From 3f76a76c46e6a1c4150fe954c7485d2177ba0dd9 Mon Sep 17 00:00:00 2001
From: Ethan <ethan@wolfssl.com>
Date: Fri, 20 Aug 2021 12:59:41 -0600
Subject: [PATCH 1/8] SE050 port with support for RNG, SHA, AES, ECC
 (sign/verify/shared secret) and ED25519

---
 configure.ac                            |  44 ++
 wolfcrypt/src/aes.c                     |  68 +-
 wolfcrypt/src/ecc.c                     |  41 +-
 wolfcrypt/src/ed25519.c                 |  29 +-
 wolfcrypt/src/port/nxp/se050_port.c     | 927 ++++++++++++++++++++++++
 wolfcrypt/src/random.c                  |  18 +
 wolfcrypt/src/sha.c                     |  39 +
 wolfcrypt/src/sha256.c                  |  63 +-
 wolfcrypt/src/sha512.c                  |  75 ++
 wolfssl/wolfcrypt/aes.h                 |  10 +
 wolfssl/wolfcrypt/ecc.h                 |  11 +
 wolfssl/wolfcrypt/ed25519.h             |   3 +
 wolfssl/wolfcrypt/port/nxp/README.md    |  68 ++
 wolfssl/wolfcrypt/port/nxp/se050_port.h |  98 +++
 wolfssl/wolfcrypt/sha.h                 |   6 +
 wolfssl/wolfcrypt/sha256.h              |   6 +
 wolfssl/wolfcrypt/sha512.h              |   6 +
 17 files changed, 1505 insertions(+), 7 deletions(-)
 create mode 100644 wolfcrypt/src/port/nxp/se050_port.c
 create mode 100644 wolfssl/wolfcrypt/port/nxp/README.md
 create mode 100644 wolfssl/wolfcrypt/port/nxp/se050_port.h

diff --git a/configure.ac b/configure.ac
index 72b1cb500..c1048664d 100644
--- a/configure.ac
+++ b/configure.ac
@@ -1336,6 +1336,50 @@ AC_ARG_WITH([cryptoauthlib],
     ]
 )
 
+# NXP SE050
+#current configure options line: "./configure --with-se050=/home/pi/Downloads/new_simw_top"
+ENABLED_SE050="no"
+trylibse050dir=""
+AC_ARG_WITH([se050],
+    [AS_HELP_STRING([--with-se050=PATH],[PATH to SE050 install (default /usr/local/lib/)])],
+    [
+        AC_MSG_CHECKING([for SE050])
+        CPPFLAGS="$CPPFLAGS -DWOLFSSL_SE050"
+        LIBS="$LIBS -lSSS_APIs"
+
+        AC_LINK_IFELSE([AC_LANG_PROGRAM([[#include <fsl_sss_api.h>]], [[ sss_mac_init(0);]])],[ libse050_linked=yes ],[ libse050_linked=no ])
+
+        if test "x$libse050_linked" = "xno" ; then
+            if test "x$withval" != "xno" ; then
+                trylibse050dir=$withval
+            fi
+            if test "x$withval" = "xyes" ; then
+                trylibse050dir="/usr/local/lib/"
+            fi
+            LDFLAGS="$LDFLAGS -L$trylibse050dir/simw-top_build/raspbian_native_se050_t1oi2c/sss/"
+            CPPFLAGS="$CPPFLAGS  -I$trylibse050dir/simw-top/sss/inc   -I$trylibse050dir/simw-top/sss/port/default \ 
+            -I$trylibse050dir/simw-top/hostlib/hostLib/inc/  -I$trylibse050dir/simw-top/hostlib/hostLib/libCommon/infra "
+
+
+            AC_LINK_IFELSE([AC_LANG_PROGRAM([[#include <fsl_sss_api.h>]], [[ sss_mac_init(0); ]])],[ libse050_linked=yes ],[ libse050_linked=no ])
+
+            if test "x$libse050_linked" = "xno" ; then
+                AC_MSG_ERROR([SE050 isn't found.
+                If it's already installed, specify its path using --with-SE050=/dir/])
+            fi
+            AM_LDFLAGS="$AM_LDFLAGS -L$trylibse050dir/simw-top_build/raspbian_native_se050_t1oi2c/sss/"
+            AM_CFLAGS="$AM_CFLAGS -I$trylibse050dir/simw-top/sss/inc/  \
+            -DWOLFSSL_AES_DIRECT"   
+
+            AC_MSG_RESULT([yes])
+        else
+            AC_MSG_RESULT([yes])
+        fi
+
+        ENABLED_SE050="yes"
+        AM_CFLAGS="$AM_CFLAGS -DWOLFSSL_SE050"
+    ]
+)
 
 # sniffer doesn't work in maxstrength mode
 if test "$ENABLED_SNIFFER" = "yes" && test "$ENABLED_MAXSTRENGTH" = "yes"
diff --git a/wolfcrypt/src/aes.c b/wolfcrypt/src/aes.c
index 16354ee50..8cd2a7b83 100644
--- a/wolfcrypt/src/aes.c
+++ b/wolfcrypt/src/aes.c
@@ -68,7 +68,9 @@ block cipher mechanism that uses n-bit binary string parameter key with 128-bits
 #ifdef WOLFSSL_IMXRT_DCP
     #include <wolfssl/wolfcrypt/port/nxp/dcp_port.h>
 #endif
-
+#ifdef WOLFSSL_SE050
+    #include <wolfssl/wolfcrypt/port/nxp/se050_port.h>
+#endif
 
 /* fips wrapper calls, user can call direct */
 #if defined(HAVE_FIPS) && \
@@ -867,6 +869,27 @@ block cipher mechanism that uses n-bit binary string parameter key with 128-bits
 #elif defined(WOLFSSL_DEVCRYPTO_AES)
     /* implemented in wolfcrypt/src/port/devcrypto/devcrypto_aes.c */
 
+#elif defined(WOLFSSL_SE050)
+    static int AES_ECB_encrypt(Aes* aes, const byte* inBlock, byte* outBlock,
+            int sz)
+    {
+        return se050_aes_crypt(aes, inBlock, outBlock, sz, AES_ENCRYPTION, kAlgorithm_SSS_AES_ECB);
+    }
+    
+    static int AES_ECB_decrypt(Aes* aes, const byte* inBlock, byte* outBlock,
+            int sz)
+    {
+        return se050_aes_crypt(aes, inBlock, outBlock, sz, AES_DECRYPTION, kAlgorithm_SSS_AES_ECB);
+    }
+    static int wc_AesEncrypt(Aes* aes, const byte* inBlock, byte* outBlock)
+    {
+        return AES_ECB_encrypt(aes, inBlock, outBlock, AES_BLOCK_SIZE);
+    }
+    static int wc_AesDecrypt(Aes* aes, const byte* inBlock, byte* outBlock)
+    {
+        return AES_ECB_decrypt(aes, inBlock, outBlock, AES_BLOCK_SIZE);
+    }
+
 #elif defined(WOLFSSL_SCE) && !defined(WOLFSSL_SCE_NO_AES)
     #include "hal_data.h"
 
@@ -2576,6 +2599,32 @@ static void wc_AesDecrypt(Aes* aes, const byte* inBlock, byte* outBlock)
         return wc_AesSetKey(aes, userKey, keylen, iv, dir);
     }
 
+#elif defined(WOLFSSL_SE050)
+    int wc_AesSetKey(Aes* aes, const byte* userKey, word32 keylen, const byte* iv,
+                  int dir)
+    {   
+        int ret = 0;
+        
+    if (aes == NULL ||  !((keylen == 16) || (keylen == 24) || (keylen == 32))) {
+        return BAD_FUNC_ARG;
+    }
+        aes->ctxInitDone = 0;
+    #if defined(WOLFSSL_AES_CFB) || defined(WOLFSSL_AES_COUNTER) || \
+        defined(WOLFSSL_AES_OFB)
+        aes->left = 0;
+    #endif
+        ret = se050_aes_set_key(aes, userKey, keylen, iv, dir);
+        if (ret == 0) {
+            ret = wc_AesSetIV(aes, iv);
+        }
+        return ret;
+    }
+        int wc_AesSetKeyDirect(Aes* aes, const byte* userKey, word32 keylen,
+                        const byte* iv, int dir)
+    {
+        return wc_AesSetKey(aes, userKey, keylen, iv, dir);
+    }
+
 #elif defined(WOLFSSL_NRF51_AES)
     int wc_AesSetKey(Aes* aes, const byte* userKey, word32 keylen,
         const byte* iv, int dir)
@@ -3830,6 +3879,18 @@ int wc_AesSetIV(Aes* aes, const byte* iv)
 #elif defined(WOLFSSL_DEVCRYPTO_CBC)
     /* implemented in wolfcrypt/src/port/devcrypt/devcrypto_aes.c */
 
+#elif defined(WOLFSSL_SE050)
+    int wc_AesCbcEncrypt(Aes* aes, byte* out, const byte* in, word32 sz)
+    {
+        return se050_aes_crypt(aes, in, out, sz, AES_ENCRYPTION,
+         kAlgorithm_SSS_AES_CBC);
+    }
+    int wc_AesCbcDecrypt(Aes* aes, byte* out, const byte* in, word32 sz)
+    {
+        return se050_aes_crypt(aes, in, out, sz, AES_DECRYPTION,
+         kAlgorithm_SSS_AES_CBC);
+    }
+
 #elif defined(WOLFSSL_SILABS_SE_ACCEL)
     /* implemented in wolfcrypt/src/port/silabs/silabs_hash.c */
 
@@ -10331,6 +10392,11 @@ void wc_AesFree(Aes* aes)
         XFREE(aes->streamData, aes->heap, DYNAMIC_TYPE_AES);
     }
 #endif
+
+#if defined(WOLFSSL_SE050)
+    se050_aes_free(aes);
+#endif
+
 }
 
 
diff --git a/wolfcrypt/src/ecc.c b/wolfcrypt/src/ecc.c
index 7c764c83d..cdff3b34f 100644
--- a/wolfcrypt/src/ecc.c
+++ b/wolfcrypt/src/ecc.c
@@ -3943,6 +3943,8 @@ int wc_ecc_shared_secret(ecc_key* private_key, ecc_key* public_key, byte* out,
     err = silabs_ecc_shared_secret(private_key, public_key, out, outlen);
 #elif defined(WOLFSSL_KCAPI_ECC)
    err = KcapiEcc_SharedSecret(private_key, public_key, out, outlen);
+#elif defined(WOLFSSL_SE050)
+    err = se050_ecc_shared_secret(private_key, public_key, out, outlen);
 #else
    err = wc_ecc_shared_secret_ex(private_key, &public_key->pubkey, out, outlen);
 #endif /* WOLFSSL_ATECC508A */
@@ -4698,6 +4700,10 @@ int wc_ecc_make_key_ex2(WC_RNG* rng, int keysize, ecc_key* key, int curve_id,
    else {
       err = NOT_COMPILED_IN;
    }
+#elif defined(WOLFSSL_SE050)
+    key->keyId = se050_allocate_key();
+    err = se050_ecc_create_key(key, key->keyId, keysize);
+    key->type = ECC_PRIVATEKEY;
 #elif defined(WOLFSSL_CRYPTOCELL)
 
     pDomain = CRYS_ECPKI_GetEcDomain(cc310_mapCurve(key->dp->id));
@@ -5098,7 +5104,8 @@ static int wc_ecc_get_curve_order_bit_count(const ecc_set_type* dp)
 
 #if defined(WOLFSSL_ATECC508A) || defined(WOLFSSL_ATECC608A) ||  \
     defined(PLUTON_CRYPTO_ECC) || defined(WOLFSSL_CRYPTOCELL) || \
-    defined(WOLFSSL_SILABS_SE_ACCEL) || defined(WOLFSSL_KCAPI_ECC)
+    defined(WOLFSSL_SILABS_SE_ACCEL) || defined(WOLFSSL_KCAPI_ECC) || \
+    defined(WOLFSSL_SE050)
 static int wc_ecc_sign_hash_hw(const byte* in, word32 inlen,
     mp_int* r, mp_int* s, byte* out, word32 *outlen, WC_RNG* rng,
     ecc_key* key)
@@ -5183,6 +5190,12 @@ static int wc_ecc_sign_hash_hw(const byte* in, word32 inlen,
     #elif defined(WOLFSSL_KCAPI_ECC)
         err = KcapiEcc_Sign(key, in, inlen, out, outlen);
         (void)rng;
+    #elif defined (WOLFSSL_SE050)
+        err = se050_ecc_sign_hash_ex(in, inlen, out, outlen, key);
+        if (err == 0) 
+            err = DecodeECC_DSA_Sig(out, *outlen, r, s);
+
+        return err;
     #endif
 
         /* Load R and S */
@@ -5357,7 +5370,8 @@ int wc_ecc_sign_hash(const byte* in, word32 inlen, byte* out, word32 *outlen,
 /* hardware crypto */
 #if defined(WOLFSSL_ATECC508A) || defined(WOLFSSL_ATECC608A) || \
     defined(PLUTON_CRYPTO_ECC) || defined(WOLFSSL_CRYPTOCELL) || \
-    defined(WOLFSSL_SILABS_SE_ACCEL) || defined(WOLFSSL_KCAPI_ECC)
+    defined(WOLFSSL_SILABS_SE_ACCEL) || defined(WOLFSSL_KCAPI_ECC) || \
+    defined(WOLFSSL_SE050)
     err = wc_ecc_sign_hash_hw(in, inlen, r, s, out, outlen, rng, key);
 #else
     err = wc_ecc_sign_hash_ex(in, inlen, rng, key, r, s);
@@ -6280,6 +6294,10 @@ int wc_ecc_free(ecc_key* key)
     }
 #endif
 
+#ifdef WOLFSSL_SE050
+        se050_ecc_free_key(key);
+#endif
+
 #if defined(WOLFSSL_ATECC508A) || defined(WOLFSSL_ATECC608A)
     atmel_ecc_free(key->slot);
     key->slot = ATECC_INVALID_SLOT;
@@ -6952,6 +6970,8 @@ int wc_ecc_verify_hash_ex(mp_int *r, mp_int *s, const byte* hash,
    byte sigRS[ECC_MAX_CRYPTO_HW_SIZE * 2];
 #elif defined(WOLFSSL_KCAPI_ECC)
    byte sigRS[MAX_ECC_BYTES*2];
+#elif defined(WOLFSSL_SE050)
+   byte sigRS[ECC_MAX_CRYPTO_HW_SIZE * 2];
 #elif !defined(WOLFSSL_SP_MATH) || defined(FREESCALE_LTC_ECC)
    int          did_init = 0;
    ecc_point    *mG = NULL, *mQ = NULL;
@@ -7095,6 +7115,23 @@ int wc_ecc_verify_hash_ex(mp_int *r, mp_int *s, const byte* hash,
     }
 
    err = KcapiEcc_Verify(key, hash, hashlen, sigRS, key->dp->size * 2);
+#elif defined(WOLFSSL_SE050)
+    /* Used when following a hardware sign operation */
+
+    int rLeadingZero = mp_leading_bit(r);
+    int sLeadingZero = mp_leading_bit(s);
+    int rLen = mp_unsigned_bin_size(r);
+    int sLen = mp_unsigned_bin_size(s);
+
+    word32 signatureLen = rLeadingZero + sLeadingZero + rLen + sLen + SIG_HEADER_SZ; /* see StoreECC_DSA_Sig */
+
+    err = StoreECC_DSA_Sig(sigRS, &signatureLen, r, s);
+    if (err != 0)
+        return err;
+
+    err = se050_ecc_verify_hash_ex(hash, hashlen, sigRS, signatureLen, key, res);
+    if (err != 0)
+       return err;
 #else
   /* checking if private key with no public part */
   if (key->type == ECC_PRIVATEKEY_ONLY) {
diff --git a/wolfcrypt/src/ed25519.c b/wolfcrypt/src/ed25519.c
index b161008e4..f8f726031 100644
--- a/wolfcrypt/src/ed25519.c
+++ b/wolfcrypt/src/ed25519.c
@@ -262,6 +262,12 @@ int wc_ed25519_sign_msg_ex(const byte* in, word32 inLen, byte* out,
                             word32 *outLen, ed25519_key* key, byte type,
                             const byte* context, byte contextLen)
 {
+#ifdef WOLFSSL_SE050
+    (void)context;
+    (void)contextLen;
+    (void)type;
+    int ret = se050_ed25519_sign_msg(in, inLen, out, outLen, key);
+#else
 #ifdef FREESCALE_LTC_ECC
     byte   tempBuf[ED25519_PRV_KEY_SIZE];
     ltc_pkha_ecc_point_t ltcPoint = {0};
@@ -406,7 +412,7 @@ int wc_ed25519_sign_msg_ex(const byte* in, word32 inLen, byte* out,
     sc_reduce(hram);
     sc_muladd(out + (ED25519_SIG_SIZE/2), hram, az, nonce);
 #endif
-
+#endif /* WOLFSSL_SE050 */
     return ret;
 }
 
@@ -492,7 +498,7 @@ int wc_ed25519ph_sign_msg(const byte* in, word32 inLen, byte* out,
 #endif /* HAVE_ED25519_SIGN */
 
 #ifdef HAVE_ED25519_VERIFY
-
+#ifndef WOLFSSL_SE050
 /*
    sig        is array of bytes containing the signature
    sigLen     is the length of sig byte array
@@ -633,6 +639,7 @@ static int ed25519_verify_msg_final_with_sha(const byte* sig, word32 sigLen,
 
     return ret;
 }
+#endif /* WOLFSSL_SE050 */
 
 #ifdef WOLFSSL_ED25519_STREAMING_VERIFY
 
@@ -670,6 +677,14 @@ int wc_ed25519_verify_msg_ex(const byte* sig, word32 sigLen, const byte* msg,
                               byte type, const byte* context, byte contextLen)
 {
     int ret;
+#ifdef WOLFSSL_SE050
+    (void)type;
+    (void)context;
+    (void)contextLen;
+    if (ed25519Ctx != NULL)
+        (void)ed25519Ctx;
+    ret = se050_ed25519_verify_msg(sig, sigLen, msg, msgLen, key, res);
+#else
 #ifdef WOLFSSL_ED25519_PERSISTENT_SHA
     wc_Sha512 *sha;
 #else
@@ -709,7 +724,7 @@ int wc_ed25519_verify_msg_ex(const byte* sig, word32 sigLen, const byte* msg,
 #ifndef WOLFSSL_ED25519_PERSISTENT_SHA
     ed25519_hash_free(key, sha);
 #endif
-
+#endif /* WOLFSSL_SE050 */
     return ret;
 }
 
@@ -813,6 +828,10 @@ int wc_ed25519_init_ex(ed25519_key* key, void* heap, int devId)
     fe_init();
 #endif
 
+#ifdef WOLFSSL_SE050
+    se050_ed25519_create_key(key);
+#endif
+
 #ifdef WOLFSSL_ED25519_PERSISTENT_SHA
     return ed25519_hash_init(key, &key->sha);
 #else /* !WOLFSSL_ED25519_PERSISTENT_SHA */
@@ -835,6 +854,10 @@ void wc_ed25519_free(ed25519_key* key)
     ed25519_hash_free(key, &key->sha);
 #endif
 
+#ifdef WOLFSSL_SE050
+    se050_ed25519_free_key(key);
+#endif
+
     ForceZero(key, sizeof(ed25519_key));
 }
 
