Add NXP QorIQ SEC (CAAM) hardware crypto port for PowerPC T-series

CMakeLists.txt

@@ -1612,6 +1612,10 @@ add_option("WOLFSSL_KEYGEN"
     "Enable key generation (default: disabled)"
     "no" "yes;no")
 
+add_option("WOLFSSL_DH_GEN_PARAMS"
+    "Enable DH domain parameter generation with key generation; protocols use the fixed FFDHE groups (default: enabled)"
+    "yes" "yes;no")
+
 add_option("WOLFSSL_CERTGEN"
     "Enable cert generation (default: disabled)"
     "no" "yes;no")
@@ -3046,6 +3050,9 @@ endif()
 
 if(WOLFSSL_KEYGEN)
     list(APPEND WOLFSSL_DEFINITIONS "-DWOLFSSL_KEY_GEN")
+    if(NOT WOLFSSL_DH_GEN_PARAMS)
+        list(APPEND WOLFSSL_DEFINITIONS "-DWOLFSSL_NO_DH_GEN_PARAMS")
+    endif()
 endif()
 if(WOLFSSL_CERTGEN)
     list(APPEND WOLFSSL_DEFINITIONS "-DWOLFSSL_CERT_GEN")

cmake/options.h.in

@@ -341,6 +341,9 @@ extern "C" {
 #cmakedefine WOLFSSL_IP_ALT_NAME
 #undef WOLFSSL_KEY_GEN
 #cmakedefine WOLFSSL_KEY_GEN
+
+#undef  WOLFSSL_NO_DH_GEN_PARAMS
+#cmakedefine WOLFSSL_NO_DH_GEN_PARAMS
 #undef WOLFSSL_NO_ASM
 #cmakedefine WOLFSSL_NO_ASM
 #undef WOLFSSL_NO_SHAKE128

configure.ac

@@ -4688,6 +4688,35 @@ then
     done
 fi
 
+# NXP QorIQ SEC (the PowerPC T-series security engine, a CAAM derivative).
+# Takes a comma separated list selecting the environment backend, e.g.
+#   --enable-sec-qoriq=baremetal
+AC_ARG_ENABLE([sec-qoriq],
+    [AS_HELP_STRING([--enable-sec-qoriq],[Enable wolfSSL support for the NXP QorIQ SEC engine, T1040/T2080 (default: disabled)])],
+    [ ENABLED_SEC_QORIQ=$enableval ],
+    [ ENABLED_SEC_QORIQ=no ]
+    )
+
+if test "$ENABLED_SEC_QORIQ" != "no"
+then
+    AM_CFLAGS="$AM_CFLAGS -DWOLFSSL_SEC_QORIQ"
+
+    for v in `echo $ENABLED_SEC_QORIQ | tr "," " "`
+    do
+      case $v in
+        yes | baremetal)
+            AM_CFLAGS="$AM_CFLAGS -DWOLFSSL_SEC_QORIQ_BAREMETAL"
+            ;;
+        linux)
+            AM_CFLAGS="$AM_CFLAGS -DWOLFSSL_SEC_QORIQ_LINUX"
+            ;;
+        *)
+            AC_MSG_ERROR([Invalid choice for --enable-sec-qoriq: $v (want baremetal or linux)])
+            ;;
+      esac
+    done
+fi
+
 AC_ARG_ENABLE([caam],
     [AS_HELP_STRING([--enable-caam],[Enable wolfSSL support for CAAM (default: disabled)])],
     [ ENABLED_CAAM=$enableval ],
@@ -5456,11 +5485,36 @@ fi
 
 # KEY GENERATION
 AC_ARG_ENABLE([keygen],
-    [AS_HELP_STRING([--enable-keygen],[Enable key generation (only applies to RSA key generation) (default: disabled)])],
+    [AS_HELP_STRING([--enable-keygen],[Enable key generation. Takes yes, no, or a comma separated list of: all, no-dh-params (drop DH domain parameter generation, keeping DH key generation; protocols use the fixed FFDHE groups) (default: disabled)])],
     [ ENABLED_KEYGEN=$enableval ],
     [ ENABLED_KEYGEN=no ]
     )
 
