STM32 and RealTek: plaintext-key AES device + hardware AES-GCM/ECDSA via crypto callbacks

[dgarske]

Summary

Hardware AES and ECDSA through the crypto-callback framework for STM32 (CubeMX/HAL and bare-metal) and RealTek RTL8735B, so the code-size WOLF_CRYPTO_CB_ONLY_AES / WOLF_CRYPTO_CB_ONLY_ECC configs run fully on hardware. Adds a plaintext-key AES device that coexists with the existing HUK/DHUK seed-key device (selectable per Aes by devId), full hardware AES-GCM on the bare STM32 and RealTek paths, and a portable asn.c build fix.

Features

• STM32 CubeMX crypto-callback device: hardware AES (ECB, and AES-GCM serviced in-callback on the HAL GCM engine) plus HW ECDSA sign + verify via the PKA and CCB-protected sign via HAL_CCB. One devId serves AES + ECDSA + CCB, making CB_ONLY_AES / CB_ONLY_ECC usable on the HAL build.
• Plaintext-key AES device, selectable by devId: a new device (STM32 CubeMX + bare, and RealTek) runs a caller-supplied AES key directly on the HW engine, registered alongside the DHUK/HUK seed-key device -- an application picks per Aes whether its key is used verbatim or as a hardware-unique-key derivation seed.
• Full hardware AES-GCM on the bare STM32 (TinyAES peripheral: encrypt + decrypt-verify with AAD and partial blocks; CRYP IP: whole-block enc + dec) and RealTek RTL8735B -- previously bare TinyAES GCM fell back to software.
• RealTek RTL8735B plaintext AES device (WOLFSSL_RTL8735B_AES) with 128/192/256-bit keys, coexisting with the HUK device.

Fixes

• asn.c: guard NULL OidFromId / GetAlgoV2 results in wc_EncryptPKCS8Key_ex -- fixes a GCC -Wnonnull break (crypto-callback-only PKCS8 build at -O2 -Werror) and closes a latent NULL-deref. No API change.
• STM32: add the missing WOLFSSL_STM32U3 PKA include arm; #ifndef-guard the bare HASH-legacy macros so WOLFSSL_STM32_BARE coexists with the ST Cube HAL headers in one TU (e.g. Zephyr).

Testing

Hardware, all Result: 0 (PASS):

• NUCLEO-U385RG-Q (CubeMX + bare) and NUCLEO-U585 (bare): plaintext AES-GCM matches published vectors (enc + dec + tamper-reject), coexistence with the DHUK device (same key bytes -> distinct ciphertext per devId), and CubeMX HW ECDSA sign/verify + CCB.
• NUCLEO-F439ZI (CRYP IP): direct-call HW AES-GCM enc + dec KAT.
• RealTek RTL8735B (AmebaPro2 EVB): 67/67 including plaintext AES-GCM on the HW engine and HUK coexistence. Host compile-test (--enable-rtl8735b) + testwolfcrypt pass.

Examples / on-target tests: wolfSSL/wolfssl-examples-stm32#16

[Copilot]

Pull request overview

This pull request adds STM32 CubeMX/HAL support for routing AES operations through wolfCrypt’s crypto-callback framework so WOLF_CRYPTO_CB_ONLY_AES can work on HAL-based STM32 builds (notably enabling AES-GCM key setup by providing an AES-ECB callback handler).

Changes:

• Added a CubeMX/HAL AES crypto-callback device (register/unregister + AES-ECB handling) and extended the existing CubeMX CCB crypto-callback device to also dispatch cipher callbacks.
• Fixed STM32U3 CubeMX PKA HAL include selection and improved compatibility when both “bare” STM32 code and Cube HAL HASH headers are present in the same translation unit.
• Documented usage for WOLF_CRYPTO_CB_ONLY_AES on CubeMX/HAL builds in the STM32 port README.

Reviewed changes

Copilot reviewed 3 out of 3 changed files in this pull request and generated no comments.

