Enhance cryptodev and its engine in OpenSSL by CAAM's public key cryptography operations

Showing results for 
Search instead for 
Did you mean: 

Enhance cryptodev and its engine in OpenSSL by CAAM's public key cryptography operations

Enhance cryptodev and its engine in OpenSSL by CAAM's public key cryptography operations

    OpenSSL is popular software library for applications that secure communications over computer networks against eavesdropping or need to identify the party at the other end. It is widely used in internet web servers, serving a majority of all web sites. OpenSSL contains an open-source implementation of the Transport Layer Security (TLS) and Secure Sockets Layer (SSL) protocols, it is a robust, commercial-grade, and full-featured toolkit for the SSL and TLS protocols. OpenSSL is also a general-purpose cryptography library. Its core library, written in the C programming language, implements basic cryptographic functions and provides various utility functions. Wrappers allowing the use of the OpenSSL library in a variety of computer languages are available. More and more embeded systems, like IoT gateway, ePOS, based on i.MX use OpenSSL for their secure communications and cryptographic operations. But it's cryptography library is pure software implementation which need to occupy lots of CPU resouce and the perfermance is very weak than dedicated hardware IP (like CAAM). 

  CAAM is the i.MX's cryptographic acceleration and assurance module, which serves as NXP's latest cryptographic acceleration and offloading hardware. It combines functions previously implemented in separate modules to create a modular and scalable acceleration and assurance engine. It also implements block encryption algorithms, stream cipher algorithms, hashing algorithms, public key algorithms (i.MX6UL/i.MX7D/S), and a hardware random number generator.

  The official Yocto release (L4.1.15_2.0.0-ga) of the i.MX only enable cryptodev for accelerating symmetric algorithms and hashing algorithms, not support asymmetric algorithms(RSA, ECC). And its engine in OpenSSL(version 1.0.2h) also miss some features which is used to support symmetric algorithms and hashing algorithms, for example, AES ECB, SHA224/256, etc. These patches in the post will close the above gaps for i.MX Linux system. The software environments as the belows:

Linux kernel: imx_4.1.15_2.0.0_ga

cryptodev: 1.8

OpenSSL: 1.0.2h

The patches include the following key features:

1, Add public key cryptography part in CAAM driver, through protocol commands, to implement a number of public (and private) key functions. These are DSA and ECDSA sign/verify, Diffie-Hellman (DH) and ECDH key agreement, ECC key generation, DLC key generation, RSA encryption/decryption, RSA key-generation finalization.

2, Add big number operation and elliptic curve math in CAAM driver to implement addition, subtraction, multiplication, exponentiation, reduction, inversion, greatest common divisor, prime testing and point add, point double, point multiply.

3, Add API in cryptodev to support RSA encryption/decryption, DSA/ECDSA sign/verify, DH/ECDH key agreement, ECC & DLC & RSA key generation and big number operation and elliptic curve math.

4, Add public key cryptography functions, hardware rng, and missing hash symmetric algorithms in OpenSSL crytodev engine.


1, RSA key generation in CAAM only support up to 1024 bit key, so I add software solution (only use CAAM to accelerate big number operation and prime testing) for RSA keygen in crytodev engine instead of CAAM.

2, You can refer to ecdhtest.c, ecdsatest.c, dhtest.c, dsatest.c, rsa_test.c for how to use crytodev engine in your applications based on libcryto.so. You can also find their executable programs in folder openssl-1.0.2h/test after compiling.

3, If you want to call crytodev API directly to accelerate public key cryptography operations, please refer to asymmetric_cipher.c in cryptodev-linux-1.8/tests.

Current Limitation:

1, CAAM driver don't support AES GCM/CCM but hardware supporting. I plan to add the feature next version.

2, ECDSA sign/verify will fail on some binary curves (sect163r1, sect163r2, sect193r1, sect193r2, sect233r1, sect283r1, sect409r1, sect571r1 and X9.62 binary curves). I will try to find the root cause and fix it.


for  some binary curves (sect163r1, sect163r2, sect193r1, sect193r2, sect233r1, sect283r1, sect409r1, sect571r1 and X9.62 binary curves)  are rarely used, so i will try to find the root cause when i'm free. 


Has any of these patches already been integrated in the latest Linux 4.9.88_2.0.0 Yocto Release for i.MX6UL?

Hi Adrian,

I complete to port these patches to L4.9.88_2.0.0. But L4.9.88_2.0.0 don't support i.MX8X/8QM, also not i.MX8M GA release. So I plan to upload updated patched after integrating them into L4.14.62 which is GA release for i.MX8X/8QM/8M Mini/8MQ and legacy i.MX.

Complete to port these patches to L4.14.78 GA. The new software environments as the belows:

Linux kernel: imx_4.14.78_1.0.0_ga

cryptodev: 1.9

OpenSSL: 1.0.2p

HW platform: i.MX6UL, i.MX7D/S, i.MX8M/MM, i.MX8QM/QXP.

The patches include the following new features:

1, support  RSA key generation but defaultly use openssl build-in function (BN_generate_prime_ex) to create prime p, q for higher security. If need to use CAAM accelerating,  please comment Macro USE_BUILTIN_PRIME_GENERATION, but don't confirm its security.

2, Add Manufacturing-protection feature, and you can refer to manufacturing_protection_test function in asymmetric_cipher.c.

3, Support AES GCM in cryptodev.

4, run "git apply 0001-Enhance-cryptodev-and-its-engine-in-OpenSSL-by-CAAM-.patch" under folder sources/poky, and "git apply 0001-Add-public-key-cryptography-operations-in-CAAM-drive.patch, git apply 0002-Fix-the-hash-issue-in-caamhash.c-due-to-aligned-outp.patch" under folder sources/meta-fsl-bsp-release for patch these codes.

Note: HMAC feature has the issue on i.MX8M/MM, i.MX8QM/QXP. I already raise the issue to SW guy to fix it.

Version history
Revision #:
1 of 1
Last update:
‎09-13-2017 11:22 PM
Updated by: