topic Re: Enabling cryptographic on A core in S32G

Enabling cryptographic on A core

ashwini2024 — Wed, 04 Sep 2024 09:21:18 GMT

how to integrate and use HSE service APIs in A-core.

Re: Enabling cryptographic on A core

Celeste_Liu — Fri, 06 Sep 2024 02:57:48 GMT

Dear @ashwini2024 ,
Thank you for your question. To better assist you, could you please provide more detailed information? Specifically, which product in the S32G series are you using? Also, if you are planning to use the HSE service on the A-core, what is the version of the Linux BSP you are using?
I recommend referring to the "HSE Security Support" chapter in the Linux BSP xx User Manual for S32Gx platforms document. Additionally, pay attention to the version compatibility when referring to the HSE Service API Reference Manual.
Best regards,
Celeste

Re: Enabling cryptographic on A core

ashwini2024 — Mon, 09 Sep 2024 04:08:23 GMT

BSP 41. Could you tell me whether there is a need to create kernel module and insert them.

Re: Enabling cryptographic on A core

Celeste_Liu — Mon, 09 Sep 2024 09:32:58 GMT

Dear @ashwini2024

No, there is no need to create kernel modules and insert them. In the case of HSE, there are no kernel modules. It is directly compiled into the image.
The cryptographic support code is located under /arch/arm64/crypto/. You can look at Kconfig and Makefile in that directory to see what options to enable to build the necessary modules.
Best regards,

Celeste

Re: Enabling cryptographic on A core

ashwini2024 — Tue, 10 Sep 2024 11:56:45 GMT

how can i integrate OpenSSL with the crypto driver to perform hashing.How can i enable the using the below image :
How can i perform this :

1.Analyze how to integrate and use HSE service APIs in A-core

2.Analyze the configurations and/or implementation changes for HASH computation and verification on sample data using HSE.

3.Test the changes done for HASH computation and verification(optional).

Re: Enabling cryptographic on A core

ashwini2024 — Wed, 11 Sep 2024 12:38:12 GMT

How can i integrate the OpenSSL with the AF_ALG ? Could u please give me some insight on that

Re: Enabling cryptographic on A core

Celeste_Liu — Thu, 12 Sep 2024 07:43:23 GMT

Dear @ashwini2024 ,

I apologize for the delayed response.

I understand that you are aiming to integrate OpenSSL with the crypto driver to perform hashing. The good news is that bsp41 already supports this functionality, so manual integration is not necessary. However, prebuilt images do not come with HSE firmware.

To compile an image with HSE support using yocto, refer to the "S32G2/3_LinuxBSP_41.0_User_Manual.pdf". For G2, follow these steps:

Open the terminal.
Navigate to ~/BSP41/fsl-auto-yocto-bsp/build_s32g274ardb2 by typing:
- cd ~/BSP41/fsl-auto-yocto-bsp/build_s32g274ardb2
Edit the conf/local.conf file by typing:
- vi conf/local.conf
Add DISTRO_FEATURES:append = "hse" and set NXP_FIRMWARE_LOCAL_DIR = "/path/to/firmware/folder".
Place the entire HSE_FW_S32G2XX_0_2_51_0 in the specified folder.
Compile to generate a *.sdcard. The boot-up print is as shown below.

Regarding how to use HSE to analyze sample data for HASH computation, you can use the OpenSSL PKCS11 engine to access the HSE based on NXP Linux BSP software. Here is a demo example:

Modify the OpenSSL configuration file for the PKCS11 engine.
- Back up the /etc/ssl/openssl.cnf file by typing:
  - cp /etc/ssl/openssl.cnf /etc/ssl/openssl.cnf.default
- Edit the file by typing:
  - vi /etc/ssl/openssl.cnf
- In the [openssl_init] section, append the line engines = engine_section.
- At the end of the file, add the following lines:
  - [engine_section]
  - pkcs11 = pkcs11_section
  - [pkcs11_section]
  - engine_id = pkcs11
  - dynamic_path = /usr/lib/engines-3/pkcs11.so
  - MODULE_PATH = /usr/lib/libpkcs-hse.so.1
  - init=0
Test the PKCS11 engine. If everything is set up correctly, you should observe a similar log as provided.
To use a hash algorithm:
- Generate a plain text file for testing by typing:
  - cd ~/workspace
  - echo "1111" > plain.txt
- Calculate the hash value by typing and You can see the following log::
  - openssl dgst -engine pkcs11 -keyform engine -sha512 plain.txt

This is only an example of S32GRDB2 + HSE + SHA512. If you want to know more about accessing the HSE via the PKCS11, refer to AN14072. Note that it is based on bsp38.
If this post answers your question, please click the "Mark Correct" button. Thank you!

Best regards,

Celeste

Re: Enabling cryptographic on A core

ashwini2024 — Thu, 12 Sep 2024 11:29:01 GMT

i want to integrate the af_alg engine with thekernel crypto apis. Could u please tell me what are the kernel crypto apis and what is the entire flow as per diagram shown.
Thank you

Re: Enabling cryptographic on A core

Celeste_Liu — Fri, 13 Sep 2024 03:59:31 GMT

Hello @ashwini2024 ,

This question is rather broad, so we may not be able to answer it directly. We apologize for the inconvenience. Could you please refine your specific needs? For example, which specific algorithm or function do you require?

Best Regards,

Celeste

Re: Enabling cryptographic on A core

ashwini2024 — Mon, 16 Sep 2024 08:09:52 GMT

In the yocto package there is algif_hash.c which contains the apis now i have to integrate it with a user space application how can i do it to perform hashing

Re: Enabling cryptographic on A core

Celeste_Liu — Thu, 19 Sep 2024 01:52:16 GMT

Hi @ashwini2024 ,

Sorry for the late reply. The past few days were holidays. Regarding the content you mentioned above, I believe I have already provided very detailed steps in my previous answer. Do you still have any problems in operation? Additionally, I noticed that you have created a new thread in the community: HSE integration - NXP Community. My colleague is also assisting you. For the convenience of thread management, may I close this thread?

Best Regards,

Celeste

Re: Enabling cryptographic on A core

ashwini2024 — Thu, 17 Oct 2024 04:58:42 GMT

I have shifted to bsp 40
Could you please let me know how could i perform hashing and any other cryptographic operations ?
Should i still follow the steps you mentioned i have enabled the hse firmware and also the hse device. THe output is as below .How do i move further ?