diff --git a/wolfcrypt/src/port/nxp/se050_port.c b/wolfcrypt/src/port/nxp/se050_port.c
new file mode 100644
index 000000000..4384f3994
--- /dev/null
+++ b/wolfcrypt/src/port/nxp/se050_port.c
@@ -0,0 +1,927 @@
+/* se050_port.c
+ *
+ * Copyright (C) 2006-2021 wolfSSL Inc.
+ *
+ * This file is part of wolfSSL.
+ *
+ * wolfSSL is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License as published by
+ * the Free Software Foundation; either version 2 of the License, or
+ * (at your option) any later version.
+ *
+ * wolfSSL is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License
+ * along with this program; if not, write to the Free Software
+ * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1335, USA
+ */
+
+#ifdef HAVE_CONFIG_H
+    #include <config.h>
+#endif
+
+#include <stdint.h>
+
+#include <wolfssl/wolfcrypt/settings.h>
+#include <wolfssl/wolfcrypt/types.h>
+#include <wolfssl/wolfcrypt/wc_port.h>
+#include <wolfssl/wolfcrypt/aes.h>
+#include <wolfssl/wolfcrypt/error-crypt.h>
+#include <wolfssl/wolfcrypt/ed25519.h>
+
+
+#if defined(WOLFSSL_SE050)
+
+#include <wolfssl/wolfcrypt/port/nxp/se050_port.h>
+#include "fsl_sss_api.h"
+#include "fsl_sss_se05x_types.h"
+
+
+/* Global variables */
+static sss_session_t *cfg_se050_i2c_pi;
+static sss_key_store_t *hostKeyStore;
+static sss_key_store_t *keyStore;
+int keyId_allocater = 100;
+
+int wolfcrypt_se050_SetConfig(sss_session_t *pSession, sss_key_store_t *pHostKeyStore, sss_key_store_t *pKeyStore) 
+{
+	printf("Setting SE050 session configuration\n");
+	
+	XMEMSET(&cfg_se050_i2c_pi, 0, sizeof(cfg_se050_i2c_pi));
+	cfg_se050_i2c_pi = pSession;
+	
+    XMEMSET(&hostKeyStore, 0, sizeof(hostKeyStore));
+	hostKeyStore = pHostKeyStore;
+	
+    XMEMSET(&keyStore, 0, sizeof(keyStore));
+	keyStore = pKeyStore;
+    
+	return 0;
+}
+
+int se050_allocate_key()
+{
+    return keyId_allocater++;
+}
+
+#ifndef WC_NO_RNG
+int se050_get_random_number(uint32_t count, uint8_t* rand_out)
+{
+    sss_status_t status;
+	sss_rng_context_t rng;
+	int ret = 0;
+
+    if (wolfSSL_CryptHwMutexLock() == 0) {
+        status = sss_rng_context_init(&rng, cfg_se050_i2c_pi);
+
+        if (status == kStatus_SSS_Success)
+            status = sss_rng_get_random(&rng, rand_out, count);
+
+        if (status == kStatus_SSS_Success)
+            status = sss_rng_context_free(&rng);
+
+        if (status != kStatus_SSS_Success) {
+            ret = RNG_FAILURE_E;
+        }
+    }
+    wolfSSL_CryptHwMutexUnLock();
+
+    return ret;
+}
+#endif /* WC_NO_RNG */
+
+/* Used for sha/sha224/sha384/sha512 */
+int se050_hash_init(SE050_HASH_Context* se050Ctx, void* heap)
+{
+    se050Ctx->heap = heap;
+    se050Ctx->len  = 0;
+    se050Ctx->used = 0;
+    se050Ctx->msg  = NULL;
+    return 0;
+}
+
+int se050_hash_update(SE050_HASH_Context* se050Ctx, const byte* data, word32 len)
+{
+    if (se050Ctx == NULL || (len > 0 && data == NULL)) {
+        return BAD_FUNC_ARG;
+    }
+    
+    if (se050Ctx->len < se050Ctx->used + len) {
+        if (se050Ctx->msg == NULL) {
+            se050Ctx->msg = (byte*)XMALLOC(se050Ctx->used + len, se050Ctx->heap,
+                    DYNAMIC_TYPE_TMP_BUFFER);
+                    if (se050Ctx->msg == NULL) {
+                        return MEMORY_E;
+                    }
+        } 
+        else {
+            byte* pt = (byte*)XREALLOC(se050Ctx->msg, se050Ctx->used + len, se050Ctx->heap,
+                    DYNAMIC_TYPE_TMP_BUFFER);
+            if (pt == NULL) {
+                return MEMORY_E;
+            }
+            se050Ctx->msg = pt;
+        }
+        se050Ctx->len = se050Ctx->used + len;
+    }
+    XMEMCPY(se050Ctx->msg + se050Ctx->used, data , len);
+    se050Ctx->used += len;
+    return 0;
+}
+
+int se050_hash_final(SE050_HASH_Context* se050Ctx, byte* hash, size_t digestLen, sss_algorithm_t algo)
+{
+    sss_status_t status;
+    sss_digest_t digest_ctx;
+   // XMEMSET(&digest_ctx, 0, sizeof(digest_ctx));
+    
+    const byte*     data = se050Ctx->msg;
+    int             size = (se050Ctx->len) / SSS_BLOCK_SIZE;
+    int             leftover = (se050Ctx->len) % SSS_BLOCK_SIZE;
+    const byte*     blocks;
+                    blocks = data;    
+
+
+    if (wolfSSL_CryptHwMutexLock() == 0) { 
+        status = sss_digest_context_init(&digest_ctx, cfg_se050_i2c_pi, algo, kMode_SSS_Digest);  
+        if(status != kStatus_SSS_Success){
+            printf("error 1\n");
+            return -1;
+        }
+
+        status = sss_digest_init(&digest_ctx);
+        if(status != kStatus_SSS_Success){
+            printf("error 2 - hash_final...\n");
+            return -1;
+        }
+        /* used to send chunks of size 512 */
+        while (size--) {
+            status = sss_digest_update(&digest_ctx, blocks, SSS_BLOCK_SIZE);
+            if(status != kStatus_SSS_Success){
+                printf("error 3\n");
+                return -1;
+            }
+            blocks += SSS_BLOCK_SIZE;       
+        }
+        if (leftover) {
+            status = sss_digest_update(&digest_ctx, blocks, leftover);
+            if(status != kStatus_SSS_Success){
+                printf("error 3\n");
+                return -1;
+            }
+        }        
+
+        status = sss_digest_finish(&digest_ctx, hash, &digestLen);
+        if(status != kStatus_SSS_Success){
+            printf("error 4\n");
+            return -1;
+        }
+        sss_digest_context_free(&digest_ctx);
+
+    }
+
+    wolfSSL_CryptHwMutexUnLock();
+
+    return 0;
+}
+
+void se050_hash_free(SE050_HASH_Context* se050Ctx)
+{
+    (void)se050Ctx;
+}
+
+#ifndef NO_AES
+int se050_aes_set_key(Aes* aes, const byte* key, word32 len,
+                                        const byte* iv, int dir)
+{
+    printf("\n\nrunning se050_set_key\n");
+    (void)dir;
+    (void)iv;
+    sss_status_t status;
+    aes->rounds = len/4 + 6;
+    sss_object_t newKey;
+    sss_key_store_t host_keystore;
+    uint32_t keyId = se050_allocate_key();
+    aes->keyId = keyId;
+    int ret = BAD_MUTEX_E;
+    
+    if (wolfSSL_CryptHwMutexLock() == 0) {
+        ret = 0;
+        status = sss_key_store_context_init(&host_keystore, cfg_se050_i2c_pi);
+
+        if (status == kStatus_SSS_Success) {
+            status = sss_key_store_allocate(&host_keystore, 55);
+        }
+        
+        if (status == kStatus_SSS_Success) {
+            status = sss_key_object_init(&newKey, &host_keystore);
+        }
+/* aes_test runs perfectly with kKeyObject_Mode_Persistent, but might have caused previous board to have no free key slots */
+        if (status == kStatus_SSS_Success) {
+            status = sss_key_object_allocate_handle(&newKey, keyId, kSSS_KeyPart_Default,
+                                                kSSS_CipherType_AES, len, 
+                                                kKeyObject_Mode_Transient); //kKeyObject_Mode_Persistent
+        }
+
+        if (status == kStatus_SSS_Success) {
+            status = sss_key_store_set_key(&host_keystore, &newKey, key, len,
+                                       len * 8, NULL, 0);
+        }
+    }
+    wolfSSL_CryptHwMutexUnLock();
+
+    if (status != kStatus_SSS_Success) 
+        ret = WC_HW_E;
+    return ret;
+}
+
+
+int se050_aes_crypt(Aes* aes, const byte* in, byte* out, word32 sz, int dir, sss_algorithm_t algorithm)
+{    
+    sss_status_t    status;
+    sss_object_t    keyObject;
+    sss_mode_t      mode;
+    sss_key_store_t host_keystore;
+    int             ret = BAD_MUTEX_E;
+    XMEMSET(&mode, 0, sizeof(mode));
+
+    if (dir == AES_DECRYPTION)
+        mode = kMode_SSS_Decrypt;
+    else if (dir == AES_ENCRYPTION)
+        mode = kMode_SSS_Encrypt;
+
+    if (wolfSSL_CryptHwMutexLock() == 0) {
+        ret = 0;
+
+        status = sss_key_store_context_init(&host_keystore, cfg_se050_i2c_pi);
+     
+        if (status == kStatus_SSS_Success) {
+            status = sss_key_store_allocate(&host_keystore, 55);
+        }
+
+        if (status == kStatus_SSS_Success) {
+            status = sss_key_object_init(&keyObject, &host_keystore);
+        }
+
+        if (status == kStatus_SSS_Success) {
+            status = sss_key_object_get_handle(&keyObject, aes->keyId);
+        }
+
+        /* The first call to this function needs an initialization call, subsequent calls just need to call update */
+        if (aes->ctxInitDone == 0) {
+            aes->ctxInitDone = 1;
+            if (status == kStatus_SSS_Success) {
+                status = sss_symmetric_context_init(&aes->aes_ctx, cfg_se050_i2c_pi,
+                                                    &keyObject, algorithm, mode);
+            }
+
+            if (status == kStatus_SSS_Success) {
+                status = sss_cipher_init(&aes->aes_ctx, (uint8_t *)aes->reg, sizeof(aes->reg));
+            }
+        }
+        if (status == kStatus_SSS_Success) {
+            status = sss_cipher_update(&aes->aes_ctx, in, sz, out, &sz);
+        }
+    }
+    wolfSSL_CryptHwMutexUnLock();
+
+    if (status != kStatus_SSS_Success) 
+        ret = WC_HW_E;
+    return ret;
+}
+
+void se050_aes_free(Aes* aes)
+{
+    sss_status_t    status;
+    sss_key_store_t host_keystore;
+    sss_object_t    keyObject;
+    aes->ctxInitDone = 0; /* sets back to zero to indicate that a free has been called */
+
+    if (wolfSSL_CryptHwMutexLock() == 0) {    
+        status = sss_key_store_context_init(&host_keystore, cfg_se050_i2c_pi);
+     
+        if (status == kStatus_SSS_Success) {
+            status = sss_key_store_allocate(&host_keystore, 55);
+        }
+
+        if (status == kStatus_SSS_Success) {
+            status = sss_key_object_init(&keyObject, &host_keystore);
+        }
+
+        if (status == kStatus_SSS_Success) {
+            status = sss_key_object_get_handle(&keyObject, aes->keyId);
+        }
+        sss_key_object_free(&keyObject);
+
+        sss_symmetric_context_free(&aes->aes_ctx);
+
+    }
+    wolfSSL_CryptHwMutexUnLock();
+}
+
+#endif /* NO_AES */
+
+#ifdef WOLFSSL_SP_MATH
+    struct sp_int;
+    #define MATH_INT_T struct sp_int
+#elif defined(USE_FAST_MATH)
+    struct fp_int;
+    #define MATH_INT_T struct fp_int
+#else
+    struct mp_int;
+	#define MATH_INT_T struct mp_int
+#endif
+struct ecc_key;
+#include <wolfssl/wolfcrypt/ecc.h>
+#include <wolfssl/wolfcrypt/asn_public.h>
+
+
+#ifdef HAVE_ECC
+int se050_ecc_sign_hash_ex(const byte* in, word32 inLen, byte* out,
+                         word32 *outLen, struct ecc_key* key)
+{
+    sss_status_t        status;
+    sss_asymmetric_t    ctx_asymm;
+    sss_key_store_t     host_keystore;
+    sss_object_t        newKey;
+    sss_algorithm_t     algorithm;
+    XMEMSET(&algorithm, 0, sizeof(algorithm));
+
+    uint32_t    keyId = se050_allocate_key();
+    int         keysize = (word32)key->dp->size;
+    int         ret = BAD_MUTEX_E;
+    
+    /* truncate if digest is larger than 64 */
+    if (inLen > 64)
+        inLen = 64;
+
+    if (inLen == 20)
+        algorithm = kAlgorithm_SSS_SHA1;
+    else if (inLen == 28)
+        algorithm = kAlgorithm_SSS_SHA224;
+    else if (inLen == 32)
+        algorithm = kAlgorithm_SSS_SHA256;
+    else if (inLen == 48)
+        algorithm = kAlgorithm_SSS_SHA384;
+    else if (inLen == 64)
+        algorithm = kAlgorithm_SSS_SHA512;
+
+
+    if (wolfSSL_CryptHwMutexLock() == 0) {
+        ret = 0;
+        status = sss_key_store_context_init(&host_keystore, cfg_se050_i2c_pi);
+
+        if (status == kStatus_SSS_Success) {
+            status = sss_key_store_allocate(&host_keystore, 70);
+        }
+
+        if (status == kStatus_SSS_Success) {
+            status = sss_key_object_init(&newKey, &host_keystore);
+        }
+
+
+        if (status == kStatus_SSS_Success) {
+            status = sss_key_object_allocate_handle(&newKey, keyId, kSSS_KeyPart_Pair, 
+                                                kSSS_CipherType_EC_NIST_P, keysize, 
+                                                kKeyObject_Mode_Transient);
+        }
+
+        if (status == kStatus_SSS_Success) {
+            status = sss_key_store_generate_key(&host_keystore, &newKey,
+                                                    keysize * 8, NULL);
+        }
+
+        if (status == kStatus_SSS_Success) {
+            status = sss_asymmetric_context_init(&ctx_asymm, cfg_se050_i2c_pi,
+                                             &newKey, algorithm, kMode_SSS_Sign);
+        }
+
+        if (status == kStatus_SSS_Success) {
+            status = sss_asymmetric_sign_digest(&ctx_asymm, (uint8_t *)in, inLen,
+                                                                   out, outLen);
+        }
+        sss_asymmetric_context_free(&ctx_asymm);
+
+
+    }
+    wolfSSL_CryptHwMutexUnLock();
+    
+    if (status != kStatus_SSS_Success) 
+        ret = WC_HW_E;
+    
+    key->keyId = keyId;
+
+    return ret;      
+}
+
+int se050_ecc_verify_hash_ex(const byte* hash, word32 hashLen, byte* signature,
+                             word32 signatureLen, struct ecc_key* key, int* res)
+{
+    printf("runing verify!\n");
+
+    sss_status_t        status;
+    sss_asymmetric_t    ctx_asymm;
+    sss_object_t        newKey;
+    sss_key_store_t     host_keystore;
+    sss_algorithm_t     algorithm;
+
+    XMEMSET(&algorithm, 0, sizeof(algorithm));
+
+    word32      derSz = 0;
+    int         ret = WC_HW_E;
+    byte*       derBuf;
+    uint32_t    keyId = rand();
+    int         keySize = (word32)key->dp->size;
+                *res = 0;
+
+    if (hashLen > 64)
+        hashLen = 64;
+
+    if (hashLen == 20)
+        algorithm = kAlgorithm_SSS_SHA1;
+    else if (hashLen == 28)
+        algorithm = kAlgorithm_SSS_SHA224;
+    else if (hashLen == 32)
+        algorithm = kAlgorithm_SSS_SHA256;
+    else if (hashLen == 48)
+        algorithm = kAlgorithm_SSS_SHA384;
+    else if (hashLen == 64)
+        algorithm = kAlgorithm_SSS_SHA512;
+
+    printf("KeyId 3 = %d\n", key->keyId);
+    
+    if (wolfSSL_CryptHwMutexLock() == 0) {
+        if (key->keyId == 0) { //this is run when a key was not generated and was instead passed in
+            
+            ret = wc_EccKeyToPKCS8(key, NULL, &derSz);
+            if (ret != -202){
+                printf("first wc_EccKeyToPKCS8 failed\n");
+                return -1;
+            }
+            derBuf = (byte*)XMALLOC(derSz, NULL, DYNAMIC_TYPE_OPENSSL);
+            ret = wc_EccKeyToPKCS8(key, derBuf, &derSz);
+            if (ret <= 0){
+                printf("second wc_EccKeyToPKCS8 failed, ret = %d\n", ret);
+                return -1;
+            }
+
+            status = sss_key_store_context_init(&host_keystore, cfg_se050_i2c_pi);   
+  
+            if (status == kStatus_SSS_Success) {
+                status = sss_key_store_allocate(&host_keystore, 61);
+            }
+
+            if (status == kStatus_SSS_Success) {
+                status = sss_key_object_init(&newKey, &host_keystore);
+            }
+
+
+            if (status == kStatus_SSS_Success) {
+                status = sss_key_object_allocate_handle(&newKey, keyId, kSSS_KeyPart_Pair,
+                                                kSSS_CipherType_EC_NIST_P, derSz, 
+                                                kKeyObject_Mode_Transient);
+            }
+
+            if (status == kStatus_SSS_Success) {
+                status = sss_key_store_set_key(&host_keystore, &newKey, derBuf,
+                                                derSz, keySize * 8, NULL, 0);
+            }
+
+            if (status == kStatus_SSS_Success) {
+                status = sss_asymmetric_context_init(&ctx_asymm, cfg_se050_i2c_pi,
+                                            &newKey, algorithm, kMode_SSS_Verify);
+            }
+
+            printf("ran through inital key setup !\n");
+
+
+            if (status == kStatus_SSS_Success) {
+                status = sss_asymmetric_verify_digest(&ctx_asymm, (uint8_t *)hash,
+                                               hashLen, signature, signatureLen);
+            }
+
+            sss_asymmetric_context_free(&ctx_asymm);
+            printf("sss_asymmetric_verify_digest with set key worked!\n\n\n");
+
+        }
+        else if (key->keyId != 0) { //this is run after a sign function has taken place
+            ret = 0;
+            
+            status = sss_key_store_context_init(&host_keystore, cfg_se050_i2c_pi);
+
+            if (status == kStatus_SSS_Success)
+                status = sss_key_store_allocate(&host_keystore, 60);
+
+            if (status == kStatus_SSS_Success)
+                status = sss_key_object_init(&newKey, &host_keystore);
+
+            if (status == kStatus_SSS_Success)
+                status = sss_key_object_get_handle(&newKey, key->keyId);
+            
+            if (status == kStatus_SSS_Success) {
+                status = sss_asymmetric_context_init(&ctx_asymm, cfg_se050_i2c_pi,
+                                            &newKey, algorithm, kMode_SSS_Verify);
+            }
+                
+            if (status == kStatus_SSS_Success) {
+                status = sss_asymmetric_verify_digest(&ctx_asymm, (uint8_t *)hash, 
+                                               hashLen, signature, signatureLen);
+            }
+
+            sss_asymmetric_context_free(&ctx_asymm);
+        }
+
+    }
+    wolfSSL_CryptHwMutexUnLock();
+
+    if (status != kStatus_SSS_Success) 
+        ret = WC_HW_E;
+
+    printf("ran verify correctly!!\n\n\n");
+
+
+    *res = 1;
+    return 0;
+}
+
+
+int se050_ecc_free_key(struct ecc_key* key)
+{
+    sss_status_t    status = kStatus_SSS_Success;
+    sss_object_t    keyObject;
+    int             ret = WC_HW_E;
+    sss_key_store_t host_keystore;
+
+    /* less tha 10,000 as one example from test.c tried to free a key that was not created on the SE050 */
+    if(key->keyId != 0 && key->keyId < 10000) {
+        if (wolfSSL_CryptHwMutexLock() == 0) {
+            ret = 0;
+
+            status = sss_key_store_context_init(&host_keystore, cfg_se050_i2c_pi);
+
+            if (status == kStatus_SSS_Success)
+                status = sss_key_store_allocate(&host_keystore, 60);
+
+            if (status == kStatus_SSS_Success)
+                status = sss_key_object_init(&keyObject, &host_keystore);
+
+            if (status == kStatus_SSS_Success)
+                status = sss_key_object_get_handle(&keyObject, key->keyId);
+
+            if (status == kStatus_SSS_Success)
+                    sss_key_object_free(&keyObject);
+        }
+    }
+    wolfSSL_CryptHwMutexUnLock();   
+
+    if (status != kStatus_SSS_Success)
+        ret = WC_CLEANUP_E;
+
+    return ret;
+}
+
+int se050_ecc_create_key(struct ecc_key* key, int keyId, int keySize)
+{
+    sss_status_t            status = kStatus_SSS_Success;
+    sss_object_t            keyPair;
+    sss_key_store_t         host_keystore;
+    
+    uint8_t keyPairExport[128];
+    size_t keyPairExportLen               = sizeof(keyPairExport);
+    size_t keyPairExportBitLen            = sizeof(keyPairExport) * 8;
+    int ret = WC_HW_E;
+
+
+    if (wolfSSL_CryptHwMutexLock() == 0) {
+        ret = 0;
+
+        status = sss_key_store_context_init(&host_keystore, cfg_se050_i2c_pi);     
+        if (status == kStatus_SSS_Success) {
+            status = sss_key_store_allocate(&host_keystore, 60);
+        }
+
+        if (status == kStatus_SSS_Success) {
+            status = sss_key_object_init(&keyPair, &host_keystore);
+        }
+
+
+        if (status == kStatus_SSS_Success) {
+            status = sss_key_object_allocate_handle(&keyPair, keyId, kSSS_KeyPart_Pair,
+                                            kSSS_CipherType_EC_NIST_P, 256, 
+                                            kKeyObject_Mode_None); //kKeyObject_Mode_Transient
+        }
+
+        if (status == kStatus_SSS_Success) {
+            status = sss_key_store_generate_key(&host_keystore, &keyPair, 256, NULL);
+        }
+
+
+        if (status == kStatus_SSS_Success) {
+            status = sss_key_store_get_key(&host_keystore, &keyPair, keyPairExport,
+                                         &keyPairExportLen, &keyPairExportBitLen);
+        }
+    }
+    wolfSSL_CryptHwMutexUnLock();   
+
+    if (status != kStatus_SSS_Success)
+        ret = WC_CLEANUP_E;
+
+    mp_read_unsigned_bin(key->pubkey.x, keyPairExport, keySize);
+    mp_read_unsigned_bin(key->pubkey.y, keyPairExport + keySize, keySize);
+
+    return ret;
+}
+
+
+int se050_ecc_shared_secret(ecc_key* private_key, ecc_key* public_key, byte* out,
+                      word32* outlen)
+{
+    sss_status_t            status = kStatus_SSS_Success;
+    sss_key_store_t         host_keystore;
+    sss_key_store_t         host_keystore_2;
+    sss_object_t            ref_private_key;
+    sss_object_t            ref_public_key;
+    sss_object_t            deriveKey;
+    sss_derive_key_t        ctx_derive_key;
+    int                     keyId = se050_allocate_key();
+    int                     keySize = (word32)public_key->dp->size;
+    size_t                  ecdhKeyLen = keySize;
+    size_t                  ecdhKeyBitLen = keySize;
+    int                     ret = WC_HW_E;
+
+    
+    if (public_key->keyId == 0) {
+        public_key->keyId = se050_allocate_key();
+        se050_ecc_create_key(public_key, public_key->keyId, keySize);
+
+    }
+    if (private_key->keyId == 0) {
+        private_key->keyId = se050_allocate_key();
+        se050_ecc_create_key(private_key, private_key->keyId, keySize);
+    }
+
+    if (wolfSSL_CryptHwMutexLock() == 0) {
+        ret = 0;
+        status = sss_key_store_context_init(&host_keystore, cfg_se050_i2c_pi);
+    
+        if (status == kStatus_SSS_Success) {
+            status = sss_key_store_allocate(&host_keystore, 60);
+        }
+
+        if (status == kStatus_SSS_Success) {
+            status = sss_key_object_init(&ref_public_key, &host_keystore);
+        }
+
+        if (status == kStatus_SSS_Success) {
+            status = sss_key_object_get_handle(&ref_public_key, public_key->keyId);
+        }
+
+        if (status == kStatus_SSS_Success) {
+            status = sss_key_store_context_init(&host_keystore_2, cfg_se050_i2c_pi);     
+        }
+
+        if (status == kStatus_SSS_Success) {
+            status = sss_key_store_allocate(&host_keystore_2, 60);
+        }
+
+        if (status == kStatus_SSS_Success) {
+            status = sss_key_object_init(&ref_private_key, &host_keystore_2);
+        }
+
+        if (status == kStatus_SSS_Success) {
+            status = sss_key_object_get_handle(&ref_private_key, private_key->keyId);
+        }
+
+        if (status == kStatus_SSS_Success) {
+            status = sss_key_object_init(&deriveKey, hostKeyStore);
+        }
+
+        if (status == kStatus_SSS_Success) {
+            status = sss_key_object_allocate_handle(&deriveKey,
+                keyId,
+                kSSS_KeyPart_Default, //try kSSS_KeyPart_Part, didn't have any noticable changes
+                kSSS_CipherType_AES,
+                ecdhKeyLen,
+                kKeyObject_Mode_Transient); //try kKeyObject_Mode_None
+        }    
+        
+        if (status == kStatus_SSS_Success) {
+            status = sss_derive_key_context_init(&ctx_derive_key, cfg_se050_i2c_pi,
+                                        &ref_private_key, kAlgorithm_SSS_ECDH,
+                                        kMode_SSS_ComputeSharedSecret);
+        }
+
+        if (status == kStatus_SSS_Success) {
+            status = sss_derive_key_dh(&ctx_derive_key, &ref_public_key, &deriveKey);
+        }
+
+        if (status == kStatus_SSS_Success) {
+            status = sss_key_store_get_key(hostKeyStore, &deriveKey, out, outlen,
+                                                                 &ecdhKeyBitLen);
+        }
+        if (ctx_derive_key.session != NULL)
+            sss_derive_key_context_free(&ctx_derive_key);
+        if (deriveKey.keyStore != NULL)
+            sss_key_object_free(&deriveKey);
+
+        if (status != kStatus_SSS_Success) 
+            ret = WC_HW_E;
+    }
+    wolfSSL_CryptHwMutexUnLock();
+
+    return ret;
+}
+#endif /* HAVE_ECC */
+
+#ifdef HAVE_ED25519
+
+
+int se050_ed25519_create_key(ed25519_key* key)
+{
+    printf("\n\nrunning se050_ed25519_create_key\n");
+    sss_status_t    status;
+    sss_key_store_t host_keystore;
+    sss_object_t    newKey;
+    int             keysize = ED25519_KEY_SIZE;
+    uint32_t        keyId = se050_allocate_key();
+                    key->keyId = keyId;
+    int             ret = 0;
+
+    if (wolfSSL_CryptHwMutexLock() == 0) {
+        status = sss_key_store_context_init(&host_keystore, cfg_se050_i2c_pi);     
+
+        if (status == kStatus_SSS_Success) {
+            status = sss_key_store_allocate(&host_keystore, 55);
+        }
+
+        if (status == kStatus_SSS_Success) {
+            status = sss_key_object_init(&newKey, &host_keystore);
+        }
+
+        if (status == kStatus_SSS_Success) {
+            status = sss_key_object_allocate_handle(&newKey, keyId, kSSS_KeyPart_Pair, 
+                                                kSSS_CipherType_EC_TWISTED_ED, keysize, 
+                                                kKeyObject_Mode_Transient);
+        }
+
+        if (status == kStatus_SSS_Success) {
+            status = sss_key_store_generate_key(&host_keystore, &newKey, keysize * 8, NULL);
+        }
+
+        if (status != kStatus_SSS_Success) {
+            sss_key_object_free(&newKey);
+            ret = WC_HW_E;
+        }
+
+    }
+    wolfSSL_CryptHwMutexUnLock();
+
+
+    printf("ran se050_ed25519_create_key\n\n\n");
+    return ret;
+}
+
+void se050_ed25519_free_key(ed25519_key* key)
+{
+        sss_status_t status;
+        sss_object_t newKey;
+        sss_key_store_t host_keystore;
+
+        if (wolfSSL_CryptHwMutexLock() == 0) {
+
+            status = sss_key_store_context_init(&host_keystore, cfg_se050_i2c_pi); 
+    
+            if (status == kStatus_SSS_Success) {
+                status = sss_key_store_allocate(&host_keystore, 60);
+            }
+            if (status == kStatus_SSS_Success) {
+                status = sss_key_object_init(&newKey, &host_keystore);
+            }
+            if (status == kStatus_SSS_Success) {
+                status = sss_key_object_get_handle(&newKey, key->keyId);
+            }
+            if (status == kStatus_SSS_Success) {
+                sss_key_object_free(&newKey);
+            }
+        }
+        wolfSSL_CryptHwMutexUnLock();
+}
+
+
+int se050_ed25519_sign_msg(const byte* in, word32 inLen, byte* out,
+                         word32 *outLen, ed25519_key* key)
+{
+    printf("\n\nhit se050_ed25519_sign_msg...\n");
+    sss_status_t        status = kStatus_SSS_Success;
+    sss_asymmetric_t    ctx_asymm;
+    sss_key_store_t     host_keystore; 
+    sss_object_t        newKey;
+    int                 ret = 0;
+                        inLen = 64;
+                        *outLen = 64;
+
+    /* used to fix edge case when ed25519_init is not called prior to signing */
+    /* figure out if needed or not for -10801 */
+    if (key->keyId > 10000 || key->keyId == 0) { 
+        key->keyId = se050_allocate_key();
+        ret = se050_ed25519_create_key(key);
+        if (ret != 0) {
+            printf("calling se050_ed25519_create_key failed..., ret = %d\n", ret);
+        }
+
+    }
+
+    if (wolfSSL_CryptHwMutexLock() == 0 && ret == 0) {
+        status = sss_key_store_context_init(&host_keystore, cfg_se050_i2c_pi);     
+
+        if (status == kStatus_SSS_Success) {
+            status = sss_key_store_allocate(&host_keystore, 60);
+        }
+
+        if (status == kStatus_SSS_Success) {
+            status = sss_key_object_init(&newKey, &host_keystore);
+        }
+
+        if (status == kStatus_SSS_Success) {
+            status = sss_key_object_get_handle(&newKey, key->keyId);
+        }
+
+        if (status == kStatus_SSS_Success) {
+            status = sss_asymmetric_context_init(&ctx_asymm, cfg_se050_i2c_pi, 
+                                &newKey, kAlgorithm_SSS_SHA512, kMode_SSS_Sign);
+        }
+
+        if (status == kStatus_SSS_Success) {
+            status = sss_se05x_asymmetric_sign((sss_se05x_asymmetric_t *)&ctx_asymm,
+                                             (uint8_t *)in, inLen, out, outLen);
+        }
+
+        if(status != kStatus_SSS_Success){
+            printf("status != kStatus_SSS_Success, status = %d\n", status);
+            sss_key_object_free(&newKey);
+            ret = WC_HW_E;
+        }
+        sss_asymmetric_context_free(&ctx_asymm);
+    }
+    wolfSSL_CryptHwMutexUnLock();
+
+    return ret;      
+}
+
+
+int se050_ed25519_verify_msg(const byte* signature, word32 signatureLen, const byte* msg,
+                             word32 msgLen, struct ed25519_key* key, int* res)
+{
+    printf("runing se050_ed25519_verify_msg!\n");
+
+    sss_status_t        status = kStatus_SSS_Success;
+    sss_asymmetric_t    ctx_asymm;
+    sss_object_t        newKey;
+    sss_key_store_t     host_keystore;
+    int                 ret = 0;
+                        msgLen = 64;
+                        *res = 1;
+
+    if (wolfSSL_CryptHwMutexLock() == 0) {
+            status = sss_key_store_context_init(&host_keystore, cfg_se050_i2c_pi);
+
+            if (status == kStatus_SSS_Success) {
+                status = sss_key_store_allocate(&host_keystore, 61);
+            }
+
+            if (status == kStatus_SSS_Success) {
+                status = sss_key_object_init(&newKey, &host_keystore);
+            }
+
+            if (status == kStatus_SSS_Success) {
+                status = sss_key_object_get_handle(&newKey, key->keyId);
+            }
+
+            if (status == kStatus_SSS_Success) {
+                status = sss_asymmetric_context_init(&ctx_asymm, cfg_se050_i2c_pi, 
+                            &newKey, kAlgorithm_SSS_SHA512, kMode_SSS_Verify);
+            }
+
+            if (status == kStatus_SSS_Success) {
+                status = sss_se05x_asymmetric_verify((sss_se05x_asymmetric_t *)&ctx_asymm,
+                                             (uint8_t *)msg, msgLen, 
+                                             (uint8_t *)signature, (size_t)signatureLen);
+            }
+
+            sss_asymmetric_context_free(&ctx_asymm);
+    }
+    wolfSSL_CryptHwMutexUnLock();
+
+    if (status != kStatus_SSS_Success) {
+        ret = WC_HW_E;
+        *res = 0;
+    }
+    return ret;
+}
+
+#endif /* HAVE_ED25519 */
+
+#endif /* SE050 */
diff --git a/wolfcrypt/src/random.c b/wolfcrypt/src/random.c
index a97c29508..41e0f682a 100644
--- a/wolfcrypt/src/random.c
+++ b/wolfcrypt/src/random.c
@@ -2574,6 +2574,24 @@ int wc_GenerateSeed(OS_Seed* os, byte* output, word32 sz)
             }
             return 0;
         }
+#elif defined(WOLFSSL_SE050)
+     #include <wolfssl/wolfcrypt/port/nxp/se050_port.h>
+    
+    int wc_GenerateSeed(OS_Seed* os, byte* output, word32 sz){
+        int ret = 0;
+        
+        (void)os;
+        
+        if(output == NULL) {
+            return BUFFER_E;
+        }
+        ret = wolfSSL_CryptHwMutexLock();
+        if (ret == 0) {
+            ret = se050_get_random_number(sz, output);
+            wolfSSL_CryptHwMutexUnLock();
+        }
+        return ret;
+    }
 
 #elif defined(DOLPHIN_EMULATOR)
 
diff --git a/wolfcrypt/src/sha.c b/wolfcrypt/src/sha.c
index af68da78b..925519168 100644
--- a/wolfcrypt/src/sha.c
+++ b/wolfcrypt/src/sha.c
@@ -336,6 +336,42 @@
 #elif defined(WOLFSSL_SILABS_SE_ACCEL)
 
