Module pka 

Public Key Accelerator (PKA)

This module provides hardware-accelerated public key cryptographic operations using the PKA peripheral. The PKA can accelerate:

• ECDSA: Signature generation and verification
• ECDH: Elliptic Curve Diffie-Hellman key agreement (via scalar multiplication)
• RSA: Encryption, decryption, and signing (via modular exponentiation)
• Arithmetic: Modular operations, Montgomery multiplication

Supported Operations

Operation	Mode	Description
Modular Exponentiation	0x00	RSA encryption/decryption
Montgomery Parameter	0x01	Compute Montgomery parameter for RSA
RSA CRT Exponentiation	0x07	Fast RSA with Chinese Remainder Theorem
Modular Inversion	0x08	Compute modular inverse
ECC Scalar Multiplication	0x20	ECDH key agreement, point multiplication
ECDSA Sign	0x24	Generate ECDSA signatures
ECDSA Verify	0x26	Verify ECDSA signatures
Point Check	0x28	Validate point is on curve

Three hardware revisions are supported: pka_v1a (STM32H5, H7RS, WBA), pka_v1b (STM32U3, U5) and pka_v1c (STM32L4+, L5, WB, WL). The older pka_v1c has a different RAM layout, no RAM initialization from the RNG and no operation error flag, and lacks the protected exponentiation, the complete point addition, the double base ladder and the projective to affine conversion, so those methods do not exist there. Its scalar multiplication also does not report the point at infinity.

Example - ECDSA Signature Verification (async)

use embassy_stm32::pka::{Pka, EcdsaCurveParams, EcdsaPublicKey, EcdsaSignature};

let mut pka = Pka::new(p.PKA, Irqs);
let params = EcdsaCurveParams::nist_p256();

let public_key = EcdsaPublicKey {
    x: &pub_key_x,
    y: &pub_key_y,
};

let signature = EcdsaSignature {
    r: &sig_r,
    s: &sig_s,
};

let valid = pka.ecdsa_verify(&params, &public_key, &signature, &hash).await?;

For blocking use, swap Pka::new for Pka::new_blocking and call pka.ecdsa_verify_blocking(...) etc. without .await.

RAM scrubbing

Operations do not clear the RAM between calls. After a sensitive operation (one that touched a private key – e.g. ecdsa_sign, ecc_mul with a private scalar, modular_exp with a private exponent), the intermediate values remain in PKA RAM until overwritten. To explicitly scrub the RAM between sensitive operations, call Pka::scrub:

pka.ecdsa_sign(&curve, &priv_key, &k, &hash, &mut sig_r, &mut sig_s).await?;
pka.scrub().await?; // zero the PKA RAM before the next op

Security Notes

• Always use cryptographically secure random numbers for ECDSA k values.
• Validate all public keys before use (call point_check).
• Call Pka::scrub between operations that touch sensitive material.
• Clear sensitive data from caller-owned buffers after use.

RNG dependency

On pka_v1a and pka_v1b, the PKA initializes its RAM with random data whenever it is enabled, and the initialization does not complete unless the RNG is running: create an Rng before the Pka, and keep it alive for as long as the PKA is in use. On STM32WBA6 the driver enables the RNG itself. pka_v1c has no such dependency.

embassy-crypto

With the embassy-crypto-p256-arith, embassy-crypto-p256-ecdh and embassy-crypto-p256-ecdsa features, and their p384 counterparts, the PKA serves the curve arithmetic, ECDH and ECDSA of the embassy-crypto crate: its p256 and p384 modules, and everything built on them. The drivers take the peripheral over, so the Pka must not be constructed by the application. They need a running RNG too: with the embassy-crypto-rng feature they start it themselves, otherwise keep an Rng alive. ECDSA signing draws its nonces from the embassy-crypto random number driver, whichever one is registered.

Structs

EccPoint

ECC point (for scalar multiplication results)

EccProjectivePoint

ECC point in projective coordinates (X, Y, Z)

EcdsaCurveParams

ECDSA/ECC curve parameters

EcdsaPublicKey

ECDSA public key

EcdsaSignature

ECDSA signature

InterruptHandler

PKA interrupt handler.

ModExpProtectParams

Parameters for modular exponentiation with protection (side-channel resistant)

Pka

PKA driver

RsaCrtParams

RSA CRT parameters for fast decryption

RsaParams

RSA operation parameters

Enums

ComparisonResult

Result of a comparison operation

Error

PKA error

PkaMode

PKA operation modes

Traits

Instance

PKA instance trait.