Guidance Required for Crypto Library and HSE Integration on S32K344 (FRDM-A-S32K344)

[FE]

Hi Team,

We are working on the FRDM‑A‑S32K344 board using the NXP S32K344 MCU.

We need guidance regarding cryptographic software integration with and without HSE support.

Our questions are:

1. If we do NOT want to use HSE (Hardware Security Engine):

   • Which crypto software library is recommended for S32K344?

   • Can we use:

     • CSEc software library?

     • mbedTLS?

     • wolfSSL?

     • AUTOSAR Crypto Stack?

     • RTD Crypto drivers?

   • Which solution is officially supported/recommended by NXP for production automotive applications?

   • Are there any example projects available for AES, SHA, RNG, ECC, or Secure Boot without HSE?

2. If we WANT to use HSE:

   • What are the required software components and configurations?

   • Which RTD version and S32 Design Studio version are recommended?

   • What configuration is needed in:

     • HSE Firmware

     • SYS_IMG

     • IVT

     • Boot configuration

     • Linker settings

   • How do we correctly flash the HSE firmware binary on FRDM-A-S32K344?

   • Which tools are recommended for HSE firmware installation?

     • S32DS

     • Lauterbach

     • PEMicro

     • UDS bootloader

   • Is there any step-by-step application note or example project available for:

     • HSE firmware flashing

     • Key management

     • Secure boot

     • Crypto service usage

3. Additional Questions:

   • Can HSE coexist with standard software crypto libraries?

   • What are the memory and flash impacts of enabling HSE?

   • Are there any limitations on FRDM-A-S32K344 compared to custom hardware?

Any guidance, reference projects, application notes, or recommended documents would be very helpful.

[lukaszadrapa]

Hi @FE 

See please my embedded answers below:

Our questions are:

1. If we do NOT want to use HSE (Hardware Security Engine):

   • Which crypto software library is recommended for S32K344?

     We do not have recommendation for this, it depends on your requirements.

   • Can we use:

     • CSEc software library?
       I’m not sure what exactly you mean by “CSEc software library” but CSEc is security module on S32K1 devices which is not directly compatible with HSE (even if HSE supports SHE commands).

     • mbedTLS?

     • wolfSSL?
       mbedTLS and wolfSSL – yes, these can be used, it’s just SW implementation.

     • AUTOSAR Crypto Stack?

     • RTD Crypto drivers?

       Autosar Crypto Stack / RTD Crypto drivers – we provide only Autosar Crypto driver which is included in RTD. This Crypto driver uses HSE features. We do not provide pure SW implementation of Crypto driver.

   • Which solution is officially supported/recommended by NXP for production automotive applications?
     We do not have recommendation for this, it depends on your requirements.

   • Are there any example projects available for AES, SHA, RNG, ECC, or Secure Boot without HSE?

     You can find “Automotive SW - S32K3 - mbedTLS” in S32K3 Reference Software package:

     https://www.nxp.com/webapp/swlicensing/sso/downloadSoftware.sp?catid=SW32K3-REFSW-D

     This shows how to use mbedTLS API while cryptographic operations are being performed by HSE module.

     We do not have other examples without HSE. There’s no reason for that because all S32K3 devices have HSE and I can’t see a reason to not use it.
     
     

2. If we WANT to use HSE:

   • What are the required software components and configurations?
     It's necessary to install HSE firmware and (if we are talking about automotive application) it's usually Autosar Crypto driver from NXP RTD and full Autosar stack from our partners like Vector or Elektrobit. 

   • Which RTD version and S32 Design Studio version are recommended?
     We recommend to use the latest RTD. Release notes file of each RTD specifies which S32 Design Studio was used for development and testing - and that's recommended version. But notice that S32DS can't be used to configure full Autosar stack - in this case, use EB Tresos or DaVinci from Vector. 

   • What configuration is needed in:

     • HSE Firmware

     • SYS_IMG

     • IVT

     • Boot configuration

     • Linker settings
       This is very complex configuration. This can't be explained in a few sentences. 

   • How do we correctly flash the HSE firmware binary on FRDM-A-S32K344?

     See this post where I described where to download and how to install HSE firmware:

     https://community.nxp.com/t5/S32K/S32K3XX-HSE-INSTALL/m-p/2337764/highlight/true#M57460

   • Which tools are recommended for HSE firmware installation?

     • S32DS

     • Lauterbach

     • PEMicro

     • UDS bootloader
       You can use any tools which can program the flash memory. See the post mentioned above. 

   • Is there any step-by-step application note or example project available for:

     • HSE firmware flashing
       Mentioned above.

     • Key management
       I recommend to read "6.1 Cryptographic keys" and "6.2 Key management" in HSE-B Firmware reference manual rev. 2.7 which can be downloaded from Documentation ->  Secure files: https://www.nxp.com/products/S32K3

     • Secure boot

       We provide Secure Boot application note including demo projects. It can be downloaded from:

       https://www.nxp.com/products/S32K3

       Application note can be found here:

       Documentation -> Secure Files -> Secure Boot Application note v0.1.1.0 (AN744511)

       Associated demo project can be downloaded here:

       Design Resources -> Software -> Secure Files -> SecureBootAppNoteDemo (SW745310)

       Other examples for secure boot can be found in HSE Demo Examples:

       https://www.nxp.com/webapp/Download?colCode=S32K3_HSE_DemoExamples

       There are examples for all three modes – advanced secure boot, basic secure boot and SHE secure boot. Advanced secure boot is recommended.

       See Readme.md file which is included in all projects.

     • Crypto service usage
       See mentioned HSE Demo Examples and examples which are included in RTD Crypto driver. 

3. Additional Questions:

   • Can HSE coexist with standard software crypto libraries?
     Yes.

   • What are the memory and flash impacts of enabling HSE?

     Take a look at following tables in S32K3 reference manual rev. 12:

     https://www.nxp.com/webapp/Download?colCode=S32K3XXRM

     Table 196. Configuration details when the HSE firmware usage feature flag is disabled

     Table 198. Configuration details when the HSE_B firmware usage feature flag is enabled

     Table 199. AB swap configuration

   • Are there any limitations on FRDM-A-S32K344 compared to custom hardware?
     If we are talking about HSE - no, the board does not affect HSE features.