IFX_OPTIGA_TrustM Class Reference

#include <OPTIGATrustM.h>

Public Member Functions
	IFX_OPTIGA_TrustM ()
	~IFX_OPTIGA_TrustM ()
int32_t	begin (uint8_t pairDevice=1)
int32_t	begin (TwoWire &CustomWire)
int32_t	checkChip (void)
int32_t	pairMCU (void)
int32_t	reset (void)
void	end (void)
	Ends communication with the Optiga Trust M. More...
int32_t	getCertificate (uint8_t certificate[], uint16_t &certificateLength)
	Get the Infineon OPTIGA Trust M device certificate. More...
int32_t	getPublicKey (uint8_t publickey[68])
	Get the Infineon OPTIGA Trust M device certificate public key. More...
int32_t	getUniqueID (uint8_t uniqueID[], uint16_t &uidLength)
int32_t	getRandom (uint16_t length, uint8_t random[])
	Get a random number. More...
int32_t	getCurrentLimit (uint8_t &currentLim)
int32_t	setCurrentLimit (uint8_t currentLim)
int32_t	getLastErrorCodes (uint8_t errorCodes[], uint16_t &errorCodesLength)
int32_t	sha256 (uint8_t dataToHash[], uint16_t dlen, uint8_t hash[32])
int32_t	calculateSignature (uint8_t dataToSign[], uint16_t dlen, uint16_t privateKey_oid, uint8_t result[], uint16_t &rlen)
int32_t	calculateSignature (uint8_t dataToSign[], uint16_t dlen, uint8_t result[], uint16_t &rlen)
int32_t	calculateSignatureRSA (uint8_t dataToSign[], uint16_t dlen, uint16_t privateKey_oid, uint8_t result[], uint16_t &rlen)
int32_t	calculateSignatureRSA (uint8_t dataToSign[], uint16_t dlen, uint8_t result[], uint16_t &rlen)
int32_t	calculateSignatureECDSA (uint8_t dataToSign[], uint16_t dlen, uint16_t privateKey_oid, uint8_t result[], uint16_t &rlen)
int32_t	calculateSignatureECDSA (uint8_t dataToSign[], uint16_t dlen, uint8_t result[], uint16_t &rlen)
int32_t	formatSignature (uint8_t signature[], uint16_t signatureLength, uint8_t result[], uint16_t &rlen)
int32_t	verifySignature (uint8_t hash[], uint16_t hashLength, uint8_t signature[], uint16_t signatureLength, uint16_t publicKey_oid)
int32_t	verifySignature (uint8_t hash[], uint16_t hashLength, uint8_t signature[], uint16_t signatureLength)
int32_t	verifySignature (uint8_t hash[], uint16_t hashLength, uint8_t signature[], uint16_t signatureLength, uint8_t pubKey[], uint16_t plen)
int32_t	verifySignatureRSA (uint8_t hash[], uint16_t hashLength, uint8_t signature[], uint16_t signatureLength, uint16_t publicKey_oid)
int32_t	verifySignatureRSA (uint8_t hash[], uint16_t hashLength, uint8_t signature[], uint16_t signatureLength, uint8_t pubKey[], uint16_t plen, optiga_rsa_key_type rsa_key_type)
int32_t	verifySignatureECDSA (uint8_t hash[], uint16_t hashLength, uint8_t signature[], uint16_t signatureLength, uint16_t publicKey_oid)
int32_t	verifySignatureECDSA (uint8_t hash[], uint16_t hashLength, uint8_t signature[], uint16_t signatureLength, uint8_t pubKey[], uint16_t plen, optiga_ecc_curve_t ecc_key_type)
int32_t	sharedSecret (uint8_t publicKey[], uint16_t plen)
int32_t	sharedSecret (uint16_t oid, uint8_t publicKey[], uint16_t plen)
int32_t	sharedSecret (String curveName, uint8_t publicKey[], uint16_t plen)
int32_t	sharedSecret (String curveName, uint16_t oid, uint8_t publicKey[], uint16_t plen)
int32_t	sharedSecretWithExport (uint8_t publicKey[], uint16_t plen, uint8_t sharedSecret[], uint16_t &shlen)
int32_t	sharedSecretWithExport (String curveName, uint8_t publicKey[], uint16_t plen, uint8_t sharedSecret[], uint16_t &shlen)
int32_t	generateKeypair (uint8_t publicKey[], uint16_t &plen)
int32_t	generateKeypair (uint8_t publicKey[], uint16_t &plen, uint16_t privateKey_oid)
int32_t	generateKeypair (uint8_t publicKey[], uint16_t &plen, uint8_t privateKey[], uint16_t &prlen)
int32_t	generateKeypairRSA (uint8_t publicKey[], uint16_t &plen)
int32_t	generateKeypairRSA (uint8_t *p_pubkey, uint16_t &plen, uint16_t privateKey_oid, optiga_rsa_key_type_t rsa_key_type)
int32_t	generateKeypairRSA (uint8_t *p_pubkey, uint16_t &plen, uint8_t *p_privkey, uint16_t &prlen, optiga_rsa_key_type_t rsa_key_type)
int32_t	generateKeypairRSA1024 (uint8_t *p_pubkey, uint16_t &plen, uint8_t *p_privkey, uint16_t &prlen)
int32_t	generateKeypairRSA1024 (uint8_t *p_pubkey, uint16_t &plen, uint16_t privateKey_oid)
int32_t	generateKeypairRSA2048 (uint8_t *p_pubkey, uint16_t &plen, uint8_t *p_privkey, uint16_t &prlen)
int32_t	generateKeypairRSA2048 (uint8_t *p_pubkey, uint16_t &plen, uint16_t privateKey_oid)
int32_t	generateKeypairECC (uint8_t publicKey[], uint16_t &plen)
int32_t	generateKeypairECC (uint8_t *p_pubkey, uint16_t &plen, uint16_t privateKey_oid, optiga_ecc_curve_t ecc_key_type)
int32_t	generateKeypairECC (uint8_t *p_pubkey, uint16_t &plen, uint8_t *p_privkey, uint16_t &prlen, optiga_ecc_curve_t ecc_key_type)
int32_t	generateKeypairECCP256 (uint8_t *p_pubkey, uint16_t &plen, uint8_t *p_privkey, uint16_t &prlen)
int32_t	generateKeypairECCP256 (uint8_t *p_pubkey, uint16_t &plen, uint16_t privateKey_oid)
int32_t	generateKeypairECCP384 (uint8_t *p_pubkey, uint16_t &plen, uint8_t *p_privkey, uint16_t &prlen)
int32_t	generateKeypairECCP384 (uint8_t *p_pubkey, uint16_t &plen, uint16_t privateKey_oid)
int32_t	encrypt (uint8_t dataToEncrypt[], uint16_t dlen, uint8_t pubkeyFromUser[], uint16_t pklen, uint8_t result[], uint16_t &rlen)
int32_t	encrypt (uint8_t dataToEncrypt[], uint16_t dlen, uint16_t certOID, uint8_t result[], uint16_t &rlen)
int32_t	decrypt (uint8_t dataToDecrypt[], uint16_t dlen, uint16_t keyOID, uint8_t result[], uint16_t &rlen)

