esp32_crypto_provider.cpp

Go to the documentation of this file.

/*
 * SPDX-License-Identifier: LGPL-3.0-or-later
 * Copyright (c) 2026 Cryptnox SA
 */

 
#include "esp32_crypto_provider.h"
#include "CW_Utils.h"
#include "uECC.h"
#include "mbedtls/sha256.h"
#include "mbedtls/sha512.h"
#include "mbedtls/aes.h"
 
/******************************************************************
 * 1b. Internal curve translator
 ******************************************************************/
 
static const uECC_Curve_t* toCurve(CW_Curve curve) {
    const uECC_Curve_t* result = NULL;
    switch (curve) {
        case CW_CURVE_SECP256R1:
            result = uECC_secp256r1();
            break;
        case CW_CURVE_SECP256K1:
            result = uECC_secp256k1();
            break;
        default:
            result = NULL;
            break;
    }
    return result;
}
 
/******************************************************************
 * 1. Module constants
 ******************************************************************/
 
/* AES */
#define AES_BLOCK_SIZE_BYTES     (16U)  /* bytes in one AES block                          */
#define AES_KEY_BITS_PER_BYTE    (8U)   /* multiplier: key bytes → key bits                */
/* Maximum AES plaintext that can be padded: covers CW_USER_DATA_PAGE_SIZE + one block. */
#define AES_PAD_BUF_MAX_INPUT    (256U)
/* Pad buffer: max input + one extra block for the bit-padding byte.                    */
#define AES_PAD_BUF_SIZE         (AES_PAD_BUF_MAX_INPUT + AES_BLOCK_SIZE_BYTES)
 
/* ISO/IEC 9797-1 Method 2 (bit padding) */
#define BIT_PADDING_MARKER       (0x80U)  /* mandatory leading 1-bit as a full byte */
#define PADDING_ZERO_FILL        (0x00U)  /* fill value for padding bytes after marker */
 
/* mbedTLS SHA mode selectors */
#define MBEDTLS_SHA256_MODE      (0)   /* 0 = SHA-256, 1 = SHA-224 */
#define MBEDTLS_SHA512_MODE      (0)   /* 0 = SHA-512, 1 = SHA-384 */
 
/* mbedTLS return code for success */
#define MBEDTLS_OK               (0)
 
/* uECC return code for success */
#define UECC_SUCCESS             (1)
 
/******************************************************************
 * 2. SHA methods
 ******************************************************************/

bool ESP32CryptoProvider::sha256(const uint8_t* data, size_t len, uint8_t* out) {
    int ret = mbedtls_sha256(data, len, out, MBEDTLS_SHA256_MODE);
    return (ret == MBEDTLS_OK);
}

bool ESP32CryptoProvider::sha512(const uint8_t* data, size_t len, uint8_t* out) {
    int ret = mbedtls_sha512(data, len, out, MBEDTLS_SHA512_MODE);
    return (ret == MBEDTLS_OK);
}
 
/******************************************************************
 * 3. AES-CBC encrypt
 ******************************************************************/

uint16_t ESP32CryptoProvider::aesCbcEncrypt(const uint8_t* in, uint16_t len, uint8_t* out,
                                             const uint8_t* key, uint8_t keyLen,
                                             uint8_t* iv, bool bitPadding) {
    uint16_t result = 0U;
 
    if ((in != NULL) && (out != NULL) && (key != NULL) && (iv != NULL)) {
        uint8_t  padBuf[AES_PAD_BUF_SIZE] = { PADDING_ZERO_FILL };
        uint16_t encLen = 0U;
 
        if (bitPadding) {
            /* Round up to next block boundary after appending the 0x80 marker. */
            uint32_t paddedLen32 = ((static_cast<uint32_t>(len) + 1U + (AES_BLOCK_SIZE_BYTES - 1U)) / AES_BLOCK_SIZE_BYTES) * AES_BLOCK_SIZE_BYTES;
            uint16_t paddedLen   = static_cast<uint16_t>(paddedLen32);
 
            if (paddedLen <= static_cast<uint16_t>(AES_PAD_BUF_SIZE)) {
                (void)CW_Utils::safe_memcpy(padBuf, sizeof(padBuf), in, static_cast<size_t>(len));
                padBuf[static_cast<size_t>(len)] = BIT_PADDING_MARKER;
                /* Remaining bytes already zero from initialisation. */
                encLen = paddedLen;
            }
        } else {
            if (len <= static_cast<uint16_t>(AES_PAD_BUF_SIZE)) {
                (void)CW_Utils::safe_memcpy(padBuf, sizeof(padBuf), in, static_cast<size_t>(len));
                encLen = len;
            }
        }
 
        if (encLen > 0U) {
            mbedtls_aes_context ctx = {};
            mbedtls_aes_init(&ctx);
 