     /* implemented in wolfcrypt/src/port/silabs/silabs_hash.c */
+#elif defined(WOLFSSL_SE050)
+
+    #include <wolfssl/wolfcrypt/port/nxp/se050_port.h>
+    int wc_InitSha_ex(wc_Sha* sha, void* heap, int devId)
+    {
+        if (sha == NULL) {
+            return BAD_FUNC_ARG;
+        }
+        (void)devId;
+
+        return se050_hash_init(&sha->se050Ctx, heap);
+
+    }
+
+    int wc_ShaUpdate(wc_Sha* sha, const byte* data, word32 len)
+    {
+        return se050_hash_update(&sha->se050Ctx, data, len);
+
+    }
+
+    int wc_ShaFinal(wc_Sha* sha, byte* hash)
+    {
+        int ret = 0;
+        ret = se050_hash_final(&sha->se050Ctx, hash, WC_SHA_DIGEST_SIZE,
+                               kAlgorithm_SSS_SHA1);
+        (void)wc_InitSha(sha);
+        return ret;
+    }
+    int wc_ShaFinalRaw(wc_Sha* sha, byte* hash)
+    {
+        int ret = 0;
+        ret = se050_hash_final(&sha->se050Ctx, hash, WC_SHA_DIGEST_SIZE,
+                               kAlgorithm_SSS_SHA1);
+        (void)wc_InitSha(sha);
+        return ret;
+    }
 
 #else
     /* Software implementation */
@@ -811,6 +847,9 @@ void wc_ShaFree(wc_Sha* sha)
 #ifdef WOLFSSL_PIC32MZ_HASH
     wc_ShaPic32Free(sha);
 #endif
+#ifdef WOLFSSL_SE050
+   se050_hash_free(&sha->se050Ctx);
+#endif
 #if (defined(WOLFSSL_RENESAS_TSIP_CRYPT) && \
     !defined(NO_WOLFSSL_RENESAS_TSIP_CRYPT_HASH))
     if (sha->msg != NULL) {
diff --git a/wolfcrypt/src/sha256.c b/wolfcrypt/src/sha256.c
index 9c342dcd7..21b956d55 100644
--- a/wolfcrypt/src/sha256.c
+++ b/wolfcrypt/src/sha256.c
@@ -184,7 +184,7 @@ where 0 <= L < 2^64.
     (!defined(WOLFSSL_ESP32WROOM32_CRYPT) || defined(NO_WOLFSSL_ESP32WROOM32_CRYPT_HASH)) && \
     (!defined(WOLFSSL_RENESAS_TSIP_CRYPT) || defined(NO_WOLFSSL_RENESAS_TSIP_HASH)) && \
     !defined(WOLFSSL_PSOC6_CRYPTO) && !defined(WOLFSSL_IMXRT_DCP) && !defined(WOLFSSL_SILABS_SE_ACCEL) && \
-    !defined(WOLFSSL_KCAPI_HASH)
+    !defined(WOLFSSL_KCAPI_HASH) && !defined(WOLFSSL_SE050)
 
 
 static int InitSha256(wc_Sha256* sha256)
@@ -597,6 +597,41 @@ static int InitSha256(wc_Sha256* sha256)
     !defined(WOLFSSL_QNX_CAAM)
     /* functions defined in wolfcrypt/src/port/caam/caam_sha256.c */
 
+#elif defined(WOLFSSL_SE050)
+
+    #include <wolfssl/wolfcrypt/port/nxp/se050_port.h>
+    int wc_InitSha256_ex(wc_Sha256* sha256, void* heap, int devId)
+    {
+        if (sha256 == NULL) {
+            return BAD_FUNC_ARG;
+        }
+        (void)devId;
+
+        return se050_hash_init(&sha256->se050Ctx, heap);
+    }
+
+    int wc_Sha256Update(wc_Sha256* sha256, const byte* data, word32 len)
+    {
+        return se050_hash_update(&sha256->se050Ctx, data, len);
+    }
+
+    int wc_Sha256Final(wc_Sha256* sha256, byte* hash)
+    {      
+        int ret = 0;
+        ret = se050_hash_final(&sha256->se050Ctx, hash, WC_SHA256_DIGEST_SIZE,
+                               kAlgorithm_SSS_SHA256);
+        (void)wc_InitSha256(sha256);
+        return ret;
+    }
+    int wc_Sha256FinalRaw(wc_Sha256* sha256, byte* hash)
+    {
+        int ret = 0;
+        ret = se050_hash_final(&sha256->se050Ctx, hash, WC_SHA256_DIGEST_SIZE, 
+                               kAlgorithm_SSS_SHA256);
+        (void)wc_InitSha256(sha256);
+        return ret;
+    }
+
 #elif defined(WOLFSSL_AFALG_HASH)
     /* implemented in wolfcrypt/src/port/af_alg/afalg_hash.c */
 
@@ -1388,6 +1423,32 @@ static int InitSha256(wc_Sha256* sha256)
 
         return ret;
     }
+#elif defined(WOLFSSL_SE050)
+
+    #include <wolfssl/wolfcrypt/port/nxp/se050_port.h>
+    int wc_InitSha224_ex(wc_Sha224* sha224, void* heap, int devId)
+    {
+        if (sha224 == NULL) {
+            return BAD_FUNC_ARG;
+        }
+        (void)devId;
+        
+        return se050_hash_init(&sha224->se050Ctx, heap);
+    }
+
+    int wc_Sha224Update(wc_Sha224* sha224, const byte* data, word32 len)
+    {
+        return se050_hash_update(&sha224->se050Ctx, data, len);
+    }
+
+    int wc_Sha224Final(wc_Sha224* sha224, byte* hash)
+    {
+        int ret = 0;   
+        ret = se050_hash_final(&sha224->se050Ctx, hash, WC_SHA224_DIGEST_SIZE,
+                               kAlgorithm_SSS_SHA224);
+        (void)wc_InitSha224(sha224);
+        return ret;
+    }
 
 #elif defined(WOLFSSL_IMX6_CAAM) && !defined(NO_IMX6_CAAM_HASH) && \
     !defined(WOLFSSL_QNX_CAAM)
diff --git a/wolfcrypt/src/sha512.c b/wolfcrypt/src/sha512.c
index 4b8d1d1cd..558325832 100644
--- a/wolfcrypt/src/sha512.c
+++ b/wolfcrypt/src/sha512.c
@@ -199,6 +199,49 @@
 #elif defined(WOLFSSL_KCAPI_HASH)
     /* functions defined in wolfcrypt/src/port/kcapi/kcapi_hash.c */
 
+#elif defined(WOLFSSL_SE050)
+    //#include <wolfssl/wolfcrypt/port/nxp/se050_port.h>
+    int wc_InitSha512(wc_Sha512* sha512)
+    {
+        if (sha512 == NULL)
+            return BAD_FUNC_ARG;
+        //void* heap;
+        return se050_hash_init(&sha512->se050Ctx, NULL);
+    }
+    int wc_InitSha512_ex(wc_Sha512* sha512, void* heap, int devId)
+    {
+        if (sha512 == NULL) {
+            return BAD_FUNC_ARG;
+        }
+        (void)devId;
+        return se050_hash_init(&sha512->se050Ctx, heap);
+    }
+    int wc_Sha512Update(wc_Sha512* sha512, const byte* data, word32 len)
+    {
+        return se050_hash_update(&sha512->se050Ctx, data, len);
+    
+    }
+    int wc_Sha512Final(wc_Sha512* sha512, byte* hash)
+    {
+        int ret = 0;
+        ret = se050_hash_final(&sha512->se050Ctx, hash, WC_SHA512_DIGEST_SIZE,
+                               kAlgorithm_SSS_SHA512);
+        (void)wc_InitSha512_ex(sha512);
+        return ret;
+    }
+    int wc_Sha512FinalRaw(wc_Sha512* sha512, byte* hash)
+    {
+        int ret = 0;
+        ret = se050_hash_final(&sha512->se050Ctx, hash, WC_SHA512_DIGEST_SIZE,
+                               kAlgorithm_SSS_SHA512);
+        (void)wc_InitSha512(sha512);
+        return ret;
+    }
+    void wc_Sha512Free(wc_Sha512* sha512)
+    {
+        (void)sha512;
+    }
+
 #else
 
 #ifdef WOLFSSL_SHA512
@@ -1173,6 +1216,38 @@ int wc_Sha512Transform(wc_Sha512* sha, const unsigned char* data)
 #if defined(WOLFSSL_IMX6_CAAM) && !defined(NO_IMX6_CAAM_HASH) && \
     !defined(WOLFSSL_QNX_CAAM)
     /* functions defined in wolfcrypt/src/port/caam/caam_sha.c */
+#elif defined(WOLFSSL_SE050)
+    #include <wolfssl/wolfcrypt/port/nxp/se050_port.h>
+    
+    int wc_InitSha384_ex(wc_Sha384* sha384, void* heap, int devId)
+    {
+        if (sha384 == NULL) {
+            return BAD_FUNC_ARG;
+        }
+        (void)devId;
+        return se050_hash_init(&sha384->se050Ctx, heap);
+    }
+    int wc_Sha384Update(wc_Sha384* sha384, const byte* data, word32 len)
+    {
+        return se050_hash_update(&sha384->se050Ctx, data, len);
+    
+    }
+    int wc_Sha384Final(wc_Sha384* sha384, byte* hash)
+    {
+        int ret = 0;
+        ret = se050_hash_final(&sha384->se050Ctx, hash, WC_SHA384_DIGEST_SIZE,
+                               kAlgorithm_SSS_SHA384);
+        (void)wc_InitSha384(sha384);
+        return ret;
+    }
+    int wc_Sha384FinalRaw(wc_Sha384* sha384, byte* hash)
+    {
+        int ret = 0;
+        ret = se050_hash_final(&sha384->se050Ctx, hash, WC_SHA384_DIGEST_SIZE,
+                               kAlgorithm_SSS_SHA384);
+        (void)wc_InitSha384(sha384);
+        return ret;
+    }
 
 #elif defined(WOLFSSL_SILABS_SHA512)
     /* functions defined in wolfcrypt/src/port/silabs/silabs_hash.c */
diff --git a/wolfssl/wolfcrypt/aes.h b/wolfssl/wolfcrypt/aes.h
index 775c2fef3..f7619c1e9 100644
--- a/wolfssl/wolfcrypt/aes.h
+++ b/wolfssl/wolfcrypt/aes.h
@@ -70,6 +70,10 @@ block cipher mechanism that uses n-bit binary string parameter key with 128-bits
 #include "xsecure_aes.h"
 #endif
 
+#ifdef WOLFSSL_SE050
+    #include <wolfssl/wolfcrypt/port/nxp/se050_port.h>
+#endif
+
 #if defined(WOLFSSL_AFALG) || defined(WOLFSSL_AFALG_XILINX_AES)
 /* included for struct msghdr */
 #include <wolfssl/wolfcrypt/port/af_alg/wc_afalg.h>
@@ -178,6 +182,12 @@ struct Aes {
     word32 aadLen;  /* additional authenticated data len */
 #endif
 
+#ifdef WOLFSSL_SE050
+    sss_symmetric_t aes_ctx; /* used as the function context */
+    int ctxInitDone;
+    int keyId;
+#endif
+
 #ifdef GCM_TABLE
     /* key-based fast multiplication table. */
     ALIGN16 byte M0[256][AES_BLOCK_SIZE];
diff --git a/wolfssl/wolfcrypt/ecc.h b/wolfssl/wolfcrypt/ecc.h
index da9dd8d70..76bbb6567 100644
--- a/wolfssl/wolfcrypt/ecc.h
+++ b/wolfssl/wolfcrypt/ecc.h
@@ -66,6 +66,10 @@
     #include <wolfssl/wolfcrypt/port/kcapi/kcapi_ecc.h>
 #endif
 
+#ifdef WOLFSSL_SE050
+    #include <wolfssl/wolfcrypt/port/nxp/se050_port.h>
+#endif
+
 #ifdef WOLFSSL_HAVE_SP_ECC
     #include <wolfssl/wolfcrypt/sp_int.h>
 #endif
@@ -168,8 +172,12 @@ enum {
         CRYPTOCELL_KEY_SIZE = ECC_MAXSIZE,
     #endif
     ECC_MAX_CRYPTO_HW_SIZE = CRYPTOCELL_KEY_SIZE,
+#elif defined(WOLFSSL_SE050)
+    ECC_MAX_CRYPTO_HW_SIZE = 32,
+    ECC_MAX_CRYPTO_HW_PUBKEY_SIZE = 64,
 #endif
 
+
     /* point compression type */
     ECC_POINT_COMP_EVEN = 0x02,
     ECC_POINT_COMP_ODD = 0x03,
@@ -436,6 +444,9 @@ struct ecc_key {
     word32 securePubKey; /* address of public key in secure memory */
     int    partNum; /* partition number*/
 #endif
+#ifdef WOLFSSL_SE050
+    int keyId;
+#endif
 #if defined(WOLFSSL_ATECC508A) || defined(WOLFSSL_ATECC608A)
     int  slot;        /* Key Slot Number (-1 unknown) */
     byte pubkey_raw[ECC_MAX_CRYPTO_HW_PUBKEY_SIZE];
diff --git a/wolfssl/wolfcrypt/ed25519.h b/wolfssl/wolfcrypt/ed25519.h
index e1b090f79..a4608d11f 100644
--- a/wolfssl/wolfcrypt/ed25519.h
+++ b/wolfssl/wolfcrypt/ed25519.h
@@ -85,6 +85,9 @@ struct ed25519_key {
     /* uncompressed point coordinates */
     byte pointX[ED25519_KEY_SIZE]; /* recovered X coordinate */
     byte pointY[ED25519_KEY_SIZE]; /* Y coordinate is the public key with The most significant bit of the final octet always zero. */
+#endif
+#ifdef WOLFSSL_SE050
+    int keyId;
 #endif
     word16 pubKeySet:1;
 #ifdef WOLFSSL_ASYNC_CRYPT
diff --git a/wolfssl/wolfcrypt/port/nxp/README.md b/wolfssl/wolfcrypt/port/nxp/README.md
new file mode 100644
index 000000000..1e1e37bf3
--- /dev/null
+++ b/wolfssl/wolfcrypt/port/nxp/README.md
@@ -0,0 +1,68 @@
+
+# NXP Ports
+
+Support for the NXP DCP, KSDK and SE050 hardware acceleration boards. 
+
+## NXP SE050
+Support for the SE050 on-board crypto hardware acceleration for symmetric AES, SHA1/SHA256/SHA384/SHA512, ECC (including ed25519) and RNG. **(discuss p-256 ECC)**
+
+## SE050 Acceleration
+For details about SE050 HW acceleration, see [NXP's SE050 page](https://www.nxp.com/products/security-and-authentication/authentication/edgelock-se050-plug-trust-secure-element-family-enhanced-iot-security-with-maximum-flexibility:SE050).
+
+## Building
+
+To enable support run:
+```
+./configure --with-se050=PATH
+```
+Followed by:
+```
+make && make install
+```
+With PATH being the directory location of simw-top.
+
+The code required to communicate with the SE050 can be found at this NXP [link](https://www.nxp.com/products/security-and-authentication/authentication/edgelock-se050-plug-trust-secure-element-family-enhanced-iot-security-with-maximum-flexibility:SE050?tab=Design_Tools_Tab) (An NXP account is required to download). Follow the instructions [here](https://www.nxp.com/docs/en/application-note/AN12570.pdf) to install and setup with a Raspberry Pi. 
+Confirm that you are able to run the examples from the 
+```
+/simw-top_build/raspbian_native_se050_t1oi2c/bin/
+```
+directory. Once that's done, it's time to modify one of those examples in order to tie into wolfSSL. 
+The ``./se05x_Minimal `` is the easiest one to modify. Open the ``simw-top/demos/se05x/se05x_Minimal `` directory and edit ``se05x_Minimal.c``. Add these headers to source file:
+```
+#include <wolfssl/options.h>
+#include <wolfssl/wolfcrypt/types.h>
+#include <wolfssl/wolfcrypt/port/nxp/se050_port.h>
+``` 
+If you would like to run our wolfcrypt test or  benchmark tool, add:
+``#include "test.h"`` or ``#include benchmark.h``, respectively. Below is the code that was replaced in ``ex_sss_entry()`` that ran the wolfcrypt test:
+```
+    sss_status_t status = kStatus_SSS_Success;
+    int ret;
+    
+    sss_session_t *pSession2 = (sss_session_t *)&pCtx->session;
+    sss_key_store_t *pHostSession = (sss_key_store_t *)&pCtx->host_ks;
+
+    LOG_I("running setconfig");
+    ret = wolfcrypt_se050_SetConfig(pSession2, pHostSession);
+    if (ret != 0) {
+        return kStatus_SSS_Fail;
+    }
+    LOG_I("ran setconfig correctly");
+    wolfcrypt_test(NULL);
+
+    LOG_I("ran wolfcrypt test");
+    return status;
+```
+
+``wolfcrypt_test(NULL);`` can be replaced with ``benchmark_test();``
+The two variables used in  ``wolfcrypt_se050_SetConfig`` are session and key store variables that are required to reference parts of the hardware. 
+
+Next, the Makefile needs to be edited.
+At the top of the Makefile, the base wolfssl directory needs to be added to ``INCLUDE_FLAGS``. Next, Inside ``CFLAGS``, the ``se05x_Minimal`` directory needs to be added so that test.c and benchmark.c are included. Finally, underneath 'all', test.c, test.h, benchmark.c and benchmark.h need to be added, along with ``-L (wolfssl directory) -lwolfssl`` at the end of the line. 
+## Wolfcrypt Test
+To run the wolfcrypt test, two files, ``test.h`` and ``test.c`` need to be added to the ``./se05x_Minimal`` directory. These files can be found inside of ``/wolfcrypt/test``. 
+Next, ``#define NO_MAIN_DRIVER`` needs to be added to test.h.
+You should be able to run `wolfcrypt_test()` now. 
+
+## Benchmark 
+To run the benchmark, both ``benchmark.c`` and ``benchmark.h`` need to be copied from wolfcrypt/benchmark to the `./se05x_Minimal` directory.  In addition, the entire `./certs` directory will need to copied into the directory. ``#define NO_MAIN_DRIVER`` will need to be added to `benchmark.h`. You should be able to run `benchmark_test() ` now. 
diff --git a/wolfssl/wolfcrypt/port/nxp/se050_port.h b/wolfssl/wolfcrypt/port/nxp/se050_port.h
new file mode 100644
index 000000000..7db7884e3
--- /dev/null
+++ b/wolfssl/wolfcrypt/port/nxp/se050_port.h
@@ -0,0 +1,98 @@
+/* se050_port.h
+ *
+ * Copyright (C) 2006-2021 wolfSSL Inc.
+ *
+ * This file is part of wolfSSL.
+ *
+ * wolfSSL is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License as published by
+ * the Free Software Foundation; either version 2 of the License, or
+ * (at your option) any later version.
+ *
+ * wolfSSL is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License
+ * along with this program; if not, write to the Free Software
+ * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1335, USA
+ */
+
+#ifndef _SE050_PORT_H_
+#define _SE050_PORT_H_
+
+
+#include <wolfssl/wolfcrypt/settings.h>
+
+#include "fsl_sss_api.h"
+
+enum {
+    SSS_BLOCK_SIZE = 512
+};
+
+typedef struct {
+    void*  heap;
+    byte*  msg;
+    word32 used;
+    word32 len;
+} SE050_HASH_Context;
+
+
+WOLFSSL_API int wolfcrypt_se050_SetConfig(sss_session_t *pSession, sss_key_store_t *pHostKeyStore, sss_key_store_t *pKeyStore);
+
+int se050_allocate_key(void);
+
+int se050_get_random_number(uint32_t count, uint8_t* rand_out);
+
+
+
+int se050_hash_init(SE050_HASH_Context* se050Ctx, void* heap);
+int se050_hash_update(SE050_HASH_Context* se050Ctx, const byte* data, word32 len);
+int se050_hash_final(SE050_HASH_Context* se050Ctx, byte* hash, size_t digestLen, word32 algo);
+void se050_hash_free(SE050_HASH_Context* se050Ctx);
+
+
+
+struct Aes;
+int se050_aes_set_key(struct Aes* aes, const byte* key, word32 len, const byte* iv, int dir);
+int se050_aes_crypt(struct Aes* aes, const byte* in, byte* out, word32 sz, int dir, sss_algorithm_t algorithm);
+void se050_aes_free(struct Aes* aes);
+//int se050_aes_ctr_crypt(struct Aes* aes, const byte* in, byte* out, word32 sz);
+
+
+
+struct ecc_key;
+struct WC_RNG;
+#ifdef WOLFSSL_SP_MATH
+    struct sp_int;
+    #define MATH_INT_T struct sp_int
+#elif defined(USE_FAST_MATH)
+    struct fp_int;
+    #define MATH_INT_T struct fp_int
+#else
+    struct mp_int;
+	#define MATH_INT_T struct mp_int
+#endif
+int se050_ecc_sign_hash_ex(const byte* in, word32 inLen, byte* out,
+                         word32 *outLen, struct ecc_key* key);
+
+int se050_ecc_verify_hash_ex(const byte* hash, word32 hashlen, byte* signature,
+                             word32 signatureLen, struct ecc_key* key, int* res);
+
+int se050_ecc_create_key(struct ecc_key* key, int keyId, int keySize);
+int se050_ecc_shared_secret(struct ecc_key* private_key, struct ecc_key* public_key, byte* out,
+                      word32* outlen);
+int se050_ecc_free_key(struct ecc_key* key);
+
+struct ed25519_key;
+//#include <wolfssl/wolfcrypt/ed25519.h>
+int se050_ed25519_create_key(struct ed25519_key* key);
+void se050_ed25519_free_key(struct ed25519_key* key);
+int se050_ed25519_sign_msg(const byte* in, word32 inLen, byte* out,
+                         word32 *outLen, struct ed25519_key* key);
+
+int se050_ed25519_verify_msg(const byte* signature, word32 signatureLen, const byte* msg,
+                             word32 msgLen, struct ed25519_key* key, int* res);
+
+#endif /* _SE050_PORT_H_ */
diff --git a/wolfssl/wolfcrypt/sha.h b/wolfssl/wolfcrypt/sha.h
index cc55fa00d..8fca499fb 100644
--- a/wolfssl/wolfcrypt/sha.h
+++ b/wolfssl/wolfcrypt/sha.h
@@ -110,10 +110,16 @@ enum {
     #include "wolfssl/wolfcrypt/port/Renesas/renesas-tsip-crypt.h"
 #else
 
+#if defined(WOLFSSL_SE050)
+    #include "wolfssl/wolfcrypt/port/nxp/se050_port.h"
+#endif
+
 /* Sha digest */
 struct wc_Sha {
 #ifdef FREESCALE_LTC_SHA
         ltc_hash_ctx_t ctx;
+#elif defined(WOLFSSL_SE050)
+        SE050_HASH_Context se050Ctx;
 #elif defined(STM32_HASH)
         STM32_HASH_Context stmCtx;
 #elif defined(WOLFSSL_SILABS_SE_ACCEL)
diff --git a/wolfssl/wolfcrypt/sha256.h b/wolfssl/wolfcrypt/sha256.h
index 706123716..5dfb3603a 100644
--- a/wolfssl/wolfcrypt/sha256.h
+++ b/wolfssl/wolfcrypt/sha256.h
@@ -144,10 +144,16 @@ enum {
     #include "wolfssl/wolfcrypt/port/Renesas/renesas-tsip-crypt.h"
 #else
 
+#if defined(WOLFSSL_SE050)
+    #include "wolfssl/wolfcrypt/port/nxp/se050_port.h"
+#endif
+
 /* wc_Sha256 digest */
 struct wc_Sha256 {
 #ifdef FREESCALE_LTC_SHA
     ltc_hash_ctx_t ctx;
+#elif defined(WOLFSSL_SE050)
+    SE050_HASH_Context se050Ctx;
 #elif defined(STM32_HASH_SHA2)
     STM32_HASH_Context stmCtx;
 #elif defined(WOLFSSL_SILABS_SE_ACCEL)
diff --git a/wolfssl/wolfcrypt/sha512.h b/wolfssl/wolfcrypt/sha512.h
index a1bb131e2..f821d94ef 100644
--- a/wolfssl/wolfcrypt/sha512.h
+++ b/wolfssl/wolfcrypt/sha512.h
@@ -138,6 +138,9 @@ enum {
 #if defined(WOLFSSL_IMX6_CAAM) && !defined(WOLFSSL_QNX_CAAM)
     #include "wolfssl/wolfcrypt/port/caam/wolfcaam_sha.h"
 #else
+#if defined(WOLFSSL_SE050)
+    #include "wolfssl/wolfcrypt/port/nxp/se050_port.h"
+#endif
 /* wc_Sha512 digest */
 struct wc_Sha512 {
 #ifdef WOLFSSL_PSOC6_CRYPTO
@@ -170,6 +173,9 @@ struct wc_Sha512 {
 #ifdef WOLFSSL_KCAPI_HASH
     wolfssl_KCAPI_Hash kcapi;
 #endif
+#if defined(WOLFSSL_SE050)
+    SE050_HASH_Context se050Ctx;
+#endif
 #ifdef WOLF_CRYPTO_CB
     int    devId;
     void*  devCtx; /* generic crypto callback context */

From 29f051e585dd423cb2a9160e72b279bf8984bb98 Mon Sep 17 00:00:00 2001
From: David Garske <david@wolfssl.com>
Date: Fri, 20 Aug 2021 15:45:10 -0700
Subject: [PATCH 2/8] Fixes and cleanups for NXP SE050 support.

