Skip to content

Commit e37dc29

Browse files
dgarskedgarske
committed
Fixed RX TSIP RSA key creation to populate the RsaKey public material.
Fixed issue with brace when using `WOLF_CRYPTO_CB_ONLY_RSA`. Fixed mixed declaration in `wc_RsaFunction_ex`. Fixed missing SetMyVersion with for RSA key gen with old ASN and no PKCS12. Added gating on RSA 1024/2048 RX TSIP build macros.
1 parent 099eaf5 commit e37dc29

7 files changed

Lines changed: 160 additions & 65 deletions

File tree

‎.wolfssl_known_macro_extras‎

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -485,6 +485,8 @@ THREADED_SNIFFTEST
485485
TIME_T_NOT_LONG
486486
TI_DUMMY_BUILD
487487
TLS13_RSA_PSS_SIGN_CB_NO_PREHASH
488+
TSIP_RSAES_1024
489+
TSIP_RSAES_2048
488490
UNICODE
489491
USER_CA_CB
490492
USER_CUSTOM_SNIFFX

‎wolfcrypt/src/asn.c‎

Lines changed: 2 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -25447,7 +25447,8 @@ int SetSerialNumber(const byte* sn, word32 snSz, byte* output,
2544725447
#endif /* !NO_CERTS */
2544825448

2544925449
#if defined(WOLFSSL_ASN_TEMPLATE) || defined(HAVE_PKCS12) || \
25450-
(defined(HAVE_ECC_KEY_EXPORT) && !defined(NO_ASN_CRYPT))
25450+
(defined(HAVE_ECC_KEY_EXPORT) && !defined(NO_ASN_CRYPT)) || \
25451+
(!defined(NO_RSA) && defined(WOLFSSL_KEY_GEN))
2545125452
int SetMyVersion(word32 version, byte* output, int header)
2545225453
{
2545325454
int i = 0;

‎wolfcrypt/src/port/Renesas/renesas_common.c‎

Lines changed: 28 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -255,6 +255,34 @@ static int Renesas_cmn_CryptoDevCb(int devIdArg, wc_CryptoInfo* info, void* ctx)
255255
#if defined(WOLFSSL_KEY_GEN) && defined(WOLFSSL_RENESAS_TSIP_CRYPTONLY)
256256
if (info->pk.type == WC_PK_TYPE_RSA_KEYGEN) {
257257
ret = wc_tsip_MakeRsaKey(info->pk.rsakg.size, (void*)ctx);
258+
if (ret == 0) {
259+
TsipUserCtx* tsipCtx = (TsipUserCtx*)ctx;
260+
RsaKey* key = info->pk.rsakg.key;
261+
#if defined(TSIP_RSAES_1024) && TSIP_RSAES_1024 == 1
262+
if (info->pk.rsakg.size == 1024) {
263+
/* export generated public key to the RsaKey structure */
264+
ret = wc_RsaPublicKeyDecodeRaw(
265+
tsipCtx->rsa1024pub_keyIdx->value.key_n,
266+
R_TSIP_RSA_1024_KEY_N_LENGTH_BYTE_SIZE,
267+
tsipCtx->rsa1024pub_keyIdx->value.key_e,
268+
R_TSIP_RSA_1024_KEY_E_LENGTH_BYTE_SIZE,
269+
key
270+
);
271+
}
272+
#endif
273+
#if defined(TSIP_RSAES_2048) && TSIP_RSAES_2048 == 1
274+
if (info->pk.rsakg.size == 2048) {
275+
/* export generated public key to the RsaKey structure */
276+
ret = wc_RsaPublicKeyDecodeRaw(
277+
tsipCtx->rsa2048pub_keyIdx->value.key_n,
278+
R_TSIP_RSA_2048_KEY_N_LENGTH_BYTE_SIZE,
279+
tsipCtx->rsa2048pub_keyIdx->value.key_e,
280+
R_TSIP_RSA_2048_KEY_E_LENGTH_BYTE_SIZE,
281+
key
282+
);
283+
}
284+
#endif
285+
}
258286
}
259287
#endif
260288
/* tsip only supports PKCSV15 padding scheme */

