TinyCrypt Integration
Overview
Use this skill to integrate TinyCrypt primitives safely. Cryptographic code needs test vectors, correct modes, nonce/IV discipline, key handling, and explicit threat boundaries before being used in products.
When To Use
Use this skill when:
- The user wants lightweight crypto primitives on an MCU using TinyCrypt.
- The task involves AES, SHA, HMAC, CTR, CCM, ECC, RNG, key storage, message authentication, or encrypted firmware/data.
- Outputs do not match known vectors or peer devices.
Do not use this skill for TLS session integration. Use mbedtls-integration for full TLS. For standalone ECDH/ECDSA operations, use micro-ecc-integration.
First Questions
Ask for:
- Primitive/mode: AES-CTR, AES-CCM, SHA, HMAC, ECC, or RNG.
- Protocol or data format consuming the primitive.
- Key, IV/nonce, tag length, AAD, and message framing policy without exposing secrets.
- Target MCU/compiler and hardware crypto availability.
- Known test vector or peer output.
Integration Checklist
Use test vectors first.
Validate primitive and mode with public vectors before product payloads.
Define nonce/IV rules.
Nonce reuse can break security. Make generation and storage explicit.
Separate encryption and authentication.
Know whether the mode authenticates data or only encrypts it.
Protect key material.
Avoid logging keys, IV secrets, raw plaintext, or derived secrets.
Handle failures securely.
Authentication failure must reject data, not fall back to plaintext.
Common Failures
- AES mode mismatch with peer.
- Nonce/IV reused after reboot.
- Tag length or AAD differs from peer implementation.
- Hash/HMAC input framing differs.
- Test code logs secrets or accepts authentication failures.
Verification
Before claiming TinyCrypt works:
- State primitive/mode, nonce policy, tag length, and framing.
- Confirm public test vectors pass.
- Confirm modified ciphertext/tag fails verification.
- Confirm secrets are not printed or stored insecurely.
Example
User:
TinyCrypt AES-CCM 加密后对端验签失败。
Agent:
- Asks for mode parameters, nonce, tag length, AAD, framing, and test vector.
- Checks nonce and AAD consistency before payload logic.
- Verifies that modified tags are rejected.
1---2name: tinycrypt-integration3description: Use when integrating, porting, configuring, or debugging TinyCrypt cryptographic primitives, AES, SHA, HMAC, ECC, CTR/CCM, RNG, or embedded security code4---56# TinyCrypt Integration78## Overview910Use this skill to integrate TinyCrypt primitives safely. Cryptographic code needs test vectors, correct modes, nonce/IV discipline, key handling, and explicit threat boundaries before being used in products.1112## When To Use1314Use this skill when:1516- The user wants lightweight crypto primitives on an MCU using TinyCrypt.17- The task involves AES, SHA, HMAC, CTR, CCM, ECC, RNG, key storage, message authentication, or encrypted firmware/data.18- Outputs do not match known vectors or peer devices.1920Do not use this skill for TLS session integration. Use `mbedtls-integration` for full TLS. For standalone ECDH/ECDSA operations, use `micro-ecc-integration`.2122## First Questions2324Ask for:2526- Primitive/mode: AES-CTR, AES-CCM, SHA, HMAC, ECC, or RNG.27- Protocol or data format consuming the primitive.28- Key, IV/nonce, tag length, AAD, and message framing policy without exposing secrets.29- Target MCU/compiler and hardware crypto availability.30- Known test vector or peer output.3132## Integration Checklist33341. Use test vectors first.35 Validate primitive and mode with public vectors before product payloads.36371. Define nonce/IV rules.38 Nonce reuse can break security. Make generation and storage explicit.39401. Separate encryption and authentication.41 Know whether the mode authenticates data or only encrypts it.42431. Protect key material.44 Avoid logging keys, IV secrets, raw plaintext, or derived secrets.45461. Handle failures securely.47 Authentication failure must reject data, not fall back to plaintext.4849## Common Failures5051- AES mode mismatch with peer.52- Nonce/IV reused after reboot.53- Tag length or AAD differs from peer implementation.54- Hash/HMAC input framing differs.55- Test code logs secrets or accepts authentication failures.5657## Verification5859Before claiming TinyCrypt works:6061- State primitive/mode, nonce policy, tag length, and framing.62- Confirm public test vectors pass.63- Confirm modified ciphertext/tag fails verification.64- Confirm secrets are not printed or stored insecurely.6566## Example6768User:6970```text71TinyCrypt AES-CCM 加密后对端验签失败。72```7374Agent:75761. Asks for mode parameters, nonce, tag length, AAD, framing, and test vector.771. Checks nonce and AAD consistency before payload logic.781. Verifies that modified tags are rejected.
easyzoom