---
 configure.ac                            |   36 +-
 wolfcrypt/src/aes.c                     |   30 +-
 wolfcrypt/src/ecc.c                     |   43 +-
 wolfcrypt/src/ed25519.c                 |    7 +-
 wolfcrypt/src/include.am                |    6 +
 wolfcrypt/src/port/nxp/README.md        |   98 ++
 wolfcrypt/src/port/nxp/se050_port.c     | 1173 +++++++++++------------
 wolfcrypt/src/random.c                  |    2 +-
 wolfcrypt/src/sha.c                     |    1 -
 wolfcrypt/src/sha512.c                  |   27 +-
 wolfssl/wolfcrypt/port/nxp/README.md    |   68 --
 wolfssl/wolfcrypt/port/nxp/se050_port.h |   64 +-
 12 files changed, 805 insertions(+), 750 deletions(-)
 create mode 100644 wolfcrypt/src/port/nxp/README.md
 delete mode 100644 wolfssl/wolfcrypt/port/nxp/README.md

diff --git a/configure.ac b/configure.ac
index c1048664d..100b96470 100644
--- a/configure.ac
+++ b/configure.ac
@@ -1337,16 +1337,15 @@ AC_ARG_WITH([cryptoauthlib],
 )
 
 # NXP SE050
-#current configure options line: "./configure --with-se050=/home/pi/Downloads/new_simw_top"
+# current configure options line: "./configure --with-se050=/home/pi/Downloads/new_simw_top"
 ENABLED_SE050="no"
 trylibse050dir=""
 AC_ARG_WITH([se050],
     [AS_HELP_STRING([--with-se050=PATH],[PATH to SE050 install (default /usr/local/lib/)])],
     [
         AC_MSG_CHECKING([for SE050])
-        CPPFLAGS="$CPPFLAGS -DWOLFSSL_SE050"
-        LIBS="$LIBS -lSSS_APIs"
 
+        LIBS="$LIBS -lSSS_APIs"
         AC_LINK_IFELSE([AC_LANG_PROGRAM([[#include <fsl_sss_api.h>]], [[ sss_mac_init(0);]])],[ libse050_linked=yes ],[ libse050_linked=no ])
 
         if test "x$libse050_linked" = "xno" ; then
@@ -1356,20 +1355,25 @@ AC_ARG_WITH([se050],
             if test "x$withval" = "xyes" ; then
                 trylibse050dir="/usr/local/lib/"
             fi
-            LDFLAGS="$LDFLAGS -L$trylibse050dir/simw-top_build/raspbian_native_se050_t1oi2c/sss/"
-            CPPFLAGS="$CPPFLAGS  -I$trylibse050dir/simw-top/sss/inc   -I$trylibse050dir/simw-top/sss/port/default \ 
-            -I$trylibse050dir/simw-top/hostlib/hostLib/inc/  -I$trylibse050dir/simw-top/hostlib/hostLib/libCommon/infra "
+            LDFLAGS="$LDFLAGS -L$trylibse050dir/build/sss"
+            CPPFLAGS="$CPPFLAGS -I$trylibse050dir/sss/inc"
+            CPPFLAGS="$CPPFLAGS -I$trylibse050dir/sss/port/default"
+            CPPFLAGS="$CPPFLAGS -I$trylibse050dir/hostlib/hostLib/inc"
+            CPPFLAGS="$CPPFLAGS -I$trylibse050dir/hostlib/hostLib/libCommon/infra"
 
-
-            AC_LINK_IFELSE([AC_LANG_PROGRAM([[#include <fsl_sss_api.h>]], [[ sss_mac_init(0); ]])],[ libse050_linked=yes ],[ libse050_linked=no ])
-
-            if test "x$libse050_linked" = "xno" ; then
-                AC_MSG_ERROR([SE050 isn't found.
-                If it's already installed, specify its path using --with-SE050=/dir/])
+            AC_CHECK_FILES([$trylibse050dir/build/sss/libSSS_APIs.a], [SE050_STATIC=yes], [SE050_STATIC=no])
+            if test "x$SE050_STATIC" = "xyes"; then
+                LIB_STATIC_ADD="$trylibse050dir/build/sss/libSSS_APIs.a $LIB_STATIC_ADD"
+            else
+                AC_LINK_IFELSE([AC_LANG_PROGRAM([[#include <fsl_sss_api.h>]], [[ sss_mac_init(0); ]])],[ libse050_linked=yes ],[ libse050_linked=no ])
+                if test "x$libse050_linked" = "xno" ; then
+                    AC_MSG_ERROR([SE050 isn't found.
+                    If it's already installed, specify its path using --with-se050=/dir/])
+                fi
             fi
-            AM_LDFLAGS="$AM_LDFLAGS -L$trylibse050dir/simw-top_build/raspbian_native_se050_t1oi2c/sss/"
-            AM_CFLAGS="$AM_CFLAGS -I$trylibse050dir/simw-top/sss/inc/  \
-            -DWOLFSSL_AES_DIRECT"   
+
+            # Requires AES direct
+            AM_CFLAGS="$AM_CFLAGS -DWOLFSSL_AES_DIRECT"
 
             AC_MSG_RESULT([yes])
         else
@@ -7079,6 +7083,7 @@ AM_CONDITIONAL([BUILD_RC2],[test "x$ENABLED_RC2" = "xyes"])
 AM_CONDITIONAL([BUILD_QNXCAAM],[test "x$ENABLED_CAAM" = "xqnx"])
 AM_CONDITIONAL([BUILD_IOTSAFE],[test "x$ENABLED_IOTSAFE" = "xyes"])
 AM_CONDITIONAL([BUILD_IOTSAFE_HWRNG],[test "x$ENABLED_IOTSAFE_HWRNG" = "xyes"])
+AM_CONDITIONAL([BUILD_SE050],[test "x$ENABLED_SE050" = "xyes"])
 
 if test "$ax_enable_debug" = "yes" ||
         test "$ENABLED_STACKSIZE" != "no" ||
@@ -7453,6 +7458,7 @@ echo "   * Crypto callbacks:           $ENABLED_CRYPTOCB"
 echo "   * i.MX6 CAAM:                 $ENABLED_CAAM"
 echo "   * IoT-Safe:                   $ENABLED_IOTSAFE"
 echo "   * IoT-Safe HWRNG:             $ENABLED_IOTSAFE_HWRNG"
+echo "   * NXP SE050:                  $ENABLED_SE050"
 echo ""
 echo "---"
 
diff --git a/wolfcrypt/src/aes.c b/wolfcrypt/src/aes.c
index 8cd2a7b83..1538f095e 100644
--- a/wolfcrypt/src/aes.c
+++ b/wolfcrypt/src/aes.c
@@ -871,15 +871,16 @@ block cipher mechanism that uses n-bit binary string parameter key with 128-bits
 
 #elif defined(WOLFSSL_SE050)
     static int AES_ECB_encrypt(Aes* aes, const byte* inBlock, byte* outBlock,
-            int sz)
+        int sz)
     {
-        return se050_aes_crypt(aes, inBlock, outBlock, sz, AES_ENCRYPTION, kAlgorithm_SSS_AES_ECB);
+        return se050_aes_crypt(aes, inBlock, outBlock, sz, AES_ENCRYPTION,
+            kAlgorithm_SSS_AES_ECB);
     }
-    
     static int AES_ECB_decrypt(Aes* aes, const byte* inBlock, byte* outBlock,
-            int sz)
+        int sz)
     {
-        return se050_aes_crypt(aes, inBlock, outBlock, sz, AES_DECRYPTION, kAlgorithm_SSS_AES_ECB);
+        return se050_aes_crypt(aes, inBlock, outBlock, sz, AES_DECRYPTION,
+            kAlgorithm_SSS_AES_ECB);
     }
     static int wc_AesEncrypt(Aes* aes, const byte* inBlock, byte* outBlock)
     {
@@ -2603,24 +2604,27 @@ static void wc_AesDecrypt(Aes* aes, const byte* inBlock, byte* outBlock)
     int wc_AesSetKey(Aes* aes, const byte* userKey, word32 keylen, const byte* iv,
                   int dir)
     {   
-        int ret = 0;
+        int ret;
         
-    if (aes == NULL ||  !((keylen == 16) || (keylen == 24) || (keylen == 32))) {
-        return BAD_FUNC_ARG;
-    }
+        if (aes == NULL || (keylen != 16 && keylen != 24 && keylen != 32)) {
+            return BAD_FUNC_ARG;
+        }
+
         aes->ctxInitDone = 0;
     #if defined(WOLFSSL_AES_CFB) || defined(WOLFSSL_AES_COUNTER) || \
         defined(WOLFSSL_AES_OFB)
         aes->left = 0;
     #endif
+
         ret = se050_aes_set_key(aes, userKey, keylen, iv, dir);
         if (ret == 0) {
             ret = wc_AesSetIV(aes, iv);
         }
         return ret;
     }
-        int wc_AesSetKeyDirect(Aes* aes, const byte* userKey, word32 keylen,
-                        const byte* iv, int dir)
+
+    int wc_AesSetKeyDirect(Aes* aes, const byte* userKey, word32 keylen,
+        const byte* iv, int dir)
     {
         return wc_AesSetKey(aes, userKey, keylen, iv, dir);
     }
@@ -3883,12 +3887,12 @@ int wc_AesSetIV(Aes* aes, const byte* iv)
     int wc_AesCbcEncrypt(Aes* aes, byte* out, const byte* in, word32 sz)
     {
         return se050_aes_crypt(aes, in, out, sz, AES_ENCRYPTION,
-         kAlgorithm_SSS_AES_CBC);
+            kAlgorithm_SSS_AES_CBC);
     }
     int wc_AesCbcDecrypt(Aes* aes, byte* out, const byte* in, word32 sz)
     {
         return se050_aes_crypt(aes, in, out, sz, AES_DECRYPTION,
-         kAlgorithm_SSS_AES_CBC);
+            kAlgorithm_SSS_AES_CBC);
     }
 
 #elif defined(WOLFSSL_SILABS_SE_ACCEL)
diff --git a/wolfcrypt/src/ecc.c b/wolfcrypt/src/ecc.c
index cdff3b34f..76f2b3eec 100644
--- a/wolfcrypt/src/ecc.c
+++ b/wolfcrypt/src/ecc.c
@@ -4701,8 +4701,7 @@ int wc_ecc_make_key_ex2(WC_RNG* rng, int keysize, ecc_key* key, int curve_id,
       err = NOT_COMPILED_IN;
    }
 #elif defined(WOLFSSL_SE050)
-    key->keyId = se050_allocate_key();
-    err = se050_ecc_create_key(key, key->keyId, keysize);
+    err = se050_ecc_create_key(key, curve_id, keysize);
     key->type = ECC_PRIVATEKEY;
 #elif defined(WOLFSSL_CRYPTOCELL)
 
@@ -5008,6 +5007,11 @@ int wc_ecc_init_ex(ecc_key* key, void* heap, int devId)
 #if defined(WOLFSSL_DSP)
     key->handle = -1;
 #endif
+
+#ifdef WOLFSSL_SE050
+    key->keyId = -1;
+#endif
+
     return ret;
 }
 
@@ -5190,7 +5194,7 @@ static int wc_ecc_sign_hash_hw(const byte* in, word32 inlen,
     #elif defined(WOLFSSL_KCAPI_ECC)
         err = KcapiEcc_Sign(key, in, inlen, out, outlen);
         (void)rng;
-    #elif defined (WOLFSSL_SE050)
+    #elif defined(WOLFSSL_SE050)
         err = se050_ecc_sign_hash_ex(in, inlen, out, outlen, key);
         if (err == 0) 
             err = DecodeECC_DSA_Sig(out, *outlen, r, s);
@@ -6295,7 +6299,7 @@ int wc_ecc_free(ecc_key* key)
 #endif
 
 #ifdef WOLFSSL_SE050
-        se050_ecc_free_key(key);
+    se050_ecc_free_key(key);
 #endif
 
 #if defined(WOLFSSL_ATECC508A) || defined(WOLFSSL_ATECC608A)
@@ -7116,22 +7120,23 @@ int wc_ecc_verify_hash_ex(mp_int *r, mp_int *s, const byte* hash,
 
    err = KcapiEcc_Verify(key, hash, hashlen, sigRS, key->dp->size * 2);
 #elif defined(WOLFSSL_SE050)
-    /* Used when following a hardware sign operation */
+    {
+        /* Used when following a hardware sign operation */
+        int rLeadingZero = mp_leading_bit(r);
+        int sLeadingZero = mp_leading_bit(s);
+        int rLen = mp_unsigned_bin_size(r);
+        int sLen = mp_unsigned_bin_size(s);
+        word32 signatureLen = rLeadingZero + sLeadingZero + 
+            rLen + sLen + SIG_HEADER_SZ; /* see StoreECC_DSA_Sig */
 
-    int rLeadingZero = mp_leading_bit(r);
-    int sLeadingZero = mp_leading_bit(s);
-    int rLen = mp_unsigned_bin_size(r);
-    int sLen = mp_unsigned_bin_size(s);
-
-    word32 signatureLen = rLeadingZero + sLeadingZero + rLen + sLen + SIG_HEADER_SZ; /* see StoreECC_DSA_Sig */
-
-    err = StoreECC_DSA_Sig(sigRS, &signatureLen, r, s);
-    if (err != 0)
-        return err;
-
-    err = se050_ecc_verify_hash_ex(hash, hashlen, sigRS, signatureLen, key, res);
-    if (err != 0)
-       return err;
+        err = StoreECC_DSA_Sig(sigRS, &signatureLen, r, s);
+        if (err == 0) {
+            err = se050_ecc_verify_hash_ex(hash, hashlen, sigRS,
+                signatureLen, key, res);
+        }
+        if (err != 0)
+            return err;
+    }
 #else
   /* checking if private key with no public part */
   if (key->type == ECC_PRIVATEKEY_ONLY) {
diff --git a/wolfcrypt/src/ed25519.c b/wolfcrypt/src/ed25519.c
index f8f726031..2b87c86f0 100644
--- a/wolfcrypt/src/ed25519.c
+++ b/wolfcrypt/src/ed25519.c
@@ -262,11 +262,12 @@ int wc_ed25519_sign_msg_ex(const byte* in, word32 inLen, byte* out,
                             word32 *outLen, ed25519_key* key, byte type,
                             const byte* context, byte contextLen)
 {
+    int    ret;
 #ifdef WOLFSSL_SE050
     (void)context;
     (void)contextLen;
     (void)type;
-    int ret = se050_ed25519_sign_msg(in, inLen, out, outLen, key);
+    ret = se050_ed25519_sign_msg(in, inLen, out, outLen, key);
 #else
 #ifdef FREESCALE_LTC_ECC
     byte   tempBuf[ED25519_PRV_KEY_SIZE];
@@ -277,7 +278,6 @@ int wc_ed25519_sign_msg_ex(const byte* in, word32 inLen, byte* out,
     byte   nonce[WC_SHA512_DIGEST_SIZE];
     byte   hram[WC_SHA512_DIGEST_SIZE];
     byte   az[ED25519_PRV_KEY_SIZE];
-    int    ret;
 
     /* sanity check on arguments */
     if (in == NULL || out == NULL || outLen == NULL || key == NULL ||
@@ -681,8 +681,7 @@ int wc_ed25519_verify_msg_ex(const byte* sig, word32 sigLen, const byte* msg,
     (void)type;
     (void)context;
     (void)contextLen;
-    if (ed25519Ctx != NULL)
-        (void)ed25519Ctx;
+    (void)ed25519Ctx;
     ret = se050_ed25519_verify_msg(sig, sigLen, msg, msgLen, key, res);
 #else
 #ifdef WOLFSSL_ED25519_PERSISTENT_SHA
diff --git a/wolfcrypt/src/include.am b/wolfcrypt/src/include.am
index 868fdadfe..c08529519 100644
--- a/wolfcrypt/src/include.am
+++ b/wolfcrypt/src/include.am
@@ -68,6 +68,8 @@ EXTRA_DIST += wolfcrypt/src/port/ti/ti-aes.c \
               wolfcrypt/src/port/arm/armv8-32-sha512-asm.c \
               wolfcrypt/src/port/nxp/ksdk_port.c \
               wolfcrypt/src/port/nxp/dcp_port.c \
+              wolfcrypt/src/port/nxp/se050_port.c \
+              wolfcrypt/src/port/nxp/README.md \
               wolfcrypt/src/port/atmel/README.md \
               wolfcrypt/src/port/xilinx/xil-sha3.c \
               wolfcrypt/src/port/xilinx/xil-aesgcm.c \
@@ -174,3 +176,7 @@ src_libwolfssl_la_SOURCES += wolfcrypt/src/port/caam/wolfcaam_qnx.c
 src_libwolfssl_la_SOURCES += wolfcrypt/src/port/caam/wolfcaam_ecdsa.c
 src_libwolfssl_la_SOURCES += wolfcrypt/src/port/caam/wolfcaam_cmac.c
 endif
+
+if BUILD_SE050
+src_libwolfssl_la_SOURCES += wolfcrypt/src/port/nxp/se050_port.c
+endif
diff --git a/wolfcrypt/src/port/nxp/README.md b/wolfcrypt/src/port/nxp/README.md
new file mode 100644
index 000000000..ac74f069b
--- /dev/null
+++ b/wolfcrypt/src/port/nxp/README.md
@@ -0,0 +1,98 @@
+# NXP Ports
+
+Support for the NXP DCP, KSDK and SE050 hardware acceleration boards. 
+
+## NXP SE050
+
+Support for the SE050 on-board crypto hardware acceleration for symmetric AES, SHA1/SHA256/SHA384/SHA512, ECC (including ed25519) and RNG. **(discuss p-256 ECC)**
+
+## SE050 Acceleration
+
+For details about SE050 HW acceleration, see [NXP's SE050 page](https://www.nxp.com/products/security-and-authentication/authentication/edgelock-se050-plug-trust-secure-element-family-enhanced-iot-security-with-maximum-flexibility:SE050).
+
+## Building simw-top
+
+The code required to communicate with the SE050 is the `EdgeLock SE05x Plug & Trust Middleware (03.03.00)`, which can be found here [link](https://www.nxp.com/products/security-and-authentication/authentication/edgelock-se050-plug-trust-secure-element-family-enhanced-iot-security-with-maximum-flexibility:SE050?tab=Design_Tools_Tab) (An NXP account is required to download).
+
+Follow the build instruction in AN12570 (EdgeLockTM SE05x Quick start guide with Raspberry Pi) [here](https://www.nxp.com/docs/en/application-note/AN12570.pdf). 
+
+## Building wolfSSL
+
+To enable support run:
+
+``sh
+./configure --with-se050=PATH
+make
+``
+
+Where `PATH` is the directory location of `simw-top`.
+Example: `./configure --with-se050=/Users/[user]/simw-top`
+
+## Building Examples
+
+Confirm that you are able to run the examples from the directory:
+
+``sh
+/simw-top_build/raspbian_native_se050_t1oi2c/bin/
+``
+
+Modify one of those examples in order to tie into wolfSSL. The `./se05x_Minimal` is the easiest one to modify.
+
+Open the `simw-top/demos/se05x/se05x_Minimal` directory and edit `se05x_Minimal.c`. Add these headers to source file:
+
+``c
+#include <wolfssl/options.h>
+#include <wolfssl/wolfcrypt/types.h>
+#include <wolfssl/wolfcrypt/port/nxp/se050_port.h>
+`` 
+
+If you would like to run our wolfcrypt test or  benchmark tool, add: `#include "test.h"` or `#include benchmark.h`.
+
+Below is the code that was replaced in `ex_sss_entry()` to run the wolfcrypt test:
+
+``c
+sss_status_t status = kStatus_SSS_Success;
+int ret;
+
+sss_session_t *pSession2 = (sss_session_t *)&pCtx->session;
+sss_key_store_t *pHostSession = (sss_key_store_t *)&pCtx->host_ks;
+
+LOG_I("running setconfig");
+ret = wc_se050_SetConfig(pSession2, pHostSession);
+if (ret != 0) {
+    return kStatus_SSS_Fail;
+}
+LOG_I("ran setconfig correctly");
+wolfcrypt_test(NULL);
+
+LOG_I("ran wolfcrypt test");
+return status;
+``
+
+Note: `wolfcrypt_test(NULL);` can be replaced with `benchmark_test();`
+
+The two variables used in `wc_se050_SetConfig` are session and key store variables that are required to reference parts of the hardware.
+
+The Makefile needs to be edited. At the top of the Makefile, the base wolfssl directory needs to be added to `INCLUDE_FLAGS`.
+
+Next, Inside `CFLAGS`, the `se05x_Minimal` directory needs to be added so that test.c and benchmark.c are included.
+
+Finally, underneath 'all', test.c, test.h, benchmark.c and benchmark.h need to be added, along with `-L[wolfssl directory] -lwolfssl` at the end of the line. 
+
+### Wolfcrypt Test
+
+To run the wolfcrypt test, two files, `test.h` and `test.c` need to be added to the `./se05x_Minimal` directory. These files can be found inside of `/wolfcrypt/test`. 
+Make sure `NO_MAIN_DRIVER` is defined to avoid `int main()` conflicts. Either in the Makefile or modify test.h to define it.
+
+You should be able to run `wolfcrypt_test()` now. 
+
+### wolfCrypt Benchmark 
+
+To run the benchmark, both `benchmark.c` and `benchmark.h` need to be copied from wolfcrypt/benchmark to the `./se05x_Minimal` directory.
+In addition, the entire `./certs` directory will need to copied into the directory. 
+Make sure `NO_MAIN_DRIVER` is defined to avoid `int main()` conflicts. Either in the Makefile or modify test.h to define it.
+Now you can run `benchmark_test()`. 
+
+## Support
+
+For questions please email support@wolfssl.com
diff --git a/wolfcrypt/src/port/nxp/se050_port.c b/wolfcrypt/src/port/nxp/se050_port.c
index 4384f3994..c011f29ce 100644
--- a/wolfcrypt/src/port/nxp/se050_port.c
+++ b/wolfcrypt/src/port/nxp/se050_port.c
@@ -33,37 +33,53 @@
 #include <wolfssl/wolfcrypt/ed25519.h>
 
 
-#if defined(WOLFSSL_SE050)
+#ifdef WOLFSSL_SE050
 
 #include <wolfssl/wolfcrypt/port/nxp/se050_port.h>
 #include "fsl_sss_api.h"
 #include "fsl_sss_se05x_types.h"
 
+#ifdef WOLFSSL_SP_MATH
+    struct sp_int;
+    #define MATH_INT_T struct sp_int
+#elif defined(USE_FAST_MATH)
+    struct fp_int;
+    #define MATH_INT_T struct fp_int
+#else
+    struct mp_int;
+    #define MATH_INT_T struct mp_int
+#endif
+struct ecc_key;
+#include <wolfssl/wolfcrypt/ecc.h>
+#include <wolfssl/wolfcrypt/asn_public.h>
+
+/* ECC SIGN 70 = keyStoreId - Implementation specific ID */
+/* AES 55 = keyStoreId - Implementation specific ID */
+/* ECC Shared Secret 60 = keyStoreId - Implementation specific ID */
+/* ECC VERIFY 61 = keyStoreId - Implementation specific ID */
+/* ECC VERIFY AFTER SIGN 60 = keyStoreId - Implementation specific ID */
+/* ED25519 55 = keyStoreId - Implementation specific ID */
 
 /* Global variables */
 static sss_session_t *cfg_se050_i2c_pi;
 static sss_key_store_t *hostKeyStore;
 static sss_key_store_t *keyStore;
-int keyId_allocater = 100;
 
-int wolfcrypt_se050_SetConfig(sss_session_t *pSession, sss_key_store_t *pHostKeyStore, sss_key_store_t *pKeyStore) 
+int wc_se050_SetConfig(sss_session_t *pSession, sss_key_store_t *pHostKeyStore,
+    sss_key_store_t *pKeyStore)
 {
-	printf("Setting SE050 session configuration\n");
-	
-	XMEMSET(&cfg_se050_i2c_pi, 0, sizeof(cfg_se050_i2c_pi));
-	cfg_se050_i2c_pi = pSession;
-	
-    XMEMSET(&hostKeyStore, 0, sizeof(hostKeyStore));
-	hostKeyStore = pHostKeyStore;
-	
-    XMEMSET(&keyStore, 0, sizeof(keyStore));
-	keyStore = pKeyStore;
-    
-	return 0;
+    WOLFSSL_MSG("Setting SE050 session configuration");
+
+    cfg_se050_i2c_pi = pSession;
+    hostKeyStore = pHostKeyStore;
+    keyStore = pKeyStore;
+
+    return 0;
 }
 
-int se050_allocate_key()
+int se050_allocate_key(void)
 {
+    static int keyId_allocater = 100;
     return keyId_allocater++;
 }
 
@@ -71,27 +87,28 @@ int se050_allocate_key()
 int se050_get_random_number(uint32_t count, uint8_t* rand_out)
 {
     sss_status_t status;
-	sss_rng_context_t rng;
-	int ret = 0;
+    sss_rng_context_t rng;
+    int ret = 0;
 
-    if (wolfSSL_CryptHwMutexLock() == 0) {
-        status = sss_rng_context_init(&rng, cfg_se050_i2c_pi);
+    if (wolfSSL_CryptHwMutexLock() != 0) {
+        return BAD_MUTEX_E;
+    }
+    status = sss_rng_context_init(&rng, cfg_se050_i2c_pi);
 
-        if (status == kStatus_SSS_Success)
-            status = sss_rng_get_random(&rng, rand_out, count);
+    if (status == kStatus_SSS_Success)
+        status = sss_rng_get_random(&rng, rand_out, count);
 
-        if (status == kStatus_SSS_Success)
-            status = sss_rng_context_free(&rng);
+    if (status == kStatus_SSS_Success)
+        status = sss_rng_context_free(&rng);
 
-        if (status != kStatus_SSS_Success) {
-            ret = RNG_FAILURE_E;
-        }
+    if (status != kStatus_SSS_Success) {
+        ret = RNG_FAILURE_E;
     }
     wolfSSL_CryptHwMutexUnLock();
 
     return ret;
 }
-#endif /* WC_NO_RNG */
+#endif /* !WC_NO_RNG */
 
 /* Used for sha/sha224/sha384/sha512 */
 int se050_hash_init(SE050_HASH_Context* se050Ctx, void* heap)
@@ -108,81 +125,61 @@ int se050_hash_update(SE050_HASH_Context* se050Ctx, const byte* data, word32 len
     if (se050Ctx == NULL || (len > 0 && data == NULL)) {
         return BAD_FUNC_ARG;
     }
-    
+
     if (se050Ctx->len < se050Ctx->used + len) {
         if (se050Ctx->msg == NULL) {
-            se050Ctx->msg = (byte*)XMALLOC(se050Ctx->used + len, se050Ctx->heap,
-                    DYNAMIC_TYPE_TMP_BUFFER);
-                    if (se050Ctx->msg == NULL) {
-                        return MEMORY_E;
-                    }
-        } 
+            se050Ctx->msg = (byte*)XMALLOC(se050Ctx->used + len,
+                se050Ctx->heap, DYNAMIC_TYPE_TMP_BUFFER);
+        }
         else {
-            byte* pt = (byte*)XREALLOC(se050Ctx->msg, se050Ctx->used + len, se050Ctx->heap,
-                    DYNAMIC_TYPE_TMP_BUFFER);
-            if (pt == NULL) {
-                return MEMORY_E;
-            }
-            se050Ctx->msg = pt;
+            se050Ctx->msg = (byte*)XREALLOC(se050Ctx->msg, se050Ctx->used + len,
+                se050Ctx->heap, DYNAMIC_TYPE_TMP_BUFFER);
+        }
+        if (se050Ctx->msg == NULL) {
+            return MEMORY_E;
         }
         se050Ctx->len = se050Ctx->used + len;
     }
+
     XMEMCPY(se050Ctx->msg + se050Ctx->used, data , len);
     se050Ctx->used += len;
+
     return 0;
 }
 
-int se050_hash_final(SE050_HASH_Context* se050Ctx, byte* hash, size_t digestLen, sss_algorithm_t algo)
+int se050_hash_final(SE050_HASH_Context* se050Ctx, byte* hash, size_t digestLen,
+    sss_algorithm_t algo)
 {
     sss_status_t status;
     sss_digest_t digest_ctx;
-   // XMEMSET(&digest_ctx, 0, sizeof(digest_ctx));
-    
-    const byte*     data = se050Ctx->msg;
-    int             size = (se050Ctx->len) / SSS_BLOCK_SIZE;
-    int             leftover = (se050Ctx->len) % SSS_BLOCK_SIZE;
-    const byte*     blocks;
-                    blocks = data;    
-
-
-    if (wolfSSL_CryptHwMutexLock() == 0) { 
-        status = sss_digest_context_init(&digest_ctx, cfg_se050_i2c_pi, algo, kMode_SSS_Digest);  
-        if(status != kStatus_SSS_Success){
-            printf("error 1\n");
-            return -1;
-        }
-
-        status = sss_digest_init(&digest_ctx);
-        if(status != kStatus_SSS_Success){
-            printf("error 2 - hash_final...\n");
-            return -1;
-        }
-        /* used to send chunks of size 512 */
-        while (size--) {
-            status = sss_digest_update(&digest_ctx, blocks, SSS_BLOCK_SIZE);
-            if(status != kStatus_SSS_Success){
-                printf("error 3\n");
-                return -1;
-            }
-            blocks += SSS_BLOCK_SIZE;       
-        }
-        if (leftover) {
-            status = sss_digest_update(&digest_ctx, blocks, leftover);
-            if(status != kStatus_SSS_Success){
-                printf("error 3\n");
-                return -1;
-            }
-        }        
-
-        status = sss_digest_finish(&digest_ctx, hash, &digestLen);
-        if(status != kStatus_SSS_Success){
-            printf("error 4\n");
-            return -1;
-        }
-        sss_digest_context_free(&digest_ctx);
+    const byte*  data = se050Ctx->msg;
+    int          size = (se050Ctx->len) / SSS_BLOCK_SIZE;
+    int          leftover = (se050Ctx->len) % SSS_BLOCK_SIZE;
+    const byte*  blocks = data;
 
