Skip to content

Commit 9227020

Browse files
author
gojimmypi
committed
code review updates for ESP32 C3/C6/S2 HW Acceleration
1 parent 7e69030 commit 9227020

7 files changed

Lines changed: 199 additions & 127 deletions

File tree

‎IDE/Espressif/ESP-IDF/README.md‎

Lines changed: 0 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -14,7 +14,6 @@ Including the following examples:
1414
* Simple [TLS client](./examples/wolfssl_client/)/[server](./examples/wolfssl_server/)
1515
* Cryptographic [test](./examples/wolfssl_test/)
1616
* Cryptographic [benchmark](./examples/wolfssl_benchmark/)
17-
* Bare-bones [template](./examples/template/)
1817

1918
The *user_settings.h* file enables some of the hardened settings.
2019

‎IDE/Espressif/ESP-IDF/user_settings.h‎

Lines changed: 120 additions & 30 deletions
Original file line numberDiff line numberDiff line change
@@ -83,7 +83,7 @@
8383
#define WOLFSSL_AES_DIRECT
8484
#endif
8585

86-
/* when you want to use aes counter mode */
86+
/* when you want to use AES counter mode */
8787
/* #define WOLFSSL_AES_DIRECT */
8888
/* #define WOLFSSL_AES_COUNTER */
8989

@@ -102,10 +102,17 @@
102102
/* Define USE_FAST_MATH and SMALL_STACK */
103103
#define ESP32_USE_RSA_PRIMITIVE
104104
/* threshold for performance adjustment for HW primitive use */
105+
106+
/* NOTE HW unreliable for small values on older original ESP32!*/
107+
/* threshold for performance adjustment for HW primitive use */
105108
/* X bits of G^X mod P greater than */
106-
#define EPS_RSA_EXPT_XBTIS 36
109+
#undef ESP_RSA_EXPT_XBITS
110+
#define ESP_RSA_EXPT_XBITS 32
111+
107112
/* X and Y of X * Y mod P greater than */
108-
#define ESP_RSA_MULM_BITS 2000
113+
#undef ESP_RSA_MULM_BITS
114+
#define ESP_RSA_MULM_BITS 16
115+
109116
#endif
110117

111118
/* debug options */
@@ -123,46 +130,129 @@
123130
/* adjust wait-timeout count if you see timeout in RSA HW acceleration */
124131
#define ESP_RSA_TIMEOUT_CNT 0x249F00
125132

