security_hal branchsandbox/ToshikazuOhiwa/security_hal

5 files changed, 2066 insertions, 0 deletions

diff --git a/LICENSE b/LICENSE
new file mode 100644
index 00000000..f433b1a5
--- /dev/null
+++ b/LICENSE
@@ -0,0 +1,177 @@
+
+                                 Apache License
+                           Version 2.0, January 2004
+                        http://www.apache.org/licenses/
+
+   TERMS AND CONDITIONS FOR USE, REPRODUCTION, AND DISTRIBUTION
+
+   1. Definitions.
+
+      "License" shall mean the terms and conditions for use, reproduction,
+      and distribution as defined by Sections 1 through 9 of this document.
+
+      "Licensor" shall mean the copyright owner or entity authorized by
+      the copyright owner that is granting the License.
+
+      "Legal Entity" shall mean the union of the acting entity and all
+      other entities that control, are controlled by, or are under common
+      control with that entity. For the purposes of this definition,
+      "control" means (i) the power, direct or indirect, to cause the
+      direction or management of such entity, whether by contract or
+      otherwise, or (ii) ownership of fifty percent (50%) or more of the
+      outstanding shares, or (iii) beneficial ownership of such entity.
+
+      "You" (or "Your") shall mean an individual or Legal Entity
+      exercising permissions granted by this License.
+
+      "Source" form shall mean the preferred form for making modifications,
+      including but not limited to software source code, documentation
+      source, and configuration files.
+
+      "Object" form shall mean any form resulting from mechanical
+      transformation or translation of a Source form, including but
+      not limited to compiled object code, generated documentation,
+      and conversions to other media types.
+
+      "Work" shall mean the work of authorship, whether in Source or
+      Object form, made available under the License, as indicated by a
+      copyright notice that is included in or attached to the work
+      (an example is provided in the Appendix below).
+
+      "Derivative Works" shall mean any work, whether in Source or Object
+      form, that is based on (or derived from) the Work and for which the
+      editorial revisions, annotations, elaborations, or other modifications
+      represent, as a whole, an original work of authorship. For the purposes
+      of this License, Derivative Works shall not include works that remain
+      separable from, or merely link (or bind by name) to the interfaces of,
+      the Work and Derivative Works thereof.
+
+      "Contribution" shall mean any work of authorship, including
+      the original version of the Work and any modifications or additions
+      to that Work or Derivative Works thereof, that is intentionally
+      submitted to Licensor for inclusion in the Work by the copyright owner
+      or by an individual or Legal Entity authorized to submit on behalf of
+      the copyright owner. For the purposes of this definition, "submitted"
+      means any form of electronic, verbal, or written communication sent
+      to the Licensor or its representatives, including but not limited to
+      communication on electronic mailing lists, source code control systems,
+      and issue tracking systems that are managed by, or on behalf of, the
+      Licensor for the purpose of discussing and improving the Work, but
+      excluding communication that is conspicuously marked or otherwise
+      designated in writing by the copyright owner as "Not a Contribution."
+
+      "Contributor" shall mean Licensor and any individual or Legal Entity
+      on behalf of whom a Contribution has been received by Licensor and
+      subsequently incorporated within the Work.
+
+   2. Grant of Copyright License. Subject to the terms and conditions of
+      this License, each Contributor hereby grants to You a perpetual,
+      worldwide, non-exclusive, no-charge, royalty-free, irrevocable
+      copyright license to reproduce, prepare Derivative Works of,
+      publicly display, publicly perform, sublicense, and distribute the
+      Work and such Derivative Works in Source or Object form.
+
+   3. Grant of Patent License. Subject to the terms and conditions of
+      this License, each Contributor hereby grants to You a perpetual,
+      worldwide, non-exclusive, no-charge, royalty-free, irrevocable
+      (except as stated in this section) patent license to make, have made,
+      use, offer to sell, sell, import, and otherwise transfer the Work,
+      where such license applies only to those patent claims licensable
+      by such Contributor that are necessarily infringed by their
+      Contribution(s) alone or by combination of their Contribution(s)
+      with the Work to which such Contribution(s) was submitted. If You
+      institute patent litigation against any entity (including a
+      cross-claim or counterclaim in a lawsuit) alleging that the Work
+      or a Contribution incorporated within the Work constitutes direct
+      or contributory patent infringement, then any patent licenses
+      granted to You under this License for that Work shall terminate
+      as of the date such litigation is filed.
+
+   4. Redistribution. You may reproduce and distribute copies of the
+      Work or Derivative Works thereof in any medium, with or without
+      modifications, and in Source or Object form, provided that You
+      meet the following conditions:
+
+      (a) You must give any other recipients of the Work or
+          Derivative Works a copy of this License; and
+
+      (b) You must cause any modified files to carry prominent notices
+          stating that You changed the files; and
+
+      (c) You must retain, in the Source form of any Derivative Works
+          that You distribute, all copyright, patent, trademark, and
+          attribution notices from the Source form of the Work,
+          excluding those notices that do not pertain to any part of
+          the Derivative Works; and
+
+      (d) If the Work includes a "NOTICE" text file as part of its
+          distribution, then any Derivative Works that You distribute must
+          include a readable copy of the attribution notices contained
+          within such NOTICE file, excluding those notices that do not
+          pertain to any part of the Derivative Works, in at least one
+          of the following places: within a NOTICE text file distributed
+          as part of the Derivative Works; within the Source form or
+          documentation, if provided along with the Derivative Works; or,
+          within a display generated by the Derivative Works, if and
+          wherever such third-party notices normally appear. The contents
+          of the NOTICE file are for informational purposes only and
+          do not modify the License. You may add Your own attribution
+          notices within Derivative Works that You distribute, alongside
+          or as an addendum to the NOTICE text from the Work, provided
+          that such additional attribution notices cannot be construed
+          as modifying the License.
+
+      You may add Your own copyright statement to Your modifications and
+      may provide additional or different license terms and conditions
+      for use, reproduction, or distribution of Your modifications, or
+      for any such Derivative Works as a whole, provided Your use,
+      reproduction, and distribution of the Work otherwise complies with
+      the conditions stated in this License.
+
+   5. Submission of Contributions. Unless You explicitly state otherwise,
+      any Contribution intentionally submitted for inclusion in the Work
+      by You to the Licensor shall be under the terms and conditions of
+      this License, without any additional terms or conditions.
+      Notwithstanding the above, nothing herein shall supersede or modify
+      the terms of any separate license agreement you may have executed
+      with Licensor regarding such Contributions.
