Skip to content

Add SHE (Secure Hardware Extension) support to wolfCrypt #10009

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
bigbrett merged 13 commits into from
Apr 16, 2026
Merged

Add SHE (Secure Hardware Extension) support to wolfCrypt #10009

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
13 commits
Select commit Hold shift + click to select a range
eeedc47
Add SHE (Secure Hardware Extension) support to wolfCrypt
night1rider Mar 18, 2026
8c0999a
fix macro guarding in tests/api.c
night1rider Mar 18, 2026
ee7fe9e
SHE API: remove key storage from context, add direct output params
night1rider Mar 20, 2026
802c340
Add more in depth comments in header file for she.h
night1rider Mar 21, 2026
f081a08
Address comments from bigbrett and Fenrir bot. Rename she.{c,h} to wc…
night1rider Mar 24, 2026
f8956ab
update she union for callback to be getUid not setUid
night1rider Mar 24, 2026
994b0cd
Add one-shot SHE LoadKey and LoadKey Verify convenience APIs: wc_SHE_…
night1rider Mar 31, 2026
8760b72
Add missing NO_WC_SHE_LOADKEY macro to known macros list
night1rider Apr 3, 2026
92bd03a
Fix .wolfssl_known_macro_extras: remove 19 unneeded macros, add NO_WC…
night1rider Apr 9, 2026
1078e79
Fix CMake SHE deps, const-correctness in CryptoCb uid, stale comment,…
night1rider Apr 9, 2026
1413afb
Fix CMake SHE build: add wc_she.c to sources, propagate CMAC/AES_DIRE…
night1rider Apr 9, 2026
9775795
Add ability to skip load key verify test
night1rider Apr 10, 2026
64a1ac8
wc_SHE_ImportM1M2M3: fix guard from || to && so it gates on WOLF_CRYP…
night1rider Apr 16, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
9 changes: 9 additions & 0 deletions .github/workflows/os-check.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -42,6 +42,15 @@ jobs:
'--enable-dtls --enable-dtlscid --enable-dtls13 --enable-secure-renegotiation
--enable-psk --enable-aesccm --enable-nullcipher
CPPFLAGS=-DWOLFSSL_STATIC_RSA',
'--enable-she=extended --enable-cryptocb --enable-cryptocbutils
CPPFLAGS=''-DWC_SHE_SW_DEFAULT'' ',
'--enable-she=standard --enable-cmac',
'--enable-she=extended --enable-cmac --enable-cryptocb --enable-cryptocbutils',
'--enable-she=standard --enable-cmac CPPFLAGS=''-DNO_WC_SHE_IMPORT_M123'' ',
'--enable-she=extended --enable-cmac --enable-cryptocb --enable-cryptocbutils
CPPFLAGS=''-DNO_WC_SHE_GETUID -DNO_WC_SHE_GETCOUNTER -DNO_WC_SHE_EXPORTKEY'' ',
'--enable-she=standard --enable-cmac --enable-cryptocb --enable-cryptocbutils
CPPFLAGS=''-DWC_SHE_SW_DEFAULT'' ',
'--enable-all CPPFLAGS=''-DNO_AES_192 -DNO_AES_256'' ',
'--enable-sniffer --enable-curve25519 --enable-curve448 --enable-enckeys
CPPFLAGS=-DWOLFSSL_DH_EXTRA',
Expand Down
1 change: 1 addition & 0 deletions .wolfssl_known_macro_extras
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -446,6 +446,7 @@ NO_TKERNEL_MEM_POOL
NO_TLSX_PSKKEM_PLAIN_ANNOUNCE
NO_VERIFY_OID
NO_WC_DHGENERATEPUBLIC
NO_WC_SHE_LOADKEY
NO_WC_SSIZE_TYPE
NO_WOLFSSL_ALLOC_ALIGN
NO_WOLFSSL_AUTOSAR_CRYIF
Expand Down
25 changes: 25 additions & 0 deletions CMakeLists.txt
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -1640,6 +1640,30 @@ if(WOLFSSL_CMAC)
endif()
endif()

# SHE (Secure Hardware Extension) key update message generation
# standard: core SHE support, extended: adds custom KDF/header overrides
add_option("WOLFSSL_SHE"
"Enable SHE key update support (standard|extended|no)"
"no" "standard;extended;no")

if(WOLFSSL_SHE STREQUAL "standard" OR WOLFSSL_SHE STREQUAL "extended")
Comment thread
dgarske marked this conversation as resolved.
if (NOT WOLFSSL_AES)
message(FATAL_ERROR "Cannot use SHE without AES.")
else()
list(APPEND WOLFSSL_DEFINITIONS
"-DWOLFSSL_SHE"
"-DWOLFSSL_CMAC"
"-DWOLFSSL_AES_DIRECT")
override_cache(WOLFSSL_CMAC "yes")
override_cache(WOLFSSL_AESCBC "yes")
endif()
endif()

if(WOLFSSL_SHE STREQUAL "extended")
list(APPEND WOLFSSL_DEFINITIONS
"-DWOLFSSL_SHE_EXTENDED")
endif()

