# infineon/optiga-trust-m-openssl architecture

> Architecture diagram of the GitHub repository infineon/optiga-trust-m-openssl, generated by GitDiagram from its file tree, README and a sample of source files (last updated 2026-09-26). It is an AI-made overview: check details against the source.

- Interactive diagram: https://gitdiagram.com/infineon/optiga-trust-m-openssl
- Repository: https://github.com/infineon/optiga-trust-m-openssl

## Overview

This repository implements an OpenSSL 3 provider that lets OpenSSL applications use OPTIGA™ Trust M for cryptographic operations while retaining key material in the secure element. The principal workflow is an OpenSSL request through provider dispatch, key/reference-key handling, hardware-backed operation, and return of signatures, derived secrets, random bytes, or public-key encodings for uses such as certificates and TLS. The README also documents RSA/ECC, ECDH, digest, and certificate workflows. The source excerpts are partial; documented capabilities are represented without asserting unsampled internal call wiring.

Main entry points: [`src/trustm_provider.c`](https://github.com/infineon/optiga-trust-m-openssl/blob/main/src/trustm_provider.c) (Provider entry), [`include/trustm_provider_common.h`](https://github.com/infineon/optiga-trust-m-openssl/blob/main/include/trustm_provider_common.h) (Provider context), [`src/trustm_keymgmt_ec.c`](https://github.com/infineon/optiga-trust-m-openssl/blob/main/src/trustm_keymgmt_ec.c) (EC key management), [`src/trustm_keymgmt_rsa.c`](https://github.com/infineon/optiga-trust-m-openssl/blob/main/src/trustm_keymgmt_rsa.c) (RSA key management)

## Diagram (Mermaid)

```mermaid
flowchart TD

subgraph group_provider["Provider dispatch"]
  node_provider_entry["Provider entry<br/>[trustm_provider.c]"]
end

subgraph group_crypto["Crypto operations"]
  node_digest["SHA-256 digest<br/>[trustm_digest.c]"]
  node_random["Random generation<br/>[trustm_rand.c]"]
  node_signature["RSA/ECC signatures"]
  node_key_exchange["ECDH exchange"]
  node_asym_rsa["RSA operations"]
end

subgraph group_keys["Keys and objects"]
  node_ec_keymgmt["EC key management"]
  node_rsa_keymgmt["RSA key management"]
  node_store["Key/object store"]
  node_encoder["Key encoding<br/>[trustm_encoder.c]"]
end

subgraph group_support["Shared support"]
  node_key_helpers["Key conversions"]
  node_common["Provider context"]
  node_helper["Device and PEM helpers<br/>[trustm_helper.c]"]
end

node_openssl(("OpenSSL applications"))
node_openssl_core["OpenSSL core"]
node_trustm[("OPTIGA Trust M")]

node_openssl -->|"requests crypto"| node_openssl_core
node_openssl_core -->|"loads provider"| node_provider_entry
node_provider_entry -->|"dispatches digest"| node_digest
node_provider_entry -->|"dispatches random"| node_random
node_provider_entry -->|"dispatches signatures"| node_signature
node_provider_entry -->|"dispatches ECDH"| node_key_exchange
node_provider_entry -->|"dispatches keys"| node_ec_keymgmt
node_provider_entry -->|"dispatches keys"| node_rsa_keymgmt
node_provider_entry -->|"dispatches store"| node_store
node_provider_entry -->|"dispatches encoding"| node_encoder
node_openssl_core -->|"dispatches RSA"| node_asym_rsa
node_digest -->|"hashes data"| node_trustm
node_random -->|"requests randomness"| node_trustm
node_signature -->|"signs or verifies"| node_trustm
node_key_exchange -->|"derives secret"| node_trustm
node_asym_rsa -->|"performs RSA"| node_trustm
node_ec_keymgmt -->|"generates keys"| node_trustm
node_rsa_keymgmt -->|"generates keys"| node_trustm
node_store -->|"reads or writes objects"| node_trustm
node_ec_keymgmt -->|"converts EC keys"| node_key_helpers
node_rsa_keymgmt -->|"writes RSA keys"| node_key_helpers
node_encoder -->|"formats keys"| node_key_helpers
node_signature -->|"uses shared context"| node_common
node_key_exchange -->|"uses shared context"| node_common
node_ec_keymgmt -->|"uses shared context"| node_common
node_rsa_keymgmt -->|"uses shared context"| node_common
node_store -->|"uses device helpers"| node_helper
node_common -->|"uses shared helpers"| node_helper

click node_provider_entry "https://github.com/infineon/optiga-trust-m-openssl/blob/main/src/trustm_provider.c"
click node_digest "https://github.com/infineon/optiga-trust-m-openssl/blob/main/src/trustm_digest.c"
click node_random "https://github.com/infineon/optiga-trust-m-openssl/blob/main/src/trustm_rand.c"
click node_signature "https://github.com/infineon/optiga-trust-m-openssl/blob/main/src/trustm_provider_signature.c"
click node_key_exchange "https://github.com/infineon/optiga-trust-m-openssl/blob/main/src/trustm_provider_keyexch.c"
click node_asym_rsa "https://github.com/infineon/optiga-trust-m-openssl/blob/main/src/trustm_provider_asym_rsa.c"
click node_ec_keymgmt "https://github.com/infineon/optiga-trust-m-openssl/blob/main/src/trustm_keymgmt_ec.c"
click node_rsa_keymgmt "https://github.com/infineon/optiga-trust-m-openssl/blob/main/src/trustm_keymgmt_rsa.c"
click node_store "https://github.com/infineon/optiga-trust-m-openssl/blob/main/src/trustm_provider_store_object.c"
click node_encoder "https://github.com/infineon/optiga-trust-m-openssl/blob/main/src/trustm_encoder.c"
click node_key_helpers "https://github.com/infineon/optiga-trust-m-openssl/blob/main/src/trustm_key_helper.c"
click node_common "https://github.com/infineon/optiga-trust-m-openssl/blob/main/include/trustm_provider_common.h"
click node_helper "https://github.com/infineon/optiga-trust-m-openssl/blob/main/src/helper/trustm_helper.c"

classDef toneNeutral fill:#f8fafc,stroke:#334155,stroke-width:1.5px,color:#0f172a
classDef toneBlue fill:#dbeafe,stroke:#2563eb,stroke-width:1.5px,color:#172554
classDef toneAmber fill:#fef3c7,stroke:#d97706,stroke-width:1.5px,color:#78350f
classDef toneMint fill:#dcfce7,stroke:#16a34a,stroke-width:1.5px,color:#14532d
classDef toneRose fill:#ffe4e6,stroke:#e11d48,stroke-width:1.5px,color:#881337
classDef toneIndigo fill:#e0e7ff,stroke:#4f46e5,stroke-width:1.5px,color:#312e81
classDef toneTeal fill:#ccfbf1,stroke:#0f766e,stroke-width:1.5px,color:#134e4a
class node_provider_entry toneBlue
class node_digest,node_random,node_signature,node_key_exchange,node_asym_rsa,node_trustm toneAmber
class node_ec_keymgmt,node_rsa_keymgmt,node_store,node_encoder toneMint
class node_key_helpers,node_common,node_helper toneRose
class node_openssl,node_openssl_core toneIndigo
```