+# Expand the list form of --enable-keygen into the individual sub-features.
+ENABLED_DH_GEN_PARAMS=yes
+if test "$ENABLED_KEYGEN" != "no" && test "$ENABLED_KEYGEN" != "yes"
+then
+    for kg in `echo $ENABLED_KEYGEN | tr ',' ' '`
+    do
+        case $kg in
+        all)
+            ;;
+        no-dh-params | nodhparams | nodhparamgen)
+            ENABLED_DH_GEN_PARAMS=no
+            ;;
+        *)
+            AC_MSG_ERROR([Invalid choice for --enable-keygen: $kg. Use yes, no, all or no-dh-params.])
+            ;;
+        esac
+    done
+    ENABLED_KEYGEN=yes
+fi
+
+if test "$ENABLED_DH_GEN_PARAMS" = "no"
+then
+    AM_CFLAGS="$AM_CFLAGS -DWOLFSSL_NO_DH_GEN_PARAMS"
+fi
+
 if test "$ENABLED_BIND" = "yes" || test "$ENABLED_NTP" = "yes" || \
    test "$ENABLED_LIBSSH2" = "yes" || test "$ENABLED_OPENRESTY" = "yes" || \
    test "$ENABLED_NGINX" = "yes" || test "$ENABLED_WOLFENGINE" = "yes" || \
@@ -11550,7 +11604,7 @@ then
     fi
 fi
 
-if test "x$ENABLED_PKCS11" = "xyes" || test "x$ENABLED_WOLFTPM" = "xyes" || test "$ENABLED_CAAM" != "no" || test "x$ENABLED_RTL8735B" != "xno" || test "x$ENABLED_VAULTIC" = "xyes"
+if test "x$ENABLED_PKCS11" = "xyes" || test "x$ENABLED_WOLFTPM" = "xyes" || test "$ENABLED_CAAM" != "no" || test "$ENABLED_SEC_QORIQ" != "no" || test "x$ENABLED_RTL8735B" != "xno" || test "x$ENABLED_VAULTIC" = "xyes"
 then
     ENABLED_CRYPTOCB=yes
 fi
@@ -13381,6 +13435,7 @@ AM_CONDITIONAL([BUILD_BENCHMARK],[test "$ENABLED_BENCHMARK" = "yes"])
 AM_CONDITIONAL([BUILD_RC2],[test "x$ENABLED_RC2" = "xyes"])
 AM_CONDITIONAL([BUILD_CUDA],[test "x$ENABLED_CUDA" = "xyes"])
 AM_CONDITIONAL([BUILD_CAAM],[test "x$ENABLED_CAAM" != "xno"])
+AM_CONDITIONAL([BUILD_SEC_QORIQ],[test "x$ENABLED_SEC_QORIQ" != "xno"])
 AM_CONDITIONAL([BUILD_QNXCAAM],[test "x$ENABLED_CAAM_QNX" = "xyes"])
 AM_CONDITIONAL([BUILD_IOTSAFE],[test "x$ENABLED_IOTSAFE" = "xyes"])
 AM_CONDITIONAL([BUILD_IOTSAFE_HWRNG],[test "x$ENABLED_IOTSAFE_HWRNG" = "xyes"])
@@ -13803,6 +13858,7 @@ echo "   * BLAKE2S:                    $ENABLED_BLAKE2S"
 echo "   * SipHash:                    $ENABLED_SIPHASH"
 echo "   * CMAC:                       $ENABLED_CMAC"
 echo "   * keygen:                     $ENABLED_KEYGEN"
+echo "   * DH parameter generation:    $ENABLED_DH_GEN_PARAMS"
 echo "   * acert:                      $ENABLED_ACERT"
 echo "   * certgen:                    $ENABLED_CERTGEN"
 echo "   * certreq:                    $ENABLED_CERTREQ"

src/pk.c

@@ -4695,11 +4695,16 @@ int wolfSSL_DH_generate_parameters_ex(WOLFSSL_DH* dh, int prime_len,
         }
     }
     if (ret == 1) {
+    #ifndef WOLFSSL_NO_DH_GEN_PARAMS
         /* Generate parameters into internal DH key. */
         if (wc_DhGenerateParams(rng, prime_len, key) != 0) {
             WOLFSSL_ERROR_MSG("wc_DhGenerateParams error");
             ret = 0;
         }
+    #else
+        WOLFSSL_ERROR_MSG("DH parameter generation disabled in this build");
+        ret = 0;
+    #endif
     }
 
