From 53b5a6bed4bf2deb96cd96a181607ff3205be604 Mon Sep 17 00:00:00 2001 From: aidan garske Date: Mon, 20 Jul 2026 16:35:37 -0700 Subject: [PATCH 01/12] Document STM32Cube pack support in README --- README.md | 18 ++++++++++++++++++ 1 file changed, 18 insertions(+) diff --git a/README.md b/README.md index a97709c..6424e82 100644 --- a/README.md +++ b/README.md @@ -17,6 +17,7 @@ wolfCOSE is a lightweight C library implementing [CBOR (RFC 8949)](https://www.r (`WOLFCOSE_LEAN_VERIFY_MLDSA`) and **~35.8 KB** sign + verify, within about 1 KB of classical ES256. The wolfCOSE portion alone is **4.6 KB** and **~6.6 KB** respectively. See [Footprint](https://github.com/wolfSSL/wolfCOSE/wiki/Footprint) - **Path to FIPS 140-3**: via wolfCrypt **FIPS Certificate #4718** (sole crypto dependency) +- **STM32Cube ready**: available as a drop-in STM32Cube pack (`I-CUBE-wolfCOSE`) for STM32CubeMX and STM32CubeIDE, so STM32 devices get COSE and CBOR out of the box (see [STM32Cube Support](#stm32cube-support)) ## Supported Algorithms @@ -147,6 +148,23 @@ See `examples/` for complete working code: - `comprehensive/`: algorithm matrix tests - `scenarios/`: firmware signing, attestation, fleet config +## STM32Cube Support + +wolfCOSE ships as a ready to use STM32Cube pack, `I-CUBE-wolfCOSE`, so it drops +into any STM32CubeMX or STM32CubeIDE project without manual source integration. + +1. Download the wolfCOSE pack (`wolfSSL.I-CUBE-wolfCOSE`) from + [wolfssl.com/files/ide](https://www.wolfssl.com/files/ide/). +2. In STM32CubeMX, use `Help`, `Manage embedded software packages`, + `From Local...` to install it. Install the `I-CUBE-wolfSSL` pack first, since + wolfCOSE uses wolfCrypt for all cryptography. +3. Under `Software Packs`, `Select Components`, enable `wolfCOSE` `Core` and + `wolfSSL` `wolfCrypt` `Core`, then generate code. + +The pack targets Cortex-M0 through Cortex-M55 and STM32MP1. COSE algorithm +support is configured through the wolfSSL `user_settings.h`, the same way the +standalone library is configured. + ## CI / Testing Runs on every push and PR: From 4715b6827b1da4f0903e641467c823bc96104539 Mon Sep 17 00:00:00 2001 From: aidan garske Date: Mon, 20 Jul 2026 16:49:03 -0700 Subject: [PATCH 02/12] Move STM32Cube docs to a wiki page and slim the README --- README.md | 20 ++------------ docs/Home.md | 1 + docs/STM32Cube.md | 67 +++++++++++++++++++++++++++++++++++++++++++++++ docs/_Sidebar.md | 1 + 4 files changed, 71 insertions(+), 18 deletions(-) create mode 100644 docs/STM32Cube.md diff --git a/README.md b/README.md index 6424e82..fcb2b6d 100644 --- a/README.md +++ b/README.md @@ -17,7 +17,7 @@ wolfCOSE is a lightweight C library implementing [CBOR (RFC 8949)](https://www.r (`WOLFCOSE_LEAN_VERIFY_MLDSA`) and **~35.8 KB** sign + verify, within about 1 KB of classical ES256. The wolfCOSE portion alone is **4.6 KB** and **~6.6 KB** respectively. See [Footprint](https://github.com/wolfSSL/wolfCOSE/wiki/Footprint) - **Path to FIPS 140-3**: via wolfCrypt **FIPS Certificate #4718** (sole crypto dependency) -- **STM32Cube ready**: available as a drop-in STM32Cube pack (`I-CUBE-wolfCOSE`) for STM32CubeMX and STM32CubeIDE, so STM32 devices get COSE and CBOR out of the box (see [STM32Cube Support](#stm32cube-support)) +- **STM32Cube ready**: available as a drop-in STM32Cube pack (`I-CUBE-wolfCOSE`) for STM32CubeMX and STM32CubeIDE, so STM32 devices get COSE and CBOR out of the box (see [STM32Cube](https://github.com/wolfSSL/wolfCOSE/wiki/STM32Cube)) ## Supported Algorithms @@ -148,23 +148,6 @@ See `examples/` for complete working code: - `comprehensive/`: algorithm matrix tests - `scenarios/`: firmware signing, attestation, fleet config -## STM32Cube Support - -wolfCOSE ships as a ready to use STM32Cube pack, `I-CUBE-wolfCOSE`, so it drops -into any STM32CubeMX or STM32CubeIDE project without manual source integration. - -1. Download the wolfCOSE pack (`wolfSSL.I-CUBE-wolfCOSE`) from - [wolfssl.com/files/ide](https://www.wolfssl.com/files/ide/). -2. In STM32CubeMX, use `Help`, `Manage embedded software packages`, - `From Local...` to install it. Install the `I-CUBE-wolfSSL` pack first, since - wolfCOSE uses wolfCrypt for all cryptography. -3. Under `Software Packs`, `Select Components`, enable `wolfCOSE` `Core` and - `wolfSSL` `wolfCrypt` `Core`, then generate code. - -The pack targets Cortex-M0 through Cortex-M55 and STM32MP1. COSE algorithm -support is configured through the wolfSSL `user_settings.h`, the same way the -standalone library is configured. - ## CI / Testing Runs on every push and PR: @@ -211,6 +194,7 @@ Full documentation is available in the [Wiki](https://github.com/wolfSSL/wolfCOS - [Testing](https://github.com/wolfSSL/wolfCOSE/wiki/Testing): Test infrastructure, coverage, and failure injection - [MISRA Compliance](https://github.com/wolfSSL/wolfCOSE/wiki/MISRA-Compliance): MISRA C:2012 and C:2023 compliance status and deviation rationale - [Project Structure](https://github.com/wolfSSL/wolfCOSE/wiki/Project-Structure): Source file layout +- [STM32Cube](https://github.com/wolfSSL/wolfCOSE/wiki/STM32Cube): Install and run wolfCOSE as an STM32Cube pack on device ## Release Notes diff --git a/docs/Home.md b/docs/Home.md index e75a0a7..4a58bc8 100644 --- a/docs/Home.md +++ b/docs/Home.md @@ -36,6 +36,7 @@ It uses [wolfSSL](https://www.wolfssl.com/) as the cryptographic backend and is | [[Footprint]] | Size and speed numbers, desktop and on-device | | [[Testing]] | Unit tests, coverage, and failure injection | | [[Project Structure]] | Source code layout and file descriptions | +| [[STM32Cube]] | Install and run wolfCOSE as an STM32Cube pack on device | | [[Release Notes]] | Per-version changelog and release highlights | ## Supported Message Types diff --git a/docs/STM32Cube.md b/docs/STM32Cube.md new file mode 100644 index 0000000..4fd9a86 --- /dev/null +++ b/docs/STM32Cube.md @@ -0,0 +1,67 @@ +# STM32Cube + +wolfCOSE ships as an STM32Cube pack, `I-CUBE-wolfCOSE`, so it drops into any +STM32CubeMX or STM32CubeIDE project without manual source integration. The pack +provides wolfCOSE as an STM32 middleware and uses the wolfSSL pack +(`I-CUBE-wolfSSL`) for all cryptography. + +Supported cores: Cortex-M0, M0+, M3, M4, M7, M23, M33, M55, and STM32MP1. + +## Prerequisites + +- STM32CubeMX, plus STM32CubeIDE or another toolchain to build. +- The wolfSSL pack, `I-CUBE-wolfSSL` 5.9.2 or later. wolfCOSE depends on + wolfCrypt for hashing, signing, and AEAD. + +## Install the packs + +1. Download `wolfSSL.I-CUBE-wolfSSL..pack` and + `wolfSSL.I-CUBE-wolfCOSE..pack` from + [wolfssl.com/files/ide](https://www.wolfssl.com/files/ide/). +2. In STM32CubeMX, open `Help`, `Manage embedded software packages`, + `From Local...`, and install the wolfSSL pack first, then the wolfCOSE pack. + +## Add wolfCOSE to a project + +1. Open or create a project `.ioc` for your board. +2. Open `Software Packs`, `Select Components`. +3. Enable `wolfSSL` `wolfCrypt` `Core` and `wolfCOSE` `Core`. To run the + on device self test, also enable `wolfCOSE` `Test`. +4. In the `Software Packs` configuration category, enable each pack. +5. Generate code and build with your toolchain. + +## Configure algorithms + +wolfCOSE reads its configuration from the wolfSSL `user_settings.h`, included +before `wolfcose/settings.h`. Enable the wolfCrypt features that match the COSE +algorithms you use: + +- ES256: `HAVE_ECC`, `WOLFSSL_SHA256` +- ES384 or ES512: add `WOLFSSL_SHA384` or `WOLFSSL_SHA512` +- ML-DSA (RFC 9964): `WOLFSSL_HAVE_MLDSA` +- Encrypt0 AEAD: `HAVE_AESGCM`, or `HAVE_CHACHA` with `HAVE_POLY1305` +- MAC0: HMAC, which is on by default with SHA support + +If a required wolfCrypt feature is missing, `wolfcose/settings.h` raises a +compile error naming it. + +## Run on a device + +The `Test` component builds `wolfcose_test.c`, a self test that runs a +`COSE_Sign1` sign and verify and reports the result over your configured +console. Call `wolfCOSETest()` from your application once `main` has initialized +the clocks and console. + +A ready to run example for the NUCLEO-H563ZI board lives in +[wolfssl-examples-stm32](https://github.com/wolfSSL/wolfssl-examples-stm32), +mirroring the wolfIP example: open the `.ioc`, generate, build, flash, and watch +the console for the wolfCOSE test output. + +## Notes + +- Only pack source is kept in the repository. The built `.pack` files are posted + at [wolfssl.com/files/ide](https://www.wolfssl.com/files/ide/). +- On some STM32 families the wolfSSL pack enables hardware hash and RNG by + default. If a build reports a missing HAL module or hash symbol, enable the + RNG and HASH peripherals in the `.ioc`, or select software crypto with + `NO_STM32_HASH` and `NO_STM32_RNG` in `user_settings.h`. diff --git a/docs/_Sidebar.md b/docs/_Sidebar.md index 2d4ee2e..6683ebe 100644 --- a/docs/_Sidebar.md +++ b/docs/_Sidebar.md @@ -10,4 +10,5 @@ - [[Testing]] - [[MISRA Compliance]] - [[Project Structure]] +- [[STM32Cube]] - [[Release Notes]] From 96db8cc3eefdd280bb3e408b8363cdad061b4845 Mon Sep 17 00:00:00 2001 From: aidan garske Date: Mon, 20 Jul 2026 17:00:30 -0700 Subject: [PATCH 03/12] Add STM32Cube test entry and pack files under IDE --- IDE/STM32Cube/README.md | 12 +++ IDE/STM32Cube/default_conf.ftl | 162 +++++++++++++++++++++++++++++++++ IDE/STM32Cube/wolfcose_test.c | 94 +++++++++++++++++++ IDE/STM32Cube/wolfcose_test.h | 30 ++++++ 4 files changed, 298 insertions(+) create mode 100644 IDE/STM32Cube/README.md create mode 100644 IDE/STM32Cube/default_conf.ftl create mode 100644 IDE/STM32Cube/wolfcose_test.c create mode 100644 IDE/STM32Cube/wolfcose_test.h diff --git a/IDE/STM32Cube/README.md b/IDE/STM32Cube/README.md new file mode 100644 index 0000000..f93db24 --- /dev/null +++ b/IDE/STM32Cube/README.md @@ -0,0 +1,12 @@ +# wolfCOSE STM32Cube Support + +Files used by the wolfCOSE STM32Cube pack (`I-CUBE-wolfCOSE`). + +- `wolfcose_test.c` / `wolfcose_test.h`: a self test that runs a `COSE_Sign1` + ES256 sign and verify and prints the result. It is built by the pack `Test` + component. Call `wolfCOSETest()` from your application once the clocks and + console are initialized; it returns `0` on success. +- `default_conf.ftl`: the STM32CubeMX configuration template for the pack. + +See the [STM32Cube wiki page](https://github.com/wolfSSL/wolfCOSE/wiki/STM32Cube) +for installing the pack and running wolfCOSE on a device. diff --git a/IDE/STM32Cube/default_conf.ftl b/IDE/STM32Cube/default_conf.ftl new file mode 100644 index 0000000..78e70f5 --- /dev/null +++ b/IDE/STM32Cube/default_conf.ftl @@ -0,0 +1,162 @@ +[#ftl] +/** + ****************************************************************************** + * File Name : ${name} + * Description : This file provides code for the configuration + * of the ${name} instances. + ****************************************************************************** +[@common.optinclude name=mxTmpFolder+"/license.tmp"/][#--include License text --] + ****************************************************************************** + */ +[#assign s = name] +[#assign toto = s?replace(".","_")] +[#assign toto = toto?replace("/","")] +[#assign toto = toto?replace("-","_")] +[#assign inclusion_protection = toto?upper_case] +/* Define to prevent recursive inclusion -------------------------------------*/ +#ifndef __${inclusion_protection}__ +#define __${inclusion_protection}__ + +#ifdef __cplusplus + extern "C" { +#endif + + +/* Includes ------------------------------------------------------------------*/ +[#if includes??] +[#list includes as include] +#include "${include}" +[/#list] +[/#if] + +[#-- SWIPdatas is a list of SWIPconfigModel --] +[#list SWIPdatas as SWIP] +[#-- Global variables --] +[#if SWIP.variables??] + [#list SWIP.variables as variable] +extern ${variable.value} ${variable.name}; + [/#list] +[/#if] + +[#-- Global variables --] + +[#assign instName = SWIP.ipName] +[#assign fileName = SWIP.fileName] +[#assign version = SWIP.version] + +/** + MiddleWare name : ${instName} + MiddleWare fileName : ${fileName} + MiddleWare version : ${version} +*/ +[#if SWIP.defines??] + [#list SWIP.defines as definition] +/*---------- [#if definition.comments??]${definition.comments}[/#if] -----------*/ +#define ${definition.name} #t#t ${definition.value} +[#if definition.description??]${definition.description} [/#if] + [/#list] +[/#if] + + + +[/#list] + +/* ------------------------------------------------------------------------- */ +/* Platform */ +/* ------------------------------------------------------------------------- */ +#define WOLFSSH_STM32_CUBEMX +/* #define WOLFSSL_CMSIS_RTOS */ +/* #define NO_FILESYSTEM */ + +/* ------------------------------------------------------------------------- */ +/* Enable Features */ +/* ------------------------------------------------------------------------- */ +/* SCP */ +#undef WOLFSSH_SCP +#if defined(WOLFSSH_CONF_SCP) && WOLFSSH_CONF_SCP == 1 + #define WOLFSSH_SCP +#endif + +/* SFTP */ +#undef