZEOF_LONG_LONG=8
# Defines added for debugging. These can be removed if debug logging is not needed
# and will increase performance and reduce library footprint size if removed.
-DEBUG_WOLFSSL
# Defines added for wolfCrypt test and benchmark only, may not be needed for your
# own application.
-DUSE_CERT_BUFFERS_2048 -DUSE_CERT_BUFFERS_256 -DNO_WRITE_TEMP_FILES
-DNO_FILESYSTEM -DNO_MAIN_DRIVER
# Defines added for debugging. These can be removed if debug logging is not needed
# and will increase performance and reduce library footprint size if removed.
-DEBUG_WOLFSSL)
)
elseif("${WOLFSSL_PKG_TYPE}" MATCHES "fipsready")
# Add preprocessor defines to CFLAGS, these match those placed into
@ -116,7 +117,8 @@ elseif("${WOLFSSL_PKG_TYPE}" MATCHES "fipsready")
# Below options are added only for wolfCrypt test and benchmark applications.
# These can be left off / removed when integrating into a real-world application.
-DNO_FILESYSTEM -DUSE_CERT_BUFFERS_2048 -DUSE_CERT_BUFFERS_256
-DNO_WRITE_TEMP_FILES -DNO_MAIN_DRIVER)
-DNO_WRITE_TEMP_FILES -DNO_MAIN_DRIVER
)
endif()
if ("$WOLFSSL_MATH_LIB" MATCHES "fastmath")
@ -150,6 +152,9 @@ aux_source_directory(${wolfssl_DIR}/src TLS_SOURCES)
list(REMOVE_ITEM TLS_SOURCES ${wolfssl_DIR}/src/bio.c)
list(REMOVE_ITEM TLS_SOURCES ${wolfssl_DIR}/src/conf.c)
list(REMOVE_ITEM TLS_SOURCES ${wolfssl_DIR}/src/pk.c)
list(REMOVE_ITEM TLS_SOURCES ${wolfssl_DIR}/src/ssl_bn.c)
list(REMOVE_ITEM TLS_SOURCES ${wolfssl_DIR}/src/ssl_asn1.c)
list(REMOVE_ITEM TLS_SOURCES ${wolfssl_DIR}/src/ssl_certman.c)
list(REMOVE_ITEM TLS_SOURCES ${wolfssl_DIR}/src/ssl_misc.c)
list(REMOVE_ITEM TLS_SOURCES ${wolfssl_DIR}/src/x509.c)
list(REMOVE_ITEM TLS_SOURCES ${wolfssl_DIR}/src/x509_str.c)
@ -264,3 +269,71 @@ target_link_libraries(
wolfssljni
wolfssl
)
# --------------------------- wolfCrypt CryptoCb Source Files --------------------------------------
# set which cryptocb subsystem (if any) will be used
set(WOLFSSL_CRYPTOCB_TYPE "")
#set(WOLFSSL_CRYPTOCB_TYPE "ccb_vaultic")
# Support for ccb_vaultic
if("${WOLFSSL_CRYPTOCB_TYPE}" MATCHES "ccb_vaultic")
set(cryptocb_DIR ${CMAKE_SOURCE_DIR}/../../../ccb_vaultic)
add_definitions (
-DWOLF_CRYPTO_CB -DWOLF_CRYPTO_CB_CMD
)
include_directories(
${cryptocb_DIR}
)
add_library(ccbvaultic SHARED
${cryptocb_DIR}/ccb_vaultic.c)
# TODO Add support for other architectures
if("${ANDROID_ABI}" MATCHES "arm64-v8a")
add_definitions(
-DHAVE_CCBVAULTIC -DWC_USE_DEVID=0x56490420 -DBENCH_EMBEDDED
#-DCCBVAULTIC_NO_AES
#-DCCBVAULTIC_NO_RSA
-DCCBVAULTIC_NO_SHA
#-DCCBVAULTIC_DEBUG
#-DCCBVAULTIC_DEBUG_TIMING
)
set(VAULTIC_DIR ${cryptocb_DIR}/VaultIC-TLS_420/vaultic_tls-4xx)
set(VAULTIC_CHIP 420)
set(CHIP_TARGET TARGETCHIP_VAULTIC_${VAULTIC_CHIP})
add_definitions ( -D${CHIP_TARGET} -DUSE_SPI )
set(VAULTIC_ELIB ${VAULTIC_DIR}/VaultIC-Elib_${VAULTIC_CHIP}/src )
include_directories(
${VAULTIC_ELIB}/common
${VAULTIC_ELIB}/device/vaultic_4XX_family
)
SET(VAULTIC_TLS ${VAULTIC_DIR}/lib/VaultIC_420_TLS_Lib/target/raspberry/dist)
include_directories(
${VAULTIC_TLS}
)
# Select whether to use the debug or release static hardware library
#SET(VAULTIC_TLS_LIB ${VAULTIC_TLS}/VaultIC_420_TLS_Lib-SPI-Debug/libvaultic420_tls.a)
SET(VAULTIC_TLS_LIB ${VAULTIC_TLS}/VaultIC_420_TLS_Lib-SPI-Release/libvaultic420_tls.a)
# Link ccbvaultic to static hardware library
target_link_libraries(
ccbvaultic
PRIVATE ${VAULTIC_TLS_LIB}
)
endif() #arm64-v8a
# Link ccbvaultic to wolfssl and log
target_link_libraries(
ccbvaultic
PUBLIC wolfssl
PUBLIC ${lib-log}
)
# Link wolfssljni to ccbvaultic
target_link_libraries(
wolfssljni
ccbvaultic
)
endif() #ccb_vaultic

