diff options
Diffstat (limited to 'client/wolfssl/wolfcrypt/src/port/Renesas')
4 files changed, 1325 insertions, 0 deletions
diff --git a/client/wolfssl/wolfcrypt/src/port/Renesas/README.md b/client/wolfssl/wolfcrypt/src/port/Renesas/README.md new file mode 100644 index 0000000..ca60bc5 --- /dev/null +++ b/client/wolfssl/wolfcrypt/src/port/Renesas/README.md @@ -0,0 +1,176 @@ +# TSIP FIT Module port +Support for TSIP FIT driver for symmetric AES, SHA1/SHA256 hardware acceleration and TLS-linked capability including Root CA, the server certificate or intermediate certificate verification. + +## Overview +Renesas TSIP FIT module with wolfSSL by setting *WOLFSSL_RENESAS_TSIP* definition. + +Including the following examples: + +* simple tls_client/tls_server +* crypt test +* crypt benchmark + + The *user_settings.h* file enables some of the hardened settings. + +## Requirements +### 1. [Renesas TSIP FIT module](https://www.renesas.com/us/en/products/software-tools/software-os-middleware-driver/security-crypto/trusted-secure-ip-driver.html) +[FIT module](https://www.renesas.com/us/en/products/software-tools/software-os-middleware-driver/software-package/fit.html) +Note : The included example program is tested with <u>TSIP FIT version **1.06**</u>. + +### 2. [e2studio](https://www.renesas.com/us/en/products/software-tools/tools/ide/e2studio.html) + +### 3. Evaluation Board that supports TSIP +Note : The included example program is tested with [GR-ROSE](http://gadget.renesas.com/en/product/rose.html), which is classified to RX65N. + +## Setup and Build wolfSSL library + 1. Uncomment out #define WOLFSSL_RENESAS_TSIP in /path/to/wolfssl/wolfssl/wolfcrypt/settings.h + Uncomment out #define WOLFSSL_RENESAS_RX65N in /path/to/wolfssl/wolfssl/wolfcrypt/settings.h + 2. Open a project file at /path/to/wolfssl/IDE/Renesas/e2studio/Projects/wolfssl/ by e2studio and build to create wolfssl library +Note : Generating FIT module source files in advance are required to compile wolfSSL when enabling WOLFSSL_RENESAS_TSIP and WOLFSSL_RENESAS_RX65N. Please see for creating FIT module files at "Setup and Build and example program" in this readme below. + +To disable portions of the hardware acceleration you can optionally define: + +``` +/* Disabled SHA acceleration */ +#define NO_WOLFSSL_RENESAS_TSIP_CRYPT_HASH +/* Disabled TLS-linked acceleration */ +#define NO_WOLFSSL_RENESAS_TSIP_TLS_SESSION +``` +### Benchmarks +**Software only implementation:** +*block cipher* +``` +RNG 200 KB took 1.099 seconds, 182.000 KB/s +SHA 1 MB took 1.005 seconds, 1.166 MB/s +SHA-256 425 KB took 1.038 seconds, 409.520 KB/s +``` + +*TLS establishment time* +``` +TLS_RSA_WITH_AES_128_CBC_SHA : 0.651 (s) +TLS_RSA_WITH_AES_128_CBC_SHA256 : 0.651 (s) +TLS_RSA_WITH_AES_256_CBC_SHA : 0.642 (s) +TLS_RSA_WITH_AES_256_CBAC_SHA256 : 0.662 (s) +TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256 : 2.050 (s) +``` +**Hardware acceleration:** +*block cipher* +``` +RNG 1 MB took 1.011 seconds, 1.038 MB/s +SHA 12 MB took 1.001 seconds, 11.515 MB/s +SHA-256 13 MB took 1.001 seconds, 12.900 MB/s +``` +*TLS establishment time with TLS-linked capability* +*Perform full TlS-linked capability* +``` +TLS_RSA_WITH_AES_128_CBC_SHA : 0.141 (s) +TLS_RSA_WITH_AES_128_CBC_SHA256 : 0.141 (s) +TLS_RSA_WITH_AES_256_CBC_SHA : 0.141 (s) +TLS_RSA_WITH_AES_256_CBAC_SHA256 : 0.144 (s) +``` +*Perform certificate verification by TSIP TLS-linked API* +``` +TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256 : 1.721 (s) +``` +Condition: +Renesas : e2Studio v7.4.0 +ToolChain : Renesas CCRX version 3.00.00 +TSIP FIT : version 1.0.6 +Board : [GR-ROSE](http://gadget.renesas.com/en/product/rose.html) +wolfSSL : 4.1.0 + + +## Setup and Build an example program +An example program expects the following FIT modules: + +* r_bsp +* r_cmt_rx +* r_config +* r_ether_rx +* r_sys_time_rx +* r_t4_driver_rx +* r_t4_rx +* r_tsip_rx + +These needed source files can be generated by creating a dummy project including Renesas Smart Configurator as steps below: + + 1. Create a dummy project including Renesas Smart Configurator for your evaluation board type + 2. Open Smart Configurator and add FIT modules above + It would need to expand *User Stack Size* property and *Heap Size* of r_bsp. + Change IP ADDRESS and PORT NUMBER in r_t4_rx_config.h + `#define T4_CFG_FIXED_IP_ADDRESS_CH0 192,168,1,33` + `#define T4_CFG_TCP_REPID1_PORT_NUMBER 11111` + Note: It would need to modify other configuration base on evaluation board. + + When using GR-ROSE, you can choose "GR-ROSE" from "board" tab and "board" drop-down list and then is able to follow settings below: + + Go to component tab and open r_ether_rx properties: + Ethernet interface : RMII + The register bus of PHY0 for ETHER0/1: Use ETHER0 + Resource, ETHERC: Check ETHERC0_RMII + + Go to component tab and open r_t4_rx properties: + Enable/Disable DHCP function : 