+    if (wolfSSL_CryptHwMutexLock() != 0) {
+        return BAD_MUTEX_E;
     }
 
+    status = sss_digest_context_init(&digest_ctx, cfg_se050_i2c_pi, algo,
+        kMode_SSS_Digest);
+    if (status == kStatus_SSS_Success) {
+        status = sss_digest_init(&digest_ctx);
+    }
+    if (status == kStatus_SSS_Success) {
+    /* used to send chunks of size 512 */
+    while (status == kStatus_SSS_Success && size--) {
+        status = sss_digest_update(&digest_ctx, blocks, SSS_BLOCK_SIZE);
+        blocks += SSS_BLOCK_SIZE;
+    }
+    if (status == kStatus_SSS_Success && leftover) {
+        status = sss_digest_update(&digest_ctx, blocks, leftover);
+    }
+    if (status == kStatus_SSS_Success) {
+        status = sss_digest_finish(&digest_ctx, hash, &digestLen);
+    }
+    sss_digest_context_free(&digest_ctx);
+
     wolfSSL_CryptHwMutexUnLock();
 
     return 0;
@@ -197,55 +194,64 @@ void se050_hash_free(SE050_HASH_Context* se050Ctx)
 int se050_aes_set_key(Aes* aes, const byte* key, word32 len,
                                         const byte* iv, int dir)
 {
-    printf("\n\nrunning se050_set_key\n");
-    (void)dir;
-    (void)iv;
     sss_status_t status;
-    aes->rounds = len/4 + 6;
     sss_object_t newKey;
     sss_key_store_t host_keystore;
-    uint32_t keyId = se050_allocate_key();
-    aes->keyId = keyId;
+    int keyId = se050_allocate_key();
     int ret = BAD_MUTEX_E;
-    
-    if (wolfSSL_CryptHwMutexLock() == 0) {
-        ret = 0;
-        status = sss_key_store_context_init(&host_keystore, cfg_se050_i2c_pi);
 
-        if (status == kStatus_SSS_Success) {
-            status = sss_key_store_allocate(&host_keystore, 55);
-        }
-        
-        if (status == kStatus_SSS_Success) {
-            status = sss_key_object_init(&newKey, &host_keystore);
-        }
-/* aes_test runs perfectly with kKeyObject_Mode_Persistent, but might have caused previous board to have no free key slots */
-        if (status == kStatus_SSS_Success) {
-            status = sss_key_object_allocate_handle(&newKey, keyId, kSSS_KeyPart_Default,
-                                                kSSS_CipherType_AES, len, 
-                                                kKeyObject_Mode_Transient); //kKeyObject_Mode_Persistent
-        }
+    WOLFSSL_MSG("se050_set_key");
 
-        if (status == kStatus_SSS_Success) {
-            status = sss_key_store_set_key(&host_keystore, &newKey, key, len,
-                                       len * 8, NULL, 0);
-        }
+    (void)dir;
+    (void)iv;
+
+    aes->rounds = len/4 + 6;
+    aes->keyId = keyId;
+
+    if (wolfSSL_CryptHwMutexLock() != 0) {
+        return BAD_MUTEX_E;
     }
+
+    status = sss_key_store_context_init(&host_keystore, cfg_se050_i2c_pi);
+
+    if (status == kStatus_SSS_Success) {
+        status = sss_key_store_allocate(&host_keystore, 55);
+    }
+
+    if (status == kStatus_SSS_Success) {
+        status = sss_key_object_init(&newKey, &host_keystore);
+    }
+
+    /* aes_test runs perfectly with kKeyObject_Mode_Persistent,
+        * but might have caused previous board to have no free key slots */
+    if (status == kStatus_SSS_Success) {
+        status = sss_key_object_allocate_handle(&newKey, keyId,
+            kSSS_KeyPart_Default, kSSS_CipherType_AES, len,
+            kKeyObject_Mode_Transient);
+    }
+
+    if (status == kStatus_SSS_Success) {
+        status = sss_key_store_set_key(&host_keystore, &newKey, key, len,
+                                    len * 8, NULL, 0);
+    }
+
     wolfSSL_CryptHwMutexUnLock();
 
-    if (status != kStatus_SSS_Success) 
+    if (status != kStatus_SSS_Success)
         ret = WC_HW_E;
     return ret;
 }
 
 
-int se050_aes_crypt(Aes* aes, const byte* in, byte* out, word32 sz, int dir, sss_algorithm_t algorithm)
-{    
+int se050_aes_crypt(Aes* aes, const byte* in, byte* out, word32 sz, int dir,
+    sss_algorithm_t algorithm)
+{
     sss_status_t    status;
     sss_object_t    keyObject;
     sss_mode_t      mode;
     sss_key_store_t host_keystore;
     int             ret = BAD_MUTEX_E;
+
     XMEMSET(&mode, 0, sizeof(mode));
 
     if (dir == AES_DECRYPTION)
@@ -253,42 +259,45 @@ int se050_aes_crypt(Aes* aes, const byte* in, byte* out, word32 sz, int dir, sss
     else if (dir == AES_ENCRYPTION)
         mode = kMode_SSS_Encrypt;
 
-    if (wolfSSL_CryptHwMutexLock() == 0) {
-        ret = 0;
+    if (wolfSSL_CryptHwMutexLock() != 0) {
+        return BAD_MUTEX_E;
+    }
 
-        status = sss_key_store_context_init(&host_keystore, cfg_se050_i2c_pi);
-     
+    status = sss_key_store_context_init(&host_keystore, cfg_se050_i2c_pi);
+
+    if (status == kStatus_SSS_Success) {
+        status = sss_key_store_allocate(&host_keystore, 55);
+    }
+
+    if (status == kStatus_SSS_Success) {
+        status = sss_key_object_init(&keyObject, &host_keystore);
+    }
+
+    if (status == kStatus_SSS_Success) {
+        status = sss_key_object_get_handle(&keyObject, aes->keyId);
+    }
+
+    /* The first call to this function needs an initialization call,
+        * subsequent calls just need to call update */
+    if (aes->ctxInitDone == 0) {
+        aes->ctxInitDone = 1;
         if (status == kStatus_SSS_Success) {
-            status = sss_key_store_allocate(&host_keystore, 55);
+            status = sss_symmetric_context_init(&aes->aes_ctx,
+                cfg_se050_i2c_pi, &keyObject, algorithm, mode);
         }
 
         if (status == kStatus_SSS_Success) {
-            status = sss_key_object_init(&keyObject, &host_keystore);
-        }
-
-        if (status == kStatus_SSS_Success) {
-            status = sss_key_object_get_handle(&keyObject, aes->keyId);
-        }
-
-        /* The first call to this function needs an initialization call, subsequent calls just need to call update */
-        if (aes->ctxInitDone == 0) {
-            aes->ctxInitDone = 1;
-            if (status == kStatus_SSS_Success) {
-                status = sss_symmetric_context_init(&aes->aes_ctx, cfg_se050_i2c_pi,
-                                                    &keyObject, algorithm, mode);
-            }
-
-            if (status == kStatus_SSS_Success) {
-                status = sss_cipher_init(&aes->aes_ctx, (uint8_t *)aes->reg, sizeof(aes->reg));
-            }
-        }
-        if (status == kStatus_SSS_Success) {
-            status = sss_cipher_update(&aes->aes_ctx, in, sz, out, &sz);
+            status = sss_cipher_init(&aes->aes_ctx, (uint8_t*)aes->reg,
+                sizeof(aes->reg));
         }
     }
+    if (status == kStatus_SSS_Success) {
+        status = sss_cipher_update(&aes->aes_ctx, in, sz, out, &sz);
+    }
+
     wolfSSL_CryptHwMutexUnLock();
 
-    if (status != kStatus_SSS_Success) 
+    if (status != kStatus_SSS_Success)
         ret = WC_HW_E;
     return ret;
 }
@@ -298,46 +307,35 @@ void se050_aes_free(Aes* aes)
     sss_status_t    status;
     sss_key_store_t host_keystore;
     sss_object_t    keyObject;
-    aes->ctxInitDone = 0; /* sets back to zero to indicate that a free has been called */
 
-    if (wolfSSL_CryptHwMutexLock() == 0) {    
-        status = sss_key_store_context_init(&host_keystore, cfg_se050_i2c_pi);
-     
-        if (status == kStatus_SSS_Success) {
-            status = sss_key_store_allocate(&host_keystore, 55);
-        }
-
-        if (status == kStatus_SSS_Success) {
-            status = sss_key_object_init(&keyObject, &host_keystore);
-        }
-
-        if (status == kStatus_SSS_Success) {
-            status = sss_key_object_get_handle(&keyObject, aes->keyId);
-        }
-        sss_key_object_free(&keyObject);
-
-        sss_symmetric_context_free(&aes->aes_ctx);
+    /* sets back to zero to indicate that a free has been called */
+    aes->ctxInitDone = 0;
 
+    if (wolfSSL_CryptHwMutexLock() != 0) {
+        return BAD_MUTEX_E;
     }
+
+    status = sss_key_store_context_init(&host_keystore, cfg_se050_i2c_pi);
+
+    if (status == kStatus_SSS_Success) {
+        status = sss_key_store_allocate(&host_keystore, 55);
+    }
+
+    if (status == kStatus_SSS_Success) {
+        status = sss_key_object_init(&keyObject, &host_keystore);
+    }
+
+    if (status == kStatus_SSS_Success) {
+        status = sss_key_object_get_handle(&keyObject, aes->keyId);
+    }
+    sss_key_object_free(&keyObject);
+
+    sss_symmetric_context_free(&aes->aes_ctx);
+
     wolfSSL_CryptHwMutexUnLock();
 }
 
-#endif /* NO_AES */
-
-#ifdef WOLFSSL_SP_MATH
-    struct sp_int;
-    #define MATH_INT_T struct sp_int
-#elif defined(USE_FAST_MATH)
-    struct fp_int;
-    #define MATH_INT_T struct fp_int
-#else
-    struct mp_int;
-	#define MATH_INT_T struct mp_int
-#endif
-struct ecc_key;
-#include <wolfssl/wolfcrypt/ecc.h>
-#include <wolfssl/wolfcrypt/asn_public.h>
-
+#endif /* !NO_AES */
 
 #ifdef HAVE_ECC
 int se050_ecc_sign_hash_ex(const byte* in, word32 inLen, byte* out,
@@ -347,13 +345,11 @@ int se050_ecc_sign_hash_ex(const byte* in, word32 inLen, byte* out,
     sss_asymmetric_t    ctx_asymm;
     sss_key_store_t     host_keystore;
     sss_object_t        newKey;
-    sss_algorithm_t     algorithm;
-    XMEMSET(&algorithm, 0, sizeof(algorithm));
-
-    uint32_t    keyId = se050_allocate_key();
+    sss_algorithm_t     algorithm = kAlgorithm_None;
+    int         keyId = se050_allocate_key();
     int         keysize = (word32)key->dp->size;
     int         ret = BAD_MUTEX_E;
-    
+
     /* truncate if digest is larger than 64 */
     if (inLen > 64)
         inLen = 64;
@@ -369,73 +365,71 @@ int se050_ecc_sign_hash_ex(const byte* in, word32 inLen, byte* out,
     else if (inLen == 64)
         algorithm = kAlgorithm_SSS_SHA512;
 
-
-    if (wolfSSL_CryptHwMutexLock() == 0) {
-        ret = 0;
-        status = sss_key_store_context_init(&host_keystore, cfg_se050_i2c_pi);
-
-        if (status == kStatus_SSS_Success) {
-            status = sss_key_store_allocate(&host_keystore, 70);
-        }
-
-        if (status == kStatus_SSS_Success) {
-            status = sss_key_object_init(&newKey, &host_keystore);
-        }
-
-
-        if (status == kStatus_SSS_Success) {
-            status = sss_key_object_allocate_handle(&newKey, keyId, kSSS_KeyPart_Pair, 
-                                                kSSS_CipherType_EC_NIST_P, keysize, 
-                                                kKeyObject_Mode_Transient);
-        }
-
-        if (status == kStatus_SSS_Success) {
-            status = sss_key_store_generate_key(&host_keystore, &newKey,
-                                                    keysize * 8, NULL);
-        }
-
-        if (status == kStatus_SSS_Success) {
-            status = sss_asymmetric_context_init(&ctx_asymm, cfg_se050_i2c_pi,
-                                             &newKey, algorithm, kMode_SSS_Sign);
-        }
-
-        if (status == kStatus_SSS_Success) {
-            status = sss_asymmetric_sign_digest(&ctx_asymm, (uint8_t *)in, inLen,
-                                                                   out, outLen);
-        }
-        sss_asymmetric_context_free(&ctx_asymm);
-
-
+    if (wolfSSL_CryptHwMutexLock() != 0) {
+        return BAD_MUTEX_E;
     }
-    wolfSSL_CryptHwMutexUnLock();
-    
-    if (status != kStatus_SSS_Success) 
-        ret = WC_HW_E;
-    
-    key->keyId = keyId;
 
-    return ret;      
+    status = sss_key_store_context_init(&host_keystore, cfg_se050_i2c_pi);
+
+    if (status == kStatus_SSS_Success) {
+        status = sss_key_store_allocate(&host_keystore, 70);
+    }
+
+    if (status == kStatus_SSS_Success) {
+        status = sss_key_object_init(&newKey, &host_keystore);
+    }
+
+
+    if (status == kStatus_SSS_Success) {
+        status = sss_key_object_allocate_handle(&newKey, keyId,
+            kSSS_KeyPart_Pair, kSSS_CipherType_EC_NIST_P, keysize,
+            kKeyObject_Mode_Transient);
+    }
+
+    if (status == kStatus_SSS_Success) {
+        status = sss_key_store_generate_key(&host_keystore, &newKey,
+                                                keysize * 8, NULL);
+    }
+
+    if (status == kStatus_SSS_Success) {
+        status = sss_asymmetric_context_init(&ctx_asymm, cfg_se050_i2c_pi,
+                                            &newKey, algorithm, kMode_SSS_Sign);
+    }
+
+    if (status == kStatus_SSS_Success) {
+        status = sss_asymmetric_sign_digest(&ctx_asymm, (uint8_t *)in, inLen,
+                                                                out, outLen);
+    }
+    sss_asymmetric_context_free(&ctx_asymm);
+
+    wolfSSL_CryptHwMutexUnLock();
+
+    if (status == kStatus_SSS_Success) {
+        key->keyId = keyId;
+        ret = 0;
+    }
+    else {
+        ret = WC_HW_E;
+    }
+
+    return ret;
 }
 
 int se050_ecc_verify_hash_ex(const byte* hash, word32 hashLen, byte* signature,
                              word32 signatureLen, struct ecc_key* key, int* res)
 {
-    printf("runing verify!\n");
-
     sss_status_t        status;
     sss_asymmetric_t    ctx_asymm;
     sss_object_t        newKey;
     sss_key_store_t     host_keystore;
-    sss_algorithm_t     algorithm;
-
-    XMEMSET(&algorithm, 0, sizeof(algorithm));
-
+    sss_algorithm_t     algorithm = kAlgorithm_None;
     word32      derSz = 0;
-    int         ret = WC_HW_E;
-    byte*       derBuf;
-    uint32_t    keyId = rand();
+    int         ret;
     int         keySize = (word32)key->dp->size;
-                *res = 0;
+
+    WOLFSSL_MSG("se050_ecc_verify_hash_ex");
+
+    *res = 0;
 
     if (hashLen > 64)
         hashLen = 64;
@@ -451,99 +445,97 @@ int se050_ecc_verify_hash_ex(const byte* hash, word32 hashLen, byte* signature,
     else if (hashLen == 64)
         algorithm = kAlgorithm_SSS_SHA512;
 
-    printf("KeyId 3 = %d\n", key->keyId);
-    
-    if (wolfSSL_CryptHwMutexLock() == 0) {
-        if (key->keyId == 0) { //this is run when a key was not generated and was instead passed in
-            
-            ret = wc_EccKeyToPKCS8(key, NULL, &derSz);
-            if (ret != -202){
-                printf("first wc_EccKeyToPKCS8 failed\n");
-                return -1;
-            }
-            derBuf = (byte*)XMALLOC(derSz, NULL, DYNAMIC_TYPE_OPENSSL);
-            ret = wc_EccKeyToPKCS8(key, derBuf, &derSz);
-            if (ret <= 0){
-                printf("second wc_EccKeyToPKCS8 failed, ret = %d\n", ret);
-                return -1;
-            }
+    if (wolfSSL_CryptHwMutexLock() != 0) {
+        return BAD_MUTEX_E;
+    }
 
-            status = sss_key_store_context_init(&host_keystore, cfg_se050_i2c_pi);   
-  
-            if (status == kStatus_SSS_Success) {
-                status = sss_key_store_allocate(&host_keystore, 61);
-            }
+    /* this is run when a key was not generated and was instead passed in */
+    if (key->keyId == 0) {
+        int keyId = se050_allocate_key();
+        byte* derBuf = NULL;
 
-            if (status == kStatus_SSS_Success) {
-                status = sss_key_object_init(&newKey, &host_keystore);
-            }
-
-
-            if (status == kStatus_SSS_Success) {
-                status = sss_key_object_allocate_handle(&newKey, keyId, kSSS_KeyPart_Pair,
-                                                kSSS_CipherType_EC_NIST_P, derSz, 
-                                                kKeyObject_Mode_Transient);
-            }
-
-            if (status == kStatus_SSS_Success) {
-                status = sss_key_store_set_key(&host_keystore, &newKey, derBuf,
-                                                derSz, keySize * 8, NULL, 0);
-            }
-
-            if (status == kStatus_SSS_Success) {
-                status = sss_asymmetric_context_init(&ctx_asymm, cfg_se050_i2c_pi,
-                                            &newKey, algorithm, kMode_SSS_Verify);
-            }
-
-            printf("ran through inital key setup !\n");
-
-
-            if (status == kStatus_SSS_Success) {
-                status = sss_asymmetric_verify_digest(&ctx_asymm, (uint8_t *)hash,
-                                               hashLen, signature, signatureLen);
-            }
-
-            sss_asymmetric_context_free(&ctx_asymm);
-            printf("sss_asymmetric_verify_digest with set key worked!\n\n\n");
-
-        }
-        else if (key->keyId != 0) { //this is run after a sign function has taken place
-            ret = 0;
-            
-            status = sss_key_store_context_init(&host_keystore, cfg_se050_i2c_pi);
-
-            if (status == kStatus_SSS_Success)
-                status = sss_key_store_allocate(&host_keystore, 60);
-
-            if (status == kStatus_SSS_Success)
-                status = sss_key_object_init(&newKey, &host_keystore);
-
-            if (status == kStatus_SSS_Success)
-                status = sss_key_object_get_handle(&newKey, key->keyId);
-            
-            if (status == kStatus_SSS_Success) {
-                status = sss_asymmetric_context_init(&ctx_asymm, cfg_se050_i2c_pi,
-                                            &newKey, algorithm, kMode_SSS_Verify);
-            }
-                
-            if (status == kStatus_SSS_Success) {
-                status = sss_asymmetric_verify_digest(&ctx_asymm, (uint8_t *)hash, 
-                                               hashLen, signature, signatureLen);
-            }
-
-            sss_asymmetric_context_free(&ctx_asymm);
+        ret = wc_EccKeyToPKCS8(key, NULL, &derSz);
+        if (ret != LENGTH_ONLY_E) {
+            return ret;
         }
 
+        derBuf = (byte*)XMALLOC(derSz, NULL, DYNAMIC_TYPE_TMP_BUFFER);
+        if (derBuf == NULL) {
+            return MEMORY_E;
+        }
+        ret = wc_EccKeyToPKCS8(key, derBuf, &derSz);
+        if (ret <= 0) {
+            XFREE(derBuf, NULL, DYNAMIC_TYPE_TMP_BUFFER);
+            return ret;
+        }
+
+        status = sss_key_store_context_init(&host_keystore, cfg_se050_i2c_pi);
+        if (status == kStatus_SSS_Success) {
+            status = sss_key_store_allocate(&host_keystore, 61);
+        }
+        if (status == kStatus_SSS_Success) {
+            status = sss_key_object_init(&newKey, &host_keystore);
+        }
+        if (status == kStatus_SSS_Success) {
+            status = sss_key_object_allocate_handle(&newKey, keyId,
+                kSSS_KeyPart_Pair, kSSS_CipherType_EC_NIST_P, derSz,
+                kKeyObject_Mode_Transient);
+        }
+        if (status == kStatus_SSS_Success) {
+            status = sss_key_store_set_key(&host_keystore, &newKey, derBuf,
+                                            derSz, keySize * 8, NULL, 0);
+        }
+        if (derBuf) {
+            XFREE(derBuf, NULL, DYNAMIC_TYPE_TMP_BUFFER);
+        }
+
+        if (status == kStatus_SSS_Success) {
+            status = sss_asymmetric_context_init(&ctx_asymm, cfg_se050_i2c_pi,
+                                        &newKey, algorithm, kMode_SSS_Verify);
+        }
+        if (status == kStatus_SSS_Success) {
+            status = sss_asymmetric_verify_digest(&ctx_asymm, (uint8_t *)hash,
+                                            hashLen, signature, signatureLen);
+        }
+
+        sss_asymmetric_context_free(&ctx_asymm);
+
+        key->keyId = keyId;
+    }
+    /* this is run after a sign function has taken place */
+    else if (key->keyId != 0) {
+        status = sss_key_store_context_init(&host_keystore, cfg_se050_i2c_pi);
+
+        if (status == kStatus_SSS_Success) {
+            status = sss_key_store_allocate(&host_keystore, 60);
+        }
+        if (status == kStatus_SSS_Success) {
+            status = sss_key_object_init(&newKey, &host_keystore);
+        }
+        if (status == kStatus_SSS_Success) {
+            status = sss_key_object_get_handle(&newKey, key->keyId);
+        }
+        if (status == kStatus_SSS_Success) {
+            status = sss_asymmetric_context_init(&ctx_asymm, cfg_se050_i2c_pi,
+                                        &newKey, algorithm, kMode_SSS_Verify);
+        }
+        if (status == kStatus_SSS_Success) {
+            status = sss_asymmetric_verify_digest(&ctx_asymm, (uint8_t *)hash,
+                                            hashLen, signature, signatureLen);
+        }
+
+        sss_asymmetric_context_free(&ctx_asymm);
     }
     wolfSSL_CryptHwMutexUnLock();
 
-    if (status != kStatus_SSS_Success) 
+    if (status == kStatus_SSS_Success) {
+        *res = 1;
+        ret = 0;
+    }
+    else {
         ret = WC_HW_E;
+    }
 
-    printf("ran verify correctly!!\n\n\n");
-
-
-    *res = 1;
     return 0;
 }
 
@@ -555,89 +547,93 @@ int se050_ecc_free_key(struct ecc_key* key)
     int             ret = WC_HW_E;
     sss_key_store_t host_keystore;
 
-    /* less tha 10,000 as one example from test.c tried to free a key that was not created on the SE050 */
-    if(key->keyId != 0 && key->keyId < 10000) {
-        if (wolfSSL_CryptHwMutexLock() == 0) {
-            ret = 0;
-
-            status = sss_key_store_context_init(&host_keystore, cfg_se050_i2c_pi);
-
-            if (status == kStatus_SSS_Success)
-                status = sss_key_store_allocate(&host_keystore, 60);
-
-            if (status == kStatus_SSS_Success)
-                status = sss_key_object_init(&keyObject, &host_keystore);
-
-            if (status == kStatus_SSS_Success)
-                status = sss_key_object_get_handle(&keyObject, key->keyId);
-
-            if (status == kStatus_SSS_Success)
-                    sss_key_object_free(&keyObject);
-        }
+    if (key->keyId <= 0) {
+        return BAD_FUNC_ARG;
     }
-    wolfSSL_CryptHwMutexUnLock();   
 
-    if (status != kStatus_SSS_Success)
+    if (wolfSSL_CryptHwMutexLock() != 0) {
+        return BAD_MUTEX_E;
+    }
+
+    status = sss_key_store_context_init(&host_keystore, cfg_se050_i2c_pi);
+
+    if (status == kStatus_SSS_Success) {
+        status = sss_key_store_allocate(&host_keystore, 60);
+    }
+    if (status == kStatus_SSS_Success) {
+        status = sss_key_object_init(&keyObject, &host_keystore);
+    }
+    if (status == kStatus_SSS_Success) {
+        status = sss_key_object_get_handle(&keyObject, key->keyId);
+    }
+    if (status == kStatus_SSS_Success) {
+        sss_key_object_free(&keyObject);
+    }
+    wolfSSL_CryptHwMutexUnLock();
+
+    if (status != kStatus_SSS_Success) {
         ret = WC_CLEANUP_E;
+    }
 
     return ret;
 }
 
-int se050_ecc_create_key(struct ecc_key* key, int keyId, int keySize)
+int se050_ecc_create_key(struct ecc_key* key, int curve_id, int keySize)
 {
-    sss_status_t            status = kStatus_SSS_Success;
-    sss_object_t            keyPair;
-    sss_key_store_t         host_keystore;
-    
-    uint8_t keyPairExport[128];
-    size_t keyPairExportLen               = sizeof(keyPairExport);
-    size_t keyPairExportBitLen            = sizeof(keyPairExport) * 8;
-    int ret = WC_HW_E;
+    sss_status_t    status = kStatus_SSS_Success;
+    sss_object_t    keyPair;
+    sss_key_store_t host_keystore;
+    int keyId = se050_allocate_key();
+    uint8_t keyPairExport[MAX_ECC_BYTES];
+    size_t keyPairExportLen = sizeof(keyPairExport);
+    size_t keyPairExportBitLen = sizeof(keyPairExport) * 8;
+    int ret;
 
+    (void)curve_id;
 
-    if (wolfSSL_CryptHwMutexLock() == 0) {
-        ret = 0;
-
-        status = sss_key_store_context_init(&host_keystore, cfg_se050_i2c_pi);     
-        if (status == kStatus_SSS_Success) {
-            status = sss_key_store_allocate(&host_keystore, 60);
-        }
-
-        if (status == kStatus_SSS_Success) {
-            status = sss_key_object_init(&keyPair, &host_keystore);
-        }
-
-
-        if (status == kStatus_SSS_Success) {
-            status = sss_key_object_allocate_handle(&keyPair, keyId, kSSS_KeyPart_Pair,
-                                            kSSS_CipherType_EC_NIST_P, 256, 
-                                            kKeyObject_Mode_None); //kKeyObject_Mode_Transient
-        }
-
-        if (status == kStatus_SSS_Success) {
-            status = sss_key_store_generate_key(&host_keystore, &keyPair, 256, NULL);
-        }
-
-
-        if (status == kStatus_SSS_Success) {
-            status = sss_key_store_get_key(&host_keystore, &keyPair, keyPairExport,
-                                         &keyPairExportLen, &keyPairExportBitLen);
-        }
+    if (wolfSSL_CryptHwMutexLock() != 0) {
+        return BAD_MUTEX_E;
     }
-    wolfSSL_CryptHwMutexUnLock();   
 