2
android/wolfssljni-ndk-gradle/app/build.gradle
View File

@ -5,6 +5,7 @@ android {
defaultConfig {
applicationId "com.wolfssl.wolfssl_ndk_gradle"
minSdkVersion 30
//noinspection ExpiredTargetSdkVersion
targetSdkVersion 30
versionCode 1
versionName "1.0"
@ -19,6 +20,7 @@ android {
release {
minifyEnabled false
proguardFiles getDefaultProguardFile('proguard-android.txt'), 'proguard-rules.pro'
signingConfig signingConfigs.debug
}
}
externalNativeBuild {

52
android/wolfssljni-ndk-gradle/app/src/main/cpp/NativeHelper.c
View File

@ -24,15 +24,49 @@
#include <wolfcrypt/test/test.h>
#include <wolfcrypt/benchmark/benchmark.h>
JNIEXPORT jint JNICALL
Java_com_wolfssl_wolfssljni_1ndk_1gradle_MainActivity_testWolfCrypt(JNIEnv *env, jobject thiz) {
int ret;
#if defined(WOLF_CRYPTO_CB)
#if defined(HAVE_CCBVAULTIC) && defined(WOLF_CRYPTO_CB_CMD)
#include "ccb_vaultic.h"
#endif
#endif
static int nativeStartup(void)
{
int ret = wolfCrypt_Init();
#ifdef WOLF_CRYPTO_CB
{
#ifdef WC_USE_DEVID
int devId = WC_USE_DEVID;
#else
int devId = INVALID_DEVID;
#endif
#if defined(HAVE_CCBVAULTIC) && defined(WOLF_CRYPTO_CB_CMD)
if((ret == 0) && (devId == CCBVAULTIC420_DEVID)) {
ret = wc_CryptoCb_RegisterDevice((int) devId,
ccbVaultIc_CryptoCb, NULL);
}
#endif
}
#endif /* WOLF_CRYPTO_CB */
ret = wolfCrypt_Init();
#ifdef WC_RNG_SEED_CB
wc_SetSeed_Cb(wc_GenerateSeed);
#endif
return ret;
}
JNIEXPORT jint JNICALL
Java_com_wolfssl_wolfssljni_1ndk_1gradle_MainActivity_testWolfCrypt(JNIEnv *env, jobject thiz) {
(void)env;
(void)thiz;
int ret = nativeStartup();
if (ret == 0) {
/* test uses WC_USE_DEVID for hardware offload tests */
ret = wolfcrypt_test(NULL);
}
wolfCrypt_Cleanup();
@ -42,13 +76,13 @@ Java_com_wolfssl_wolfssljni_1ndk_1gradle_MainActivity_testWolfCrypt(JNIEnv *env,
JNIEXPORT jint JNICALL
Java_com_wolfssl_wolfssljni_1ndk_1gradle_MainActivity_benchWolfCrypt(JNIEnv *env, jobject thiz) {
int ret = 0;
(void)env;
(void)thiz;
int ret = nativeStartup();
ret = wolfCrypt_Init();
#ifdef WC_RNG_SEED_CB
wc_SetSeed_Cb(wc_GenerateSeed);
#endif
if (ret == 0) {
/* benchmark uses WC_USE_DEVID for hardware offload tests */
ret = benchmark_test(NULL);
}
wolfCrypt_Cleanup();

244
android/wolfssljni-ndk-gradle/app/src/main/java/com/wolfssl/wolfssljni_ndk_gradle/MainActivity.java
View File

@ -1,15 +1,17 @@
package com.wolfssl.wolfssljni_ndk_gradle;
import android.os.AsyncTask;
import android.support.v7.app.AppCompatActivity;
import android.os.Bundle;
import android.view.View;
import android.widget.Button;
import android.widget.TextView;
import com.wolfssl.WolfSSL;
import com.wolfssl.provider.jsse.WolfSSLProvider;
import java.io.ByteArrayOutputStream;
import java.security.Security;
import java.util.concurrent.Executors;
import javax.net.ssl.SSLContext;
import javax.net.ssl.SSLSocket;
@ -20,102 +22,181 @@ public class MainActivity extends AppCompatActivity {
public native int testWolfCrypt();
public native int benchWolfCrypt();
private static String host = "www.wolfssl.com";
private static int port = 443;
private static final String host = "www.wolfssl.com";
private static final int port = 443;
private View.OnClickListener wcTestListener = new View.OnClickListener() {
@Override
public void onClick(View v) {
private int connectCount = 0;
private void setDisplayText(String s)
{
runOnUiThread(() -> {
TextView tv = (TextView) findViewById(R.id.displayText);
tv.setText("Running wolfCrypt tests.\n" +
"See logcat output for details (adb logcat).\n" +
"...\n");
tv.setText(s);
});
}
private void appendDisplayText(String s)
{
runOnUiThread(() -> {
TextView tv = (TextView) findViewById(R.id.displayText);
tv.append(s);
});
}
private final View.OnClickListener wcTestListener = v -> {
setDisplayText("Running wolfCrypt tests.\n" +
"See logcat output for details (adb logcat).\n" +
"...\n");
AsyncTask.execute(new Runnable() {
@Override
public void run() {
int ret = testWolfCrypt();
if (ret == 0) {
tv.append("TESTS PASSED\n");
} else {
tv.append("TESTS FAILED!\nInspect logcat.");
}
tv.append("\n");
tv.append("To adjust wolfSSL configuration, please edit\n" +
"add_definitions() in CMakeLists.txt.");
}
});
Executors.newSingleThreadExecutor().execute(() -> {
int ret = testWolfCrypt();
if (ret == 0) {
appendDisplayText("TESTS PASSED\n");
} else {
appendDisplayText("TESTS FAILED!\nInspect logcat.");
}
appendDisplayText("\nTo adjust wolfSSL configuration, please edit\n" +
"add_definitions() in CMakeLists.txt.");
});
}
};
private View.OnClickListener wcBenchmarkListener = new View.OnClickListener() {
@Override
public void onClick(View v) {
TextView tv = (TextView) findViewById(R.id.displayText);
tv.setText("Running wolfCrypt benchmark.\n" +
"See logcat output for details (adb logcat).\n" +
"...\n");
private final View.OnClickListener wcBenchmarkListener = v -> {
setDisplayText("Running wolfCrypt benchmark.\n" +
"See logcat output for details (adb logcat).\n" +
"...\n");
AsyncTask.execute(new Runnable() {
@Override
public void run() {
int ret = benchWolfCrypt();
if (ret == 0) {
tv.append("BENCHMARK PASSED\n");
} else {
tv.append("BENCHMARK FAILED!\nInspect logcat.");
}
tv.append("\n");
tv.append("To adjust wolfSSL configuration, please edit\n" +
"add_definitions() in CMakeLists.txt.");
}
});
}
Executors.newSingleThreadExecutor().execute(() -> {
int ret = benchWolfCrypt();
if (ret == 0) {
appendDisplayText("BENCHMARK PASSED\n");
} else {
appendDisplayText("BENCHMARK FAILED!\nInspect logcat.");
}
appendDisplayText("\nTo adjust wolfSSL configuration, please edit\n" +
"add_definitions() in CMakeLists.txt.");
});
};
private View.OnClickListener sslSocketConnectListener = new View.OnClickListener() {
@Override
public void onClick(View v) {
TextView tv = (TextView) findViewById(R.id.displayText);
tv.setText("Making simple SSL/TLS connection to:\n" +
"www.wolfssl.com:443\n\n" +
"See logcat output for details (adb logcat).\n" +
"...\n");
private final View.OnClickListener sslSocketConnectListener = v -> {
setDisplayText("Making simple SSL/TLS connection to:\n" +
host + ":" + port + "\n" +
"See logcat output for details (adb logcat).\n" +
"...\n");
Executors.newSingleThreadExecutor().execute(() -> {
try {
/* Enable wolfJSSE debug messages */
System.setProperty("wolfjsse.debug", "true");
AsyncTask.execute(new Runnable() {
@Override
public void run() {
/* Select The devId which will be registered and used on every other invocation */
/* Unique devId's are compiled into wolfssljni */
//int devId = 0x56490420; /* VaultIC 420 */
int devId = WolfSSL.INVALID_DEVID; /* No hardware offload */
try {
/* Enable wolfJSSE debug messages */
System.setProperty("wolfjsse.debug", "true");
/* Select if the cipher suites and protocols will be limited */
boolean limitCipherProtocol = false;
Security.insertProviderAt(new WolfSSLProvider(), 1);
long[] ts = new long[10];
/* not setting up KeyStore or TrustStore, wolfJSSE will load
* CA certs from the Android system KeyStore by default. */
SSLContext ctx = SSLContext.getInstance("TLS");
ctx.init(null, null, null);
ts[0] = System.currentTimeMillis();
WolfSSLProvider wolfProv = new WolfSSLProvider();
appendDisplayText("A. Inserting Provider " + wolfProv.getName() + "\n");
Security.insertProviderAt(wolfProv, 1);
SSLSocketFactory sf = ctx.getSocketFactory();
SSLSocket sock = (SSLSocket)sf.createSocket(host, port);
ts[1] = System.currentTimeMillis();
connectCount++;
sock.startHandshake();
sock.close();
tv.append("TLS Connection Successful!");
} catch (Exception e) {
tv.append("TLS Connection Failed");
e.printStackTrace();
}
if (((connectCount % 2) == 0) && (devId != WolfSSL.INVALID_DEVID)) {
appendDisplayText("B. Using hardware offload\n");
wolfProv.registerDevId(devId);
wolfProv.setDevId(devId);
} else {
appendDisplayText("B. Using software crypto.\n");
wolfProv.setDevId(WolfSSL.INVALID_DEVID);
}
});
}
ts[2] = System.currentTimeMillis();
appendDisplayText("C. Setting up context and socket\n");
/* not setting up KeyStore or TrustStore, wolfJSSE will load
* CA certs from the Android system KeyStore by default. */
SSLContext ctx = SSLContext.getInstance("TLS", wolfProv.getName());
ctx.init(null, null, null);
SSLSocketFactory sf = ctx.getSocketFactory();
SSLSocket sock = (SSLSocket) sf.createSocket(host, port);
if (limitCipherProtocol) {
/* Limit cipherSuites and protocol */
String[] cipherSuites = new String[]{"TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA"};
sock.setEnabledCipherSuites(cipherSuites);
String[] protocols = new String[]{"TLSv1.2"};
sock.setEnabledProtocols(protocols);
}
ts[3] = System.currentTimeMillis();
appendDisplayText("D. Starting Handshake\n");
sock.startHandshake();
ts[4] = System.currentTimeMillis();
appendDisplayText("E. Sending GET Request\n");
String getCmd = "GET / HTTP/1.1\r\n" +
"Host: www.wolfssl.com\r\n" +
"Accept: */*\r\n\r\n";
sock.getOutputStream().write(getCmd.getBytes());
ts[5] = System.currentTimeMillis();
long sizeLimit = 10 * 1024;
appendDisplayText("F. Receiving at least " + sizeLimit + " bytes\n");
byte[] data = new byte[4 * 1024];
ByteArrayOutputStream buffer = new ByteArrayOutputStream();
long totalRead = 0;
/* Read the first 10kB */
while (totalRead < sizeLimit) {
int nRead = sock.getInputStream().read(data, 0, data.length);
if (nRead < 0) break;
buffer.write(data, 0, nRead);
totalRead = totalRead + nRead;
}
ts[6] = System.currentTimeMillis();
appendDisplayText("G. Closing socket\n");
sock.close();
ts[7] = System.currentTimeMillis();
if (((connectCount % 2) == 0) && (devId != WolfSSL.INVALID_DEVID)) {
appendDisplayText("H. Disabling hardware offload\n");
wolfProv.setDevId(WolfSSL.INVALID_DEVID);
wolfProv.unRegisterDevId(devId);
} else {
appendDisplayText("H. Software crypto still enabled\n");
}
ts[8] = System.currentTimeMillis();
appendDisplayText("I. Removing Provider\n");
Security.removeProvider(wolfProv.getName());
ts[9] = System.currentTimeMillis();
appendDisplayText("TLS Connection Successful! Got" +
totalRead + " bytes.\n");
appendDisplayText("Times(ms):" +
" A:" + (ts[1] - ts[0]) +
" B:" + (ts[2] - ts[1]) +
" C:" + (ts[3] - ts[2]) +
" D:" + (ts[4] - ts[3]) +
" E:" + (ts[5] - ts[4]) +
", " + getCmd.length() * 1000 / (ts[5] - ts[4] + 1) + "Bps" +
" F:" + (ts[6] - ts[5]) +
", " + totalRead * 1000 / (ts[6] - ts[5] + 1) + "Bps" +
" G:" + (ts[7] - ts[6]) +
" H:" + (ts[8] - ts[7]) +
" I:" + (ts[9] - ts[8]) +
"\n");
} catch (Exception e) {
appendDisplayText("TLS Connection Failed");
e.printStackTrace();
}
});
};
@Override
@ -123,8 +204,7 @@ public class MainActivity extends AppCompatActivity {
super.onCreate(savedInstanceState);
setContentView(R.layout.activity_main);
TextView tv = (TextView) findViewById(R.id.displayText);
tv.setText("Please make a selection below");
setDisplayText("Please make a selection below");
Button wcTestButton = (Button) findViewById(R.id.btn_wc_test);
wcTestButton.setOnClickListener(wcTestListener);

