CHIPCryptoPALHsm_utils_trustm.cpp

/*
 *
 *    Copyright (c) 2024 Project CHIP Authors
 *
 *    Licensed under the Apache License, Version 2.0 (the "License");
 *    you may not use this file except in compliance with the License.
 *    You may obtain a copy of the License at
 *
 *        http://www.apache.org/licenses/LICENSE-2.0
 *
 *    Unless required by applicable law or agreed to in writing, software
 *    distributed under the License is distributed on an "AS IS" BASIS,
 *    WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
 *    See the License for the specific language governing permissions and
 *    limitations under the License.
 */

/**
 *    @file
 *      HSM based implementation of CHIP crypto primitives
 *      Based on configurations in CHIPCryptoPALHsm_config.h file,
 *      chip crypto apis use either HSM or rollback to software implementation.
 */

/* OPTIGA(TM) Trust M includes */
#include "CHIPCryptoPALHsm_utils_trustm.h"
#include "ifx_i2c_config.h"
#include "mbedtls/base64.h"
#include "optiga_crypt.h"
#include "optiga_lib_types.h"
#include "optiga_util.h"
#include "pal.h"
#include "pal_ifx_i2c_config.h"
#include "pal_os_event.h"
#include "pal_os_memory.h"
#include "pal_os_timer.h"
#include <FreeRTOS.h>

optiga_crypt_t * p_local_crypt = NULL;
optiga_util_t * p_local_util   = NULL;
static bool trustm_isOpen      = false;
#define ENABLE_HMAC_MULTI_STEP (0)
#define OPTIGA_UTIL_DER_BITSTRING_TAG (0x03)
#define OPTIGA_UTIL_DER_NUM_UNUSED_BITS (0x00)

#if ENABLE_HMAC_MULTI_STEP
#define MAX_MAC_DATA_LEN 640
#endif

// ================================================================================
// FreeRTOS Callbacks
// ================================================================================

/* This is a place from which we can poll the status of operation */

void vApplicationTickHook(void);

void vApplicationTickHook(void)
{
    pal_os_event_trigger_registered_callback();
}

#define WAIT_FOR_COMPLETION(ret)                                                                                                   \
    if (OPTIGA_LIB_SUCCESS != ret)                                                                                                 \
    {                                                                                                                              \
        break;                                                                                                                     \
    }                                                                                                                              \
    while (optiga_lib_status == OPTIGA_LIB_BUSY)                                                                                   \
    {                                                                                                                              \
        pal_os_event_trigger_registered_callback();                                                                                \
    }                                                                                                                              \
                                                                                                                                   \
    if (OPTIGA_LIB_SUCCESS != optiga_lib_status)                                                                                   \
    {                                                                                                                              \
        ret = optiga_lib_status;                                                                                                   \
        printf("Error: 0x%02X \r\n", optiga_lib_status);                                                                           \
        break;                                                                                                                     \
    }

#define CHECK_RESULT(expr)                                                                                                         \
    optiga_lib_status_t return_status = (int32_t) OPTIGA_DEVICE_ERROR;                                                             \
                                                                                                                                   \
    do                                                                                                                             \
    {                                                                                                                              \
        optiga_lib_status = OPTIGA_LIB_BUSY;                                                                                       \
        return_status     = expr;                                                                                                  \
        WAIT_FOR_COMPLETION(return_status);                                                                                        \
    } while (0);                                                                                                                   \
                                                                                                                                   \
    return return_status;

static volatile optiga_lib_status_t optiga_lib_status;

static void optiga_util_callback(void * context, optiga_lib_status_t return_status)
{
    optiga_lib_status = return_status;
}

// lint --e{818} suppress "argument "context" is not used in the sample provided"
static void optiga_crypt_callback(void * context, optiga_lib_status_t return_status)
{
    optiga_lib_status = return_status;
    if (NULL != context)
    {
        // callback to upper layer here
    }
}

/* Open session to trustm */
/**********************************************************************
 * trustm_Open()
 **********************************************************************/
static bool init = false;
void trustm_Open(void)
{
    optiga_lib_status_t xResult;
    uint16_t dOptigaOID = 0xE0C4;
    // Maximum Power, Minimum Current limitation
    uint8_t cCurrentLimit = 15;

    if (!trustm_isOpen)
    {
        optiga_lib_status_t return_status;
        do
        {
            /**
             * 1. Create OPTIGA Crypt Instance
             */
            p_local_crypt = optiga_crypt_create(0, optiga_crypt_callback, NULL);
            if (NULL == p_local_crypt)
            {
                break;
            }
            // printf("trustm created crypt Instance \r\n");
            /**
             * 1. Create OPTIGA Util Instance
             */
            p_local_util = optiga_util_create(0, optiga_util_callback, NULL);
            if (NULL == p_local_util)
            {
                break;
            }
            // printf("trustm created util Instance \r\n");
            /**
             * Open the application on OPTIGA which is a precondition to perform any other operations
             * using optiga_util_open_application
             */
            optiga_lib_status = OPTIGA_LIB_BUSY;
            return_status     = optiga_util_open_application(p_local_util, 0); // skip restore
            while (optiga_lib_status == OPTIGA_LIB_BUSY)

