wolfSSL · dgarske · Sep 9, 2026 · Sep 9, 2026 · Sep 10, 2026
diff --git a/.github/scripts/check-headers.sh b/.github/scripts/check-headers.sh
@@ -66,8 +66,7 @@ else
         | grep -vE '^wolfssl/wolfcrypt/port/caam/(caam_driver|caam_qnx|wolfcaam_hash)\.h$' \
         | grep -vE '^wolfssl/wolfcrypt/port/kcapi/' \
         | grep -vE '^wolfssl/wolfcrypt/port/nxp/(dcp_port|se050_port)\.h$' \
-        | grep -vE '^wolfssl/wolfcrypt/port/Renesas/(renesas_fspsm_internal|renesas-rx64-hw-crypt|renesas-tsip-crypt|renesas_tsip_internal)\.h$' \
-        | grep -vE '^wolfssl/wolfcrypt/port/silabs/silabs_aes\.h$'
+        | grep -vE '^wolfssl/wolfcrypt/port/Renesas/(renesas_fspsm_internal|renesas-rx64-hw-crypt|renesas-tsip-crypt|renesas_tsip_internal)\.h$'
     )
 fi
 

diff --git a/.wolfssl_known_macro_extras b/.wolfssl_known_macro_extras
@@ -1111,6 +1111,7 @@ WOLFSSL_SHA3_NO_AVX2
 WOLFSSL_SHA3_PPC64_BLOCKS_N
 WOLFSSL_SHA512_HASHTYPE
 WOLFSSL_SHUTDOWNONCE
+WOLFSSL_SILABS_NO_VAULT_KEYS
 WOLFSSL_SILABS_TRNG
 WOLFSSL_SLHDSA_FULL_HASH
 WOLFSSL_SLHDSA_NO_VERIFY_ONLY

diff --git a/configure.ac b/configure.ac
@@ -3830,6 +3830,31 @@ then
 fi
 
 
+# Silicon Labs EFR32 Secure Element crypto-callback port.
+# On-target the application supplies the Simplicity SDK include path. This
+# option is a host compile-test of the port: it swaps the SE Manager headers
+# for a shim (WOLFSSL_SILABS_HOST_TEST) so the cryptocb dispatch and wiring
+# build without the vendor SDK. It forces crypto callbacks on (see the
+# cryptocb block).
+# Example: "./configure --enable-silabs-cryptocb"
+ENABLED_SILABS_CRYPTOCB="no"
+AC_ARG_ENABLE([silabs-cryptocb],
+    [AS_HELP_STRING([--enable-silabs-cryptocb],
+        [Enable Silicon Labs EFR32 Secure Element crypto-callback port (host compile-test).])],
+    [ ENABLED_SILABS_CRYPTOCB=$enableval ],
+    [ ENABLED_SILABS_CRYPTOCB=no ])
+
+if test "x$ENABLED_SILABS_CRYPTOCB" != "xno"
+then
+    # The shim models an EFR32xG25 (Series 2 Config 5) with Secure Vault High.
+    # The port's AES-ECB dispatch is gated on HAVE_AES_ECB and compiles out
+    # without it, so this option does not turn AES-ECB on. To compile-test that
+    # path too, add --enable-aesecb, which enables the (public,
+    # unauthenticated) AES-ECB API through the normal option.
+    AM_CFLAGS="$AM_CFLAGS -DWOLFSSL_SILABS_CRYPTOCB -DWOLFSSL_SILABS_HOST_TEST"
+fi
+
+
 # NXP SE050
 # Example: "./configure --with-se050=/home/pi/simw_top"
 ENABLED_SE050="no"
@@ -11731,7 +11756,7 @@ then
     fi
 fi
 
