RSIP-E50D elliptic-curve asymmetric path (ECDSA / ECDH / Ed25519). More...

#include <stdint.h>
#include "ra8_attributes.h"
#include "ra8_check.h"
#include "ra8_err.h"
#include "ra8_log.h"
#include "ra8_rsip.h"
#include "ra8_rsip_asym_internal.h"
#include "ra8_rsip_internal.h"
#include "ra8_rsip_regs.h"

Include dependency graph for ra8_rsip_ecc.c:

Functions
ra8_err_t	ra8_rsip_ecdsa_sign (const ra8_rsip_key_handle_t key, ra8_rsip_curve_t curve, const uint8_t digest, uint32_t digest_len, uint8_t *signature)
	ECDSA sign a digest with a wrapped private key.
ra8_err_t	ra8_rsip_ecdsa_verify (const ra8_rsip_key_handle_t key, ra8_rsip_curve_t curve, const uint8_t digest, uint32_t digest_len, const uint8_t *signature)
	ECDSA verify a signature with a peer public key.
ra8_err_t	ra8_rsip_eddsa_sign (const ra8_rsip_key_handle_t key, const uint8_t msg, uint32_t msg_len, uint8_t *signature)
	Ed25519 PureEdDSA sign a message (RFC 8032).
ra8_err_t	ra8_rsip_eddsa_verify (const ra8_rsip_key_handle_t key, const uint8_t msg, uint32_t msg_len, const uint8_t *signature)
	Ed25519 PureEdDSA verify a signature (RFC 8032).
ra8_err_t	ra8_rsip_ecdh_compute (const ra8_rsip_key_handle_t key, ra8_rsip_curve_t curve, const uint8_t peer_x, const uint8_t peer_y, ra8_rsip_key_handle_t out)
	ECDH shared-secret derivation.

Variables
static const char *	s_tag = "RSIP"
	Logger tag used by every ra8_log_* call in this TU.

Detailed Description

RSIP-E50D elliptic-curve asymmetric path (ECDSA / ECDH / Ed25519).

Tag: [Ring 3 / HAL] {World: S}

Elliptic-curve slice of the RA8D2 RSIP-E50D asymmetric HAL driver, split out of ra8_rsip_asym.c to keep every translation unit under the file-size budget. Exposes:

ECDSA sign / verify over a pre-computed digest;
ECDH key agreement;
Ed25519 PureEdDSA sign / verify (RFC 8032).

Every entry point is FAIL-CLOSED in production: HUM Ch 52 documents no asymmetric command-register map for the RSIP-E50D, so the off-target-only command path is gated behind the stub-crypto guard and a production build returns k_ra8_err_not_supported. The real ECDSA-P256 / ECDH / Ed25519 backend is tf-psa-crypto on the M85, silicon-proven in psa_crypto_hil (issues #214 + #181).

The byte-lane streaming primitives internal_asym_push / internal_asym_pull and the handle-tail zero helper internal_zero_handle_tail are defined in ra8_rsip_asym.c and shared via ra8_rsip_asym_internal.h; the remaining cross-TU primitives (priv_load_handle, priv_complete) are declared in ra8_rsip_internal.h. The RSIP engine exposes no documented asymmetric register interface (HUM Ch 52 is a feature overview, p 3302-3307), so the fake command path here is a modelled fiction, not a real hardware sequence.

Copyright: Copyright (c) 2026 Brighton Sikarskie SPDX-License-Identifier: MIT

Since: 0.1.0

Definition in file ra8_rsip_ecc.c.

Function Documentation

◆ ra8_rsip_ecdh_compute()

ra8_err_t ra8_rsip_ecdh_compute	(	const ra8_rsip_key_handle_t *	key,
		ra8_rsip_curve_t	curve,
		const uint8_t *	peer_x,
		const uint8_t *	peer_y,
		ra8_rsip_key_handle_t *	out )

nodiscard

ECDH shared-secret derivation.

The peer public key is supplied as the uncompressed (X || Y) coordinate pair. The shared secret stays inside the wrapped vault and out receives a wrapped handle suitable for ra8_rsip_kdf.

Parameters

[in]	key	Wrapped ECC private-key handle (own).
[in]	curve	Curve selector.
[in]	peer_x	Peer X coordinate (curve byte length).
[in]	peer_y	Peer Y coordinate (curve byte length).
[out]	out	Wrapped shared-secret handle.

Returns: ra8_err_t error code.

Return values

k_ra8_ok	Shared secret derived.
k_ra8_err_not_supported	Production build fail-closed; no RSIP backend, use tf-psa-crypto.
k_ra8_err_null_ptr	Any pointer was NULL.
k_ra8_err_invalid_arg	Bad curve.
k_ra8_err_hw_timeout	Engine never signalled DONE.
k_ra8_err_hw_error	Peer point off-curve.

Precondition: key->alg is an ECC private install opcode.; peer_x and peer_y are non-NULL.

Postcondition: On success out->alg matches the curve's HMAC opcode.

