OpenSSL Provider with SE052F for RNG

sam123 — Thu, 14 May 2026 10:42:53 GMT

We have a requirement to use the SE052F as a FIPS compliant source for random number generation. We require OpenSSL to use the SE052F, and in turn, all applications that use the openssl libraries to use the SE052F for RNG.

I understand we must use the NXP MW accessManager and the OpenSSL Provider.
I am using: SE-PLUG-TRUST-MW_04.07.01
I have followed the instructions in:
AN14028.pdf
SE-PLUG-TRUST-MW_04.07.01/simw-top/doc/hostlib/hostLib/accessManager/doc/accessManager.html
and the README info here (but not using this repo): https://github.com/NXPPlugNTrust/se05x-openssl-provider

accessManager built with the following cmake options:

NXP_SE_MW_CONF_OPTS += -DWithSharedLIB=OFF -DPTMW_Host=Raspbian -DPTMW_SMCOM=T1oI2C -DPTMW_Applet=SE05X_C \ -DPTMW_FIPS=None -DPTMW_SE05X_Ver=07_02 -DPTMW_SE05X_Auth=PlatfSCP03 -DPTMW_SCP=SCP03_SSS -DSE05X_EN_PIN=582 -DSE_RESET_LOGIC=0 \ -DPAHO_BUILD_SHARED=FALSE -DPAHO_BUILD_STATIC=TRUE

OpenSSL Provider built with the following cmake options:

NXP_SE_MW2_CONF_OPTS += -DWithSharedLIB=ON -DPTMW_HostCrypto=OPENSSL -DPTMW_Host=Raspbian -DPTMW_SMCOM=JRCP_V1_AM -DPTMW_SE05X_Auth=None

openssl.cnf modified as follows:

[provider_sect] nxp_prov = nxp_sect default = default_sect [nxp_sect] identity = nxp_prov module = /usr/lib/libsssProvider.so activate = 1 [default_sect] activate = 1

The accessManager starts:

Starting accessManager (Rev.1.1). Protect Link between accessManager and SE: YES. accessManager JRCPv1 (T1oI2C SE side) ****************************************************************************** Server: waiting for connections on port 8040. Server: only localhost based processes can connect.

RNG using openssl from the command line seems to work OK:

# openssl rand -hex 64 sssprov-dbg: Enter - OSSL_provider_init App :INFO :Using PortName='127.0.0.1:8040' (gszSocketPortDefault) App :INFO :If you want to over-ride the selection, use ENV=EX_SSS_BOOT_SSS_PORT or pass in command line arguments. New client connection from 127.0.0.1. Client ID: 5 Command 0x00 from client 5 DUMMY_ATR=0x01.A0.00.00.03.96.04.03.E8.00.FE.02.0B.03.E8.00.01.00.00.00.00.64.13.88.0A.00.65.53.45.30.35.31.00.00.00. Replacing *_ATR by default (pre-cooked) ATR. ATR=0x3B.FB.18.00.00.81.31.FE.45.50.4C.41.43.45.48.4F.4C.44.45.52.AB. Command 0x01 from client 5 SM_EstablishPlatformSCP03Am (Entry) App :WARN :Using SCP03 keys from:'/tmp/SE05X/plain_scp.txt' (FILE=/tmp/SE05X/plain_scp.txt) SE051 connected. SM_EstablishPlatformSCP03Am (Exit); Status = 0x9000 sss :INFO :Newer version of Applet Found sss :INFO :Compiled for 0x70200. Got newer 0x70216 sss :WARN :Communication channel is Plain. sss :WARN :!!!Not recommended for production use.!!! sssprov-dbg: Enter - sss_rand_newctx sssprov-dbg: Enter - sss_rand_instantiate sssprov-dbg: Enter - sss_rand_enable_locking sssprov-dbg: Enter - sss_rand_newctx sssprov-dbg: Enter - sss_rand_instantiate sssprov-dbg: Enter - sss_rand_get_ctx_params sssprov-dbg: Enter - sss_rand_generate sssprov-flw: Get random data from SE05x Command 0x01 from client 5 SM_SendAPDUAm: smStatus = 0x9000 5f0f4d63e4ec771b8cfd46dd50c497b7e4e56e203ad5bc6eca9f8c28d23f39aa2d4a807915e3c60cf2e6a833794cb1208554f3e635811354eadd7b2c911c60da sssprov-dbg: Enter - sss_rand_freectx sssprov-dbg: Enter - sss_rand_freectx sssprov-dbg: Enter - sss_teardown Received 0 byte from client 5 (Message Header Phase) .

But, starting the ssh daemon fails:

# /usr/sbin/sshd & sssprov-dbg: Enter - OSSL_provider_init App :INFO :Using PortName='127.0.0.1:8040' (gszSocketPortDefault) App :INFO :If you want to over-ride the selection, use ENV=EX_SSS_BOOT_SSS_PORT or pass in command line arguments. New client connection from 127.0.0.1. Client ID: 5 Command 0x00 from client 5 ATR=0x3B.FB.18.00.00.81.31.FE.45.50.4C.41.43.45.48.4F.4C.44.45.52.AB. Command 0x01 from client 5 Pre-cooked response (rspAppletSelect) sss :INFO :Newer version of Applet Found sss :INFO :Compiled for 0x70200. Got newer 0x70216 sss :WARN :Communication channel is Plain. sss :WARN :!!!Not recommended for production use.!!! sssprov-dbg: Enter - sss_rand_newctx sssprov-dbg: Enter - sss_rand_instantiate sssprov-dbg: Enter - sss_rand_enable_locking sssprov-dbg: Enter - sss_rand_get_ctx_params PRNG is not seeded Received 0 byte from client 5 (Message Header Phase) . [2]+ Done(255) /usr/sbin/sshd

I'd be very grateful for any help,

Sam

topic OpenSSL Provider with SE052F for RNG in Secure Authentication

OpenSSL Provider with SE052F for RNG