Skip to content

Commit a407280

Browse files
dgarskedgarske
committed
Example for ST-SAFE A120
1 parent 4561614 commit a407280

11 files changed

Lines changed: 3212 additions & 0 deletions

‎.gitignore‎

Lines changed: 5 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -402,3 +402,8 @@ kernel/bsdkm/bsd_example.ko
402402
kernel/bsdkm/machine
403403
kernel/bsdkm/opt_global.h
404404
kernel/bsdkm/x86
405+
406+
# STSAFE test executables
407+
stsafe/stsafe_test
408+
stsafe/wolfssl_stsafe_test
409+
stsafe/wolfssl_stsafe_full_test

‎stsafe/Makefile‎

Lines changed: 162 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,162 @@
1+
# STSAFE-A120 Test Makefile for Raspberry Pi
2+
#
3+
# Copyright 2025 wolfSSL Inc.
4+
5+
CC = gcc
6+
CFLAGS = -Wall -Wextra -O2 -g
7+
8+
# wolfSSL configuration
9+
# Option 1: Use installed wolfSSL (after make install)
10+
#WOLFSSL_DIR = /usr/local
11+
# Option 2: Use local wolfSSL source
12+
WOLFSSL_DIR = $(HOME)/wolfssl
13+
14+
# STSELib paths
15+
STSELIB_DIR = $(HOME)/STSELib
16+
PLATFORM_DIR = ./platform
17+
18+
# Include paths
19+
# Note: Current directory (.) must come first so our user_settings.h is found
20+
INCLUDES = -I. \
21+
-I$(STSELIB_DIR) \
22+
-I$(PLATFORM_DIR) \
23+
-I$(WOLFSSL_DIR)
24+
25+
# wolfSSL library flags
26+
# For installed wolfSSL:
27+
#LDFLAGS = -L$(WOLFSSL_DIR)/lib -lwolfssl -lm
28+
# For local wolfSSL source (using .libs):
29+
LDFLAGS = -L$(WOLFSSL_DIR)/src/.libs -lwolfssl -lm -Wl,-rpath,$(WOLFSSL_DIR)/src/.libs
30+
31+
# wolfSSL compile flags
32+
# WOLFSSL_USER_SETTINGS tells wolfSSL to include user_settings.h
33+
CFLAGS += -DWOLFSSL_USER_SETTINGS
34+
35+
# STSELib source files
36+
STSELIB_CORE_SRC = $(STSELIB_DIR)/core/stse_device.c \
37+
$(STSELIB_DIR)/core/stse_frame.c \
38+
$(STSELIB_DIR)/core/stse_generic_typedef.c \
39+
$(STSELIB_DIR)/core/stse_platform.c \
40+
$(STSELIB_DIR)/core/stse_session.c
41+
42+
STSELIB_API_SRC = $(wildcard $(STSELIB_DIR)/api/*.c)
43+
STSELIB_SERVICES_SRC = $(wildcard $(STSELIB_DIR)/services/stsafea/*.c) \
44+
$(wildcard $(STSELIB_DIR)/services/stsafel/*.c)
45+
STSELIB_CERT_SRC = $(wildcard $(STSELIB_DIR)/certificate/*.c)
46+
47+
# Platform source files
48+
PLATFORM_SRC = $(PLATFORM_DIR)/stse_platform_linux.c
49+
50+
# Platform crypto source (wolfSSL implementation)
51+
