Skip to content

[stm32n6_crypt] Zeroize key/iv registers on error #51

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
aidangarske merged 1 commit into from
Jul 2, 2026
Merged

[stm32n6_crypt] Zeroize key/iv registers on error #51

Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
48 changes: 38 additions & 10 deletions src/crypto/stm32n6_cryp.c
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -308,6 +308,7 @@ static whal_Error Process_BlockCipher(const uint8_t *in, uint8_t *out, size_t sz
err = WaitOutputReady(base, cfg->timeout);
Comment thread
aidangarske marked this conversation as resolved.
if (err) {
Disable(base);
ZeroKeyIv(base);
return err;
}
ReadBlock(base, out + i);
Expand Down Expand Up @@ -447,7 +448,7 @@ whal_Error whal_Stm32n6_CrypAesEcb_Start(whal_AesEcb *dev,
err = PrepareDecryptionKey(base, key, keySz, keySizeBits,
cfg->timeout);
if (err)
return err;
goto cleanup;
ConfigureMode(base, CRYP_ALGOMODE_AES_ECB, CRYP_ALGODIR_DECRYPT,
keySizeBits, 0, 0, 0);
Enable(base);
Expand All @@ -458,11 +459,16 @@ whal_Error whal_Stm32n6_CrypAesEcb_Start(whal_AesEcb *dev,
WriteKey(base, key, keySz);
err = WaitKeyValid(base, cfg->timeout);
if (err)
return err;
goto cleanup;
Enable(base);
}

return WHAL_SUCCESS;

cleanup:
Disable(base);
ZeroKeyIv(base);
return err;
}

whal_Error whal_Stm32n6_CrypAesEcb_Process(whal_AesEcb *dev,
Expand Down Expand Up @@ -554,7 +560,7 @@ whal_Error whal_Stm32n6_CrypAesCbc_Start(whal_AesCbc *dev,
err = PrepareDecryptionKey(base, key, keySz, keySizeBits,
cfg->timeout);
if (err)
return err;
goto cleanup;
ConfigureMode(base, CRYP_ALGOMODE_AES_CBC, CRYP_ALGODIR_DECRYPT,
keySizeBits, 0, 0, 0);
WriteIv16(base, (const uint8_t *)iv);
Expand All @@ -567,11 +573,16 @@ whal_Error whal_Stm32n6_CrypAesCbc_Start(whal_AesCbc *dev,
WriteKey(base, key, keySz);
err = WaitKeyValid(base, cfg->timeout);
if (err)
return err;
goto cleanup;
Enable(base);
}

return WHAL_SUCCESS;

cleanup:
Disable(base);
ZeroKeyIv(base);
return err;
}

whal_Error whal_Stm32n6_CrypAesCbc_Process(whal_AesCbc *dev,
Expand Down Expand Up @@ -661,10 +672,15 @@ whal_Error whal_Stm32n6_CrypAesCtr_Start(whal_AesCtr *dev,
WriteKey(base, key, keySz);
err = WaitKeyValid(base, cfg->timeout);
if (err)
return err;
goto cleanup;
Enable(base);

return WHAL_SUCCESS;

cleanup:
Disable(base);
ZeroKeyIv(base);
return err;
}

whal_Error whal_Stm32n6_CrypAesCtr_Process(whal_AesCtr *dev,
Expand Down Expand Up @@ -911,12 +927,12 @@ whal_Error whal_Stm32n6_CrypAesGcm_Start(whal_AesGcm *dev,
err = GcmInit((const uint8_t *)key, keySz,
keySizeBits, algoDir, (const uint8_t *)iv);
if (err)
return err;
goto cleanup;

/* Header phase */
err = GcmHeaderPhase((const uint8_t *)aad, aadSz);
if (err)
return err;
goto cleanup;

/* Transition to payload phase */
Disable(base);
Expand All @@ -930,6 +946,11 @@ whal_Error whal_Stm32n6_CrypAesGcm_Start(whal_AesGcm *dev,
g_aesGcmState.dataSz = 0;

return WHAL_SUCCESS;

cleanup:
Disable(base);
ZeroKeyIv(base);
return err;
}

whal_Error whal_Stm32n6_CrypAesGcm_Process(whal_AesGcm *dev,
Expand Down Expand Up @@ -967,6 +988,7 @@ whal_Error whal_Stm32n6_CrypAesGcm_Process(whal_AesGcm *dev,
err = WaitOutputReady(base, cfg->timeout);
if (err) {
Disable(base);
ZeroKeyIv(base);
return err;
}

Expand Down Expand Up @@ -1379,13 +1401,13 @@ whal_Error whal_Stm32n6_CrypAesCcm_Start(whal_AesCcm *dev,
WriteKey(base, key, keySz);
err = WaitKeyValid(base, cfg->timeout);
if (err)
return err;
goto cleanup;
Enable(base);

WriteBlock(base, b0);
err = WaitCrypEnClear(base, cfg->timeout);
if (err)
return err;
goto cleanup;

/* Header phase (AAD) */
if (aadSz > 0) {
Expand Down Expand Up @@ -1417,7 +1439,7 @@ whal_Error whal_Stm32n6_CrypAesCcm_Start(whal_AesCcm *dev,

err = WaitBusyClear(base, cfg->timeout);
if (err)
return err;
goto cleanup;
}

/* Transition to payload phase */
Expand All @@ -1432,6 +1454,11 @@ whal_Error whal_Stm32n6_CrypAesCcm_Start(whal_AesCcm *dev,
g_aesCcmState.dataSz = 0;

return WHAL_SUCCESS;

cleanup:
Disable(base);
ZeroKeyIv(base);
return err;
}

whal_Error whal_Stm32n6_CrypAesCcm_Process(whal_AesCcm *dev,
Expand Down Expand Up @@ -1480,6 +1507,7 @@ whal_Error whal_Stm32n6_CrypAesCcm_Process(whal_AesCcm *dev,
err = WaitOutputReady(base, cfg->timeout);
if (err) {
Disable(base);
ZeroKeyIv(base);
return err;
}

Expand Down
Loading