Skip to content

Commit 1281685

Browse files
benmabenma
committed
Merge branch 'secchip-deps2'
2 parents 02c8a76 + eef0f8e commit 1281685

File tree

6 files changed

+256
-0
lines changed

6 files changed

+256
-0
lines changed

‎.gitmodules

Lines changed: 3 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -10,3 +10,6 @@
1010
[submodule "tools/ttf2ugui"]
1111
path = tools/ttf2ugui
1212
url = https://github.com/BitBoxSwiss/ttf2ugui
13+
[submodule "external/optiga-trust-m"]
14+
path = external/optiga-trust-m
15+
url = https://github.com/BitBoxSwiss/optiga-trust-m.git

‎external/CMakeLists.txt

Lines changed: 36 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -258,3 +258,39 @@ target_compile_options(rtt PRIVATE "-Wno-cast-qual")
258258
# we define it anyway here in case the default changes.
259259
target_compile_definitions(rtt PUBLIC "BUFFER_SIZE_DOWN=(1024)" "BUFFER_SIZE_UP=(1024)")
260260
target_include_directories(rtt SYSTEM PUBLIC SEGGER_RTT_V796b/RTT SEGGER_RTT_V796b/Config)
261+
262+
263+
# optiga-trust-m
264+
# The below build instructions are loosely based on optiga-trust-m/tests/linux_i2c.cmake
265+
aux_source_directory(optiga-trust-m/src/cmd SRC_CMD_FILES)
266+
aux_source_directory(optiga-trust-m/src/common SRC_COMMON_FILES)
267+
aux_source_directory(optiga-trust-m/external/mbedtls/library MBEDTLS_FILES)
268+
aux_source_directory(optiga-trust-m/src/comms/ifx_i2c SRC_COMMS_IFX_I2C_FILES)
269+
aux_source_directory(optiga-trust-m/src/crypt SRC_CRYPT_FILES)
270+
aux_source_directory(optiga-trust-m/src/util SRC_UTIL_FILES)
271+
set(PAL_FILES optiga-trust-m/extras/pal/pal_crypt_mbedtls.c)
272+
add_library(optiga
273+
${SRC_CMD_FILES}
274+
${SRC_COMMON_FILES}
275+
${SRC_COMMS_IFX_I2C_FILES}
276+
optiga-trust-m/src/comms/optiga_comms_ifx_i2c.c
277+
${SRC_CRYPT_FILES}
278+
${SRC_UTIL_FILES}
279+
${PAL_FILES}
280+
${MBEDTLS_FILES}
281+
)
282+
target_compile_definitions(optiga PRIVATE MBEDTLS_USER_CONFIG_FILE="mbedtls_config.h")
283+
# Ignore warnings in external lib.
284+
target_compile_options(optiga PRIVATE "-w")
285+
target_compile_definitions(optiga PRIVATE OPTIGA_LIB_EXTERNAL="optiga_config.h")
286+
target_include_directories(optiga SYSTEM PUBLIC
287+
optiga-trust-m/config
288+
optiga-trust-m/include
289+
optiga-trust-m/include/cmd
290+
optiga-trust-m/include/common
291+
optiga-trust-m/include/ifx_i2c
292+
optiga-trust-m/include/pal
293+
optiga-trust-m/include/comms
294+
optiga-trust-m/external/mbedtls/include
295+
${CMAKE_CURRENT_SOURCE_DIR} # for the BitBox-custom "optiga_config.h"
296+
)