                // Only run once for initialisation
                if (init)
                {
                    xResult = optiga_util_write_data(p_local_util, dOptigaOID, OPTIGA_UTIL_WRITE_ONLY, 0, &cCurrentLimit, 1);

                    if (OPTIGA_LIB_SUCCESS != xResult)
                    {
                        break;
                    }
                    while (optiga_lib_status == OPTIGA_LIB_BUSY)
                        ;
                    // Set init to true
                    init = true;
                }

            if (OPTIGA_LIB_SUCCESS != return_status)
            {
                // optiga_util_open_application api returns error !!!
                printf("optiga_util_open_application api returns error !!!\n");
                break;
            }

            while (optiga_lib_status == OPTIGA_LIB_BUSY)
                ;
            if (OPTIGA_LIB_SUCCESS != optiga_lib_status)
            {
                // optiga_util_open_application failed
                printf("optiga_util_open_application failed\n");
                break;
            }

            // printf("trustm open application successful \r\n");

        } while (0);

        // p_local_util and p_local_crypt instance can be destroyed
        // if no close_application w.r.t hibernate is required to be performed
        if (p_local_util || p_local_crypt)
        {
            optiga_util_destroy(p_local_util);
            optiga_crypt_destroy(p_local_crypt);
        }
        trustm_isOpen = true;
    }
}

void trustm_close(void)
{
    optiga_lib_status_t return_status = OPTIGA_DEVICE_ERROR;

    do
    {
        /**
         * Close the application on OPTIGA after all the operations are executed
         * using optiga_util_close_application
         */
        optiga_lib_status = OPTIGA_LIB_BUSY;
        return_status     = optiga_util_close_application(p_local_util, 0);
        if (OPTIGA_LIB_SUCCESS != return_status)
            break;

        while (optiga_lib_status == OPTIGA_LIB_BUSY)
        {
            pal_os_event_trigger_registered_callback();
        }

        // destroy util and crypt instances
        optiga_util_destroy(p_local_util);
        optiga_crypt_destroy(p_local_crypt);
        pal_os_event_destroy(NULL);
        trustm_isOpen = false;
        return_status = OPTIGA_LIB_SUCCESS;
    } while (0);
}

void read_certificate_from_optiga(uint16_t optiga_oid, char * cert_pem, uint16_t * cert_pem_length)
{
    size_t ifx_cert_b64_len = 0;
    uint8_t ifx_cert_b64_temp[1200];
    uint16_t offset_to_write = 0, offset_to_read = 0;
    uint16_t size_to_copy = 0;
    optiga_lib_status_t return_status;

    optiga_util_t * me_util = NULL;
    uint8_t ifx_cert_hex[1024];
    uint16_t ifx_cert_hex_len = sizeof(ifx_cert_hex);

    do
    {
        // Create an instance of optiga_util to read the certificate from OPTIGA.
        me_util = optiga_util_create(0, optiga_util_callback, NULL);
        if (!me_util)
        {
            optiga_lib_print_message("optiga_util_create failed !!!", OPTIGA_UTIL_SERVICE, OPTIGA_UTIL_SERVICE_COLOR);
            break;
        }
        optiga_lib_status = OPTIGA_LIB_BUSY;
        return_status     = optiga_util_read_data(me_util, optiga_oid, 0, ifx_cert_hex, &ifx_cert_hex_len);
        if (OPTIGA_LIB_SUCCESS != return_status)
        {
            // optiga_util_read_data api returns error !!!
            optiga_lib_print_message("optiga_util_read_data api returns error !!!", OPTIGA_UTIL_SERVICE, OPTIGA_UTIL_SERVICE_COLOR);
            break;
        }

        while (optiga_lib_status == OPTIGA_LIB_BUSY)
            ;
        if (OPTIGA_LIB_SUCCESS != optiga_lib_status)
        {
            // optiga_util_read_data failed
            optiga_lib_print_message("optiga_util_read_data failed", OPTIGA_UTIL_SERVICE, OPTIGA_UTIL_SERVICE_COLOR);
            break;
        }

        // convert to PEM format
        // If the first byte is TLS Identity Tag, than we need to skip 9 first bytes
        offset_to_read = ifx_cert_hex[0] == 0xc0 ? 9 : 0;
        mbedtls_base64_encode((unsigned char *) ifx_cert_b64_temp, sizeof(ifx_cert_b64_temp), &ifx_cert_b64_len,
                              ifx_cert_hex + offset_to_read, ifx_cert_hex_len - offset_to_read);

        memcpy(cert_pem, "-----BEGIN CERTIFICATE-----\n", 28);
        offset_to_write += 28;