133+
/* Default is HW enabled unless turned off.
134+
** Uncomment these lines to force SW instead of HW acceleration */
135+
126136
#if defined(CONFIG_IDF_TARGET_ESP32)
127-
/* when you want not to use HW acceleration on ESP32 (below for S3, etc */
128-
/* #define NO_ESP32_CRYPT */
129-
/* #define NO_WOLFSSL_ESP32_CRYPT_HASH */
130-
/* #define NO_WOLFSSL_ESP32_CRYPT_AES */
131-
/* #define NO_WOLFSSL_ESP32_CRYPT_RSA_PRI */
137+
/* wolfSSL HW Acceleration supported on ESP32. Uncomment to disable: */
138+
/* #define NO_ESP32_CRYPT */
139+
/* #define NO_WOLFSSL_ESP32_CRYPT_HASH */
140+
/* #define NO_WOLFSSL_ESP32_CRYPT_AES */
141+
/* #define NO_WOLFSSL_ESP32_CRYPT_RSA_PRI */
142+
/* #define NO_WOLFSSL_ESP32_CRYPT_RSA_PRI_MP_MUL */
143+
/* #define NO_WOLFSSL_ESP32_CRYPT_RSA_PRI_MULMOD */
144+
/* #define NO_WOLFSSL_ESP32_CRYPT_RSA_PRI_EXPTMOD */
145+
146+
/* These are defined automatically in esp32-crypt.h, here for clarity: */
147+
#define NO_WOLFSSL_ESP32_CRYPT_HASH_SHA224 /* no SHA224 HW on ESP32 */
148+
/* end CONFIG_IDF_TARGET_ESP32 */
149+
#undef ESP_RSA_MULM_BITS
150+
#define ESP_RSA_MULM_BITS 16 /* TODO add compile-time warning */
151+
/***** END CONFIG_IDF_TARGET_ESP32 *****/
152+
132153
#elif defined(CONFIG_IDF_TARGET_ESP32S2)
133-
/* ESP32-S2 disabled by default; not implemented */
134-
#define NO_ESP32_CRYPT
135-
#define NO_WOLFSSL_ESP32_CRYPT_HASH
136-
#define NO_WOLFSSL_ESP32_CRYPT_AES
137-
#define NO_WOLFSSL_ESP32_CRYPT_RSA_PRI
154+
/* wolfSSL HW Acceleration supported on ESP32-S2. Uncomment to disable: */
155+
/* #define NO_ESP32_CRYPT */
156+
/* #define NO_WOLFSSL_ESP32_CRYPT_HASH */
157+
/* Note: There's no AES192 HW on the ESP32-S2; falls back to SW */
158+
/* #define NO_WOLFSSL_ESP32_CRYPT_AES */
159+
/* #define NO_WOLFSSL_ESP32_CRYPT_RSA_PRI */
160+
/* #define NO_WOLFSSL_ESP32_CRYPT_RSA_PRI_MP_MUL */
161+
/* #define NO_WOLFSSL_ESP32_CRYPT_RSA_PRI_MULMOD */
162+
/* #define NO_WOLFSSL_ESP32_CRYPT_RSA_PRI_EXPTMOD */
163+
/***** END CONFIG_IDF_TARGET_ESP32S2 *****/
164+
138165
#elif defined(CONFIG_IDF_TARGET_ESP32S3)
139-
/* when you want not to use HW acceleration on ESP32-S3 */
140-
/* #define NO_ESP32_CRYPT */
141-
/* #define NO_WOLFSSL_ESP32_CRYPT_HASH */
142-
/* #define NO_WOLFSSL_ESP32_CRYPT_AES */
143-
/* #define NO_WOLFSSL_ESP32_CRYPT_RSA_PRI */
166+
/* wolfSSL HW Acceleration supported on ESP32-S3. Uncomment to disable: */
167+
/* #define NO_ESP32_CRYPT */
168+
/* #define NO_WOLFSSL_ESP32_CRYPT_HASH */
169+
/* Note: There's no AES192 HW on the ESP32-S3; falls back to SW */
170+
/* #define NO_WOLFSSL_ESP32_CRYPT_AES */
171+
/* #define NO_WOLFSSL_ESP32_CRYPT_RSA_PRI */
172+
/* #define NO_WOLFSSL_ESP32_CRYPT_RSA_PRI_MP_MUL */
173+
/* #define NO_WOLFSSL_ESP32_CRYPT_RSA_PRI_MULMOD */
174+
/* #define NO_WOLFSSL_ESP32_CRYPT_RSA_PRI_EXPTMOD */
175+
/***** END CONFIG_IDF_TARGET_ESP32S3 *****/
176+
144177
#elif defined(CONFIG_IDF_TARGET_ESP32C3)
145-
/* ESP32-C3 disabled by default, not implemented */
146-
#define NO_ESP32_CRYPT
147-
#define NO_WOLFSSL_ESP32_CRYPT_HASH
148-
#define NO_WOLFSSL_ESP32_CRYPT_AES
149-
#define NO_WOLFSSL_ESP32_CRYPT_RSA_PRI
178+
/* wolfSSL HW Acceleration supported on ESP32-C2. Uncomment to disable: */
179+
180+
/* #define NO_ESP32_CRYPT */
181+
/* #define NO_WOLFSSL_ESP32_CRYPT_HASH */ /* to disable all SHA HW */
182+
183+
/* These are defined automatically in esp32-crypt.h, here for clarity: */
184+
#define NO_WOLFSSL_ESP32_CRYPT_HASH_SHA384 /* no SHA384 HW on C6 */
