STM32 bare-metal crypto port (HASH / AES / PKA / RNG, DHUK, CCB) by dgarske · Pull Request #10395 · wolfSSL/wolfssl

dgarske · 2026-05-04T23:16:08Z

Adds a direct-register STM32 hardware-crypto integration that needs zero HAL or StdPeriphLib, for wolfBoot / no-OS / FreeRTOS / TrustZone-NS use. Builds and is validated across ~27 STM32 families. Layered as the bare IP drivers, DHUK device-bound keys, and CCB hardware-protected ECDSA.

Features

Bare-metal IP drivers (WOLFSSL_STM32_BARE): direct-register AES (TinyAES / CRYP / SAES), HASH (classic and new-gen IP), RNG, and PKA (V1 and V2 layouts: ECDSA sign/verify and ECC scalar-mul). The same code drives both the bare path and the CubeMX/HAL path. On STM32C5, whose PKA exposes only the side-channel-protected ECC modes, ECDSA sign runs in hardware and verify in software.
DHUK (Device Hardware Unique Key): chip-bound keys through the standard crypto-callback framework. Register the device, set a key's devId to it, and run normal AES / GMAC / ECDSA - the working key is derived inside SAES and never enters software.
CCB (Coupling and Chaining Bridge): hardware-protected P-256 ECDSA on STM32U3 and STM32C5. The DHUK-wrapped private scalar is unwrapped SAES -> PKA inside the CCB and never enters software or crosses the system bus. Transparent through the standard ECC API (wc_ecc_make_key to provision, wc_ecc_sign_hash to sign) - no CCB-specific public API; both bare and CubeMX/HAL backends.

New build options

WOLFSSL_STM32_BARE - bare-metal direct-register path (vs WOLFSSL_STM32_CUBEMX).
Per-IP enables: STM32_CRYPTO, STM32_HASH, STM32_RNG, WOLFSSL_STM32_PKA (+ WC_STM32_PKA_VERIFY_ONLY / WC_STM32_PKA_SIGN_ONLY for verify-only or sign-only parts such as STM32C5), WOLFSSL_STM32_USE_SAES.
WOLFSSL_DHUK + WOLF_CRYPTO_CB - DHUK crypto-callback device (WOLFSSL_STM32_DHUK_UNWRAP for the optional exact-key import).
WOLFSSL_STM32_CCB - CCB-protected ECDSA (requires DHUK + crypto-cb, STM32U3 or STM32C5 silicon).
Per-family flags (WOLFSSL_STM32U3, WOLFSSL_STM32C5, ...) select register layouts.

Testing performed

Multi-board regression on real silicon via the companion STM32_Bare_Test harness (wolfcrypt_test + benchmark), covering ~27 STM32 families: F2/F3/F4/F7, G0/G4, H5/H7/H7RS, L4/L5, U0/U3/U5, WB/WBA/WL, C0/C5, N6, and more. Latest sweep: all attached boards PASS.
CCB validated on NUCLEO-U385RG-Q (bare and CubeMX) and NUCLEO-C5A3ZG (bare), TZEN=0, P-256: wc_ecc_make_key -> wc_ecc_sign_hash -> wc_ecc_verify_hash, scalar never in software.
DHUK validated on STM32U385 (GMAC, AES-ECB, ECDSA sign via the crypto callback).
STM32C5 (NUCLEO-C5A3ZG): HW RNG and HW PKA ECDSA sign (verify in software) enabled and validated, plus device-wrapped key-import argument validation.
check-source-text clean.

Known limitations / follow-up

On STM32C5 the integrated HW PKA verify mode is not used; ECDSA verify runs in software (sign is hardware-accelerated). CCB is P-256 only.

Reference

Per-board chip-support matrix, build sizes, and benchmarks (companion examples branch): https://github.com/dgarske/wolfssl-examples-stm32/blob/stm32_bare/STM32_Bare_Test/README.md

Copilot

Pull request overview

This PR introduces a new STM32 “bare-metal” crypto port flavor (WOLFSSL_STM32_BARE) that uses CMSIS device-header register access (no HAL/StdPeriph dependency) and wires it into wolfCrypt’s AES/HASH/RNG paths, plus a direct-register PKA implementation used by the existing STM32 PKA integration.