Note: Thread safety: not thread-safe.; Fail-closed in production (HUM Ch 52 documents no RSIP backend); the fake/stub command path never ships. Real crypto: tf-psa-crypto (issues #214 / #187 / #181).

Since: 0.1.0

Definition at line 392 of file ra8_rsip_ecc.c.

References k_ra8_err_not_supported, RA8_CHECK_NULL_PTR, and s_tag.

◆ ra8_rsip_ecdsa_sign()

ra8_err_t ra8_rsip_ecdsa_sign	(	const ra8_rsip_key_handle_t *	key,
		ra8_rsip_curve_t	curve,
		const uint8_t *	digest,
		uint32_t	digest_len,
		uint8_t *	signature )

nodiscard

ECDSA sign a digest with a wrapped private key.

Parameters

[in]	key	Wrapped ECC private-key handle.
[in]	curve	Curve selector.
[in]	digest	Pre-computed message digest.
[in]	digest_len	Digest length.
[out]	signature	Output (r \|\| s); 64 bytes for P-256, 96 for P-384, 132 for P-521.

Returns: ra8_err_t error code.

Return values

k_ra8_ok	Signature produced.
k_ra8_err_not_supported	Production build fail-closed; no RSIP backend, use tf-psa-crypto.
k_ra8_err_null_ptr	Any pointer was NULL.
k_ra8_err_invalid_arg	Bad curve, or curve is k_ra8_rsip_curve_ed25519 (use ra8_rsip_eddsa_sign – Ed25519 is PureEdDSA, not ECDSA).
k_ra8_err_hw_timeout	Engine never signalled DONE.

Precondition: key->alg is an ECC (Weierstrass-curve) install opcode.; digest and signature are non-NULL.

Postcondition: On success, signature holds (r || s).

Note: Thread safety: not thread-safe.; Fail-closed in production (HUM Ch 52 documents no RSIP backend); the fake/stub command path never ships. Real crypto: tf-psa-crypto (issues #214 / #187 / #181).; Ed25519 is rejected here; route it through ra8_rsip_eddsa_sign.

See also: ra8_rsip_eddsa_sign

Since: 0.1.0

Definition at line 340 of file ra8_rsip_ecc.c.

References k_ra8_err_not_supported, RA8_CHECK_NULL_PTR, and s_tag.

Referenced by ra8_rsip_protected_ecdsa_sign().

◆ ra8_rsip_ecdsa_verify()

ra8_err_t ra8_rsip_ecdsa_verify	(	const ra8_rsip_key_handle_t *	key,
		ra8_rsip_curve_t	curve,
		const uint8_t *	digest,
		uint32_t	digest_len,
		const uint8_t *	signature )

nodiscard

ECDSA verify a signature with a peer public key.

Parameters

[in]	key	Wrapped ECC public-key handle (or the peer's raw uncompressed point staged through ASYM_PUB_X/ASYM_PUB_Y).
[in]	curve	Curve selector.
[in]	digest	Pre-computed digest.
[in]	digest_len	Digest length.
[in]	signature	Signature (r \|\| s).

Returns: ra8_err_t error code.

Return values

k_ra8_ok	Signature valid.
k_ra8_err_not_supported	Production build fail-closed; no RSIP backend, use tf-psa-crypto.
k_ra8_err_null_ptr	Any pointer was NULL.
k_ra8_err_invalid_arg	Bad curve, or curve is k_ra8_rsip_curve_ed25519 (use ra8_rsip_eddsa_verify).
k_ra8_err_hw_timeout	Engine never signalled DONE.
k_ra8_err_hw_error	Signature did not verify.

Precondition: key->alg is an ECC (Weierstrass-curve) install opcode.; digest and signature are non-NULL.

Postcondition: On success, the engine has validated the signature.

Note: Thread safety: not thread-safe.; Fail-closed in production (HUM Ch 52 documents no RSIP backend); the fake/stub command path never ships. Real crypto: tf-psa-crypto (issues #214 / #187 / #181).; Ed25519 is rejected here; route it through ra8_rsip_eddsa_verify.

See also: ra8_rsip_eddsa_verify

Since: 0.1.0

Definition at line 354 of file ra8_rsip_ecc.c.

References k_ra8_err_not_supported, RA8_CHECK_NULL_PTR, and s_tag.

◆ ra8_rsip_eddsa_sign()

ra8_err_t ra8_rsip_eddsa_sign	(	const ra8_rsip_key_handle_t *	key,
		const uint8_t *	msg,
		uint32_t	msg_len,
		uint8_t *	signature )

nodiscard

Ed25519 PureEdDSA sign a message (RFC 8032).