185+
#define NO_WOLFSSL_ESP32_CRYPT_HASH_SHA512 /* no SHA512 HW on C6 */
186+
187+
/* #define NO_WOLFSSL_ESP32_CRYPT_AES */
188+
/* #define NO_WOLFSSL_ESP32_CRYPT_RSA_PRI */
189+
/* #define NO_WOLFSSL_ESP32_CRYPT_RSA_PRI_MP_MUL */
190+
/* #define NO_WOLFSSL_ESP32_CRYPT_RSA_PRI_MULMOD */
191+
/* #define NO_WOLFSSL_ESP32_CRYPT_RSA_PRI_EXPTMOD */
192+
/***** END CONFIG_IDF_TARGET_ESP32C3 *****/
193+
150194
#elif defined(CONFIG_IDF_TARGET_ESP32C6)
151-
/* ESP32-C6 disabled by default, not implemented */
152-
#define NO_ESP32_CRYPT
153-
#define NO_WOLFSSL_ESP32_CRYPT_HASH
154-
#define NO_WOLFSSL_ESP32_CRYPT_AES
155-
#define NO_WOLFSSL_ESP32_CRYPT_RSA_PRI
195+
/* wolfSSL HW Acceleration supported on ESP32-C6. Uncomment to disable: */
196+
197+
/* #define NO_ESP32_CRYPT */
198+
/* #define NO_WOLFSSL_ESP32_CRYPT_HASH */
199+
/* These are defined automatically in esp32-crypt.h, here for clarity: */
200+
#define NO_WOLFSSL_ESP32_CRYPT_HASH_SHA384 /* no SHA384 HW on C6 */
201+
#define NO_WOLFSSL_ESP32_CRYPT_HASH_SHA512 /* no SHA512 HW on C6 */
202+
203+
/* #define NO_WOLFSSL_ESP32_CRYPT_AES */
204+
/* #define NO_WOLFSSL_ESP32_CRYPT_RSA_PRI */
205+
/* #define NO_WOLFSSL_ESP32_CRYPT_RSA_PRI_MP_MUL */
206+
/* #define NO_WOLFSSL_ESP32_CRYPT_RSA_PRI_MULMOD */
207+
/* #define NO_WOLFSSL_ESP32_CRYPT_RSA_PRI_EXPTMOD */
208+
/***** END CONFIG_IDF_TARGET_ESP32C6 *****/
209+
156210
#elif defined(CONFIG_IDF_TARGET_ESP32H2)
157-
/* ESP32-H2 disabled by default, not implemented */
211+
/* wolfSSL Hardware Acceleration not yet implemented */
158212
#define NO_ESP32_CRYPT
159213
#define NO_WOLFSSL_ESP32_CRYPT_HASH
160214
#define NO_WOLFSSL_ESP32_CRYPT_AES
161215
#define NO_WOLFSSL_ESP32_CRYPT_RSA_PRI
216+
/***** END CONFIG_IDF_TARGET_ESP32H2 *****/
217+
162218
#else
163-
/* anything else unknown will have HW disabled by default */
219+
/* Anything else encountered, disable HW accleration */
164220
#define NO_ESP32_CRYPT
165221
#define NO_WOLFSSL_ESP32_CRYPT_HASH
166222
#define NO_WOLFSSL_ESP32_CRYPT_AES
167223
#define NO_WOLFSSL_ESP32_CRYPT_RSA_PRI
224+
#endif /* CONFIG_IDF_TARGET Check */
225+
226+
/* optional SM4 Ciphers. See https://github.com/wolfSSL/wolfsm
227+
#define WOLFSSL_SM2
228+
#define WOLFSSL_SM3
229+
#define WOLFSSL_SM4
230+
*/
231+
232+
#if defined(WOLFSSL_SM2) || defined(WOLFSSL_SM3) || defined(WOLFSSL_SM4)
233+
#include <wolfssl/certs_test_sm.h>
234+
#define CTX_CA_CERT root_sm2
235+
#define CTX_CA_CERT_SIZE sizeof_root_sm2
236+
#define CTX_CA_CERT_TYPE WOLFSSL_FILETYPE_PEM
237+
#define CTX_SERVER_CERT server_sm2
238+
#define CTX_SERVER_CERT_SIZE sizeof_server_sm2
239+
#define CTX_SERVER_CERT_TYPE WOLFSSL_FILETYPE_PEM
240+
#define CTX_SERVER_KEY server_sm2_priv
241+
#define CTX_SERVER_KEY_SIZE sizeof_server_sm2_priv
242+
#define CTX_SERVER_KEY_TYPE WOLFSSL_FILETYPE_PEM
243+
244+
#undef WOLFSSL_BASE16
245+
#define WOLFSSL_BASE16
246+
#else
247+
#define USE_CERT_BUFFERS_2048
248+
#define USE_CERT_BUFFERS_256
249+
#define CTX_CA_CERT ca_cert_der_2048
250+
#define CTX_CA_CERT_SIZE sizeof_ca_cert_der_2048
251+
#define CTX_CA_CERT_TYPE WOLFSSL_FILETYPE_ASN1
252+
#define CTX_SERVER_CERT server_cert_der_2048
253+
#define CTX_SERVER_CERT_SIZE sizeof_server_cert_der_2048
254+
#define CTX_SERVER_CERT_TYPE WOLFSSL_FILETYPE_ASN1
255+
#define CTX_SERVER_KEY server_key_der_2048
256+
#define CTX_SERVER_KEY_SIZE sizeof_server_key_der_2048
257+
#define CTX_SERVER_KEY_TYPE WOLFSSL_FILETYPE_ASN1
168258
#endif