6
android/wolfssljni-ndk-gradle/app/src/main/res/layout/activity_main.xml
View File

@ -9,13 +9,15 @@
<LinearLayout
android:layout_width="match_parent"
android:layout_height="match_parent"
android:gravity="bottom"
android:orientation="vertical">
<TextView
android:id="@+id/displayText"
android:layout_width="match_parent"
android:layout_height="532dp"
android:layout_marginTop="10dp" />
android:layout_height="wrap_content"
android:layout_marginTop="10dp"
android:layout_weight="1" />
<View
android:id="@+id/divider"

6
android/wolfssljni-ndk-gradle/build.gradle
View File

@ -2,11 +2,11 @@
buildscript {
repositories {
jcenter()
mavenCentral()
google()
}
dependencies {
classpath 'com.android.tools.build:gradle:7.2.0'
classpath 'com.android.tools.build:gradle:8.0.2'
// NOTE: Do not place your application dependencies here; they belong
// in the individual module build.gradle files
@ -15,7 +15,7 @@ buildscript {
allprojects {
repositories {
jcenter()
mavenCentral()
google()
}
}

4
android/wolfssljni-ndk-gradle/gradle.properties
View File

@ -9,9 +9,13 @@
# Specifies the JVM arguments used for the daemon process.
# The setting is particularly useful for tweaking memory settings.
android.defaults.buildfeatures.buildconfig=true
android.nonFinalResIds=false
android.nonTransitiveRClass=false
org.gradle.jvmargs=-Xmx1536m
# When configured, Gradle will run in incubating parallel mode.
# This option should only be used with decoupled projects. More details, visit
# http://www.gradle.org/docs/current/userguide/multi_project_builds.html#sec:decoupled_projects
# org.gradle.parallel=true
org.gradle.warning.mode=all

2
android/wolfssljni-ndk-gradle/gradle/wrapper/gradle-wrapper.properties vendored
View File

@ -1,6 +1,6 @@
#Mon May 23 13:47:02 MDT 2022
distributionBase=GRADLE_USER_HOME
distributionUrl=https\://services.gradle.org/distributions/gradle-7.3.3-bin.zip
distributionUrl=https\://services.gradle.org/distributions/gradle-8.0-bin.zip
distributionPath=wrapper/dists
zipStorePath=wrapper/dists
zipStoreBase=GRADLE_USER_HOME