-    if (status != kStatus_SSS_Success)
-        ret = WC_CLEANUP_E;
+    status = sss_key_store_context_init(&host_keystore, cfg_se050_i2c_pi);
+    if (status == kStatus_SSS_Success) {
+        status = sss_key_store_allocate(&host_keystore, 60);
+    }
+    if (status == kStatus_SSS_Success) {
+        status = sss_key_object_init(&keyPair, &host_keystore);
+    }
+    if (status == kStatus_SSS_Success) {
+        status = sss_key_object_allocate_handle(&keyPair, keyId,
+            kSSS_KeyPart_Pair, kSSS_CipherType_EC_NIST_P, 256,
+            kKeyObject_Mode_None);
+    }
+    if (status == kStatus_SSS_Success) {
+        status = sss_key_store_generate_key(&host_keystore, &keyPair,
+            256, NULL);
+    }
+    if (status == kStatus_SSS_Success) {
+        status = sss_key_store_get_key(&host_keystore, &keyPair,
+            keyPairExport, &keyPairExportLen, &keyPairExportBitLen);
+    }
 
-    mp_read_unsigned_bin(key->pubkey.x, keyPairExport, keySize);
-    mp_read_unsigned_bin(key->pubkey.y, keyPairExport + keySize, keySize);
+    wolfSSL_CryptHwMutexUnLock();
+
+    if (status == kStatus_SSS_Success) {
+        mp_read_unsigned_bin(key->pubkey.x, keyPairExport, keySize);
+        mp_read_unsigned_bin(key->pubkey.y, keyPairExport + keySize, keySize);
+        key->keyId = keyId;
+        ret = 0;
+    }
+    else {
+        ret = WC_HW_E;
+    }
 
     return ret;
 }
 
 
-int se050_ecc_shared_secret(ecc_key* private_key, ecc_key* public_key, byte* out,
-                      word32* outlen)
+int se050_ecc_shared_secret(ecc_key* private_key, ecc_key* public_key,
+    byte* out, word32* outlen)
 {
     sss_status_t            status = kStatus_SSS_Success;
     sss_key_store_t         host_keystore;
@@ -646,90 +642,88 @@ int se050_ecc_shared_secret(ecc_key* private_key, ecc_key* public_key, byte* out
     sss_object_t            ref_public_key;
     sss_object_t            deriveKey;
     sss_derive_key_t        ctx_derive_key;
-    int                     keyId = se050_allocate_key();
+    int                     keyId;
     int                     keySize = (word32)public_key->dp->size;
     size_t                  ecdhKeyLen = keySize;
     size_t                  ecdhKeyBitLen = keySize;
     int                     ret = WC_HW_E;
-
     
-    if (public_key->keyId == 0) {
-        public_key->keyId = se050_allocate_key();
-        se050_ecc_create_key(public_key, public_key->keyId, keySize);
-
-    }
-    if (private_key->keyId == 0) {
-        private_key->keyId = se050_allocate_key();
-        se050_ecc_create_key(private_key, private_key->keyId, keySize);
+    if (private_key->keyId <= 0 || public_key->keyId <= 0) {
+        return BAD_FUNC_ARG;
     }
 
-    if (wolfSSL_CryptHwMutexLock() == 0) {
+    if (wolfSSL_CryptHwMutexLock() != 0) {
+        return BAD_MUTEX_E;
+    }
+
+    status = sss_key_store_context_init(&host_keystore, cfg_se050_i2c_pi);
+    if (status == kStatus_SSS_Success) {
+        status = sss_key_store_allocate(&host_keystore, 60);
+    }
+
+    if (status == kStatus_SSS_Success) {
+        status = sss_key_object_init(&ref_public_key, &host_keystore);
+    }
+
+    if (status == kStatus_SSS_Success) {
+        status = sss_key_object_get_handle(&ref_public_key, public_key->keyId);
+    }
+
+    if (status == kStatus_SSS_Success) {
+        status = sss_key_store_context_init(&host_keystore_2, cfg_se050_i2c_pi);
+    }
+
+    if (status == kStatus_SSS_Success) {
+        status = sss_key_store_allocate(&host_keystore_2, 60);
+    }
+
+    if (status == kStatus_SSS_Success) {
+        status = sss_key_object_init(&ref_private_key, &host_keystore_2);
+    }
+
+    if (status == kStatus_SSS_Success) {
+        status = sss_key_object_get_handle(&ref_private_key, private_key->keyId);
+    }
+
+    if (status == kStatus_SSS_Success) {
+        status = sss_key_object_init(&deriveKey, hostKeyStore);
+    }
+
+    if (status == kStatus_SSS_Success) {
+        keyId = se050_allocate_key();
+
+        status = sss_key_object_allocate_handle(&deriveKey,
+            keyId,
+            kSSS_KeyPart_Default,
+            kSSS_CipherType_AES,
+            ecdhKeyLen,
+            kKeyObject_Mode_Transient);
+    }
+
+    if (status == kStatus_SSS_Success) {
+        status = sss_derive_key_context_init(&ctx_derive_key, cfg_se050_i2c_pi,
+                                    &ref_private_key, kAlgorithm_SSS_ECDH,
+                                    kMode_SSS_ComputeSharedSecret);
+    }
+
+    if (status == kStatus_SSS_Success) {
+        status = sss_derive_key_dh(&ctx_derive_key, &ref_public_key, &deriveKey);
+    }
+
+    if (status == kStatus_SSS_Success) {
+        status = sss_key_store_get_key(hostKeyStore, &deriveKey, out, outlen,
+                                                                &ecdhKeyBitLen);
+    }
+    if (ctx_derive_key.session != NULL)
+        sss_derive_key_context_free(&ctx_derive_key);
+    if (deriveKey.keyStore != NULL)
+        sss_key_object_free(&deriveKey);
+
+    if (status == kStatus_SSS_Success)
         ret = 0;
-        status = sss_key_store_context_init(&host_keystore, cfg_se050_i2c_pi);
-    
-        if (status == kStatus_SSS_Success) {
-            status = sss_key_store_allocate(&host_keystore, 60);
-        }
+    else
+        ret = WC_HW_E;
 
-        if (status == kStatus_SSS_Success) {
-            status = sss_key_object_init(&ref_public_key, &host_keystore);
-        }
-
-        if (status == kStatus_SSS_Success) {
-            status = sss_key_object_get_handle(&ref_public_key, public_key->keyId);
-        }
-
-        if (status == kStatus_SSS_Success) {
-            status = sss_key_store_context_init(&host_keystore_2, cfg_se050_i2c_pi);     
-        }
-
-        if (status == kStatus_SSS_Success) {
-            status = sss_key_store_allocate(&host_keystore_2, 60);
-        }
-
-        if (status == kStatus_SSS_Success) {
-            status = sss_key_object_init(&ref_private_key, &host_keystore_2);
-        }
-
-        if (status == kStatus_SSS_Success) {
-            status = sss_key_object_get_handle(&ref_private_key, private_key->keyId);
-        }
-
-        if (status == kStatus_SSS_Success) {
-            status = sss_key_object_init(&deriveKey, hostKeyStore);
-        }
-
-        if (status == kStatus_SSS_Success) {
-            status = sss_key_object_allocate_handle(&deriveKey,
-                keyId,
-                kSSS_KeyPart_Default, //try kSSS_KeyPart_Part, didn't have any noticable changes
-                kSSS_CipherType_AES,
-                ecdhKeyLen,
-                kKeyObject_Mode_Transient); //try kKeyObject_Mode_None
-        }    
-        
-        if (status == kStatus_SSS_Success) {
-            status = sss_derive_key_context_init(&ctx_derive_key, cfg_se050_i2c_pi,
-                                        &ref_private_key, kAlgorithm_SSS_ECDH,
-                                        kMode_SSS_ComputeSharedSecret);
-        }
-
-        if (status == kStatus_SSS_Success) {
-            status = sss_derive_key_dh(&ctx_derive_key, &ref_public_key, &deriveKey);
-        }
-
-        if (status == kStatus_SSS_Success) {
-            status = sss_key_store_get_key(hostKeyStore, &deriveKey, out, outlen,
-                                                                 &ecdhKeyBitLen);
-        }
-        if (ctx_derive_key.session != NULL)
-            sss_derive_key_context_free(&ctx_derive_key);
-        if (deriveKey.keyStore != NULL)
-            sss_key_object_free(&deriveKey);
-
-        if (status != kStatus_SSS_Success) 
-            ret = WC_HW_E;
-    }
     wolfSSL_CryptHwMutexUnLock();
 
     return ret;
@@ -738,190 +732,187 @@ int se050_ecc_shared_secret(ecc_key* private_key, ecc_key* public_key, byte* out
 
 #ifdef HAVE_ED25519
 
-
 int se050_ed25519_create_key(ed25519_key* key)
 {
-    printf("\n\nrunning se050_ed25519_create_key\n");
     sss_status_t    status;
     sss_key_store_t host_keystore;
     sss_object_t    newKey;
     int             keysize = ED25519_KEY_SIZE;
-    uint32_t        keyId = se050_allocate_key();
-                    key->keyId = keyId;
+    int             keyId;
     int             ret = 0;
 
-    if (wolfSSL_CryptHwMutexLock() == 0) {
-        status = sss_key_store_context_init(&host_keystore, cfg_se050_i2c_pi);     
-
-        if (status == kStatus_SSS_Success) {
-            status = sss_key_store_allocate(&host_keystore, 55);
-        }
-
-        if (status == kStatus_SSS_Success) {
-            status = sss_key_object_init(&newKey, &host_keystore);
-        }
-
-        if (status == kStatus_SSS_Success) {
-            status = sss_key_object_allocate_handle(&newKey, keyId, kSSS_KeyPart_Pair, 
-                                                kSSS_CipherType_EC_TWISTED_ED, keysize, 
-                                                kKeyObject_Mode_Transient);
-        }
-
-        if (status == kStatus_SSS_Success) {
-            status = sss_key_store_generate_key(&host_keystore, &newKey, keysize * 8, NULL);
-        }
-
-        if (status != kStatus_SSS_Success) {
-            sss_key_object_free(&newKey);
-            ret = WC_HW_E;
-        }
-
+    if (wolfSSL_CryptHwMutexLock() != 0) {
+        return BAD_MUTEX_E;
     }
+
+    status = sss_key_store_context_init(&host_keystore, cfg_se050_i2c_pi);
+    if (status == kStatus_SSS_Success) {
+        status = sss_key_store_allocate(&host_keystore, 55);
+    }
+
+    if (status == kStatus_SSS_Success) {
+        status = sss_key_object_init(&newKey, &host_keystore);
+    }
+
+    if (status == kStatus_SSS_Success) {
+        keyId = se050_allocate_key();
+        status = sss_key_object_allocate_handle(&newKey, keyId,
+            kSSS_KeyPart_Pair, kSSS_CipherType_EC_TWISTED_ED, keysize,
+            kKeyObject_Mode_Transient);
+    }
+
+    if (status == kStatus_SSS_Success) {
+        status = sss_key_store_generate_key(&host_keystore, &newKey,
+            keysize * 8, NULL);
+    }
+
+    if (status == kStatus_SSS_Success) {
+        key->keyId = keyId;
+        ret = 0;
+    }
+    else {
+        sss_key_object_free(&newKey);
+        ret = WC_HW_E;
+    }
+
     wolfSSL_CryptHwMutexUnLock();
 
-
-    printf("ran se050_ed25519_create_key\n\n\n");
     return ret;
 }
 
 void se050_ed25519_free_key(ed25519_key* key)
 {
-        sss_status_t status;
-        sss_object_t newKey;
-        sss_key_store_t host_keystore;
+    sss_status_t status;
+    sss_object_t newKey;
+    sss_key_store_t host_keystore;
 
-        if (wolfSSL_CryptHwMutexLock() == 0) {
+    if (wolfSSL_CryptHwMutexLock() != 0) {
+        return BAD_MUTEX_E;
+    }
 
-            status = sss_key_store_context_init(&host_keystore, cfg_se050_i2c_pi); 
-    
-            if (status == kStatus_SSS_Success) {
-                status = sss_key_store_allocate(&host_keystore, 60);
-            }
-            if (status == kStatus_SSS_Success) {
-                status = sss_key_object_init(&newKey, &host_keystore);
-            }
-            if (status == kStatus_SSS_Success) {
-                status = sss_key_object_get_handle(&newKey, key->keyId);
-            }
-            if (status == kStatus_SSS_Success) {
-                sss_key_object_free(&newKey);
-            }
-        }
-        wolfSSL_CryptHwMutexUnLock();
+    status = sss_key_store_context_init(&host_keystore, cfg_se050_i2c_pi);
+
+    if (status == kStatus_SSS_Success) {
+        status = sss_key_store_allocate(&host_keystore, 55);
+    }
+    if (status == kStatus_SSS_Success) {
+        status = sss_key_object_init(&newKey, &host_keystore);
+    }
+    if (status == kStatus_SSS_Success) {
+        status = sss_key_object_get_handle(&newKey, key->keyId);
+    }
+    if (status == kStatus_SSS_Success) {
+        sss_key_object_free(&newKey);
+    }
+    wolfSSL_CryptHwMutexUnLock();
 }
 
-
 int se050_ed25519_sign_msg(const byte* in, word32 inLen, byte* out,
                          word32 *outLen, ed25519_key* key)
 {
-    printf("\n\nhit se050_ed25519_sign_msg...\n");
     sss_status_t        status = kStatus_SSS_Success;
     sss_asymmetric_t    ctx_asymm;
-    sss_key_store_t     host_keystore; 
+    sss_key_store_t     host_keystore;
     sss_object_t        newKey;
     int                 ret = 0;
-                        inLen = 64;
-                        *outLen = 64;
 
-    /* used to fix edge case when ed25519_init is not called prior to signing */
-    /* figure out if needed or not for -10801 */
-    if (key->keyId > 10000 || key->keyId == 0) { 
-        key->keyId = se050_allocate_key();
-        ret = se050_ed25519_create_key(key);
-        if (ret != 0) {
-            printf("calling se050_ed25519_create_key failed..., ret = %d\n", ret);
-        }
+    inLen = 64;
+    *outLen = 64;
 
+    if (wolfSSL_CryptHwMutexLock() != 0) {
+        return BAD_MUTEX_E;
     }
 
-    if (wolfSSL_CryptHwMutexLock() == 0 && ret == 0) {
-        status = sss_key_store_context_init(&host_keystore, cfg_se050_i2c_pi);     
+    status = sss_key_store_context_init(&host_keystore, cfg_se050_i2c_pi);
 
-        if (status == kStatus_SSS_Success) {
-            status = sss_key_store_allocate(&host_keystore, 60);
-        }
-
-        if (status == kStatus_SSS_Success) {
-            status = sss_key_object_init(&newKey, &host_keystore);
-        }
-
-        if (status == kStatus_SSS_Success) {
-            status = sss_key_object_get_handle(&newKey, key->keyId);
-        }
-
-        if (status == kStatus_SSS_Success) {
-            status = sss_asymmetric_context_init(&ctx_asymm, cfg_se050_i2c_pi, 
-                                &newKey, kAlgorithm_SSS_SHA512, kMode_SSS_Sign);
-        }
-
-        if (status == kStatus_SSS_Success) {
-            status = sss_se05x_asymmetric_sign((sss_se05x_asymmetric_t *)&ctx_asymm,
-                                             (uint8_t *)in, inLen, out, outLen);
-        }
-
-        if(status != kStatus_SSS_Success){
-            printf("status != kStatus_SSS_Success, status = %d\n", status);
-            sss_key_object_free(&newKey);
-            ret = WC_HW_E;
-        }
-        sss_asymmetric_context_free(&ctx_asymm);
+    if (status == kStatus_SSS_Success) {
+        status = sss_key_store_allocate(&host_keystore, 55);
     }
+
+    if (status == kStatus_SSS_Success) {
+        status = sss_key_object_init(&newKey, &host_keystore);
+    }
+
+    if (status == kStatus_SSS_Success) {
+        status = sss_key_object_get_handle(&newKey, key->keyId);
+    }
+
+    if (status == kStatus_SSS_Success) {
+        status = sss_asymmetric_context_init(&ctx_asymm, cfg_se050_i2c_pi,
+                            &newKey, kAlgorithm_SSS_SHA512, kMode_SSS_Sign);
+    }
+
+    if (status == kStatus_SSS_Success) {
+        status = sss_se05x_asymmetric_sign((sss_se05x_asymmetric_t *)&ctx_asymm,
+                                            (uint8_t *)in, inLen, out, outLen);
+    }
+
+    sss_asymmetric_context_free(&ctx_asymm);
+
+    if (status != kStatus_SSS_Success) {
+        sss_key_object_free(&newKey);
+        ret = WC_HW_E;
+    }
+
     wolfSSL_CryptHwMutexUnLock();
 
-    return ret;      
+    return ret;
 }
 
 
-int se050_ed25519_verify_msg(const byte* signature, word32 signatureLen, const byte* msg,
-                             word32 msgLen, struct ed25519_key* key, int* res)
+int se050_ed25519_verify_msg(const byte* signature, word32 signatureLen,
+    const byte* msg, word32 msgLen, struct ed25519_key* key, int* res)
 {
-    printf("runing se050_ed25519_verify_msg!\n");
-
     sss_status_t        status = kStatus_SSS_Success;
     sss_asymmetric_t    ctx_asymm;
     sss_object_t        newKey;
     sss_key_store_t     host_keystore;
     int                 ret = 0;
-                        msgLen = 64;
-                        *res = 1;
 
-    if (wolfSSL_CryptHwMutexLock() == 0) {
-            status = sss_key_store_context_init(&host_keystore, cfg_se050_i2c_pi);
+    msgLen = 64;
 
-            if (status == kStatus_SSS_Success) {
-                status = sss_key_store_allocate(&host_keystore, 61);
-            }
-
-            if (status == kStatus_SSS_Success) {
-                status = sss_key_object_init(&newKey, &host_keystore);
-            }
-
-            if (status == kStatus_SSS_Success) {
-                status = sss_key_object_get_handle(&newKey, key->keyId);
-            }
-
-            if (status == kStatus_SSS_Success) {
-                status = sss_asymmetric_context_init(&ctx_asymm, cfg_se050_i2c_pi, 
-                            &newKey, kAlgorithm_SSS_SHA512, kMode_SSS_Verify);
-            }
-
-            if (status == kStatus_SSS_Success) {
-                status = sss_se05x_asymmetric_verify((sss_se05x_asymmetric_t *)&ctx_asymm,
-                                             (uint8_t *)msg, msgLen, 
-                                             (uint8_t *)signature, (size_t)signatureLen);
-            }
-
-            sss_asymmetric_context_free(&ctx_asymm);
+    if (wolfSSL_CryptHwMutexLock() != 0) {
+        return BAD_MUTEX_E;
     }
+
+    status = sss_key_store_context_init(&host_keystore, cfg_se050_i2c_pi);
+
+    if (status == kStatus_SSS_Success) {
+        status = sss_key_store_allocate(&host_keystore, 61);
+    }
+
+    if (status == kStatus_SSS_Success) {
+        status = sss_key_object_init(&newKey, &host_keystore);
+    }
+
+    if (status == kStatus_SSS_Success) {
+        status = sss_key_object_get_handle(&newKey, key->keyId);
+    }
+
+    if (status == kStatus_SSS_Success) {
+        status = sss_asymmetric_context_init(&ctx_asymm, cfg_se050_i2c_pi,
+                    &newKey, kAlgorithm_SSS_SHA512, kMode_SSS_Verify);
+    }
+
+    if (status == kStatus_SSS_Success) {
+        status = sss_se05x_asymmetric_verify(
+                (sss_se05x_asymmetric_t*)&ctx_asymm, (uint8_t*)msg, msgLen,
+                (uint8_t*)signature, (size_t)signatureLen);
+    }
+
+    sss_asymmetric_context_free(&ctx_asymm);
+
     wolfSSL_CryptHwMutexUnLock();
 
-    if (status != kStatus_SSS_Success) {
+    if (status == kStatus_SSS_Success) {
+        *res = 1;
+    }
+    else {
         ret = WC_HW_E;
-        *res = 0;
     }
     return ret;
 }
 
 #endif /* HAVE_ED25519 */
 
-#endif /* SE050 */
+#endif /* WOLFSSL_SE050 */
diff --git a/wolfcrypt/src/random.c b/wolfcrypt/src/random.c
index 41e0f682a..722e49a1d 100644
--- a/wolfcrypt/src/random.c
+++ b/wolfcrypt/src/random.c
@@ -2582,7 +2582,7 @@ int wc_GenerateSeed(OS_Seed* os, byte* output, word32 sz)
         
         (void)os;
         
-        if(output == NULL) {
+        if (output == NULL) {
             return BUFFER_E;
         }
         ret = wolfSSL_CryptHwMutexLock();
diff --git a/wolfcrypt/src/sha.c b/wolfcrypt/src/sha.c
index 925519168..3952200c1 100644
--- a/wolfcrypt/src/sha.c
+++ b/wolfcrypt/src/sha.c
@@ -347,7 +347,6 @@
         (void)devId;
 
         return se050_hash_init(&sha->se050Ctx, heap);
-
     }
 
     int wc_ShaUpdate(wc_Sha* sha, const byte* data, word32 len)
diff --git a/wolfcrypt/src/sha512.c b/wolfcrypt/src/sha512.c
index 558325832..13aef4ba0 100644
--- a/wolfcrypt/src/sha512.c
+++ b/wolfcrypt/src/sha512.c
@@ -49,6 +49,10 @@
     #include <wolfssl/wolfcrypt/cryptocb.h>
 #endif
 
+#ifdef WOLFSSL_SE050
+    #include <wolfssl/wolfcrypt/port/nxp/se050_port.h>
+#endif
+
 /* deprecated USE_SLOW_SHA2 (replaced with USE_SLOW_SHA512) */
 #if defined(USE_SLOW_SHA2) && !defined(USE_SLOW_SHA512)
     #define USE_SLOW_SHA512
@@ -200,7 +204,6 @@
     /* functions defined in wolfcrypt/src/port/kcapi/kcapi_hash.c */
 
 #elif defined(WOLFSSL_SE050)
-    //#include <wolfssl/wolfcrypt/port/nxp/se050_port.h>
     int wc_InitSha512(wc_Sha512* sha512)
     {
         if (sha512 == NULL)
@@ -224,17 +227,31 @@
     int wc_Sha512Final(wc_Sha512* sha512, byte* hash)
     {
         int ret = 0;
+        int devId = INVALID_DEVID;
+        if (sha512 == NULL) {
+            return BAD_FUNC_ARG;
+        }
+    #ifdef WOLF_CRYPTO_CB
+        devId = sha512->devId;
+    #endif
         ret = se050_hash_final(&sha512->se050Ctx, hash, WC_SHA512_DIGEST_SIZE,
                                kAlgorithm_SSS_SHA512);
-        (void)wc_InitSha512_ex(sha512);
+        (void)wc_InitSha512_ex(sha512, sha512->heap, devId);
         return ret;
     }
     int wc_Sha512FinalRaw(wc_Sha512* sha512, byte* hash)
     {
         int ret = 0;
+        int devId = INVALID_DEVID;
+        if (sha512 == NULL) {
+            return BAD_FUNC_ARG;
+        }
+    #ifdef WOLF_CRYPTO_CB
+        devId = sha512->devId;
+    #endif
         ret = se050_hash_final(&sha512->se050Ctx, hash, WC_SHA512_DIGEST_SIZE,
                                kAlgorithm_SSS_SHA512);
-        (void)wc_InitSha512(sha512);
+        (void)wc_InitSha512_ex(sha512, sha512->heap, devId);
         return ret;
     }
     void wc_Sha512Free(wc_Sha512* sha512)
@@ -948,6 +965,7 @@ int wc_Sha512Update(wc_Sha512* sha512, const byte* data, word32 len)
 
 #else
 
+#ifndef WOLFSSL_SE050
 static WC_INLINE int Sha512Final(wc_Sha512* sha512)
 {
     byte* local = (byte*)sha512->buffer;
@@ -1207,6 +1225,7 @@ int wc_Sha512Transform(wc_Sha512* sha, const unsigned char* data)
 }
 #endif /* OPENSSL_EXTRA */
 #endif /* WOLFSSL_SHA512 */
+#endif /* WOLFSSL_SE050 */
 