     /* Free local random number generator if created. */

tests/api/test_dh.c

@@ -1006,6 +1006,7 @@ int test_wc_DhGenerateParams_and_ExportRaw(void)
  * generate-and-export flow below is only valid with the full SP math
  * (WOLFSSL_SP_MATH_ALL), fastmath or heapmath backends. */
 #if !defined(NO_DH) && defined(WOLFSSL_KEY_GEN) && !defined(WOLFSSL_SP_MATH) && \
+    !defined(WOLFSSL_NO_DH_GEN_PARAMS) && \
     !defined(HAVE_SELFTEST) && !defined(HAVE_FIPS)
     DhKey dh;
     WC_RNG rng;

tests/unit-mcdc/test_dh_fault_whitebox.c

@@ -724,6 +724,7 @@ static void test_agree_nonblock(void)
  * subgroup) that cannot be produced deterministically without a working
  * fault-injection hook into the prime.c/sp_int.c backends this campaign's
  * allocator hook does not reach - left as residuals (see report). */
+#ifndef WOLFSSL_NO_DH_GEN_PARAMS
 static void test_generate_params(void)
 {
     WC_RNG rng;
@@ -745,6 +746,7 @@ static void test_generate_params(void)
 
     wc_FreeRng(&rng);
 }
+#endif /* !WOLFSSL_NO_DH_GEN_PARAMS */
 
 int main(void)
 {
@@ -774,7 +776,12 @@ int main(void)
     WB_NOTE("WC_DH_NONBLOCK not built; nb cache decisions "
             "(2070/2085/2098/2116) skipped");
 #endif
+#ifndef WOLFSSL_NO_DH_GEN_PARAMS
     test_generate_params();
+#else
+    WB_NOTE("WOLFSSL_NO_DH_GEN_PARAMS built; parameter generation decisions "
+            "(3293/3299) skipped");
+#endif
 
     printf("done (%s)\n", wb_fail ? "FAILURES" : "ok");
     return 0;

wolfcrypt/src/asn.c

@@ -33005,13 +33005,18 @@ int DecodeECC_DSA_Sig_Ex(const byte* sig, word32 sigLen, mp_int* r, mp_int* s,
     /* Clear dynamic data and set mp_ints to put r and s into. */
     XMEMSET(dataASN, 0, sizeof(dataASN));
     if (init) {
-        GetASN_MP(&dataASN[DSASIGASN_IDX_R], r);
-        GetASN_MP(&dataASN[DSASIGASN_IDX_S], s);
-    }
-    else {
-        GetASN_MP_Inited(&dataASN[DSASIGASN_IDX_R], r);
-        GetASN_MP_Inited(&dataASN[DSASIGASN_IDX_S], s);
+        /* Initialize here rather than leaving it to the item store, which
+         * only does so once an item has parsed. A decode that fails before
+         * that, or that stores r and then fails on s, would otherwise reach
+         * the mp_clear() calls below with values that were never
+         * initialized. */
+        ret = mp_init_multi(r, s, NULL, NULL, NULL, NULL);
+        if (ret != MP_OKAY) {
+            return ret;
+        }
     }
+    GetASN_MP_Inited(&dataASN[DSASIGASN_IDX_R], r);
+    GetASN_MP_Inited(&dataASN[DSASIGASN_IDX_S], s);
 
     /* Decode the DSA signature. */
     ret = GetASN_Items(dsaSigASN, dataASN, dsaSigASN_Length, 0, sig, &idx,

wolfcrypt/src/cryptocb.c

@@ -753,6 +753,39 @@ int wc_CryptoCb_RsaGetSize(const RsaKey* key, int* keySize)
 }
 #endif /* !NO_RSA */
 