# Uncomment when building with wolfSSL crypto support:
52+
PLATFORM_CRYPTO_SRC = $(PLATFORM_DIR)/stse_platform_crypto_wolfssl.c
53+
54+
# Test source files
55+
TEST_SRC = stsafe_test.c
56+
WOLFSSL_TEST_SRC = wolfssl_stsafe_test.c
57+
WOLFSSL_FULL_TEST_SRC = wolfssl_stsafe_full_test.c
58+
59+
# All sources
60+
ALL_SRC = $(STSELIB_CORE_SRC) $(STSELIB_API_SRC) $(STSELIB_SERVICES_SRC) \
61+
$(STSELIB_CERT_SRC) $(PLATFORM_SRC) $(PLATFORM_CRYPTO_SRC) $(TEST_SRC)
62+
63+
# wolfSSL STSAFE port source
64+
WOLFSSL_STSAFE_SRC = $(WOLFSSL_DIR)/wolfcrypt/src/port/st/stsafe.c
65+
66+
# Targets
67+
TARGET = stsafe_test
68+
WOLFSSL_TARGET = wolfssl_stsafe_test
69+
WOLFSSL_FULL_TARGET = wolfssl_stsafe_full_test
70+
71+
.PHONY: all clean test info basic wolfssl wolfssl-full
72+
73+
all: $(TARGET)
74+
75+
# Full build with wolfSSL crypto support
76+
$(TARGET): $(TEST_SRC) $(PLATFORM_SRC) $(PLATFORM_CRYPTO_SRC)
77+
$(CC) $(CFLAGS) $(INCLUDES) -o $@ \
78+
$(TEST_SRC) \
79+
$(PLATFORM_SRC) \
80+
$(PLATFORM_CRYPTO_SRC) \
81+
$(STSELIB_CORE_SRC) \
82+
$(STSELIB_API_SRC) \
83+
$(STSELIB_SERVICES_SRC) \
84+
$(STSELIB_CERT_SRC) \
85+
$(LDFLAGS)
86+
87+
# Basic build without wolfSSL (for initial testing without host sessions)
88+
basic: $(TEST_SRC) $(PLATFORM_SRC)
89+
$(CC) $(CFLAGS) $(INCLUDES) -o $(TARGET) \
90+
$(TEST_SRC) \
91+
$(PLATFORM_SRC) \
92+
$(STSELIB_CORE_SRC) \
93+
$(STSELIB_API_SRC) \
94+
$(STSELIB_SERVICES_SRC) \
95+
$(STSELIB_CERT_SRC)
96+
97+
# wolfSSL crypto callback test build
98+
# Note: We compile stsafe.c directly since it's not built into libwolfssl by default
99+
# IMPORTANT: Use WOLFSSL_USE_OPTIONS_H to get options.h included for proper wolfSSL settings
100+
# We add -DWOLFSSL_STSAFEA120 -DUSE_STSAFE_RNG_SEED to enable STSAFE in stsafe.c
101+
WOLFSSL_STSAFE_FLAGS = -DWOLFSSL_USE_OPTIONS_H -DWOLFSSL_STSAFEA120 -DUSE_STSAFE_RNG_SEED -Wno-strict-prototypes
102+
WOLFSSL_BASE_FLAGS = -Wall -Wextra -O2 -g
103+
wolfssl: $(WOLFSSL_TEST_SRC) $(PLATFORM_SRC) $(PLATFORM_CRYPTO_SRC)
104+
$(CC) $(WOLFSSL_BASE_FLAGS) $(WOLFSSL_STSAFE_FLAGS) -I$(STSELIB_DIR) -I$(PLATFORM_DIR) -I$(WOLFSSL_DIR) \
105+
-c $(WOLFSSL_STSAFE_SRC) -o stsafe.o
106+
$(CC) $(WOLFSSL_BASE_FLAGS) $(WOLFSSL_STSAFE_FLAGS) -I$(STSELIB_DIR) -I$(PLATFORM_DIR) -I$(WOLFSSL_DIR) \
107+
-c $(PLATFORM_SRC) -o stse_platform_linux.o
108+