Constructor & Destructor Documentation

IFX_OPTIGA_TrustM()

IFX_OPTIGA_TrustM::IFX_OPTIGA_TrustM

(

)

~IFX_OPTIGA_TrustM()

IFX_OPTIGA_TrustM::~IFX_OPTIGA_TrustM

(

)

Member Function Documentation

begin() [1/2]

int32_t IFX_OPTIGA_TrustM::begin

(

uint8_t

pairDevice = 1

)

This function initializes the Infineon OPTIGA Trust X command library and sends the 'open application' command to the device. This opens the communicatino channel to the Optiga Trust M, so that you can carry out different operations

Parameters

[in]

pairDevice

Define whether you want to pair MCU and OPTIGA Trust M devices.

Return values

0	If function was successful.
1	If the operation failed.

Create OPTIGA Crypt Instance

Open the application on OPTIGA which is a precondition to perform any other operations using optiga_util_open_application

Here is the call graph for this function:

begin() [2/2]

int32_t IFX_OPTIGA_TrustM::begin

(

TwoWire &

CustomWire

)

This function initializes the Infineon OPTIGA Trust M command library and sends the 'open application' command to the device. This opens the communicatino channel to the Optiga Trust M, so that you can carry out different operations

Parameters

[in]

CustomWire

Reference to a custom TwoWire object used with the Optiga.

Return values

0	If function was successful.
1	If the operation failed.

Set the corresponding i2c context first

Here is the call graph for this function:

calculateSignature() [1/2]

int32_t IFX_OPTIGA_TrustM::calculateSignature ( uint8_t  dataToSign[], uint16_t  dlen, uint16_t  privateKey_oid, uint8_t  result[], uint16_t &  rlen  )

inline

This function generates an ECDSA signature.

Parameters

[in]	dataToSign	Pointer to the data
[in]	dlen	Length of the input data
[in]	privateKey_oid	[Optional] Object ID defines which private key slot will be used to generate the signature. Default is the first slot. Use either one of: eDEVICE_PRIKEY_1 (Default) eDEVICE_PRIKEY_2 eDEVICE_PRIKEY_3 eDEVICE_PRIKEY_4 slots define below or eSessionCtxId_d session contexts
[out]	result	Pointer to the data array where the final result should be stored.
[out]	rlen	Length of the output data. Will be modified in case of success.

Return values

0	If function was successful.
1	If the operation failed.

Here is the call graph for this function:

calculateSignature() [2/2]

int32_t IFX_OPTIGA_TrustM::calculateSignature ( uint8_t  dataToSign[], uint16_t  dlen, uint8_t  result[], uint16_t &  rlen  )

inline

Here is the call graph for this function:

calculateSignatureECDSA() [1/2]

int32_t IFX_OPTIGA_TrustM::calculateSignatureECDSA	(	uint8_t	dataToSign[],
		uint16_t	dlen,
		uint16_t	privateKey_oid,
		uint8_t	result[],
		uint16_t &	rlen
	)

This function generates an ECDSA signature.

Parameters

[in]	dataToSign	Pointer to the data
[in]	dlen	Length of the input data
[in]	privateKey_oid	[Optional] Object ID defines which private key slot will be used to generate the signature. Default is the first slot. Use either one of: eDEVICE_PRIKEY_1 (Default) eDEVICE_PRIKEY_2 eDEVICE_PRIKEY_3 eDEVICE_PRIKEY_4 slots define below or eSessionCtxId_d session contexts
[out]	result	Pointer to the data array where the final result should be stored.
[out]	rlen	Length of the output data. Will be modified in case of success.