+#ifndef NO_DH
+int wc_CryptoCb_Dh(DhKey* key, const byte* priv, word32 privSz,
+    const byte* otherPub, word32 pubSz, byte* agree, word32* agreeSz)
+{
+    int ret = WC_NO_ERR_TRACE(CRYPTOCB_UNAVAILABLE);
+    CryptoCb* dev;
+
+    if (key == NULL)
+        return ret;
+
+    /* locate registered callback */
+    dev = wc_CryptoCb_FindDevice(key->devId, WC_ALGO_TYPE_PK);
+    if (dev && dev->cb) {
+        wc_CryptoInfo cryptoInfo;
+        XMEMSET(&cryptoInfo, 0, sizeof(cryptoInfo));
+        cryptoInfo.algo_type = WC_ALGO_TYPE_PK;
+        cryptoInfo.pk.type = WC_PK_TYPE_DH;
+        cryptoInfo.pk.dh.key = key;
+        cryptoInfo.pk.dh.priv = priv;
+        cryptoInfo.pk.dh.privSz = privSz;
+        cryptoInfo.pk.dh.otherPub = otherPub;
+        cryptoInfo.pk.dh.pubSz = pubSz;
+        cryptoInfo.pk.dh.agree = agree;
+        cryptoInfo.pk.dh.agreeSz = agreeSz;
+
+        ret = dev->cb(dev->devId, &cryptoInfo, dev->ctx);
+    }
+
+    return wc_CryptoCb_TranslateErrorCode(ret);
+}
+#endif /* !NO_DH */
+
+
 #ifdef HAVE_ECC
 #ifdef HAVE_ECC_DHE
 int wc_CryptoCb_MakeEccKey(WC_RNG* rng, int keySize, ecc_key* key, int curveId)

wolfcrypt/src/dh.c

@@ -36,6 +36,9 @@
 #endif
 
 #include <wolfssl/wolfcrypt/dh.h>
+#ifdef WOLF_CRYPTO_CB
+    #include <wolfssl/wolfcrypt/cryptocb.h>
+#endif
 
 #ifdef WOLFSSL_HAVE_SP_DH
 #include <wolfssl/wolfcrypt/sp.h>
@@ -973,6 +976,7 @@ int wc_InitDhKey_ex(DhKey* key, void* heap, int devId)
 
     key->heap = heap; /* for XMALLOC/XFREE in future */
     key->trustedGroup = 0;
+    key->devId = devId;
 
 #ifdef WC_DH_INITIAL_RUNTIME_ENABLEMENT
     if (! wc_dh_enabled)
@@ -990,8 +994,6 @@ int wc_InitDhKey_ex(DhKey* key, void* heap, int devId)
     /* handle as async */
     ret = wolfAsync_DevCtxInit(&key->asyncDev, WOLFSSL_ASYNC_MARKER_DH,
         key->heap, devId);
-#else
-    (void)devId;
 #endif
 
 #ifdef WOLFSSL_KCAPI_DH
@@ -2137,6 +2139,41 @@ static int wc_DhAgree_Sync(DhKey* key, byte* agree, word32* agreeSz,
 #endif
     }
 
+#ifdef WOLF_CRYPTO_CB
+    /* Dispatched here, after the checks above, so a device gets validated
+     * inputs and the SP 800-56A guarantees do not depend on each driver
+     * reimplementing them. Placing it here rather than at the top of
+     * wc_DhAgree() also means the validation runs once, not twice, when a
+     * callback declines and software takes over. */
+    #ifndef WOLF_CRYPTO_CB_FIND
+    if (key->devId != INVALID_DEVID)
+    #endif
+    {
+        ret = wc_CryptoCb_Dh(key, priv, privSz, otherPub, pubSz, agree,
+                             agreeSz);
+        if (ret != WC_NO_ERR_TRACE(CRYPTOCB_UNAVAILABLE)) {
+            /* The shared secret must not be 1 (SP 800-56A 5.7.1.1). The
+             * software path below checks the mp_int; the device has already
+             * produced bytes, so check those. */
+            if (ret == 0) {
+                word32 i;
+                byte acc = 0;
+
+                for (i = 0; (i + 1) < *agreeSz; i++) {
+                    acc |= agree[i];
+                }
+                if ((acc == 0) && (*agreeSz > 0) &&
+                        (agree[*agreeSz - 1] == 1)) {
+                    WOLFSSL_MSG("wc_DhAgree shared secret is one");
+                    return MP_VAL;
+                }
+            }
+            return ret;
+        }
+        ret = 0; /* fall through to software */
+    }
+#endif
+
 #if defined(WC_DH_NONBLOCK) && defined(WOLFSSL_HAVE_SP_DH) && \
     defined(WOLFSSL_SP_NONBLOCK) && defined(WOLFSSL_SP_SMALL) && \
     !defined(WOLFSSL_SP_FAST_MODEXP)
@@ -2437,6 +2474,7 @@ int wc_DhAgree(DhKey* key, byte* agree, word32* agreeSz, const byte* priv,
         return FIPS_NOT_ALLOWED_E;
 #endif
 