Changes:

Add WOLFSSL_STM32_BARE selection in settings to include only CMSIS device headers and auto-enable the no-lib RNG path.
Add per-family bare-metal clock-enable macros and HAL/PKA stand-in types to support a direct-register PKA driver.
Add bare-metal AES (CRYP + TinyAES), HASH clock enable override, and bare PKA shims/driver, plus AES dispatcher updates in aes.c and RNG clock-enable macro use in random.c.

Reviewed changes

Copilot reviewed 6 out of 6 changed files in this pull request and generated 6 comments.

Show a summary per file

File	Description
`wolfssl/wolfcrypt/settings.h`	Adds `WOLFSSL_STM32_BARE` selection, CMSIS header includes, and mutual exclusion with CubeMX.
`wolfssl/wolfcrypt/port/st/stm32.h`	Adds BARE clock-enable macros, HASH ALGO defines for new IP, and PKA stand-in types.
`wolfcrypt/src/port/st/stm32.c`	Implements bare-metal AES (CRYP/TinyAES), HASH clock enable override, and bare-metal PKA shims/driver.
`wolfcrypt/src/aes.c`	Routes ECB/CBC/CTR and GCM-encrypt through the BARE STM32 implementation with SW fallback behavior.
`wolfcrypt/src/random.c`	Uses a per-family RNG clock-enable macro (for BARE) instead of a fixed RCC register bit.
`wolfcrypt/src/ecc.c`	Adjusts STM32 PKA guards so BARE uses SW ECDSA paths while still leveraging HW scalar mul.

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

github-actions · 2026-05-05T00:38:37Z

dgarske · 2026-05-07T21:24:50Z

Note #10307 seems to have broken AES CBC on STM32... I will put the fix into my new wolfSSL/wolfssl-examples-stm32#13

Copilot

Pull request overview

Copilot reviewed 8 out of 8 changed files in this pull request and generated 5 comments.

Comments suppressed due to low confidence (1)

wolfcrypt/src/port/st/stm32.c:1

After wc_Stm32_Aes_DhukOp() completes, the unwrapped key remains resident in SAES key registers (KEYR) until overwritten by a later operation. If the platform threat model includes debug/privileged register reads or post-operation key scraping, consider explicitly clearing KEYR/CR state (or triggering any available peripheral key/CCF/error clear mechanism) before releasing the mutex. This is especially relevant because DHUK is explicitly about protecting keys at rest/in RAM.

/* stm32.c

Copilot

Pull request overview

Copilot reviewed 8 out of 8 changed files in this pull request and generated 7 comments.

dgarske · 2026-05-22T03:16:08Z

Jenkins retest this please

Copilot

Pull request overview

Copilot reviewed 9 out of 10 changed files in this pull request and generated 5 comments.

Copilot

Pull request overview

Copilot reviewed 9 out of 10 changed files in this pull request and generated 4 comments.

Copilot

Pull request overview

Copilot reviewed 12 out of 13 changed files in this pull request and generated 2 comments.

github-actions · 2026-06-19T17:53:43Z

retest this please

Copilot

Pull request overview

Copilot reviewed 12 out of 13 changed files in this pull request and generated 4 comments.

- Wrap source lines >80 cols added by the STM32 bare/DHUK/CCB port: reformat the P-256 CCB curve constants to 8 bytes/line, break long SAES/PKA register writes and pka_read_be calls, and rewrap doxygen and in-code comments (port/st/stm32.c + stm32.h, aes.c, ecc.c, random.c, doc/dox_comments/header_files/stm32.h). - .wolfssl_known_macro_extras: add AES_CR_CPHASE, RCC_AHB2ENR_CCBEN, and WOLFSSL_STM32_RNG_LEGACY_FAILFAST; drop the now-recognized WOLFSSL_STM32_CCB.

dgarske · 2026-06-22T19:34:41Z

Jenkins retest this please: "Build PRB-valgrind-check-v3 #12810 completed: FAILURE"

--enable-opensslall --enable-sniffer CPPFLAGS="-DWOLFSSL_OLD_PRIME_CHECK"

Client Random : 7461110EA4B112748EC4987742146F9718AAF438EA3CF0A2D3C37E9A3659F243
BIO error printing session
 Success -- All results as expected.
 End Cipher Suite Tests
unit_test: Success for all configured tests.
==23369== 
==23369== HEAP SUMMARY:
==23369==     in use at exit: 0 bytes in 0 blocks
==23369==   total heap usage: 2,366,309 allocs, 2,366,309 frees, 863,521,254 bytes allocated
==23369== 
==23369== All heap blocks were freed -- no leaks are possible
==23369== 
==23369== ERROR SUMMARY: 0 errors from 0 contexts (suppressed: 0 from 0)
Exiting with status: 3
Script ran for 664 seconds.
script returned exit code 3

Copilot

Pull request overview

Copilot reviewed 12 out of 13 changed files in this pull request and generated 5 comments.

