You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
Copy file name to clipboardexpand all lines: wolfSSL/src/chapter06.md
+22-13
Original file line number
Diff line number
Diff line change
@@ -58,7 +58,7 @@ Again, no dynamic memory is used for this structure since a maximum number of SS
58
58
```c
59
59
typedefstruct packetInfo_st {
60
60
char packetName[MAX_PACKETNAME_SZ + 1]; /* SSL name */
61
-
Timeval timestamp; /* when it occured */
61
+
Timeval timestamp; /* when it occurred */
62
62
unsigned char value[MAX_VALUE_SZ]; /* if fits, it's here */
63
63
unsigned char* bufferValue; /* otherwise here (non 0) */
64
64
int valueSz; /* sz of value or buffer */
@@ -189,7 +189,7 @@ To use Atomic Record Layer callbacks, wolfSSL needs to be compiled using the [`-
189
189
190
190
## Crypto Callbacks (cryptocb)
191
191
192
-
The Crypto callback framework in wolfSSL/wolfCrypt enables users to override the default implementation of select cryptographic algorithms and provide their own custom implementations at runtime. The most common use case for crypto callbacks is to offload an algorithm to custom hardware acceleration, however it could also be used to add additional logging/introspection, retrieve keys from secure storage, to call crypto from another library for standards compliance reasons, or even to perform a remote procedure call.
192
+
The Crypto callback framework in wolfSSL/wolfCrypt enables users to override the default implementation of select cryptographic algorithms and provide their own custom implementations at runtime. The most common use case for crypto callbacks is to offload an algorithm to custom hardware acceleration, however it could also be used to add additional logging/introspection, retrieve keys from secure storage, to call crypto from another library for standards compliance reasons, or even to perform a remote procedure call.
193
193
194
194
### Using Crypto callbacks
195
195
@@ -210,18 +210,20 @@ To use crypto callbacks, the user must register a top-level cryptographic callba
210
210
211
211
To register a cryptographic callback function with wolfCrypt, use the `wc_CryptoCb_RegisterDevice` API. This takes a (`devId`), the callback function, and an optional user context that will be passed through to the callback when it is invoked.
WOLFSSL_API int wc_CryptoCb_RegisterDevice(int devId,
217
217
CryptoDevCallbackFunc cb,
218
218
void* ctx);
219
219
```
220
220
221
+
Note: A registered `devId` can be any value other than `-2`, which is reserved for the special `INVALID_DEVID` enum value. Passing `devId == INVALID_DEVID` as an argument into a wolfCrypt API indicates that no callback should be invoked and to use the default internal implementation instead.
221
222
222
223
#### 3. Pass the `devId` as an argument to a wolfCrypt API function
223
224
224
-
For wolfCrypt API’s use the init functions that accept `devId` such as:
225
+
For wolfCrypt API’s, use the init functions that accept `devId` such as:
226
+
225
227
```
226
228
wc_InitRsaKey_ex
227
229
wc_ecc_init_ex
@@ -231,11 +233,12 @@ wc_InitSha_ex
231
233
wc_HmacInit
232
234
wc_InitCmac_ex
233
235
```
234
-
This is not an exhaustive list. Please refer to the wolfCrypt API documentation to see if a particular algorithm supports crypto callbacks.
236
+
237
+
This will cause wolfCrypt to invoke the crypto callback in place of the default implementation. This is not an exhaustive API list. Please refer to the wolfCrypt API documentation to see if a particular algorithm supports crypto callbacks.
235
238
236
239
#### 4. (TLS only): associate the devId with a wolfSSL context
237
240
To enable use of a crypto callback when using TLS, you must supply the `devId` arguments on initialization of a `WOLFSSL_CTX` or `WOLFSSL` struct.
238
-
```
241
+
```c
239
242
wolfSSL_CTX_SetDevId(ctx, devId);
240
243
wolfSSL_SetDevId(ssl, devId);
241
244
```
@@ -258,7 +261,7 @@ The crypto callback should return zero on success, or a valid wolfCrypt error co
@@ -290,7 +293,7 @@ Some of the simpler algo type unions, such as the RNG and seed unions, require n
290
293
291
294
Here is a simplified example for a complex algo type union with multiple levels of union decoding. The callback contains support for random number generation, as well as ECC key agreement, sign, and verify.
292
295
293
-
```
296
+
```c
294
297
int myCryptoCallback(int devId, wc_CryptoInfo* info, void* ctx)
The data structure for each type of request generally contains a pointer and associated size for input and output data. Depending on the request it may include additional data including cryptographic keys, nonces, or further configuration. The crypto callback should operate on the input data and write relevant output data back to the appropriate variant of the algo type union. Writing data to a union variant that does not correspond to the algorithm type in question (e.g. using `info->cipher` when `info->algo_type == WC_ALGO_TYPE_RNG` is a memory error and can result in undefined behavior.
334
+
The data structure for each type of request generally contains a pointer and associated size for input and output data. Depending on the request it may include additional data including cryptographic keys, nonces, or further configuration. The crypto callback should operate on the input data and write relevant output data back to the appropriate variant of the algo type union. Writing data to a union variant that does not correspond to the algorithm type in question (e.g. using `info->cipher`
335
+
when `info->algo_type == WC_ALGO_TYPE_RNG` is a memory error and can result in undefined behavior.
336
+
337
+
### Troubleshooting
338
+
339
+
Some older compilers don't allow "anonymous inline aggregates", which wolfCrypt uses when defining the nested `wcCryptoInfo` anonymous unions in order to save space. To disable the use of anonymous inline aggregates, define the `HAVE_ANONYMOUS_INLINE_AGGREGATES` preprocessor macro as `0`. This will allow crypto callbacks to be used, but will dramatically increase the size of the `wcCryptoInfo` structure.
332
340
333
341
334
342
### Examples
335
343
336
344
Full examples of crypto callbacks can be found in the following locations
0 commit comments