$(CC) $(WOLFSSL_BASE_FLAGS) $(WOLFSSL_STSAFE_FLAGS) -I$(STSELIB_DIR) -I$(PLATFORM_DIR) -I$(WOLFSSL_DIR) \
109+
-c $(PLATFORM_CRYPTO_SRC) -o stse_platform_crypto.o
110+
$(CC) $(WOLFSSL_BASE_FLAGS) $(WOLFSSL_STSAFE_FLAGS) -I$(STSELIB_DIR) -I$(PLATFORM_DIR) -I$(WOLFSSL_DIR) \
111+
-o $(WOLFSSL_TARGET) \
112+
$(WOLFSSL_TEST_SRC) \
113+
stse_platform_linux.o stse_platform_crypto.o stsafe.o \
114+
$(STSELIB_CORE_SRC) \
115+
$(STSELIB_API_SRC) \
116+
$(STSELIB_SERVICES_SRC) \
117+
$(STSELIB_CERT_SRC) \
118+
$(LDFLAGS)
119+
120+
test: $(TARGET)
121+
./$(TARGET)
122+
123+
test-wolfssl: wolfssl
124+
./$(WOLFSSL_TARGET)
125+
126+
# Full wolfSSL integration test with ECDH and benchmarks
127+
wolfssl-full: $(WOLFSSL_FULL_TEST_SRC) $(PLATFORM_SRC) $(PLATFORM_CRYPTO_SRC)
128+
$(CC) $(WOLFSSL_BASE_FLAGS) $(WOLFSSL_STSAFE_FLAGS) -I$(STSELIB_DIR) -I$(PLATFORM_DIR) -I$(WOLFSSL_DIR) \
129+
-c $(WOLFSSL_STSAFE_SRC) -o stsafe.o
130+
$(CC) $(WOLFSSL_BASE_FLAGS) $(WOLFSSL_STSAFE_FLAGS) -I$(STSELIB_DIR) -I$(PLATFORM_DIR) -I$(WOLFSSL_DIR) \
131+
-c $(PLATFORM_SRC) -o stse_platform_linux.o
132+
$(CC) $(WOLFSSL_BASE_FLAGS) $(WOLFSSL_STSAFE_FLAGS) -I$(STSELIB_DIR) -I$(PLATFORM_DIR) -I$(WOLFSSL_DIR) \
133+
-c $(PLATFORM_CRYPTO_SRC) -o stse_platform_crypto.o
134+
$(CC) $(WOLFSSL_BASE_FLAGS) $(WOLFSSL_STSAFE_FLAGS) -I$(STSELIB_DIR) -I$(PLATFORM_DIR) -I$(WOLFSSL_DIR) \
135+
-o $(WOLFSSL_FULL_TARGET) \
136+
$(WOLFSSL_FULL_TEST_SRC) \
137+
stse_platform_linux.o stse_platform_crypto.o stsafe.o \
138+
$(STSELIB_CORE_SRC) \
139+
$(STSELIB_API_SRC) \
140+
$(STSELIB_SERVICES_SRC) \
141+
$(STSELIB_CERT_SRC) \
142+
$(LDFLAGS)
143+
144+
test-wolfssl-full: wolfssl-full
145+
./$(WOLFSSL_FULL_TARGET)
146+
147+
clean:
148+
rm -f $(TARGET) $(WOLFSSL_TARGET) $(WOLFSSL_FULL_TARGET) *.o stsafe.o stse_platform_linux.o stse_platform_crypto.o
149+
150+
# Show configuration
151+
info:
152+
@echo "STSELib directory: $(STSELIB_DIR)"
153+
@echo "wolfSSL directory: $(WOLFSSL_DIR)"
154+
@echo "Platform directory: $(PLATFORM_DIR)"
155+
@echo "Include paths: $(INCLUDES)"
156+
@echo "Linker flags: $(LDFLAGS)"
157+
@echo ""
158+
@echo "Build targets:"
159+
@echo " make - Build with wolfSSL crypto support (full features)"
160+
@echo " make basic - Build without wolfSSL (basic tests only)"
161+
@echo " make test - Build and run tests"
162+
@echo " make clean - Clean build artifacts"