-if test "x$ENABLED_PKCS11" = "xyes" || test "x$ENABLED_WOLFTPM" = "xyes" || test "$ENABLED_CAAM" != "no" || test "x$ENABLED_RTL8735B" != "xno" || test "x$ENABLED_VAULTIC" = "xyes"
+if test "x$ENABLED_PKCS11" = "xyes" || test "x$ENABLED_WOLFTPM" = "xyes" || test "$ENABLED_CAAM" != "no" || test "x$ENABLED_RTL8735B" != "xno" || test "x$ENABLED_SILABS_CRYPTOCB" != "xno" || test "x$ENABLED_VAULTIC" = "xyes"
 then
     ENABLED_CRYPTOCB=yes
 fi
@@ -13646,6 +13671,7 @@ AM_CONDITIONAL([BUILD_VAULTIC],[test "x$ENABLED_VAULTIC" = "xyes"])
 AM_CONDITIONAL([BUILD_SE050],[test "x$ENABLED_SE050" = "xyes"])
 AM_CONDITIONAL([BUILD_STSAFE],[test "x$ENABLED_STSAFE" != "xno"])
 AM_CONDITIONAL([BUILD_RTL8735B],[test "x$ENABLED_RTL8735B" != "xno"])
+AM_CONDITIONAL([BUILD_SILABS_CRYPTOCB],[test "x$ENABLED_SILABS_CRYPTOCB" != "xno"])
 AM_CONDITIONAL([BUILD_TROPIC01],[test "x$ENABLED_TROPIC01" = "xyes"])
 AM_CONDITIONAL([BUILD_KDF],[test "x$ENABLED_KDF" = "xyes"])
 AM_CONDITIONAL([BUILD_HMAC],[test "x$ENABLED_HMAC" = "xyes"])

diff --git a/src/keys.c b/src/keys.c
@@ -2477,31 +2477,35 @@ int SetKeys(Ciphers* enc, Ciphers* dec, Keys* keys, CipherSpecs* specs,
     #endif
         if (side == WOLFSSL_CLIENT_END) {
             if (enc) {
-                chachaRet = wc_Chacha_SetKey(enc->chacha, keys->client_write_key,
-                                          specs->key_size);
+                chachaRet = wc_Chacha_SetKey_ex(enc->chacha,
+                                          keys->client_write_key,
+                                          specs->key_size, heap, devId);
                 XMEMCPY(keys->aead_enc_imp_IV, keys->client_write_IV,
                         CHACHA20_IMP_IV_SZ);
                 if (chachaRet != 0) return chachaRet;
             }
             if (dec) {
-                chachaRet = wc_Chacha_SetKey(dec->chacha, keys->server_write_key,
-                                          specs->key_size);
+                chachaRet = wc_Chacha_SetKey_ex(dec->chacha,
+                                          keys->server_write_key,
+                                          specs->key_size, heap, devId);
                 XMEMCPY(keys->aead_dec_imp_IV, keys->server_write_IV,
                         CHACHA20_IMP_IV_SZ);
                 if (chachaRet != 0) return chachaRet;
             }
         }
         else {
             if (enc) {
-                chachaRet = wc_Chacha_SetKey(enc->chacha, keys->server_write_key,
-                                          specs->key_size);
+                chachaRet = wc_Chacha_SetKey_ex(enc->chacha,
+                                          keys->server_write_key,
+                                          specs->key_size, heap, devId);
                 XMEMCPY(keys->aead_enc_imp_IV, keys->server_write_IV,
                         CHACHA20_IMP_IV_SZ);
                 if (chachaRet != 0) return chachaRet;
             }
             if (dec) {
-                chachaRet = wc_Chacha_SetKey(dec->chacha, keys->client_write_key,
-                                          specs->key_size);
+                chachaRet = wc_Chacha_SetKey_ex(dec->chacha,
+                                          keys->client_write_key,
+                                          specs->key_size, heap, devId);
                 XMEMCPY(keys->aead_dec_imp_IV, keys->client_write_IV,
                         CHACHA20_IMP_IV_SZ);
                 if (chachaRet != 0) return chachaRet;

diff --git a/wolfcrypt/src/aes.c b/wolfcrypt/src/aes.c
@@ -6136,6 +6136,13 @@ static void AesSetKey_C(Aes* aes, const byte* key, word32 keySz, int dir)
             return BAD_FUNC_ARG;
         }
 