 /* -------------------------------------------------------------------------- */
 /* SHA384 */
@@ -1217,8 +1236,6 @@ int wc_Sha512Transform(wc_Sha512* sha, const unsigned char* data)
     !defined(WOLFSSL_QNX_CAAM)
     /* functions defined in wolfcrypt/src/port/caam/caam_sha.c */
 #elif defined(WOLFSSL_SE050)
-    #include <wolfssl/wolfcrypt/port/nxp/se050_port.h>
-    
     int wc_InitSha384_ex(wc_Sha384* sha384, void* heap, int devId)
     {
         if (sha384 == NULL) {
diff --git a/wolfssl/wolfcrypt/port/nxp/README.md b/wolfssl/wolfcrypt/port/nxp/README.md
deleted file mode 100644
index 1e1e37bf3..000000000
--- a/wolfssl/wolfcrypt/port/nxp/README.md
+++ /dev/null
@@ -1,68 +0,0 @@
-
-# NXP Ports
-
-Support for the NXP DCP, KSDK and SE050 hardware acceleration boards. 
-
-## NXP SE050
-Support for the SE050 on-board crypto hardware acceleration for symmetric AES, SHA1/SHA256/SHA384/SHA512, ECC (including ed25519) and RNG. **(discuss p-256 ECC)**
-
-## SE050 Acceleration
-For details about SE050 HW acceleration, see [NXP's SE050 page](https://www.nxp.com/products/security-and-authentication/authentication/edgelock-se050-plug-trust-secure-element-family-enhanced-iot-security-with-maximum-flexibility:SE050).
-
-## Building
-
-To enable support run:
-```
-./configure --with-se050=PATH
-```
-Followed by:
-```
-make && make install
-```
-With PATH being the directory location of simw-top.
-
-The code required to communicate with the SE050 can be found at this NXP [link](https://www.nxp.com/products/security-and-authentication/authentication/edgelock-se050-plug-trust-secure-element-family-enhanced-iot-security-with-maximum-flexibility:SE050?tab=Design_Tools_Tab) (An NXP account is required to download). Follow the instructions [here](https://www.nxp.com/docs/en/application-note/AN12570.pdf) to install and setup with a Raspberry Pi. 
-Confirm that you are able to run the examples from the 
-```
-/simw-top_build/raspbian_native_se050_t1oi2c/bin/
-```
-directory. Once that's done, it's time to modify one of those examples in order to tie into wolfSSL. 
-The ``./se05x_Minimal `` is the easiest one to modify. Open the ``simw-top/demos/se05x/se05x_Minimal `` directory and edit ``se05x_Minimal.c``. Add these headers to source file:
-```
-#include <wolfssl/options.h>
-#include <wolfssl/wolfcrypt/types.h>
-#include <wolfssl/wolfcrypt/port/nxp/se050_port.h>
-``` 
-If you would like to run our wolfcrypt test or  benchmark tool, add:
-``#include "test.h"`` or ``#include benchmark.h``, respectively. Below is the code that was replaced in ``ex_sss_entry()`` that ran the wolfcrypt test:
-```
-    sss_status_t status = kStatus_SSS_Success;
-    int ret;
-    
-    sss_session_t *pSession2 = (sss_session_t *)&pCtx->session;
-    sss_key_store_t *pHostSession = (sss_key_store_t *)&pCtx->host_ks;
-
-    LOG_I("running setconfig");
-    ret = wolfcrypt_se050_SetConfig(pSession2, pHostSession);
-    if (ret != 0) {
-        return kStatus_SSS_Fail;
-    }
-    LOG_I("ran setconfig correctly");
-    wolfcrypt_test(NULL);
-
-    LOG_I("ran wolfcrypt test");
-    return status;
-```
-
-``wolfcrypt_test(NULL);`` can be replaced with ``benchmark_test();``
-The two variables used in  ``wolfcrypt_se050_SetConfig`` are session and key store variables that are required to reference parts of the hardware. 
-
-Next, the Makefile needs to be edited.
-At the top of the Makefile, the base wolfssl directory needs to be added to ``INCLUDE_FLAGS``. Next, Inside ``CFLAGS``, the ``se05x_Minimal`` directory needs to be added so that test.c and benchmark.c are included. Finally, underneath 'all', test.c, test.h, benchmark.c and benchmark.h need to be added, along with ``-L (wolfssl directory) -lwolfssl`` at the end of the line. 
-## Wolfcrypt Test
-To run the wolfcrypt test, two files, ``test.h`` and ``test.c`` need to be added to the ``./se05x_Minimal`` directory. These files can be found inside of ``/wolfcrypt/test``. 
-Next, ``#define NO_MAIN_DRIVER`` needs to be added to test.h.
-You should be able to run `wolfcrypt_test()` now. 
-
-## Benchmark 
-To run the benchmark, both ``benchmark.c`` and ``benchmark.h`` need to be copied from wolfcrypt/benchmark to the `./se05x_Minimal` directory.  In addition, the entire `./certs` directory will need to copied into the directory. ``#define NO_MAIN_DRIVER`` will need to be added to `benchmark.h`. You should be able to run `benchmark_test() ` now. 
diff --git a/wolfssl/wolfcrypt/port/nxp/se050_port.h b/wolfssl/wolfcrypt/port/nxp/se050_port.h
index 7db7884e3..9208b4443 100644
--- a/wolfssl/wolfcrypt/port/nxp/se050_port.h
+++ b/wolfssl/wolfcrypt/port/nxp/se050_port.h
@@ -22,7 +22,6 @@
 #ifndef _SE050_PORT_H_
 #define _SE050_PORT_H_
 
-
 #include <wolfssl/wolfcrypt/settings.h>
 
 #include "fsl_sss_api.h"
@@ -39,27 +38,25 @@ typedef struct {
 } SE050_HASH_Context;
 
 
-WOLFSSL_API int wolfcrypt_se050_SetConfig(sss_session_t *pSession, sss_key_store_t *pHostKeyStore, sss_key_store_t *pKeyStore);
-
-int se050_allocate_key(void);
-
-int se050_get_random_number(uint32_t count, uint8_t* rand_out);
-
-
-
-int se050_hash_init(SE050_HASH_Context* se050Ctx, void* heap);
-int se050_hash_update(SE050_HASH_Context* se050Ctx, const byte* data, word32 len);
-int se050_hash_final(SE050_HASH_Context* se050Ctx, byte* hash, size_t digestLen, word32 algo);
-void se050_hash_free(SE050_HASH_Context* se050Ctx);
+WOLFSSL_API int wc_se050_SetConfig(sss_session_t *pSession,
+    sss_key_store_t *pHostKeyStore, sss_key_store_t *pKeyStore);
 
+WOLFSSL_LOCAL int se050_allocate_key(void);
+WOLFSSL_LOCAL int se050_get_random_number(uint32_t count, uint8_t* rand_out);
 
+WOLFSSL_LOCAL int se050_hash_init(SE050_HASH_Context* se050Ctx, void* heap);
+WOLFSSL_LOCAL int se050_hash_update(SE050_HASH_Context* se050Ctx,
+    const byte* data, word32 len);
+WOLFSSL_LOCAL int se050_hash_final(SE050_HASH_Context* se050Ctx, byte* hash,
+    size_t digestLen, word32 algo);
+WOLFSSL_LOCAL void se050_hash_free(SE050_HASH_Context* se050Ctx);
 
 struct Aes;
-int se050_aes_set_key(struct Aes* aes, const byte* key, word32 len, const byte* iv, int dir);
-int se050_aes_crypt(struct Aes* aes, const byte* in, byte* out, word32 sz, int dir, sss_algorithm_t algorithm);
-void se050_aes_free(struct Aes* aes);
-//int se050_aes_ctr_crypt(struct Aes* aes, const byte* in, byte* out, word32 sz);
-
+WOLFSSL_LOCAL int se050_aes_set_key(struct Aes* aes, const byte* key,
+    word32 len, const byte* iv, int dir);
+WOLFSSL_LOCAL int se050_aes_crypt(struct Aes* aes, const byte* in, byte* out,
+    word32 sz, int dir, sss_algorithm_t algorithm);
+WOLFSSL_LOCAL void se050_aes_free(struct Aes* aes);
 
 
 struct ecc_key;
@@ -74,25 +71,26 @@ struct WC_RNG;
     struct mp_int;
 	#define MATH_INT_T struct mp_int
 #endif
-int se050_ecc_sign_hash_ex(const byte* in, word32 inLen, byte* out,
-                         word32 *outLen, struct ecc_key* key);
 
-int se050_ecc_verify_hash_ex(const byte* hash, word32 hashlen, byte* signature,
-                             word32 signatureLen, struct ecc_key* key, int* res);
+WOLFSSL_LOCAL int se050_ecc_sign_hash_ex(const byte* in, word32 inLen,
+    byte* out, word32 *outLen, struct ecc_key* key);
 
-int se050_ecc_create_key(struct ecc_key* key, int keyId, int keySize);
-int se050_ecc_shared_secret(struct ecc_key* private_key, struct ecc_key* public_key, byte* out,
-                      word32* outlen);
-int se050_ecc_free_key(struct ecc_key* key);
+WOLFSSL_LOCAL int se050_ecc_verify_hash_ex(const byte* hash, word32 hashlen,
+    byte* signature, word32 signatureLen, struct ecc_key* key, int* res);
+
+WOLFSSL_LOCAL int se050_ecc_create_key(struct ecc_key* key, int curve_id, int keySize);
+WOLFSSL_LOCAL int se050_ecc_shared_secret(struct ecc_key* private_key,
+    struct ecc_key* public_key, byte* out, word32* outlen);
+WOLFSSL_LOCAL int se050_ecc_free_key(struct ecc_key* key);
 
 struct ed25519_key;
-//#include <wolfssl/wolfcrypt/ed25519.h>
-int se050_ed25519_create_key(struct ed25519_key* key);
-void se050_ed25519_free_key(struct ed25519_key* key);
-int se050_ed25519_sign_msg(const byte* in, word32 inLen, byte* out,
-                         word32 *outLen, struct ed25519_key* key);
+WOLFSSL_LOCAL int se050_ed25519_create_key(struct ed25519_key* key);
+WOLFSSL_LOCAL void se050_ed25519_free_key(struct ed25519_key* key);
+WOLFSSL_LOCAL int se050_ed25519_sign_msg(const byte* in, word32 inLen,
+    byte* out, word32 *outLen, struct ed25519_key* key);
 
-int se050_ed25519_verify_msg(const byte* signature, word32 signatureLen, const byte* msg,
-                             word32 msgLen, struct ed25519_key* key, int* res);
+WOLFSSL_LOCAL int se050_ed25519_verify_msg(const byte* signature,
+    word32 signatureLen, const byte* msg, word32 msgLen,
+    struct ed25519_key* key, int* res);
 
 #endif /* _SE050_PORT_H_ */

From 2028d8b63dd86ab550df933075a2ae27d762ef37 Mon Sep 17 00:00:00 2001
From: David Garske <david@wolfssl.com>
Date: Fri, 20 Aug 2021 15:57:11 -0700
Subject: [PATCH 3/8] Add missing `se050_port.h`.

---
 wolfssl/wolfcrypt/include.am | 1 +
 1 file changed, 1 insertion(+)

diff --git a/wolfssl/wolfcrypt/include.am b/wolfssl/wolfcrypt/include.am
index b68d0a471..8195584b5 100644
--- a/wolfssl/wolfcrypt/include.am
+++ b/wolfssl/wolfcrypt/include.am
@@ -78,6 +78,7 @@ noinst_HEADERS+= \
                          wolfssl/wolfcrypt/port/nrf51.h \
                          wolfssl/wolfcrypt/port/nxp/ksdk_port.h \
                          wolfssl/wolfcrypt/port/nxp/dcp_port.h \
+                         wolfssl/wolfcrypt/port/nxp/se050_port.h \
                          wolfssl/wolfcrypt/port/xilinx/xil-sha3.h \
                          wolfssl/wolfcrypt/port/caam/caam_driver.h \
                          wolfssl/wolfcrypt/port/caam/caam_error.h \

From 185d48938d937477d91e693a0d575a2646c2dabf Mon Sep 17 00:00:00 2001
From: David Garske <david@wolfssl.com>
Date: Thu, 2 Sep 2021 14:17:27 -0700
Subject: [PATCH 4/8] Fixes for building NXP SE050. Add support for automatic
 initialization of the SE050 if `WOLFSSL_SE050_INIT` is defined. Optionally
 can override the `portName` using `SE050_DEFAULT_PORT`.

---
 configure.ac                            |  12 +-
 wolfcrypt/src/port/nxp/README.md        |  22 +++-
 wolfcrypt/src/port/nxp/se050_port.c     | 142 ++++++++++++++++++++----
 wolfcrypt/src/wc_port.c                 |   8 ++
 wolfssl/wolfcrypt/port/nxp/se050_port.h |  23 +++-
 5 files changed, 176 insertions(+), 31 deletions(-)

diff --git a/configure.ac b/configure.ac
index 100b96470..cdc5fb41d 100644
--- a/configure.ac
+++ b/configure.ac
@@ -1337,7 +1337,7 @@ AC_ARG_WITH([cryptoauthlib],
 )
 
 # NXP SE050
-# current configure options line: "./configure --with-se050=/home/pi/Downloads/new_simw_top"
+# Example: "./configure --with-se050=/home/pi/simw_top"
 ENABLED_SE050="no"
 trylibse050dir=""
 AC_ARG_WITH([se050],
@@ -1356,14 +1356,20 @@ AC_ARG_WITH([se050],
                 trylibse050dir="/usr/local/lib/"
             fi
             LDFLAGS="$LDFLAGS -L$trylibse050dir/build/sss"
+            CPPFLAGS="$CPPFLAGS -I$trylibse050dir/build"
             CPPFLAGS="$CPPFLAGS -I$trylibse050dir/sss/inc"
+            CPPFLAGS="$CPPFLAGS -I$trylibse050dir/sss/ex/inc"
             CPPFLAGS="$CPPFLAGS -I$trylibse050dir/sss/port/default"
             CPPFLAGS="$CPPFLAGS -I$trylibse050dir/hostlib/hostLib/inc"
             CPPFLAGS="$CPPFLAGS -I$trylibse050dir/hostlib/hostLib/libCommon/infra"
 
             AC_CHECK_FILES([$trylibse050dir/build/sss/libSSS_APIs.a], [SE050_STATIC=yes], [SE050_STATIC=no])
             if test "x$SE050_STATIC" = "xyes"; then
-                LIB_STATIC_ADD="$trylibse050dir/build/sss/libSSS_APIs.a $LIB_STATIC_ADD"
+                LIB_STATIC_ADD="$trylibse050dir/build/sss/ex/src/libex_common.a \
+                                $trylibse050dir/build/sss/libSSS_APIs.a \
+                                $trylibse050dir/build/hostlib/hostLib/se05x/libse05x.a \
+                                $trylibse050dir/build/hostlib/hostLib/liba7x_utils.a \
+                                $trylibse050dir/build/hostlib/hostLib/libCommon/libsmCom.a $LIB_STATIC_ADD"
             else
                 AC_LINK_IFELSE([AC_LANG_PROGRAM([[#include <fsl_sss_api.h>]], [[ sss_mac_init(0); ]])],[ libse050_linked=yes ],[ libse050_linked=no ])
                 if test "x$libse050_linked" = "xno" ; then
@@ -1381,7 +1387,7 @@ AC_ARG_WITH([se050],
         fi
 
         ENABLED_SE050="yes"
-        AM_CFLAGS="$AM_CFLAGS -DWOLFSSL_SE050"
+        AM_CFLAGS="$AM_CFLAGS -DWOLFSSL_SE050 -DSSS_USE_FTR_FILE"
     ]
 )
 
diff --git a/wolfcrypt/src/port/nxp/README.md b/wolfcrypt/src/port/nxp/README.md
index ac74f069b..742b45b35 100644
--- a/wolfcrypt/src/port/nxp/README.md
+++ b/wolfcrypt/src/port/nxp/README.md
@@ -4,7 +4,7 @@ Support for the NXP DCP, KSDK and SE050 hardware acceleration boards.
 
 ## NXP SE050
 
-Support for the SE050 on-board crypto hardware acceleration for symmetric AES, SHA1/SHA256/SHA384/SHA512, ECC (including ed25519) and RNG. **(discuss p-256 ECC)**
+Support for the SE050 on-board crypto hardware acceleration for symmetric AES, SHA1/SHA256/SHA384/SHA512, ECC (including ed25519) and RNG.
 
 ## SE050 Acceleration
 
@@ -16,6 +16,22 @@ The code required to communicate with the SE050 is the `EdgeLock SE05x Plug & Tr
 
 Follow the build instruction in AN12570 (EdgeLockTM SE05x Quick start guide with Raspberry Pi) [here](https://www.nxp.com/docs/en/application-note/AN12570.pdf). 
 
+In summary here are the steps for building:
+
+```
+# from simw-top directory
+mkdir build
+cd build
+ccmake ..
+# Change:
+#   `Host OS` to `Raspbian`
+#   `Host Crypto` to `None`
+#   `SMCOM` to `T1oI2C`
+c # to configure
+q
+make
+```
+
 ## Building wolfSSL
 
 To enable support run:
@@ -26,7 +42,7 @@ make
 ``
 
 Where `PATH` is the directory location of `simw-top`.
-Example: `./configure --with-se050=/Users/[user]/simw-top`
+Example: `./configure --enable-debug --disable-shared --with-se050=/home/pi/simw-top CFLAGS="-DWOLFSSL_SE050_INIT"`
 
 ## Building Examples
 
@@ -46,7 +62,7 @@ Open the `simw-top/demos/se05x/se05x_Minimal` directory and edit `se05x_Minimal.
 #include <wolfssl/wolfcrypt/port/nxp/se050_port.h>
 `` 
 
-If you would like to run our wolfcrypt test or  benchmark tool, add: `#include "test.h"` or `#include benchmark.h`.
+If you would like to run our wolfcrypt test or benchmark tool, add: `#include "test.h"` or `#include benchmark.h`.
 
 Below is the code that was replaced in `ex_sss_entry()` to run the wolfcrypt test:
 
diff --git a/wolfcrypt/src/port/nxp/se050_port.c b/wolfcrypt/src/port/nxp/se050_port.c
index c011f29ce..3444dcd81 100644
--- a/wolfcrypt/src/port/nxp/se050_port.c
+++ b/wolfcrypt/src/port/nxp/se050_port.c
@@ -26,18 +26,25 @@
 #include <stdint.h>
 
 #include <wolfssl/wolfcrypt/settings.h>
+
+#ifdef WOLFSSL_SE050
+
 #include <wolfssl/wolfcrypt/types.h>
 #include <wolfssl/wolfcrypt/wc_port.h>
 #include <wolfssl/wolfcrypt/aes.h>
 #include <wolfssl/wolfcrypt/error-crypt.h>
 #include <wolfssl/wolfcrypt/ed25519.h>
-
-
-#ifdef WOLFSSL_SE050
+#include <wolfssl/wolfcrypt/logging.h>
 
 #include <wolfssl/wolfcrypt/port/nxp/se050_port.h>
-#include "fsl_sss_api.h"
-#include "fsl_sss_se05x_types.h"
+
+#ifdef WOLFSSL_SE050_INIT
+    #ifndef SE050_DEFAULT_PORT
+    #define SE050_DEFAULT_PORT "/dev/i2c-1"
+    #endif
+
+    #include "ex_sss_boot.h"
+#endif
 
 #ifdef WOLFSSL_SP_MATH
     struct sp_int;
@@ -77,6 +84,34 @@ int wc_se050_SetConfig(sss_session_t *pSession, sss_key_store_t *pHostKeyStore,
     return 0;
 }
 
+#ifdef WOLFSSL_SE050_INIT
+int wc_se050_init(const char* portName)
+{
+    int ret;
+    sss_status_t status;
+    static ex_sss_boot_ctx_t pCtx;
+
+    if (portName == NULL) {
+        portName = SE050_DEFAULT_PORT;
+    }
+
+    status = ex_sss_boot_open(&pCtx, portName);
+    if (status == kStatus_SSS_Success) {
+        ret = wc_se050_SetConfig(&pCtx.session,
+        #if SSS_HAVE_HOSTCRYPTO_ANY
+            &pCtx.host_ks,
+        #else
+            NULL,
+        #endif
+            &pCtx.ks);
+    }
+    else {
+        ret = WC_HW_E;
+    }
+    return ret;
+}
+#endif
+
 int se050_allocate_key(void)
 {
     static int keyId_allocater = 100;
@@ -90,6 +125,10 @@ int se050_get_random_number(uint32_t count, uint8_t* rand_out)
     sss_rng_context_t rng;
     int ret = 0;
 
+    if (cfg_se050_i2c_pi == NULL) {
+        return WC_HW_E;
+    }
+
     if (wolfSSL_CryptHwMutexLock() != 0) {
         return BAD_MUTEX_E;
     }
@@ -157,6 +196,10 @@ int se050_hash_final(SE050_HASH_Context* se050Ctx, byte* hash, size_t digestLen,
     int          leftover = (se050Ctx->len) % SSS_BLOCK_SIZE;
     const byte*  blocks = data;
 
+    if (cfg_se050_i2c_pi == NULL) {
+        return WC_HW_E;
+    }
+
     if (wolfSSL_CryptHwMutexLock() != 0) {
         return BAD_MUTEX_E;
     }
@@ -167,18 +210,19 @@ int se050_hash_final(SE050_HASH_Context* se050Ctx, byte* hash, size_t digestLen,
         status = sss_digest_init(&digest_ctx);
     }
     if (status == kStatus_SSS_Success) {
-    /* used to send chunks of size 512 */
-    while (status == kStatus_SSS_Success && size--) {
-        status = sss_digest_update(&digest_ctx, blocks, SSS_BLOCK_SIZE);
-        blocks += SSS_BLOCK_SIZE;
+        /* used to send chunks of size 512 */
+        while (status == kStatus_SSS_Success && size--) {
+            status = sss_digest_update(&digest_ctx, blocks, SSS_BLOCK_SIZE);
+            blocks += SSS_BLOCK_SIZE;
+        }
+        if (status == kStatus_SSS_Success && leftover) {
+            status = sss_digest_update(&digest_ctx, blocks, leftover);
+        }
+        if (status == kStatus_SSS_Success) {
+            status = sss_digest_finish(&digest_ctx, hash, &digestLen);
+        }
+        sss_digest_context_free(&digest_ctx);
     }
-    if (status == kStatus_SSS_Success && leftover) {
-        status = sss_digest_update(&digest_ctx, blocks, leftover);
-    }
-    if (status == kStatus_SSS_Success) {
-        status = sss_digest_finish(&digest_ctx, hash, &digestLen);
-    }
-    sss_digest_context_free(&digest_ctx);
 
     wolfSSL_CryptHwMutexUnLock();
 
@@ -200,7 +244,9 @@ int se050_aes_set_key(Aes* aes, const byte* key, word32 len,
     int keyId = se050_allocate_key();
     int ret = BAD_MUTEX_E;
 
-    WOLFSSL_MSG("se050_set_key");
+    if (cfg_se050_i2c_pi == NULL) {
+        return WC_HW_E;
+    }
 
     (void)dir;
     (void)iv;
@@ -252,6 +298,10 @@ int se050_aes_crypt(Aes* aes, const byte* in, byte* out, word32 sz, int dir,
     sss_key_store_t host_keystore;
     int             ret = BAD_MUTEX_E;
 
+    if (cfg_se050_i2c_pi == NULL) {
+        return WC_HW_E;
+    }
+
     XMEMSET(&mode, 0, sizeof(mode));
 
     if (dir == AES_DECRYPTION)
@@ -292,7 +342,8 @@ int se050_aes_crypt(Aes* aes, const byte* in, byte* out, word32 sz, int dir,
         }
     }
     if (status == kStatus_SSS_Success) {
-        status = sss_cipher_update(&aes->aes_ctx, in, sz, out, &sz);
+        size_t outSz = (size_t)sz;
+        status = sss_cipher_update(&aes->aes_ctx, in, sz, out, &outSz);
     }
 
     wolfSSL_CryptHwMutexUnLock();
@@ -308,11 +359,15 @@ void se050_aes_free(Aes* aes)
     sss_key_store_t host_keystore;
     sss_object_t    keyObject;
 
+    if (cfg_se050_i2c_pi == NULL) {
+        return;
+    }
+
     /* sets back to zero to indicate that a free has been called */
     aes->ctxInitDone = 0;
 
     if (wolfSSL_CryptHwMutexLock() != 0) {
-        return BAD_MUTEX_E;
+        return;
     }
 
     status = sss_key_store_context_init(&host_keystore, cfg_se050_i2c_pi);
@@ -350,6 +405,10 @@ int se050_ecc_sign_hash_ex(const byte* in, word32 inLen, byte* out,
     int         keysize = (word32)key->dp->size;
     int         ret = BAD_MUTEX_E;
 
+    if (cfg_se050_i2c_pi == NULL) {
+        return WC_HW_E;
+    }
+
     /* truncate if digest is larger than 64 */
     if (inLen > 64)
         inLen = 64;
@@ -397,8 +456,10 @@ int se050_ecc_sign_hash_ex(const byte* in, word32 inLen, byte* out,
     }
 
     if (status == kStatus_SSS_Success) {
+        size_t outLenSz = (size_t)*outLen;
         status = sss_asymmetric_sign_digest(&ctx_asymm, (uint8_t *)in, inLen,
-                                                                out, outLen);
+                                                                out, &outLenSz);
+        *outLen = outLenSz;
     }
     sss_asymmetric_context_free(&ctx_asymm);
 
@@ -427,10 +488,12 @@ int se050_ecc_verify_hash_ex(const byte* hash, word32 hashLen, byte* signature,
     int         ret;
     int         keySize = (word32)key->dp->size;
 
-    WOLFSSL_MSG("se050_ecc_verify_hash_ex");
-
     *res = 0;
 
+    if (cfg_se050_i2c_pi == NULL) {
+        return WC_HW_E;
+    }
+
     if (hashLen > 64)
         hashLen = 64;
 
@@ -547,6 +610,10 @@ int se050_ecc_free_key(struct ecc_key* key)
     int             ret = WC_HW_E;
     sss_key_store_t host_keystore;
 
+    if (cfg_se050_i2c_pi == NULL) {
+        return WC_HW_E;
+    }
+
     if (key->keyId <= 0) {
         return BAD_FUNC_ARG;
     }
@@ -589,6 +656,11 @@ int se050_ecc_create_key(struct ecc_key* key, int curve_id, int keySize)
     size_t keyPairExportBitLen = sizeof(keyPairExport) * 8;
     int ret;
 
+    if (cfg_se050_i2c_pi == NULL) {
+        return WC_HW_E;
+    }
+
+
     (void)curve_id;
 
     if (wolfSSL_CryptHwMutexLock() != 0) {
@@ -647,7 +719,11 @@ int se050_ecc_shared_secret(ecc_key* private_key, ecc_key* public_key,
     size_t                  ecdhKeyLen = keySize;
     size_t                  ecdhKeyBitLen = keySize;
     int                     ret = WC_HW_E;
-    
+
+    if (cfg_se050_i2c_pi == NULL) {
+        return WC_HW_E;
+    }
+
     if (private_key->keyId <= 0 || public_key->keyId <= 0) {
         return BAD_FUNC_ARG;
     }
@@ -711,8 +787,10 @@ int se050_ecc_shared_secret(ecc_key* private_key, ecc_key* public_key,
     }
 
     if (status == kStatus_SSS_Success) {
-        status = sss_key_store_get_key(hostKeyStore, &deriveKey, out, outlen,
+        size_t outlenSz = (size_t)*outlen;
+        status = sss_key_store_get_key(hostKeyStore, &deriveKey, out, &outlenSz,
                                                                 &ecdhKeyBitLen);
+        *outlen = outlenSz;
     }
     if (ctx_derive_key.session != NULL)
         sss_derive_key_context_free(&ctx_derive_key);
@@ -741,6 +819,10 @@ int se050_ed25519_create_key(ed25519_key* key)
     int             keyId;
     int             ret = 0;
 
+    if (cfg_se050_i2c_pi == NULL) {
+        return WC_HW_E;
+    }
+
     if (wolfSSL_CryptHwMutexLock() != 0) {
         return BAD_MUTEX_E;
     }
@@ -786,6 +868,10 @@ void se050_ed25519_free_key(ed25519_key* key)
     sss_object_t newKey;
     sss_key_store_t host_keystore;
 
+    if (cfg_se050_i2c_pi == NULL) {
+        return;
+    }
+
     if (wolfSSL_CryptHwMutexLock() != 0) {
         return BAD_MUTEX_E;
     }
@@ -819,6 +905,10 @@ int se050_ed25519_sign_msg(const byte* in, word32 inLen, byte* out,
     inLen = 64;
     *outLen = 64;
 
+    if (cfg_se050_i2c_pi == NULL) {
+        return WC_HW_E;
+    }
+
     if (wolfSSL_CryptHwMutexLock() != 0) {
         return BAD_MUTEX_E;
     }
@@ -869,6 +959,10 @@ int se050_ed25519_verify_msg(const byte* signature, word32 signatureLen,
     sss_key_store_t     host_keystore;
     int                 ret = 0;
 
+    if (cfg_se050_i2c_pi == NULL) {
+        return WC_HW_E;
+    }
+
     msgLen = 64;
 
     if (wolfSSL_CryptHwMutexLock() != 0) {
diff --git a/wolfcrypt/src/wc_port.c b/wolfcrypt/src/wc_port.c
index 23fb898d8..01570b0ed 100644
--- a/wolfcrypt/src/wc_port.c
+++ b/wolfcrypt/src/wc_port.c
@@ -91,6 +91,10 @@
     #include <wolfssl/wolfcrypt/port/cavium/cavium_octeon_sync.h>
 #endif
 
+#if defined(WOLFSSL_SE050) && defined(WOLFSSL_SE050_INIT)
+#include <wolfssl/wolfcrypt/port/nxp/se050_port.h>
+#endif
+
 #ifdef WOLFSSL_SCE
     #include "hal_data.h"
 #endif
@@ -230,6 +234,10 @@ int wolfCrypt_Init(void)
         ret = sl_se_init();
     #endif
 