‎external/mbedtls_config.h

Lines changed: 92 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,92 @@
1+
/**
2+
* \file config-ccm-psk-tls1_2.h
3+
*
4+
* \brief Minimal configuration for TLS 1.2 with PSK and AES-CCM ciphersuites
5+
*/
6+
/*
7+
* Copyright The Mbed TLS Contributors
8+
* SPDX-License-Identifier: Apache-2.0 OR GPL-2.0-or-later
9+
*/
10+
/*
11+
* Minimal configuration for TLS 1.2 with PSK and AES-CCM ciphersuites
12+
*
13+
* Distinguishing features:
14+
* - Optimized for small code size, low bandwidth (on a reliable transport),
15+
* and low RAM usage.
16+
* - No asymmetric cryptography (no certificates, no Diffie-Hellman key
17+
* exchange).
18+
* - Fully modern and secure (provided the pre-shared keys are generated and
19+
* stored securely).
20+
* - Very low record overhead with CCM-8.
21+
*
22+
* See README.txt for usage instructions.
23+
*/
24+
25+
/* System support */
26+
//#define MBEDTLS_HAVE_TIME /* Optionally used in Hello messages */
27+
/* Other MBEDTLS_HAVE_XXX flags irrelevant for this configuration */
28+
29+
// This undefines everything as a basis. Specific settings are re-enabled below.
30+
#include <mbedtls_default_config.h>
31+
32+
/* Mbed TLS modules */
33+
#define MBEDTLS_AES_C
34+
#define MBEDTLS_CCM_C
35+
#define MBEDTLS_CIPHER_C
36+
#define MBEDTLS_CTR_DRBG_C
37+
#define MBEDTLS_ENTROPY_C
38+
#define MBEDTLS_MD_C
39+
40+
#define MBEDTLS_SHA256_C
41+
#define MBEDTLS_SSL_CLI_C
42+
#define MBEDTLS_SSL_SRV_C
43+
#define MBEDTLS_SSL_TLS_C
44+
45+
/* TLS protocol feature support */
46+
#define MBEDTLS_KEY_EXCHANGE_PSK_ENABLED
47+
#define MBEDTLS_SSL_PROTO_TLS1_2
48+
49+
/*
50+
* Use only CCM_8 ciphersuites, and
51+
* save ROM and a few bytes of RAM by specifying our own ciphersuite list
52+
*/
53+
#define MBEDTLS_SSL_CIPHERSUITES \
54+
MBEDTLS_TLS_PSK_WITH_AES_256_CCM_8, \
55+
MBEDTLS_TLS_PSK_WITH_AES_128_CCM_8
56+
57+
/*
58+
* Save RAM at the expense of interoperability: do this only if you control
59+
* both ends of the connection! (See comments in "mbedtls/ssl.h".)
60+
* The optimal size here depends on the typical size of records.
61+
*/
62+
#define MBEDTLS_SSL_IN_CONTENT_LEN 1024
63+
#define MBEDTLS_SSL_OUT_CONTENT_LEN 1024
64+
65+
/* Save RAM at the expense of ROM */
66+
#define MBEDTLS_AES_ROM_TABLES
67+
68+
/* Save some RAM by adjusting to your exact needs */
69+
#define MBEDTLS_PSK_MAX_LEN 16 /* 128-bits keys are generally enough */
70+
71+
/*
72+
* You should adjust this to the exact number of sources you're using: default
73+
* is the "platform_entropy_poll" source, but you may want to add other ones
74+
* Minimum is 2 for the entropy test suite.
75+
*/
76+
#define MBEDTLS_NO_PLATFORM_ENTROPY
77+
#define MBEDTLS_ENTROPY_MAX_SOURCES 2
78+
79+
/* These defines are present so that the config modifying scripts can enable
80+
* them during tests/scripts/test-ref-configs.pl */
81+
//#define MBEDTLS_USE_PSA_CRYPTO
82+
//#define MBEDTLS_PSA_CRYPTO_C
83+
84+
/* Error messages and TLS debugging traces
85+
* (huge code size increase, needed for tests/ssl-opt.sh) */
86+
//#define MBEDTLS_DEBUG_C
87+
//#define MBEDTLS_ERROR_C
88+
89+
// Change to a buffer allocator
90+
#define MBEDTLS_PLATFORM_C
91+
#define MBEDTLS_PLATFORM_MEMORY
92+
#define MBEDTLS_MEMORY_BUFFER_ALLOC_C