‎wolfcrypt/src/port/Renesas/renesas_tsip_rsa.c‎

Lines changed: 100 additions & 48 deletions
Original file line numberDiff line numberDiff line change
@@ -1,4 +1,4 @@
1-
/* renesas_sce_rsa.c
1+
/* renesas_tsip_rsa.c
22
*
33
* Copyright (C) 2006-2025 wolfSSL Inc.
44
*
@@ -38,7 +38,13 @@
3838
#include <wolfssl/wolfcrypt/rsa.h>
3939
#include <wolfssl/wolfcrypt/port/Renesas/renesas-tsip-crypt.h>
4040

41-
#ifdef WOLFSSL_RENESAS_TSIP_CRYPTONLY
41+
/* Make sure at least RSA 1024 or RSA 2048 is enabled */
42+
#if (defined(TSIP_RSAES_1024) && TSIP_RSAES_1024 == 0) && \
43+
(defined(TSIP_RSAES_2048) && TSIP_RSAES_2048 == 0)
44+
#error Please enable TSIP RSA 1024 or 2048. \
45+
This code assumes at least one is enabled
46+
#endif
47+
4248
/* Make RSA key for TSIP and set it to callback ctx
4349
* Assumes to be called by Crypt Callback
4450
*
@@ -50,63 +56,84 @@ int wc_tsip_MakeRsaKey(int size, void* ctx)
5056
{
5157
e_tsip_err_t ret;
5258
TsipUserCtx *info = (TsipUserCtx*)ctx;
53-
59+
#if defined(TSIP_RSAES_1024) && TSIP_RSAES_1024 == 1
5460
tsip_rsa1024_key_pair_index_t *tsip_pair1024_key = NULL;
61+
#endif
62+
#if defined(TSIP_RSAES_2048) && TSIP_RSAES_2048 == 1
5563
tsip_rsa2048_key_pair_index_t *tsip_pair2048_key = NULL;
64+
#endif
5665

5766
/* sanity check */
5867
if (ctx == NULL)
5968
return BAD_FUNC_ARG;
6069

70+
6171
if (size != 1024 && size != 2048) {
62-
WOLFSSL_MSG("Failed to generate key pair by TSIP");
72+
WOLFSSL_MSG("TSIP RSA KeyGen bit size not supported");
6373
return CRYPTOCB_UNAVAILABLE;
6474
}
75+
#if defined(TSIP_RSAES_1024) && TSIP_RSAES_1024 == 0
76+
if (size == 1024)
77+
return CRYPTOCB_UNAVAILABLE;
78+
#endif
79+
#if defined(TSIP_RSAES_2048) && TSIP_RSAES_2048 == 0
80+
if (size == 2048)
81+
return CRYPTOCB_UNAVAILABLE;
82+
#endif
6583

6684
if ((ret = tsip_hw_lock()) == 0) {
6785
if (size == 1024) {
86+
#if defined(TSIP_RSAES_1024) && TSIP_RSAES_1024 == 1
6887
tsip_pair1024_key =
69-
(tsip_rsa1024_key_pair_index_t*)XMALLOC(
70-
sizeof(tsip_rsa1024_key_pair_index_t), NULL,
71-
DYNAMIC_TYPE_RSA_BUFFER);
72-
if (tsip_pair1024_key == NULL)
88+
(tsip_rsa1024_key_pair_index_t*)XMALLOC(
89+
sizeof(tsip_rsa1024_key_pair_index_t), NULL,
90+
DYNAMIC_TYPE_RSA_BUFFER);
91+
if (tsip_pair1024_key == NULL) {
92+
tsip_hw_unlock();
7393
return MEMORY_E;
74-
94+
}
7595
ret = R_TSIP_GenerateRsa1024RandomKeyIndex(tsip_pair1024_key);
96+
#endif
7697
}
7798
else if (size == 2048) {
99+
#if defined(TSIP_RSAES_2048) && TSIP_RSAES_2048 == 1
78100
tsip_pair2048_key =
79-
(tsip_rsa2048_key_pair_index_t*)XMALLOC(
80-
sizeof(tsip_rsa2048_key_pair_index_t), NULL,
81-
DYNAMIC_TYPE_RSA_BUFFER);
82-
if (tsip_pair2048_key == NULL)
101+
(tsip_rsa2048_key_pair_index_t*)XMALLOC(
102+
sizeof(tsip_rsa2048_key_pair_index_t), NULL,
103+
DYNAMIC_TYPE_RSA_BUFFER);
104+
if (tsip_pair2048_key == NULL) {
105+
tsip_hw_unlock();
83106
return MEMORY_E;
84-
107+
}
85108
ret = R_TSIP_GenerateRsa2048RandomKeyIndex(tsip_pair2048_key);
109+
#endif
86110
}
87-
88111
if (ret == TSIP_SUCCESS) {
89112
if (size == 1024) {
113+
#if defined(TSIP_RSAES_1024) && TSIP_RSAES_1024 == 1
90114
XFREE(info->rsa1024pri_keyIdx, NULL, DYNAMIC_TYPE_RSA_BUFFER);
91115
XFREE(info->rsa1024pub_keyIdx, NULL, DYNAMIC_TYPE_RSA_BUFFER);
116+
92117
info->rsa1024pri_keyIdx =
93-
(tsip_rsa1024_private_key_index_t*)XMALLOC(
94-
sizeof(tsip_rsa1024_private_key_index_t), NULL,
95-
DYNAMIC_TYPE_RSA_BUFFER);
118+
(tsip_rsa1024_private_key_index_t*)XMALLOC(
119+
sizeof(tsip_rsa1024_private_key_index_t), NULL,
120+
DYNAMIC_TYPE_RSA_BUFFER);
96121