+
+   6. Trademarks. This License does not grant permission to use the trade
+      names, trademarks, service marks, or product names of the Licensor,
+      except as required for reasonable and customary use in describing the
+      origin of the Work and reproducing the content of the NOTICE file.
+
+   7. Disclaimer of Warranty. Unless required by applicable law or
+      agreed to in writing, Licensor provides the Work (and each
+      Contributor provides its Contributions) on an "AS IS" BASIS,
+      WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or
+      implied, including, without limitation, any warranties or conditions
+      of TITLE, NON-INFRINGEMENT, MERCHANTABILITY, or FITNESS FOR A
+      PARTICULAR PURPOSE. You are solely responsible for determining the
+      appropriateness of using or redistributing the Work and assume any
+      risks associated with Your exercise of permissions under this License.
+
+   8. Limitation of Liability. In no event and under no legal theory,
+      whether in tort (including negligence), contract, or otherwise,
+      unless required by applicable law (such as deliberate and grossly
+      negligent acts) or agreed to in writing, shall any Contributor be
+      liable to You for damages, including any direct, indirect, special,
+      incidental, or consequential damages of any character arising as a
+      result of this License or out of the use or inability to use the
+      Work (including but not limited to damages for loss of goodwill,
+      work stoppage, computer failure or malfunction, or any and all
+      other commercial damages or losses), even if such Contributor
+      has been advised of the possibility of such damages.
+
+   9. Accepting Warranty or Additional Liability. While redistributing
+      the Work or Derivative Works thereof, You may choose to offer,
+      and charge a fee for, acceptance of support, warranty, indemnity,
+      or other liability obligations and/or rights consistent with this
+      License. However, in accepting such obligations, You may act only
+      on Your own behalf and on Your sole responsibility, not on behalf
+      of any other Contributor, and only if You agree to indemnify,
+      defend, and hold each Contributor harmless for any liability
+      incurred by, or claims asserted against, such Contributor by reason
+      of your accepting any such warranty or additional liability.
+
+   END OF TERMS AND CONDITIONS
diff --git a/Makefile b/Makefile
new file mode 100644
index 00000000..5435be74
--- /dev/null
+++ b/Makefile
@@ -0,0 +1,67 @@
+#
+# @copyright Copyright (c) 2018-2020 TOYOTA MOTOR CORPORATION.
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#      http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+#
+
+######### installed program/file ################
+TARGET := libsecurity_hal.so
+
+HEADER := hal_api/security_hal.h
+
+######### include paths/files ###################
+CXXFLAGS := -I./inc/
+CXXFLAGS += -I./hal_api/
+CXXFLAGS += -I$(SDKTARGETSYSROOT)/usr/agl/include
+CXXFLAGS += -include $(SDKTARGETSYSROOT)/usr/agl/include/agl_types_obsoluted.h
+
+######### compile options #######################
+CXXFLAGS +=  -Wall -fPIC
+
+######### link options ##########################
+LDFLAGS += -shared
+LDFLAGS += -Wl,--no-as-needed
+LDFLAGS += -Wl,--no-undefined
+LDFLAGS += -L$(SDKTARGETSYSROOT)/usr/agl/lib
+
+RPATH :=
+
+######### linked library ########################
+LIBS += -Wl,-Bdynamic -lstdc++
+LIBS += -Wl,-Bdynamic -lNS_FrameworkUnified
+
+######### source files ##########################
+VPATH := src
+OBJS := security_hal.o
+
+######### make targets ##########################
+all: $(TARGET)
+	@echo $@ done.
+
+$(TARGET): $(OBJS)
+	$(CC) $(LDFLAGS) -Wl,-rpath=$(RPATH) $(OBJS) $(LIBS) -o $(TARGET)
+	@echo $@ done.
+
+######### make cleans ###########################
+GCNO_FILES := $(filter %.gcno,$(OBJS:%.o=%.gcno))
+
+clean:
+	rm -f $(OBJS) $(TARGET) $(GCNO_FILES)
+	@echo $@ done.
+
+######### make installs #########################
+install:
+	install -d -m 0755 $(DESTDIR)/usr/lib
+	install -m 0755 $(TARGET) $(DESTDIR)/usr/lib
+	@echo $@ done.
+
diff --git a/hal_api/security_hal.h b/hal_api/security_hal.h
new file mode 100644
index 00000000..5d2bf90d
--- /dev/null
+++ b/hal_api/security_hal.h
@@ -0,0 +1,1131 @@
+/*
+ * @copyright Copyright (c) 2017-2020 TOYOTA MOTOR CORPORATION.
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+#ifndef HAL_API_SECURITY_HAL_H_
+#define HAL_API_SECURITY_HAL_H_
+
+#include <stdint.h>
+#include <native_service/frameworkunified_types.h>
+
+/**
+ * @file security_hal.h
+ */
+
+/** @addtogroup update_service
+ *  @{
+ */
+/** @addtogroup security_hal
+ *  @ingroup update_service
+ *  @{
+ */
+
+/**
+ * \~english  The max size of RSA modulus
+ */
+#define RSA_MODULUS_MAX_SIZE 2048
+/**
+ * \~english  The max size of RSA public exponent
+ */
+#define RSA_PUBLIC_EXPONENT_MAX_SIZE 2048
+/**
+ * \~english  The max size of RSA private exponent
+ */
+#define RSA_PRIVATE_EXPONENT_MAX_SIZE  2048
+/**
+ * \~english  The minimum size of RSA padding
+ */
+#define RSA_PADDING_MINIMUM_SIZE 11
+
+/**
+ * \~english  Cipher type
+ */
+enum CipherType {
+  /**
+   * \~english  AES symmetric cipher
+   */
+  SYMMETRIC_CIPHER_AES = 1,
+  /**
+   * \~english  BLOWFISH symmetric cipher
+   */
+  SYMMETRIC_CIPHER_BLOWFISH,
+  /**
+   * \~english  CAST5 symmetric cipher
+   */