        // Properly copy certificate and format it as pkcs expects
        for (offset_to_read = 0; offset_to_read < (uint16_t) ifx_cert_b64_len;)
        {
            // The last block of data usually is less than 64, thus we need to find the leftover
            if ((offset_to_read + 64) >= (uint16_t) ifx_cert_b64_len)
                size_to_copy = (uint16_t) ifx_cert_b64_len - offset_to_read;
            else
                size_to_copy = 64;
            memcpy(cert_pem + offset_to_write, ifx_cert_b64_temp + offset_to_read, size_to_copy);
            offset_to_write += size_to_copy;
            offset_to_read += size_to_copy;
            cert_pem[offset_to_write] = '\n';
            offset_to_write++;
        }

        memcpy(cert_pem + offset_to_write, "-----END CERTIFICATE-----\n\0", 27);

        *cert_pem_length = offset_to_write + 27;

    } while (0);

    // me_util instance to be destroyed
    if (me_util)
    {
        optiga_util_destroy(me_util);
    }
}
void write_data(uint16_t optiga_oid, const uint8_t * p_data, uint16_t length)
{
    optiga_util_t * me_util = NULL;
    optiga_lib_status_t return_status;

    do
    {
        // Create an instance of optiga_util to open the application on OPTIGA.
        me_util = optiga_util_create(0, optiga_util_callback, NULL);
        if (!me_util)
        {
            optiga_lib_print_message("optiga_util_create failed !!!", OPTIGA_UTIL_SERVICE, OPTIGA_UTIL_SERVICE_COLOR);
            break;
        }

        optiga_lib_status = OPTIGA_LIB_BUSY;
        return_status     = optiga_util_write_data(me_util, optiga_oid, OPTIGA_UTIL_ERASE_AND_WRITE, 0, p_data, length);
        {
            if (OPTIGA_LIB_SUCCESS != return_status)
            {
                optiga_lib_print_message("optiga_util_wirte_data api returns error !!!", OPTIGA_UTIL_SERVICE,
                                         OPTIGA_UTIL_SERVICE_COLOR);
                break;
            }

            while (OPTIGA_LIB_BUSY == optiga_lib_status)
            {
                // Wait until the optiga_util_write_data operation is completed
            }

            if (OPTIGA_LIB_SUCCESS != optiga_lib_status)
            {
                optiga_lib_print_message("optiga_util_write_data failed", OPTIGA_UTIL_SERVICE, OPTIGA_UTIL_SERVICE_COLOR);
                return_status = optiga_lib_status;
                break;
            }
            else
            {
                optiga_lib_print_message("optiga_util_write_data successful", OPTIGA_UTIL_SERVICE, OPTIGA_UTIL_SERVICE_COLOR);
            }
        }
    } while (0);

    // me_util instance can be destroyed
    // if no close_application w.r.t hibernate is required to be performed
    if (me_util)
    {
        optiga_util_destroy(me_util);
    }
}

void write_metadata(uint16_t optiga_oid, const uint8_t * p_data, uint8_t length)
{
    optiga_util_t * me_util = NULL;
    optiga_lib_status_t return_status;

    do
    {
        // Create an instance of optiga_util to open the application on OPTIGA.
        me_util = optiga_util_create(0, optiga_util_callback, NULL);
        if (!me_util)
        {
            optiga_lib_print_message("optiga_util_create failed !!!", OPTIGA_UTIL_SERVICE, OPTIGA_UTIL_SERVICE_COLOR);
            break;
        }

        optiga_lib_status = OPTIGA_LIB_BUSY;
        return_status     = optiga_util_write_metadata(me_util, optiga_oid, p_data, length);
        {
            if (OPTIGA_LIB_SUCCESS != return_status)
            {
                optiga_lib_print_message("optiga_util_wirte_data api returns error !!!", OPTIGA_UTIL_SERVICE,
                                         OPTIGA_UTIL_SERVICE_COLOR);
                break;
            }

            while (OPTIGA_LIB_BUSY == optiga_lib_status)
            {
                // Wait until the optiga_util_write_metadata operation is completed
            }

            if (OPTIGA_LIB_SUCCESS != optiga_lib_status)
            {
                optiga_lib_print_message("optiga_util_write_metadata failed", OPTIGA_UTIL_SERVICE, OPTIGA_UTIL_SERVICE_COLOR);
                return_status = optiga_lib_status;
                break;
            }
            else
            {
                optiga_lib_print_message("optiga_util_write_metadata successful", OPTIGA_UTIL_SERVICE, OPTIGA_UTIL_SERVICE_COLOR);
            }
        }
    } while (0);