97122
if (info->rsa1024pri_keyIdx == NULL) {
98123
XFREE(tsip_pair1024_key, NULL, DYNAMIC_TYPE_RSA_BUFFER);
124+
tsip_hw_unlock();
99125
return MEMORY_E;
100126
}
101127

102128
info->rsa1024pub_keyIdx =
103-
(tsip_rsa1024_public_key_index_t*)XMALLOC(
104-
sizeof(tsip_rsa1024_public_key_index_t), NULL,
105-
DYNAMIC_TYPE_RSA_BUFFER);
129+
(tsip_rsa1024_public_key_index_t*)XMALLOC(
130+
sizeof(tsip_rsa1024_public_key_index_t), NULL,
131+
DYNAMIC_TYPE_RSA_BUFFER);
106132

107133
if (info->rsa1024pub_keyIdx == NULL) {
108134
XFREE(tsip_pair1024_key, NULL, DYNAMIC_TYPE_RSA_BUFFER);
109135
XFREE(info->rsa1024pri_keyIdx, NULL, DYNAMIC_TYPE_RSA_BUFFER);
136+
tsip_hw_unlock();
110137
return MEMORY_E;
111138
}
112139
/* copy generated key pair and free malloced key */
@@ -121,17 +148,21 @@ int wc_tsip_MakeRsaKey(int size, void* ctx)
121148
info->keyflgs_crypt.bits.rsapri1024_key_set = 1;
122149
info->keyflgs_crypt.bits.rsapub1024_key_set = 1;
123150
info->wrappedKeyType = TSIP_KEY_TYPE_RSA1024;
151+
#endif
124152
}
125153
else if (size == 2048) {
154+
#if defined(TSIP_RSAES_2048) && TSIP_RSAES_2048 == 1
126155
XFREE(info->rsa2048pri_keyIdx, NULL, DYNAMIC_TYPE_RSA_BUFFER);
127156
XFREE(info->rsa2048pub_keyIdx, NULL, DYNAMIC_TYPE_RSA_BUFFER);
157+
128158
info->rsa2048pri_keyIdx =
129-
(tsip_rsa2048_private_key_index_t*)XMALLOC(
130-
sizeof(tsip_rsa2048_private_key_index_t), NULL,
131-
DYNAMIC_TYPE_RSA_BUFFER);
159+
(tsip_rsa2048_private_key_index_t*)XMALLOC(
160+
sizeof(tsip_rsa2048_private_key_index_t), NULL,
161+
DYNAMIC_TYPE_RSA_BUFFER);
132162

133163
if (info->rsa2048pri_keyIdx == NULL) {
134164
XFREE(tsip_pair2048_key, NULL, DYNAMIC_TYPE_RSA_BUFFER);
165+
tsip_hw_unlock();
135166
return MEMORY_E;
136167
}
137168

@@ -144,6 +175,7 @@ int wc_tsip_MakeRsaKey(int size, void* ctx)
144175
XFREE(tsip_pair2048_key, NULL, DYNAMIC_TYPE_RSA_BUFFER);
145176
XFREE(info->rsa2048pri_keyIdx, NULL,
146177
DYNAMIC_TYPE_RSA_BUFFER);
178+
tsip_hw_unlock();
147179
return MEMORY_E;
148180
}
149181