Return values

0	If function was successful.
1	If the operation failed.

calculateSignatureECDSA() [2/2]

int32_t IFX_OPTIGA_TrustM::calculateSignatureECDSA ( uint8_t  dataToSign[], uint16_t  dlen, uint8_t  result[], uint16_t &  rlen  )

inline

Here is the call graph for this function:

calculateSignatureRSA() [1/2]

int32_t IFX_OPTIGA_TrustM::calculateSignatureRSA	(	uint8_t	dataToSign[],
		uint16_t	dlen,
		uint16_t	privateKey_oid,
		uint8_t	result[],
		uint16_t &	rlen
	)

This function generates an RSA signature.

Parameters

[in]	dataToSign	Pointer to the data
[in]	dlen	Length of the input data
[in]	privateKey_oid	[Optional] Object ID defines which private key slot will be used to generate the signature. Default is the first slot. Use either one of: eDEVICE_PRIKEY_1 (Default) eDEVICE_PRIKEY_2 eDEVICE_PRIKEY_3 eDEVICE_PRIKEY_4 slots define below or eSessionCtxId_d session contexts
[out]	result	Pointer to the data array where the final result should be stored.
[out]	rlen	Length of the output data. Will be modified in case of success.

Return values

0	If function was successful.
1	If the operation failed.

calculateSignatureRSA() [2/2]

int32_t IFX_OPTIGA_TrustM::calculateSignatureRSA ( uint8_t  dataToSign[], uint16_t  dlen, uint8_t  result[], uint16_t &  rlen  )

inline

Here is the call graph for this function:

checkChip()

int32_t IFX_OPTIGA_TrustM::checkChip

(

void

)

This function checks whether the chip posseses the genuine certificate

Return values

0	If function was successful.
1	If the operation failed.

decrypt()

int32_t IFX_OPTIGA_TrustM::decrypt	(	uint8_t	dataToDecrypt[],
		uint16_t	dlen,
		uint16_t	keyOID,
		uint8_t	result[],
		uint16_t &	rlen
	)

This function decrypt user given data with RSAES PKCS1 v1.5 Scheme.

Parameters

[in]	dataToDecrypt	Pointer to the data
[in]	dlen	Length of the input data
[in]	keyOID	Object ID defines which key will be used to decrypt the message. Default is the first slot. Use either one of: eRSA_DEVICE_PRIKEY_1 (Default) eRSA_DEVICE_PRIKEY_2
[out]	result	Pointer to the data array where the final result should be stored.
[out]	rlen	Length of the output data. Will be modified in case of success.

Return values

0	If function was successful.
1	If the operation failed.

encrypt() [1/2]

int32_t IFX_OPTIGA_TrustM::encrypt	(	uint8_t	dataToEncrypt[],
		uint16_t	dlen,
		uint8_t	pubkeyFromUser[],
		uint16_t	pklen,
		uint8_t	result[],
		uint16_t &	rlen
	)

This function encrypt user given data with RSAES PKCS1 v1.5 Scheme.

Parameters

[in]	dataToEncrypt	Pointer to the data
[in]	dlen	Length of the input data
[in]	pubkeyFromUser	A user provided RSA public key.

Note

The folloiwng format is expected static uint8_t public_key [] = { //BIT String 0x03, //BIT String Length 0x81, 0x8E, //UnusedBits 0x00, //SEQUENCE 0x30, //Length 0x81, 0x8A, //INTEGER (pub key) 0x02, //Pub key modulus length 0x81, 0x81, //Public key modulus 0x00, 0xA1, 0xD4, 0x6F, 0xBA, 0x23, 0x18, 0xF8, 0xDC, 0xEF, 0x16, 0xC2, 0x80, 0x94, 0x8B, 0x1C, 0xF2, 0x79, 0x66, 0xB9, 0xB4, 0x72, 0x25, 0xED, 0x29, 0x89, 0xF8, 0xD7, 0x4B, 0x45, 0xBD, 0x36, 0x04, 0x9C, 0x0A, 0xAB, 0x5A, 0xD0, 0xFF, 0x00, 0x35, 0x53, 0xBA, 0x84, 0x3C, 0x8E, 0x12, 0x78, 0x2F, 0xC5, 0x87, 0x3B, 0xB8, 0x9A, 0x3D, 0xC8, 0x4B, 0x88, 0x3D, 0x25, 0x66, 0x6C, 0xD2, 0x2B, 0xF3, 0xAC, 0xD5, 0xB6, 0x75, 0x96, 0x9F, 0x8B, 0xEB, 0xFB, 0xCA, 0xC9, 0x3F, 0xDD, 0x92, 0x7C, 0x74, 0x42, 0xB1, 0x78, 0xB1, 0x0D, 0x1D, 0xFF, 0x93, 0x98, 0xE5, 0x23, 0x16, 0xAA, 0xE0, 0xAF, 0x74, 0xE5, 0x94, 0x65, 0x0B, 0xDC, 0x3C, 0x67, 0x02, 0x41, 0xD4, 0x18, 0x68, 0x45, 0x93, 0xCD, 0xA1, 0xA7, 0xB9, 0xDC, 0x4F, 0x20, 0xD2, 0xFD, 0xC6, 0xF6, 0x63, 0x44, 0x07, 0x40, 0x03, 0xE2, 0x11, //INTEGER (publicExponent) 0x02, //Pub key exponent length 0x04, //Public Exponent 0x00, 0x01, 0x00, 0x01 };

Parameters

[in]	pklen	Public key length
[out]	result	Pointer to the data array where the final result should be stored.
[out]	rlen	Length of the output data. Will be modified in case of success.

