Crypt module (#549)

- Moved cryptography code out of Tactility project and into a kernel module.
- Converted C++ code to C style interface
- Hardened security
This commit is contained in:
Ken Van Hoeylandt
2026-07-05 11:17:42 +02:00
committed by GitHub
parent 9d5993930d
commit dfaeb9a2d9
229 changed files with 482 additions and 112246 deletions
@@ -1,64 +0,0 @@
/** @file secure.h
*
* @brief Hardware-bound encryption methods.
* @warning Enable secure boot and flash encryption to increase security.
*
* Offers AES 256 CBC encryption with built-in key.
* The key is built from data including:
* - the internal factory MAC address
* - random data stored in NVS
*
* It's important to use flash encryption to avoid an attacker to get
* access to your encrypted data. If flash encryption is disabled,
* someone can fetch the key from the partitions.
*
* See:
* https://docs.espressif.com/projects/esp-idf/en/latest/esp32/security/secure-boot-v2.html
* https://docs.espressif.com/projects/esp-idf/en/latest/esp32/security/flash-encryption.html
*/
#pragma once
#include <cstdio>
#include <cstdint>
#include <string>
namespace tt::crypt {
/**
* @brief Fills the IV with zeros and then creates an IV based on the input data.
* @param[in] data input data
* @param[in] dataLength input data length
* @param[out] iv output IV
*/
void getIv(const void* data, size_t dataLength, uint8_t iv[16]);
/**
* @brief Encrypt data.
*
* Important: Use flash encryption to increase security.
* Important: input and output data must be aligned to 16 bytes.
*
* @param[in] iv the AES IV
* @param[in] inData input data
* @param[out] outData output data
* @param[in] dataLength data length, a multiple of 16 (for both inData and outData)
* @return the result of esp_aes_crypt_cbc() (MBEDTLS_ERR_*)
*/
int encrypt(const uint8_t iv[16], const uint8_t* inData, uint8_t* outData, size_t dataLength);
/**
* @brief Decrypt data.
*
* Important: Use flash encryption to increase security.
* Important: input and output data must be aligned to 16 bytes.
*
* @param[in] iv AES IV
* @param[in] inData input data
* @param[out] outData output data
* @param[in] dataLength data length, a multiple of 16 (for both inData and outData)
* @return the result of esp_aes_crypt_cbc() (MBEDTLS_ERR_*)
*/
int decrypt(const uint8_t iv[16], const uint8_t* inData, uint8_t* outData, size_t dataLength);
} // namespace
@@ -1,23 +0,0 @@
#pragma once
#include <cstddef>
#include <cstdint>
namespace tt::crypt {
/**
* Implementation of DJB2 hashing algorithm.
* @param[in] str the string to calculate the hash for
* @return the hash
*/
uint32_t djb2(const char* str);
/**
* Implementation of DJB2 hashing algorithm.
* @param[in] data the bytes to calculate the hash for
* @param[in] length the size of data
* @return the hash
*/
uint32_t djb2(const void* data, size_t length);
} // namespace