0 + IP address for ch0, when DHCP disable : 192,168,1,33 + TCP REPID1 prot number : 11111 + + Go to pins tab and select ethernet controller + Check to use pins + + 3. Generate source code +Now, it is able to copy these FIT modules into an example project. + 4. Make "smc_gen" folder under /path/to/wolfssl/IDE/Renesas/e2studio/Projects/test/src/ + 5. Copy the FIT modules into the folder that is created at step 4. + 6. Open an example project file at /path/to/wolfssl/IDE/Renesas/e2studio/Projects/test/ by e2studio + 7. Enable a macro definition in /path/to/wolfssl/IDE/Renesas/e2studio/Projects/test/src/wolfssl_demo.h for application type + `#define CRYPT_TEST // enable crypt test` + `#define BENCHMARK // enable benchmark application` + `#define TLS_CLIENT // enable simple tls client application` + `#define TLS_SERVER // enable simple tls server application` + `#define USE_TSIP_TLS // to inform user key and flash keying, when using TSIP` + Note: CRYPT_TEST and BENCHMARK can be enabled at the same time. TLS_CLIENT and TLS_SERVER cannot be enabled together other definitions. + 7. Setup debug configuration based on your debug hardware + +## Run client/server program on the device +When testing the embedded client or server on the device, it is recommended to test against one of the standard wolfSSL example application running on a desktop machine. + + +For the embedded client, an example server commands for running on a desktop machine, IP address 192.168.1.45, is as follows: +`$./example/server/server -b -d -i` + + +For the embedded server, an example client commands for running on a desktop machine is as follows: +`$./example/client/client -h 192.168.1.33 -p 11111` + +## Modify an example program +To use own TSIP keys for TSIP TLS-linked API use, it needs own flash keyring, PSS signed signature and RSA key. + +### Create flash keyring and use it in an example program + 1. Please follow the instruction at TSIP manual, chapter 7. Key Data Operations. + 2. Copy and paste s_flash[] data to s_flash[] data in example-program/key_data.c +`const uint32_t s_flash[] =` + +### Create RSA key pair for signing Root CA verification and use them in an example program + To use TSIP TLS-linked APIs, it needs RSA key pair and Root CA certificate bundle signature by RSA 2048 PSS with SHA256. + Shell and Perl script program in /path/to/wolfssl/IDE/Renesas/e2studio/Projects/tools/ can be used for the purpose. + + * generate_rsa_keypair.sh : generate RSA 2048 bit key pair. Show modulus and public exponent when specifying "-s" option + * rsa_pss_sign.sh : sign the file by the specified private key + * genhexbuf.pl : generate C header file including a byte array generated from the specified file in the script + + Modulus and public exponent showed by `generate_rsa_keypair.sh` can be used for input date to Renesas Secure Flash Programmer to generate encrypted RSA keys for TSIP TLS-linked API use. Please follow the instruction about how to generate RSA keys in the TSIP manual. + + + Generated byte array of signed signature by genhexbuf.pl can be replaced signature data in key_data.c of an example program. + + + Encrypted RSA key and generated byte array of signed signature need to be informed wolfSSL library before loading CA certification. Please see SetTsipTlskey() function an example program about how to inform them. + +### Coding + +In your application you must include <wolfssl/wolfcrypt/settings.h> before any other wolfSSL headers. If building the sources directly we recommend defining `WOLFSSL_USER_SETTINGS` and adding your own `user_settings.h` file. You can find a good reference for this in `/path/to/Renesas/e2studio/Projects/common/user_settings.h`. + +## Support + For question please email [[email protected]] + + diff --git a/client/wolfssl/wolfcrypt/src/port/Renesas/renesas_tsip_aes.c b/client/wolfssl/wolfcrypt/src/port/Renesas/renesas_tsip_aes.c new file mode 100644 index 0000000..ce04ff5 --- /dev/null +++ b/client/wolfssl/wolfcrypt/src/port/Renesas/renesas_tsip_aes.c @@ -0,0 +1,156 @@ +/* renesas_tsip_aes.c + * + * Copyright (C) 2006-2020 wolfSSL Inc. + * + * This file is part of wolfSSL. + * + * wolfSSL is free software; you can redistribute it and/or modify + * it under the terms of the GNU General Public License as published by + * the Free Software Foundation; either version 2 of the License, or + * (at your option) any later version. + * + * wolfSSL is distributed in the hope that it will be useful, + * but WITHOUT ANY WARRANTY; without even the implied warranty of + * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the + * GNU General Public License for more details. + * + * You should have received a copy of the GNU General Public License + * along with this program; if not, write to the Free Software + * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1335, USA + */ + +#include <string.h> +#include <stdio.h> + +#ifdef