WOLFSSH_SFTP +#if !defined(NO_FILESYSTEM) && defined(WOLFSSH_CONF_SFTP) && WOLFSSH_CONF_SFTP == 1 + #define WOLFSSH_SFTP +#endif + +/* ------------------------------------------------------------------------- */ +/* Debugging */ +/* ------------------------------------------------------------------------- */ +#if defined(WOLFSSH_CONF_DEBUG) && WOLFSSH_CONF_DEBUG == 1 + #define DEBUG_WOLFSSH +#endif + + +/* ------------------------------------------------------------------------- */ +/* wolfSSH IO */ +/* ------------------------------------------------------------------------- */ +#if defined(WOLFSSH_CONF_IO) && WOLFSSH_CONF_IO == 2 + #define WOLFSSH_LWIP +#else + #define WOLFSSH_USER_IO +#endif + +/* To be defined for the target Socket API */ +#define WSTARTTCP() + +#define WOLFSSH_LOG_PRINTF +#define WOLFSSL_LOG_PRINTF +#define fprintf(err, ... ) printf(__VA_ARGS__) +#define WFFLUSH fflush + +#define BENCH_EMBEDDED +#define NO_WRITEV +#define NO_DEV_RANDOM +#define USE_CERT_BUFFERS_2048 +#define WOLFSSL_USER_CURRTIME +#define SIZEOF_LONG_LONG 8 +#define NO_WOLFSSL_DIR +#define WOLFSSL_NO_CURRDIR +#define NO_WOLF_C99 +#define NO_MULTIBYTE_PRINT + + +#if !defined(NO_FILESYSTEM) + #define WOLFSSH_USER_FILESYSTEM +#endif +#define NO_WOLFSSH_DIR + + +#define XVALIDATEDATE(d, f,t) (0) +#define WOLFSSL_USER_CURRTIME /* for benchmark */ + +#define WOLFSSL_GENSEED_FORTEST /* Warning: define your own seed gen */ + +#define TFM_TIMING_RESISTANT +#define ECC_TIMING_RESISTANT +#define WC_RSA_BLINDING + +/* #define NO_DH */ +#define HAVE_AESGCM +#define WOLFSSL_SHA512 +#define HAVE_ECC +#define HAVE_ED25519 + +#define WOLFSSH_IGNORE_FILE_WARN + +typedef unsigned int size_t; + +/* defines for unit tests */ +#define NO_UNITTEST_MAIN_DRIVER +#define NO_TESTSUITE_MAIN_DRIVER +#define NO_APITEST_MAIN_DRIVER + +#ifdef __cplusplus +} +#endif +#endif /* ${inclusion_protection}_H */ + +/** + * @} + */ + +/*****END OF FILE****/ diff --git a/IDE/STM32Cube/wolfcose_test.c b/IDE/STM32Cube/wolfcose_test.c new file mode 100644 index 0000000..706cc2e --- /dev/null +++ b/IDE/STM32Cube/wolfcose_test.c @@ -0,0 +1,94 @@ +/* wolfcose_test.c + * + * Copyright (C) 2026 wolfSSL Inc. + * + * This file is part of wolfCOSE. + * + * wolfCOSE is free software; you can redistribute it and/or modify + * it under the terms of the GNU General Public License as published by + * the Free Software Foundation; either version 3 of the License, or + * (at your option) any later version. + * + * wolfCOSE is distributed in the hope that it will be useful, + * but WITHOUT ANY WARRANTY; without even the implied warranty of + * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the + * GNU General Public License for more details. + * + * You should have received a copy of the GNU General Public License + * along with this program; if not, see . + */ + +#include "wolfcose_test.h" + +#include +#include + +int wolfCOSETest(void) +{ +#ifdef WOLFCOSE_HAVE_ES256 + WOLFCOSE_KEY key; + ecc_key eccKey; + WC_RNG rng; + WOLFCOSE_HDR hdr; + const uint8_t payload[] = "wolfCOSE STM32 self test"; + uint8_t scratch[WOLFCOSE_MAX_SCRATCH_SZ]; + uint8_t out[512]; + const uint8_t* decPayload = NULL; + size_t payloadLen = sizeof(payload) - 1u; + size_t outLen = 0; + size_t decPayloadLen = 0; + int rngInited = 0; + int eccInited = 0; + int ret; + + printf("Running wolfCOSE test (COSE_Sign1 ES256)...\n"); + + ret = wc_InitRng(&rng); + if (ret == 0) { + rngInited = 1; + ret = wc_ecc_init(&eccKey); + } + if (ret == 0) { + eccInited = 1; + ret = wc_ecc_make_key(&rng, 32, &eccKey); + } + if (ret == 0) { + wc_CoseKey_Init(&key); + ret = wc_CoseKey_SetEcc(&key, WOLFCOSE_CRV_P256, &eccKey); + } + if (ret == 0) { + ret = wc_CoseSign1_Sign(&key, WOLFCOSE_ALG_ES256, + NULL, 0, payload, payloadLen, NULL, 0, NULL, 0, + scratch, sizeof(scratch), out, sizeof(out), &outLen, &rng); + } + if (ret == 0) { + ret = wc_CoseSign1_Verify(&key, out, outLen, NULL, 0, NULL, 0, + scratch, sizeof(scratch), &hdr, &decPayload, &decPayloadLen); + } + if (ret == 0) { + if ((decPayload == NULL) || (decPayloadLen != payloadLen) || + (memcmp(decPayload, payload, decPayloadLen) != 0) || + (hdr.alg != WOLFCOSE_ALG_ES256)) { + ret = -1; + } + } + + if (eccInited != 0) { + (void)wc_ecc_free(&eccKey); + } + if (rngInited != 0) { + (void)wc_FreeRng(&rng); + } + + if (ret == 0) { + printf("wolfCOSE test: PASS (COSE_Sign1 %u bytes)\n", (unsigned)outLen); + } + else { + printf("wolfCOSE test: FAIL, ret %d\n", ret); + } + return ret; +#else + printf("wolfCOSE test: build with WOLFCOSE_HAVE_ES256 to run\n"); + return 0; +#endif +} diff --git a/IDE/STM32Cube/wolfcose_test.h b/IDE/STM32Cube/wolfcose_test.h new file mode 100644 index 0000000..fcb2776 --- /dev/null +++ b/IDE/STM32Cube/wolfcose_test.h @@ -0,0 +1,30 @@ +/* wolfcose_test.h + * + * Copyright (C) 2026 wolfSSL Inc. + * + * This file is part of wolfCOSE. + * + * wolfCOSE is free software; you can redistribute it and/or modify + * it under the terms of the GNU General Public License as published by + * the Free Software Foundation; either version 3 of the License, or + * (at your option) any later version. + * + * wolfCOSE is distributed in the hope that it will be useful, + * but WITHOUT ANY WARRANTY; without even the implied warranty of + * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the + * GNU General Public License for more details. + * + * You should have received a copy of the GNU General Public License + * along with this program; if not, see . + */ + +#ifndef WOLFCOSE_TEST_H_ +#define WOLFCOSE_TEST_H_ + +#include +#include +#include + +int wolfCOSETest(void); + +#endif /* WOLFCOSE_TEST_H_ */ From b4c0cb648f41c9dea25d7e79f05c822993237521 Mon Sep 17 00:00:00 2001 From: aidan garske Date: Mon, 20 Jul 2026 17:13:12 -0700 Subject: [PATCH 04/12] Harden STM32 test build guards and check init return per skoll review --- IDE/STM32Cube/wolfcose_test.c | 9 ++++++--- 1 file changed, 6 insertions(+), 3 deletions(-) diff --git a/IDE/STM32Cube/wolfcose_test.c b/IDE/STM32Cube/wolfcose_test.c index 706cc2e..7218413 100644 --- a/IDE/STM32Cube/wolfcose_test.c +++ b/IDE/STM32Cube/wolfcose_test.c @@ -25,7 +25,8 @@ int wolfCOSETest(void) { -#ifdef WOLFCOSE_HAVE_ES256 +#if defined(WOLFCOSE_HAVE_ES256) && defined(WOLFCOSE_SIGN1_SIGN) && \ + defined(WOLFCOSE_SIGN1_VERIFY) WOLFCOSE_KEY key; ecc_key eccKey; WC_RNG rng; @@ -53,7 +54,9 @@ int wolfCOSETest(void) ret = wc_ecc_make_key(&rng, 32, &eccKey); } if (ret == 0) { - wc_CoseKey_Init(&key); + ret = wc_CoseKey_Init(&key); + } + if (ret == 0) { ret = wc_CoseKey_SetEcc(&key, WOLFCOSE_CRV_P256, &eccKey); } if (ret == 0) { @@ -88,7 +91,7 @@ int wolfCOSETest(void) } return ret; #else - printf("wolfCOSE test: build with WOLFCOSE_HAVE_ES256 to run\n"); + printf("wolfCOSE test: needs ES256 with COSE_Sign1 sign and verify\n"); return 0; #endif } From e8d2e2237ca0cfa19c2af328cc0304f0222eb2e2 Mon Sep 17 00:00:00 2001 From: aidan garske Date: Tue, 21 Jul 2026 08:47:22 -0700 Subject: [PATCH 05/12] Link the posted I-CUBE-wolfCOSE.pack download URL in docs --- docs/STM32Cube.md | 11 ++++++----- 1 file changed, 6 insertions(+), 5 deletions(-) diff --git a/docs/STM32Cube.md b/docs/STM32Cube.md index 4fd9a86..471e690 100644 --- a/docs/STM32Cube.md +++ b/docs/STM32Cube.md @@ -15,9 +15,10 @@ Supported cores: Cortex-M0, M0+, M3, M4, M7, M23, M33, M55, and STM32MP1. ## Install the packs -1. Download `wolfSSL.I-CUBE-wolfSSL..pack` and - `wolfSSL.I-CUBE-wolfCOSE..pack` from - [wolfssl.com/files/ide](https://www.wolfssl.com/files/ide/). +1. Download the wolfSSL pack + ([I-CUBE-wolfSSL.pack](https://www.wolfssl.com/files/ide/I-CUBE-wolfSSL.pack)) + and the wolfCOSE pack + ([I-CUBE-wolfCOSE.pack](https://www.wolfssl.com/files/ide/I-CUBE-wolfCOSE.pack)). 2. In STM32CubeMX, open `Help`, `Manage embedded software packages`, `From Local...`, and install the wolfSSL pack first, then the wolfCOSE pack. @@ -59,8 +60,8 @@ the console for the wolfCOSE test output. ## Notes -- Only pack source is kept in the repository. The built `.pack` files are posted - at [wolfssl.com/files/ide](https://www.wolfssl.com/files/ide/). +- Only pack source is kept in the repository. The built pack is posted at + [wolfssl.com/files/ide/I-CUBE-wolfCOSE.pack](https://www.wolfssl.com/files/ide/I-CUBE-wolfCOSE.pack). - On some STM32 families the wolfSSL pack enables hardware hash and RNG by default. If a build reports a missing HAL module or hash symbol, enable the RNG and HASH peripherals in the `.ioc`, or select software crypto with From 8591f335977d6c1f2adda09ea9c87c0f31c58639 Mon Sep 17 00:00:00 2001 From: aidan garske Date: Tue, 21 Jul 2026 11:02:45 -0700 Subject: [PATCH 06/12] Show hardware verified test output in STM32Cube docs --- docs/STM32Cube.md | 13 +++++++++++-- 1 file changed, 11 insertions(+), 2 deletions(-) diff --git a/docs/STM32Cube.md b/docs/STM32Cube.md index 471e690..c32a1b2 100644 --- a/docs/STM32Cube.md +++ b/docs/STM32Cube.md @@ -55,8 +55,17 @@ the clocks and console. A ready to run example for the NUCLEO-H563ZI board lives in [wolfssl-examples-stm32](https://github.com/wolfSSL/wolfssl-examples-stm32), -mirroring the wolfIP example: open the `.ioc`, generate, build, flash, and watch -the console for the wolfCOSE test output. +with a pre-configured `.ioc`: install the packs, open the `.ioc`, generate, +add the glue and software-crypto config from that example's README, build, +flash, and watch the console. + +Verified on NUCLEO-H563ZI hardware, the console prints: + +``` +== wolfCOSE NUCLEO-H563ZI == +Running wolfCOSE test (COSE_Sign1 ES256)... +wolfCOSE test: PASS (COSE_Sign1 99 bytes) +``` ## Notes From 7050a01341f7260bfff7ee0ceaee5a30fa8a4859 Mon Sep 17 00:00:00 2001 From: aidan garske Date: Tue, 21 Jul 2026 11:21:22 -0700 Subject: [PATCH 07/12] Report not run rather than pass when ES256 path not built per skoll --- IDE/STM32Cube/wolfcose_test.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/IDE/STM32Cube/wolfcose_test.c b/IDE/STM32Cube/wolfcose_test.c index 7218413..3c135bb 100644 --- a/IDE/STM32Cube/wolfcose_test.c +++ b/IDE/STM32Cube/wolfcose_test.c @@ -91,7 +91,8 @@ int wolfCOSETest(void) } return ret; #else + /* ES256 COSE_Sign1 not compiled in; report not run so it is not read as pass */ printf("wolfCOSE test: needs ES256 with COSE_Sign1 sign and verify\n"); - return 0; + return -1; #endif } From 2d8eddd344789b3f2d506b2525c7d33eca556169 Mon Sep 17 00:00:00 2001 From: aidan garske Date: Tue, 21 Jul 2026 13:52:06 -0700 Subject: [PATCH 08/12] Replace copied wolfSSH conf template with wolfCOSE config --- IDE/STM32Cube/default_conf.ftl | 89 ++-------------------------------- 1 file changed, 4 insertions(+), 85 deletions(-) diff --git a/IDE/STM32Cube/default_conf.ftl b/IDE/STM32Cube/default_conf.ftl index 78e70f5..4b91f30 100644 --- a/IDE/STM32Cube/default_conf.ftl +++ b/IDE/STM32Cube/default_conf.ftl @@ -61,95 +61,14 @@ extern ${variable.value} ${variable.name}; [/#list] -/* ------------------------------------------------------------------------- */ -/* Platform */ -/* ------------------------------------------------------------------------- */ -#define WOLFSSH_STM32_CUBEMX -/* #define WOLFSSL_CMSIS_RTOS */ -/* #define NO_FILESYSTEM */ - -/* ------------------------------------------------------------------------- */ -/* Enable Features */ -/* ------------------------------------------------------------------------- */ -/* SCP */ -#undef WOLFSSH_SCP -#if defined(WOLFSSH_CONF_SCP) && WOLFSSH_CONF_SCP == 1 - #define WOLFSSH_SCP -#endif - -/* SFTP */ -#undef WOLFSSH_SFTP -#if !defined(NO_FILESYSTEM) && defined(WOLFSSH_CONF_SFTP) && WOLFSSH_CONF_SFTP == 1 - #define WOLFSSH_SFTP -#endif - -/* ------------------------------------------------------------------------- */ -/* Debugging */ -/* ------------------------------------------------------------------------- */ -#if defined(WOLFSSH_CONF_DEBUG) && WOLFSSH_CONF_DEBUG == 1 - #define DEBUG_WOLFSSH -#endif +#define WOLFCOSE_STM32_CUBEMX +/* wolfCOSE takes its crypto configuration from the wolfSSL user_settings.h. */ -/* ------------------------------------------------------------------------- */ -/* wolfSSH IO */ -/* ------------------------------------------------------------------------- */ -#if defined(WOLFSSH_CONF_IO) && WOLFSSH_CONF_IO == 2 - #define WOLFSSH_LWIP -#else - #define WOLFSSH_USER_IO +#if defined(WOLFCOSE_CONF_DEBUG) && WOLFCOSE_CONF_DEBUG == 1 + #define DEBUG_WOLFCOSE #endif -/* To be defined for the target Socket API */ -#define WSTARTTCP() - -#define WOLFSSH_LOG_PRINTF -#define WOLFSSL_LOG_PRINTF -#define fprintf(err, ... ) printf(__VA_ARGS__) -#define WFFLUSH fflush - -#define BENCH_EMBEDDED -#define NO_WRITEV -#define NO_DEV_RANDOM -#define USE_CERT_BUFFERS_2048 -#define WOLFSSL_USER_CURRTIME -#define SIZEOF_LONG_LONG 8 -#define NO_WOLFSSL_DIR -#define WOLFSSL_NO_CURRDIR -#define NO_WOLF_C99 -#define NO_MULTIBYTE_PRINT - - -#if !defined(NO_FILESYSTEM) - #define WOLFSSH_USER_FILESYSTEM -#endif -#define