    // me_util instance can be destroyed
    // if no close_application w.r.t hibernate is required to be performed
    if (me_util)
    {
        optiga_util_destroy(me_util);
    }
}

optiga_lib_status_t deriveKey_HKDF(const uint8_t * salt, uint16_t salt_length, const uint8_t * info, uint16_t info_length,
                                   uint16_t derived_key_length, bool_t export_to_host, uint8_t * derived_key)
{
    optiga_lib_status_t return_status;

    do
    {
        // Create an instance of optiga_crypt_t
        p_local_crypt = optiga_crypt_create(0, optiga_crypt_callback, NULL);
        if (NULL == p_local_crypt)
        {
            optiga_lib_print_message("optiga_crypt_create failed !!!", OPTIGA_UTIL_SERVICE, OPTIGA_UTIL_SERVICE_COLOR);
            break;
        }

        optiga_lib_status = OPTIGA_LIB_BUSY;
        return_status     = optiga_crypt_hkdf(p_local_crypt, OPTIGA_HKDF_SHA_256, TRUSTM_HKDF_OID_KEY, /* Input secret OID */
                                              salt, salt_length, info, info_length, derived_key_length, TRUE, derived_key);
        if (OPTIGA_LIB_SUCCESS != return_status)
        {
            // optiga_crypt_hkdf api returns error !!!
            optiga_lib_print_message("optiga_crypt_hkdf api returns error !!!", OPTIGA_UTIL_SERVICE, OPTIGA_UTIL_SERVICE_COLOR);
            break;
        }

        while (p_local_crypt->instance_state != OPTIGA_LIB_INSTANCE_FREE)
            ;

        if (OPTIGA_LIB_SUCCESS != optiga_lib_status)
        {
            // optiga_crypt_hkdf failed
            optiga_lib_print_message("optiga_crypt_hkdf failed", OPTIGA_UTIL_SERVICE, OPTIGA_UTIL_SERVICE_COLOR);
            break;
        }
    } while (0);

    if (p_local_crypt)
    {
        optiga_crypt_destroy(p_local_crypt);
    }
    return return_status;
}

optiga_lib_status_t hmac_sha256(optiga_hmac_type_t type, const uint8_t * input_data, uint32_t input_data_length, uint8_t * mac,
                                uint32_t * mac_length)
{
    optiga_lib_status_t return_status;

    do
    {
        // Create an instance of optiga_crypt_t
        p_local_crypt = optiga_crypt_create(0, optiga_crypt_callback, NULL);
        if (NULL == p_local_crypt)
        {
            optiga_lib_print_message("optiga_crypt_create failed !!!", OPTIGA_UTIL_SERVICE, OPTIGA_UTIL_SERVICE_COLOR);
            break;
        }

        return_status = OPTIGA_LIB_BUSY;
#if ENABLE_HMAC_MULTI_STEP
        // If the size is less than the max length supported
        if (input_data_length <= MAX_MAC_DATA_LEN)
        {
            return_status =
                optiga_crypt_hmac(p_local_crypt, type, TRUSTM_HMAC_OID_KEY, input_data, input_data_length, mac, mac_length);
            if (OPTIGA_LIB_SUCCESS != return_status)
            {
                // optiga_crypt_hmac api returns error !!!
                optiga_lib_print_message("optiga_crypt_hmac api returns error !!!", OPTIGA_UTIL_SERVICE, OPTIGA_UTIL_SERVICE_COLOR);
                break;
            }
        }
        else
        {
            // Calculate HMAC in multiple steps
            uint32_t dataLenTemp  = 0;
            uint32_t remainingLen = input_data_length;
            // Start the HMAC Operation
            return_status = optiga_crypt_hmac_start(p_local_crypt, type, TRUSTM_HMAC_OID_KEY, input_data, MAX_MAC_DATA_LEN);

            if (OPTIGA_LIB_SUCCESS != return_status)
            {
                // optiga_crypt_hmac_start api returns error !!!
                optiga_lib_print_message("optiga_crypt_hmac_start api returns error !!!", OPTIGA_UTIL_SERVICE,
                                         OPTIGA_UTIL_SERVICE_COLOR);
                break;
            }
            remainingLen = input_data_length - MAX_MAC_DATA_LEN;

            while (remainingLen > 0)
            {
                dataLenTemp = (remainingLen > MAX_MAC_DATA_LEN) ? MAX_MAC_DATA_LEN : remainingLen;

                if (remainingLen > MAX_MAC_DATA_LEN)
                {
                    return_status = OPTIGA_LIB_BUSY;
                    // printf("HMAC Update\n");
                    // Continue HMAC operation on input data
                    return_status =
                        optiga_crypt_hmac_update(p_local_crypt, (input_data + (input_data_length - remainingLen)), dataLenTemp);
                    remainingLen = remainingLen - dataLenTemp;

                    if (OPTIGA_LIB_SUCCESS != return_status)
                    {
                        // optiga_crypt_hmac_update api returns error !!!
                        optiga_lib_print_message("optiga_crypt_hmac_update api returns error !!!", OPTIGA_UTIL_SERVICE,
                                                 OPTIGA_UTIL_SERVICE_COLOR);
                        break;
                    }
                }
                else
                {
                    // End HMAC sequence and return the MAC generated
                    // printf("HMAC Finalize\n");
                    return_status = OPTIGA_LIB_BUSY;
                    return_status = optiga_crypt_hmac_finalize(p_local_crypt, (input_data + (input_data_length - remainingLen)),
                                                               dataLenTemp, mac, mac_length);

