How infineon/optiga-trust-m-openssl works
This repository implements an OpenSSL 3 provider that lets OpenSSL applications use OPTIGA™ Trust M for cryptographic operations while retaining key material in the secure element. The principal workflow is an OpenSSL request through provider dispatch, key/reference-key handling, hardware-backed operation, and return of signatures, derived secrets, random bytes, or public-key encodings for uses such as certificates and TLS. The README also documents RSA/ECC, ECDH, digest, and certificate workflows. The source excerpts are partial; documented capabilities are represented without asserting unsampled internal call wiring.
Main entry points: trustm_provider.c Provider entry · trustm_provider_common.h Provider context · trustm_keymgmt_ec.c EC key management · trustm_keymgmt_rsa.c RSA key management
Components 16
Provider dispatch
- Provider entry
src/trustm_provider.c
Crypto operations
- SHA-256 digest
src/trustm_digest.c - Random generation
src/trustm_rand.c - RSA/ECC signatures
src/trustm_provider_signature.c - ECDH exchange
src/trustm_provider_keyexch.c - RSA operations
src/trustm_provider_asym_rsa.c
Keys and objects
- EC key management
src/trustm_keymgmt_ec.c - RSA key management
src/trustm_keymgmt_rsa.c - Key/object store
src/trustm_provider_store_object.c - Key encoding
src/trustm_encoder.c
Shared support
- Key conversions
src/trustm_key_helper.c - Provider context
include/trustm_provider_common.h - Device and PEM helpers
src/helper/trustm_helper.c
Other components
- OpenSSL applications
- OpenSSL core
- OPTIGA Trust M
Connections 28
- OpenSSL applications → OpenSSL core: requests crypto
- OpenSSL core → Provider entry: loads provider
- Provider entry → SHA-256 digest: dispatches digest
- Provider entry → Random generation: dispatches random
- Provider entry → RSA/ECC signatures: dispatches signatures
- Provider entry → ECDH exchange: dispatches ECDH
- Provider entry → EC key management: dispatches keys
- Provider entry → RSA key management: dispatches keys
- Provider entry → Key/object store: dispatches store
- Provider entry → Key encoding: dispatches encoding
- OpenSSL core → RSA operations: dispatches RSA
- SHA-256 digest → OPTIGA Trust M: hashes data
- Random generation → OPTIGA Trust M: requests randomness
- RSA/ECC signatures → OPTIGA Trust M: signs or verifies
- ECDH exchange → OPTIGA Trust M: derives secret
- RSA operations → OPTIGA Trust M: performs RSA
- EC key management → OPTIGA Trust M: generates keys
- RSA key management → OPTIGA Trust M: generates keys
- Key/object store → OPTIGA Trust M: reads or writes objects
- EC key management → Key conversions: converts EC keys
- RSA key management → Key conversions: writes RSA keys
- Key encoding → Key conversions: formats keys
- RSA/ECC signatures → Provider context: uses shared context
- ECDH exchange → Provider context: uses shared context
- EC key management → Provider context: uses shared context
- RSA key management → Provider context: uses shared context
- Key/object store → Device and PEM helpers: uses device helpers
- Provider context → Device and PEM helpers: uses shared helpers