+    #if defined(WOLFSSL_SE050) && defined(WOLFSSL_SE050_INIT)
+        ret = wc_se050_init(NULL);
+    #endif
+
     #ifdef WOLFSSL_ARMASM
         WOLFSSL_MSG("Using ARM hardware acceleration");
     #endif
diff --git a/wolfssl/wolfcrypt/port/nxp/se050_port.h b/wolfssl/wolfcrypt/port/nxp/se050_port.h
index 9208b4443..d5a7447cd 100644
--- a/wolfssl/wolfcrypt/port/nxp/se050_port.h
+++ b/wolfssl/wolfcrypt/port/nxp/se050_port.h
@@ -23,8 +23,25 @@
 #define _SE050_PORT_H_
 
 #include <wolfssl/wolfcrypt/settings.h>
+#include <wolfssl/wolfcrypt/visibility.h>
 
+#ifdef __GNUC__
+#pragma GCC diagnostic push
+#pragma GCC diagnostic ignored "-Wundef"
+#pragma GCC diagnostic ignored "-Wredundant-decls"
+#endif
+
+#include "fsl_sss_se05x_types.h"
+#include "fsl_sss_se05x_apis.h"
+
+#if (SSS_HAVE_SSS > 1)
 #include "fsl_sss_api.h"
+#endif
+
+#ifdef __GNUC__
+#pragma GCC diagnostic pop
+#endif
+
 
 enum {
     SSS_BLOCK_SIZE = 512
@@ -37,10 +54,14 @@ typedef struct {
     word32 len;
 } SE050_HASH_Context;
 
-
+/* Public Functions */
 WOLFSSL_API int wc_se050_SetConfig(sss_session_t *pSession,
     sss_key_store_t *pHostKeyStore, sss_key_store_t *pKeyStore);
+#ifdef WOLFSSL_SE050_INIT
+WOLFSSL_API int wc_se050_init(const char* portName);
+#endif
 
+/* Private Functions */
 WOLFSSL_LOCAL int se050_allocate_key(void);
 WOLFSSL_LOCAL int se050_get_random_number(uint32_t count, uint8_t* rand_out);
 

From 09ce1e3c5f699f0b70e263b7d59a76de54fef214 Mon Sep 17 00:00:00 2001
From: Ethan Looney <ethan@wolfssl.com>
Date: Mon, 4 Oct 2021 13:28:02 -0700
Subject: [PATCH 5/8] Improvements to the key id allocation

---
 wolfcrypt/src/port/nxp/se050_port.c     | 61 ++++++++++++++++++-------
 wolfssl/wolfcrypt/port/nxp/se050_port.h | 17 ++++++-
 2 files changed, 61 insertions(+), 17 deletions(-)

diff --git a/wolfcrypt/src/port/nxp/se050_port.c b/wolfcrypt/src/port/nxp/se050_port.c
index 3444dcd81..ef484ddfd 100644
--- a/wolfcrypt/src/port/nxp/se050_port.c
+++ b/wolfcrypt/src/port/nxp/se050_port.c
@@ -60,12 +60,10 @@ struct ecc_key;
 #include <wolfssl/wolfcrypt/ecc.h>
 #include <wolfssl/wolfcrypt/asn_public.h>
 
-/* ECC SIGN 70 = keyStoreId - Implementation specific ID */
 /* AES 55 = keyStoreId - Implementation specific ID */
-/* ECC Shared Secret 60 = keyStoreId - Implementation specific ID */
-/* ECC VERIFY 61 = keyStoreId - Implementation specific ID */
-/* ECC VERIFY AFTER SIGN 60 = keyStoreId - Implementation specific ID */
-/* ED25519 55 = keyStoreId - Implementation specific ID */
+/* ECC SIGN 56 = keyStoreId - Implementation specific ID */
+/* ECC VERIFY 57 = keyStoreId - Implementation specific ID */
+/* ED25519 58 = keyStoreId - Implementation specific ID */
 
 /* Global variables */
 static sss_session_t *cfg_se050_i2c_pi;
@@ -112,10 +110,42 @@ int wc_se050_init(const char* portName)
 }
 #endif
 
-int se050_allocate_key(void)
+int se050_allocate_key(int keyType)
 {
-    static int keyId_allocater = 100;
-    return keyId_allocater++;
+    int keyId = 0;
+    static int keyId_allocator = 100;
+    switch(keyType) {
+
+    #ifndef SE050_KEYID_AES
+        case SE050_AES_KEY:
+            keyId = SE050_AES_KEYID;
+            break;
+    #endif
+
+    #ifndef SE050_KEYID_ECC_SIGN
+        case SE050_ECC_SIGN:
+            keyId = SE050_ECC_SIGN_KEYID;
+            break;
+    #endif
+
+    #ifndef SE050_KEYID_ECC_VERIFY
+        case SE050_ECC_VERIFY:
+            keyId = SE050_ECC_VERIFY_KEYID;
+            break;
+    #endif
+
+    #ifndef SE050_KEYID_ED25519
+        case SE050_ED25519:
+            keyId = SE050_ED25519_KEYID;
+            break;
+    #endif
+
+        case SE050_KEYID_ANY:
+            keyId = keyId_allocator++;
+            break;
+    }
+
+    return keyId;
 }
 
 #ifndef WC_NO_RNG
@@ -241,7 +271,7 @@ int se050_aes_set_key(Aes* aes, const byte* key, word32 len,
     sss_status_t status;
     sss_object_t newKey;
     sss_key_store_t host_keystore;
-    int keyId = se050_allocate_key();
+    int keyId = se050_allocate_key(SE050_AES_KEY);
     int ret = BAD_MUTEX_E;
 
     if (cfg_se050_i2c_pi == NULL) {
@@ -401,7 +431,7 @@ int se050_ecc_sign_hash_ex(const byte* in, word32 inLen, byte* out,
     sss_key_store_t     host_keystore;
     sss_object_t        newKey;
     sss_algorithm_t     algorithm = kAlgorithm_None;
-    int         keyId = se050_allocate_key();
+    int         keyId = se050_allocate_key(SE050_ECC_SIGN);
     int         keysize = (word32)key->dp->size;
     int         ret = BAD_MUTEX_E;
 
@@ -514,7 +544,7 @@ int se050_ecc_verify_hash_ex(const byte* hash, word32 hashLen, byte* signature,
 
     /* this is run when a key was not generated and was instead passed in */
     if (key->keyId == 0) {
-        int keyId = se050_allocate_key();
+        int keyId = se050_allocate_key(SE050_ECC_VERIFY);
         byte* derBuf = NULL;
 
         ret = wc_EccKeyToPKCS8(key, NULL, &derSz);
@@ -644,13 +674,12 @@ int se050_ecc_free_key(struct ecc_key* key)
 
     return ret;
 }
-
 int se050_ecc_create_key(struct ecc_key* key, int curve_id, int keySize)
 {
     sss_status_t    status = kStatus_SSS_Success;
     sss_object_t    keyPair;
     sss_key_store_t host_keystore;
-    int keyId = se050_allocate_key();
+    int keyId = se050_allocate_key(SE050_KEYID_ANY);
     uint8_t keyPairExport[MAX_ECC_BYTES];
     size_t keyPairExportLen = sizeof(keyPairExport);
     size_t keyPairExportBitLen = sizeof(keyPairExport) * 8;
@@ -766,7 +795,7 @@ int se050_ecc_shared_secret(ecc_key* private_key, ecc_key* public_key,
     }
 
     if (status == kStatus_SSS_Success) {
-        keyId = se050_allocate_key();
+        keyId = se050_allocate_key(SE050_KEYID_ANY);
 
         status = sss_key_object_allocate_handle(&deriveKey,
             keyId,
@@ -837,7 +866,7 @@ int se050_ed25519_create_key(ed25519_key* key)
     }
 
     if (status == kStatus_SSS_Success) {
-        keyId = se050_allocate_key();
+        keyId = se050_allocate_key(SE050_ED25519);
         status = sss_key_object_allocate_handle(&newKey, keyId,
             kSSS_KeyPart_Pair, kSSS_CipherType_EC_TWISTED_ED, keysize,
             kKeyObject_Mode_Transient);
@@ -873,7 +902,7 @@ void se050_ed25519_free_key(ed25519_key* key)
     }
 
     if (wolfSSL_CryptHwMutexLock() != 0) {
-        return BAD_MUTEX_E;
+        return /*BAD_MUTEX_E*/;
     }
 
     status = sss_key_store_context_init(&host_keystore, cfg_se050_i2c_pi);
diff --git a/wolfssl/wolfcrypt/port/nxp/se050_port.h b/wolfssl/wolfcrypt/port/nxp/se050_port.h
index d5a7447cd..3b4475594 100644
--- a/wolfssl/wolfcrypt/port/nxp/se050_port.h
+++ b/wolfssl/wolfcrypt/port/nxp/se050_port.h
@@ -43,10 +43,25 @@
 #endif
 
 
+#define SE050_AES_KEYID                     55
+#define SE050_ECC_SIGN_KEYID                56
+#define SE050_ECC_VERIFY_KEYID              57
+#define SE050_ED25519_KEYID                 58
+
+
 enum {
     SSS_BLOCK_SIZE = 512
 };
 
+enum se050KeyType {
+    SE050_KEYID_ANY,
+    SE050_AES_KEY,
+    SE050_ECC_SIGN,
+    SE050_ECC_VERIFY,
+    SE050_ED25519,
+};
+
+
 typedef struct {
     void*  heap;
     byte*  msg;
@@ -62,7 +77,7 @@ WOLFSSL_API int wc_se050_init(const char* portName);
 #endif
 
 /* Private Functions */
-WOLFSSL_LOCAL int se050_allocate_key(void);
+WOLFSSL_LOCAL int se050_allocate_key(int keyType);
 WOLFSSL_LOCAL int se050_get_random_number(uint32_t count, uint8_t* rand_out);
 
 WOLFSSL_LOCAL int se050_hash_init(SE050_HASH_Context* se050Ctx, void* heap);

From 0c1d12c224d74204d7f1bf40353e5377cefcaf89 Mon Sep 17 00:00:00 2001
From: David Garske <david@wolfssl.com>
Date: Mon, 4 Oct 2021 13:40:24 -0700
Subject: [PATCH 6/8] Improve keyId logic. Fix minor compile warnings. Change
 `wc_se050_set_config` to match naming convention of other function in port.

---
 wolfcrypt/src/port/nxp/README.md        |  4 +--
 wolfcrypt/src/port/nxp/se050_port.c     | 38 +++++++++----------------
 wolfssl/wolfcrypt/port/nxp/se050_port.h | 21 ++++++++++----
 3 files changed, 30 insertions(+), 33 deletions(-)

diff --git a/wolfcrypt/src/port/nxp/README.md b/wolfcrypt/src/port/nxp/README.md
index 742b45b35..ba47856ce 100644
--- a/wolfcrypt/src/port/nxp/README.md
+++ b/wolfcrypt/src/port/nxp/README.md
@@ -74,7 +74,7 @@ sss_session_t *pSession2 = (sss_session_t *)&pCtx->session;
 sss_key_store_t *pHostSession = (sss_key_store_t *)&pCtx->host_ks;
 
 LOG_I("running setconfig");
-ret = wc_se050_SetConfig(pSession2, pHostSession);
+ret = wc_se050_set_config(pSession2, pHostSession);
 if (ret != 0) {
     return kStatus_SSS_Fail;
 }
@@ -87,7 +87,7 @@ return status;
 
 Note: `wolfcrypt_test(NULL);` can be replaced with `benchmark_test();`
 
-The two variables used in `wc_se050_SetConfig` are session and key store variables that are required to reference parts of the hardware.
+The two variables used in `wc_se050_set_config` are session and key store variables that are required to reference parts of the hardware.
 
 The Makefile needs to be edited. At the top of the Makefile, the base wolfssl directory needs to be added to `INCLUDE_FLAGS`.
 
diff --git a/wolfcrypt/src/port/nxp/se050_port.c b/wolfcrypt/src/port/nxp/se050_port.c
index ef484ddfd..92b42dd16 100644
--- a/wolfcrypt/src/port/nxp/se050_port.c
+++ b/wolfcrypt/src/port/nxp/se050_port.c
@@ -70,7 +70,7 @@ static sss_session_t *cfg_se050_i2c_pi;
 static sss_key_store_t *hostKeyStore;
 static sss_key_store_t *keyStore;
 
-int wc_se050_SetConfig(sss_session_t *pSession, sss_key_store_t *pHostKeyStore,
+int wc_se050_set_config(sss_session_t *pSession, sss_key_store_t *pHostKeyStore,
     sss_key_store_t *pKeyStore)
 {
     WOLFSSL_MSG("Setting SE050 session configuration");
@@ -95,7 +95,7 @@ int wc_se050_init(const char* portName)
 
     status = ex_sss_boot_open(&pCtx, portName);
     if (status == kStatus_SSS_Success) {
-        ret = wc_se050_SetConfig(&pCtx.session,
+        ret = wc_se050_set_config(&pCtx.session,
         #if SSS_HAVE_HOSTCRYPTO_ANY
             &pCtx.host_ks,
         #else
@@ -114,37 +114,23 @@ int se050_allocate_key(int keyType)
 {
     int keyId = 0;
     static int keyId_allocator = 100;
-    switch(keyType) {
-
-    #ifndef SE050_KEYID_AES
+    switch (keyType) {
         case SE050_AES_KEY:
-            keyId = SE050_AES_KEYID;
+            keyId = SE050_KEYID_AES;
             break;
-    #endif
-
-    #ifndef SE050_KEYID_ECC_SIGN
         case SE050_ECC_SIGN:
-            keyId = SE050_ECC_SIGN_KEYID;
+            keyId = SE050_KEYID_ECC_SIGN;
             break;
-    #endif
-
-    #ifndef SE050_KEYID_ECC_VERIFY
         case SE050_ECC_VERIFY:
-            keyId = SE050_ECC_VERIFY_KEYID;
+            keyId = SE050_KEYID_ECC_VERIFY;
             break;
-    #endif
-
-    #ifndef SE050_KEYID_ED25519
         case SE050_ED25519:
-            keyId = SE050_ED25519_KEYID;
+            keyId = SE050_KEYID_ED25519;
             break;
-    #endif
-
         case SE050_KEYID_ANY:
             keyId = keyId_allocator++;
             break;
     }
-
     return keyId;
 }
 
@@ -489,7 +475,7 @@ int se050_ecc_sign_hash_ex(const byte* in, word32 inLen, byte* out,
         size_t outLenSz = (size_t)*outLen;
         status = sss_asymmetric_sign_digest(&ctx_asymm, (uint8_t *)in, inLen,
                                                                 out, &outLenSz);
-        *outLen = outLenSz;
+        *outLen = (word32)outLenSz;
     }
     sss_asymmetric_context_free(&ctx_asymm);
 
@@ -596,7 +582,7 @@ int se050_ecc_verify_hash_ex(const byte* hash, word32 hashLen, byte* signature,
         key->keyId = keyId;
     }
     /* this is run after a sign function has taken place */
-    else if (key->keyId != 0) {
+    else {
         status = sss_key_store_context_init(&host_keystore, cfg_se050_i2c_pi);
 
         if (status == kStatus_SSS_Success) {
@@ -819,7 +805,7 @@ int se050_ecc_shared_secret(ecc_key* private_key, ecc_key* public_key,
         size_t outlenSz = (size_t)*outlen;
         status = sss_key_store_get_key(hostKeyStore, &deriveKey, out, &outlenSz,
                                                                 &ecdhKeyBitLen);
-        *outlen = outlenSz;
+        *outlen = (word32)outlenSz;
     }
     if (ctx_derive_key.session != NULL)
         sss_derive_key_context_free(&ctx_derive_key);
@@ -962,8 +948,10 @@ int se050_ed25519_sign_msg(const byte* in, word32 inLen, byte* out,
     }
 
     if (status == kStatus_SSS_Success) {
+        size_t outlenSz = (size_t)*outLen;
         status = sss_se05x_asymmetric_sign((sss_se05x_asymmetric_t *)&ctx_asymm,
-                                            (uint8_t *)in, inLen, out, outLen);
+                                          (uint8_t *)in, inLen, out, &outlenSz);
+        *outLen = (word32)outlenSz;
     }
 
     sss_asymmetric_context_free(&ctx_asymm);
diff --git a/wolfssl/wolfcrypt/port/nxp/se050_port.h b/wolfssl/wolfcrypt/port/nxp/se050_port.h
index 3b4475594..672ff75d3 100644
--- a/wolfssl/wolfcrypt/port/nxp/se050_port.h
+++ b/wolfssl/wolfcrypt/port/nxp/se050_port.h
@@ -43,17 +43,26 @@
 #endif
 
 
-#define SE050_AES_KEYID                     55
-#define SE050_ECC_SIGN_KEYID                56
-#define SE050_ECC_VERIFY_KEYID              57
-#define SE050_ED25519_KEYID                 58
+/* Default key ID's */
+#ifndef SE050_KEYID_AES
+#define SE050_KEYID_AES        55
+#endif
+#ifndef SE050_KEYID_ECC_SIGN
+#define SE050_KEYID_ECC_SIGN   56
+#endif
+#ifndef SE050_KEYID_ECC_VERIFY 
+#define SE050_KEYID_ECC_VERIFY 57
+#endif
+#ifndef SE050_KEYID_ED25519
+#define SE050_KEYID_ED25519    58
+#endif
 
 
 enum {
     SSS_BLOCK_SIZE = 512
 };
 
-enum se050KeyType {
+enum SE050KeyType {
     SE050_KEYID_ANY,
     SE050_AES_KEY,
     SE050_ECC_SIGN,
@@ -70,7 +79,7 @@ typedef struct {
 } SE050_HASH_Context;
 
 /* Public Functions */
-WOLFSSL_API int wc_se050_SetConfig(sss_session_t *pSession,
+WOLFSSL_API int wc_se050_set_config(sss_session_t *pSession,
     sss_key_store_t *pHostKeyStore, sss_key_store_t *pKeyStore);
 #ifdef WOLFSSL_SE050_INIT
 WOLFSSL_API int wc_se050_init(const char* portName);

From 90a51490a9049846a9b795730e722961aefd1766 Mon Sep 17 00:00:00 2001
From: David Garske <david@wolfssl.com>
Date: Mon, 11 Oct 2021 11:01:03 -0700
Subject: [PATCH 7/8] Peer review feedback. Improvements with small stack.

---
 wolfcrypt/src/ecc.c    | 29 ++++++++++++++++++++++++++---
 wolfcrypt/src/sha512.c |  2 --
 2 files changed, 26 insertions(+), 5 deletions(-)

diff --git a/wolfcrypt/src/ecc.c b/wolfcrypt/src/ecc.c
index 76f2b3eec..037dba0b0 100644
--- a/wolfcrypt/src/ecc.c
+++ b/wolfcrypt/src/ecc.c
@@ -4617,7 +4617,8 @@ int wc_ecc_make_key_ex2(WC_RNG* rng, int keysize, ecc_key* key, int curve_id,
 
     int err;
 #if !defined(WOLFSSL_ATECC508A) && !defined(WOLFSSL_ATECC608A) && \
-    !defined(WOLFSSL_CRYPTOCELL) && !defined(WOLFSSL_KCAPI_ECC)
+    !defined(WOLFSSL_CRYPTOCELL) && !defined(WOLFSSL_KCAPI_ECC) && \
+    !defined(WOLFSSL_SE050)
 #if !defined(WOLFSSL_SP_MATH)
     DECLARE_CURVE_SPECS(curve, ECC_CURVE_FIELD_COUNT);
 #endif
@@ -6975,7 +6976,11 @@ int wc_ecc_verify_hash_ex(mp_int *r, mp_int *s, const byte* hash,
 #elif defined(WOLFSSL_KCAPI_ECC)
    byte sigRS[MAX_ECC_BYTES*2];
 #elif defined(WOLFSSL_SE050)
-   byte sigRS[ECC_MAX_CRYPTO_HW_SIZE * 2];
+   #ifdef WOLFSSL_SMALL_STACK
+   byte* sigRS = NULL;
+   #else
+   byte  sigRS[ECC_MAX_CRYPTO_HW_SIZE * 2];
+   #endif
 #elif !defined(WOLFSSL_SP_MATH) || defined(FREESCALE_LTC_ECC)
    int          did_init = 0;
    ecc_point    *mG = NULL, *mQ = NULL;
@@ -7129,11 +7134,29 @@ int wc_ecc_verify_hash_ex(mp_int *r, mp_int *s, const byte* hash,
         word32 signatureLen = rLeadingZero + sLeadingZero + 
             rLen + sLen + SIG_HEADER_SZ; /* see StoreECC_DSA_Sig */
 
-        err = StoreECC_DSA_Sig(sigRS, &signatureLen, r, s);
+    #ifdef WOLFSSL_SMALL_STACK
+        sigRS = (byte*)XMALLOC(signatureLen, NULL, DYNAMIC_TYPE_SIGNATURE);
+        if (sigRS == NULL) {
+            err = MEMORY_E;
+        }
+    #else
+        if (signatureLen > sizeof(sigRS)) {
+            err = BUFFER_E;
+        }
+    #endif
+        if (err == 0) {
+            err = StoreECC_DSA_Sig(sigRS, &signatureLen, r, s);
+        }
         if (err == 0) {
             err = se050_ecc_verify_hash_ex(hash, hashlen, sigRS,
                 signatureLen, key, res);
         }
+    #ifdef WOLFSSL_SMALL_STACK  
+        if (sigRS != NULL) {
+            XFREE(sigRS, NULL, DYNAMIC_TYPE_SIGNATURE);
+            sigRS = NULL;
+        }
+    #endif
         if (err != 0)
             return err;
     }
diff --git a/wolfcrypt/src/sha512.c b/wolfcrypt/src/sha512.c
index 13aef4ba0..263c22312 100644
--- a/wolfcrypt/src/sha512.c
+++ b/wolfcrypt/src/sha512.c
@@ -208,7 +208,6 @@
     {
         if (sha512 == NULL)
             return BAD_FUNC_ARG;
-        //void* heap;
         return se050_hash_init(&sha512->se050Ctx, NULL);
     }
     int wc_InitSha512_ex(wc_Sha512* sha512, void* heap, int devId)
@@ -222,7 +221,6 @@
     int wc_Sha512Update(wc_Sha512* sha512, const byte* data, word32 len)
     {
         return se050_hash_update(&sha512->se050Ctx, data, len);
-    
     }
     int wc_Sha512Final(wc_Sha512* sha512, byte* hash)
     {

From 70894383cece92fb71ff53953a549d43dcf3ae71 Mon Sep 17 00:00:00 2001
From: David Garske <david@wolfssl.com>
Date: Mon, 11 Oct 2021 13:01:38 -0700
Subject: [PATCH 8/8] Fix for new SHA512 224/256 support with NXP SE050.

---
 wolfcrypt/src/sha512.c                  | 13 +++++++++++--
 wolfssl/wolfcrypt/port/nxp/se050_port.h | 10 ++++++++++
 2 files changed, 21 insertions(+), 2 deletions(-)

diff --git a/wolfcrypt/src/sha512.c b/wolfcrypt/src/sha512.c
index 263c22312..256aae06e 100644
--- a/wolfcrypt/src/sha512.c
+++ b/wolfcrypt/src/sha512.c
@@ -958,12 +958,13 @@ int wc_Sha512Update(wc_Sha512* sha512, const byte* data, word32 len)
 
 #endif /* WOLFSSL_IMX6_CAAM || WOLFSSL_SILABS_SHA384 */
 
+
 #if defined(WOLFSSL_KCAPI_HASH)
     /* functions defined in wolfcrypt/src/port/kcapi/kcapi_hash.c */
+#elif defined(WOLFSSL_SE050)
 
 #else
 
-#ifndef WOLFSSL_SE050
 static WC_INLINE int Sha512Final(wc_Sha512* sha512)
 {
     byte* local = (byte*)sha512->buffer;
@@ -1071,6 +1072,7 @@ static WC_INLINE int Sha512Final(wc_Sha512* sha512)
 
 #if defined(WOLFSSL_KCAPI_HASH)
     /* functions defined in wolfcrypt/src/port/kcapi/kcapi_hash.c */
+#elif defined(WOLFSSL_SE050)
 
 #else
 
@@ -1142,6 +1144,7 @@ int wc_Sha512Final(wc_Sha512* sha512, byte* hash)
 
 #endif /* WOLFSSL_KCAPI_HASH */
 
+#ifndef WOLFSSL_SE050
 int wc_InitSha512(wc_Sha512* sha512)
 {
     return wc_InitSha512_ex(sha512, NULL, INVALID_DEVID);
@@ -1223,7 +1226,8 @@ int wc_Sha512Transform(wc_Sha512* sha, const unsigned char* data)
 }
 #endif /* OPENSSL_EXTRA */
 #endif /* WOLFSSL_SHA512 */
-#endif /* WOLFSSL_SE050 */
+#endif /* !WOLFSSL_SE050 */
+
 
 /* -------------------------------------------------------------------------- */
 /* SHA384 */
@@ -1568,8 +1572,10 @@ int wc_Sha512_224Update(wc_Sha512* sha, const byte* data, word32 len)
 {
     return wc_Sha512Update(sha, data, len);
 }
+
 #if defined(WOLFSSL_KCAPI_HASH)
     /* functions defined in wolfcrypt/src/port/kcapi/kcapi_hash.c */
+#elif defined(WOLFSSL_SE050)
 
 #else
 int wc_Sha512_224FinalRaw(wc_Sha512* sha, byte* hash)
@@ -1588,6 +1594,8 @@ void wc_Sha512_224Free(wc_Sha512* sha)
 }
 #if defined(WOLFSSL_KCAPI_HASH)
     /* functions defined in wolfcrypt/src/port/kcapi/kcapi_hash.c */
+#elif defined(WOLFSSL_SE050)
+
 
 #else
 int wc_Sha512_224GetHash(wc_Sha512* sha512, byte* hash)
@@ -1631,6 +1639,7 @@ int wc_Sha512_256Update(wc_Sha512* sha, const byte* data, word32 len)
 }
 #if defined(WOLFSSL_KCAPI_HASH)
     /* functions defined in wolfcrypt/src/port/kcapi/kcapi_hash.c */
+#elif defined(WOLFSSL_SE050)
 
 #else
 int wc_Sha512_256FinalRaw(wc_Sha512* sha, byte* hash)
diff --git a/wolfssl/wolfcrypt/port/nxp/se050_port.h b/wolfssl/wolfcrypt/port/nxp/se050_port.h
index 672ff75d3..bd3759236 100644
--- a/wolfssl/wolfcrypt/port/nxp/se050_port.h
+++ b/wolfssl/wolfcrypt/port/nxp/se050_port.h
@@ -38,6 +38,16 @@
 #include "fsl_sss_api.h"
 #endif
 
+#ifdef WOLFSSL_SE050
+    /* NXP SE050 - Disable SHA512 224/256 support */
+    #ifndef WOLFSSL_NOSHA512_224
+    #define WOLFSSL_NOSHA512_224
+    #endif
+    #ifndef WOLFSSL_NOSHA512_256
+    #define WOLFSSL_NOSHA512_256
+    #endif
+#endif
+
 #ifdef __GNUC__
 #pragma GCC diagnostic pop
 #endif