+  SYMMETRIC_CIPHER_CAST5,
+  /**
+   * \~english  DES symmetric cipher
+   */
+  SYMMETRIC_CIPHER_DES,
+  /**
+   * \~english  DESEDA symmetric cipher
+   */
+  SYMMETRIC_CIPHER_DESEDA,
+  /**
+   * \~english  DESEDA3 symmetric cipher
+   */
+  SYMMETRIC_CIPHER_DESEDA3,
+  /**
+   * \~english  IDEA symmetric cipher
+   */
+  SYMMETRIC_CIPHER_IDEA,
+  /**
+   * \~english  RC2 symmetric cipher
+   */
+  SYMMETRIC_CIPHER_RC2,
+  /**
+   * \~english  RC4 symmetric cipher
+   */
+  SYMMETRIC_CIPHER_RC4,
+  /**
+   * \~english  RC5 symmetric cipher
+   */
+  SYMMETRIC_CIPHER_RC5,
+  /**
+   * \~english  RSA asymmetric cipher
+   */
+  ASYMMETRIC_CIPHER_RSA,
+  /**
+   * \~english  DSA asymmetric cipher
+   */
+  ASYMMETRIC_CIPHER_DSA,
+  /**
+   * \~english  ECDSA asymmetric cipher
+   */
+  ASYMMETRIC_CIPHER_ECDSA
+};
+
+/**
+ * \~english  Symmetric Cipher Mode
+ */
+enum SymmetricCipherMode {
+  /**
+   * \~english  Stream symmetric cipher mode
+   */
+  SYMMETRIC_CIPHER_MODE_STREAM    = 0x00000001,
+  /**
+   * \~english  ECB symmetric cipher mode
+   */
+  SYMMETRIC_CIPHER_MODE_BLOCK_ECB = 0x00000002,
+  /**
+   * \~english  CBC symmetric cipher mode
+   */
+  SYMMETRIC_CIPHER_MODE_BLOCK_CBC = 0x00000004,
+  /**
+   * \~english  CFB symmetric cipher mode
+   */
+  SYMMETRIC_CIPHER_MODE_BLOCK_CFB = 0x00000008,
+  /**
+   * \~english  OFB symmetric cipher mode
+   */
+  SYMMETRIC_CIPHER_MODE_BLOCK_OFB = 0x00000010
+};
+
+/**
+ * \~english  Symmetric cipher Block Size
+ */
+enum SymmetricCipherBlockSize {
+  /**
+   * \~english  Symmetric cipher block size is 4 bytes
+   */
+  SYMMETRIC_CIPHER_BLOCK_SIZE_4    = 0x00000001,
+  /**
+   * \~english  Symmetric cipher block size is 8 bytes
+   */
+  SYMMETRIC_CIPHER_BLOCK_SIZE_8    = 0x00000002,
+  /**
+   * \~english  Symmetric cipher block size is 16 bytes
+   */
+  SYMMETRIC_CIPHER_BLOCK_SIZE_16   = 0x00000004,
+  /**
+   * \~english  Symmetric cipher block size is 32 bytes
+   */
+  SYMMETRIC_CIPHER_BLOCK_SIZE_32   = 0x00000008
+};
+
+/**
+ * \~english  Symmetric Cipher Round
+ */
+enum SymmetricCipherRound {
+  /**
+   * \~english  Symmetric cipher round is 1
+   */
+  SYMMETRIC_CIPHER_ROUND_1    = 0x00000001,
+  /**
+   * \~english  Symmetric cipher round is 2
+   */
+  SYMMETRIC_CIPHER_ROUND_2    = 0x00000002,
+  /**
+   * \~english  Symmetric cipher round is 8.5
+   */
+  SYMMETRIC_CIPHER_ROUND_8_5  = 0x00000004,
+  /**
+   * \~english  Symmetric cipher round is 10
+   */
+  SYMMETRIC_CIPHER_ROUND_10   = 0x00000008,
+  /**
+   * \~english  Symmetric cipher round is 12
+   */
+  SYMMETRIC_CIPHER_ROUND_12   = 0x00000010,
+  /**
+   * \~english  Symmetric cipher round is 14
+   */
+  SYMMETRIC_CIPHER_ROUND_14   = 0x00000020,
+  /**
+   * \~english  Symmetric cipher round is 16
+   */
+  SYMMETRIC_CIPHER_ROUND_16   = 0x00000040
+};
+
+/**
+ * \~english  Asymmetric Padding Mode
+ */
+enum AsymmetricPaddingMode {
+  /**
+   * \~english  RSA PKCS1 asymmetric padding mode
+   */
+  ASYMMETRIC_PADDING_MODE_RSA_PKCS1 = 1,
+  /**
+   * \~english  RSA SSLV23 asymmetric padding mode
+   */
+  ASYMMETRIC_PADDING_MODE_RSA_SSLV23,
+  /**
+   * \~english  RSA NOPADDING asymmetric padding mode
+   */
+  ASYMMETRIC_PADDING_MODE_RSA_NOPADDING,
+  /**
+   * \~english  RSA OAEP asymmetric padding mode
+   */
+  ASYMMETRIC_PADDING_MODE_RSA_OAEP,
+  /**
+   * \~english  RSA PSS asymmetric padding mode
+   */
+  ASYMMETRIC_PADDING_MODE_RSA_PSS
+};
+
+/**
+ * @union CipherParameter
+ * \~english @par Brief
+ *          Union of cipher parameter
+ */
+union CipherParameter {
+  /**
+   * \~english  Struct of symmetric cipher parameter
+   */
+  struct SymmetricCipherParameter {
+    /**
+     * \~english Symmetric cipher mode
+     */
+    enum SymmetricCipherMode  mode;
+    /**
+     * \~english Symmetric cipher block size
+     */
+    enum SymmetricCipherBlockSize block_size;
+    /**
+     * \~english Symmetric cipher round
+     */
+    enum SymmetricCipherRound round;
+    /**
+     * \~english Padding ON/OFF. Only used in CBC mode and ECB mode.
+     *           Padding ON :
+     *               Encrypt:
+     *                   1.If plaintext length isn't aligned with block size, the
+     *                     ciphertext length is aligned with block size.
+     *                   2.If plaintext length is aligned with block size, the
+     *                     ciphertext length is equal to plaintext length + 1 block size.
+     *               Decrypt:
+     *                   1.If ciphertext length isn't aligned with block size, return error.
+     *                   2.If ciphertext length is aligned with block size, plaintext length
+     *                     is equal to ciphertext length minus padding length. Padding length
+     *                     is greater than 0 and not greater than block size.
+     *           Padding OFF:
+     *               Encrypt:
+     *                   1.If plaintext length isn't aligned with block size, return error.
+     *                   2.If plaintext length is aligned with block size, the
+     *                     ciphertext length is equal to plaintext length.
+     *               Decrypt:
+     *                   1.If ciphertext length isn't aligned with block size, return error.
+     *                   2.If ciphertext length is aligned with block size, the
+     *                     plaintext length is equal to ciphertext length.