+    #ifdef WOLFSSL_SILABS_SE_TYPES
+        /* A plaintext key supersedes any resident key bound by
+         * wc_SilabsSe_AesUse*Key(); without clearing the binding the SE would
+         * keep using the key it still holds. */
+        aes->ctx.keySet = 0;
+    #endif
+
     /* sometimes hardware may not support all keylengths (e.g. ESP32-S3) */
     #if defined(WOLFSSL_ESPIDF) && defined(NEED_AES_HW_FALLBACK)
         ESP_LOGV(TAG, "wc_AesSetKey fallback check %d", keylen);

diff --git a/wolfcrypt/src/chacha.c b/wolfcrypt/src/chacha.c
@@ -199,7 +199,8 @@ static const word32 tau[4] = {0x61707865, 0x3120646e, 0x79622d36, 0x6b206574};
 /**
   * Key setup. 8 word iv (nonce)
   */
-int wc_Chacha_SetKey(ChaCha* ctx, const byte* key, word32 keySz)
+int wc_Chacha_SetKey_ex(ChaCha* ctx, const byte* key, word32 keySz,
+    void* heap, int devId)
 {
 #if (!defined(USE_ARM_CHACHA_SPEEDUP) || defined(WOLFSSL_ARM_CHACHA_NEED_C)) && \
     !defined(USE_RISCV_CHACHA_SPEEDUP)
@@ -276,9 +277,23 @@ int wc_Chacha_SetKey(ChaCha* ctx, const byte* key, word32 keySz)
     ctx->left = 0; /* resets state */
     ctx->keySet = 1;
 
+#ifdef WOLF_CRYPTO_CB
+    /* A device takes the plaintext key, not the expanded state above. */
+    XMEMCPY(ctx->devKey, key, keySz);
+    ctx->devKeySz = keySz;
+    ctx->devId = devId;
+#endif
+    (void)heap;   /* nothing on this path allocates */
+    (void)devId;
+
     return 0;
 }
 
+int wc_Chacha_SetKey(ChaCha* ctx, const byte* key, word32 keySz)
+{
+    return wc_Chacha_SetKey_ex(ctx, key, keySz, NULL, INVALID_DEVID);
+}
+
 #if (!defined(USE_INTEL_CHACHA_SPEEDUP) && !defined(USE_ARM_CHACHA_SPEEDUP) && \
     !defined(USE_RISCV_CHACHA_SPEEDUP)) || defined(WOLFSSL_ARM_CHACHA_NEED_C)
 /**

diff --git a/wolfcrypt/src/chacha20_poly1305.c b/wolfcrypt/src/chacha20_poly1305.c
@@ -34,6 +34,10 @@ or Authenticated Encryption with Additional Data (AEAD) algorithm.
 #include <wolfssl/wolfcrypt/chacha20_poly1305.h>
 #include <wolfssl/wolfcrypt/cpuid.h>
 
+#ifdef WOLF_CRYPTO_CB
+    #include <wolfssl/wolfcrypt/cryptocb.h>
+#endif
+
 #ifdef NO_INLINE
 #include <wolfssl/wolfcrypt/misc.h>
 #else
@@ -442,6 +446,17 @@ WOLFSSL_API int wc_ChaCha20Poly1305_Encrypt_ex(ChaCha* chacha, Poly1305* poly,
         return BAD_FUNC_ARG;
     }
 
+#ifdef WOLF_CRYPTO_CB
+    /* devId comes from wc_Chacha_SetKey_ex(). This is the path the TLS
+     * record layer uses. Software runs if the device declines. */
+    if (chacha->devId != INVALID_DEVID) {
+        ret = wc_CryptoCb_Chacha20Poly1305Encrypt(chacha->devId, chacha->devKey,
+            nonce, aad, aadSz, in, sz, out, tag);
+        if (ret != WC_NO_ERR_TRACE(CRYPTOCB_UNAVAILABLE))
+            return ret;
+    }
+#endif
+
 #ifdef WOLFSSL_CHACHA20_POLY1305_SHORT
     if (sz <= CHACHA20_POLY1305_SHORT_MAX)
         return chacha20_poly1305_encrypt_short(chacha, poly, out, in, sz,
@@ -532,6 +547,16 @@ WOLFSSL_API int wc_ChaCha20Poly1305_Decrypt_ex(ChaCha* chacha, Poly1305* poly,
         return BAD_FUNC_ARG;
     }
 