                    if (OPTIGA_LIB_SUCCESS != return_status)
                    {
                        // optiga_crypt_hmac_finalize api returns error !!!
                        optiga_lib_print_message("optiga_crypt_hmac_finalize api returns error !!!", OPTIGA_UTIL_SERVICE,
                                                 OPTIGA_UTIL_SERVICE_COLOR);
                        break;
                    }
                }
            }
        }
#else

        return_status = optiga_crypt_hmac(p_local_crypt, type, TRUSTM_HMAC_OID_KEY, input_data, input_data_length, mac, mac_length);
        // printf("Output Length %ld Input Length %ld \n", *mac_length, input_data_length);
        if (OPTIGA_LIB_SUCCESS != return_status)
        {
            // optiga_crypt_hmac api returns error !!!
            optiga_lib_print_message("optiga_crypt_hmac api returns error !!!", OPTIGA_UTIL_SERVICE, OPTIGA_UTIL_SERVICE_COLOR);
            break;
        }

        while (p_local_crypt->instance_state != OPTIGA_LIB_INSTANCE_FREE)
            ;

        if (OPTIGA_LIB_SUCCESS != optiga_lib_status)
        {
            // optiga_crypt_hkdf failed
            optiga_lib_print_message("optiga_crypt_hkdf failed", OPTIGA_UTIL_SERVICE, OPTIGA_UTIL_SERVICE_COLOR);
            break;
        }
#endif
    } while (0);

    if (p_local_crypt)
    {
        optiga_crypt_destroy(p_local_crypt);
    }
    return return_status;
}
optiga_lib_status_t optiga_crypt_rng(uint8_t * random_data, uint16_t random_data_length)
{
    optiga_lib_status_t return_status;
    do
    {
        // Create an instance of optiga_crypt_t
        p_local_crypt = optiga_crypt_create(0, optiga_crypt_callback, NULL);
        if (NULL == p_local_crypt)
        {
            optiga_lib_print_message("optiga_crypt_create failed !!!", OPTIGA_UTIL_SERVICE, OPTIGA_UTIL_SERVICE_COLOR);
            break;
        }

        return_status = OPTIGA_LIB_BUSY;
        return_status = optiga_crypt_random(p_local_crypt, OPTIGA_RNG_TYPE_DRNG, random_data, random_data_length);
        if (OPTIGA_LIB_SUCCESS != return_status)
        {
            // optiga_crypt_random api returns error !!!
            optiga_lib_print_message("optiga_crypt_random api returns error !!!", OPTIGA_UTIL_SERVICE, OPTIGA_UTIL_SERVICE_COLOR);
            break;
        }

        while (p_local_crypt->instance_state != OPTIGA_LIB_INSTANCE_FREE)
            ;

        if (OPTIGA_LIB_SUCCESS != optiga_lib_status)
        {
            // optiga_crypt_random failed
            optiga_lib_print_message("optiga_crypt_random failed", OPTIGA_UTIL_SERVICE, OPTIGA_UTIL_SERVICE_COLOR);
            break;
        }
    } while (0);

    if (p_local_crypt)
    {
        optiga_crypt_destroy(p_local_crypt);
    }
    return return_status;
}
optiga_lib_status_t trustm_ecc_keygen(uint16_t optiga_key_id, uint8_t key_type, optiga_ecc_curve_t curve_id, uint8_t * pubkey,
                                      uint16_t * pubkey_length)
{
    optiga_lib_status_t return_status;
    uint8_t header256[] = { 0x30, 0x59, 0x30, 0x13, 0x06, 0x07, 0x2A, 0x86, 0x48, 0xCE, 0x3D, 0x02,
                            0x01, 0x06, 0x08, 0x2A, 0x86, 0x48, 0xCE, 0x3D, 0x03, 0x01, 0x07 };
    uint16_t i;
    for (i = 0; i < sizeof(header256); i++)
    {
        pubkey[i] = header256[i];
    }
    do
    {
        // Create an instance of optiga_crypt_t
        p_local_crypt = optiga_crypt_create(0, optiga_crypt_callback, NULL);
        if (NULL == p_local_crypt)
        {
            optiga_lib_print_message("optiga_crypt_create failed !!!", OPTIGA_UTIL_SERVICE, OPTIGA_UTIL_SERVICE_COLOR);
            break;
        }

        optiga_lib_status = OPTIGA_LIB_BUSY;
        return_status = optiga_crypt_ecc_generate_keypair(p_local_crypt, curve_id, key_type, FALSE, &optiga_key_id, (pubkey + i),
                                                          pubkey_length);
        if (OPTIGA_LIB_SUCCESS != return_status)
        {
            // optiga_crypt_ecc_generate_keypair api returns error !!!
            optiga_lib_print_message("optiga_crypt_ecc_generate_keypair api returns error !!!", OPTIGA_UTIL_SERVICE,
                                     OPTIGA_UTIL_SERVICE_COLOR);
            break;
        }

        while (p_local_crypt->instance_state != OPTIGA_LIB_INSTANCE_FREE)
            ;