Return values

0	If function was successful.
1	If the operation failed.

encrypt() [2/2]

int32_t IFX_OPTIGA_TrustM::encrypt	(	uint8_t	dataToEncrypt[],
		uint16_t	dlen,
		uint16_t	certOID,
		uint8_t	result[],
		uint16_t &	rlen
	)

This function encrypt user given data with RSAES PKCS1 v1.5 Scheme.

Parameters

[in]	dataToEncrypt	Pointer to the data
[in]	dlen	Length of the input data
[in]	certOID	Object ID defines which public key will be used to encrypt the message (the public key will be extracted from the certificate). Default is the first slot. Use either one of: eDEVICE_PUBKEY_CERT_IFX (Default) eDEVICE_PUBKEY_CERT_PRJSPC_1 eDEVICE_PUBKEY_CERT_PRJSPC_2 eDEVICE_PUBKEY_CERT_PRJSPC_3
[out]	result	Pointer to the data array where the final result should be stored.
[out]	rlen	Length of the output data. Will be modified in case of success.

Return values

0	If function was successful.
1	If the operation failed.

end()

void IFX_OPTIGA_TrustM::end

(

void

)

Ends communication with the Optiga Trust M.

Return values

0	If function was successful.
1	If the operation failed.

formatSignature()

int32_t IFX_OPTIGA_TrustM::formatSignature	(	uint8_t	signature[],
		uint16_t	signatureLength,
		uint8_t	result[],
		uint16_t &	rlen
	)

This function encodes generated signature in ASN.1 format

Parameters

[in]	signature	Pointer to signature in DER format
[in]	signatureLength	Length of the input data
[out]	result	Pointer to the data array where the final result should be stored.
[out]	rlen	Length of the output data. Will be modified in case of success.

Return values

0	If function was successful.
1	If the operation failed.

generateKeypair() [1/3]

int32_t IFX_OPTIGA_TrustM::generateKeypair ( uint8_t  publicKey[], uint16_t &  plen  )

inline

This function generates a RSA 1024 bits exponential public private keypair. You can store the private key internally or export it for your usage

Parameters

[out]	publicKey	Pointer to the data array where the result public key should be stored.
[out]	plen	Length of the public key
[in]	privateKey_oid	an Object ID of a slot, where the newly generated key should be stored: Use one of the following slots: eSESSION_ID_1 eSESSION_ID_2 (Default) eSESSION_ID_3 eSESSION_ID_4 eDEVICE_PRIKEY_1 eDEVICE_PRIKEY_2 eDEVICE_PRIKEY_3 eDEVICE_PRIKEY_4
[out]	privateKey	[Optional] Pointer to the data array where the result private key should be stored.
[out]	prlen	[Optional] Length of the private key.

Return values

0	If function was successful.
1	If the operation failed.

Here is the call graph for this function:

generateKeypair() [2/3]

int32_t IFX_OPTIGA_TrustM::generateKeypair ( uint8_t  publicKey[], uint16_t &  plen, uint16_t  privateKey_oid  )

inline

Here is the call graph for this function:

generateKeypair() [3/3]

int32_t IFX_OPTIGA_TrustM::generateKeypair ( uint8_t  publicKey[], uint16_t &  plen, uint8_t  privateKey[], uint16_t &  prlen  )

inline

Here is the call graph for this function:

generateKeypairECC() [1/3]

int32_t IFX_OPTIGA_TrustM::generateKeypairECC ( uint8_t  publicKey[], uint16_t &  plen  )

inline

This function generates an ECC public private keypair. You can store the private key internally or export it for your usage

Parameters

[out]	publicKey	Pointer to the data array where the result public key should be stored.
[out]	plen	Length of the public key
[in]	privateKey_oid	an Object ID of a slot, where the newly generated key should be stored: Use one of the following slots: eSESSION_ID_1 eSESSION_ID_2 (Default) eSESSION_ID_3 eSESSION_ID_4 eDEVICE_PRIKEY_1 eDEVICE_PRIKEY_2 eDEVICE_PRIKEY_3 eDEVICE_PRIKEY_4
[out]	privateKey	[Optional] Pointer to the data array where the result private key should be stored.
[out]	prlen	[Optional] Length of the private key.
[in]	ecc_key_type	[Optional] Public key ECC curve type

Return values

0	If function was successful.
1	If the operation failed.

Here is the call graph for this function:

generateKeypairECC() [2/3]

int32_t IFX_OPTIGA_TrustM::generateKeypairECC	(	uint8_t *	p_pubkey,
		uint16_t &	plen,
		uint16_t	privateKey_oid,
		optiga_ecc_curve_t	ecc_key_type
	)

Generate ECC Key pair

• Use ECC NIST P 256 or P384 Curve
• Specify the Key Usage (Key Agreement or Sign based on requirement)
• Store the Private key in OPTIGA Key store
• Export Public Key

generateKeypairECC() [3/3]

int32_t IFX_OPTIGA_TrustM::generateKeypairECC	(	uint8_t *	p_pubkey,
		uint16_t &	plen,
		uint8_t *	p_privkey,
		uint16_t &	prlen,
		optiga_ecc_curve_t	ecc_key_type
	)

