From 2ec08e5a2599aba0554be43942c091d8875fa29a Mon Sep 17 00:00:00 2001
From: Thomas Cook <thomas@wolfssl.com>
Date: Tue, 31 Mar 2026 16:45:19 -0400
Subject: [PATCH] Add support for rsa public crypt operations

---
 wolfcrypt/src/port/nxp/casper_port.c     | 45 +++++++++++++++++++++---
 wolfcrypt/src/rsa.c                      | 18 ++++++++++
 wolfssl/wolfcrypt/port/nxp/casper_port.h |  9 +++++
 3 files changed, 68 insertions(+), 4 deletions(-)

diff --git a/wolfcrypt/src/port/nxp/casper_port.c b/wolfcrypt/src/port/nxp/casper_port.c
index 9b4a2560ff..dc772766ea 100644
--- a/wolfcrypt/src/port/nxp/casper_port.c
+++ b/wolfcrypt/src/port/nxp/casper_port.c
@@ -19,7 +19,6 @@
  * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1335, USA
  */
 
-
 #ifdef HAVE_CONFIG_H
     #include <config.h>
 #endif
@@ -32,17 +31,55 @@
     #error WOLFSSL_CRYPT_HW_MUTEX=1 not supported yet
 #endif
 
-//#include <wolfssl/wolfcrypt/aes.h>
-#include <wolfssl/wolfcrypt/sha.h>
-#include <wolfssl/wolfcrypt/sha256.h>
 #include <wolfssl/wolfcrypt/error-crypt.h>
+#include <wolfssl/wolfcrypt/port/nxp/casper_port.h>
 #include "fsl_casper.h"
 
 int wc_casper_init(void)
 {
     CASPER_Init(CASPER);
+
     return 0;
 }
 
+#if !defined(NO_RSA) && !defined(WOLFSSL_NXP_CASPER_NO_RSA)
+
+#define CASPER_MAX_BUF_SZ   512
+static uint8_t key_buf[CASPER_MAX_BUF_SZ];
+static uint8_t sig_buf[CASPER_MAX_BUF_SZ];
+static uint8_t out_buf[CASPER_MAX_BUF_SZ];
+
+int casper_rsa_public_exptmod(
+    const byte* in, word32 inLen, byte* out, word32 outLen, RsaKey* key
+)
+{
+    int res;
+    int sig_sz = inLen;
+    int key_sz = mp_unsigned_bin_size(&key->n);
+    word32 exp;
+
+    if (inLen > CASPER_MAX_BUF_SZ || outLen > CASPER_MAX_BUF_SZ)
+        return BAD_FUNC_ARG;
+
+    /* casper requires little endian format for inputs/outputs */
+    XMEMCPY(sig_buf, in, sig_sz);
+    mp_reverse(sig_buf, sig_sz);
+
+    if ((res = mp_to_unsigned_bin(&key->n, key_buf)) != MP_OKAY)
+        return res;
+    mp_reverse(key_buf, key_sz);
+
+    if ((res = mp_to_unsigned_bin(&key->e, (uint8_t *)&exp)) != MP_OKAY)
+        return res;
+
+    CASPER_ModExp(CASPER, (void *)sig_buf, (void *)key_buf,
+            key_sz / sizeof(uint32_t), exp, out_buf);
+
+    mp_reverse(out_buf, sig_sz);
+    XMEMCPY(out, out_buf, sig_sz);
+
+    return 0;
+}
+#endif
 
 #endif /* WOLFSSL_NXP_CASPER */
diff --git a/wolfcrypt/src/rsa.c b/wolfcrypt/src/rsa.c
index 3a32f915b7..8df1031b7b 100644
--- a/wolfcrypt/src/rsa.c
+++ b/wolfcrypt/src/rsa.c
@@ -56,6 +56,9 @@ RSA keys can be used to encrypt, decrypt, sign and verify data.
 #ifdef WOLFSSL_HAVE_SP_RSA
 #include <wolfssl/wolfcrypt/sp.h>
 #endif
+#if defined(WOLFSSL_NXP_CASPER) && !defined(WOLFSSL_NXP_CASPER_NO_RSA)
+#include <wolfssl/wolfcrypt/port/nxp/casper_port.h>
+#endif
 
 #if defined(WOLFSSL_USE_SAVE_VECTOR_REGISTERS) && !defined(WOLFSSL_SP_ASM)
     /* force off unneeded vector register save/restore. */
@@ -2411,6 +2414,21 @@ static int wc_RsaFunctionSync(const byte* in, word32 inLen, byte* out,
 
     return ret;
 }
+
+#elif defined(WOLFSSL_NXP_CASPER) && !defined(WOLFSSL_NXP_CASPER_NO_RSA)
+static int wc_RsaFunctionSync(const byte* in, word32 inLen, byte* out,
+                              word32* outLen, int type, RsaKey* key,
+                              WC_RNG* rng)
+{
+    (void)rng;
+
+    if (type == RSA_PUBLIC_DECRYPT || type == RSA_PUBLIC_ENCRYPT) {
+        return casper_rsa_public_exptmod(in, inLen, out, *outLen, key);
+    }
+
+    return RSA_WRONG_TYPE_E;
+}
+
 #else
 #ifndef WOLF_CRYPTO_CB_ONLY_RSA
 #ifdef WOLFSSL_HAVE_SP_RSA
diff --git a/wolfssl/wolfcrypt/port/nxp/casper_port.h b/wolfssl/wolfcrypt/port/nxp/casper_port.h
index e700b1f26f..a61cd2be4a 100644
--- a/wolfssl/wolfcrypt/port/nxp/casper_port.h
+++ b/wolfssl/wolfcrypt/port/nxp/casper_port.h
@@ -25,4 +25,13 @@
 
 int wc_casper_init(void);
 
+#if !defined(NO_RSA) && !defined(WOLFSSL_NXP_CASPER_NO_RSA)
+
+#include <wolfssl/wolfcrypt/rsa.h>
+
+int casper_rsa_public_exptmod(
+    const byte* in, word32 inLen, byte* out, word32 outLen, RsaKey* key
+);
+#endif
+
 #endif