67
ccb_vaultic/Makefile 100644
View File

@ -0,0 +1,67 @@
# Pick up cross-compiler info from environment
CC=${NDK_CC}
AS=${NDK_AS}
RANLIB=${NDK_RANLIB}
AR=${NDK_AR}
LD=${NDK_LD}
# Relative path to wolfSSL source
WOLFSSL_DIR?=../../wolfssl
# Relative path to VaultIC dev kit source
VAULTIC_DIR?=./VaultIC-TLS_420/vaultic_tls-4xx
# Common settings and files
CFLAGS+=-I. -O2 -DHAVE_CCBVAULTIC
OBJS=ccb_vaultic.o
# Uncomment to enable verbose debug logging
CFLAGS+=-DCCBVAULTIC_DEBUG
CFLAGS+=-DCCBVAULTIC_DEBUG_TIMING
#CFLAGS+=-DCCBVAULTIC_DEBUG_ALL
# Optionally disable certain kinds of offload
#CFLAGS+=-DCCBVAULTIC_NO_AES
CFLAGS+=-DCCBVAULTIC_NO_SHA
#CFLAGS+=-DCCBVAULTIC_NO_RSA
# wolfSSL settings and files
# ./configure --enable-cryptocb --enable-static --disable-shared
# --host aarch64-linux-android CFLAGS=-DWOLF_CRYPTO_CB_CMD
CFLAGS+=-I$(WOLFSSL_DIR)
LDFLAGS+=-L$(WOLFSSL_DIR)/src/.libs -lwolfssl -lm
# VaultIC settings and files. These must match the vault_tls_config.h
VAULTIC_CHIP=420
CHIP_TARGET=TARGETCHIP_VAULTIC_$(VAULTIC_CHIP)
CFLAGS+= -D$(CHIP_TARGET)
CFLAGS+= -DUSE_SPI
#CFLAGS+=-DSPI_TRACE_ERRORS
VAULTIC_ELIB?=$(VAULTIC_DIR)/VaultIC-Elib_$(VAULTIC_CHIP)/src
CFLAGS+=-I$(VAULTIC_ELIB)/common
CFLAGS+=-I$(VAULTIC_ELIB)/device/vaultic_4XX_family
VAULTIC_TLS?=$(VAULTIC_DIR)/lib/VaultIC_420_TLS_Lib/target/raspberry/dist
CFLAGS+=-I$(VAULTIC_TLS)
#LDFLAGS+=-L$(VAULTIC_TLS)/VaultIC_420_TLS_Lib-SPI-Debug -lvaultic420_tls
LDFLAGS+=-L$(VAULTIC_TLS)/VaultIC_420_TLS_Lib-SPI-Release -lvaultic420_tls
#Test and Benchmark targets
CFLAGS+=-DWC_USE_DEVID=0x56490420 -DBENCH_EMBEDDED -DNO_MAIN_DRIVER
TEST_OBJS:=$(WOLFSSL_DIR)/wolfcrypt/test/test.o main-test.o
BENCH_OBJS:=$(WOLFSSL_DIR)/wolfcrypt/benchmark/benchmark.o main-bench.o
#Makefile rules
all: wolfcrypt-test wolfcrypt-benchmark
wolfcrypt-test: $(OBJS) $(TEST_OBJS)
$(CC) -o $@ $^ $(LDFLAGS)
wolfcrypt-benchmark: $(OBJS) $(BENCH_OBJS)
$(CC) -o $@ $^ $(LDFLAGS)
clean:
rm -f *.o *.d wolfcrypt-test wolfcrypt-benchmark
rm -f $(WOLFSSL_DIR)/wolfcrypt/benchmark/*.o
rm -f $(WOLFSSL_DIR)/wolfcrypt/test/*.o