+#ifdef WOLF_CRYPTO_CB
+    /* See the encrypt counterpart. */
+    if (chacha->devId != INVALID_DEVID) {
+        ret = wc_CryptoCb_Chacha20Poly1305Decrypt(chacha->devId, chacha->devKey,
+            nonce, aad, aadSz, in, sz, tag, out);
+        if (ret != WC_NO_ERR_TRACE(CRYPTOCB_UNAVAILABLE))
+            return ret;
+    }
+#endif
+
 #ifdef WOLFSSL_CHACHA20_POLY1305_SHORT
     if (sz <= CHACHA20_POLY1305_SHORT_MAX)
         return chacha20_poly1305_decrypt_short(chacha, poly, out, in, sz,
@@ -801,10 +826,10 @@ int wc_ChaCha20Poly1305_CheckTag(
     return ret;
 }
 
-int wc_ChaCha20Poly1305_Init(ChaChaPoly_Aead* aead,
+int wc_ChaCha20Poly1305_Init_ex(ChaChaPoly_Aead* aead,
     const byte inKey[CHACHA20_POLY1305_AEAD_KEYSIZE],
     const byte inIV[CHACHA20_POLY1305_AEAD_IV_SIZE],
-    int isEncrypt)
+    int isEncrypt, void* heap, int devId)
 {
     int ret;
     byte authKey[CHACHA20_POLY1305_AEAD_KEYSIZE];
@@ -833,8 +858,10 @@ int wc_ChaCha20Poly1305_Init(ChaChaPoly_Aead* aead,
     aead->isEncrypt = isEncrypt ? 1 : 0;
 
     /* Initialize the ChaCha20 context (key and iv) */
-    ret = wc_Chacha_SetKey(&aead->chacha, inKey,
-        CHACHA20_POLY1305_AEAD_KEYSIZE);
+    ret = wc_Chacha_SetKey_ex(&aead->chacha, inKey,
+        CHACHA20_POLY1305_AEAD_KEYSIZE, heap, devId);
+    (void)heap;
+    (void)devId;
     if (ret == 0) {
         ret = wc_Chacha_SetIV(&aead->chacha, inIV,
             CHACHA20_POLY1305_AEAD_INITIAL_COUNTER);
@@ -870,6 +897,15 @@ int wc_ChaCha20Poly1305_Init(ChaChaPoly_Aead* aead,
     return ret;
 }
 
+int wc_ChaCha20Poly1305_Init(ChaChaPoly_Aead* aead,
+    const byte inKey[CHACHA20_POLY1305_AEAD_KEYSIZE],
+    const byte inIV[CHACHA20_POLY1305_AEAD_IV_SIZE],
+    int isEncrypt)
+{
+    return wc_ChaCha20Poly1305_Init_ex(aead, inKey, inIV, isEncrypt, NULL,
+        INVALID_DEVID);
+}
+
 /* optional additional authentication data */
 int wc_ChaCha20Poly1305_UpdateAad(ChaChaPoly_Aead* aead,
     const byte* inAAD, word32 inAADLen)

diff --git a/wolfcrypt/src/cryptocb.c b/wolfcrypt/src/cryptocb.c
@@ -301,6 +301,8 @@ static const char* GetKdfTypeStr(int type)
             return "HKDF Extract";
         case WC_KDF_TYPE_HKDF_EXPAND:
             return "HKDF Expand";
+        case WC_KDF_TYPE_PBKDF2:
+            return "PBKDF2";
         case WC_KDF_TYPE_TWOSTEP_CMAC:
             return "TWOSTEP_CMAC";
     }
@@ -2232,8 +2234,73 @@ int wc_CryptoCb_PqcSignatureCheckPrivKey(void* key, int type,
 }
 #endif /* HAVE_FALCON || WOLFSSL_HAVE_MLDSA || WOLFSSL_HAVE_SLHDSA */
 
