|
SharkSSL™ Embedded SSL/TLS Stack
|
This guide explains how to add the IAR RX assembly implementations to an existing SharkSSL build. Cipher acceleration and big-integer acceleration are configured separately. For the GNU RX toolchain, use the distinct RX_GCC port; the IAR syntax is not accepted by GNU as.
The IAR and GNU RX backends implement the same 19 assembly hooks. Assemble the .s files with preprocessing enabled and, for RX72N, select --core rxv3 --endian l. Pass the same SharkSSL feature definitions to the C compiler and assembler. These routines use the standard RX ABI: R1-R4 parameter registers, stack parameters and preserved R6-R13 registers.
Compile SharkSslCrypto_RX.s together with SharkSslCrypto.c:
Set the following in TargConfig.h:
Enable the algorithms required by your application:
See SharkSslCrypto.h for the APIs. The Poly1305 implementation is based on Daniel J. Bernstein's "The Poly1305-AES message-authentication code", but this API does not use AES. The ChaCha20 implementation is based on his "The ChaCha family of stream ciphers".
ChaCha20 keeps state words 0..11 in registers across all twenty rounds and spills only words 12..15. It uses 80 bytes of local stack plus 32 bytes for the preserved registers. Zero-length calls return without changing the counter; short tails read only the requested input bytes.
When ChaCha20 assembly is excluded, SHARKSSL_CHACHA_SMALL_FOOTPRINT=1 selects a smaller, slightly slower C implementation.
Compile SharkSslBigInt_RX.s together with SharkSslBigInt.c:
Set the following in TargConfig.h:
Compile SharkSslX25519_RX.s with SharkSslBigInt.c and enable:
This backend supplies all ten X25519 hooks: field add/subtract, combined add/subtract, multiplication, squaring, multiplication by 121666, single/paired conditional swaps, inversion and the full Montgomery ladder. Its eight little-endian 32-bit limbs and RX EMULU instruction sequences match the GNU RX backend. Field arithmetic and scalar swaps have fixed schedules; only public loop counts control branches. It is independent of generic BigInt assembly and requires little-endian IAR RX and 32-bit BigInt words. The shared C hook guard accepts __ICCRX__ in little-endian mode.
Compile SharkSslGcm_RX.s with SharkSslCrypto.c and enable the hooks independently:
The IAR version uses the same 16-entry M0 table, scaled word-table addressing, descending byte pointer and direct high-nibble mask as GNU RX. GHASH retains data-dependent table accesses; it is not a table-free implementation. The GCM hook processes complete blocks, calls the existing AES encryption routine, advances the 32-bit big-endian counter and authenticates ciphertext before an in-place decrypt overwrites it. Partial blocks remain in C. AES-128/192/256 context layouts are selected from the same feature definitions. GHASH-only builds and GCM with the C GHASH fallback are supported. Use little-endian mode and identical AES/NOPACK definitions for C and assembly. The block hook accepts both IAR's default narrow enums and --enum_is_int; it reads the operation enum without relying on its stack-slot padding. The reduction table holds sixteen aligned 32-bit constants with their final bit positions, avoiding a separate shift on each four-bit reduction. Table-word loads are interleaved with independent XOR operations, and the reduction constant is loaded before the independent accumulator shifts.
The historical speed and size examples are shown side by side below. Enable CCM only if your application needs it.
These values are reference examples, not a production TLS preset. In particular, SHARKSSL_USE_RNG_TINYMT=1 selects a generator unsuitable for cryptographic use. For a current build, follow build configuration and the configuration API.
| Setting | Speed example | Size example |
|---|---|---|
B_LITTLE_ENDIAN | 1 | 1 |
SHARKSSL_AES_CIPHER_LOOP_UNROLL | 1 | 0 |
SHARKSSL_BIGINT_EXP_SLIDING_WINDOW_K | 5 | 1 |
SHARKSSL_BIGINT_WORDSIZE | 32 | 32 |
SHARKSSL_DES_CIPHER_LOOP_UNROLL | 1 | 0 |
SHARKSSL_ENABLE_AES_CCM | 1 /* IF NEEDED */ | 1 /* IF NEEDED */ |
SHARKSSL_ENABLE_AES_CTR_MODE | 0 | 0 |
SHARKSSL_ENABLE_AES_GCM | 1 | 1 |
SHARKSSL_ENABLE_RSA_BLINDING | 1 | 1 |
SHARKSSL_MD5_SMALL_FOOTPRINT | 0 | 1 |
SHARKSSL_OPTIMIZED_BIGINT_ASM | 1 | 1 |
SHARKSSL_SHA1_SMALL_FOOTPRINT | 0 | 1 |
SHARKSSL_SHA256_SMALL_FOOTPRINT | 0 | 1 |
SHARKSSL_UNALIGNED_ACCESS | 1 | 1 |
SHARKSSL_USE_3DES | 1 | 1 |
SHARKSSL_USE_AES_128 | 1 | 1 |
SHARKSSL_USE_AES_256 | 1 | 1 |
SHARKSSL_USE_ARC4 | 0 | 0 |
SHARKSSL_USE_DES | 0 | 0 |
SHARKSSL_USE_ECC | 1 | 1 |
SHARKSSL_USE_RNG_TINYMT | 1 | 1 |
SHARKSSL_USE_SHA_256 | 1 | 1 |
The RX routines provide processor-specific implementations of ChaCha20, Poly1305, big-integer arithmetic, X25519 and GHASH/GCM. Their intended benefit is lower cryptographic processing cost without changing application APIs. Performance depends on the selected routines, compiler settings, and RX processor. Measure the selected configuration on the intended RX processor before estimating application throughput.
Measured on the RX72N Envision Kit at 240 MHz using GNU RX 14.2, -O3, disabled flash cache and interrupts, and identical full-library configurations. Values below are median milliseconds per 4096-byte encryption call over seven rounds of 32 calls, after an excluded warm-up. LCD and backlight were off. These are GNU build timings; native IAR C/C+ASM was checked separately for correctness using the IAR compiler, assembler, linker and C-SPY simulator.
| Operation | Plain C | Previous RX ASM | Current RX ASM |
|---|---|---|---|
| ChaCha20 | 0.293800 | 0.322050 | 0.274579 |
| AES-128-GCM | 2.216671 | 2.200879 | 2.033171 |
| AES-256-GCM | 2.719962 | 2.704171 | 2.536462 |
The full suite covered 42 operation/size groups; all 882 selected hardware records passed with matching C/previous/current checksums. The current GNU ASM firmware saves 200 text bytes against the previous GNU ASM firmware. Both backends use four-byte alignment for the BigInt code section to preserve arithmetic-loop performance when the smaller ChaCha20 implementation shifts the linked code.