+     */
+    bool to_pad;
+  } symmetric;
+
+  /**
+   * \~english  Struct of asymmetric cipher parameter
+   */
+  struct AsymmetricCipherParameter {
+    /**
+     * \~english Asymmetric padding mode
+     */
+    enum AsymmetricPaddingMode mode;
+  } asymmetric;
+};
+
+
+/**
+ * \~english Symmetric cipher key type
+ */
+enum SymmetricCipherKeyType {
+  /**
+   * \~english Key is managed by hardware/chip
+   */
+  SYMMETRIC_CIPHER_KEY_TYPE_MANAGED,
+  /**
+   * \~english Key is provided by user
+   */
+  SYMMETRIC_CIPHER_KEY_TYPE_USER
+};
+
+/**
+ * @struct RsaPrivateKey
+ * \~english @par Brief
+ *                Struct of RSA private key
+ */
+struct RsaPrivateKey {
+  /**
+   * \~english Private exponent
+   */
+  uint8_t d[RSA_PRIVATE_EXPONENT_MAX_SIZE];
+  /**
+   * \~english Modulus
+   */
+  uint8_t n[RSA_MODULUS_MAX_SIZE];
+  /**
+   * \~english The length of private exponent
+   */
+  uint32_t d_length;
+  /**
+   * \~english The length of modulus
+   */
+  uint32_t n_length;
+};
+
+/**
+ * @union PrivateKey
+ * \~english @par Brief
+ *          Union of private key
+ */
+union PrivateKey {
+  /**
+   * \~english Rsa private key
+   */
+  struct RsaPrivateKey rsa;
+};
+
+/**
+ * @struct RsaPublicKey
+ * \~english @par Brief
+ *          Union of RSA public key
+ */
+struct RsaPublicKey {
+  /**
+   * \~english Public exponent
+   */
+  uint8_t e[RSA_PUBLIC_EXPONENT_MAX_SIZE];
+  /**
+   * \~english Modulus
+   */
+  uint8_t n[RSA_MODULUS_MAX_SIZE];
+  /**
+   * \~english The length of public exponent
+   */
+  uint32_t e_length;
+  /**
+   * \~english  The length of modulus
+   */
+  uint32_t n_length;
+};
+
+/**
+ * @union PublicKey
+ * \~english @par Brief
+ *          Union of public key
+ */
+union PublicKey {
+  /**
+   * \~english Struct of rsa public key
+   */
+  struct RsaPublicKey rsa;
+};
+
+/**
+ * \~english Asymmetric cipher key type
+ */
+enum AsymmetricCipherKeyType {
+  /**
+   * \~english Key is managed by hardware/chip
+   */
+  ASYMMETRIC_CIPHER_KEY_TYPE_MANAGED,
+  /**
+   * \~english Public key is provided by user
+   */
+  ASYMMETRIC_CIPHER_KEY_TYPE_USER_PUBLIC,
+  /**
+   * \~english Private key is provided by user
+   */
+  ASYMMETRIC_CIPHER_KEY_TYPE_USER_PRIVATE
+};
+
+/**
+ * @union KeyParam
+ * \~english @par Brief
+ *          Union of key parameter
+ */
+union KeyParam {
+  /**
+   * \~english  Struct of symmetric key paramater
+   */
+  struct SymmetricKeyParam {
+    /**
+     * \~english Symmetric cipher key type
+     */
+    enum SymmetricCipherKeyType key_type;
+    /**
+     * \~english  Union of symmetric key parameter
+     */
+    union {
+      /**
+       * \~english  The symmetric key index
+       */
+      uint32_t managed_key_index;
+      /**
+       * \~english  Struct of user key
+       */
+      struct {
+        /**
+         * \~english  Key source
+         */
+        uint8_t* key;
+        /**
+         * \~english  Key length
+         */
+        uint32_t key_len;
+        /**
+         * \~english  Key Initialization vector.
+         */
+        uint8_t* iv;
+        /**
+         * \~english  Initialization vector length.The length should be
+         *            equal to block size, otherwise return error.
+         */
+        uint32_t iv_len;
+      } user_key;
+    } key_param;
+  } symmetric;
+  /**
+   * \~english  Struct of asymmetric key parameter
+   */
+  struct AsymmetricKeyParam {
+    /**
+     * \~english Asymmetric cipher key type
+     */
+    enum AsymmetricCipherKeyType key_type;
+    /**
+     * \~english  Union of asymmetric key parameter
+     */
+    union {
+      /**
+       * \~english  The asymmetric key index
+       */
+      uint32_t managed_key_index;
+      /**
+       * \~english  Union of user key
+       */
+      union {
+        /**
+         * \~english Public key
+         */
+        union PublicKey* public_key;
+        /**
+         * \~english Private key
+         */
+        union PrivateKey* private_key;
+      } user_key;
+    } key_param;
+  } asymmetric;
+};
+
+/**
+ * \~english  hash type
+ */
+enum HashType {
+  /**
+   * \~english  hash type is md5
+   */
+  HASH_TYPE_MD5 = 1,
+  /**
+   * \~english  hash type is sha1
+   */
+  HASH_TYPE_SHA1,
+  /**
+   * \~english  hash type is sha224
+   */
+  HASH_TYPE_SHA224,
+  /**
+   * \~english  hash type is sha256
+   */
+  HASH_TYPE_SHA256,
+  /**
+   * \~english  hash type is sha384
+   */
+  HASH_TYPE_SHA384,
+  /**
+   * \~english  hash type is sha512
+   */
+  HASH_TYPE_SHA512
+};
+
+/**
+ * \ingroup EncryptStart
+ * \~english @par Brief
+ *        Initialize the encrypt context information.
+ * \~english @param [in] cipher_type
+ *        enum CipherType    - Cipher type.
+ * \~english @param [in] param
+ *        union CipherParameter*      - Cipher parameter
+ * \~english @param [in] key
+ *        union KeyParam*      - Key parameter
+ * \~english @param [out] ctx
+ *        void**      - The encrypt information context handle.
+ * \~english @retval eFrameworkunifiedStatusOK :          indicates success
+ * \~english @retval eFrameworkunifiedStatusFail :        indicates the hardware/handle initialize
+ *                                           fail or hardware I/O operation fail or
+ *                                           hardware device busy or allocate context handle fail.
+ * \~english @retval eFrameworkunifiedStatusInvldParam :  indicates parameter error.
+ * \~english @par Prerequisite
+ *        - None.
+ * \~english @par Change of internal state
+ *        - Change of internal state according to the API does not occur.
+ * \~english @par Conditions of processing failure
+ *        - If the parameter "cipher_type" is less than SYMMETRIC_CIPHER_AES
+ *          or greater than ASYMMETRIC_CIPHER_ECDSA [eFrameworkunifiedStatusInvldParam]
+ *        - If the parameter "param" is NULL [eFrameworkunifiedStatusInvldParam]
+ *        - If the parameter "key" is NULL [eFrameworkunifiedStatusInvldParam]
+ *        - If the parameter "ctx" is NULL [eFrameworkunifiedStatusInvldParam]
+ *        - If the hardware/handle initialize failed [eFrameworkunifiedStatusFail]
+ *        - If the hardware I/O operation failed [eFrameworkunifiedStatusFail]
+ *        - If the hardware device is busy [eFrameworkunifiedStatusFail]
+ *        - If ctx can not be allocated [eFrameworkunifiedStatusFail]
+ * \~english @par Detail
+ *        - Initialize the encrypt context information according to cipher type,
+ *          cipher parameter and key parameter.
+ *        - If EncryptStart() was called successfully, EncryptCleanup() should
+ *          be called to clean up encrypt context information.
+ *        - The API can be used by multiple processes.
+ * \~english @par Classification
+ *        Public
+ * \~english @par Type
+ *        Sync
+ * \~english @see
+ *        EncryptUpdate, EncryptFinish, EncryptCleanup
+ */
+EFrameworkunifiedStatus EncryptStart(enum CipherType cipher_type, union CipherParameter* param,
+                        union KeyParam* key, void** ctx);
+
+/**
+ * \ingroup EncryptUpdate
+ * \~english @par Brief
+ *        Encrypt plaintext information.
+ * \~english @param [in] ctx
+ *        void*    - The encrypt information context handle.
+ * \~english @param [in] in
+ *        const uint8_t*      - The plaintext to be encrypted.
+ * \~english @param [in] in_len
+ *        uint32_t      - The input buffer length
+ *                        in_len shall be greater than 0 for symmetric encrypt.
+ *                        in_len shall be greater than 0 and not greater than
+ *                        RSA_PRIVATE_EXPONENT_MAX_SIZE/8 - RSA_PADDING_MINIMUM_SIZE
+ *                        for RSA asymmetric encrypt.
+ * \~english @param [out] out
+ *        uint8_t*      - The ciphertext after plaintext had been encrypted.
+ * \~english @param [in] out_len
+ *        uint32_t      - The output buffer length.
+ *                        out_len shall not be less than in_len + 1 block size for symmetric encrypt.
+ *                        out_len shall not be less than RSA_PRIVATE_EXPONENT_MAX_SIZE/8 for RSA asymmetric encrypt.
+ * \~english @param [out] true_length
+ *        uint32_t*      - The ciphertext length.
+ * \~english @retval eFrameworkunifiedStatusOK :          indicates success
+ * \~english @retval eFrameworkunifiedStatusFail :        indicates the hardware/handle initialize fail, hardware I/O operation fail,
+ *                                           hardware device busy or allocate context handle fail.
+ * \~english @retval eFrameworkunifiedStatusInvldParam :  indicates parameter error.
+ * \~english @par Prerequisite
+ *        - EncryptStart() was called successfully.
+ * \~english @par Change of internal state
+ *        - Change of internal state according to the API does not occur
+ * \~english @par Conditions of processing failure
+ *        - If the parameter "ctx" is NULL [eFrameworkunifiedStatusInvldParam]
+ *        - If the parameter "in" is NULL [eFrameworkunifiedStatusInvldParam]
+ *        - If the parameter "in_len" is 0 for symmetric encrypt[eFrameworkunifiedStatusInvldParam]
+ *        - If the parameter "in_len" is 0 or greater than
+ *          RSA_PRIVATE_EXPONENT_MAX_SIZE/8 - RSA_PADDING_MINIMUM_SIZE for RSA asymmetric encrypt[eFrameworkunifiedStatusInvldParam]
+ *        - If the parameter "out is NULL [eFrameworkunifiedStatusInvldParam]
+ *        - If the parameter "out_len" is less than in_len + 1 block size
+ *          for symmetric encrypt [eFrameworkunifiedStatusInvldParam]
+ *        - If the parameter "out_len" is less than RSA_PRIVATE_EXPONENT_MAX_SIZE/8
+ *          for RSA asymmetric encrypt [eFrameworkunifiedStatusInvldParam]
+ *        - If the parameter "true_length" is NULL [eFrameworkunifiedStatusFail]
+ *        - If the hardware/handle init failed [eFrameworkunifiedStatusFail]
+ *        - If the hardware I/O operation failed [eFrameworkunifiedStatusFail]
+ *        - If the hardware device is busy [eFrameworkunifiedStatusFail]
+ *        - If ctx can not be allocated [eFrameworkunifiedStatusFail]
+ * \~english @par Detail
+ *        - Update the plaintext to ciphertext by symmetric or asymmetric encrypt algorithm.
+ *        - The API can be used by multiple processes.
+ * \~english @par Classification
+ *        Public
+ * \~english @par Type
+ *        Sync
+ * \~english @see
+ *        EncryptStart, EncryptFinish, EncryptCleanup
+ */
+EFrameworkunifiedStatus EncryptUpdate(void* ctx, const uint8_t* in, uint32_t in_len,
+                         uint8_t* out, uint32_t out_len, uint32_t* true_length);
+
+/**
+ * \ingroup EncryptFinish
+ * \~english @par Brief
+ *        Encrypt the final plaintext information.
+ * \~english @param [in] ctx
+ *        void*    - The encrypt information context handle.
+ * \~english @param [out] out
+ *        uint8_t*      - The ciphertext after plaintext had been encrypted.
+ *                        out is useless for RSA asymmetric encrypt.
+ * \~english @param [in] out_len
+ *        uint32_t      - The final output buffer length.
+ *                        out_len shall not be less than 1 block size for symmetric encrypt.
+ *                        out_len is useless for RSA asymmetric encrypt.
+ * \~english @param [out] true_length
+ *        uint32_t*      - The ciphertext length.
+ *                         true_length is useless for RSA asymmetric encrypt.
+ * \~english @retval eFrameworkunifiedStatusOK :          indicates success
+ * \~english @retval eFrameworkunifiedStatusFail :        indicates the hardware/handle initialize fail, hardware I/O operation fail,
+ *                                           hardware device busy or allocate context handle fail.
+ * \~english @retval eFrameworkunifiedStatusInvldParam :  indicates parameter error.
+ * \~english @par Prerequisite
+ *        - EncryptStart() and EncryptUpdate() were called successfully.
+ * \~english @par Change of internal state
+ *        - Change of internal state according to the API does not occur
+ * \~english @par Conditions of processing failure
+ *        - If the parameter "ctx" is NULL [eFrameworkunifiedStatusInvldParam]
+ *        - If the parameter "out" is NULL [eFrameworkunifiedStatusInvldParam]
+ *        - If the parameter "out_len" is less than 1 block size
+ *          for symmetric encrypt [eFrameworkunifiedStatusInvldParam]
+ *        - If the parameter "true_length" is NULL [eFrameworkunifiedStatusInvldParam]
+ *        - If the hardware/handle init failed [eFrameworkunifiedStatusFail]
+ *        - If the hardware I/O operation failed [eFrameworkunifiedStatusFail]
+ *        - If the hardware device is busy [eFrameworkunifiedStatusFail]
+ *        - If ctx can not be allocated [eFrameworkunifiedStatusFail]
+ * \~english @par Detail
+ *        - Update the final plaintext to ciphertext for symmetric encrypt and do nothing for asymmetric encrypt.
+ *        - The API can be used by multiple processes.
+ * \~english @par Classification
+ *        Public
+ * \~english @par Type
+ *        Sync
+ * \~english @see
+ *        EncryptStart, EncryptUpdate, EncryptCleanup
+ */
+EFrameworkunifiedStatus EncryptFinish(void* ctx, uint8_t* out, uint32_t out_len, uint32_t* true_length);
+
+/**
+ * \ingroup EncryptCleanup
+ * \~english @par Brief
+ *        Clean up encrypt context information.
+ * \~english @param [in] ctx
+ *        void*    - The encrypt information context handle.
+ * \~english @retval eFrameworkunifiedStatusOK :          indicates success
+ * \~english @retval eFrameworkunifiedStatusInvldParam :  indicates parameter error.
+ * \~english @par Prerequisite
+ *        - EncryptStart() was called successfully.
+ * \~english @par Change of internal state
+ *        - Change of internal state according to the API does not occur
+ * \~english @par Conditions of processing failure
+ *        - If the parameter "ctx" is NULL [eFrameworkunifiedStatusInvldParam]
+ * \~english @par Detail
+ *        - Clean up encrypt context information.
+ *        - The API can be used by multiple processes.
+ * \~english @par Classification
+ *        Public
+ * \~english @par Type
+ *        Sync
+ * \~english @see
+ *        EncryptStart, EncryptUpdate, EncryptFinish
+ */
+EFrameworkunifiedStatus EncryptCleanup(void* ctx);
+
+/**
+ * \ingroup DecryptStart
+ * \~english @par Brief
+ *        Initialize the decrypt context information.
+ * \~english @param [in] cipher_type
+ *        enum CipherType    - Cipher type.
+ * \~english @param [in] param
+ *        union CipherParameter*      - Cipher parameter
+ * \~english @param [in] key
+ *        union KeyParam*      - Key parameter
+ * \~english @param [out] ctx
+ *        void**      - The decrypt information context handle.
+ * \~english @retval eFrameworkunifiedStatusOK :          indicates success
+ * \~english @retval eFrameworkunifiedStatusFail :        indicates the hardware/handle initialize fail or hardware I/O
+ *                                           operation fail or hardware device busy or allocate context handle fail.
+ * \~english @retval eFrameworkunifiedStatusInvldParam :  indicates parameter error.
+ * \~english @par Prerequisite
+ *        - None.
+ * \~english @par Change of internal state
+ *        - Change of internal state according to the API does not occur.
+ * \~english @par Conditions of processing failure
+ *        - If the parameter "cipher_type" is less than SYMMETRIC_CIPHER_AES
+ *          or greater than ASYMMETRIC_CIPHER_ECDSA [eFrameworkunifiedStatusInvldParam]
+ *        - If the parameter "param" is NULL [eFrameworkunifiedStatusInvldParam]
+ *        - If the parameter "key" is NULL [eFrameworkunifiedStatusInvldParam]
+ *        - If the parameter "ctx" is NULL [eFrameworkunifiedStatusInvldParam]
+ *        - If the hardware/handle initialize failed [eFrameworkunifiedStatusFail]
+ *        - If the hardware I/O operation failed [eFrameworkunifiedStatusFail]
+ *        - If the hardware device is busy [eFrameworkunifiedStatusFail]
+ *        - If ctx can not be allocated [eFrameworkunifiedStatusFail]
+ * \~english @par Detail
+ *        - Initialize the decrypt context information according to cipher type, cipher parameter and key parameter.
+ *        - If DecryptStart() was called successfully, DecryptCleanup() should be called
+ *          to clean up decrypt context information.
+ *        - The API can be used by multiple processes.
+ * \~english @par Classification
+ *        Public
+ * \~english @par Type
+ *        Sync
+ * \~english @see
+ *        DecryptUpdate, DecryptFinish, DecryptCleanup
+ */
+EFrameworkunifiedStatus DecryptStart(enum CipherType cipher_type, union CipherParameter* param,
+                        union KeyParam *key, void** ctx);
+
+/**
+ * \ingroup DecryptUpdate
+ * \~english @par Brief
+ *        Decrypt ciphertext information.
+ * \~english @param [in] ctx
+ *        void*    - The decrypt information context handle.
+ * \~english @param [in] in
+ *        const uint8_t*      - The ciphertext to be decrypted.
+ * \~english @param [in] in_len
+ *        uint32_t      - The input buffer length
+ *                        in_len shall be greater than 0 for symmetric decrypt.
+ *                        in_len shall be equal to RSA_PRIVATE_EXPONENT_MAX_SIZE/8
+ *                        for RSA asymmetric decrypt.
+ * \~english @param [out] out
+ *        uint8_t*      - The plaintext after ciphertext had been decrypted.
+ * \~english @param [in] out_len
+ *        uint32_t      - The output buffer length.
+ *                        out_len shall not be less than in_len + 1 block size for symmetric decrypt.
+ *                        out_len shall not be less than RSA_PRIVATE_EXPONENT_MAX_SIZE/8 - RSA_PADDING_MINIMUM_SIZE
+ *                        for RSA asymmetric decrypt.
+ * \~english @param [out] true_length
+ *        uint32_t*      - The plaintext length.
+ * \~english @retval eFrameworkunifiedStatusOK :          indicates success
+ * \~english @retval eFrameworkunifiedStatusFail :        indicates the hardware/handle initialize fail, hardware I/O operation fail,
+ *                                           hardware device busy or allocate context handle fail.
+ * \~english @retval eFrameworkunifiedStatusInvldParam :  indicates parameter error.
+ * \~english @par Prerequisite
+ *        - DecryptStart() was called successfully.
+ * \~english @par Change of internal state
+ *        - Change of internal state according to the API does not occur
+ * \~english @par Conditions of processing failure
+ *        - If the parameter "ctx" is NULL [eFrameworkunifiedStatusInvldParam]
+ *        - If the parameter "in" is NULL [eFrameworkunifiedStatusInvldParam]
+ *        - If the parameter "in_len" is 0 for symmetric decrypt [eFrameworkunifiedStatusInvldParam]
+ *        - If the parameter "in_len" isn't equal to
+ *          RSA_PRIVATE_EXPONENT_MAX_SIZE/8 for RSA asymmetric decrypt [eFrameworkunifiedStatusInvldParam]
+ *        - If the parameter "out is NULL [eFrameworkunifiedStatusInvldParam]
+ *        - If the parameter "out_len" is less than in_len
+ *          for symmetric decrypt [eFrameworkunifiedStatusInvldParam]
+ *        - If the parameter "out_len" is less than RSA_PRIVATE_EXPONENT_MAX_SIZE/8 - RSA_PADDING_MINIMUM_SIZE
+ *          for RSA asymmetric decrypt [eFrameworkunifiedStatusInvldParam]
+ *        - If the parameter "true_length" is NULL [eFrameworkunifiedStatusInvldParam]
+ *        - If the hardware/handle init failed [eFrameworkunifiedStatusFail]
+ *        - If the hardware I/O operation failed [eFrameworkunifiedStatusFail]
+ *        - If the hardware device is busy [eFrameworkunifiedStatusFail]
+ *        - If ctx can not be allocated [eFrameworkunifiedStatusFail]
+ * \~english @par Detail
+ *        - Update the ciphertext to plaintext by symmetric or asymmetric decrypt algorithm.
+ *        - The API can be used by multiple processes.
+ * \~english @par Classification
+ *        Public
+ * \~english @par Type
+ *        Sync
+ * \~english @see
+ *        DecryptStart, DecryptFinish, DecryptCleanup
+ */
+EFrameworkunifiedStatus DecryptUpdate(void* ctx, const uint8_t* in, uint32_t in_len,
+                         uint8_t* out, uint32_t out_len, uint32_t* true_length);
+
+/**
+ * \ingroup DecryptFinish
+ * \~english @par Brief
+ *        Decrypt the final ciphertext information.
+ * \~english @param [in] ctx
+ *        void*    - The decrypt information context handle.
+ * \~english @param [out] out
+ *        uint8_t*      - The plaintext after ciphertext had been decrypted.
+ *                        out is useless for RSA asymmetric decrypt.
+ * \~english @param [in] out_len
+ *        uint32_t      - The final output buffer length.
+ *                        out_len shall not be less than 1 block size for symmetric decrypt.
+ *                        out_len is useless for RSA asymmetric decrypt.
+ * \~english @param [out] true_length
+ *        uint32_t*      - The plaintext length.
+ *                         true_length is useless for RSA asymmetric decrypt.
+ * \~english @retval eFrameworkunifiedStatusOK :          indicates success
+ * \~english @retval eFrameworkunifiedStatusFail :        indicates the hardware/handle initialize fail, hardware I/O operation fail,
+ *                                           hardware device busy or allocate context handle fail.
+ * \~english @retval eFrameworkunifiedStatusInvldParam :  indicates parameter error.
+ * \~english @par Prerequisite
+ *        - DecryptStart() and DecryptUpdate() were called successfully.
+ * \~english @par Change of internal state
+ *        - Change of internal state according to the API does not occur
+ * \~english @par Conditions of processing failure
+ *        - If the parameter "ctx" is NULL [eFrameworkunifiedStatusInvldParam]
+ *        - If the parameter "out" is NULL [eFrameworkunifiedStatusInvldParam]
+ *        - If the parameter "out_len" is less than 1 block size
+ *          for symmetric decrypt [eFrameworkunifiedStatusInvldParam]
+ *        - If the parameter "true_length" is NULL [eFrameworkunifiedStatusInvldParam]
+ *        - If the hardware/handle init failed [eFrameworkunifiedStatusFail]
+ *        - If the hardware I/O operation failed [eFrameworkunifiedStatusFail]
+ *        - If the hardware device is busy [eFrameworkunifiedStatusFail]
+ *        - If ctx can not be allocated [eFrameworkunifiedStatusFail]
+ * \~english @par Detail
+ *        - Update the final ciphertext to plaintext for symmetric decrypt and do nothing for asymmetric decrypt.
+ *        - The API can be used by multiple processes.
+ * \~english @par Classification
+ *        Public
+ * \~english @par Type
+ *        Sync
+ * \~english @see
+ *        DecryptStart, DecryptUpdate, DecryptCleanup
+ */
+EFrameworkunifiedStatus DecryptFinish(void* ctx, uint8_t* out, uint32_t out_len, uint32_t* true_length);
+
+/**
+ * \ingroup DecryptCleanup
+ * \~english @par Brief
+ *        Clean up decrypt context information.
+ * \~english @param [in] ctx
+ *        void*    - The decrypt information context handle.
+ * \~english @retval eFrameworkunifiedStatusOK :          indicates success
+
+ * \~english @retval eFrameworkunifiedStatusInvldParam :  indicates parameter error.
+
+ * \~english @par Prerequisite
+ *        - DecryptStart() was called successfully.
+ * \~english @par Change of internal state
+ *        - Change of internal state according to the API does not occur
+ * \~english @par Conditions of processing failure
+ *        - If the parameter "ctx" is NULL [eFrameworkunifiedStatusInvldParam]
+ * \~english @par Detail
+ *        - Clean up decrypt context information.
+ *        - The API can be used by multiple processes.
+ * \~english @par Classification
+ *        Public
+ * \~english @par Type
+ *        Sync
+ * \~english @see
+ *        DecryptStart, DecryptUpdate, DecryptFinish
+ */
+EFrameworkunifiedStatus DecryptCleanup(void* ctx);
+
+/**
+ * \ingroup HashStart
+ * \~english @par Brief
+ *        Initialize hash context information.
+ * \~english @param [in] hash_type
+ *        enum HashType    - Hash type.
+ * \~english @param [out] ctx
+ *        void**      - The hash information context handle.
+ * \~english @retval eFrameworkunifiedStatusOK :          indicates success
+ * \~english @retval eFrameworkunifiedStatusFail :        indicates the hardware/handle initialize fail or hardware I/O operation
+ *                                           fail or hardware device busy or allocate context handle fail.
+ * \~english @retval eFrameworkunifiedStatusInvldParam :  indicates parameter error.
+ * \~english @par Prerequisite
+ *        - None.
+ * \~english @par Change of internal state
+ *        - Change of internal state according to the API does not occur.
