CRYPTO Devices
Last updated
Last updated
Encryption/Decryption is a file and message encryption and decryption technology. With the rapid development of the Internet of Things, users have a strong demand for data encryption and decryption in their normal work.
To ensure the information security of IoT devices, the TLS secure transport layer protocol was introduced at the software level. At the same time, security-related encryption and decryption modules were gradually added to hardware chips, and even security chips designed specifically for security appeared. The hardware security module on the chip has a faster computing speed and smaller resource usage than the security algorithm implemented purely by software. However, most IoT devices still use pure software security algorithms. One of the most important reasons is that the hardware interfaces are different and diverse, making it difficult to connect with software.
Therefore, RT-Thread launched the hwcrypto hardware encryption and decryption driver framework and connected it to common security transmission kits. As long as the hardware supports the encryption and decryption module, the hardware-based encryption and decryption security transmission kit can be used directly, and the transmission speed can be increased several times.
hwcrypto is a hardware encryption and decryption device driver framework. It is mainly composed of two parts: the hardware encryption and decryption driver abstraction layer and various encryption and decryption API interfaces. For upper-layer applications, it can be connected to a security suite or used directly, and the usage is very flexible. For the driver, there are few interfaces to be connected, the function is single, and the driver development is simple and fast. The following figure is a Crypto framework hierarchy diagram:
The main features are as follows:
Thin and light design, efficient operation
The most important function of the hardware encryption and decryption driver is interface conversion, which realizes interface unification and facilitates upper-layer applications to use hardware encryption and decryption. Therefore, it is designed to be very thin and light. It has extremely low resource usage, ROM < 0.8K / RAM < 0.2K.
Encryption and decryption also have very high requirements on running speed. Therefore, for frequently called code, careful consideration is given to reduce the steps of the running process to a minimum, so as to minimize the performance loss, and make it as fast as directly operating the hardware registers.
Thoughtful and easy to use
In API design, we start from two dimensions: simplicity and ease of use, and full functionality. First, users directly use the hardware encryption and decryption API, which requires easy to use. For this reason, we evaluated many software interfaces in the early stage. After personal use and testing, we finally defined a set of APIs with full functionality and simple interfaces.
While meeting the needs of users, we also made a lot of considerations in the connection with the secure transmission suite. We added an API specifically for the secure transmission suite. In the end, this set of API users can use or connect to the secure transmission suite with ease.
Fully compatible and versatile
The interface design of the driver docking is also carefully designed. In the early stage, the encryption and decryption peripherals of many hardware manufacturers were classified according to their functions, analyzed and sorted, and a set of driver interfaces with single functions and comprehensive parameters were extracted. This driver interface can fully adapt to conventional MCU encryption and decryption peripherals. It has been verified on multiple platforms, such as Lianshengde W60X series, STM32 series, etc.
The hardware encryption and decryption framework currently supports encryption and decryption related interfaces such as AES/DES/3DES/RC4/SHA1/SHA2/MD5/CRC/RNG/BIGNUM.
The above encryption and decryption algorithms are divided into the following categories according to different types. Each category has rich APIs available for use. The currently supported types are as follows:
hash: hash algorithm
symmetric: symmetric encryption and decryption algorithm
gcm: GMAC message authentication code
crc: CRC redundancy check
rng: random number generator
bignum: large number operations
A hash algorithm transforms an input of any length into an output of a fixed length through a hash algorithm. It is a function that compresses a message of any length into a message digest of a fixed length. The space of hash values is usually much smaller than the space of inputs. Different inputs may hash to the same output, so it is impossible to determine the unique input value from the hash value.
The application accesses the hash algorithm device hardware through the hash algorithm device management interface provided by RT-Thread. The relevant interface is as follows:
function
describe
rt_hwcrypto_hash_create()
Creating a hash context
rt_hwcrypto_hash_destroy()
Release context
rt_hwcrypto_hash_finish()
Calculate the final hash value
rt_hwcrypto_hash_update()
Process a packet of data
rt_hwcrypto_hash_cpy()
Copy context
rt_hwcrypto_hash_reset()
Reset Context
rt_hwcrypto_hash_set_type()
Set the hash algorithm type
The application creates a hash context based on the handle of the hash device as follows:
parameter
describe
device
Encryption and decryption device handle
type
Hash algorithm type
return
——
NULL
fail
other
Device Object
Common types and subtypes of hash algorithms are as follows
If you create a hash algorithm of the MD5 type, the usage example is as follows
The prototype of the rt_hwcrypto_dev_default() function is struct rt_hwcrypto_device *rt_hwcrypto_dev_default(void)
to return the default hardware encryption and decryption device handle.
The application deletes the context based on the hash context and releases the resources as follows:
parameter
describe
ctx
Context
return
——
Based on the hash context, the application can output the final hash value as follows:
parameter
describe
ctx
Context
output
Output Data
length
Data length
return
——
RT_EOK
Calculation success
other
fail
The application inputs a packet of data and calculates the hash value according to the hash context, as shown below:
parameter
describe
ctx
Context
input
Input Data
length
Input data length
return
——
RT_EOK
Calculation success
other
fail
The usage examples are as follows:
The application copies the context of the source hash to the context of the target hash as follows:
parameter
describe
of the
Target context
src
Source context
return
——
RT_EOK
Calculation success
other
fail
The application resets the hash context text according to the hash context, as follows:
parameter
describe
ctx
Context
return
——
Before releasing the context, the next packet of data can be calculated only after it is reset.
The application sets the hash algorithm type according to the hash context, as follows:
parameter
describe
ctx
Context
type
Hash algorithm type
return
——
RT_EOK
Calculation success
other
fail
Common hash algorithm types, refer to the type introduction in the creation of hash context
Setting the type is only valid before data operation. Changing the type during operation will result in incorrect operation results.
Symmetric encryption and decryption refers to an encryption algorithm that uses the same key for encryption and decryption, so this encryption algorithm is also called a secret key algorithm or a single key algorithm. The security of a symmetric algorithm depends on the key. Leaking the key means that anyone can decrypt the messages they send or receive, so the confidentiality of the key is crucial to the security of communication.
The application accesses the symmetric algorithm device hardware through the symmetric device management interface provided by RT-Thread. The relevant interface is as follows:
function
describe
rt_hwcrypto_symmetric_create()
Create a symmetric encryption and decryption context
rt_hwcrypto_symmetric_destroy()
Release context
rt_hwcrypto_symmetric_crypt()
Encryption and decryption operations
rt_hwcrypto_symmetric_setkey()
Set encryption and decryption keys
rt_hwcrypto_symmetric_getkey()
Get encryption and decryption keys