Add SRAM PUF (Physically Unclonable Function) support to wolfCrypt. Derives device-unique cryptographic keys from the power-on state of SRAM memory using a BCH(127,64,t=10) fuzzy extractor with HKDF key derivation.
- **wolfCrypt PUF API** (`wolfcrypt/src/puf.c`, `wolfssl/wolfcrypt/puf.h`)
- `wc_PufInit`, `wc_PufReadSram`, `wc_PufEnroll`, `wc_PufReconstruct`
- `wc_PufDeriveKey` (HKDF-SHA256), `wc_PufGetIdentity` (SHA-256 device fingerprint)
- `wc_PufZeroize` (secure context cleanup)
- `wc_PufSetTestData` (synthetic SRAM for testing without hardware)
- **BCH(127,64,t=10) error-correcting codec** - corrects up to 10 bit flips per 127-bit codeword across 16 codewords
- **`WC_PUF_SHA3` build option** - select SHA3-256 instead of SHA-256 for identity hash and HKDF (default: SHA-256)
- **Precomputed GF(2^7) tables** - `const` arrays in `.rodata` (no runtime init, thread-safe, flash-resident on embedded)
- `./configure --enable-puf` (auto-enables HKDF dependency)
- CMake: `WOLFSSL_PUF=yes`
- `WOLFSSL_USER_SETTINGS`: define `WOLFSSL_PUF` and `WOLFSSL_PUF_SRAM`
- See wolfssl-examples/puf for example implementation on STM32 NUCLEO-H563ZI (Cortex-M33, STM32H563ZI)
- Supports test mode (synthetic SRAM)
- Builds to ~13KB `.elf`
- Tested on NUCLEO-H563ZI: enrollment, noisy reconstruction, key derivation all pass
- `.github/workflows/puf.yml`: host build + test workflow for PUF feature
- Doxygen API docs for all 8 public functions
- PUF group added to `doxygen_groups.h`
tests/api/test_ossl_x509.c, tests/api/test_ossl_x509.h: add test_wolfssl_local_IsValidFQDN().
src/internal.c: in MatchDomainName(), when WOLFSSL_LEFT_MOST_WILDCARD_ONLY, do pattern matching and case folding only if target string validates as an FQDN.
This caused problems on CHERI with bounds violations.
The code assumes WC_CACHE_LINE_SZ == 64 and perhaps this is not the case.
Signed-off-by: William Beasley (The Capable Hub) <wbeasley@thegoodpenguin.co.uk>
Follow-up to #7731 ("Changes needed for default TLS support in zephyr
kernel"). Zephyr 4.3's TLS socket integration uses three additional
wolfSSL features that were not needed by the 3.7 integration, plus an
extension to the native_sim time-source gates introduced in #7731.
native_sim timer gates (src/internal.c, wolfcrypt/src/wc_port.c):
Extend the !CONFIG_BOARD_NATIVE_POSIX gate in LowResTimer() and the
CONFIG_BOARD_NATIVE_POSIX RTC path in z_time() to also cover
CONFIG_BOARD_NATIVE_SIM. Zephyr 4.3 renamed the simulator board from
native_posix to native_sim; without this, k_cpu_idle() on native_sim
advances simulated time during DTLS retransmit loops and the RTC path
falls through to uptime-since-boot. Behavior on native_posix is
unchanged.
New Kconfig options (zephyr/Kconfig, zephyr/user_settings.h):
CONFIG_WOLFSSL_SESSION_EXPORT -> HAVE_EXT_CACHE
Required by consumers that serialize TLS session state across
connections via wolfSSL_i2d_SSL_SESSION / wolfSSL_d2i_SSL_SESSION.
CONFIG_WOLFSSL_KEEP_PEER_CERT -> KEEP_PEER_CERT
Retain the peer certificate after handshake so the application
layer can inspect it via wolfSSL_get_peer_certificate.
CONFIG_WOLFSSL_ALWAYS_VERIFY_CB -> WOLFSSL_ALWAYS_VERIFY_CB
Invoke an application-set verify callback on successful chain
validation in addition to validation failures.
All three are default-off; customers opt in the same way they do for
the existing CONFIG_WOLFSSL_DTLS / ALPN / PSK feature options.
.wolfssl_known_macro_extras: register HAVE_EXT_CACHE.
scripts/pem.test:
* add setup for WOLFSSL_NO_DER_TO_PEM,
* exit early with skip code if executable dependencies are missing or WOLFSSL_NO_PEM or NO_CODING, and
* add clean skip clauses to convert_to_pem(), compare_pem(), and pem_der_exp(), if WOLFSSL_NO_DER_TO_PEM.
Two follow-ups raised by Copilot review on PR #10247:
src/pk_rsa.c: Make derAllocSz a word32 instead of int and only assign
it after a successful XMALLOC, so the cleanup path can never call
ForceZero with a wrapped-around size derived from a negative derSz.
src/pk.c: Capture allocSz at the XMALLOC call site (and clear it back
to 0 on allocation failure) so the relationship between the buffer
allocation and the recorded size is explicit and cannot drift if the
surrounding control flow changes.
Kareem
JacobBarthelmeh
Paul Adelsbach
jordan
David Garske
Josh Holtrop
Thomas Cook
Daniel Pouzzner
Roy Carter
William Beasley (The Capable Hub)
S-P Chan
Andrew Hutchings
Mattia Moffa
Sean Parkinson
Eric Blankenhorn
Colton Willey
Jeremiah Mackey
Juliusz Sosinowicz
Lealem Amedie