|
SharkSSL™ Embedded SSL/TLS Stack
|
This guide explains how to add the GNU RX assembly implementations to an existing SharkSSL build. Cipher acceleration and big-integer acceleration are configured separately. For the IAR toolchain, use the distinct RX_IAR port; the GNU syntax is not accepted by IAR.
Compile the uppercase .S files through GCC so they are preprocessed. For RX72N, use -misa=v3. Supply the same feature definitions to the C and assembly sources through SharkSSL_opts.h or GCC -D options. The GNU port translates the same 19 assembly hooks as native RX_IAR. Both ports use the _RX basenames; select the source directory for your toolchain and keep its object files in a separate output directory.
Compile SharkSslCrypto_RX.S together with SharkSslCrypto.c:
Set the following in TargConfig.h:
Enable the algorithms required by your application:
See SharkSslCrypto.h for the APIs. The Poly1305 implementation is based on Daniel J. Bernstein's "The Poly1305-AES message-authentication code", but this API does not use AES. The ChaCha20 implementation is based on his "The ChaCha family of stream ciphers".
ChaCha20 keeps state words 0..11 in registers across all twenty rounds and spills only words 12..15. It uses 80 bytes of local stack plus 32 bytes for the preserved registers. Zero-length calls return without changing the counter; short tails read only the requested input bytes.
When ChaCha20 assembly is excluded, SHARKSSL_CHACHA_SMALL_FOOTPRINT=1 selects a smaller, slightly slower C implementation.
Compile SharkSslBigInt_RX.S together with SharkSslBigInt.c:
Set the following in TargConfig.h:
Compile SharkSslX25519_RX.S with SharkSslBigInt.c and enable:
This backend supplies all ten Cortex-M4 hooks: field add/subtract, combined add/subtract, multiplication, squaring, multiplication by 121666, single/paired conditional swaps, inversion and the full Montgomery ladder. It uses eight little-endian 32-bit limbs and RX EMULU, rather than ARM DSP instructions. Field arithmetic and scalar swaps have fixed schedules; only public loop counts control branches. It is independent of generic BigInt assembly and requires little-endian GNU RX and 32-bit BigInt words.
Compile SharkSslGcm_RX.S with SharkSslCrypto.c and enable the hooks independently:
GHASH uses the same 16-entry M0 table and byte-order convention as the Cortex-M GCC and portable C implementations. Its table accesses depend on authenticated data; this is not a table-free GHASH implementation. The GCM hook processes complete blocks, calls the existing AES block-encryption routine, advances the 32-bit big-endian counter and authenticates ciphertext before an in-place decrypt overwrites it. Partial blocks remain in C. AES-128/192/256 context layouts are selected from the same feature definitions. GHASH-only builds and GCM with the C GHASH fallback are supported. The reduction table holds sixteen aligned 32-bit constants with their final bit positions, avoiding a separate shift on each four-bit reduction. Table-word loads are interleaved with independent XOR operations, and the reduction constant is loaded before the independent accumulator shifts.
The historical speed and size examples are shown side by side below. Enable CCM only if your application needs it.
These values are reference examples, not a production TLS preset. In particular, SHARKSSL_USE_RNG_TINYMT=1 selects a generator unsuitable for cryptographic use. For a current build, follow build configuration and the configuration API.
| Setting | Speed example | Size example |
|---|---|---|
B_LITTLE_ENDIAN | 1 | 1 |
SHARKSSL_AES_CIPHER_LOOP_UNROLL | 1 | 0 |
SHARKSSL_BIGINT_EXP_SLIDING_WINDOW_K | 5 | 1 |
SHARKSSL_BIGINT_WORDSIZE | 32 | 32 |
SHARKSSL_DES_CIPHER_LOOP_UNROLL | 1 | 0 |
SHARKSSL_ENABLE_AES_CCM | 1 /* IF NEEDED */ | 1 /* IF NEEDED */ |
SHARKSSL_ENABLE_AES_CTR_MODE | 0 | 0 |
SHARKSSL_ENABLE_AES_GCM | 1 | 1 |
SHARKSSL_ENABLE_RSA_BLINDING | 1 | 1 |
SHARKSSL_MD5_SMALL_FOOTPRINT | 0 | 1 |
SHARKSSL_OPTIMIZED_BIGINT_ASM | 1 | 1 |
SHARKSSL_SHA1_SMALL_FOOTPRINT | 0 | 1 |
SHARKSSL_SHA256_SMALL_FOOTPRINT | 0 | 1 |
SHARKSSL_UNALIGNED_ACCESS | 1 | 1 |
SHARKSSL_USE_3DES | 1 | 1 |
SHARKSSL_USE_AES_128 | 1 | 1 |
SHARKSSL_USE_AES_256 | 1 | 1 |
SHARKSSL_USE_ARC4 | 0 | 0 |
SHARKSSL_USE_DES | 0 | 0 |
SHARKSSL_USE_ECC | 1 | 1 |
SHARKSSL_USE_RNG_TINYMT | 1 | 1 |
SHARKSSL_USE_SHA_256 | 1 | 1 |
The RX routines provide processor-specific implementations of ChaCha20, Poly1305, big-integer arithmetic, X25519 and GHASH/GCM. Their intended benefit is lower cryptographic processing cost without changing application APIs. Performance depends on the selected routines, compiler settings, and RX processor. Measure the selected configuration on the intended RX processor before estimating application throughput.
Measured on the RX72N Envision Kit at 240 MHz using GNU RX 14.2, -O3, disabled flash cache and interrupts, and identical full-library configurations. Values below are median milliseconds per 4096-byte encryption call over seven rounds of 32 calls, after an excluded warm-up. LCD and backlight were off.
| Operation | Plain C | Previous RX ASM | Current RX ASM |
|---|---|---|---|
| ChaCha20 | 0.293800 | 0.322050 | 0.274579 |
| AES-128-GCM | 2.216671 | 2.200879 | 2.033171 |
| AES-256-GCM | 2.719962 | 2.704171 | 2.536462 |
The full suite covered 42 operation/size groups; all 882 selected hardware records passed with matching C/previous/current checksums. The current ASM firmware saves 200 text bytes against the previous ASM firmware. Its BigInt section uses four-byte alignment to preserve arithmetic-loop performance when the smaller ChaCha20 implementation shifts the linked code.