150
ccb_vaultic/README.md 100644
View File

@ -0,0 +1,150 @@
# CryptoCB Wisekey VaultIC Port
Support for the VaultIC 420:
- Symmetric ciphers/modes: AES128-CBC
- Hashes: SHA256
- Asymmetric ciphers/functions: RSA-2048 Verify
This port requires the VaultIC 420 Dev Kit (including the vaultic_tls library) from Wisekey. Please contact support@wolfssl.com for assistance.
## Building VaultIC Hardware Crypto Offload Support
This port is setup for cross compiling to an ARMv8 Android system and the build configuration assume the Android NDK is installed. Environment variables can be setup, for example:
```
export NDK=~/Library/Android/sdk/ndk/25.2.9519653/toolchains/llvm/prebuilt/darwin-x86_64
export PATH=$PATH:~/Documents/Masters/android/platform-tools
export NDK_AR=$NDK/bin/llvm-ar
export NDK_CC=$NDK/bin/aarch64-linux-android30-clang
export NDK_AS=$NDK_CC
export NDK_CXX=$NDK/bin/aarch64-linux-android30-clang++
export NDK_LD=$NDK/bin/ld
export NDK_RANLIB=$NDK/bin/llvm-ranlib
export NDK_STRIP=$NDK/bin/llvm-strip
```
### Building wolfSSL
To enable hardware offload support via cryptocb, configure wolfSSL to include crypto callbacks and to cross-compile a static library:
```
git clone git@github.com:wolfssl/wolfssl.git
cd wolfssl
./configure --host aarch64-linux-android CC=$NDK_CC AS=$NDK_AS RANLIB=$NDK_RANLIB AR=$NDK_AR LD=$NDK_LD STRIP=$NDK_STRIP CXX=$NDK_CXX CFLAGS=-DWOLF_CRYPTO_CB_CMD --enable-cryptocb --enable-static --disable-shared
make
```
The port's `Makefile` also relies on certain source and header files within wolfSSL to be available. The relative path to the wolfSSL directory is set by the `WOLFSSL_DIR` variable. The wolfSSL source was updated to allow the test and benchmark programs to accept a compile-time CryptoCB DevId using the `FORCE_DEVID` macro, which is in a pending PR.
### Building VaultIC TLS Library
Please contact support@wolfssl.com for access to the modified VaultIC library files used for this port.
This port has modified the Wisekey provided vaultic_tls library to attempt to cancel authentication during startup in case a previous session ended without closing the VaultIC library by invoking `VltAuthClose()` immediately after opening the VaultIC interface. The library is statically configured with user authentication hard-coded within the library itself and to use the Linux SPI Dev interface for communications. Note that typical Linux permissions require root privileges to access the SPI device.
For this example, the VaultIC library needed to be configured and cross-compiled to the Android target which is similar to the vendor-provided Raspberry Pi target. Modifications we made to disable any GPIO's used to powerup and reset the chip as well as to set the cross compiler to use the Android NDK as above. To build the VaultIC API and TLS libraries, follow the instructions provided by Wisekey, which are summarized as:
```
cd VaultIC-TLS_420/vaultic_tls-4xx/lib/VaultIC_420_TLS_Lib/target/raspberry/build
./build-all_spi.sh
```
The port's `Makefile` expects headers and corresponding functions from `vaultic_tls.h` and from the common VaultIC folders. The relative base folder is set as the variable `VAULTIC_DIR`.
### Building the Port's Benchmark and Test programs
This port leverages wolfCrypt's included benchmark and test programs as an example of how to statically link against wolfSSL and the VaultIC libraries as well as use the hardware offload abstractions provided within wolfSSL. In this case, the wolfSSL software will attempt every cryptographic operating using the Wisekey VaultIC port via the CryptoCB method, but only the implemented functions will use the VaultIC hardware. Every unsupported function will fallback and use the ARMv8-accelerated software implementation.
To build using the NDK cross-compiler configuration above:
```
make clean
make CC=$NDK_CC AS=$NDK_AS RANLIB=$NDK_RANLIB AR=$NDK_AR LD=$NDK_LD
```
The benchmark and test programs are built as part of the `make all` target and can be run on the target hardware as `wolfcrypt-bench` and `wolfcrypt-test` respectively. Note that the test program expects the test certificates to be available on the target hardware.
## Benchmarks and Known Answer Tests
Benchmark using unoptimized ARMv8 (imx8) and VaultIC 420 for AES128-CBC:
```
Math: Multi-Precision: Wolf(SP) word-size=64 bits=4096 sp_int.c
wolfCrypt Benchmark (block bytes 1024, min 1.0 sec each)
AESCBC Internal with useDevice:0 and devid:56490420
AES-128-CBC-enc 78 MiB took 1.000 seconds, 77.604 MiB/s
AES-128-CBC-dec 77 MiB took 1.000 seconds, 77.361 MiB/s
AESCBC Internal with useDevice:1 and devid:56490420
AES-128-CBC-enc 25 KiB took 25.647 seconds, 0.975 KiB/s
AES-128-CBC-dec 25 KiB took 24.884 seconds, 1.005 KiB/s
SHA256 with useDevice:0 and devid:56490420
SHA-256 74 MiB took 1.000 seconds, 74.240 MiB/s
SHA256 with useDevice:1 and devid:56490420
SHA-256 25 KiB took 25.626 seconds, 0.976 KiB/s
HMAC SHA256 with useDevice:0 and devid:56490420
HMAC-SHA256 73 MiB took 1.000 seconds, 73.406 MiB/s
HMAC SHA256 with useDevice:1 and devid:56490420
HMAC-SHA256 25 KiB took 25.490 seconds, 0.981 KiB/s
RSA with useDevice:0 and devid:56490420
RSA 2048 public 2834 ops took 1.001 sec, avg 0.353 ms, 2832.561 ops/sec
RSA with useDevice:1 and devid:56490420
RSA 2048 public 2 ops took 2.463 sec, avg 1231.505 ms, 0.812 ops/sec
```
Known answer test program output with VaultIC performing AES128-CBC test:
```
------------------------------------------------------------------------------
wolfSSL version 5.6.3 with DevID:56490420
------------------------------------------------------------------------------
error test passed!
MEMORY test passed!
base64 test passed!
asn test passed!
RANDOM test passed!
MD5 test passed!
SHA test passed!
SHA-224 test passed!
SHA-256 test passed!
SHA-384 test passed!
SHA-512 test passed!
SHA-512/224 test passed!
SHA-512/256 test passed!
SHA-3 test passed!
Hash test passed!
HMAC-MD5 test passed!
HMAC-SHA test passed!
HMAC-SHA224 test passed!
HMAC-SHA256 test passed!
HMAC-SHA384 test passed!
HMAC-SHA512 test passed!
HMAC-SHA3 test passed!
HMAC-KDF test passed!
TLSv1.3 KDF test passed!
GMAC test passed!
Chacha test passed!
POLY1305 test passed!
ChaCha20-Poly1305 AEAD test passed!
AES test passed!
AES192 test passed!
AES256 test passed!
AES-GCM test passed!
RSA test passed!
DH test passed!
PWDBASED test passed!
ECC test passed!
logging test passed!
time test passed!
mutex test passed!
memcb test passed!
crypto callback test passed!
Test complete
```
## Support
Email us at [support@wolfssl.com](mailto:support@wolfssl.com).

