STM32H5 Secure Manager + TLS stack (CycloneCRYPTO) : Peripheral ownership and Opaque key handling
Hi!
Setup
- MCU: STM32H573 (Cortex-M33, TrustZone enabled)
- Secure world: STM32 Secure Manager via SMAK, product state CLOSED
- Non-secure app: CycloneTCP / CycloneSSL / CycloneCRYPTO (Oryx Embedded)
- Use case: HTTPS server on a networked device with a long-lived device identity key that must never leave the secure world, plus automated certificate renewal (EST/ACME)
What I understand so far!!!
mbedTLS consumes the PSA Crypto API natively (MBEDTLS_USE_PSA_CRYPTO plus mbedtls_pk_setup_opaque()), and wolfSSL has partial PSA support via WOLFSSL_HAVE_PSA. Both therefore let the private key stay inside Secure Manager while the non-secure application holds only a psa_key_id_t handle.
CycloneCRYPTO has no PSA backend as far as I can tell. Instead it ships register-level STM32H5 ports (stm32h5xx_crypto_pkc.c, stm32h5xx_crypto_cipher.c, stm32h5xx_crypto_hash.c, stm32h5xx_crypto_trng.c) that drive PKA, AES/SAES, HASH and RNG directly. That looks like a direct conflict with Secure Manager, which claims several of those peripherals for the secure world through GTZC.
Questions
1. Peripheral ownership. In the default Secure Manager configuration on STM32H573, which crypto peripherals are reserved for the secure world like PKA, SAES, AES, HASH, RNG? Is any of them left assignable to the non-secure world, and where is that configured?
2. Supported interface. Is PSA Crypto the only supported path from the non-secure application into Secure Manager, or is there an ST-provided or ST-recommended pattern for integrating a third-party TLS stack that does not speak PSA?
3. Customer-written shim. I am considering a shim that registers CycloneCRYPTO's X.509 and TLS ECDSA sign callbacks and forwards them to psa_sign_hash(). Is that an accepted pattern from ST's perspective, and are there known pitfalls beyond the obvious format conversions?
Has anyone here integrated CycloneCRYPTO, CycloneSSL or wolfSSL along with Secure Manager on an STM32H5? Any application note, example, or thread I have missed would be very welcome.
Thanks in advance.
