Skip to content

SE050: create ECDH derive target object for applet 7.2 middleware #10971

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
LinuxJedi wants to merge 4 commits into
base: master
Choose a base branch
from
+53 −10
Open

SE050: create ECDH derive target object for applet 7.2 middleware #10971

Changes from 1 commit
Commits
Show all changes
4 commits
Select commit Hold shift + click to select a range
4592cf0
SE050: create ECDH derive target object for applet 7.2 middleware
LinuxJedi Jul 21, 2026
f23da12
SE050: only flag curve25519 derive key after it is created
LinuxJedi Jul 23, 2026
9efd88c
SE050 CI: pin strict simulator for applet 7.2 ECDH contract
LinuxJedi Jul 23, 2026
6d0e149
SE050 CI: correct pinned simulator commit id
LinuxJedi Jul 23, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
47 changes: 41 additions & 6 deletions wolfcrypt/src/port/nxp/se050_port.c
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -2850,25 +2850,42 @@ int se050_ecc_shared_secret(ecc_key* private_key, ecc_key* public_key,
status = sss_key_object_allocate_handle(&deriveKey,
keyIdAes,
kSSS_KeyPart_Default,
kSSS_CipherType_Binary,
kSSS_CipherType_HMAC,
keySize,
kKeyObject_Mode_Transient);
}
if (status == kStatus_SSS_Success) {
byte keyBuf[MAX_ECC_BYTES];

/* Try to delete existing key first, ignore return since will
* fail if no key exists yet */
sss_key_store_erase_key(&host_keystore, &deriveKey);

/* SE05x applet 7.2 and later stores the ECDH result into an
* existing HMACKey object whose size must equal the shared
* secret exactly, so the object must be created before the
* derive (returns SW 0x6985 otherwise) */
XMEMSET(keyBuf, 0, sizeof(keyBuf));
status = sss_key_store_set_key(&host_keystore, &deriveKey,
keyBuf, keySize, keySize * 8, NULL, 0);
if (status == kStatus_SSS_Success) {
deriveKeyCreated = 1;
}
}
if (status == kStatus_SSS_Success) {
status = sss_derive_key_context_init(&ctx_derive_key, cfg_se050_i2c_pi,
&ref_private_key, kAlgorithm_SSS_ECDH,
kMode_SSS_ComputeSharedSecret);
if (status == kStatus_SSS_Success) {
/* Try to delete existing key first, ignore return since will
* fail if no key exists yet */
sss_key_store_erase_key(&host_keystore, &deriveKey);
status = sss_derive_key_dh(&ctx_derive_key, &ref_public_key,
&deriveKey);
}
if (status == kStatus_SSS_Success) {
size_t outlenSz = (size_t)*outlen;
size_t outlenSzBits = outlenSz * 8;
deriveKeyCreated = 1;
/* sss_key_store_get_key has no HMAC read case, so read the
* object back as AES type (both are a plain ReadObject) */
deriveKey.cipherType = kSSS_CipherType_AES;
/* derived key export */
status = sss_key_store_get_key(&host_keystore, &deriveKey,
out, &outlenSz, &outlenSzBits);
Expand Down Expand Up @@ -3445,10 +3462,25 @@ int se050_curve25519_shared_secret(curve25519_key* private_key,
status = sss_key_object_allocate_handle(&deriveKey,
keyIdAes,
kSSS_KeyPart_Default,
kSSS_CipherType_Binary,
kSSS_CipherType_HMAC,
Comment thread
LinuxJedi marked this conversation as resolved.
Outdated
keySize,
kKeyObject_Mode_Transient);
}
if (status == kStatus_SSS_Success) {
byte keyBuf[CURVE25519_KEYSIZE];

/* Try to delete existing key first, ignore return since will
* fail if no key exists yet */
sss_key_store_erase_key(&host_keystore, &deriveKey);

/* SE05x applet 7.2 and later stores the ECDH result into an
* existing HMACKey object whose size must equal the shared
* secret exactly, so the object must be created before the
* derive (returns SW 0x6985 otherwise) */
XMEMSET(keyBuf, 0, sizeof(keyBuf));
status = sss_key_store_set_key(&host_keystore, &deriveKey,
keyBuf, keySize, keySize * 8, NULL, 0);
}
if (status == kStatus_SSS_Success) {
status = sss_derive_key_context_init(&ctx_derive_key, cfg_se050_i2c_pi,
&ref_private_key, kAlgorithm_SSS_ECDH,
Expand All @@ -3460,6 +3492,9 @@ int se050_curve25519_shared_secret(curve25519_key* private_key,
if (status == kStatus_SSS_Success) {
size_t outlenSz = sizeof(out->point);
size_t outlenSzBits = outlenSz * 8;
/* sss_key_store_get_key has no HMAC read case, so read the
* object back as AES type (both are a plain ReadObject) */
deriveKey.cipherType = kSSS_CipherType_AES;
/* derived key export */
status = sss_key_store_get_key(&host_keystore, &deriveKey,
out->point, &outlenSz, &outlenSzBits);
Expand Down
Loading