STM32 bare-metal crypto port (HASH / AES / PKA / RNG, DHUK, CCB)

[dgarske]

Adds a direct-register STM32 hardware-crypto integration that needs zero HAL or StdPeriphLib, for wolfBoot / no-OS / FreeRTOS / TrustZone-NS use. Builds and is validated across ~27 STM32 families. Layered as the bare IP drivers, DHUK device-bound keys, and CCB hardware-protected ECDSA.

Features

• Bare-metal IP drivers (WOLFSSL_STM32_BARE): direct-register AES (TinyAES / CRYP / SAES), HASH (classic and new-gen IP), RNG, and PKA (V1 and V2 layouts: ECDSA sign/verify and ECC scalar-mul). The same code drives both the bare path and the CubeMX/HAL path. On STM32C5, whose PKA exposes only the side-channel-protected ECC modes, ECDSA sign runs in hardware and verify in software.
• DHUK (Device Hardware Unique Key): chip-bound keys through the standard crypto-callback framework. Register the device, set a key's devId to it, and run normal AES / GMAC / ECDSA - the working key is derived inside SAES and never enters software.
• CCB (Coupling and Chaining Bridge): hardware-protected P-256 ECDSA on STM32U3 and STM32C5. The DHUK-wrapped private scalar is unwrapped SAES -> PKA inside the CCB and never enters software or crosses the system bus. Transparent through the standard ECC API (wc_ecc_make_key to provision, wc_ecc_sign_hash to sign) - no CCB-specific public API; both bare and CubeMX/HAL backends.

New build options

• WOLFSSL_STM32_BARE - bare-metal direct-register path (vs WOLFSSL_STM32_CUBEMX).
• Per-IP enables: STM32_CRYPTO, STM32_HASH, STM32_RNG, WOLFSSL_STM32_PKA (+ WC_STM32_PKA_VERIFY_ONLY / WC_STM32_PKA_SIGN_ONLY for verify-only or sign-only parts such as STM32C5), WOLFSSL_STM32_USE_SAES.
• WOLFSSL_DHUK + WOLF_CRYPTO_CB - DHUK crypto-callback device (WOLFSSL_STM32_DHUK_UNWRAP for the optional exact-key import).
• WOLFSSL_STM32_CCB - CCB-protected ECDSA (requires DHUK + crypto-cb, STM32U3 or STM32C5 silicon).
• Per-family flags (WOLFSSL_STM32U3, WOLFSSL_STM32C5, ...) select register layouts.

Testing performed

• Multi-board regression on real silicon via the companion STM32_Bare_Test harness (wolfcrypt_test + benchmark), covering ~27 STM32 families: F2/F3/F4/F7, G0/G4, H5/H7/H7RS, L4/L5, U0/U3/U5, WB/WBA/WL, C0/C5, N6, and more. Latest sweep: all attached boards PASS.
• CCB validated on NUCLEO-U385RG-Q (bare and CubeMX) and NUCLEO-C5A3ZG (bare), TZEN=0, P-256: wc_ecc_make_key -> wc_ecc_sign_hash -> wc_ecc_verify_hash, scalar never in software.
• DHUK validated on STM32U385 (GMAC, AES-ECB, ECDSA sign via the crypto callback).
• STM32C5 (NUCLEO-C5A3ZG): HW RNG and HW PKA ECDSA sign (verify in software) enabled and validated, plus device-wrapped key-import argument validation.
• check-source-text clean.

Known limitations / follow-up

• On STM32C5 the integrated HW PKA verify mode is not used; ECDSA verify runs in software (sign is hardware-accelerated). CCB is P-256 only.

Reference

Per-board chip-support matrix, build sizes, and benchmarks (companion examples branch): https://github.com/dgarske/wolfssl-examples-stm32/blob/stm32_bare/STM32_Bare_Test/README.md

[Copilot]

Pull request overview

This PR introduces a new STM32 “bare-metal” crypto port flavor (WOLFSSL_STM32_BARE) that uses CMSIS device-header register access (no HAL/StdPeriph dependency) and wires it into wolfCrypt’s AES/HASH/RNG paths, plus a direct-register PKA implementation used by the existing STM32 PKA integration.

Changes:

• Add WOLFSSL_STM32_BARE selection in settings to include only CMSIS device headers and auto-enable the no-lib RNG path.
• Add per-family bare-metal clock-enable macros and HAL/PKA stand-in types to support a direct-register PKA driver.
• Add bare-metal AES (CRYP + TinyAES), HASH clock enable override, and bare PKA shims/driver, plus AES dispatcher updates in aes.c and RNG clock-enable macro use in random.c.

Reviewed changes

Copilot reviewed 6 out of 6 changed files in this pull request and generated 6 comments.

Show a summary per file

File	Description
wolfssl/wolfcrypt/settings.h	Adds WOLFSSL_STM32_BARE selection, CMSIS header includes, and mutual exclusion with CubeMX.
wolfssl/wolfcrypt/port/st/stm32.h	Adds BARE clock-enable macros, HASH ALGO defines for new IP, and PKA stand-in types.
wolfcrypt/src/port/st/stm32.c	Implements bare-metal AES (CRYP/TinyAES), HASH clock enable override, and bare-metal PKA shims/driver.
wolfcrypt/src/aes.c	Routes ECB/CBC/CTR and GCM-encrypt through the BARE STM32 implementation with SW fallback behavior.
wolfcrypt/src/random.c	Uses a per-family RNG clock-enable macro (for BARE) instead of a fixed RCC register bit.
wolfcrypt/src/ecc.c	Adjusts STM32 PKA guards so BARE uses SW ECDSA paths while still leveraging HW scalar mul.

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

[github-actions]

MemBrowse Memory Report

No memory changes detected for:

• gcc-arm-cortex-m4
• gcc-arm-cortex-m4-baremetal
• gcc-arm-cortex-m4-min-ecc
• gcc-arm-cortex-m4-tls12

[dgarske]

Note #10307 seems to have broken AES CBC on STM32... I will put the fix into my new wolfSSL/wolfssl-examples-stm32#13

[Copilot]

Pull request overview

Copilot reviewed 8 out of 8 changed files in this pull request and generated 5 comments.

Comments suppressed due to low confidence (1)

wolfcrypt/src/port/st/stm32.c:1

• After wc_Stm32_Aes_DhukOp() completes, the unwrapped key remains resident in SAES key registers (KEYR) until overwritten by a later operation. If the platform threat model includes debug/privileged register reads or post-operation key scraping, consider explicitly clearing KEYR/CR state (or triggering any available peripheral key/CCF/error clear mechanism) before releasing the mutex. This is especially relevant because DHUK is explicitly about protecting keys at rest/in RAM.

/* stm32.c

[Copilot]

Pull request overview

Copilot reviewed 8 out of 8 changed files in this pull request and generated 7 comments.

[dgarske]

Jenkins retest this please

[Copilot]

Copilot encountered an error and was unable to review this pull request. You can try again by re-requesting a review.

[Copilot]

Copilot encountered an error and was unable to review this pull request. You can try again by re-requesting a review.

[Copilot]

Pull request overview

Copilot reviewed 9 out of 10 changed files in this pull request and generated 5 comments.

[Copilot]

Pull request overview

Copilot reviewed 9 out of 10 changed files in this pull request and generated 4 comments.