# TODO: - RC2
# - FIPS, again (there's more logic for FIPS in configure.ac)
# - Selftest
Expand Down Expand Up @@ -2816,6 +2840,7 @@ if(WOLFSSL_EXAMPLES)
tests/api/test_hash.c
tests/api/test_hmac.c
tests/api/test_cmac.c
tests/api/test_she.c
tests/api/test_des3.c
tests/api/test_chacha.c
tests/api/test_poly1305.c
Expand Down
7 changes: 7 additions & 0 deletions cmake/functions.cmake
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -345,6 +345,9 @@ function(generate_build_flags)
if(WOLFSSL_HPKE OR WOLFSSL_USER_SETTINGS)
set(BUILD_HPKE "yes" PARENT_SCOPE)
endif()
if(WOLFSSL_SHE AND NOT WOLFSSL_SHE STREQUAL "no")
set(BUILD_SHE "yes" PARENT_SCOPE)
endif()

set(BUILD_FLAGS_GENERATED "yes" PARENT_SCOPE)
endfunction()
Expand Down Expand Up @@ -1150,6 +1153,10 @@ function(generate_lib_src_list LIB_SOURCES)
list(APPEND LIB_SOURCES wolfcrypt/src/cryptocb.c)
endif()

if(BUILD_SHE)
list(APPEND LIB_SOURCES wolfcrypt/src/wc_she.c)
endif()

if(BUILD_PKCS11)
list(APPEND LIB_SOURCES wolfcrypt/src/wc_pkcs11.c)
endif()
Expand Down
26 changes: 26 additions & 0 deletions configure.ac
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -5945,6 +5945,31 @@ fi
AS_IF([test "x$ENABLED_CMAC" = "xyes"],
[AM_CFLAGS="$AM_CFLAGS -DWOLFSSL_CMAC -DWOLFSSL_AES_DIRECT"])

# SHE (Secure Hardware Extension) key update message generation
# --enable-she=standard: standard SHE support
# --enable-she=extended: standard + extended overrides (custom KDF/headers)
AC_ARG_ENABLE([she],
Comment thread
bigbrett marked this conversation as resolved.
[AS_HELP_STRING([--enable-she@<:@=standard|extended@:>@],
[Enable SHE key update support (default: disabled)])],
[ ENABLED_SHE=$enableval ],
[ ENABLED_SHE=no ]
)

if test "x$ENABLED_SHE" = "xstandard" || test "x$ENABLED_SHE" = "xextended"
then
if test "$ENABLED_AESCBC" = "no"
then
AC_MSG_ERROR([SHE requires AES-CBC. Cannot use --disable-aescbc with --enable-she.])
fi
AM_CFLAGS="$AM_CFLAGS -DWOLFSSL_SHE -DWOLFSSL_CMAC -DWOLFSSL_AES_DIRECT"
ENABLED_CMAC=yes
ENABLED_AESCBC=yes
Comment thread
dgarske marked this conversation as resolved.
fi

if test "x$ENABLED_SHE" = "xextended"
then
AM_CFLAGS="$AM_CFLAGS -DWOLFSSL_SHE_EXTENDED"
fi

# AES-XTS
AC_ARG_ENABLE([aesxts],
Expand Down Expand Up @@ -11555,6 +11580,7 @@ AM_CONDITIONAL([BUILD_FIPS_V6],[test $HAVE_FIPS_VERSION = 6])
AM_CONDITIONAL([BUILD_FIPS_V6_PLUS],[test $HAVE_FIPS_VERSION -ge 6])
AM_CONDITIONAL([BUILD_SIPHASH],[test "x$ENABLED_SIPHASH" = "xyes" || test "x$ENABLED_USERSETTINGS" = "xyes"])
AM_CONDITIONAL([BUILD_CMAC],[test "x$ENABLED_CMAC" = "xyes" || test "x$ENABLED_USERSETTINGS" = "xyes"])
AM_CONDITIONAL([BUILD_SHE],[test "x$ENABLED_SHE" = "xstandard" || test "x$ENABLED_SHE" = "xextended" || test "x$ENABLED_USERSETTINGS" = "xyes"])
AM_CONDITIONAL([BUILD_SELFTEST],[test "x$ENABLED_SELFTEST" = "xyes"])
AM_CONDITIONAL([BUILD_SHA224],[test "x$ENABLED_SHA224" = "xyes" || test "x$ENABLED_USERSETTINGS" = "xyes"])
AM_CONDITIONAL([BUILD_SHA3],[test "x$ENABLED_SHA3" != "xno" || test "x$ENABLED_USERSETTINGS" = "xyes"])
Expand Down
16 changes: 16 additions & 0 deletions src/include.am
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -159,6 +159,10 @@ if BUILD_CMAC
src_libwolfssl@LIBSUFFIX@_la_SOURCES += wolfcrypt/src/cmac.c
endif