Ed25519 PureEdDSA (RFC 8032) is NOT backed by a documented RSIP register interface on this silicon – HUM Ch 52 "Renesas Secure IP (RSIP-E50D)" is a feature overview, not a command-register map, and the vendor engine is driven through an encrypted firmware mailbox. A production build (neither RA8_INSECURE_STUB_CRYPTO nor RA8_OFF_TARGET) is therefore FAIL-CLOSED: this entry point returns k_ra8_err_not_supported rather than hand back bytes that no RFC 8032 verifier would accept. The real Ed25519 signer is tf-psa-crypto (PSA_ALG_PURE_EDDSA) on the M85. Only the insecure-stub / off-target build drives a placeholder EdDSA command path (host command-path testing only); PureEdDSA signs the raw message, NOT a pre-computed digest, and the 64-byte output is the R || S encoding.

Parameters

[in]	key	Wrapped Ed25519 private-key handle (k_ra8_rsip_oem_cmd_ecc_ed25519_priv).
[in]	msg	Message to sign; may be NULL only if msg_len is 0.
[in]	msg_len	Message length in bytes.
[out]	signature	64-byte output (R \|\| S); never NULL.

Returns: ra8_err_t error code.

Return values

k_ra8_ok	Signature produced (stub / off-target build only).
k_ra8_err_not_supported	Production build – Ed25519 has no RSIP backend; use tf-psa-crypto instead.
k_ra8_err_null_ptr	key / signature was NULL, or msg was NULL with non-zero msg_len.
k_ra8_err_invalid_arg	key->alg is not the Ed25519 opcode.
k_ra8_err_hw_timeout	Engine never signalled DONE.

Precondition: key->alg == k_ra8_rsip_oem_cmd_ecc_ed25519_priv.; signature is at least 64 bytes wide.

Postcondition: On success, signature[0..63] holds (R || S).; No engine key state persists beyond the call.

Note: Thread safety: not thread-safe.; Fail-closed in production; Ed25519 is provided by tf-psa-crypto.

See also: ra8_rsip_eddsa_verify

Since: 0.1.0

Definition at line 368 of file ra8_rsip_ecc.c.

References k_ra8_err_not_supported, RA8_CHECK_NULL_PTR, and s_tag.

◆ ra8_rsip_eddsa_verify()

ra8_err_t ra8_rsip_eddsa_verify	(	const ra8_rsip_key_handle_t *	key,
		const uint8_t *	msg,
		uint32_t	msg_len,
		const uint8_t *	signature )

nodiscard

Ed25519 PureEdDSA verify a signature (RFC 8032).

The verify counterpart to ra8_rsip_eddsa_sign and subject to the same constraint: the RSIP-E50D exposes no documented Ed25519 register interface on this silicon, so a production build (neither RA8_INSECURE_STUB_CRYPTO nor RA8_OFF_TARGET) is FAIL-CLOSED and returns k_ra8_err_not_supported. Ed25519 verification is provided by tf-psa-crypto (PSA_ALG_PURE_EDDSA) on the M85. Only the insecure-stub / off-target build drives a placeholder EdDSA command path: the raw message is presented and the 64-byte signature is the R || S encoding.

Parameters

[in]	key	Wrapped Ed25519 public-key handle (tagged with the Ed25519 opcode).
[in]	msg	Message that was signed; may be NULL only if msg_len is 0.
[in]	msg_len	Message length in bytes.
[in]	signature	64-byte signature (R \|\| S); never NULL.

Returns: ra8_err_t error code.

Return values

k_ra8_ok	Signature valid (stub / off-target build only).
k_ra8_err_not_supported	Production build – Ed25519 has no RSIP backend; use tf-psa-crypto instead.
k_ra8_err_null_ptr	key / signature was NULL, or msg was NULL with non-zero msg_len.
k_ra8_err_invalid_arg	key->alg is not the Ed25519 opcode.
k_ra8_err_hw_timeout	Engine never signalled DONE.
k_ra8_err_hw_error	Signature did not verify.

Precondition: key->alg == k_ra8_rsip_oem_cmd_ecc_ed25519_priv.; signature is at least 64 bytes wide.

Postcondition: On success, the engine has validated the signature.

Note: Thread safety: not thread-safe.; Fail-closed in production; Ed25519 is provided by tf-psa-crypto.

See also: ra8_rsip_eddsa_sign

Since: 0.1.0

Definition at line 380 of file ra8_rsip_ecc.c.

References k_ra8_err_not_supported, RA8_CHECK_NULL_PTR, and s_tag.

Variable Documentation

◆ s_tag

const char* s_tag = "RSIP"

static

Logger tag used by every ra8_log_* call in this TU.

Kept short ("RSIP") so it fits in the fixed-width log prefix without truncation. Each RSIP translation unit keeps its own private copy.

Note: Static, file-scope.

Since: 0.1.0

Definition at line 60 of file ra8_rsip_ecc.c.

Functions

Variables

Detailed Description

Function Documentation

◆ ra8_rsip_ecdh_compute()

◆ ra8_rsip_ecdsa_sign()

◆ ra8_rsip_ecdsa_verify()

◆ ra8_rsip_eddsa_sign()

◆ ra8_rsip_eddsa_verify()

Variable Documentation

◆ s_tag