HAVE_CONFIG_H + #include <config.h> +#endif +#include <wolfssl/wolfcrypt/settings.h> +#include <stdio.h> + +#ifndef NO_AES + +#if defined(WOLFSSL_RENESAS_TSIP_CRYPT) && \ + !defined(NO_WOLFSSL_RENESAS_TSIP_CRYPT_AES) + +#include <wolfssl/wolfcrypt/wc_port.h> +#include <wolfssl/wolfcrypt/error-crypt.h> + +#include <wolfssl/wolfcrypt/aes.h> +#include "wolfssl/wolfcrypt/port/Renesas/renesas-tsip-crypt.h" + +struct Aes; + +int wc_tsip_AesCbcEncrypt(struct Aes* aes, byte* out, const byte* in, word32 sz) +{ + tsip_aes_handle_t _handle; + word32 ret; + word32 blocks = (sz / AES_BLOCK_SIZE); + uint32_t dataLength; + byte *iv; + + if ((in == NULL) || (out == NULL) || (aes == NULL)) + return BAD_FUNC_ARG; + + /* while doing TLS handshake, TSIP driver keeps true-key and iv * + * on the device. iv is dummy */ + iv = (uint8_t*)aes->reg; + + if((ret = tsip_hw_lock()) != 0){ + WOLFSSL_MSG("Failed to lock"); + return ret; + } + + if (aes->ctx.keySize == 16) { + ret = R_TSIP_Aes128CbcEncryptInit(&_handle, &aes->ctx.tsip_keyIdx, iv); + } else if (aes->ctx.keySize == 32) { + ret = R_TSIP_Aes256CbcEncryptInit(&_handle, &aes->ctx.tsip_keyIdx, iv); + } else { + tsip_hw_unlock(); + return -1; + } + + while (ret == TSIP_SUCCESS && blocks--) { + + if (aes->ctx.keySize == 16) + ret = R_TSIP_Aes128CbcEncryptUpdate(&_handle, (uint8_t*)in, + (uint8_t*)out, (uint32_t)AES_BLOCK_SIZE); + else + ret = R_TSIP_Aes256CbcEncryptUpdate(&_handle, (uint8_t*)in, + (uint8_t*)out, (uint32_t)AES_BLOCK_SIZE); + + in += AES_BLOCK_SIZE; + out += AES_BLOCK_SIZE; + } + + if (ret == TSIP_SUCCESS) { + if (aes->ctx.keySize == 16) { + ret = R_TSIP_Aes128CbcEncryptFinal(&_handle, out, &dataLength); + } else { + ret = R_TSIP_Aes256CbcEncryptFinal(&_handle, out, &dataLength); + } + } else { + WOLFSSL_MSG("TSIP AES CBC encryption failed"); + ret = -1; + } + + tsip_hw_unlock(); + return ret; +} + +int wc_tsip_AesCbcDecrypt(struct Aes* aes, byte* out, const byte* in, word32 sz) +{ + tsip_aes_handle_t _handle; + word32 ret; + word32 blocks = (sz / AES_BLOCK_SIZE); + uint32_t dataLength; + byte *iv; + + if ((in == NULL) || (out == NULL) || (aes == NULL)) + return BAD_FUNC_ARG; + + iv = (uint8_t*)aes->reg; + + if((ret = tsip_hw_lock()) != 0){ + WOLFSSL_MSG("Failed to lock"); + return ret; + } + + if (aes->ctx.keySize == 16) { + ret = R_TSIP_Aes128CbcDecryptInit(&_handle, &aes->ctx.tsip_keyIdx, iv); + } else if (aes->ctx.keySize == 32) { + ret = R_TSIP_Aes256CbcDecryptInit(&_handle, &aes->ctx.tsip_keyIdx, iv); + } else { + tsip_hw_unlock(); + return -1; + } + + while (ret == TSIP_SUCCESS && blocks--) { + + if (aes->ctx.keySize == 16) + ret = R_TSIP_Aes128CbcDecryptUpdate(&_handle, (uint8_t*)in, + (uint8_t*)out, (uint32_t)AES_BLOCK_SIZE); + else + ret = R_TSIP_Aes256CbcDecryptUpdate(&_handle, (uint8_t*)in, + (uint8_t*)out, (uint32_t)AES_BLOCK_SIZE); + + in += AES_BLOCK_SIZE; + out += AES_BLOCK_SIZE; + } + + if (ret == TSIP_SUCCESS) { + if (aes->ctx.keySize == 16) + ret = R_TSIP_Aes128CbcDecryptFinal(&_handle, out, &dataLength); + else + ret = R_TSIP_Aes256CbcDecryptFinal(&_handle, out, &dataLength); + } else { + WOLFSSL_MSG("TSIP AES CBC decryption failed"); + ret = -1; + } + + tsip_hw_unlock(); + return ret; +} + +#endif /* WOLFSSL_RENESAS_TSIP_CRYPT */ +#endif /* NO_AES */ diff --git a/client/wolfssl/wolfcrypt/src/port/Renesas/renesas_tsip_sha.c b/client/wolfssl/wolfcrypt/src/port/Renesas/renesas_tsip_sha.c new file mode 100644 index 0000000..b12d8ee --- /dev/null +++ b/client/wolfssl/wolfcrypt/src/port/Renesas/renesas_tsip_sha.c @@ -0,0 +1,274 @@ +/* renesas_tsip_sha.c + * + * Copyright (C) 2006-2020 wolfSSL Inc. + * + * This file is part of wolfSSL. + * + * wolfSSL is free software; you can redistribute it and/or modify + * it under the terms of the GNU General Public License as published by + * the Free Software Foundation; either version 2 of the License, or + * (at your option) any later version. + * + * wolfSSL is distributed in the hope that it will be useful, + * but WITHOUT ANY WARRANTY; without even the implied warranty of + * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the + * GNU General Public License for more details. + * + * You should have received a copy of the GNU General Public License + * along with this program; if not, write to the Free Software + * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1335, USA + */ +#include <string.h> +#include <stdio.h> + +#ifdef HAVE_CONFIG_H + #include <config.h> +#endif +#include <wolfssl/wolfcrypt/settings.h> + +#if !defined(NO_SHA) || !defined(NO_SHA256) + +#include <wolfssl/wolfcrypt/logging.h> + +#if defined(WOLFSSL_RENESAS_TSIP_CRYPT) + +#include <wolfssl/wolfcrypt/error-crypt.h> +#include <wolfssl/wolfcrypt/port/Renesas/renesas-tsip-crypt.h> + +#if !defined(NO_SHA) +#include <wolfssl/wolfcrypt/sha.h> + +static void TSIPHashFree(wolfssl_TSIP_Hash* hash) +{ + if (hash == NULL) + return; + + if (hash->msg != NULL) { + XFREE(hash->msg, hash->heap, DYNAMIC_TYPE_TMP_BUFFER); + hash->msg = NULL; + } +} + +static int TSIPHashInit(wolfssl_TSIP_Hash* hash, void* heap, int devId, + word32 sha_type) +{ + if (hash == NULL) { + return BAD_FUNC_ARG; + } + + (void)devId; + XMEMSET(hash, 0, sizeof(wolfssl_TSIP_Hash)); + + hash->heap = heap; + hash->len = 0; + hash->used = 0; + hash->msg = NULL; + hash->sha_type = sha_type; + + return 0; +} + +static int TSIPHashUpdate(wolfssl_TSIP_Hash* hash, const byte* data, word32 sz) +{ + if (hash == NULL || (sz > 0 && data == NULL)) { + return BAD_FUNC_ARG; + } + + if (hash->len < hash->used + sz) { + if (hash->msg == NULL) { + hash->msg = (byte*)XMALLOC(hash->used + sz, hash->heap, + DYNAMIC_TYPE_TMP_BUFFER); + } else { +#ifdef FREERTOS + byte* pt = (byte*)XMALLOC(hash->used + sz, hash->heap, + DYNAMIC_TYPE_TMP_BUFFER); + if (pt == NULL) { + return MEMORY_E; + } + XMEMCPY(pt, hash->msg, hash->used); + XFREE(hash->msg, hash->heap, DYNAMIC_TYPE_TMP_BUFFER); + hash->msg = NULL; + hash->msg = pt; +#else + byte* pt = (byte*)XREALLOC(hash->msg, hash->used + sz, hash->heap, + DYNAMIC_TYPE_TMP_BUFFER); + if (pt == NULL) { + return MEMORY_E; + } + hash->msg = pt; +#endif + } + if (hash->msg == NULL) { + return MEMORY_E; + } + hash->len = hash->used + sz; + } + XMEMCPY(hash->msg + hash->used, data , sz); + hash->used += sz; + + return 0; +} + +static int TSIPHashFinal(wolfssl_TSIP_Hash* hash, byte* out, word32 outSz) +{ + int ret; + void* heap; + tsip_sha_md5_handle_t handle; + uint32_t sz; + + e_tsip_err_t (*Init)(tsip_sha_md5_handle_t*); + e_tsip_err_t (*Update)(tsip_sha_md5_handle_t*, uint8_t*, uint32_t); + e_tsip_err_t (*Final )(tsip_sha_md5_handle_t*, uint8_t*, uint32_t*); + + if (hash == NULL || out == NULL) { + return BAD_FUNC_ARG; + } + + if (hash->sha_type == TSIP_SHA1) { + Init = R_TSIP_Sha1Init; + Update = R_TSIP_Sha1Update; + Final = R_TSIP_Sha1Final; + } else if (hash->sha_type == TSIP_SHA256) { + Init = R_TSIP_Sha256Init; + Update = R_TSIP_Sha256Update; + Final = R_TSIP_Sha256Final; + } else + return BAD_FUNC_ARG; + + heap = hash->heap; + + tsip_hw_lock(); + + if (Init(&handle) == TSIP_SUCCESS) { + ret = Update(&handle, (uint8_t*)hash->msg, hash->used); + if (ret == TSIP_SUCCESS) { + ret = Final(&handle, out, (uint32_t*)&sz); + if (ret != TSIP_SUCCESS || sz != outSz) { + return ret; + } + } + } + tsip_hw_unlock(); + + TSIPHashFree(hash); + return TSIPHashInit(hash, heap, 0, hash->sha_type); +} + +static int TSIPHashGet(wolfssl_TSIP_Hash* hash, byte* out, word32 outSz) +{ + int ret; + tsip_sha_md5_handle_t handle; + uint32_t sz; + + e_tsip_err_t (*Init)(tsip_sha_md5_handle_t*); + e_tsip_err_t (*Update)(tsip_sha_md5_handle_t*, uint8_t*, uint32_t); + e_tsip_err_t (*Final )(tsip_sha_md5_handle_t*, uint8_t*, uint32_t*); + + if (hash == NULL || out == NULL) { + return BAD_FUNC_ARG; + } + + if (hash->sha_type == TSIP_SHA1) { + Init = R_TSIP_Sha1Init; + Update = R_TSIP_Sha1Update; + Final = R_TSIP_Sha1Final; + } else if (hash->sha_type == TSIP_SHA256) { + Init = R_TSIP_Sha256Init; + Update = R_TSIP_Sha256Update; + Final = R_TSIP_Sha256Final; + } else + return BAD_FUNC_ARG; + + tsip_hw_lock(); + + if (Init(&handle) == TSIP_SUCCESS) { + ret = Update(&handle, (uint8_t*)hash->msg, hash->used); + if (ret == TSIP_SUCCESS) { + ret = Final(&handle, out, &sz); + if (ret != TSIP_SUCCESS || sz != outSz) { + return ret; + } + } + } + + tsip_hw_unlock(); + + return 0; +} + +static int TSIPHashCopy(wolfssl_TSIP_Hash* src, wolfssl_TSIP_Hash* dst) +{ + if (src == NULL || dst == NULL) { + return BAD_FUNC_ARG; + } + + XMEMCPY(dst, src, sizeof(wolfssl_TSIP_Hash)); + + if (src->len > 0 && src->msg != NULL) { + dst->msg = (byte*)XMALLOC(src->len, dst->heap, DYNAMIC_TYPE_TMP_BUFFER); + if (dst->msg == NULL) { + return MEMORY_E; + } + XMEMCPY(dst->msg, src->msg, src->len); + } + + return 0; +} + /* */ +int wc_InitSha_ex(wc_Sha* sha, void* heap, int devId) +{ + return TSIPHashInit(sha, heap, devId, TSIP_SHA1); +} + +int wc_ShaUpdate(wc_Sha* sha, const byte* in, word32 sz) +{ + return TSIPHashUpdate(sha, in, sz); +} + +int wc_ShaFinal(wc_Sha* sha, byte* hash) +{ + return TSIPHashFinal(sha, hash, WC_SHA_DIGEST_SIZE); +} + +int wc_ShaGetHash(wc_Sha* sha, byte* hash) +{ + return TSIPHashGet(sha, hash, WC_SHA_DIGEST_SIZE); +} + +int wc_ShaCopy(wc_Sha256* src, wc_Sha256* dst) +{ + return TSIPHashCopy(src, dst); +} +#endif /* !NO_SHA */ + +#if !defined(NO_SHA256) +#include <wolfssl/wolfcrypt/sha256.h> + +/* */ +int wc_InitSha256_ex(wc_Sha256* sha, void* heap, int devId) +{ + return TSIPHashInit(sha, heap, devId, TSIP_SHA256); +} + +int wc_Sha256Update(wc_Sha256* sha, const byte* in, word32 sz) +{ + return TSIPHashUpdate(sha, in, sz); +} + +int wc_Sha256Final(wc_Sha256* sha, byte* hash) +{ + return TSIPHashFinal(sha, hash, WC_SHA256_DIGEST_SIZE); +} + +int wc_Sha256GetHash(wc_Sha256* sha, byte* hash) +{ + return TSIPHashGet(sha, hash, WC_SHA256_DIGEST_SIZE); +} + +int wc_Sha256Copy(wc_Sha256* src, wc_Sha256* dst) +{ + return TSIPHashCopy(src, dst); +} +#endif /* !NO_SHA256 */ +#endif /* WOLFSSL_RENESAS_TSIP_CRYPT */ +#endif /* #if !defined(NO_SHA) || !defined(NO_SHA256) */ diff --git a/client/wolfssl/wolfcrypt/src/port/Renesas/renesas_tsip_util.c b/client/wolfssl/wolfcrypt/src/port/Renesas/renesas_tsip_util.c new file mode 100644 index 0000000..e3cd7ad --- /dev/null +++ b/client/wolfssl/wolfcrypt/src/port/Renesas/renesas_tsip_util.c @@ -0,0 +1,719 @@ +/* renesas_tsip_util.c + * + * Copyright (C) 2006-2020 wolfSSL Inc. + * + * This file is part of wolfSSL. + * + * wolfSSL is free software; you can redistribute it and/or modify + * it under the terms of the GNU General Public License as published by + * the Free Software Foundation; either version 2 of the License, or + * (at your option) any later version. + * + * wolfSSL is distributed in the hope that it will be useful, + * but WITHOUT ANY WARRANTY; without even the implied warranty of + * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the + * GNU General Public License for more details. + * + * You should have received a copy of the GNU General Public License + * along with this program; if not, write to the Free Software + * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1335, USA + */ +#include <wolfssl/wolfcrypt/settings.h> + +#if defined(WOLFSSL_RENESAS_TSIP) + +#include <wolfssl/wolfcrypt/wc_port.h> +#include <wolfssl/wolfcrypt/error-crypt.h> + +#include <wolfssl/wolfcrypt/port/Renesas/renesas-tsip-crypt.h> +#include <wolfssl/wolfcrypt/memory.h> +#include <wolfssl/wolfcrypt/error-crypt.h> +#include <wolfssl/wolfcrypt/aes.h> +#include <wolfssl/ssl.h> +#include <wolfssl/internal.h> + +#include <stdio.h> +/* mutex */ +wolfSSL_Mutex tsip_mutex; +static int tsip_CryptHwMutexInit_ = 0; + +/* ./ca-cert.der.sign, */ +/* expect to have these variables defined at user application */ +extern uint32_t s_flash[]; +extern uint32_t s_inst1[R_TSIP_SINST_WORD_SIZE]; +extern uint32_t s_inst2[R_TSIP_SINST2_WORD_SIZE]; +static const byte *ca_cert_sig; + +/* user key */ +static tsip_key_data g_user_key_info; +/* tsip only keep one encrypted ca public key */ +#if defined(WOLFSSL_RENESAS_TSIP_TLS) +static uint32_t g_encrypted_publicCA_key[R_TSIP_SINST_WORD_SIZE]; +static uint32_t g_CAscm_Idx; /* index of CM table */ +#endif + +static int tsip_CryptHwMutexInit(wolfSSL_Mutex* mutex) { + return wc_InitMutex(mutex); +} + +static int tsip_CryptHwMutexLock(wolfSSL_Mutex* mutex) { + return wc_LockMutex(mutex); +} + +static int tsip_CryptHwMutexUnLock(wolfSSL_Mutex* mutex) { + return wc_UnLockMutex(mutex); +} + +/* +* lock hw engine. +* this should be called before using engine. +*/ +int tsip_hw_lock() +{ + int ret = 0; + + WOLFSSL_MSG("enter esp_sha_hw_lock"); + + if(tsip_CryptHwMutexInit_ == 0){ + ret = tsip_CryptHwMutexInit(&tsip_mutex); + if(ret == 0) { + tsip_CryptHwMutexInit_ = 1; + } else { + WOLFSSL_MSG(" mutex initialization failed."); + return -1; + } + } + if(tsip_CryptHwMutexLock(&tsip_mutex) != 0) { + /* this should not happens */ + return -1; + } + + WOLFSSL_MSG("leave tsip_sha_try_hw_lock"); + return ret; +} + +/* +* release hw engine +*/ +void tsip_hw_unlock( void ) +{ + WOLFSSL_MSG("enter tsip_hw_unlock"); + /* unlock hw engine for next use */ + tsip_CryptHwMutexUnLock(&tsip_mutex); + WOLFSSL_MSG("leave tsip_hw_unlock"); +} +/* check if tsip tls functions can be used for the cipher */ +/* cipher0 : in the some cipher suite, */ +/* first byte becomes greater than 0, otherwise 0x00 */ +/* side : CLIENT END or SEVER END */ +int tsip_useable(const struct WOLFSSL *ssl) +{ + byte cipher0; + byte cipher; + byte side; + + /* sanity check */ + if (ssl == NULL) + return BAD_FUNC_ARG; + + /* when rsa key index == NULL, tsip isn't used for cert verification. */ + /* in the case, we cannot use TSIP. */ + if (!ssl->peerTsipEncRsaKeyIndex) + return 0; + + /* when enabled Extended Master Secret, we cannot use TSIP. */ + if (ssl->options.haveEMS) + return 0; + + cipher0 = ssl->options.cipherSuite0; + cipher = ssl->options.cipherSuite; + side = ssl->options.side; + + if (cipher0 > 0x00) + return 0; + + if ((cipher == l_TLS_RSA_WITH_AES_128_CBC_SHA || + cipher == l_TLS_RSA_WITH_AES_128_CBC_SHA256 || + cipher == l_TLS_RSA_WITH_AES_256_CBC_SHA || + cipher == l_TLS_RSA_WITH_AES_256_CBC_SHA256) && + side == WOLFSSL_CLIENT_END) + return 1; + else + return 0; +} + +/* check if the g_alreadyVerified CA's key can be used for * + * peer's certification */ +byte tsip_checkCA(word32 cmIdx) +{ + return (cmIdx == g_CAscm_Idx? 1:0); +} + +/* check if the root CA has been verified by TSIP, * + * and it exists in the CM table. */ +byte tsip_rootCAverified( ) +{ + return (g_CAscm_Idx != (uint32_t)-1 ? 