Generate ECC Key pair

• Use ECC NIST P 256 or P384 Curve
• Specify the Key Usage (Key Agreement or Sign based on requirement)
• Store the Private key in OPTIGA Key store
• Export Public Key

generateKeypairECCP256() [1/2]

int32_t IFX_OPTIGA_TrustM::generateKeypairECCP256 ( uint8_t *  p_pubkey, uint16_t &  plen, uint8_t *  p_privkey, uint16_t &  prlen  )

inline

This function generates an ECC NIST P 256 public private keypair. You can store the private key internally or export it for your usage

Parameters

[out]	publicKey	Pointer to the data array where the result public key should be stored.
[out]	plen	Length of the public key
[in]	privateKey_oid	an Object ID of a slot, where the newly generated key should be stored: Use one of the following slots: eSESSION_ID_1 eSESSION_ID_2 (Default) eSESSION_ID_3 eSESSION_ID_4 eDEVICE_PRIKEY_1 eDEVICE_PRIKEY_2 eDEVICE_PRIKEY_3 eDEVICE_PRIKEY_4
[out]	privateKey	[Optional] Pointer to the data array where the result private key should be stored.
[out]	prlen	[Optional] Length of the private key.

Return values

0	If function was successful.
1	If the operation failed.

Here is the call graph for this function:

generateKeypairECCP256() [2/2]

int32_t IFX_OPTIGA_TrustM::generateKeypairECCP256 ( uint8_t *  p_pubkey, uint16_t &  plen, uint16_t  privateKey_oid  )

inline

Here is the call graph for this function:

generateKeypairECCP384() [1/2]

int32_t IFX_OPTIGA_TrustM::generateKeypairECCP384 ( uint8_t *  p_pubkey, uint16_t &  plen, uint8_t *  p_privkey, uint16_t &  prlen  )

inline

This function generates an ECC NIST P 384 public private keypair. You can store the private key internally or export it for your usage

Parameters

[out]	publicKey	Pointer to the data array where the result public key should be stored.
[out]	plen	Length of the public key
[in]	privateKey_oid	an Object ID of a slot, where the newly generated key should be stored: Use one of the following slots: eSESSION_ID_1 eSESSION_ID_2 (Default) eSESSION_ID_3 eSESSION_ID_4 eDEVICE_PRIKEY_1 eDEVICE_PRIKEY_2 eDEVICE_PRIKEY_3 eDEVICE_PRIKEY_4
[out]	privateKey	[Optional] Pointer to the data array where the result private key should be stored.
[out]	prlen	[Optional] Length of the private key.

Return values

0	If function was successful.
1	If the operation failed.

Here is the call graph for this function:

generateKeypairECCP384() [2/2]

int32_t IFX_OPTIGA_TrustM::generateKeypairECCP384 ( uint8_t *  p_pubkey, uint16_t &  plen, uint16_t  privateKey_oid  )

inline

Here is the call graph for this function:

generateKeypairRSA() [1/3]

int32_t IFX_OPTIGA_TrustM::generateKeypairRSA ( uint8_t  publicKey[], uint16_t &  plen  )

inline

This function generates a RSA type public private keypair. You can store the private key internally or export it for your usage

Parameters

[out]	publicKey	Pointer to the data array where the result public key should be stored.
[out]	plen	Length of the public key
[in]	privateKey_oid	an Object ID of a slot, where the newly generated key should be stored: Use one of the following slots: eSESSION_ID_1 eSESSION_ID_2 (Default) eSESSION_ID_3 eSESSION_ID_4 eDEVICE_PRIKEY_1 eDEVICE_PRIKEY_2 eDEVICE_PRIKEY_3 eDEVICE_PRIKEY_4
[out]	privateKey	[Optional] Pointer to the data array where the result private key should be stored.
[out]	prlen	[Optional] Length of the private key.
[in]	rsa_key_type	[Optional] Public key RSA type

Return values

0	If function was successful.
1	If the operation failed.

Here is the call graph for this function:

generateKeypairRSA() [2/3]

int32_t IFX_OPTIGA_TrustM::generateKeypairRSA	(	uint8_t *	p_pubkey,
		uint16_t &	plen,
		uint16_t	privateKey_oid,
		optiga_rsa_key_type_t	rsa_key_type
	)

Generate RSA Key pair

• Use 1024 or 2048 bit RSA key
• Specify the Key Usage
• Store the Private key in OPTIGA Key store (When exporting the private key, provide buffer of sufficient length (key size in bytes + encoding length))
• Export Public Key

generateKeypairRSA() [3/3]

int32_t IFX_OPTIGA_TrustM::generateKeypairRSA	(	uint8_t *	p_pubkey,
		uint16_t &	plen,
		uint8_t *	p_privkey,
		uint16_t &	prlen,
		optiga_rsa_key_type_t	rsa_key_type
	)

Generate RSA Key pair

• Use 1024 or 2048 bit RSA key
• Specify the Key Usage
• Export the Private key in OPTIGA Key store (When exporting the private key, provide buffer of sufficient length (key size in bytes + encoding length))
• Export Public Key

generateKeypairRSA1024() [1/2]

int32_t IFX_OPTIGA_TrustM::generateKeypairRSA1024 ( uint8_t *  p_pubkey, uint16_t &  plen, uint8_t *  p_privkey, uint16_t &  prlen  )

inline

This function generates RSA 1024 bits exponential type public private keypair. You can store the private key internally or export it for your usage

Parameters

[out]	publicKey	Pointer to the data array where the result public key should be stored.
[out]	plen	Length of the public key
[in]	privateKey_oid	an Object ID of a slot, where the newly generated key should be stored: Use one of the following slots: eSESSION_ID_1 eSESSION_ID_2 (Default) eSESSION_ID_3 eSESSION_ID_4 eDEVICE_PRIKEY_1 eDEVICE_PRIKEY_2 eDEVICE_PRIKEY_3 eDEVICE_PRIKEY_4
[out]	privateKey	[Optional] Pointer to the data array where the result private key should be stored.
[out]	prlen	[Optional] Length of the private key.

