CW_Utils Class Reference

Portable utility functions for cryptographic and security operations. More...

#include <CW_Utils.h>

Static Public Member Functions
static bool	secure_compare (const uint8_t *a, const uint8_t *b, size_t len)
	Constant-time buffer comparison, resistant to timing side-channel attacks.
static void	secure_wipe (uint8_t *buf, size_t len)
	Securely zero a buffer, guaranteed not to be optimised away.
static bool	safe_memcpy (uint8_t *dst, size_t dstSize, const uint8_t *src, size_t count)
	Safe memcpy — validates pointers, sizes, and checks for overlap.
static bool	fill_secure_random (uint8_t *dest, size_t len)
	Fill len bytes at dest with cryptographically random data.

Detailed Description

Portable utility functions for cryptographic and security operations.

All methods here are platform-independent pure C++ with no dependency on Arduino or any hardware-specific library.

Hardware-specific helpers (e.g. TRNG byte generation) live in the concrete crypto provider implementation (ArduinoCryptoProvider).

Definition at line 45 of file CW_Utils.h.

Member Function Documentation

fill_secure_random()

bool CW_Utils::fill_secure_random ( uint8_t * dest, size_t len )

static

Fill len bytes at dest with cryptographically random data.

The implementation is platform-specific. On ESP32 it calls esp_fill_random() after verifying that Wi-Fi or Bluetooth is active, ensuring the hardware TRNG is properly seeded. Returns false (hard failure) if neither radio is on (SEC-001).

Parameters

dest	Destination buffer.
len	Number of random bytes to generate.

Returns

true on success, false if dest is NULL, len is zero, or no radio is active.

Definition at line 109 of file fuzz_der.cpp.

safe_memcpy()

bool CW_Utils::safe_memcpy ( uint8_t * dst, size_t dstSize, const uint8_t * src, size_t count )

static

Safe memcpy — validates pointers, sizes, and checks for overlap.

Safe memcpy — checks src, dst and size before copying.

Parameters

dst	Destination buffer.
dstSize	Capacity of the destination buffer.
src	Source buffer.
count	Number of bytes to copy.

Returns

true if copy succeeded, false if parameters are invalid.

true if copy succeeded, false otherwise.

Examples

BasicUsage.ino, Sign.ino, and UsdcSigning.ino.

Definition at line 50 of file CW_Utils.cpp.

Referenced by CW_SecureChannel::aesCbcDecrypt(), CW_SecureChannel::aesCbcEncrypt(), CryptnoxWallet::buildSignPayload(), CryptnoxWallet::extractRawSignature(), CW_SecureChannel::getCardCertificate(), CryptnoxWallet::getCardInfo(), CW_SecureChannel::getManufacturerCertificate(), loop(), CW_SecureChannel::mutuallyAuthenticate(), CW_SecureChannel::openSecureChannel(), CryptnoxWallet::parseDerSignature(), CW_SecureChannel::parseDerSigToRaw(), rlpFinalize(), setup(), and CryptnoxWallet::verifyPin().

secure_compare()

bool CW_Utils::secure_compare ( const uint8_t * a, const uint8_t * b, size_t len )

static

Constant-time buffer comparison, resistant to timing side-channel attacks.

Always iterates over the full length regardless of where the first difference occurs, preventing an attacker from inferring the correct value byte-by-byte via timing measurements.

Parameters

a	Pointer to the first buffer.
b	Pointer to the second buffer.
len	Number of bytes to compare.

Returns

true if the buffers are identical, false otherwise.

Definition at line 22 of file CW_Utils.cpp.

Referenced by CW_SecureChannel::aesCbcDecrypt(), and CW_SecureChannel::verifyCertificateChain().

secure_wipe()

void CW_Utils::secure_wipe ( uint8_t * buf, size_t len )

static

Securely zero a buffer, guaranteed not to be optimised away.

Uses a volatile pointer so the compiler cannot elide the writes, ensuring sensitive material is actually erased from memory.

Parameters

buf	Pointer to the buffer to wipe.
len	Number of bytes to zero.

Examples

BasicUsage.ino, Sign.ino, and UsdcSigning.ino.

Definition at line 37 of file CW_Utils.cpp.

Referenced by CW_SecureChannel::aesCbcDecrypt(), CW_SecureChannel::aesCbcEncrypt(), CW_SecureSession::clear(), encodeERC20Transfer(), CryptnoxWallet::establishSecureChannel(), CryptnoxWallet::extractRawSignature(), CryptnoxWallet::getCardInfo(), loop(), CW_SecureChannel::mutuallyAuthenticate(), rlpEncodeSignedTx(), setup(), CryptnoxWallet::sign(), CW_SecureChannel::verifyCertificateChain(), CryptnoxWallet::verifyPin(), and CW_SignRequest::~CW_SignRequest().

---

The documentation for this class was generated from the following files:

• src/cryptnox-sdk-cpp/CW_Utils.h
• src/cryptnox-sdk-cpp/CW_Utils.cpp
• src/cryptnox-sdk-cpp/fuzz/fuzz_der.cpp