1:0); +} + +/* open TSIP driver for use */ +int tsip_Open( ) { + + int ret; + + if ((ret = tsip_hw_lock()) == 0) { + /* open the TSIP */ + ret = R_TSIP_Open((uint32_t*)s_flash, s_inst1, s_inst2); + if( ret != TSIP_SUCCESS ) { + WOLFSSL_MSG("RENESAS TSIP Open failed"); + } + +#if defined(WOLFSSL_RENESAS_TSIP_TLS) + /* generate TLS Rsa public key for Certificate verification */ + if (ret == TSIP_SUCCESS && g_user_key_info.encrypted_user_tls_key) { + ret = R_TSIP_GenerateTlsRsaPublicKeyIndex( + g_user_key_info.encrypted_session_key, + g_user_key_info.iv, + g_user_key_info.encrypted_user_tls_key, + &g_user_key_info.user_rsa2048_tls_pubindex); + + if (ret != TSIP_SUCCESS) { + WOLFSSL_MSG("R_TSIP_GenerateTlsRsaPublicKeyIndex failed"); + } else { + /* close once */ + tsip_Close( ); + /* open again with s_inst[] */ + XMEMCPY(s_inst1, + g_user_key_info.user_rsa2048_tls_pubindex.value, + sizeof(s_inst1)); + ret = R_TSIP_Open((uint32_t*)s_flash, s_inst1, s_inst2); + if (ret != TSIP_SUCCESS) { + WOLFSSL_MSG("R_TSIP_(Re)Open failed"); + } + /* init vars */ + g_CAscm_Idx = (uint32_t)-1; + } + } +#endif + /* unlock hw */ + tsip_hw_unlock(); + } else + WOLFSSL_MSG("Failed to lock tsip hw \n"); + + return ret; +} + +/* close TSIP driver */ +void tsip_Close( ) { + int ret; + + if ((ret = tsip_hw_lock()) == 0) { + /* close TSIP */ + ret = R_TSIP_Close(); +#if defined(WOLFSSL_RENESAS_TSIP_TLS) + g_CAscm_Idx = (uint32_t)-1; +#endif + /* unlock hw */ + tsip_hw_unlock(); + if( ret != TSIP_SUCCESS ) { + WOLFSSL_MSG("RENESAS TSIP Close failed"); + } + } else + WOLFSSL_MSG("Failed to unlock tsip hw \n"); +} + +/* Support functions for TSIP TLS Capability */ +#if defined(WOLFSSL_RENESAS_TSIP_TLS) + +/* to inform ca certificate sign */ +/* signature format expects RSA 2048 PSS with SHA256 */ +void tsip_inform_cert_sign(const byte *sign) +{ + if(sign) + ca_cert_sig = sign; +} + +/* inform user key */ +/* the function expects to be called from user application */ +/* user has to create these key information by Renesas tool in advance.*/ +void tsip_inform_user_keys( + byte *encrypted_session_key, + byte *iv, + byte *encrypted_user_tls_key +) +{ + g_user_key_info.encrypted_session_key = NULL; + g_user_key_info.iv = NULL; + g_user_key_info.encrypted_user_tls_key = NULL; + + if ( encrypted_session_key ) { + g_user_key_info.encrypted_session_key = encrypted_session_key; + } + if ( iv ) { + g_user_key_info.iv = iv; + } + if ( encrypted_user_tls_key ) { + g_user_key_info.encrypted_user_tls_key = encrypted_user_tls_key; + } +} + +#ifndef NO_WOLFSSL_RENESAS_TSIP_TLS_SESSION +/* convert def to tsip define */ +static byte _tls2tsipdef(byte cipher) +{ + byte def = R_TSIP_TLS_RSA_WITH_AES_128_CBC_SHA; + switch(cipher){ + case l_TLS_RSA_WITH_AES_128_CBC_SHA: + break; + case l_TLS_RSA_WITH_AES_128_CBC_SHA256: + def = R_TSIP_TLS_RSA_WITH_AES_128_CBC_SHA256; + break; + case l_TLS_RSA_WITH_AES_256_CBC_SHA: + def = R_TSIP_TLS_RSA_WITH_AES_256_CBC_SHA; + break; + case l_TLS_RSA_WITH_AES_256_CBC_SHA256: + def = R_TSIP_TLS_RSA_WITH_AES_256_CBC_SHA256; + break; + default:break; + } + return def; +} + +/* Sha1Hmac */ +int tsip_Sha1Hmac(const struct WOLFSSL *ssl, const byte *myInner, + word32 innerSz, const byte *in, word32 sz, byte *digest, + word32 verify) +{ + tsip_hmac_sha_handle_t _handle; + tsip_hmac_sha_key_index_t key_index; + int ret; + + if ((ssl == NULL) || (myInner == NULL) || (in == NULL) || + (digest == NULL)) + return BAD_FUNC_ARG; + + if ((ret = tsip_hw_lock()) != 0) { + WOLFSSL_MSG("hw lock failed\n"); + return ret; + } + + if ( (ssl->options.side == WOLFSSL_CLIENT_END && !verify) || + (ssl->options.side == WOLFSSL_SERVER_END && verify) ) + XMEMCPY(key_index.value, ssl->keys.tsip_client_write_MAC_secret, + sizeof(key_index.value)); + else + XMEMCPY(key_index.value, ssl->keys.tsip_server_write_MAC_secret, + sizeof(key_index.value)); + + ret = R_TSIP_Sha1HmacGenerateInit(&_handle, &key_index); + + if (ret == TSIP_SUCCESS) + ret = R_TSIP_Sha1HmacGenerateUpdate(&_handle, (uint8_t*)myInner, + (uint32_t)innerSz); + + if (ret == TSIP_SUCCESS) + ret = R_TSIP_Sha1HmacGenerateUpdate(&_handle, (uint8_t*)in, sz); + + if (ret == TSIP_SUCCESS) + ret = R_TSIP_Sha1HmacGenerateFinal(&_handle, digest); + + /* unlock hw */ + tsip_hw_unlock(); + + return ret; +} + +/* Sha256Hmac */ +int tsip_Sha256Hmac(const struct WOLFSSL *ssl, const byte *myInner, + word32 innerSz, const byte *in, word32 sz, byte *digest, + word32 verify) +{ + tsip_hmac_sha_handle_t _handle; + tsip_hmac_sha_key_index_t key_index; + int ret; + + if ((ssl == NULL) || (myInner == NULL) || (in == NULL) || + (digest == NULL)) + return BAD_FUNC_ARG; + + if ( (ssl->options.side == WOLFSSL_CLIENT_END && !verify) || + (ssl->options.side == WOLFSSL_SERVER_END && verify) ) + XMEMCPY(key_index.value, ssl->keys.tsip_client_write_MAC_secret, + sizeof(key_index.value)); + else + XMEMCPY(key_index.value, ssl->keys.tsip_server_write_MAC_secret, + sizeof(key_index.value)); + + if ((ret = tsip_hw_lock()) != 