Return values

0	If function was successful.
1	If the operation failed.

Here is the call graph for this function:

generateKeypairRSA1024() [2/2]

int32_t IFX_OPTIGA_TrustM::generateKeypairRSA1024 ( uint8_t *  p_pubkey, uint16_t &  plen, uint16_t  privateKey_oid  )

inline

Here is the call graph for this function:

generateKeypairRSA2048() [1/2]

int32_t IFX_OPTIGA_TrustM::generateKeypairRSA2048 ( uint8_t *  p_pubkey, uint16_t &  plen, uint8_t *  p_privkey, uint16_t &  prlen  )

inline

This function generates RSA 2048 bits exponential type public private keypair. You can store the private key internally or export it for your usage

Parameters

[out]	publicKey	Pointer to the data array where the result public key should be stored.
[out]	plen	Length of the public key
[in]	privateKey_oid	an Object ID of a slot, where the newly generated key should be stored: Use one of the following slots: eSESSION_ID_1 eSESSION_ID_2 (Default) eSESSION_ID_3 eSESSION_ID_4 eDEVICE_PRIKEY_1 eDEVICE_PRIKEY_2 eDEVICE_PRIKEY_3 eDEVICE_PRIKEY_4
[out]	privateKey	[Optional] Pointer to the data array where the result private key should be stored.
[out]	prlen	[Optional] Length of the private key.

Return values

0	If function was successful.
1	If the operation failed.

Here is the call graph for this function:

generateKeypairRSA2048() [2/2]

int32_t IFX_OPTIGA_TrustM::generateKeypairRSA2048 ( uint8_t *  p_pubkey, uint16_t &  plen, uint16_t  privateKey_oid  )

inline

Here is the call graph for this function:

getCertificate()

int32_t IFX_OPTIGA_TrustM::getCertificate	(	uint8_t	certificate[],
		uint16_t &	certificateLength
	)

Get the Infineon OPTIGA Trust M device certificate.

The function retrieves the public X.509 certificate stored in the Infineon OPTIGA Trust M device. This certificate and the contained public key can be used to verify a signature from the device. In addition, the receiver of the certificate can verify the chain of trust by validating the issuer of the certificate and the issuer's signature on it.

Parameters

[out]	certificate	Pointer to the buffer that will contain the output.
[out]	certificateLength	Pointer to the variable that will contain the length.

Return values

0	If function was successful.
1	If the operation failed.

getCurrentLimit()

int32_t IFX_OPTIGA_TrustM::getCurrentLimit ( uint8_t &  currentLim )

inline

This function returns the current limitation, which holds the maximum value of current allowed to be consumed by the OPTIGA™ Trust M across all operating conditions.

Default value 0x06

Parameters

[out]

currentLim

Reference where the value will be stored

Return values

0	If function was successful.
1	If the operation failed.

getLastErrorCodes()

int32_t IFX_OPTIGA_TrustM::getLastErrorCodes ( uint8_t  errorCodes[], uint16_t &  errorCodesLength  )

inline

This function returns the last error code.

Parameters

[out]	errorCodes	Pointer where the value will be stored
[out]	errorCodesLength	Pointer where the length of the value is stored

Return values

0	If function was successful.
1	If the operation failed.

getPublicKey()

int32_t IFX_OPTIGA_TrustM::getPublicKey

(

uint8_t

publickey[68]

)

Get the Infineon OPTIGA Trust M device certificate public key.

The function retrieves the public X.509 certificate stored in the Infineon OPTIGA Trust M device and extracts the public key from it. Work for Certificates based on NIST P256 curve

Parameters

[out]

publickey

Pointer to the buffer where the public key will be stored. Should 68 bytes long. 64 bytes for the key and 4 bytes for the encoding BitString Format (0x03, 0x42, 0x00) + Compression format (0x04) + Public Key (64 bytes)

Return values

0	If the function was successful.
1	If the operation failed.

Here is the call graph for this function:

getRandom()

int32_t IFX_OPTIGA_TrustM::getRandom	(	uint16_t	length,
		uint8_t	random[]
	)

Get a random number.

The function retrieves a cryptographic-quality random number from the OPTIGA device. This function can be used as entropy source for various security schemes.

Parameters

[in]	length	Length of the random number (range 8 to 256).
[out]	random	Buffer to store the data.

Return values

0	If function was successful.
1	If the operation failed.

Generate Random -

• Specify the Random type as TRNG

getUniqueID()

int32_t IFX_OPTIGA_TrustM::getUniqueID ( uint8_t  uniqueID[], uint16_t &  uidLength  )

inline

This function returns the Coprocessor UID value. Length is 27, where First 25 bytes is the unique hardware identifier Last 2 bytes is the Embedded Software Build Number BCD Coded

Parameters

[out]	uniqueID	Pointer where the value will be stored
[in]	ulen	Pointer where the length of the value is stored

Return values

0	If function was successful.
1	If the operation failed.

pairMCU()

int32_t IFX_OPTIGA_TrustM::pairMCU

(

void

)

This function pairs the Host MCU and the OPTIGA Trust M This function by default works only with samples which have Pres-shared secret data object unlocked for modification YOu can though pair devices and then lock this dataobject afterwards.

