wolfSSL now runs its cryptography on the hardware accelerators of the Nuvoton NuMicro M2354, an Arm Cortex-M23 microcontroller with TrustZone. Hashing, AES, RSA, and elliptic curve operations move off the CPU and onto the chip’s CRPT engine.
- Offloads SHA-1 through SHA-512, AES in ECB, CBC and CTR modes, AES-GCM and AES-CCM authenticated encryption, RSA, ECDSA and ECDH.
- Seeds the random number generator from the chip’s dedicated TRNG.
- Supports the Key Store, so an AES key can live in SRAM, Flash, or one time programmable slots and be used by handle. The key material never enters wolfSSL memory.
- Works in either TrustZone world. wolfSSL can run in the secure world and call the hardware directly, or in the non secure world and reach it through secure entry veneers.
- Falls back to software for anything the accelerator does not cover, so a build does not have to know in advance what the part supports.
On a NuMaker-M2354 at 96 MHz, SHA-256 goes from 771 KiB/s in software to 8.7 MiB/s on the engine, and AES-128-CBC from 411 KiB/s to 8.7 MiB/s. Both columns come from the same build with the optimised software math enabled, so the comparison is against wolfSSL configured properly for this core.
The M2354 is aimed at connected devices that need security in a small power budget. Doing the heavy cryptography in hardware frees the processor for the application and finishes the work sooner, which matters on a battery. Keeping keys in the Key Store raises the bar further, because the key is used by reference and is never present in application memory where a software fault could expose it.
Full details are in the PR #11445
Check out PR #628 for a runnable wolfCrypt test and benchmark for the NuMaker-M2354.
wolfBoot has a matching M2354 target that builds on this port, including the TrustZone arrangement (PR #884). https://github.com/wolfSSL/wolfBoot/pull/884
If you have questions about any of the above, please contact us at facts@wolfssl.com or call us at +1 425 245 8247.
Download wolfSSL Now