    } while (0);

    if (p_local_crypt)
    {
        optiga_crypt_destroy(p_local_crypt);
    }

    *pubkey_length += sizeof(header256);
    return return_status;
}
void trustmGetKey(uint16_t optiga_oid, uint8_t * pubkey, uint16_t * pubkeyLen)
{
    optiga_lib_status_t return_status;
    uint16_t offset = 0;
    do
    {
        // Create an instance of optiga_crypt_t
        p_local_util = optiga_util_create(0, optiga_util_callback, NULL);
        if (NULL == p_local_util)
        {
            optiga_lib_print_message("optiga_util_create failed !!!", OPTIGA_UTIL_SERVICE, OPTIGA_UTIL_SERVICE_COLOR);
            break;
        }

        optiga_lib_status = OPTIGA_LIB_BUSY;
        return_status     = optiga_util_read_data(p_local_util, optiga_oid, offset, pubkey, pubkeyLen);
        if (OPTIGA_LIB_SUCCESS != return_status)
        {
            // optiga_util_read_pubkey api returns error !!!
            optiga_lib_print_message("optiga_util_read_pubkey returns error !!!", OPTIGA_UTIL_SERVICE, OPTIGA_UTIL_SERVICE_COLOR);
            break;
        }

        while (optiga_lib_status == OPTIGA_LIB_BUSY)
            ;

    } while (0);

    if (p_local_util)
    {
        optiga_util_destroy(p_local_util);
    }
}
optiga_lib_status_t trustm_hash(uint8_t * msg, uint16_t msg_length, uint8_t * digest, uint8_t digest_length)
{
    optiga_lib_status_t return_status;
    hash_data_from_host_t hash_data_host;
    do
    {
        // Create an instance of optiga_crypt_t
        p_local_crypt = optiga_crypt_create(0, optiga_crypt_callback, NULL);
        if (NULL == p_local_crypt)
        {
            optiga_lib_print_message("optiga_crypt_create failed !!!", OPTIGA_UTIL_SERVICE, OPTIGA_UTIL_SERVICE_COLOR);
            break;
        }
        hash_data_host.buffer = msg;
        hash_data_host.length = msg_length;
        optiga_lib_status     = OPTIGA_LIB_BUSY;
        return_status = optiga_crypt_hash(p_local_crypt, OPTIGA_HASH_TYPE_SHA_256, OPTIGA_CRYPT_HOST_DATA, &hash_data_host, digest);

        if (OPTIGA_LIB_SUCCESS != return_status)
        {
            // optiga_crypt_ecdsa_sign api returns error !!!
            optiga_lib_print_message("optiga_crypt_hash api returns error !!!", OPTIGA_UTIL_SERVICE, OPTIGA_UTIL_SERVICE_COLOR);
            break;
        }

        while (p_local_crypt->instance_state != OPTIGA_LIB_INSTANCE_FREE)
            ;

    } while (0);

    if (p_local_crypt)
    {
        optiga_crypt_destroy(p_local_crypt);
    }
    return return_status;
}
optiga_lib_status_t trustm_ecdsa_sign(optiga_key_id_t optiga_key_id, uint8_t * digest, uint8_t digest_length, uint8_t * signature,
                                      uint16_t * signature_length)
{
    optiga_lib_status_t return_status;
    int i;
    do
    {
        // Create an instance of optiga_crypt_t
        p_local_crypt = optiga_crypt_create(0, optiga_crypt_callback, NULL);
        if (NULL == p_local_crypt)
        {
            optiga_lib_print_message("optiga_crypt_create failed !!!", OPTIGA_UTIL_SERVICE, OPTIGA_UTIL_SERVICE_COLOR);
            break;
        }
        optiga_lib_status = OPTIGA_LIB_BUSY;
        return_status = optiga_crypt_ecdsa_sign(p_local_crypt, digest, digest_length, optiga_key_id, signature, signature_length);
        if (OPTIGA_LIB_SUCCESS != return_status)
        {
            // optiga_crypt_ecdsa_sign api returns error !!!
            optiga_lib_print_message("optiga_crypt_ecdsa_sign api returns error !!!", OPTIGA_UTIL_SERVICE,
                                     OPTIGA_UTIL_SERVICE_COLOR);
            break;
        }

        while (p_local_crypt->instance_state != OPTIGA_LIB_INSTANCE_FREE)
            ;

        for (i = (*signature_length - 1); i >= 0; i--)
        {
            signature[i + 2] = signature[i];
        }

        signature[0]      = 0x30;                          // Insert SEQUENCE
        signature[1]      = (uint8_t) (*signature_length); // insert length
        *signature_length = *signature_length + 2;