@@ -159,15 +191,15 @@ int wc_tsip_MakeRsaKey(int size, void* ctx)
159191
info->keyflgs_crypt.bits.rsapri2048_key_set = 1;
160192
info->keyflgs_crypt.bits.rsapub2048_key_set = 1;
161193
info->wrappedKeyType = TSIP_KEY_TYPE_RSA2048;
194+
#endif
162195
}
163196
}
164-
165197
tsip_hw_unlock();
166198
}
167199

168-
169200
return 0;
170201
}
202+
171203
/* Generate TSIP key index if needed
172204
*
173205
* tuc struct pointer of TsipUserCtx
@@ -178,6 +210,7 @@ static int tsip_RsakeyImport(TsipUserCtx* tuc)
178210
int ret = 0;
179211

180212
switch (tuc->wrappedKeyType) {
213+
#if defined(TSIP_RSAES_1024) && TSIP_RSAES_1024 == 1
181214
case TSIP_KEY_TYPE_RSA1024:
182215
if (tuc->keyflgs_crypt.bits.rsapub1024_key_set != 1) {
183216
ret = tsip_ImportPublicKey(tuc, tuc->wrappedKeyType);
@@ -188,6 +221,8 @@ static int tsip_RsakeyImport(TsipUserCtx* tuc)
188221

189222
}
190223
break;
224+
#endif
225+
#if defined(TSIP_RSAES_2048) && TSIP_RSAES_2048 == 1
191226
case TSIP_KEY_TYPE_RSA2048:
192227
if (tuc->keyflgs_crypt.bits.rsapub2048_key_set != 1) {
193228
ret = tsip_ImportPublicKey(tuc, tuc->wrappedKeyType);
@@ -197,6 +232,7 @@ static int tsip_RsakeyImport(TsipUserCtx* tuc)
197232
ret = CRYPTOCB_UNAVAILABLE;
198233
}
199234
break;
235+
#endif
200236
default:
201237
WOLFSSL_MSG("wrapped private key is not supported");
202238
ret = CRYPTOCB_UNAVAILABLE;
@@ -220,7 +256,6 @@ int wc_tsip_RsaFunction(wc_CryptoInfo* info, TsipUserCtx* tuc)
220256
int type;
221257
tsip_rsa_byte_data_t plain, cipher;
222258

223-
224259
if (info == NULL || tuc == NULL) {
225260
return BAD_FUNC_ARG;
226261
}
@@ -230,48 +265,57 @@ int wc_tsip_RsaFunction(wc_CryptoInfo* info, TsipUserCtx* tuc)
230265
keySize = (int)tuc->wrappedKeyType;
231266

232267
if ((ret = tsip_hw_lock()) == 0) {
233-
if (type == RSA_PUBLIC_ENCRYPT || type == RSA_PUBLIC_DECRYPT) {
268+
if (type == RSA_PUBLIC_ENCRYPT ||
269+
type == RSA_PUBLIC_DECRYPT)
270+
{
234271
plain.pdata = (uint8_t*)info->pk.rsa.in;
235272
plain.data_length = info->pk.rsa.inLen;
236273
cipher.pdata = (uint8_t*)info->pk.rsa.out;
237274
cipher.data_length = *(info->pk.rsa.outLen);
238275

239-
if (keySize == TSIP_KEY_TYPE_RSA1024) {
276+
switch (keySize) {
277+
#if defined(TSIP_RSAES_1024) && TSIP_RSAES_1024 == 1
278+
case TSIP_KEY_TYPE_RSA1024:
240279
ret = R_TSIP_RsaesPkcs1024Encrypt(&plain, &cipher,
241280
tuc->rsa1024pub_keyIdx);
242-
}
243-
else if (keySize == TSIP_KEY_TYPE_RSA2048) {
281+
break;
282+
#endif
283+
#if defined(TSIP_RSAES_2048) && TSIP_RSAES_2048 == 1
284+
case TSIP_KEY_TYPE_RSA2048:
244285
ret = R_TSIP_RsaesPkcs2048Encrypt(&plain, &cipher,
245286
tuc->rsa2048pub_keyIdx);
246-
}
247-
else {
248-
WOLFSSL_MSG("keySize is invalid, neither 128 or 256 bytes, "
249-
"1024 or 2048 bits.");
250-
return BAD_FUNC_ARG;
287+
break;
288+
#endif
289+
default:
290+
ret = CRYPTOCB_UNAVAILABLE;
251291
}
252292
if (ret == 0) {
253293
*(info->pk.rsa.outLen) = cipher.data_length;
254294
}
255295
}
256-
else if (type == RSA_PRIVATE_DECRYPT || type == RSA_PRIVATE_ENCRYPT)
296+
else if (type == RSA_PRIVATE_DECRYPT ||
297+
type == RSA_PRIVATE_ENCRYPT)
257298
{
258299
plain.pdata = (uint8_t*)info->pk.rsa.out;
259300
plain.data_length = *(info->pk.rsa.outLen);
260301
cipher.pdata = (uint8_t*)info->pk.rsa.in;
261302
cipher.data_length = info->pk.rsa.inLen;
262303

