Add SHE (Secure Hardware Extension) support to wolfCrypt

Author: night1rider

.github/workflows/os-check.yml

@@ -43,6 +43,8 @@ jobs:
           '--enable-dtls --enable-dtlscid --enable-dtls13 --enable-secure-renegotiation
             --enable-psk --enable-aesccm --enable-nullcipher
             CPPFLAGS=-DWOLFSSL_STATIC_RSA',
+          '--enable-she --enable-cmac',
+          '--enable-she --enable-cmac --enable-cryptocb --enable-cryptocbutils',
           '--enable-ascon --enable-experimental',
           '--enable-ascon CPPFLAGS=-DWOLFSSL_ASCON_UNROLL --enable-experimental',
           '--enable-all CPPFLAGS=''-DNO_AES_192 -DNO_AES_256'' ',

.wolfssl_known_macro_extras

@@ -889,6 +889,7 @@ WOLFSSL_SE050_NO_TRNG
 WOLFSSL_SECURE_RENEGOTIATION_ON_BY_DEFAULT
 WOLFSSL_SERVER_EXAMPLE
 WOLFSSL_SETTINGS_FILE
+WOLFSSL_SHE
 WOLFSSL_SH224
 WOLFSSL_SHA256_ALT_CH_MAJ
 WOLFSSL_SHA512_HASHTYPE

CMakeLists.txt

@@ -1600,6 +1600,20 @@ if(WOLFSSL_CMAC)
     endif()
 endif()
 
+# SHE (Secure Hardware Extension) key update message generation
+add_option("WOLFSSL_SHE"
+    "Enable SHE key update support (default: disabled)"
+    "no" "yes;no")
+
+if(WOLFSSL_SHE)
+    if (NOT WOLFSSL_AES)
+        message(FATAL_ERROR "Cannot use SHE without AES.")
+    else()
+        list(APPEND WOLFSSL_DEFINITIONS
+            "-DWOLFSSL_SHE")
+    endif()
+endif()
+
 # TODO: - RC2
 #       - FIPS, again (there's more logic for FIPS in configure.ac)
 #       - Selftest
@@ -2776,6 +2790,7 @@ if(WOLFSSL_EXAMPLES)
         tests/api/test_hash.c
         tests/api/test_hmac.c
         tests/api/test_cmac.c
+        tests/api/test_she.c
         tests/api/test_des3.c
         tests/api/test_chacha.c
         tests/api/test_poly1305.c

configure.ac

@@ -6014,6 +6014,15 @@ fi
 AS_IF([test "x$ENABLED_CMAC" = "xyes"],
       [AM_CFLAGS="$AM_CFLAGS -DWOLFSSL_CMAC -DWOLFSSL_AES_DIRECT"])
 
+# SHE (Secure Hardware Extension) key update message generation
+AC_ARG_ENABLE([she],
+    [AS_HELP_STRING([--enable-she],[Enable SHE key update support (default: disabled)])],
+    [ ENABLED_SHE=$enableval ],
+    [ ENABLED_SHE=no ]
+    )
+
+AS_IF([test "x$ENABLED_SHE" = "xyes"],
+      [AM_CFLAGS="$AM_CFLAGS -DWOLFSSL_SHE"])
 
 # AES-XTS
 AC_ARG_ENABLE([aesxts],
@@ -11402,6 +11411,7 @@ AM_CONDITIONAL([BUILD_FIPS_V6],[test $HAVE_FIPS_VERSION = 6])
 AM_CONDITIONAL([BUILD_FIPS_V6_PLUS],[test $HAVE_FIPS_VERSION -ge 6])
 AM_CONDITIONAL([BUILD_SIPHASH],[test "x$ENABLED_SIPHASH" = "xyes" || test "x$ENABLED_USERSETTINGS" = "xyes"])
 AM_CONDITIONAL([BUILD_CMAC],[test "x$ENABLED_CMAC" = "xyes" || test "x$ENABLED_USERSETTINGS" = "xyes"])
+AM_CONDITIONAL([BUILD_SHE],[test "x$ENABLED_SHE" = "xyes" || test "x$ENABLED_USERSETTINGS" = "xyes"])
 AM_CONDITIONAL([BUILD_SELFTEST],[test "x$ENABLED_SELFTEST" = "xyes"])
 AM_CONDITIONAL([BUILD_SHA224],[test "x$ENABLED_SHA224" = "xyes" || test "x$ENABLED_USERSETTINGS" = "xyes"])
 AM_CONDITIONAL([BUILD_SHA3],[test "x$ENABLED_SHA3" != "xno" || test "x$ENABLED_USERSETTINGS" = "xyes"])

src/include.am

@@ -159,6 +159,10 @@ if BUILD_CMAC
 src_libwolfssl@LIBSUFFIX@_la_SOURCES += wolfcrypt/src/cmac.c
 endif
 