1153
ccb_vaultic/ccb_vaultic.c 100644
View File

File diff suppressed because it is too large Load Diff

93
ccb_vaultic/ccb_vaultic.h 100644
View File

@ -0,0 +1,93 @@
/*
* ccb_vaultic.h
*
* Copyright (C) 2023 wolfSSL Inc.
*
* wolfSSL is free software; you can redistribute it and/or modify
* it under the terms of the GNU General Public License as published by
* the Free Software Foundation; either version 2 of the License, or
* (at your option) any later version.
*
* wolfSSL is distributed in the hope that it will be useful,
* but WITHOUT ANY WARRANTY; without even the implied warranty of
* MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
* GNU General Public License for more details.
*
* You should have received a copy of the GNU General Public License
* along with this program; if not, write to the Free Software
* Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1335, USA
*/
#ifndef CCB_VAULTIC_H
#define CCB_VAULTIC_H
/* VaultIC DevID MSBs are ASCII "VI" */
#define CCBVAULTIC_DEVID (0x56490000ul)
#define CCBVAULTIC420_DEVID (CCBVAULTIC_DEVID + 0x0420)
#ifdef HAVE_CCBVAULTIC
/*
* Implementation of wolfCrypt cryptocb callbacks
*
* The wolfSSL port of the Wisekey VaultIC provides a wrapper library to allow
* the VaultIC to be used as an external crypto provider. This library depends
* on the Wisekey-provided VaultIC interface libraries that have been statically
* compiled in the proper hardware configuration.
*/
typedef struct {
int initialized;
int vlt_rc;
/* Buffer to store message during SHA with will_copy flag set */
int hash_type; /* enum wc_HashType */
unsigned char *m;
size_t m_len;
/* Buffer to cache aes key between invocations */
unsigned char *aescbc_key;
size_t aescbc_keylen;
} ccbVaultIc_Context;
/* ccbVaultIc_Context static initializer */
#define CCBVAULTIC_CONTEXT_INITIALIZER \
{ \
.initialized = 0 \
}
/* Initialize the Wisekey VaultIC library and clear the context.
* Returns: 0 on success
* BAD_FUNC_ARGS with NULL context
* WC_INIT_E on error initializing the VaultIC.
* c->vlt_rc will have error code
*/
int ccbVaultIc_Init(ccbVaultIc_Context *c);
/* Close the Wisekey VaultIC library. */
void ccbVaultIc_Cleanup(ccbVaultIc_Context *c);
#ifdef WOLF_CRYPTO_CB
#include "wolfssl/wolfcrypt/cryptocb.h" /* For wc_CryptInfo */
/* Register this callback and associate with a context using:
* ccbVaultIc_Context ctx=CCBVAULTIC_CONTEXT_INITIALIZER;
* ccbVaultIc_Init(&ctx);
* wc_CryptoCb_RegisterDevice(
* CCBVAULTIC420_DEVID,
* ccbVaultIc_CryptoCb,
* &ctx);
* wc_Aes aes={0};
* wc_AesInit(&aes, NULL, CCBVAULTIC420_DEVID);
* Returns: 0 on success
* CRYPTOCB_UNAVAILABLE if not initialized or not implemented
* MEMORY_E if memory allocation fails
*/
int ccbVaultIc_CryptoCb(int devId,
wc_CryptoInfo* info,
void* ctx);
#endif /* WOLF_CRYPTO_CB */
#endif /* HAVE_CCBVAULTIC */
#endif /* CCB_VAULTIC_H_ */