‎external/optiga-trust-m

Submodule optiga-trust-m added at 5b924c8

‎external/optiga_config.h

Lines changed: 117 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,117 @@
1+
#ifndef _OPTIGA_LIB_CONFIG_BITBOX02_H_
2+
#define _OPTIGA_LIB_CONFIG_BITBOX02_H_
3+
4+
#ifdef __cplusplus
5+
extern "C" {
6+
#endif
7+
8+
/** @brief OPTIGA CRYPT random number generation feature enable/disable macro */
9+
#define OPTIGA_CRYPT_RANDOM_ENABLED
10+
/** @brief OPTIGA CRYPT hash feature enable/disable macro */
11+
#define OPTIGA_CRYPT_HASH_ENABLED
12+
/** @brief OPTIGA CRYPT ECC generate keypair feature enable/disable macro */
13+
#define OPTIGA_CRYPT_ECC_GENERATE_KEYPAIR_ENABLED
14+
/** @brief OPTIGA CRYPT ECDSA signature feature enable/disable macro */
15+
#define OPTIGA_CRYPT_ECDSA_SIGN_ENABLED
16+
/** @brief OPTIGA CRYPT verify ECDSA signature feature enable/disable macro */
17+
#define OPTIGA_CRYPT_ECDSA_VERIFY_ENABLED
18+
/** @brief OPTIGA CRYPT ECDH feature enable/disable macro */
19+
#define OPTIGA_CRYPT_ECDH_ENABLED
20+
/** @brief OPTIGA CRYPT ECC 521 feature enable/disable macro */
21+
#define OPTIGA_CRYPT_ECC_NIST_P_521_ENABLED
22+
/** @brief OPTIGA CRYPT ECC Brainpool feature enable/disable macro */
23+
#define OPTIGA_CRYPT_ECC_BRAINPOOL_P_R1_ENABLED
24+
/** @brief OPTIGA CRYPT TLS PRF sha256 feature enable/disable macro */
25+
#define OPTIGA_CRYPT_TLS_PRF_SHA256_ENABLED
26+
/** @brief OPTIGA CRYPT TLS PRF sha384 feature enable/disable macro */
27+
#define OPTIGA_CRYPT_TLS_PRF_SHA384_ENABLED
28+
/** @brief OPTIGA CRYPT TLS PRF sha512 feature enable/disable macro */
29+
#define OPTIGA_CRYPT_TLS_PRF_SHA512_ENABLED
30+
/** @brief OPTIGA CRYPT RSA generate keypair feature enable/disable macro */
31+
#define OPTIGA_CRYPT_RSA_GENERATE_KEYPAIR_ENABLED
32+
/** @brief OPTIGA CRYPT RSA sign feature enable/disable macro */
33+
#define OPTIGA_CRYPT_RSA_SIGN_ENABLED
34+
/** @brief OPTIGA CRYPT RSA verify sign feature enable/disable macro */
35+
#define OPTIGA_CRYPT_RSA_VERIFY_ENABLED
36+
/** @brief OPTIGA CRYPT RSA Encrypt feature enable/disable macro */
37+
#define OPTIGA_CRYPT_RSA_ENCRYPT_ENABLED
38+
/** @brief OPTIGA CRYPT RSA Decrypt feature enable/disable macro */
39+
#define OPTIGA_CRYPT_RSA_DECRYPT_ENABLED
40+
/** @brief OPTIGA CRYPT RSA pre-master feature enable/disable macro */
41+
#define OPTIGA_CRYPT_RSA_PRE_MASTER_SECRET_ENABLED
42+
/** @brief OPTIGA CRYPT RSA SSA with SHA512 as digest feature enable/disable macro */
43+
#define OPTIGA_CRYPT_RSA_SSA_SHA512_ENABLED
44+
/** @brief OPTIGA CRYPT symmetric encrypt feature enable/disable macro */
45+
#define OPTIGA_CRYPT_SYM_ENCRYPT_ENABLED
46+
/** @brief OPTIGA CRYPT symmetric decrypt feature enable/disable macro */
47+
#define OPTIGA_CRYPT_SYM_DECRYPT_ENABLED
48+
/** @brief OPTIGA CRYPT HMAC feature enable/disable macro */
49+
#define OPTIGA_CRYPT_HMAC_ENABLED
50+
/** @brief OPTIGA CRYPT HKDF feature enable/disable macro */
51+
#define OPTIGA_CRYPT_HKDF_ENABLED
52+
/** @brief OPTIGA CRYPT symmetric generate key feature enable/disable macro */
53+
#define OPTIGA_CRYPT_SYM_GENERATE_KEY_ENABLED
54+
/** @brief OPTIGA CRYPT generate auth code feature enable/disable macro */
55+
#define OPTIGA_CRYPT_GENERATE_AUTH_CODE_ENABLED
56+
/** @brief OPTIGA CRYPT HMAC verify feature enable/disable macro */
57+
#define OPTIGA_CRYPT_HMAC_VERIFY_ENABLED
58+
/** @brief OPTIGA CRYPT clear AUTO state feature enable/disable macro */
59+
#define OPTIGA_CRYPT_CLEAR_AUTO_STATE_ENABLED
60+
61+