+if BUILD_SHE
+src_libwolfssl@LIBSUFFIX@_la_SOURCES += wolfcrypt/src/she.c
+endif
+
 src_libwolfssl@LIBSUFFIX@_la_SOURCES += wolfcrypt/src/fips.c \
                              wolfcrypt/src/fips_test.c
 
@@ -424,6 +428,10 @@ if BUILD_CMAC
 src_libwolfssl@LIBSUFFIX@_la_SOURCES += wolfcrypt/src/cmac.c
 endif
 
+if BUILD_SHE
+src_libwolfssl@LIBSUFFIX@_la_SOURCES += wolfcrypt/src/she.c
+endif
+
 src_libwolfssl@LIBSUFFIX@_la_SOURCES += wolfcrypt/src/fips.c \
                              wolfcrypt/src/fips_test.c
 
@@ -673,6 +681,10 @@ if BUILD_CMAC
 src_libwolfssl@LIBSUFFIX@_la_SOURCES += wolfcrypt/src/cmac.c
 endif
 
+if BUILD_SHE
+src_libwolfssl@LIBSUFFIX@_la_SOURCES += wolfcrypt/src/she.c
+endif
+
 if BUILD_CURVE448
 src_libwolfssl@LIBSUFFIX@_la_SOURCES += wolfcrypt/src/curve448.c
 endif
@@ -1005,6 +1017,10 @@ if !BUILD_FIPS_V2_PLUS
 if BUILD_CMAC
 src_libwolfssl@LIBSUFFIX@_la_SOURCES += wolfcrypt/src/cmac.c
 endif
+
+if BUILD_SHE
+src_libwolfssl@LIBSUFFIX@_la_SOURCES += wolfcrypt/src/she.c
+endif
 endif !BUILD_FIPS_V2_PLUS
 
 if !BUILD_FIPS_V2

tests/api.c

@@ -183,6 +183,7 @@
 #include <tests/api/test_hash.h>
 #include <tests/api/test_hmac.h>
 #include <tests/api/test_cmac.h>
+#include <tests/api/test_she.h>
 #include <tests/api/test_des3.h>
 #include <tests/api/test_chacha.h>
 #include <tests/api/test_poly1305.h>
@@ -33840,6 +33841,11 @@ TEST_CASE testCases[] = {
     TEST_HMAC_DECLS,
     /* CMAC */
     TEST_CMAC_DECLS,
+    /* SHE */
+    TEST_SHE_DECLS,
+#ifdef WOLF_CRYPTO_CB
+    TEST_SHE_CB_DECLS,
+#endif
 
     /* Cipher */
     /* Triple-DES */

tests/api/include.am

@@ -18,6 +18,8 @@ tests_unit_test_SOURCES += tests/api/test_hash.c
 # MAC
 tests_unit_test_SOURCES += tests/api/test_hmac.c
 tests_unit_test_SOURCES += tests/api/test_cmac.c
+# SHE
+tests_unit_test_SOURCES += tests/api/test_she.c
 # Cipher
 tests_unit_test_SOURCES += tests/api/test_des3.c
 tests_unit_test_SOURCES += tests/api/test_chacha.c
@@ -124,6 +126,7 @@ EXTRA_DIST += tests/api/test_digest.h
 EXTRA_DIST += tests/api/test_hash.h
 EXTRA_DIST += tests/api/test_hmac.h
 EXTRA_DIST += tests/api/test_cmac.h
+EXTRA_DIST += tests/api/test_she.h
 EXTRA_DIST += tests/api/test_des3.h
 EXTRA_DIST += tests/api/test_chacha.h
 EXTRA_DIST += tests/api/test_poly1305.h