Skip to content

Add SHE (Secure Hardware Extension) support to wolfCrypt#10009

Draft
night1rider wants to merge 4 commits intowolfSSL:masterfrom
night1rider:SHE-update
Draft

Add SHE (Secure Hardware Extension) support to wolfCrypt#10009
night1rider wants to merge 4 commits intowolfSSL:masterfrom
night1rider:SHE-update

Conversation

@night1rider
Copy link
Contributor

@night1rider night1rider commented Mar 18, 2026

Implements software-only SHE CMD_LOAD_KEY message generation (M1/M2/M3)
and verification message computation (M4/M5) with optional crypto
callback support for hardware offload.

New files:

  • wolfssl/wolfcrypt/she.h: API declarations, constants, wc_SHE context
  • wolfcrypt/src/she.c: Miyaguchi-Preneel KDF, message generation,
    verification computation, and crypto callback integration
  • tests/api/test_she.c/h: API tests with 97% line / 100% function coverage

API:

  • wc_SHE_Init/Free, Init_Id, Init_Label (lifecycle)
  • wc_SHE_GenerateM1M2M3 (generate M1/M2/M3 to caller buffers, callback optional)
  • wc_SHE_GenerateM4M5 (generate M4/M5 to caller buffers, independent of
    M1/M2/M3, callback optional)
  • wc_SHE_ImportM1M2M3 (import external M1/M2/M3 into context)
  • wc_SHE_GetUID (callback required, fetches UID from hardware)
  • wc_SHE_GetCounter (callback required, reads monotonic counter from hardware)
  • wc_SHE_ExportKey (callback required, exports key slot as M1-M5 from hardware)
  • wc_SHE_SetKdfConstants (callback optional, WOLFSSL_SHE_EXTENDED only)
  • wc_SHE_SetM2Header (callback optional, WOLFSSL_SHE_EXTENDED only)
  • wc_SHE_SetM4Header (callback optional, WOLFSSL_SHE_EXTENDED only)
  • No key material stored in the context; all inputs passed at generation time

Crypto callback integration:

  • WC_ALGO_TYPE_SHE added to wc_AlgoType enum
  • Callback sub-types: WC_SHE_SET_UID, WC_SHE_GET_COUNTER,
    WC_SHE_GENERATE_M1M2M3, WC_SHE_GENERATE_M4M5, WC_SHE_EXPORT_KEY
  • Per-operation structs in wc_CryptoInfo union with full parameter passthrough
  • Dispatch functions in cryptocb.c
  • Optional features: NO_WC_SHE_GETUID, NO_WC_SHE_GETCOUNTER,
    NO_WC_SHE_EXPORTKEY, NO_WC_SHE_IMPORT_M123

Build system:

  • configure.ac: --enable-she=standard|extended
  • CMakeLists.txt: WOLFSSL_SHE standard|extended|no
  • src/include.am: she.c compilation
  • .github/workflows/os-check.yml: CI configs for standard, extended,
    and NO_* disable flag combinations

Ported from wolfHSM wh_she_crypto.c.

@night1rider night1rider self-assigned this Mar 18, 2026
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant