/*************************************************************************** * Copyright (c) 2024 Microsoft Corporation * Copyright (c) 2025-present Eclipse ThreadX Contributors * * This program and the accompanying materials are made available under the * terms of the MIT License which is available at * https://opensource.org/licenses/MIT. * * SPDX-License-Identifier: MIT **************************************************************************/ #ifndef NX_CRYPTO_STANDALONE_ENABLE #include "nx_secure_tls.h" #include "nx_crypto_hash_clone_test.h" #include "nx_crypto_sha2.h" /* Define cryptographic methods for use with TLS. */ extern NX_CRYPTO_METHOD crypto_method_none; extern NX_CRYPTO_METHOD crypto_method_null; extern NX_CRYPTO_METHOD crypto_method_aes_cbc_128; extern NX_CRYPTO_METHOD crypto_method_aes_cbc_256; extern NX_CRYPTO_METHOD crypto_method_aes_ccm_8; extern NX_CRYPTO_METHOD crypto_method_aes_ccm_16; extern NX_CRYPTO_METHOD crypto_method_aes_128_gcm_16; extern NX_CRYPTO_METHOD crypto_method_aes_256_gcm_16; extern NX_CRYPTO_METHOD crypto_method_ecdsa; extern NX_CRYPTO_METHOD crypto_method_ecdhe; extern NX_CRYPTO_METHOD crypto_method_hmac_sha1; extern NX_CRYPTO_METHOD crypto_method_hmac_sha256; extern NX_CRYPTO_METHOD crypto_method_hmac_md5; extern NX_CRYPTO_METHOD crypto_method_rsa; extern NX_CRYPTO_METHOD crypto_method_pkcs1; extern NX_CRYPTO_METHOD crypto_method_auth_psk; extern NX_CRYPTO_METHOD crypto_method_ec_secp256; extern NX_CRYPTO_METHOD crypto_method_ec_secp384; extern NX_CRYPTO_METHOD crypto_method_ec_secp521; extern NX_CRYPTO_METHOD crypto_method_md5; extern NX_CRYPTO_METHOD crypto_method_sha1; extern NX_CRYPTO_METHOD crypto_method_sha224; extern NX_CRYPTO_METHOD crypto_method_sha384; extern NX_CRYPTO_METHOD crypto_method_sha512; extern NX_CRYPTO_METHOD crypto_method_hkdf_sha1; extern NX_CRYPTO_METHOD crypto_method_hkdf_sha256; extern NX_CRYPTO_METHOD crypto_method_tls_prf_1; extern NX_CRYPTO_METHOD crypto_method_tls_prf_sha256; extern NX_CRYPTO_METHOD crypto_method_tls_prf_sha384; extern NX_CRYPTO_METHOD crypto_method_hkdf; extern NX_CRYPTO_METHOD crypto_method_hmac; NX_CRYPTO_METHOD crypto_method_sha256_hc = { NX_CRYPTO_HASH_SHA256, /* SHA256 algorithm */ 0, /* Key size in bits */ 0, /* IV size in bits, not used */ NX_CRYPTO_SHA256_ICV_LEN_IN_BITS, /* Transmitted ICV size in bits */ NX_CRYPTO_SHA2_BLOCK_SIZE_IN_BYTES, /* Block size in bytes */ sizeof(NX_CRYPTO_HASH_CLONE_TEST), /* Metadata size in bytes */ _nx_crypto_method_hash_clone_test_init, /* SHA256 initialization routine */ _nx_crypto_method_hash_clone_test_cleanup, /* SHA256 cleanup routine */ _nx_crypto_method_hash_clone_test_operation /* SHA256 operation */ }; /* Ciphersuite table without ECC. */ /* Lookup table used to map ciphersuites to cryptographic routines. */ NX_SECURE_TLS_CIPHERSUITE_INFO _nx_crypto_ciphersuite_lookup_table_hc[] = { /* Ciphersuite, public cipher, public_auth, session cipher & cipher mode, iv