+#if defined(WOLFSSL_DHUK) && \
+    (defined(WOLFSSL_STM32U5) || defined(WOLFSSL_STM32U3) || \
+     defined(WOLFSSL_STM32H5) || defined(WOLFSSL_STM32WBA) || \
+     defined(WOLFSSL_STM32C5) || defined(WOLFSSL_STM32H7S))
+    #define WC_STM32_HAS_DHUK
+#endif


+    ForceZero(d, MAX_ECC_BYTES);
+    if (tmpInit) {
+        wc_ecc_free(tmp);
+    }
+#ifdef WOLFSSL_SMALL_STACK
+    XFREE(scratch, key->heap, DYNAMIC_TYPE_TMP_BUFFER);
+    XFREE(tmp, key->heap, DYNAMIC_TYPE_ECC);
+#endif
+    return ret;


+
+- Validated on STM32U385 (NUCLEO-U385RG-Q, TZEN=0), P-256, on both the bare-metal and CubeMX/HAL build paths: `wc_ecc_make_key` -> `wc_ecc_sign_hash` -> `wc_ecc_verify_hash` round-trips, with the private scalar never present in software.
+- Also validated on STM32C5 (NUCLEO-C5A3ZG, TZEN=0), P-256, bare-metal: the same `wc_ecc_make_key` -> `wc_ecc_sign_hash` -> `wc_ecc_verify_hash` flow plus a persisted-blob re-import (`wc_ecc_import_wrapped_private_ex`) round-trip, all on the CCB hardware. On STM32C5 the blob-create step is a combined create-and-sign: the C5 OPSTEP machine only advances through the GCM-final phase when the random k is drawn and the PKA sign is started during creation (the r,s are a by-product and discarded). That extra sequence is gated by `WOLFSSL_STM32C5` in the bare driver; the U3 OPSTEP machine does not require it.
+- `Stm32Ccb_Init()` pulse-resets the PKA / SAES / RNG before each operation, so the first CCB op is robust even when prior standalone crypto (RNG seeding, ECC keygen) left an engine in a state that would otherwise stall the CCB's chained SAES GCM step. The family-specific reset register name is abstracted (`WC_STM32_CCB_RSTR`).


+The caller is responsible for:
+
+1. Clock-tree bring-up (HSI/HSE, PLL, voltage scaling, flash latency).
+2. UART / VCP bring-up for stdout.
+3. Peripheral clock-enable for the IP blocks you use (RNG, CRYP/SAES, HASH, PKA).


     /* Generate a RNG seed using the hardware random number generator
      * on the STM32F2/F4/F7/L4. */
+    #include <wolfssl/wolfcrypt/port/st/stm32.h>
+        /* Pulls in WC_STM32_RNG_CLK_ENABLE for WOLFSSL_STM32_BARE builds */


dgarske self-assigned this May 4, 2026

Copilot AI review requested due to automatic review settings May 4, 2026 23:16

Copilot started reviewing on behalf of dgarske May 4, 2026 23:19 View session

Copilot AI reviewed May 4, 2026

View reviewed changes

dgarske force-pushed the stm32_bare branch 3 times, most recently from 8058c8c to 22ee90e Compare May 7, 2026 18:11

dgarske force-pushed the stm32_bare branch 5 times, most recently from 1c9091e to 3519503 Compare May 11, 2026 21:35

dgarske requested a review from Copilot May 11, 2026 21:36

Copilot AI reviewed May 11, 2026

View reviewed changes

Comment thread wolfssl/wolfcrypt/port/st/stm32.h Outdated

Comment thread wolfssl/wolfcrypt/port/st/stm32.h

Comment thread wolfcrypt/src/port/st/stm32.c

Comment thread wolfcrypt/src/random.c

Comment thread wolfcrypt/src/port/st/stm32.c

dgarske force-pushed the stm32_bare branch 2 times, most recently from 965e81b to 2c8100c Compare May 12, 2026 20:16

dgarske requested a review from Copilot May 12, 2026 20:26

Copilot AI reviewed May 12, 2026

View reviewed changes

Copilot started reviewing on behalf of dgarske May 12, 2026 21:00 View session

dgarske force-pushed the stm32_bare branch 4 times, most recently from 0145fa0 to b0ba9ce Compare May 15, 2026 23:30

dgarske force-pushed the stm32_bare branch from b0ba9ce to 4264147 Compare May 22, 2026 01:45

dgarske force-pushed the stm32_bare branch 3 times, most recently from 65fc021 to 9b9eb3e Compare June 3, 2026 17:00

