CW_Defs.h

Go to the documentation of this file.

/*
 * SPDX-License-Identifier: LGPL-3.0-or-later
 * Copyright (c) 2026 Cryptnox SA
 */

 
#ifndef CW_DEFS_H
#define CW_DEFS_H
 
/******************************************************************
 * 0. Doxygen module groups (used by @ingroup throughout the SDK)
 ******************************************************************/




 
/******************************************************************
 * 1. Included files
 ******************************************************************/
 
#include "platform_compat.h"
#include "CW_Utils.h"
 
/******************************************************************
 * 2. Constants / define declarations
 ******************************************************************/
 
/* Session key sizes */
#define CW_AESKEY_SIZE    (32U)  
#define CW_MACKEY_SIZE    (32U)  
#define CW_IV_SIZE        (16U)  
 
/* Generic error codes */
#define CW_OK                         (0x00U)  
#define CW_NOK                        (0x01U)  
#define CW_INVALID_SESSION            (0x02U)  
 
/* Key / path types for SIGN command (keyType) */
#define CW_SIGN_CURR_K1               (0x00U)  
#define CW_SIGN_CURR_R1               (0x10U)  
#define CW_SIGN_DERIVE_K1             (0x01U)  
#define CW_SIGN_DERIVE_R1             (0x11U)  
#define CW_SIGN_PINLESS_K1            (0x03U)  
 
/* PIN mode for SIGN command */
#define CW_SIGN_WITH_PIN              (false)  
#define CW_SIGN_PINLESS               (true)   
 
/* Signature types for SIGN command */
#define CW_SIGN_SIG_ECDSA_LOW_S       (0x00U)  
#define CW_SIGN_SIG_ECDSA_EOSIO       (0x01U)  
#define CW_SIGN_SIG_SCHNORR_BIP340    (0x02U)  
 
/* SIGN-specific error codes */
#define CW_SIGN_KEY_TOO_SHORT                  (0x80U)
#define CW_SIGN_NO_KEY_LOADED                  (0x81U)
#define CW_SIGN_PIN_INCORRECT                  (0x82U)
#define CW_SIGN_KEY_TOO_SHORT_WITH_PINLESS_MODE (0x83U)
 
/* Size constants */
#define CW_RAW_SIGNATURE_SIZE         (64U)    
#define CW_HASH_SIZE                  (32U)    
#define CW_MAX_DERIVE_PATH_LENGTH     (20U)    
#define CW_MIN_PIN_LENGTH              (4U)    
#define CW_MAX_PIN_LENGTH              (9U)    
#define CW_USER_DATA_PAGE_SIZE        (208U)   
#define CW_CONNECT_MAX_ATTEMPTS        (5U)    
 
/* Byte offsets within a raw 64-byte signature (r[32] || s[32]) */
#define CW_SIG_R_OFFSET               (0U)   
#define CW_SIG_S_OFFSET               (32U)  
 
/* DER encoding tags (ASN.1) */
#define CW_DER_TAG_SEQUENCE           (0x30U)
#define CW_DER_TAG_INTEGER            (0x02U)
 
/* Certificate verification constants */
#define CW_CERT_NONCE_SIZE            (8U)     
 
/* Certificate verification result codes */
#define CW_CERT_OK                    (0x00U)  
#define CW_CERT_FORMAT_ERROR          (0x10U)  
#define CW_CERT_NONCE_MISMATCH        (0x11U)  
#define CW_CERT_CARD_SIG_INVALID      (0x12U)  
#define CW_CERT_MANUF_SIG_INVALID     (0x13U)  
#define CW_CERT_KEY_NOT_FOUND         (0x14U)  
 
/* Manufacturer certificate maximum buffer size (bytes).
 * Actual Cryptnox Basic G1 manufacturer certificate is 411 bytes (0x019B). */
#define CW_MANUF_CERT_MAX_BYTES       (420U)
 
/******************************************************************
 * 3. CW_Curve enum
 ******************************************************************/

enum CW_Curve {
    CW_CURVE_SECP256R1 = 0,  
    CW_CURVE_SECP256K1 = 1   
};
 
/******************************************************************
 * 4. CW_SecureSession struct
 ******************************************************************/

struct CW_SecureSession {
    uint8_t aesKey[CW_AESKEY_SIZE];  
    uint8_t macKey[CW_MACKEY_SIZE];  
    uint8_t iv[CW_IV_SIZE];          

    CW_SecureSession() {
        memset(aesKey, 0U, sizeof(aesKey));
        memset(macKey, 0U, sizeof(macKey));
        memset(iv, 0U, sizeof(iv));
    }

    void clear() {
        CW_Utils::secure_wipe(aesKey, sizeof(aesKey));
        CW_Utils::secure_wipe(macKey, sizeof(macKey));
        CW_Utils::secure_wipe(iv,     sizeof(iv));
    }
};
 
/******************************************************************
 * 5. Compile-time feature flags
 ******************************************************************/

#ifndef CW_VERIFY_CERT
#define CW_VERIFY_CERT 1
#endif
#if CW_VERIFY_CERT == 0
#  error "CW_VERIFY_CERT=0 disables certificate chain verification (CRIT-02/H-07). " \
         "Remove -DCW_VERIFY_CERT=0 from your build flags — this gate must never be disabled."
#endif

#ifndef CW_DEBUG_LOGGING
#  define CW_DEBUG_LOGGING 0
#endif
 
#if CW_DEBUG_LOGGING && defined(NDEBUG)
#  error "CW_DEBUG_LOGGING=1 is set but NDEBUG is defined (release/optimised build). " \
         "Debug logging must not ship in production firmware — it leaks session state " \
         "over UART.  Remove -DCW_DEBUG_LOGGING=1 from your release build flags (SEC-012)."
#endif
 
#endif // CW_DEFS_H