• Registered: 2017-01-26
  • Posts: 5

Topic: [SOLVED] STM32F437 Hardware Crypto functions integration with WolfSSL

Hi, I have a project which uses DTLS over connections. For now I have successfully managed to run WolfSSL on controllers using only software implementation but the time required to setup the initial connection is abhorrent and I'm now looking to utilize HW crypto in the MCU to accelerate performance. From the STM32F2 implementation provided by WolfSSL, I have only seen a few crypto algorithms being retargeted to the hardware crypto. In my DTLS implementation I am utilizing quite a few different algos provided by WolfCrypt. As I am quite inexperienced with very low level details of the SSL library, I need some help to retarget almost all the encryption algorithms present in WolfSSL from software implementation to STM32 Crypto Hardware.

According to ST's Cube HAL framework, the algos supported by HW Encrytion are

STM32F437x/439x
– AES: CFB, OFB, XTS, CCM, GCM, CMAC, KeyWrap
Key size: 128, 192, 256 bit Crypto accelerator
– ECC: Key generation, Scalar multiplication, ECDSA Random number
generator (RNG) – RSA encryption/decryption functions with PKCS#1v1.5

So I would need help changing these algos in WolfSSL such that they use STM32 HW Acc. If someone can provide sample of this, that would be most appreciated. Thanks!

Share

  • From: Bozeman
  • Registered: 2014-05-09
  • Posts: 777

Re: [SOLVED] STM32F437 Hardware Crypto functions integration with WolfSSL

Hi uzairo89,

Which version of wolfSSL are you working with? wolfSSL recently added support for CubeMX HAL. If you do not have wolfSSLv3.10.0 please download it from our download page here: https://wolfssl.com/wolfSSL/download/downloadForm.php or get it from our github account https://github.com/wolfSSL/wolfssl.git

You'll find a define for WOLFSSL_STM32_CUBEMX in the STM32F2 section of <wolfssl-root>/wolfssl/wolfcrypt/settings.h
This define offloads AES, DES3, and RANDOM operations to hardware. If you wish to port additional algorithms please use the sections in <wolfssl-root>/wolfcrypt/src/aes.c surrounded by the define for WOLFSSL_STM32_CUBEMX as a reference.


Warmest Regards,

Kaleb

EDIT: See also a slightly more detailed response here: http://stackoverflow.com/questions/4187 … 9#41881639

Kaleb J. Himes's Website

Share

  • Registered: 2017-01-26
  • Posts: 5

Re: [SOLVED] STM32F437 Hardware Crypto functions integration with WolfSSL

The version I'm using is 3.9.8. Unfortunately the server I am connecting to is also running 3.9.8 and if I use 3.10.0 on the client side, it does not connect. So for now, I believe I have to make 3.9.8 work with HW encryption.
I did take a look at the CubeMX integration and I'll try to import that into 3.9.8 and get back to you. Thanks!

Share

  • From: Bozeman
  • Registered: 2014-05-09
  • Posts: 777

Re: [SOLVED] STM32F437 Hardware Crypto functions integration with WolfSSL

Hi uzairo89,

I checked the backwards compatibility on my end and they connect fine.

SERVER:

wolfssl-3.9.8 khimes$ ./examples/server/server -u -v 3
SSL version is DTLSv1.2
SSL cipher suite is TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384
Client message: hello wolfssl!

CLIENT:

wolfssl-3.10.0 khimes$ ./examples/client/client -u -v 3
SSL version is DTLSv1.2
SSL cipher suite is TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384
Server response: I hear you fa shizzle!

What is the error you are seeing when you connect a 3.10.0 client to 3.9.8 server?

Which configuration settings are used on the server side and which are used on the client side?

When you connect the 3.9.8 client to the 3.9.8 server which cipher suite is selected for the connection? Is it possible there is some dfine in the configuration of the 3.9.8 client that is missing in the 3.10.0 client?


- Kaleb

Kaleb J. Himes's Website

Share

  • Registered: 2017-01-26
  • Posts: 5

Re: [SOLVED] STM32F437 Hardware Crypto functions integration with WolfSSL

The issue was a bug in the server code. We have patched the server and now can connect using WolfSSL 3.10.0. Thanks for your assistance.

Share

  • From: Bozeman
  • Registered: 2014-05-09
  • Posts: 777

Re: [SOLVED] STM32F437 Hardware Crypto functions integration with WolfSSL

Hi uzairo89,

Glad to hear you have it working! For the sake of the community could you confirm if it was a define missing or was there some customization to the base server code that had to be modified and if so what change helped you to resolve the issue?

Details can be helpful to others facing the same or similar issues if you are free to post those they would be most welcome.


Warm Regards,

Kaleb

Kaleb J. Himes's Website

Share