Return values

0	If function was successful.
1	If the operation failed.

1. Initialize the protection level and protocol version for the instances
2. Read Platform Binding Shared secret (0xE140) data object metadata from OPTIGA using optiga_util_read_metadata.
3. Validate LcsO in the metadata. Skip the rest of the procedure if LcsO is greater than or equal to operational state(0x07)
4. Generate Random using optiga_crypt_random
   • Specify the Random type as TRNG a. The recommended size of secret is 64 bytes which is maximum supported. the minimum recommended is 32 bytes. b. If the host platform doesn't support random generation, use OPTIGA to generate the maximum size chosen. else choose the appropriate length of random to be generted by OPTIGA
5. Write random(secret) to OPTIGA platform Binding shared secret data object (0xE140)
6. Write/store the random(secret) on the Host platform
7. Update metadata of OPTIGA Platform Binding shared secret data object (0xE140)

reset()

int32_t IFX_OPTIGA_TrustM::reset

(

void

)

This function resets the Infineon OPTIGA Trust M. This helps to recover the connection to the optiga once it got lost. (Indicator: 1 is returned by any other function)

Return values

0	If function was successful.
1	If the operation failed.

Here is the call graph for this function:

setCurrentLimit()

int32_t IFX_OPTIGA_TrustM::setCurrentLimit ( uint8_t  currentLim )

inline

This function sets the sleep mode activation delay. Valid values are 0x06 - 0x0F or 6 mA - 15mA

Parameters

[in]

currentLim

The value that will be set

Return values

0	If function was successful.
1	If the operation failed.

sha256()

int32_t IFX_OPTIGA_TrustM::sha256	(	uint8_t	dataToHash[],
		uint16_t	dlen,
		uint8_t	hash[32]
	)

This function calculates SHA256 hash of the given data.

Parameters

[in]	dataToHash	Pointer to the data
[in]	dlen	Length of the input data
[out]	p_out	Pointer to the data array where the final result should be stored. Must be defined.

Return values

0	If function was successful.
1	If the operation failed.

1. Initialize the Hash context
2. Initialize the hashing context at OPTIGA
3. Continue hashing the data
4. Finalize the hash

sharedSecret() [1/4]

int32_t IFX_OPTIGA_TrustM::sharedSecret ( uint8_t  publicKey[], uint16_t  plen  )

inline

This function generates a shared secret based on Elliptic Curve Diffie-Hellman Key Exchange Algorithm This functions works in several modes. In general for such functions you need to specify following: elliptic curve type, private key, public key, result shared secret. Different functions listed below assume you don't need various parts of this input as you use internally stored values #1 sharedSecret(p_pubkey) - Private Key is taken from the first private keys slot. NISTP256 Curve is used #2 sharedSecret(priv_oid, p_pubkey) - Works like #1, but you can specifiy which slot to use. #3 sharedSecret(priv_oid, ssec_oid, p_pubkey) - Works like #1, but you can specifiy which slot to use for the private key and for the shared secret. #4 sharedSecret(curve_type, p_pubkey) - Works like #1, but you can define a curve type: "secp256r1" or "secp384r1" #5 sharedSecret(curve_type, priv_oid, p_pubkey) - Works like #2, but you can define a curve type: "secp256r1" or "secp384r1" #6 sharedSecretWithExport(p_pubkey, p_out) - Works like #1, but exports the result in p_out #7 sharedSecretWithExport(curve_type, p_pubkey, p_out) - Works like #5, but additionally you can define curve type of the publick key

This Shared secret can be used until the Session Context will be flashed, either after an application restart or a reset

Parameters

[in]	curveName	Curve name. The following are supported: "secp256r1" (Deafult) "secp384r1"
[in]	oid	Object ID defines which slot will be used as input and output Use one of the following slots: eSESSION_ID_1 eSESSION_ID_2 (Default) eSESSION_ID_3 eSESSION_ID_4
[in]	publicKey	A pointer to a public key
[in]	plen	Length of a public key
[out]

sharedSecret() [2/4]

int32_t IFX_OPTIGA_TrustM::sharedSecret ( uint16_t  oid, uint8_t  publicKey[], uint16_t  plen  )

inline

sharedSecret() [3/4]

int32_t IFX_OPTIGA_TrustM::sharedSecret ( String  curveName, uint8_t  publicKey[], uint16_t  plen  )

inline

sharedSecret() [4/4]

int32_t IFX_OPTIGA_TrustM::sharedSecret ( String  curveName, uint16_t  oid, uint8_t  publicKey[], uint16_t  plen  )

inline

sharedSecretWithExport() [1/2]

int32_t IFX_OPTIGA_TrustM::sharedSecretWithExport ( uint8_t  publicKey[], uint16_t  plen, uint8_t  sharedSecret[], uint16_t &  shlen  )

inline

Here is the call graph for this function:

sharedSecretWithExport() [2/2]

int32_t IFX_OPTIGA_TrustM::sharedSecretWithExport ( String  curveName, uint8_t  publicKey[], uint16_t  plen, uint8_t  sharedSecret[], uint16_t &  shlen  )

inline

Here is the call graph for this function:

verifySignature() [1/3]

int32_t IFX_OPTIGA_TrustM::verifySignature ( uint8_t  hash[], uint16_t  hashLength, uint8_t  signature[], uint16_t  signatureLength, uint16_t  publicKey_oid  )

inline

This function verifies an ECDSA signature. This functions works in two modes, either use internal OID where a public key is stored or you can give your own public key as an input