263-
if (keySize == TSIP_KEY_TYPE_RSA1024) {
304+
switch (keySize) {
305+
#if defined(TSIP_RSAES_1024) && TSIP_RSAES_1024 == 1
306+
case TSIP_KEY_TYPE_RSA1024:
264307
ret = R_TSIP_RsaesPkcs1024Decrypt(&cipher, &plain,
265308
tuc->rsa1024pri_keyIdx);
266-
}
267-
else if (keySize == TSIP_KEY_TYPE_RSA2048) {
309+
break;
310+
#endif
311+
#if defined(TSIP_RSAES_2048) && TSIP_RSAES_2048 == 1
312+
case TSIP_KEY_TYPE_RSA2048:
268313
ret = R_TSIP_RsaesPkcs2048Decrypt(&cipher, &plain,
269314
tuc->rsa2048pri_keyIdx);
270-
}
271-
else {
272-
WOLFSSL_MSG("keySize is invalid, neither 128 or 256 bytes, "
273-
"1024 or 2048 bits.");
274-
return BAD_FUNC_ARG;
315+
break;
316+
#endif
317+
default:
318+
ret = CRYPTOCB_UNAVAILABLE;
275319
}
276320
if (ret == 0) {
277321
*(info->pk.rsa.outLen) = plain.data_length;
@@ -280,6 +324,10 @@ int wc_tsip_RsaFunction(wc_CryptoInfo* info, TsipUserCtx* tuc)
280324
tsip_hw_unlock();
281325
}
282326
}
327+
328+
if (ret != 0) {
329+
WOLFSSL_MSG("RSA key size is not supported (only 1024 or 2048 bits)");
330+
}
283331
return ret;
284332
}
285333
/* Perform Rsa verify by TSIP
@@ -324,6 +372,7 @@ int wc_tsip_RsaVerifyPkcs(wc_CryptoInfo* info, TsipUserCtx* tuc)
324372

325373
if ((ret = tsip_hw_lock()) == 0) {
326374
switch (tuc->wrappedKeyType) {
375+
#if defined(TSIP_RSAES_1024) && TSIP_RSAES_1024 == 1
327376
case TSIP_KEY_TYPE_RSA1024:
328377
err = R_TSIP_RsassaPkcs1024SignatureVerification(&sigData,
329378
&hashData,
@@ -340,6 +389,8 @@ int wc_tsip_RsaVerifyPkcs(wc_CryptoInfo* info, TsipUserCtx* tuc)
340389
ret = WC_HW_E;
341390
}
342391
break;
392+
#endif
393+
#if defined(TSIP_RSAES_2048) && TSIP_RSAES_2048 == 1
343394
case TSIP_KEY_TYPE_RSA2048:
344395
err = R_TSIP_RsassaPkcs2048SignatureVerification(&sigData,
345396
&hashData,
@@ -356,13 +407,14 @@ int wc_tsip_RsaVerifyPkcs(wc_CryptoInfo* info, TsipUserCtx* tuc)
356407
ret = WC_HW_E;
357408
}
358409
break;
410+
#endif
411+
default:
412+
ret = CRYPTOCB_UNAVAILABLE;
359413
}
360414
tsip_hw_unlock();
361415
}
362416
}
363417

364418
return ret;
365419
}
366-
#endif /* WOLFSSL_RENESAS_TSIP_CRYPTONLY */
367-
#endif /* WOLFSSL_RENESAS_TSIP_TLS || \
368-
WOLFSSL_RENESAS_TSIP_CRYPTONLY */
420+
#endif /* !NO_RSA && WOLFSSL_RENESAS_TSIP_CRYPTONLY */

0 commit comments

Comments
 (0)