‎wolfcrypt/src/port/Espressif/README.md‎

Lines changed: 42 additions & 13 deletions
Original file line numberDiff line numberDiff line change
@@ -1,37 +1,66 @@
11
# ESP32 Port
22

3-
Support for the ESP32-WROOM-32 on-board crypto hardware acceleration for symmetric AES, SHA1/SHA256/SHA384/SHA512 and RSA primitive including mul, mulmod and exptmod.
3+
Support for the ESP32 on-board cryptographic hardware acceleration for symmetric AES, SHA1/SHA256/SHA384/SHA512 and RSA primitive including mul, mulmod and exptmod.
4+
5+
* ESP32 - Supported
6+
* ESP32S2 - Supported
7+
* ESP32S3 - Supported
8+
* ESP32C2 - Software only (contact support to request hardware acceleration)
9+
* ESP32C3 - Supported
10+
* ESP32C6 - Supported
11+
* ESP32H2 - Software only (contact support to request hardware acceleration)
412

513
## ESP32 Acceleration
614

7-
For detail about ESP32 HW Acceleration, you can find in [Technical Reference Manual](https://espressif.com/sites/default/files/documentation/esp32_technical_reference_manual_en.pdf)
15+
More details about ESP32 HW Accelerationcan be found in:
16+
17+
* [ESP32 Technical Reference Manual](https://espressif.com/sites/default/files/documentation/esp32_technical_reference_manual_en.pdf)
18+
* [ESP32-S2 Technical Reference Manual](https://www.espressif.com/sites/default/files/documentation/esp32-s2_technical_reference_manual_en.pdf)
19+
* [ESP32-S3 Technical Reference Manual](https://www.espressif.com/sites/default/files/documentation/esp32-s3_technical_reference_manual_en.pdf)
20+
* [ESP32-C2 (aka ESP8684 Technical Reference Manual](https://www.espressif.com/sites/default/files/documentation/esp8684_technical_reference_manual_en.pdf)
21+
* [ESP32-C3 Technical Reference Manual](https://www.espressif.com/sites/default/files/documentation/esp32-c3_technical_reference_manual_en.pdf)
22+
* [ESP32-C6 Technical Reference Manual](https://www.espressif.com/sites/default/files/documentation/esp32-c6_technical_reference_manual_en.pdf)
23+
* [ESP32-H2 Technical Reference Manual](https://www.espressif.com/sites/default/files/documentation/esp32-h2_technical_reference_manual_en.pdf)
824