Copilot started reviewing on behalf of dgarske June 12, 2026 23:03 View session

Copilot AI reviewed Jun 12, 2026

View reviewed changes

Comment thread wolfcrypt/src/random.c

Comment thread wolfcrypt/src/port/st/README.md Outdated

Comment thread wolfcrypt/src/port/st/README.md Outdated

Comment thread wolfcrypt/src/port/st/README.md Outdated

Comment thread wolfcrypt/src/port/st/README.md Outdated

dgarske mentioned this pull request Jun 12, 2026

Add RealTek AmebaPro2 (RTL8735B) HUK crypto-callback port #10677

Draft

dgarske force-pushed the stm32_bare branch from e88805b to 3ba188e Compare June 15, 2026 23:27

dgarske requested a review from Copilot June 15, 2026 23:28

Copilot started reviewing on behalf of dgarske June 15, 2026 23:30 View session

Copilot AI reviewed Jun 15, 2026

View reviewed changes

Comment thread wolfcrypt/src/random.c

Comment thread wolfcrypt/src/ecc.c

Comment thread wolfcrypt/src/ecc.c

Comment thread wolfcrypt/src/port/st/README.md Outdated

dgarske force-pushed the stm32_bare branch from 3ba188e to b1efa6a Compare June 16, 2026 17:21

dgarske requested a review from Copilot June 18, 2026 19:43

Copilot started reviewing on behalf of dgarske June 18, 2026 19:44 View session

Copilot AI reviewed Jun 18, 2026

View reviewed changes

Comment thread wolfcrypt/src/aes.c

Comment thread wolfcrypt/src/random.c

dgarske force-pushed the stm32_bare branch 2 times, most recently from 7bb6ce8 to 511da24 Compare June 19, 2026 17:53

dgarske marked this pull request as ready for review June 19, 2026 17:53

dgarske requested a review from Copilot June 19, 2026 17:53

dgarske assigned wolfSSL-Bot Jun 19, 2026

Copilot started reviewing on behalf of dgarske June 19, 2026 17:54 View session

Copilot AI reviewed Jun 19, 2026

View reviewed changes

Comment thread wolfssl/wolfcrypt/ecc.h Outdated

Comment thread wolfcrypt/src/aes.c

Comment thread wolfcrypt/src/aes.c

Comment thread doc/dox_comments/header_files/ecc.h Outdated

dgarske added 6 commits June 22, 2026 08:12

Add STM32 bare-metal support for Hash, SAES/AES, PKA and RNG

a4fe37a

Add STM32 DHUK (Device Hardware Unique Key) support via crypto callbacks

6413684

Add STM32 CCB and STM32C5 HW PKA ECDSA support

f59aa63

Refactor STM32 CCB driver and expand STM32 port docs and doxygen

a84ef7d

Add STM32C5 CCB ECDSA hardware blob-create support

f5842a0

dgarske force-pushed the stm32_bare branch from 511da24 to 54db326 Compare June 22, 2026 18:23

dgarske requested a review from Copilot June 22, 2026 19:34

Copilot started reviewing on behalf of dgarske June 22, 2026 19:39 View session

Copilot AI reviewed Jun 22, 2026

View reviewed changes

Conversation

dgarske commented May 4, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Features

New build options

Testing performed

Known limitations / follow-up

Reference

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Reviewed changes

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

github-actions Bot commented May 5, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

MemBrowse Memory Report

Uh oh!

dgarske commented May 7, 2026

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

dgarske commented May 22, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Uh oh!

Uh oh!

Uh oh!

github-actions Bot commented Jun 19, 2026

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Uh oh!

Uh oh!

Uh oh!

dgarske commented May 4, 2026 •

edited

Loading

github-actions Bot commented May 5, 2026 •

edited

Loading

dgarske commented May 22, 2026 •

edited

Loading