## Components

### Provider dispatch

- [Provider entry](https://github.com/infineon/optiga-trust-m-openssl/blob/main/src/trustm_provider.c): `src/trustm_provider.c`

### Crypto operations

- [SHA-256 digest](https://github.com/infineon/optiga-trust-m-openssl/blob/main/src/trustm_digest.c): `src/trustm_digest.c`
- [Random generation](https://github.com/infineon/optiga-trust-m-openssl/blob/main/src/trustm_rand.c): `src/trustm_rand.c`
- [RSA/ECC signatures](https://github.com/infineon/optiga-trust-m-openssl/blob/main/src/trustm_provider_signature.c): `src/trustm_provider_signature.c`
- [ECDH exchange](https://github.com/infineon/optiga-trust-m-openssl/blob/main/src/trustm_provider_keyexch.c): `src/trustm_provider_keyexch.c`
- [RSA operations](https://github.com/infineon/optiga-trust-m-openssl/blob/main/src/trustm_provider_asym_rsa.c): `src/trustm_provider_asym_rsa.c`

### Keys and objects

- [EC key management](https://github.com/infineon/optiga-trust-m-openssl/blob/main/src/trustm_keymgmt_ec.c): `src/trustm_keymgmt_ec.c`
- [RSA key management](https://github.com/infineon/optiga-trust-m-openssl/blob/main/src/trustm_keymgmt_rsa.c): `src/trustm_keymgmt_rsa.c`
- [Key/object store](https://github.com/infineon/optiga-trust-m-openssl/blob/main/src/trustm_provider_store_object.c): `src/trustm_provider_store_object.c`
- [Key encoding](https://github.com/infineon/optiga-trust-m-openssl/blob/main/src/trustm_encoder.c): `src/trustm_encoder.c`

### Shared support

- [Key conversions](https://github.com/infineon/optiga-trust-m-openssl/blob/main/src/trustm_key_helper.c): `src/trustm_key_helper.c`
- [Provider context](https://github.com/infineon/optiga-trust-m-openssl/blob/main/include/trustm_provider_common.h): `include/trustm_provider_common.h`
- [Device and PEM helpers](https://github.com/infineon/optiga-trust-m-openssl/blob/main/src/helper/trustm_helper.c): `src/helper/trustm_helper.c`

### Other components

- **OpenSSL applications**
- **OpenSSL core**
- **OPTIGA Trust M**

## Connections

- OpenSSL applications → OpenSSL core: requests crypto
- OpenSSL core → Provider entry: loads provider
- Provider entry → SHA-256 digest: dispatches digest
- Provider entry → Random generation: dispatches random
- Provider entry → RSA/ECC signatures: dispatches signatures
- Provider entry → ECDH exchange: dispatches ECDH
- Provider entry → EC key management: dispatches keys
- Provider entry → RSA key management: dispatches keys
- Provider entry → Key/object store: dispatches store
- Provider entry → Key encoding: dispatches encoding
- OpenSSL core → RSA operations: dispatches RSA
- SHA-256 digest → OPTIGA Trust M: hashes data
- Random generation → OPTIGA Trust M: requests randomness
- RSA/ECC signatures → OPTIGA Trust M: signs or verifies
- ECDH exchange → OPTIGA Trust M: derives secret
- RSA operations → OPTIGA Trust M: performs RSA
- EC key management → OPTIGA Trust M: generates keys
- RSA key management → OPTIGA Trust M: generates keys
- Key/object store → OPTIGA Trust M: reads or writes objects
- EC key management → Key conversions: converts EC keys
- RSA key management → Key conversions: writes RSA keys
- Key encoding → Key conversions: formats keys
- RSA/ECC signatures → Provider context: uses shared context
- ECDH exchange → Provider context: uses shared context
- EC key management → Provider context: uses shared context
- RSA key management → Provider context: uses shared context
- Key/object store → Device and PEM helpers: uses device helpers
- Provider context → Device and PEM helpers: uses shared helpers