‎stsafe/README.md‎

Lines changed: 183 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,183 @@
1+
# wolfSSL STSAFE-A120 Test Suite
2+
3+
Test harness for wolfSSL integration with ST STSAFE-A120 secure element on Raspberry Pi 5.
4+
5+
## Hardware Requirements
6+
7+
- Raspberry Pi 5 (or compatible Linux system with I2C)
8+
- STSAFE-A120 secure element connected via I2C
9+
- I2C enabled on the system
10+
11+
## Software Requirements
12+
13+
- wolfSSL library (compiled with ECC, CMAC, SHA-384 support)
14+
- STSELib (ST Secure Element Library)
15+
- GCC compiler
16+
- Linux I2C development headers (`libi2c-dev`)
17+
18+
## Directory Structure
19+
20+
```
21+
stsafe/
22+
├── Makefile # Build configuration
23+
├── README.md # This file
24+
├── user_settings.h # wolfSSL configuration
25+
├── stsafe_test.c # STSELib basic tests
26+
├── wolfssl_stsafe_test.c # wolfSSL crypto callback tests
27+
├── wolfssl_stsafe_full_test.c # Full integration tests with benchmarks
28+
└── platform/
29+
├── stse_conf.h # STSELib configuration
30+
├── stse_platform_generic.h # Platform type definitions
31+
├── stse_platform_linux.c # Linux I2C platform implementation
32+
└── stse_platform_crypto_wolfssl.c # wolfSSL crypto for STSELib
33+
```
34+
35+
## Configuration
36+
37+
### I2C Setup
38+
39+
1. Enable I2C on Raspberry Pi:
40+
```bash
41+
sudo raspi-config
42+
# Navigate to: Interface Options -> I2C -> Enable
43+
```
44+
45+
2. Verify I2C device:
46+
```bash
47+
sudo i2cdetect -y 1
48+
# STSAFE should appear at address 0x20
49+
```
50+
51+
3. Set I2C permissions (optional, for non-root access):
52+
```bash
53+
sudo usermod -a -G i2c $USER
54+
# Logout and login again
55+
```
56+
57+
### Environment
58+
59+
Set paths to dependencies:
60+
```bash
61+
export WOLFSSL_DIR=$HOME/wolfssl
62+
export STSELIB_DIR=$HOME/STSELib
63+
```
64+
65+
## Building
66+
67+
### Prerequisites
68+
69+
1. Build wolfSSL with required features:
70+
```bash
71+
cd $WOLFSSL_DIR
72+
./configure --enable-cryptocb --enable-ecc --enable-cmac --enable-sha384 --enable-debug
73+
make
74+
```
75+
76+
2. Clone STSELib:
77+
```bash
78+
git clone https://github.com/STMicroelectronics/STSELib.git $STSELIB_DIR
79+
```
80+
81+
### Build Targets
82+
83+
```bash
84+
# Build basic STSELib tests (no wolfSSL crypto callbacks)
85+
make
86+
87+
# Build wolfSSL crypto callback tests
88+
make wolfssl
89+
90+
# Build full integration tests with benchmarks
91+
make wolfssl-full
92+
93+
# Build without wolfSSL (basic I2C tests only)
94+
make basic
95+
96+
# Clean build artifacts
97+
make clean
98+
99+
# Show configuration
100+
make info
101+
```
102+
103+
## Running Tests
104+
105+
### Basic STSELib Tests
106+
```bash
107+
./stsafe_test
108+
```
109+
110+
Tests:
111+
- Echo command (I2C communication)
112+
- Random number generation
113+
- ECC P-256 key generation
114+
- ECDSA P-256 signing
115+
- ECC P-384 key generation
116+
117+
### wolfSSL Crypto Callback Tests
118+
```bash
119+
./wolfssl_stsafe_test
120+
```
121+
122+
Tests:
123+
- RNG with STSAFE-A120
124+
- ECC P-256 key generation via crypto callback
125+
- ECC P-384 key generation via crypto callback
126+
- ECDSA P-256 sign/verify
127+
- ECDSA P-384 sign/verify
128+
129+
### Full Integration Tests
130+
```bash
131+
./wolfssl_stsafe_full_test
132+
```
133+
134+
Tests:
135+
- RNG benchmark
136+
- ECDSA P-256 benchmark (keygen, sign, verify timing)
137+
- Multiple sequential operations
138+
139+
## Expected Output
140+
141+
```
142+
================================================
143+
STSAFE-A120 Test Suite for wolfSSL Integration
144+
================================================
145+
146+
Initializing STSAFE handler...
147+
STSAFE-A120 initialized successfully.
148+
149+
Test: Echo Command
150+
Echo response matches!
151+
[PASS] Echo command
152+
153+
Test: Random Number Generation
154+
Random data: A1 B2 C3 D4 ...
155+
[PASS] Random number generation
156+
157+
Test: ECC Key Generation (P-256)
158+
Public Key X: 12345678...
159+
Public Key Y: ABCDEF01...
160+
[PASS] ECC P-256 key generation
161+
162+
...
163+
164+
================================================
165+
Test Summary: 5 passed, 0 failed
166+
================================================
167+
```
168+
169+
## Performance Results (Raspberry Pi 5)
170+
171+
| Operation | Time | Throughput |
172+
|-----------|------|------------|
173+
| RNG (256 bytes) | <1 ms | ~9 MB/s |
174+
| ECC P-256 KeyGen | ~40 ms | 25 ops/sec |
175+
| ECDSA P-256 Sign | ~51 ms | 19.5 ops/sec |
176+
| ECDSA P-256 Verify | ~79 ms | 12.7 ops/sec |
177+
178+
## References
179+
180+
- [wolfSSL Documentation](https://www.wolfssl.com/docs/)
181+
- [STSELib GitHub](https://github.com/STMicroelectronics/STSELib)
182+
- [STSAFE-A120 Datasheet](https://www.st.com/en/secure-mcus/stsafe-a120.html)
183+
- [Raspberry Pi I2C Documentation](https://www.raspberrypi.com/documentation/computers/raspberry-pi.html#gpio-and-the-40-pin-header)

0 commit comments

Comments
 (0)