File	Description
wolfssl/wolfcrypt/port/st/stm32.h	Avoids HASH macro redefinition conflicts with Cube HAL headers; declares CubeMX AES crypto-callback device APIs.
wolfcrypt/src/port/st/stm32.c	Implements CubeMX AES crypto-callback device (AES-ECB) and routes cipher callbacks through the existing CubeMX CCB device; adds STM32U3 PKA includes.
wolfcrypt/src/port/st/README.md	Adds documentation describing how to enable/register the AES crypto-callback device for WOLF_CRYPTO_CB_ONLY_AES.

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

[github-actions]

MemBrowse Memory Report

No memory changes detected for:

• gcc-arm-cortex-m0plus
• gcc-arm-cortex-m3
• gcc-arm-cortex-m4
• gcc-arm-cortex-m4-baremetal
• gcc-arm-cortex-m4-crypto-only
• gcc-arm-cortex-m4-dtls13
• gcc-arm-cortex-m4-min-ecc
• gcc-arm-cortex-m4-openssl-compat
• gcc-arm-cortex-m4-pkcs7
• gcc-arm-cortex-m4-pq
• gcc-arm-cortex-m4-rsa-only
• gcc-arm-cortex-m4-sp-math
• gcc-arm-cortex-m4-tls12
• gcc-arm-cortex-m4-tls13
• gcc-arm-cortex-m7
• gcc-arm-cortex-m7-pq
• gcc-arm-cortex-m7-tls13
• linuxkm-pie
• linuxkm-standard
• stm32-sim-stm32h753

[Copilot]

Pull request overview

Copilot reviewed 3 out of 3 changed files in this pull request and generated 4 comments.

[Copilot]

Pull request overview

Copilot reviewed 3 out of 3 changed files in this pull request and generated no new comments.

Comments suppressed due to low confidence (1)

wolfcrypt/src/port/st/README.md:101

• The example snippet always calls wc_Stm32_DhukRegister(devId), but on CubeMX/HAL that symbol is only available when WOLFSSL_STM32_CCB is enabled. For the non-CCB case (described immediately below), the snippet should instead call wc_Stm32_CubeAesRegister(devId) (or show a conditional) to avoid a link/compile mismatch for readers copying the example.

wc_Stm32_DhukRegister(devId);      /* once; serves AES + ECDSA (+ CCB) */

[Copilot]

Pull request overview

Copilot reviewed 10 out of 10 changed files in this pull request and generated no new comments.

Comments suppressed due to low confidence (3)

wolfcrypt/src/port/realtek/rtl8735b.c:361

• Rtl8735bAes_Gcm() returns early on keyLen > sizeof(keyA) after bounce buffers may have been allocated, which skips the cleanup path and leaks/suppresses scrubbing of the bounce allocations.

    if (keyLen > sizeof(keyA)) {
        return BAD_FUNC_ARG;
    }

wolfcrypt/src/port/st/stm32.c:2552

• TinyAES GCM final-phase length fields are written with MSW=0, which produces an incorrect tag when AAD or payload length exceeds 2^32-1 bits (~512MB). GCM specifies 64-bit bit-lengths, so the high 32 bits should be computed instead of forced to 0.

    aadBits = aadSz * 8u;
    ptBits  = sz * 8u;
    WC_STM32_AES_INST->DINR = 0u;
    WC_STM32_AES_INST->DINR = aadBits;
    WC_STM32_AES_INST->DINR = 0u;

wolfcrypt/src/port/realtek/rtl8735b.c:329

• In the plaintext-key AES device, a non-12-byte IV currently returns BAD_FUNC_ARG, which prevents the intended software fallback described for unsupported cases (and contradicts the later comment that unsupported cases return CRYPTOCB_UNAVAILABLE so callers can fall back with the same plaintext key). Returning CRYPTOCB_UNAVAILABLE here would preserve compatibility for non-96-bit IV usage where software GCM is available.

    if (ivSz != GCM_NONCE_MID_SZ) {
        return BAD_FUNC_ARG;   /* 12-byte IV only; hard error (see comment) */
    }

[dgarske]

Jenkins retest this please

[dgarske]

Jenkins retest this please