NO_WOLFSSH_DIR - - -#define XVALIDATEDATE(d, f,t) (0) -#define WOLFSSL_USER_CURRTIME /* for benchmark */ - -#define WOLFSSL_GENSEED_FORTEST /* Warning: define your own seed gen */ - -#define TFM_TIMING_RESISTANT -#define ECC_TIMING_RESISTANT -#define WC_RSA_BLINDING - -/* #define NO_DH */ -#define HAVE_AESGCM -#define WOLFSSL_SHA512 -#define HAVE_ECC -#define HAVE_ED25519 - -#define WOLFSSH_IGNORE_FILE_WARN - -typedef unsigned int size_t; - -/* defines for unit tests */ -#define NO_UNITTEST_MAIN_DRIVER -#define NO_TESTSUITE_MAIN_DRIVER -#define NO_APITEST_MAIN_DRIVER - #ifdef __cplusplus } #endif From 8a94a0e9d14ad1b3fe502c30e0fa8e439615c945 Mon Sep 17 00:00:00 2001 From: aidan garske Date: Tue, 21 Jul 2026 13:52:06 -0700 Subject: [PATCH 09/12] Print wolfCOSE test outLen with %lu --- IDE/STM32Cube/wolfcose_test.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/IDE/STM32Cube/wolfcose_test.c b/IDE/STM32Cube/wolfcose_test.c index 3c135bb..fc213ae 100644 --- a/IDE/STM32Cube/wolfcose_test.c +++ b/IDE/STM32Cube/wolfcose_test.c @@ -84,7 +84,7 @@ int wolfCOSETest(void) } if (ret == 0) { - printf("wolfCOSE test: PASS (COSE_Sign1 %u bytes)\n", (unsigned)outLen); + printf("wolfCOSE test: PASS (COSE_Sign1 %lu bytes)\n", (unsigned long)outLen); } else { printf("wolfCOSE test: FAIL, ret %d\n", ret); From 7cc8e2091ca954cbd05a1fd96a20bc1eb54f9834 Mon Sep 17 00:00:00 2001 From: aidan garske Date: Tue, 21 Jul 2026 14:04:17 -0700 Subject: [PATCH 10/12] Add extern C guard and scrub the COSE key in the STM32 test --- IDE/STM32Cube/wolfcose_test.c | 5 +++++ IDE/STM32Cube/wolfcose_test.h | 8 ++++++++ 2 files changed, 13 insertions(+) diff --git a/IDE/STM32Cube/wolfcose_test.c b/IDE/STM32Cube/wolfcose_test.c index fc213ae..8171f9d 100644 --- a/IDE/STM32Cube/wolfcose_test.c +++ b/IDE/STM32Cube/wolfcose_test.c @@ -40,6 +40,7 @@ int wolfCOSETest(void) size_t decPayloadLen = 0; int rngInited = 0; int eccInited = 0; + int keyInited = 0; int ret; printf("Running wolfCOSE test (COSE_Sign1 ES256)...\n"); @@ -57,6 +58,7 @@ int wolfCOSETest(void) ret = wc_CoseKey_Init(&key); } if (ret == 0) { + keyInited = 1; ret = wc_CoseKey_SetEcc(&key, WOLFCOSE_CRV_P256, &eccKey); } if (ret == 0) { @@ -76,6 +78,9 @@ int wolfCOSETest(void) } } + if (keyInited != 0) { + wc_CoseKey_Free(&key); + } if (eccInited != 0) { (void)wc_ecc_free(&eccKey); } diff --git a/IDE/STM32Cube/wolfcose_test.h b/IDE/STM32Cube/wolfcose_test.h index fcb2776..4465c02 100644 --- a/IDE/STM32Cube/wolfcose_test.h +++ b/IDE/STM32Cube/wolfcose_test.h @@ -25,6 +25,14 @@ #include #include +#ifdef __cplusplus +extern "C" { +#endif + int wolfCOSETest(void); +#ifdef __cplusplus +} +#endif + #endif /* WOLFCOSE_TEST_H_ */ From 3d42286f0a40001f9763b47fa0af36f091651eb0 Mon Sep 17 00:00:00 2001 From: Aidan Garske Date: Tue, 28 Jul 2026 18:24:19 -0700 Subject: [PATCH 11/12] Document enabling the RNG peripheral for the STM32Cube pack --- IDE/STM32Cube/README.md | 38 ++++++++++++++++++++++++++++++++++---- docs/STM32Cube.md | 20 ++++++++++++++------ 2 files changed, 48 insertions(+), 10 deletions(-) diff --git a/IDE/STM32Cube/README.md b/IDE/STM32Cube/README.md index f93db24..af78a3a 100644 --- a/IDE/STM32Cube/README.md +++ b/IDE/STM32Cube/README.md @@ -1,6 +1,11 @@ -# wolfCOSE STM32Cube Support +# wolfCOSE for STM32Cube -Files used by the wolfCOSE STM32Cube pack (`I-CUBE-wolfCOSE`). +wolfCOSE is a zero-allocation C implementation of CBOR (RFC 8949) and COSE +(RFC 9052/9053) built on top of wolfCrypt. It ships as an STM32Cube pack, +`I-CUBE-wolfCOSE`, which provides wolfCOSE as an STM32 middleware and depends +on the wolfSSL pack (`I-CUBE-wolfSSL`) for wolfCrypt. + +This directory holds the files the pack builds from: - `wolfcose_test.c` / `wolfcose_test.h`: a self test that runs a `COSE_Sign1` ES256 sign and verify and prints the result. It is built by the pack `Test` @@ -8,5 +13,30 @@ Files used by the wolfCOSE STM32Cube pack (`I-CUBE-wolfCOSE`). console are initialized; it returns `0` on success. - `default_conf.ftl`: the STM32CubeMX configuration template for the pack. -See the [STM32Cube wiki page](https://github.com/wolfSSL/wolfCOSE/wiki/STM32Cube) -for installing the pack and running wolfCOSE on a device. +## Dependency + +Install the wolfSSL pack (`I-CUBE-wolfSSL`, version 5.9.2 or later) first and +enable `wolfCrypt: Core`. wolfCOSE uses wolfCrypt for hashing, signing, and AEAD. + +## Enabling in STM32CubeMX + +1. `Help`, `Manage embedded software packages`, `From Local...` and install + the wolfSSL pack, then this wolfCOSE pack. +2. Enable the RNG peripheral under `Pinout & Configuration`, `Security`, `RNG`. + Signing needs entropy, and `wc_GenerateSeed()` fails without it. +3. In the project `.ioc`, open `Software Packs`, `Select Components`, expand + `wolfCOSE` and check `Core` (and `wolfSSL`, `wolfCrypt: Core`). To run the + on device self test, also check `wolfCOSE` `Test`. +4. In the `Software Packs` configuration category, enable the wolfCOSE pack. +5. Generate code and build. + +## Configuration + +wolfCOSE is configured through the wolfSSL `user_settings.h` (included before +`wolfcose/settings.h`). Algorithm support such as `WOLFCOSE_ENABLE_ES384`, +`WOLFCOSE_ENABLE_ES512`, and `WOLFCOSE_ENABLE_MLDSA` requires the matching +wolfCrypt features (`HAVE_ECC`, `WOLFSSL_SHA384/512`, `WOLFSSL_HAVE_MLDSA`). + +See the wolfCOSE `examples/` for sign1, mac0, and encrypt0 usage, and the +[STM32Cube wiki page](https://github.com/wolfSSL/wolfCOSE/wiki/STM32Cube) for +the full walkthrough including a ready to run NUCLEO-H563ZI project. diff --git a/docs/STM32Cube.md b/docs/STM32Cube.md index c32a1b2..4b10773 100644 --- a/docs/STM32Cube.md +++ b/docs/STM32Cube.md @@ -12,6 +12,7 @@ Supported cores: Cortex-M0, M0+, M3, M4, M7, M23, M33, M55, and STM32MP1. - STM32CubeMX, plus STM32CubeIDE or another toolchain to build. - The wolfSSL pack, `I-CUBE-wolfSSL` 5.9.2 or later. wolfCOSE depends on wolfCrypt for hashing, signing, and AEAD. +- A board with a hardware RNG and a UART for console output. ## Install the packs @@ -25,11 +26,13 @@ Supported cores: Cortex-M0, M0+, M3, M4, M7, M23, M33, M55, and STM32MP1. ## Add wolfCOSE to a project 1. Open or create a project `.ioc` for your board. -2. Open `Software Packs`, `Select Components`. -3. Enable `wolfSSL` `wolfCrypt` `Core` and `wolfCOSE` `Core`. To run the +2. Enable the RNG peripheral under `Pinout & Configuration`, `Security`, `RNG`. + Signing needs entropy, and `wc_GenerateSeed()` fails without it. +3. Open `Software Packs`, `Select Components`. +4. Enable `wolfSSL` `wolfCrypt` `Core` and `wolfCOSE` `Core`. To run the on device self test, also enable `wolfCOSE` `Test`. -4. In the `Software Packs` configuration category, enable each pack. -5. Generate code and build with your toolchain. +5. In the `Software Packs` configuration category, enable each pack. +6. Generate code and build with your toolchain. ## Configure algorithms @@ -73,5 +76,10 @@ wolfCOSE test: PASS (COSE_Sign1 99 bytes) [wolfssl.com/files/ide/I-CUBE-wolfCOSE.pack](https://www.wolfssl.com/files/ide/I-CUBE-wolfCOSE.pack). - On some STM32 families the wolfSSL pack enables hardware hash and RNG by default. If a build reports a missing HAL module or hash symbol, enable the - RNG and HASH peripherals in the `.ioc`, or select software crypto with - `NO_STM32_HASH` and `NO_STM32_RNG` in `user_settings.h`. + matching peripheral in the `.ioc`, or select software crypto with + `NO_STM32_HASH` and `NO_STM32_RNG` in the generated + `wolfSSL.I-CUBE-wolfSSL_conf.h`. On the STM32H5 the hardware hash block + references a HAL enum that does not exist, so software crypto is required + there; the + [NUCLEO-H563ZI example](https://github.com/wolfSSL/wolfssl-examples-stm32/tree/master/wolfCOSE-STM32-Example) + shows the exact edit. From f48bda233d54e46679fe070052bb9b7aee689c2a Mon Sep 17 00:00:00 2001 From: Aidan Garske Date: Wed, 29 Jul 2026 14:53:23 -0700 Subject: [PATCH 12/12] Link the I-CUBE-wolfSSL STM32Cube README from the wolfCOSE pack docs --- IDE/STM32Cube/README.md | 3 +++ 1 file changed, 3 insertions(+) diff --git a/IDE/STM32Cube/README.md b/IDE/STM32Cube/README.md index af78a3a..db20529 100644 --- a/IDE/STM32Cube/README.md +++ b/IDE/STM32Cube/README.md @@ -17,6 +17,9 @@ This directory holds the files the pack builds from: Install the wolfSSL pack (`I-CUBE-wolfSSL`, version 5.9.2 or later) first and enable `wolfCrypt: Core`. wolfCOSE uses wolfCrypt for hashing, signing, and AEAD. +See the +[wolfSSL STM32Cube README](https://github.com/wolfSSL/wolfssl/blob/master/IDE/STM32Cube/README.md) +for the wolfSSL pack documentation and install instructions. ## Enabling in STM32CubeMX