+#if defined(HAVE_CHACHA) && defined(HAVE_POLY1305)
+int wc_CryptoCb_Chacha20Poly1305Encrypt(int devId, const byte* inKey,
+    const byte* inIV, const byte* inAAD, word32 inAADSz, const byte* in,
+    word32 inSz, byte* out, byte* outAuthTag)
+{
+    int ret = WC_NO_ERR_TRACE(CRYPTOCB_UNAVAILABLE);
+    CryptoCb* dev;
+
+    dev = wc_CryptoCb_FindDevice(devId, WC_ALGO_TYPE_CIPHER);
+
+    if (dev && dev->cb) {
+        wc_CryptoInfo cryptoInfo;
+        XMEMSET(&cryptoInfo, 0, sizeof(cryptoInfo));
+
+        cryptoInfo.algo_type   = WC_ALGO_TYPE_CIPHER;
+        cryptoInfo.cipher.type = WC_CIPHER_CHACHA;
+        cryptoInfo.cipher.enc  = 1;
+        cryptoInfo.cipher.chacha20_poly1305_enc.inKey      = inKey;
+        cryptoInfo.cipher.chacha20_poly1305_enc.inIV       = inIV;
+        cryptoInfo.cipher.chacha20_poly1305_enc.inAAD      = inAAD;
+        cryptoInfo.cipher.chacha20_poly1305_enc.inAADSz    = inAADSz;
+        cryptoInfo.cipher.chacha20_poly1305_enc.in         = in;
+        cryptoInfo.cipher.chacha20_poly1305_enc.inSz       = inSz;
+        cryptoInfo.cipher.chacha20_poly1305_enc.out        = out;
+        cryptoInfo.cipher.chacha20_poly1305_enc.outAuthTag = outAuthTag;
+
+        ret = dev->cb(dev->devId, &cryptoInfo, dev->ctx);
+    }
+
+    return wc_CryptoCb_TranslateErrorCode(ret);
+}
+
+int wc_CryptoCb_Chacha20Poly1305Decrypt(int devId, const byte* inKey,
+    const byte* inIV, const byte* inAAD, word32 inAADSz, const byte* in,
+    word32 inSz, const byte* inAuthTag, byte* out)
+{
+    int ret = WC_NO_ERR_TRACE(CRYPTOCB_UNAVAILABLE);
+    CryptoCb* dev;
+
+    dev = wc_CryptoCb_FindDevice(devId, WC_ALGO_TYPE_CIPHER);
+
+    if (dev && dev->cb) {
+        wc_CryptoInfo cryptoInfo;
+        XMEMSET(&cryptoInfo, 0, sizeof(cryptoInfo));
+
+        cryptoInfo.algo_type   = WC_ALGO_TYPE_CIPHER;
+        cryptoInfo.cipher.type = WC_CIPHER_CHACHA;
+        cryptoInfo.cipher.enc  = 0;
+        cryptoInfo.cipher.chacha20_poly1305_dec.inKey     = inKey;
+        cryptoInfo.cipher.chacha20_poly1305_dec.inIV      = inIV;
+        cryptoInfo.cipher.chacha20_poly1305_dec.inAAD     = inAAD;
+        cryptoInfo.cipher.chacha20_poly1305_dec.inAADSz   = inAADSz;
+        cryptoInfo.cipher.chacha20_poly1305_dec.in        = in;
+        cryptoInfo.cipher.chacha20_poly1305_dec.inSz      = inSz;
+        cryptoInfo.cipher.chacha20_poly1305_dec.inAuthTag = inAuthTag;
+        cryptoInfo.cipher.chacha20_poly1305_dec.out       = out;
+
+        ret = dev->cb(dev->devId, &cryptoInfo, dev->ctx);
+    }
+
+    return wc_CryptoCb_TranslateErrorCode(ret);
+}
+#endif /* HAVE_CHACHA && HAVE_POLY1305 */
+
 #ifndef NO_AES
 #ifdef HAVE_AESGCM
+
 int wc_CryptoCb_AesGcmEncrypt(Aes* aes, byte* out,
                                const byte* in, word32 sz,
                                const byte* iv, word32 ivSz,
@@ -3589,6 +3656,39 @@ int wc_CryptoCb_DefaultDevID(void)
     return ret;
 }
 