size, key size, hash method, hash size, TLS PRF */ #ifdef NX_SECURE_ENABLE_AEAD_CIPHER {TLS_RSA_WITH_AES_128_GCM_SHA256, &crypto_method_rsa, &crypto_method_rsa, &crypto_method_aes_128_gcm_16, 16, 16, &crypto_method_null, 0, &crypto_method_tls_prf_sha256}, #endif /* NX_SECURE_ENABLE_AEAD_CIPHER */ {TLS_RSA_WITH_AES_256_CBC_SHA256, &crypto_method_rsa, &crypto_method_rsa, &crypto_method_aes_cbc_256, 16, 32, &crypto_method_hmac_sha256, 32, &crypto_method_tls_prf_sha256}, {TLS_RSA_WITH_AES_128_CBC_SHA256, &crypto_method_rsa, &crypto_method_rsa, &crypto_method_aes_cbc_128, 16, 16, &crypto_method_hmac_sha256, 32, &crypto_method_tls_prf_sha256}, #ifdef NX_SECURE_ENABLE_PSK_CIPHERSUITES {TLS_PSK_WITH_AES_128_CBC_SHA256, &crypto_method_null, &crypto_method_auth_psk, &crypto_method_aes_cbc_128, 16, 16, &crypto_method_hmac_sha256, 32, &crypto_method_tls_prf_sha256}, #ifdef NX_SECURE_ENABLE_AEAD_CIPHER {TLS_PSK_WITH_AES_128_CCM_8, &crypto_method_null, &crypto_method_auth_psk, &crypto_method_aes_ccm_8, 16, 16, &crypto_method_null, 0, &crypto_method_tls_prf_sha256}, #endif #endif /* NX_SECURE_ENABLE_PSK_CIPHERSUITES */ }; const UINT _nx_crypto_ciphersuite_lookup_table_hc_size = sizeof(_nx_crypto_ciphersuite_lookup_table_hc) / sizeof(NX_SECURE_TLS_CIPHERSUITE_INFO); /* Lookup table for X.509 digital certificates - they need a public-key algorithm and a hash routine for verification. */ NX_SECURE_X509_CRYPTO _nx_crypto_x509_cipher_lookup_table_hc[] = { /* OID identifier, public cipher, hash method */ {NX_SECURE_TLS_X509_TYPE_RSA_SHA_256, &crypto_method_rsa, &crypto_method_sha256_hc}, {NX_SECURE_TLS_X509_TYPE_RSA_SHA_384, &crypto_method_rsa, &crypto_method_sha384}, {NX_SECURE_TLS_X509_TYPE_RSA_SHA_512, &crypto_method_rsa, &crypto_method_sha512}, {NX_SECURE_TLS_X509_TYPE_RSA_SHA_1, &crypto_method_rsa, &crypto_method_sha1}, {NX_SECURE_TLS_X509_TYPE_RSA_MD5, &crypto_method_rsa, &crypto_method_md5}, }; const UINT _nx_crypto_x509_cipher_lookup_table_hc_size = sizeof(_nx_crypto_x509_cipher_lookup_table_hc) / sizeof(NX_SECURE_X509_CRYPTO); /* Define the object we can pass into TLS. */ NX_SECURE_TLS_CRYPTO nx_crypto_tls_ciphers_hc = { /* Ciphersuite lookup table and size. */ _nx_crypto_ciphersuite_lookup_table_hc, sizeof(_nx_crypto_ciphersuite_lookup_table_hc) / sizeof(NX_SECURE_TLS_CIPHERSUITE_INFO), #ifndef NX_SECURE_DISABLE_X509 /* X.509 certificate cipher table and size. */ _nx_crypto_x509_cipher_lookup_table_hc, sizeof(_nx_crypto_x509_cipher_lookup_table_hc) / sizeof(NX_SECURE_X509_CRYPTO), #endif /* TLS version-specific methods. */ #if (NX_SECURE_TLS_TLS_1_0_ENABLED || NX_SECURE_TLS_TLS_1_1_ENABLED) &crypto_method_md5, &crypto_method_sha1, &crypto_method_tls_prf_1, #endif #if (NX_SECURE_TLS_TLS_1_2_ENABLED) &crypto_method_sha256_hc, &crypto_method_tls_prf_sha256, #endif #if (NX_SECURE_TLS_TLS_1_3_ENABLED) &crypto_method_hkdf, &crypto_method_hmac, &crypto_method_ecdhe, #endif }; #endif /* NX_CRYPTO_STANDALONE_ENABLE */