            unsigned int keyBits = static_cast<unsigned int>(
                static_cast<uint32_t>(keyLen) * static_cast<uint32_t>(AES_KEY_BITS_PER_BYTE));
 
            int ret = mbedtls_aes_setkey_enc(&ctx, key, keyBits);
 
            if (ret == MBEDTLS_OK) {
                ret = mbedtls_aes_crypt_cbc(&ctx, MBEDTLS_AES_ENCRYPT,
                                             static_cast<size_t>(encLen),
                                             iv, padBuf, out);
            }
 
            mbedtls_aes_free(&ctx);
 
            if (ret == MBEDTLS_OK) {
                result = encLen;
            }
        }
    }
 
    return result;
}
 
/******************************************************************
 * 4. AES-CBC decrypt
 ******************************************************************/

uint16_t ESP32CryptoProvider::aesCbcDecrypt(uint8_t* in, uint16_t len, uint8_t* out,
                                             const uint8_t* key, uint8_t keyLen,
                                             uint8_t* iv, bool bitPadding) {
    uint16_t result = 0U;
 
    if ((in != NULL) && (out != NULL) && (key != NULL) && (iv != NULL) && (len > 0U)) {
        bool blockAligned = ((static_cast<uint32_t>(len) % AES_BLOCK_SIZE_BYTES) == 0U);
 
        if (blockAligned) {
            mbedtls_aes_context ctx = {};
            mbedtls_aes_init(&ctx);
 
            unsigned int keyBits = static_cast<unsigned int>(
                static_cast<uint32_t>(keyLen) * static_cast<uint32_t>(AES_KEY_BITS_PER_BYTE));
 
            int ret = mbedtls_aes_setkey_dec(&ctx, key, keyBits);
 
            if (ret == MBEDTLS_OK) {
                ret = mbedtls_aes_crypt_cbc(&ctx, MBEDTLS_AES_DECRYPT,
                                             static_cast<size_t>(len),
                                             iv, in, out);
            }
 
            mbedtls_aes_free(&ctx);
 
            if (ret == MBEDTLS_OK) {
                if (bitPadding) {
                    /* Strip ISO/IEC 9797-1 Method 2 padding: scan backward,
                     * skip 0x00 bytes, then expect the 0x80 marker byte.
                     * padPos ends at the index of the 0x80 byte on success. */
                    uint16_t padPos    = len;
                    bool     found     = false;
                    bool     searching = true;
 
                    while ((padPos != static_cast<uint16_t>(0U)) && searching) {
                        padPos--;
                        if (out[padPos] == BIT_PADDING_MARKER) {
                            found     = true;
                            searching = false;
                        } else if (out[padPos] != PADDING_ZERO_FILL) {
                            searching = false;
                        } else {
                            /* byte is 0x00 — continue scanning toward the marker */
                        }
                    }
 
                    if (found) {
                        result = padPos;  /* bytes 0 .. padPos-1 are the plaintext */
                    }
                } else {
                    result = len;
                }
            }
        }
    }
 
    return result;
}
 
/******************************************************************
 * 5. ECDH and key generation (delegated to uECC shim)
 ******************************************************************/

bool ESP32CryptoProvider::ecdh(const uint8_t* pubKey, const uint8_t* privKey,
                                uint8_t* secret, CW_Curve curve) {
    bool result = false;
    const uECC_Curve_t* ueccCurve = toCurve(curve);
    if (ueccCurve != NULL) {
        int ret = uECC_shared_secret(pubKey, privKey, secret, ueccCurve);
        result = (ret == UECC_SUCCESS);
    }
    return result;
}

bool ESP32CryptoProvider::makeKey(uint8_t* pubKey, uint8_t* privKey,
                                   CW_Curve curve) {
    bool result = false;
    const uECC_Curve_t* ueccCurve = toCurve(curve);
    if (ueccCurve != NULL) {
        int ret = uECC_make_key(pubKey, privKey, ueccCurve);
        result = (ret == UECC_SUCCESS);
    }
    return result;
}
 
/******************************************************************
 * 6. Random bytes from ESP32 hardware True RNG
 ******************************************************************/

bool ESP32CryptoProvider::random(uint8_t* dest, unsigned size) {
    bool result = false;
 
    if ((dest != NULL) && (size > 0U)) {
        result = CW_Utils::fill_secure_random(dest, static_cast<size_t>(size));
    }
 
    return result;
}

bool ESP32CryptoProvider::ecdsaVerify(const uint8_t* pubKey64, const uint8_t* hash,
                                       size_t hashLen, const uint8_t* sig,
                                       CW_Curve curve) {
    bool result = false;
    const uECC_Curve_t* ueccCurve = toCurve(curve);
    if (ueccCurve != NULL) {
        int ret = uECC_verify(pubKey64, hash, static_cast<unsigned>(hashLen),
                              sig, ueccCurve);
        result = (ret == UECC_SUCCESS);
    }
    return result;
}