if BUILD_SHE
src_libwolfssl@LIBSUFFIX@_la_SOURCES += wolfcrypt/src/wc_she.c
endif

src_libwolfssl@LIBSUFFIX@_la_SOURCES += wolfcrypt/src/fips.c \
wolfcrypt/src/fips_test.c

Expand Down Expand Up @@ -424,6 +428,10 @@ if BUILD_CMAC
src_libwolfssl@LIBSUFFIX@_la_SOURCES += wolfcrypt/src/cmac.c
endif

if BUILD_SHE
src_libwolfssl@LIBSUFFIX@_la_SOURCES += wolfcrypt/src/wc_she.c
endif

src_libwolfssl@LIBSUFFIX@_la_SOURCES += wolfcrypt/src/fips.c \
wolfcrypt/src/fips_test.c

Expand Down Expand Up @@ -677,6 +685,10 @@ if BUILD_CMAC
src_libwolfssl@LIBSUFFIX@_la_SOURCES += wolfcrypt/src/cmac.c
endif

if BUILD_SHE
src_libwolfssl@LIBSUFFIX@_la_SOURCES += wolfcrypt/src/wc_she.c
endif

if BUILD_CURVE448
src_libwolfssl@LIBSUFFIX@_la_SOURCES += wolfcrypt/src/curve448.c
endif
Expand Down Expand Up @@ -1009,6 +1021,10 @@ if !BUILD_FIPS_V2_PLUS
if BUILD_CMAC
src_libwolfssl@LIBSUFFIX@_la_SOURCES += wolfcrypt/src/cmac.c
endif

if BUILD_SHE
src_libwolfssl@LIBSUFFIX@_la_SOURCES += wolfcrypt/src/wc_she.c
endif
endif !BUILD_FIPS_V2_PLUS

if !BUILD_FIPS_V2
Expand Down
9 changes: 9 additions & 0 deletions tests/api.c
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -202,6 +202,7 @@
#include <tests/api/test_hash.h>
#include <tests/api/test_hmac.h>
#include <tests/api/test_cmac.h>
#include <tests/api/test_she.h>
#include <tests/api/test_des3.h>
#include <tests/api/test_chacha.h>
#include <tests/api/test_poly1305.h>
Expand Down Expand Up @@ -35635,6 +35636,14 @@ TEST_CASE testCases[] = {
TEST_HMAC_DECLS,
/* CMAC */
TEST_CMAC_DECLS,
/* SHE */
TEST_SHE_DECLS,
#ifdef WOLFSSL_SHE_EXTENDED
TEST_SHE_EXT_DECLS,
#endif
#if defined(WOLF_CRYPTO_CB) && defined(WOLFSSL_SHE)
TEST_SHE_CB_DECLS,
#endif

/* Cipher */
/* Triple-DES */
Expand Down
3 changes: 3 additions & 0 deletions tests/api/include.am
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -18,6 +18,8 @@ tests_unit_test_SOURCES += tests/api/test_hash.c
# MAC
tests_unit_test_SOURCES += tests/api/test_hmac.c
tests_unit_test_SOURCES += tests/api/test_cmac.c
# SHE
tests_unit_test_SOURCES += tests/api/test_she.c
# Cipher
tests_unit_test_SOURCES += tests/api/test_des3.c
tests_unit_test_SOURCES += tests/api/test_chacha.c
Expand Down Expand Up @@ -124,6 +126,7 @@ EXTRA_DIST += tests/api/test_digest.h
EXTRA_DIST += tests/api/test_hash.h
EXTRA_DIST += tests/api/test_hmac.h
EXTRA_DIST += tests/api/test_cmac.h
EXTRA_DIST += tests/api/test_she.h
EXTRA_DIST += tests/api/test_des3.h
EXTRA_DIST += tests/api/test_chacha.h
EXTRA_DIST += tests/api/test_poly1305.h
Expand Down
Loading
Loading