# infineon/optiga-trust-m architecture

> Architecture diagram of the GitHub repository infineon/optiga-trust-m, generated by GitDiagram from its file tree, README and a sample of source files (last updated 2026-09-26). It is an AI-made overview: check details against the source.

- Interactive diagram: https://gitdiagram.com/infineon/optiga-trust-m
- Repository: https://github.com/infineon/optiga-trust-m

## Overview

The OPTIGA Trust M Host Library is a C API for using the Trust M security chip from host applications. Its main workflow is an application calling the cryptography or utility API, which submits commands through communications and the IFX I2C stack to the device; asynchronous completion is reported through callbacks. Utility operations cover application/session management and object access, while cryptography exposes operations such as hashing, signing, verification, encryption, and key derivation. The tree also shows platform-specific PAL implementations and optional host-side cryptographic backends. Layer links reflect documented interfaces and sampled excerpts; platform variants are alternatives.

Main entry points: [`src/cmd/optiga_cmd.c`](https://github.com/infineon/optiga-trust-m/blob/main/src/cmd/optiga_cmd.c) (OPTIGA commands), [`src/crypt/optiga_crypt.c`](https://github.com/infineon/optiga-trust-m/blob/main/src/crypt/optiga_crypt.c) (Cryptography API), [`src/util/optiga_util.c`](https://github.com/infineon/optiga-trust-m/blob/main/src/util/optiga_util.c) (Utility API), [`src/comms/optiga_comms_ifx_i2c.c`](https://github.com/infineon/optiga-trust-m/blob/main/src/comms/optiga_comms_ifx_i2c.c) (Communications)

## Diagram (Mermaid)

```mermaid
flowchart TD

subgraph group_api["Host APIs"]
  node_crypt_api["Cryptography API<br/>[optiga_crypt.c]"]
  node_util_api["Utility API<br/>[optiga_util.c]"]
end

subgraph group_command["Command layer"]
  node_command_api["OPTIGA commands<br/>[optiga_cmd.c]"]
end

subgraph group_transport["I2C transport"]
  node_comms["Communications"]
  node_ifx_wrapper["IFX I2C wrapper<br/>[ifx_i2c.c]"]
  node_presentation["Presentation layer"]
  node_transport_layer["Transport layer"]
  node_data_link["Data-link layer"]
  node_physical["Physical layer"]
end

subgraph group_platform["Platform services"]
  node_pal_i2c["I2C platform adapter<br/>[pal_i2c.c]"]
  node_pal_services["OS platform services<br/>[pal_os_event.c]"]
  node_datastore[("Platform datastore<br/>[pal_os_datastore.c]")]
end

subgraph group_crypto["Crypto support"]
  node_pal_crypto["PSA crypto adapter<br/>[pal_crypt_psa.c]"]
end

node_application(("Host application"))
node_device[("OPTIGA Trust M")]
node_mbedtls["Mbed TLS / PSA"]

node_application -->|"calls crypto API"| node_crypt_api
node_application -->|"calls utility API"| node_util_api
node_crypt_api -->|"issues commands"| node_command_api
node_util_api -->|"issues commands"| node_command_api
node_command_api -->|"transmits APDUs"| node_comms
node_comms -->|"dispatches I2C"| node_ifx_wrapper
node_ifx_wrapper -->|"uses protocol"| node_presentation
node_presentation -->|"transceives frames"| node_transport_layer
node_transport_layer -->|"uses link layer"| node_data_link
node_data_link -->|"uses physical layer"| node_physical
node_physical -->|"reads and writes"| node_pal_i2c
node_pal_i2c -->|"I2C exchange"| node_device
node_command_api -->|"persists context"| node_datastore
node_crypt_api -.->|"uses host crypto"| node_pal_crypto
node_pal_crypto -->|"calls PSA"| node_mbedtls
node_command_api -->|"uses OS services"| node_pal_services

click node_crypt_api "https://github.com/infineon/optiga-trust-m/blob/main/src/crypt/optiga_crypt.c"
click node_util_api "https://github.com/infineon/optiga-trust-m/blob/main/src/util/optiga_util.c"
click node_command_api "https://github.com/infineon/optiga-trust-m/blob/main/src/cmd/optiga_cmd.c"
click node_comms "https://github.com/infineon/optiga-trust-m/blob/main/src/comms/optiga_comms_ifx_i2c.c"
click node_ifx_wrapper "https://github.com/infineon/optiga-trust-m/blob/main/src/comms/ifx_i2c/ifx_i2c.c"
click node_presentation "https://github.com/infineon/optiga-trust-m/blob/main/src/comms/ifx_i2c/ifx_i2c_presentation_layer.c"
click node_transport_layer "https://github.com/infineon/optiga-trust-m/blob/main/src/comms/ifx_i2c/ifx_i2c_transport_layer.c"
click node_data_link "https://github.com/infineon/optiga-trust-m/blob/main/src/comms/ifx_i2c/ifx_i2c_data_link_layer.c"
click node_physical "https://github.com/infineon/optiga-trust-m/blob/main/src/comms/ifx_i2c/ifx_i2c_physical_layer.c"
click node_pal_i2c "https://github.com/infineon/optiga-trust-m/blob/main/extras/pal/linux/pal_i2c.c"
click node_pal_services "https://github.com/infineon/optiga-trust-m/blob/main/extras/pal/linux/pal_os_event.c"
click node_datastore "https://github.com/infineon/optiga-trust-m/blob/main/extras/pal/linux/pal_os_datastore.c"
click node_pal_crypto "https://github.com/infineon/optiga-trust-m/blob/main/extras/pal/pal_crypt_psa.c"

classDef toneNeutral fill:#f8fafc,stroke:#334155,stroke-width:1.5px,color:#0f172a
classDef toneBlue fill:#dbeafe,stroke:#2563eb,stroke-width:1.5px,color:#172554
classDef toneAmber fill:#fef3c7,stroke:#d97706,stroke-width:1.5px,color:#78350f
classDef toneMint fill:#dcfce7,stroke:#16a34a,stroke-width:1.5px,color:#14532d
classDef toneRose fill:#ffe4e6,stroke:#e11d48,stroke-width:1.5px,color:#881337
classDef toneIndigo fill:#e0e7ff,stroke:#4f46e5,stroke-width:1.5px,color:#312e81
classDef toneTeal fill:#ccfbf1,stroke:#0f766e,stroke-width:1.5px,color:#134e4a
class node_crypt_api,node_util_api toneBlue
class node_command_api,node_device toneAmber
class node_comms,node_ifx_wrapper,node_presentation,node_transport_layer,node_data_link,node_physical toneMint
class node_pal_i2c,node_pal_services,node_datastore toneRose
class node_pal_crypto,node_application,node_mbedtls toneIndigo
```