0) { + WOLFSSL_MSG("hw lock failed\n"); + return ret; + } + + ret = R_TSIP_Sha256HmacGenerateInit(&_handle, &key_index); + + if (ret == TSIP_SUCCESS) + ret = R_TSIP_Sha256HmacGenerateUpdate(&_handle, (uint8_t*)myInner, + innerSz); + + if (ret == TSIP_SUCCESS) + ret = R_TSIP_Sha256HmacGenerateUpdate(&_handle, (uint8_t*)in, sz); + + if (ret == TSIP_SUCCESS) + ret = R_TSIP_Sha256HmacGenerateFinal(&_handle, digest); + + /* unlock hw */ + tsip_hw_unlock(); + + return ret; +} + +/* generate Verify Data based on master secret */ +int tsip_generateVerifyData(const byte *ms, /* master secret */ + const byte *side, const byte *handshake_hash, + byte *hashes /* out */) +{ + int ret ; + uint32_t l_side = R_TSIP_TLS_GENERATE_CLIENT_VERIFY; + + if ((ms == NULL) || (side == NULL) || (handshake_hash == NULL) || + (hashes == NULL)) + return BAD_FUNC_ARG; + + if (XSTRNCMP((const char*)side, (const char*)tls_server, FINISHED_LABEL_SZ) + == 0) + { + l_side = R_TSIP_TLS_GENERATE_SERVER_VERIFY; + } + + if ((ret = tsip_hw_lock()) == 0) { + ret = R_TSIP_TlsGenerateVerifyData(l_side, (uint32_t*)ms, + (uint8_t*)handshake_hash, hashes/* out */); + if (ret != TSIP_SUCCESS) { + WOLFSSL_MSG("R_TSIP_TlsGenerateSessionKey failed\n"); + } + } + /* unlock hw */ + tsip_hw_unlock(); + + return ret; +} + +/* generate keys for TLS communication */ +int tsip_generateSeesionKey(struct WOLFSSL *ssl) +{ + int ret; + Ciphers *enc; + Ciphers *dec; + tsip_hmac_sha_key_index_t key_client_mac; + tsip_hmac_sha_key_index_t key_server_mac; + tsip_aes_key_index_t key_client_aes; + tsip_aes_key_index_t key_server_aes; + + if (ssl== NULL) + return BAD_FUNC_ARG; + + if ((ret = tsip_hw_lock()) == 0) { + ret = R_TSIP_TlsGenerateSessionKey( + _tls2tsipdef(ssl->options.cipherSuite), + (uint32_t*)ssl->arrays->tsip_masterSecret, + (uint8_t*)ssl->arrays->clientRandom, + (uint8_t*)ssl->arrays->serverRandom, &key_client_mac, + &key_server_mac, &key_client_aes, &key_server_aes, + NULL, NULL); + if (ret != TSIP_SUCCESS) { + WOLFSSL_MSG("R_TSIP_TlsGenerateSessionKey failed\n"); + } else { + /* succeeded creating session keys */ + /* alloc aes instance for both enc and dec */ + enc = &ssl->encrypt; + dec = &ssl->decrypt; + + if (enc) { + if (enc->aes == NULL) { + enc->aes = (Aes*)XMALLOC(sizeof(Aes), ssl->heap, + DYNAMIC_TYPE_CIPHER); + if (enc->aes == NULL) + return MEMORY_E; + } + + XMEMSET(enc->aes, 0, sizeof(Aes)); + } + if (dec) { + if (dec->aes == NULL) { + dec->aes = (Aes*)XMALLOC(sizeof(Aes), ssl->heap, + DYNAMIC_TYPE_CIPHER); + if (dec->aes == NULL) { + if (enc) { + XFREE(enc->aes, NULL, DYNAMIC_TYPE_CIPHER); + } + return MEMORY_E; + } + } + + XMEMSET(dec->aes, 0, sizeof(Aes)); + } + /* copy key index into aes */ + if (ssl->options.side == PROVISION_CLIENT) { + XMEMCPY(&enc->aes->ctx.tsip_keyIdx, &key_client_aes, + sizeof(key_client_aes)); + XMEMCPY(&dec->aes->ctx.tsip_keyIdx, &key_server_aes, + sizeof(key_server_aes)); + } else { + XMEMCPY(&enc->aes->ctx.tsip_keyIdx, &key_server_aes, + sizeof(key_server_aes)); + XMEMCPY(&dec->aes->ctx.tsip_keyIdx, &key_client_aes, + sizeof(key_client_aes)); + } + /* copy hac key index into keys */ + XMEMCPY(ssl->keys.tsip_client_write_MAC_secret, key_client_mac.value, + sizeof(key_client_mac.value)); + XMEMCPY(ssl->keys.tsip_server_write_MAC_secret, key_server_mac.value, + sizeof(key_client_mac.value)); + /* set up key size and marked readly */ + if (enc){ + enc->aes->ctx.keySize = ssl->specs.key_size; + /* ready for use */ + enc->setup = 1; + } + /* set up key size and marked readly */ + if (dec) { + dec->aes->ctx.keySize = ssl->specs.key_size; + /* ready for use */ + dec->setup = 1; + } + } + /* unlock hw */ + tsip_hw_unlock(); + } else + WOLFSSL_MSG("hw lock failed\n"); + + return ret; +} +/* generate Master secrete by TSIP */ +int tsip_generateMasterSecret(const byte *pr, /* pre-master */ + const byte *cr, /* client random */ + const byte *sr, /* server random */ + byte *ms) +{ + int ret; + + if ((pr == NULL) || (cr == NULL) || (sr == NULL) || + (ms == NULL)) + return BAD_FUNC_ARG; + + if ((ret = tsip_hw_lock()) == 0) { + ret = R_TSIP_TlsGenerateMasterSecret( (uint32_t*)pr, + (uint8_t*)cr, (uint8_t*)sr, (uint32_t*)ms); + if (ret != TSIP_SUCCESS) { + WOLFSSL_MSG("R_TSIP_TlsGenerateMasterSecret failed\n"); + } + /* unlock hw */ + tsip_hw_unlock(); + } else { + WOLFSSL_MSG(" hw lock failed "); + } + + return ret; +} +/* generate pre-Master secrete by TSIP */ +int tsip_generatePremasterSecret(byte *premaster, word32 preSz ) +{ + int ret; + + if (premaster == NULL) + return BAD_FUNC_ARG; + + if ((ret = tsip_hw_lock()) == 0 && preSz >= + (R_TSIP_TLS_MASTER_SECRET_WORD_SIZE*4)) { + /* generate pre-master, 80 bytes */ + ret = R_TSIP_TlsGeneratePreMasterSecret( (uint32_t*)premaster ); + if (ret != TSIP_SUCCESS) { + WOLFSSL_MSG(" R_TSIP_TlsGeneratePreMasterSecret failed\n"); + } + /* unlock hw */ + tsip_hw_unlock(); + } else { + WOLFSSL_MSG(" hw