/** @brief OPTIGA COMMS shielded connection feature.
62+
* To disable the feature, undefine the macro
63+
*/
64+
#define OPTIGA_COMMS_SHIELDED_CONNECTION
65+
66+
/** @brief Default reset protection level for OPTIGA CRYPT and UTIL APIs */
67+
#define OPTIGA_COMMS_DEFAULT_PROTECTION_LEVEL OPTIGA_COMMS_FULL_PROTECTION
68+
//#define OPTIGA_COMMS_DEFAULT_PROTECTION_LEVEL OPTIGA_COMMS_NO_PROTECTION
69+
70+
/** @brief Default reset type in optiga_comms_open. \n
71+
* Cold Reset - (0) : This is applicable if the host platform has GPIO option for RST and VDD. \n
72+
* Soft Reset - (1) : This is applicable if the host platform doesn't have GPIO options for VDD and RST. \n
73+
* Warm Reset - (2) : This is applicable if the host platform doesn't have GPIO option for VDD. \n
74+
* Any other value will lead to error
75+
*/
76+
#define OPTIGA_COMMS_DEFAULT_RESET_TYPE (1U)
77+
78+
/** @brief NULL parameter check.
79+
* To disable the check, undefine the macro
80+
*/
81+
#define OPTIGA_LIB_DEBUG_NULL_CHECK
82+
/** @brief Maximum number of instance registration */
83+
#define OPTIGA_CMD_MAX_REGISTRATIONS (0x02)
84+
/** @brief Maximum buffer size required to communicate with OPTIGA */
85+
#define OPTIGA_MAX_COMMS_BUFFER_SIZE (0x615) //1557 in decimal
86+
87+
/** @brief Macro to enable logger \n
88+
* Enable macro OPTIGA_LIB_ENABLE_UTIL_LOGGING for Util Service layer logging \n
89+
* Enable macro OPTIGA_LIB_ENABLE_CRYPT_LOGGING for Crypt Service layer logging \n
90+
* Enable macro OPTIGA_LIB_ENABLE_CMD_LOGGING for Command layer logging \n
91+
* Enable macro OPTIGA_LIB_ENABLE_COMMS_LOGGING for Communication layer logging */
92+
// #define OPTIGA_LIB_ENABLE_LOGGING
93+
/** @brief Enable macro OPTIGA_PAL_INIT_ENABLED for calling pal_init functionality */
94+
//#define OPTIGA_PAL_INIT_ENABLED
95+
/// @cond
96+
#ifdef OPTIGA_LIB_ENABLE_LOGGING
97+
/** @brief Macro to enable logger for Util service */
98+
#define OPTIGA_LIB_ENABLE_UTIL_LOGGING
99+
/** @brief Macro to enable logger for Crypt service */
100+
#define OPTIGA_LIB_ENABLE_CRYPT_LOGGING
101+
/** @brief Macro to enable logger for Command layer */
102+
#define OPTIGA_LIB_ENABLE_CMD_LOGGING
103+
/** @brief Macro to enable logger for Communication layer */
104+
#define OPTIGA_LIB_ENABLE_COMMS_LOGGING
105+
#endif
106+
/// @endcond
107+
108+
109+
#ifdef __cplusplus
110+
}
111+
#endif
112+
113+
#endif /* _OPTIGA_LIB_CONFIG_BITBOX02_*/
114+
115+
/**
116+
* @}
117+
*/

‎src/CMakeLists.txt

Lines changed: 7 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -451,6 +451,7 @@ if(CMAKE_CROSSCOMPILING)
451451
# Must manually link against C so that malloc can find _sbrk
452452
target_link_libraries(${elf}
453453
PRIVATE
454+
optiga
454455
cryptoauthlib
455456
fatfs
456457
ctaes
@@ -477,6 +478,12 @@ if(CMAKE_CROSSCOMPILING)
477478
target_link_libraries(${elf} PRIVATE --specs=nosys.specs)
478479

479480
target_link_libraries(${elf} PRIVATE ${firmware}_rust_c)
481+
482+
# Optiga config must be defined both when compiling the optiga lib, and also when compiling our
483+
# sources. We can verify this include is indeed used by our sources - when you point it to a
484+
# non-existing file, compilation fails.
485+
# This definition is also added in external/CMakeLists.txt for the optiga lib.
486+
target_compile_definitions(${elf} PRIVATE OPTIGA_LIB_EXTERNAL="optiga_config.h")
480487
endforeach(firmware)
481488

482489
target_sources(firmware.elf PRIVATE firmware.c)

0 commit comments

Comments
 (0)