+
 #ifdef WOLFSSL_KCAPI_DH
     (void)priv;
     (void)privSz;
@@ -3181,7 +3219,7 @@ int wc_DhCopyNamedKey(int name,
 }
 
 
-#ifdef WOLFSSL_KEY_GEN
+#if defined(WOLFSSL_KEY_GEN) && !defined(WOLFSSL_NO_DH_GEN_PARAMS)
 
 /* modulus_size in bits */
 int wc_DhGenerateParams(WC_RNG *rng, int modSz, DhKey *dh)

wolfcrypt/src/include.am

@@ -88,6 +88,14 @@ EXTRA_DIST += wolfcrypt/src/port/ti/ti-aes.c \
               wolfcrypt/src/port/nxp/dcp_port.c \
               wolfcrypt/src/port/nxp/se050_port.c \
               wolfcrypt/src/port/nxp/README.md \
+              wolfcrypt/src/port/nxp/sec_qoriq.c \
+              wolfcrypt/src/port/nxp/sec_qoriq_cb.c \
+              wolfcrypt/src/port/nxp/sec_qoriq_hash.c \
+              wolfcrypt/src/port/nxp/sec_qoriq_aes.c \
+              wolfcrypt/src/port/nxp/sec_qoriq_rng.c \
+              wolfcrypt/src/port/nxp/sec_qoriq_pkha.c \
+              wolfcrypt/src/port/nxp/sec_qoriq_baremetal.c \
+              wolfcrypt/src/port/nxp/sec_qoriq_linux.c \
               wolfcrypt/src/port/nxp/casper_port.c \
               wolfcrypt/src/port/nxp/hashcrypt_port.c \
               wolfcrypt/src/port/atmel/README.md \
@@ -243,6 +251,17 @@ endif
 EXTRA_DIST += wolfcrypt/src/port/sealsq/README.md
 
 
+if BUILD_SEC_QORIQ
+src_libwolfssl@LIBSUFFIX@_la_SOURCES += wolfcrypt/src/port/nxp/sec_qoriq.c
+src_libwolfssl@LIBSUFFIX@_la_SOURCES += wolfcrypt/src/port/nxp/sec_qoriq_cb.c
+src_libwolfssl@LIBSUFFIX@_la_SOURCES += wolfcrypt/src/port/nxp/sec_qoriq_hash.c
+src_libwolfssl@LIBSUFFIX@_la_SOURCES += wolfcrypt/src/port/nxp/sec_qoriq_aes.c
+src_libwolfssl@LIBSUFFIX@_la_SOURCES += wolfcrypt/src/port/nxp/sec_qoriq_rng.c
+src_libwolfssl@LIBSUFFIX@_la_SOURCES += wolfcrypt/src/port/nxp/sec_qoriq_pkha.c
+src_libwolfssl@LIBSUFFIX@_la_SOURCES += wolfcrypt/src/port/nxp/sec_qoriq_baremetal.c
+src_libwolfssl@LIBSUFFIX@_la_SOURCES += wolfcrypt/src/port/nxp/sec_qoriq_linux.c
+endif
+
 if BUILD_CAAM
 src_libwolfssl@LIBSUFFIX@_la_SOURCES += wolfcrypt/src/port/caam/wolfcaam_init.c
 src_libwolfssl@LIBSUFFIX@_la_SOURCES += wolfcrypt/src/port/caam/wolfcaam_qnx.c