    } while (0);

    if (p_local_crypt)
    {
        optiga_crypt_destroy(p_local_crypt);
    }
    return return_status;
}
void ecc_pub_key_bit(uint8_t * q_buffer, uint8_t q_length, uint8_t * pub_key_buffer, uint16_t * pub_key_length)
{
#define OPTIGA_UTIL_ECC_DER_ADDITIONAL_LENGTH (0x02)

    uint16_t index = 0;

    pub_key_buffer[index++] = OPTIGA_UTIL_DER_BITSTRING_TAG;
    pub_key_buffer[index++] = q_length + OPTIGA_UTIL_ECC_DER_ADDITIONAL_LENGTH;
    pub_key_buffer[index++] = OPTIGA_UTIL_DER_NUM_UNUSED_BITS;
    // Compression format. Supports only 04 [uncompressed]
    pub_key_buffer[index++] = 0x04;

    pal_os_memcpy(&pub_key_buffer[index], q_buffer, q_length);
    index += q_length;

    *pub_key_length = index;

#undef OPTIGA_UTIL_ECC_DER_ADDITIONAL_LENGTH
}
optiga_lib_status_t trustm_ecdsa_verify(uint8_t * digest, uint8_t digest_length, uint8_t * signature, uint16_t signature_length,
                                        uint8_t * ecc_pubkey, uint8_t ecc_pubkey_length)
{
    optiga_lib_status_t return_status;
    uint8_t ecc_public_key[70] = { 0x00 };
    uint16_t i;
    uint16_t ecc_public_key_length = 0;
    ecc_pub_key_bit(ecc_pubkey, ecc_pubkey_length, ecc_public_key, &ecc_public_key_length);

    public_key_from_host_t public_key_details = { ecc_public_key, ecc_public_key_length, (uint8_t) OPTIGA_ECC_CURVE_NIST_P_256 };
    do
    {
        // Create an instance of optiga_crypt_t
        p_local_crypt = optiga_crypt_create(0, optiga_crypt_callback, NULL);

        if (NULL == p_local_crypt)
        {
            optiga_lib_print_message("optiga_crypt_create failed !!!", OPTIGA_UTIL_SERVICE, OPTIGA_UTIL_SERVICE_COLOR);
            break;
        }
        signature_length = signature[1];
        for (i = 0; i < signature_length; i++)
        {
            signature[i] = signature[i + 2];
        }
        return_status = OPTIGA_LIB_BUSY;
        return_status = optiga_crypt_ecdsa_verify(p_local_crypt, digest, digest_length, signature, signature_length,
                                                  OPTIGA_CRYPT_HOST_DATA, &public_key_details);
        if (OPTIGA_LIB_SUCCESS != return_status)
        {
            // optiga_crypt_ecdsa_verify api returns error !!!
            optiga_lib_print_message("optiga_crypt_ecdsa_verify api returns error !!!", OPTIGA_UTIL_SERVICE,
                                     OPTIGA_UTIL_SERVICE_COLOR);
            break;
        }

        while (p_local_crypt->instance_state != OPTIGA_LIB_INSTANCE_FREE)
            ;

    } while (0);

    if (p_local_crypt)
    {
        optiga_crypt_destroy(p_local_crypt);
    }
    return return_status;
}

CHIP_ERROR trustmGetCertificate(uint16_t optiga_oid, uint8_t * buf, uint16_t * buflen)
{
    optiga_lib_status_t return_status;
    VerifyOrReturnError(buf != nullptr, CHIP_ERROR_INTERNAL);
    VerifyOrReturnError(buflen != nullptr, CHIP_ERROR_INTERNAL);

    uint8_t ifx_cert_hex[1024];
    uint16_t ifx_cert_hex_len = sizeof(ifx_cert_hex);

    trustm_Open();
    do
    {
        // Create an instance of optiga_util to read the certificate from OPTIGA.
        p_local_util = optiga_util_create(0, optiga_util_callback, NULL);
        if (!p_local_util)
        {
            optiga_lib_print_message("optiga_util_create failed !!!", OPTIGA_UTIL_SERVICE, OPTIGA_UTIL_SERVICE_COLOR);
            break;
        }
        optiga_lib_status = OPTIGA_LIB_BUSY;
        return_status     = optiga_util_read_data(p_local_util, optiga_oid, 0, ifx_cert_hex, &ifx_cert_hex_len);
        if (OPTIGA_LIB_SUCCESS != return_status)
        {
            // optiga_util_read_data api returns error !!!
            optiga_lib_print_message("optiga_util_read_data api returns error !!!", OPTIGA_UTIL_SERVICE, OPTIGA_UTIL_SERVICE_COLOR);
            break;
        }
        while (optiga_lib_status == OPTIGA_LIB_BUSY)
            ;
        if (OPTIGA_LIB_SUCCESS != optiga_lib_status)
        {
            // optiga_util_read_data failed
            optiga_lib_print_message("optiga_util_read_data failed", OPTIGA_UTIL_SERVICE, OPTIGA_UTIL_SERVICE_COLOR);
            break;
        }