+#if (defined(HAVE_PBKDF2) && !defined(NO_HMAC) && !defined(NO_PWDBASED))
+int wc_CryptoCb_Pbkdf2(byte* output, const byte* passwd, int pLen,
+    const byte* salt, int sLen, int iterations, int kLen, int hashType,
+    int devId)
+{
+    int       ret = WC_NO_ERR_TRACE(CRYPTOCB_UNAVAILABLE);
+    CryptoCb* dev;
+
+    /* Find registered callback device */
+    dev = wc_CryptoCb_FindDevice(devId, WC_ALGO_TYPE_KDF);
+
+    if (dev && dev->cb) {
+        wc_CryptoInfo cryptoInfo;
+        XMEMSET(&cryptoInfo, 0, sizeof(cryptoInfo));
+
+        cryptoInfo.algo_type             = WC_ALGO_TYPE_KDF;
+        cryptoInfo.kdf.type              = WC_KDF_TYPE_PBKDF2;
+        cryptoInfo.kdf.pbkdf2.output     = output;
+        cryptoInfo.kdf.pbkdf2.passwd     = passwd;
+        cryptoInfo.kdf.pbkdf2.pLen       = pLen;
+        cryptoInfo.kdf.pbkdf2.salt       = salt;
+        cryptoInfo.kdf.pbkdf2.sLen       = sLen;
+        cryptoInfo.kdf.pbkdf2.iterations = iterations;
+        cryptoInfo.kdf.pbkdf2.kLen       = kLen;
+        cryptoInfo.kdf.pbkdf2.hashType   = hashType;
+
+        ret = dev->cb(dev->devId, &cryptoInfo, dev->ctx);
+    }
+
+    return wc_CryptoCb_TranslateErrorCode(ret);
+}
+#endif /* HAVE_PBKDF2 && !NO_HMAC && !NO_PWDBASED */
+
 #if defined(HAVE_HKDF) && !defined(NO_HMAC)
 int wc_CryptoCb_Hkdf(int hashType, const byte* inKey, word32 inKeySz,
                      const byte* salt, word32 saltSz, const byte* info,

diff --git a/wolfcrypt/src/ecc.c b/wolfcrypt/src/ecc.c
@@ -2007,6 +2007,14 @@ int wc_ecc_set_curve(ecc_key* key, int keysize, int curve_id)
         return ECC_BAD_ARG_E;
     }
 
+#ifdef WOLFSSL_SILABS_SE_TYPES
+    /* Every import and keygen path resolves the curve here, so this is where
+     * a key stops representing whatever wc_SilabsSe_EccUse*Key() bound to it.
+     * Leaving the binding set would keep the SE on the old resident key. */
+    ForceZero(key->key_raw, sizeof(key->key_raw));
+    key->silabsKeySet = 0;
+#endif
+
     /* handle custom case */
     if (key->idx != ECC_CUSTOM_IDX) {
         int x;
@@ -8621,6 +8629,13 @@ int wc_ecc_free(ecc_key* key)
     wc_MAXQ10XX_EccFree(key);
 #endif
 
+#ifdef WOLFSSL_SILABS_SE_TYPES
+    /* key_raw holds the private scalar alongside the public point whenever the
+     * SE has been handed a plaintext key. Scrub it. */
+    ForceZero(key->key_raw, sizeof(key->key_raw));
+    key->silabsKeySet = 0;
+#endif
+
 #ifdef WOLFSSL_DHUK
     /* Scrub the DHUK derivation seed and wrapped scalar (both secret). */
     ForceZero(key->dhuk_seed, sizeof(key->dhuk_seed));