114
ccb_vaultic/main-bench.c 100644
View File

@ -0,0 +1,114 @@
/* wolfCrypt benchmark test application for Wisekey VaultIC
*
* Copyright (C) 2023 wolfSSL Inc.
*
* wolfSSL is free software; you can redistribute it and/or modify
* it under the terms of the GNU General Public License as published by
* the Free Software Foundation; either version 2 of the License, or
* (at your option) any later version.
*
* wolfSSL is distributed in the hope that it will be useful,
* but WITHOUT ANY WARRANTY; without even the implied warranty of
* MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
* GNU General Public License for more details.
*
* You should have received a copy of the GNU General Public License
* along with this program; if not, write to the Free Software
* Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1335, USA
*/
#ifndef WOLFSSL_USER_SETTINGS
#include "wolfssl/options.h"
#endif
#include "wolfssl/wolfcrypt/settings.h" /* For X-defines */
/* wolfCrypt includes */
#include "wolfssl/wolfcrypt/wc_port.h" /* For Init/Cleanup */
#ifdef WOLF_CRYPTO_CB
#include "wolfssl/wolfcrypt/cryptocb.h" /* For Register/Unregister */
#endif
#ifdef HAVE_CCBVAULTIC
#include "ccb_vaultic.h" /* For devId and cryptocb */
#endif
/* Local include */
#include "wolfcrypt/benchmark/benchmark.h"
int main(int argc, char **argv)
{
(void)argc;
(void)argv;
int rc = 0;
/* Initialize wolfCrypt */
rc = wolfCrypt_Init();
if (rc == 0) {
#ifdef WOLF_CRYPTO_CB
/* Allocate/initialize context */
void* ctx = NULL;
#ifndef WOLF_CRYPTO_CB_CMD
/* External allocation/initialization of hardware context */
#ifdef HAVE_CCBVAULTIC
static ccbVaultIc_Context ctx_storage = CCBVAULTIC_CONTEXT_INITIALIZER;
ctx = &ctx_storage;
rc = ccbVaultIc_Init(ctx);
#else
/* Add other elif hardware here */
#endif
#endif /* WOLF_CRYPTO_CB_CMD */
if (rc == 0) {
/* Setup callback and devId */
int devId = INVALID_DEVID;
CryptoDevCallbackFunc ccb = NULL;
#ifdef HAVE_CCBVAULTIC
devId = CCBVAULTIC420_DEVID;
ccb = ccbVaultIc_CryptoCb;
#else
/* Add other elif hardware here */
#endif
/* Register cryptocb */
rc = wc_CryptoCb_RegisterDevice(
devId,
ccb,
ctx);
#endif /* WOLF_CRYPTO_CB */
if (rc == 0) {
/* Run benchmarks */
rc = benchmark_test(NULL);
#ifdef WOLF_CRYPTO_CB
/* Unregister the callback */
wc_CryptoCb_UnRegisterDevice(devId);
#endif
} else {
printf("Failed to register cryptocb:%d (%x) "\
" with devId:%x ccb:%p\n",
rc, rc, devId, ccb);
}
#ifdef WOLF_CRYPTO_CB
#ifndef WOLF_CRYPTO_CB_CMD
/* External deallocation of hardware context */
#ifdef HAVE_CCBVAULTIC
ccbVaultIc_Cleanup(ctx);
#else
/* Add other hardware cleanup here */
#endif
#endif
#endif
} else {
printf(" Failed to initialize hardware: %d (%x)\n", rc, rc);
}
wolfCrypt_Cleanup();
}else {
printf("Failed to initialize wolfCrypt: %d (%x)\n", rc, rc);
}
return rc;
}

114
ccb_vaultic/main-test.c 100644
View File

@ -0,0 +1,114 @@
/* wolfCrypt test application for Wisekey VaultIC
*
* Copyright (C) 2023 wolfSSL Inc.
*
* wolfSSL is free software; you can redistribute it and/or modify
* it under the terms of the GNU General Public License as published by
* the Free Software Foundation; either version 2 of the License, or
* (at your option) any later version.
*
* wolfSSL is distributed in the hope that it will be useful,
* but WITHOUT ANY WARRANTY; without even the implied warranty of
* MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
* GNU General Public License for more details.
*
* You should have received a copy of the GNU General Public License
* along with this program; if not, write to the Free Software
* Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1335, USA
*/
#ifndef WOLFSSL_USER_SETTINGS
#include "wolfssl/options.h"
#endif
#include "wolfssl/wolfcrypt/settings.h" /* For X-defines */
/* wolfCrypt includes */
#include "wolfssl/wolfcrypt/wc_port.h" /* For Init/Cleanup */
#ifdef WOLF_CRYPTO_CB
#include "wolfssl/wolfcrypt/cryptocb.h" /* For Register/Unregister */
#endif
#ifdef HAVE_CCBVAULTIC
#include "ccb_vaultic.h" /* For devId and cryptocb */
#endif
/* Local include */
#include "wolfcrypt/test/test.h"
int main(int argc, char **argv)
{
(void)argc;
(void)argv;
int rc = 0;
/* Initialize wolfCrypt */
rc = wolfCrypt_Init();
if (rc == 0) {
#ifdef WOLF_CRYPTO_CB
/* Allocate/initialize context */
void* ctx = NULL;
#ifndef WOLF_CRYPTO_CB_CMD
/* External allocation/initialization of hardware context */
#ifdef HAVE_CCBVAULTIC
static ccbVaultIc_Context ctx_storage = CCBVAULTIC_CONTEXT_INITIALIZER;
ctx = &ctx_storage;
rc = ccbVaultIc_Init(ctx);
#else
/* Add other elif hardware here */
#endif
#endif /* WOLF_CRYPTO_CB_CMD */
if (rc == 0) {
/* Setup callback and devId */
int devId = INVALID_DEVID;
CryptoDevCallbackFunc ccb = NULL;
#ifdef HAVE_CCBVAULTIC
devId = CCBVAULTIC420_DEVID;
ccb = ccbVaultIc_CryptoCb;
#else
/* Add other elif hardware here */
#endif
/* Register cryptocb */
rc = wc_CryptoCb_RegisterDevice(
devId,
ccb,
ctx);
#endif /* WOLF_CRYPTO_CB */
if (rc == 0) {
/* Run tests */
rc = wolfcrypt_test(NULL);
#ifdef WOLF_CRYPTO_CB
/* Unregister the callback */
wc_CryptoCb_UnRegisterDevice(devId);
#endif
} else {
printf("Failed to register cryptocb:%d (%x) "\
" with devId:%x ccb:%p\n",
rc, rc, devId, ccb);
}
#ifdef WOLF_CRYPTO_CB
#ifndef WOLF_CRYPTO_CB_CMD
/* External deallocation of hardware context */
#ifdef HAVE_CCBVAULTIC
ccbVaultIc_Cleanup(ctx);
#else
/* Add other hardware cleanup here */
#endif
#endif
#endif
} else {
printf(" Failed to initialize hardware: %d (%x)\n", rc, rc);
}
wolfCrypt_Cleanup();
}else {
printf("Failed to initialize wolfCrypt: %d (%x)\n", rc, rc);
}
return rc;
}