925
### Building
1026

11-
```
12-
git clone --recurse-submodules -j8 https://github.com/espressif/esp-idf master
13-
```
27+
Simply run `ESP-IDF.py` in any of the [Espressif/ESP-IDF/Examples](https://github.com/wolfSSL/wolfssl/tree/master/IDE/Espressif/ESP-IDF/examples).
28+
See the respective project README files. Examples are also available using wolfssl as a [Managed Component](https://components.espressif.com/components/wolfssl/wolfssl).
29+
30+
Hardware acceleration is enabled by default. All settings should be adjusted in the respective project component
31+
`user_settings.h` file. See the example in [template example](https://github.com/wolfSSL/wolfssl/blob/master/IDE/Espressif/ESP-IDF/examples/template/components/wolfssl/include/user_settings.h).
32+
In particular, comment out the `NO_[feature_name]` macros to enable hardware encryption:
1433

15-
Hardware acceleration is enabled by default.
34+
/* #define NO_ESP32_CRYPT */
35+
/* #define NO_WOLFSSL_ESP32_CRYPT_HASH */
36+
/* #define NO_WOLFSSL_ESP32_CRYPT_AES */
37+
/* #define NO_WOLFSSL_ESP32_CRYPT_RSA_PRI */
1638

17-
To disable portions of the hardware acceleration you can optionally define:
39+
To disable specific portions of the hardware acceleration you can optionally define:
1840

1941
```c
20-
/* Disabled SHA, AES and RSA acceleration */
42+
/* Disable all SHA, AES and RSA acceleration */
2143
#define NO_ESP32_CRYPT
22-
/* Disabled AES acceleration */
44+
45+
/* Disable only AES acceleration */
2346
#define NO_WOLFSSL_ESP32_CRYPT_AES
24-
/* Disabled SHA acceleration */
47+
48+
/* Disabled only SHA acceleration */
2549
#define NO_WOLFSSL_ESP32_CRYPT_HASH
26-
/* Disabled RSA Primitive acceleration */
50+
51+
/* Disabled only RSA Primitive acceleration */
2752
#define NO_WOLFSSL_ESP32_CRYPT_RSA_PRI
2853
```
2954

55+
See the [wolfcrypt/port/Espressif/esp32-crypt.h](https://github.com/wolfSSL/wolfssl/blob/master/wolfssl/wolfcrypt/port/Espressif/esp32-crypt.h)
56+
for more details on fine tuning and debugging options.
57+
3058
### Coding
3159

3260
In your application you must include `<wolfssl/wolfcrypt/settings.h>` before any other wolfSSL headers.
33-
If building the sources directly we recommend defining `WOLFSSL_USER_SETTINGS` and adding your own
34-
`user_settings.h` file. You can find a good reference for this in `IDE/GCC-ARM/Header/user_settings.h`.
61+
If building the sources directly we recommend defining `WOLFSSL_USER_SETTINGS` (typically defined in the `CMakeLists.txt`)
62+
and adding your own `user_settings.h` file. You can find a good reference in the [Espressif examples](https://github.com/wolfSSL/wolfssl/tree/master/IDE/Espressif/ESP-IDF/examples)
63+
as well as other examples such as [IDE/GCC-ARM/Header/user_settings.h](https://github.com/wolfSSL/wolfssl/blob/master/IDE/GCC-ARM/Header/user_settings.h).
3564

3665
To view disassembly, add `__attribute__((section(".iram1")))` decorator. Foe example:
3766

0 commit comments

Comments
 (0)