        memcpy(buf, ifx_cert_hex, ifx_cert_hex_len);
        *buflen = ifx_cert_hex_len;
    } while (0);

    if (p_local_util)
    {
        optiga_util_destroy(p_local_util);
    }
    return CHIP_NO_ERROR;
}
optiga_lib_status_t trustm_ecdh_derive_secret(optiga_key_id_t optiga_key_id, uint8_t * public_key, uint16_t public_key_length,
                                              uint8_t * shared_secret, uint8_t shared_secret_length)
{
    optiga_lib_status_t return_status;
    static public_key_from_host_t public_key_details = {
        (uint8_t *) public_key,
        public_key_length,
        (uint8_t) OPTIGA_ECC_CURVE_NIST_P_256,
    };
    do
    {
        // Create an instance of optiga_crypt_t
        p_local_crypt = optiga_crypt_create(0, optiga_crypt_callback, NULL);

        if (NULL == p_local_crypt)
        {
            optiga_lib_print_message("optiga_crypt_create failed !!!", OPTIGA_UTIL_SERVICE, OPTIGA_UTIL_SERVICE_COLOR);
            break;
        }

        optiga_lib_status = OPTIGA_LIB_BUSY;
        return_status     = optiga_crypt_ecdh(p_local_crypt, optiga_key_id, &public_key_details, TRUE, shared_secret);
        if (OPTIGA_LIB_SUCCESS != return_status)
        {
            // optiga_crypt_ecdh api returns error !!!
            optiga_lib_print_message("optiga_crypt_ecdh api returns error !!!", OPTIGA_UTIL_SERVICE, OPTIGA_UTIL_SERVICE_COLOR);
            break;
        }

        while (p_local_crypt->instance_state != OPTIGA_LIB_INSTANCE_FREE)
            ;

    } while (0);

    if (p_local_crypt)
    {
        optiga_crypt_destroy(p_local_crypt);
    }
    return return_status;
}

optiga_lib_status_t trustm_PBKDF2_HMAC(const unsigned char * salt, size_t slen, unsigned int iteration_count, uint32_t key_length,
                                       unsigned char * output)
{
    optiga_lib_status_t return_status;
    uint8_t md1[32];
    uint32_t md1_len = sizeof(md1);
    uint8_t work[32];
    uint32_t work_len = sizeof(work);

    unsigned char * out_p = output;
    do
    {
        // Create an instance of optiga_crypt_t
        p_local_crypt = optiga_crypt_create(0, optiga_crypt_callback, NULL);
        if (NULL == p_local_crypt)
        {
            optiga_lib_print_message("optiga_crypt_create failed!!!", OPTIGA_UTIL_SERVICE, OPTIGA_UTIL_SERVICE_COLOR);
            break;
        }

        // Calculate U1, U1 ends up in work
        return_status =
            optiga_crypt_hmac(p_local_crypt, OPTIGA_HMAC_SHA_256, TRUSTM_HMAC_OID_KEY, salt, (uint32_t) slen, work, &work_len);

        if (OPTIGA_LIB_SUCCESS != return_status)
        {
            optiga_lib_print_message("optiga_crypt_hmac api returns error!!!", OPTIGA_UTIL_SERVICE, OPTIGA_UTIL_SERVICE_COLOR);
            break;
        }
        return_status = OPTIGA_LIB_BUSY;
        memcpy(md1, work, md1_len);
        for (unsigned int i = 1; i < iteration_count; i++)
        {
            // Calculated subsequent U, which ends up in md1
            return_status = optiga_crypt_hmac(p_local_crypt, OPTIGA_HMAC_SHA_256, TRUSTM_HMAC_OID_KEY, md1, md1_len, md1, &md1_len);

            if (OPTIGA_LIB_SUCCESS != return_status)
            {
                optiga_lib_print_message("optiga_crypt_hmac api returns error!!!", OPTIGA_UTIL_SERVICE, OPTIGA_UTIL_SERVICE_COLOR);
                break;
            }
            return_status = OPTIGA_LIB_BUSY;

            // U1 xor U2
            for (int j = 0; j < (int) md1_len; j++)
            {
                work[j] ^= md1[j];
            }
        }

        while (p_local_crypt->instance_state != OPTIGA_LIB_INSTANCE_FREE)
            ;

        if (OPTIGA_LIB_SUCCESS != optiga_lib_status)

        {

            // optiga_crypt_hkdf failed

            optiga_lib_print_message("optiga_crypt_pbkdf_hmac failed failed", OPTIGA_UTIL_SERVICE, OPTIGA_UTIL_SERVICE_COLOR);

            break;
        }
        memcpy(out_p, work, key_length);
    } while (0);

    if (p_local_crypt)
    {
        optiga_crypt_destroy(p_local_crypt);
    }
    return return_status;
}