Parameters

[in]	hash	Pointer to the hash
[in]	hashLength	Length of the input data
[in]	publicKey_oid	[Optional] Object ID defines which slot will be used to verify the signature. The slot should contain a public key certificate starting with internat 0xC0 byte. For more information please refere to the datasheet documents. Default is the first slot. Possible values are: eDEVICE_PUBKEY_CERT_IFX (Default) eDEVICE_PUBKEY_CERT_PRJSPC_1 eDEVICE_PUBKEY_CERT_PRJSPC_2 eDEVICE_PUBKEY_CERT_PRJSPC_3
[in]	signature	Pointer to the data array where the final result should be stored.
[in]	signatureLength	Length of the output data. Will be modified in case of success.
[in]	pubKey	A pointer to the public key to be used for the verification
[in]	plen	Length of the public key to be used for the verification

Return values

0	If function was successful.
1	If the operation failed.

Here is the call graph for this function:

verifySignature() [2/3]

int32_t IFX_OPTIGA_TrustM::verifySignature ( uint8_t  hash[], uint16_t  hashLength, uint8_t  signature[], uint16_t  signatureLength  )

inline

Here is the call graph for this function:

verifySignature() [3/3]

int32_t IFX_OPTIGA_TrustM::verifySignature ( uint8_t  hash[], uint16_t  hashLength, uint8_t  signature[], uint16_t  signatureLength, uint8_t  pubKey[], uint16_t  plen  )

inline

Here is the call graph for this function:

verifySignatureECDSA() [1/2]

int32_t IFX_OPTIGA_TrustM::verifySignatureECDSA	(	uint8_t	hash[],
		uint16_t	hashLength,
		uint8_t	signature[],
		uint16_t	signatureLength,
		uint16_t	publicKey_oid
	)

This function verifies an ECDSA FIPS 186-3 w/o hash signature. This functions works in two modes, either use internal OID where a public key is stored or you can give your own public key as an input

Parameters

[in]	hash	Pointer to the hash
[in]	hashLength	Length of the input data
[in]	publicKey_oid	[Optional] Object ID defines which slot will be used to verify the signature. The slot should contain a public key certificate starting with internat 0xC0 byte. For more information please refere to the datasheet documents. Default is the first slot. Possible values are: eDEVICE_PUBKEY_CERT_IFX (Default) eDEVICE_PUBKEY_CERT_PRJSPC_1 eDEVICE_PUBKEY_CERT_PRJSPC_2 eDEVICE_PUBKEY_CERT_PRJSPC_3
[in]	signature	Pointer to the data array where the final result should be stored.
[in]	signatureLength	Length of the output data. Will be modified in case of success.
[in]	pubKey	A pointer to the public key to be used for the verification
[in]	plen	Length of the public key to be used for the verification
[in]	ecc_key_type	Public key ECC curve type

Return values

0	If function was successful.
1	If the operation failed.

Verify RSA signature using public key from host

verifySignatureECDSA() [2/2]

int32_t IFX_OPTIGA_TrustM::verifySignatureECDSA	(	uint8_t	hash[],
		uint16_t	hashLength,
		uint8_t	signature[],
		uint16_t	signatureLength,
		uint8_t	pubKey[],
		uint16_t	plen,
		optiga_ecc_curve_t	ecc_key_type
	)

Verify RSA signature using public key from host

verifySignatureRSA() [1/2]

int32_t IFX_OPTIGA_TrustM::verifySignatureRSA	(	uint8_t	hash[],
		uint16_t	hashLength,
		uint8_t	signature[],
		uint16_t	signatureLength,
		uint16_t	publicKey_oid
	)

This function verifies an RSA signature. This functions works in two modes, either use internal OID where a public key is stored or you can give your own public key as an input

Parameters

[in]	hash	Pointer to the hash
[in]	hashLength	Length of the input data
[in]	publicKey_oid	[Optional] Object ID defines which slot will be used to verify the signature. The slot should contain a public key certificate starting with internat 0xC0 byte. For more information please refere to the datasheet documents. Default is the first slot. Possible values are: eDEVICE_PUBKEY_CERT_IFX (Default) eDEVICE_PUBKEY_CERT_PRJSPC_1 eDEVICE_PUBKEY_CERT_PRJSPC_2 eDEVICE_PUBKEY_CERT_PRJSPC_3
[in]	signature	Pointer to the data array where the final result should be stored.
[in]	signatureLength	Length of the output data. Will be modified in case of success.
[in]	pubKey	A pointer to the public key to be used for the verification
[in]	plen	Length of the public key to be used for the verification
[in]	rsa_key_type	Public key RSA type

Return values

0	If function was successful.
1	If the operation failed.

Verify RSA signature using public key from host

verifySignatureRSA() [2/2]

int32_t IFX_OPTIGA_TrustM::verifySignatureRSA	(	uint8_t	hash[],
		uint16_t	hashLength,
		uint8_t	signature[],
		uint16_t	signatureLength,
		uint8_t	pubKey[],
		uint16_t	plen,
		optiga_rsa_key_type	rsa_key_type
	)

---

The documentation for this class was generated from the following files:

• C:/Users/Enriquez/Documents/Arduino/libraries/arduino-optiga-trust-m/src/OPTIGATrustM.h
• C:/Users/Enriquez/Documents/Arduino/libraries/arduino-optiga-trust-m/src/OPTIGATrustM.cpp