lock failed or preSz is smaller than 80"); + } + + return ret; +} +/* generate encrypted pre-Master secrete by TSIP */ +int tsip_generateEncryptPreMasterSecret(WOLFSSL *ssl, byte *out, word32 *outSz) +{ + int ret; + + if ((ssl == NULL) || (out == NULL) || (outSz == NULL)) + return BAD_FUNC_ARG; + + if ((ret = tsip_hw_lock()) == 0) { + if (*outSz >= 256) + ret = R_TSIP_TlsEncryptPreMasterSecret( + (uint32_t*)ssl->peerTsipEncRsaKeyIndex, + (uint32_t*)&ssl->arrays->preMasterSecret[VERSION_SZ], + (uint8_t*)out); + else + ret = -1; + + if (ret != TSIP_SUCCESS) { + WOLFSSL_MSG(" R_TSIP_TlsEncryptPreMasterSecret failed\n"); + } else { + *outSz = 256; /* TSIP can only handles 2048 RSA */ + } + /* unlock hw */ + tsip_hw_unlock(); + } else { + WOLFSSL_MSG(" hw lock failed "); + } + + return ret; +} +#endif /* NO_WOLFSSL_RENESAS_TSIP_TLS_SESSION */ + +/* Certificate verification by TSIP */ +int tsip_tls_CertVerify(const byte *cert, word32 certSz, + const byte *signature, word32 sigSz, + word32 key_n_start, word32 key_n_len, + word32 key_e_start, word32 key_e_len, + byte *tsip_encRsaKeyIndex) +{ + int ret; + + if (cert == NULL) + return BAD_FUNC_ARG; + + if (!signature) { + WOLFSSL_MSG(" signature for ca verification is not set\n"); + return -1; + } + if (!tsip_encRsaKeyIndex) { + WOLFSSL_MSG(" tsip_encRsaKeyIndex is NULL.\n"); + return -1; + } + + if ((ret = tsip_hw_lock()) == 0) { + ret = R_TSIP_TlsCertificateVerification( + (uint32_t*)g_encrypted_publicCA_key,/* encrypted public key */ + (uint8_t*)cert, /* certificate der */ + certSz, /* length of der */ + (uint8_t*)signature, /* sign data by RSA PSS */ + key_n_start, /* start position of public key n in bytes */ + (key_n_start + key_n_len), /* length of the public key n */ + key_e_start, /* start pos, key e in bytes */ + (key_e_start + key_e_len), /* length of the public key e */ + (uint32_t*)tsip_encRsaKeyIndex /* returned encrypted key */ + ); + + if (ret != TSIP_SUCCESS) { + WOLFSSL_MSG(" R_TSIP_TlsCertificateVerification() failed"); + } + tsip_hw_unlock(); + } else { + WOLFSSL_MSG(" hw lock failed "); + } + + return ret; +} +/* Root Certificate verification */ +int tsip_tls_RootCertVerify(const byte *cert, word32 cert_len, + word32 key_n_start, word32 key_n_len, + word32 key_e_start, word32 key_e_len, + word32 cm_row) +{ + int ret; + /* call to generate encrypted public key for certificate verification */ + uint8_t *signature = (uint8_t*)ca_cert_sig; + + if (cert == NULL) + return BAD_FUNC_ARG; + + if (!signature) { + WOLFSSL_MSG(" signature for ca verification is not set\n"); + return -1; + } + + if ((ret = tsip_hw_lock()) == 0) { + ret = R_TSIP_TlsRootCertificateVerification( + /* CA cert */ + (uint8_t*)cert, + /* length of CA cert */ + (uint32_t)cert_len, + /* Byte position of public key */ + key_n_start, + (key_n_start + key_n_len), + key_e_start, + (key_e_start + key_e_len), + /* signature by "RSA 2048 PSS with SHA256" */ + (uint8_t*)ca_cert_sig, + /* RSA-2048 public key used by + RSA-2048 PSS with SHA256. 560 Bytes*/ + g_encrypted_publicCA_key + ); + + if (ret != TSIP_SUCCESS) { + WOLFSSL_MSG(" R_TSIP_TlsRootCertVerify() failed"); + } else { + g_CAscm_Idx = cm_row; + } + + tsip_hw_unlock(); + } else { + WOLFSSL_MSG(" hw lock failed "); + } + + return ret; +} +#endif /* WOLFSSL_RENESAS_TSIP_TLS */ + +#ifdef WOLFSSL_RENESAS_TSIP_CRYPT_DEBUG + +/* err + * e_tsip_err + TSIP_SUCCESS = 0, + TSIP_ERR_SELF_CHECK1, // Self-check 1 fail or TSIP function internal err. + TSIP_ERR_RESOURCE_CONFLICT, // A resource conflict occurred. + TSIP_ERR_SELF_CHECK2, // Self-check 2 fail. + TSIP_ERR_KEY_SET, // setting the invalid key. + TSIP_ERR_AUTHENTICATION, // Authentication failed. + TSIP_ERR_CALLBACK_UNREGIST, // Callback function is not registered. + TSIP_ERR_PARAMETER, // Illegal Input data. + TSIP_ERR_PROHIBIT_FUNCTION, // An invalid function call occurred. + * TSIP_RESUME_FIRMWARE_GENERATE_MAC, + // There is a continuation of R_TSIP_GenerateFirmwareMAC. +*/ + +static void hexdump(const uint8_t* in, uint32_t len) +{ + uint32_t i; + + if (in == NULL) + return; + + for (i = 0; i <= len;i++, in++){ + printf("%02x:", *in); + if (((i+1)%16)==0){ + printf("\n"); + } + } + printf("\n"); +} + +byte *ret2err(word32 ret) +{ + switch(ret){ + case TSIP_SUCCESS: return "success"; + case TSIP_ERR_SELF_CHECK1: return "selfcheck1"; + case TSIP_ERR_RESOURCE_CONFLICT: return "rsconflict"; + case TSIP_ERR_SELF_CHECK2: return "selfcheck2"; + case TSIP_ERR_KEY_SET: return "keyset"; + case TSIP_ERR_AUTHENTICATION: return "authentication"; + case TSIP_ERR_CALLBACK_UNREGIST: return "callback unreg"; + case TSIP_ERR_PARAMETER: return "badarg"; + case TSIP_ERR_PROHIBIT_FUNCTION: return "prohibitfunc"; + case TSIP_RESUME_FIRMWARE_GENERATE_MAC: return "conti-generate-mac"; + default:return "unknown"; + } +} + +#endif /* WOLFSSL_RENESAS_TSIP_CRYPT_DEBUG */ +#endif /* WOLFSSL_RENESAS_TSIP */ |