## Components

### Host APIs

- [Cryptography API](https://github.com/infineon/optiga-trust-m/blob/main/src/crypt/optiga_crypt.c): `src/crypt/optiga_crypt.c`
- [Utility API](https://github.com/infineon/optiga-trust-m/blob/main/src/util/optiga_util.c): `src/util/optiga_util.c`

### Command layer

- [OPTIGA commands](https://github.com/infineon/optiga-trust-m/blob/main/src/cmd/optiga_cmd.c): `src/cmd/optiga_cmd.c`

### I2C transport

- [Communications](https://github.com/infineon/optiga-trust-m/blob/main/src/comms/optiga_comms_ifx_i2c.c): `src/comms/optiga_comms_ifx_i2c.c`
- [IFX I2C wrapper](https://github.com/infineon/optiga-trust-m/blob/main/src/comms/ifx_i2c/ifx_i2c.c): `src/comms/ifx_i2c/ifx_i2c.c`
- [Presentation layer](https://github.com/infineon/optiga-trust-m/blob/main/src/comms/ifx_i2c/ifx_i2c_presentation_layer.c): `src/comms/ifx_i2c/ifx_i2c_presentation_layer.c`
- [Transport layer](https://github.com/infineon/optiga-trust-m/blob/main/src/comms/ifx_i2c/ifx_i2c_transport_layer.c): `src/comms/ifx_i2c/ifx_i2c_transport_layer.c`
- [Data-link layer](https://github.com/infineon/optiga-trust-m/blob/main/src/comms/ifx_i2c/ifx_i2c_data_link_layer.c): `src/comms/ifx_i2c/ifx_i2c_data_link_layer.c`
- [Physical layer](https://github.com/infineon/optiga-trust-m/blob/main/src/comms/ifx_i2c/ifx_i2c_physical_layer.c): `src/comms/ifx_i2c/ifx_i2c_physical_layer.c`

### Platform services

- [I2C platform adapter](https://github.com/infineon/optiga-trust-m/blob/main/extras/pal/linux/pal_i2c.c): `extras/pal/linux/pal_i2c.c`
- [OS platform services](https://github.com/infineon/optiga-trust-m/blob/main/extras/pal/linux/pal_os_event.c): `extras/pal/linux/pal_os_event.c`
- [Platform datastore](https://github.com/infineon/optiga-trust-m/blob/main/extras/pal/linux/pal_os_datastore.c): `extras/pal/linux/pal_os_datastore.c`

### Crypto support

- [PSA crypto adapter](https://github.com/infineon/optiga-trust-m/blob/main/extras/pal/pal_crypt_psa.c): `extras/pal/pal_crypt_psa.c`

### Other components

- **Host application**
- **OPTIGA Trust M**
- **Mbed TLS / PSA**

## Connections

- Host application → Cryptography API: calls crypto API
- Host application → Utility API: calls utility API
- Cryptography API → OPTIGA commands: issues commands
- Utility API → OPTIGA commands: issues commands
- OPTIGA commands → Communications: transmits APDUs
- Communications → IFX I2C wrapper: dispatches I2C
- IFX I2C wrapper → Presentation layer: uses protocol
- Presentation layer → Transport layer: transceives frames
- Transport layer → Data-link layer: uses link layer
- Data-link layer → Physical layer: uses physical layer
- Physical layer → I2C platform adapter: reads and writes
- I2C platform adapter → OPTIGA Trust M: I2C exchange
- OPTIGA commands → Platform datastore: persists context
- Cryptography API → PSA crypto adapter: uses host crypto
- PSA crypto adapter → Mbed TLS / PSA: calls PSA
- OPTIGA commands → OS platform services: uses OS services