+ * \~english @par Conditions of processing failure
+ *        - If the parameter "hash_type" less than HASH_TYPE_MD5
+ *          or greater than HASH_TYPE_SHA512 [eFrameworkunifiedStatusInvldParam]
+ *        - If the parameter "ctx" is NULL [eFrameworkunifiedStatusInvldParam]
+ *        - If the hardware/handle initialize failed [eFrameworkunifiedStatusFail]
+ *        - If the hardware I/O operation failed [eFrameworkunifiedStatusFail]
+ *        - If the hardware device is busy [eFrameworkunifiedStatusFail]
+ *        - If ctx can not be allocated [eFrameworkunifiedStatusFail]
+ * \~english @par Detail
+ *        - Initialize hash context information according to hash type.
+ *        - If HashStart() was called successfully, HashCleanup() should be called
+ *          to clean up hash context information.
+ *        - The API can be used by multiple processes.
+ * \~english @par Classification
+ *        Public
+ * \~english @par Type
+ *        Sync
+ * \~english @see
+ *        HashUpdate, HashFinish, HashCleanup
+ */
+EFrameworkunifiedStatus HashStart(enum HashType hash_type, void** ctx);
+
+/**
+ * \ingroup HashUpdate
+ * \~english @par Brief
+ *        Caculate hash value of input data.
+ * \~english @param [in] ctx
+ *        void*    - The hash information context handle.
+ * \~english @param [in] in
+ *        const uint8_t*      - The input data to be hashed.
+ * \~english @param [in] in_len
+ *        uint32_t      - The input buffer length
+ * \~english @retval eFrameworkunifiedStatusOK :          indicates success
+ * \~english @retval eFrameworkunifiedStatusFail :        indicates the hardware/handle initialize fail, hardware I/O operation fail,
+ *                                           hardware device busy or allocate context handle fail.
+ * \~english @retval eFrameworkunifiedStatusInvldParam :  indicates parameter error.
+ * \~english @par Prerequisite
+ *        - HashStart() was called successfully.
+ * \~english @par Change of internal state
+ *        - Change of internal state according to the API does not occur
+ * \~english @par Conditions of processing failure
+ *        - If the parameter "ctx" is NULL [eFrameworkunifiedStatusInvldParam]
+ *        - If the parameter "in" is NULL [eFrameworkunifiedStatusInvldParam]
+ *        - If the parameter "in_len" is 0 [eFrameworkunifiedStatusInvldParam]
+ *        - If the hardware/handle init failed [eFrameworkunifiedStatusFail]
+ *        - If the hardware I/O operation failed [eFrameworkunifiedStatusFail]
+ *        - If the hardware device is busy [eFrameworkunifiedStatusFail]
+ *        - If ctx can not be allocated [eFrameworkunifiedStatusFail]
+ * \~english @par Detail
+ *        - Caculate hash value of input data.
+ *        - The API can be used by multiple processes.
+ * \~english @par Classification
+ *        Public
+ * \~english @par Type
+ *        Sync
+ * \~english @see
+ *        HashStart, HashFinish, HashCleanup
+ */
+EFrameworkunifiedStatus HashUpdate(void* ctx, const uint8_t* in, uint32_t in_len);
+
+/**
+ * \ingroup HashFinish
+ * \~english @par Brief
+ *        Caculate final message digest.
+ * \~english @param [in] ctx
+ *        void*    - The hash information context handle.
+ * \~english @param [out] out
+ *        uint8_t*      - The message digest after all input data had been hashed.
+ * \~english @param [in] out_len
+ *        uint32_t      - The output buffer length.
+ * \~english @param [out] true_length
+ *        uint32_t*      - The message digest length.
+ * \~english @retval eFrameworkunifiedStatusOK :          indicates success
+ * \~english @retval eFrameworkunifiedStatusFail :        indicates the hardware/handle initialize fail, hardware I/O operation fail,
+ *                                           hardware device busy or allocate context handle fail.
+ * \~english @retval eFrameworkunifiedStatusInvldParam :  indicates parameter error.
+ * \~english @par Prerequisite
+ *        - HashStart() and HashUpdate() were called successfully.
+ * \~english @par Change of internal state
+ *        - Change of internal state according to the API does not occur
+ * \~english @par Conditions of processing failure
+ *        - If the parameter "ctx" is NULL [eFrameworkunifiedStatusInvldParam]
+ *        - If the parameter "out" is NULL [eFrameworkunifiedStatusInvldParam]
+ *        - If the parameter "out_len" is 0 [eFrameworkunifiedStatusInvldParam]
+ *        - If the parameter "true_length" is NULL [eFrameworkunifiedStatusInvldParam]
+ *        - If the hardware/handle init failed [eFrameworkunifiedStatusFail]
+ *        - If the hardware I/O operation failed [eFrameworkunifiedStatusFail]
+ *        - If the hardware device is busy [eFrameworkunifiedStatusFail]
+ *        - If ctx can not be allocated [eFrameworkunifiedStatusFail]
+ * \~english @par Detail
+ *        - Caculate final message digest.
+ *        - The API can be used by multiple processes.
+ * \~english @par Classification
+ *        Public
+ * \~english @par Type
+ *        Sync
+ * \~english @see
+ *        HashStart, HashUpdate, HashCleanup
+ */
+EFrameworkunifiedStatus HashFinish(void* ctx, uint8_t* out, uint32_t out_len, uint32_t* true_length);
+
+/**
+ * \ingroup HashCleanup
+ * \~english @par Brief
+ *        Clean up hash context information.
+ * \~english @param [in] ctx
+ *        void*    - The hash information context handle.
+ * \~english @retval eFrameworkunifiedStatusOK :          indicates success
+ * \~english @retval eFrameworkunifiedStatusInvldParam :  indicates parameter error.
+ * \~english @par Prerequisite
+ *        - HashStart() was called successfully.
+ * \~english @par Change of internal state
+ *        - Change of internal state according to the API does not occur
+ * \~english @par Conditions of processing failure
+ *        - If the parameter "ctx" is NULL [eFrameworkunifiedStatusInvldParam]
+ * \~english @par Detail
+ *        - Clean up hash context information.
+ *        - The API can be used by multiple processes.
+ * \~english @par Classification
+ *        Public
+ * \~english @par Type
+ *        Sync
+ * \~english @see
+ *        HashStart, HashUpdate, HashFinish
+ */
+EFrameworkunifiedStatus HashCleanup(void* ctx);
+
+/**
+ * \ingroup RandomInit
+ * \~english @par Brief
+ *        Initialize random number context information.
+ * \~english @param [out] ctx
+ *        void**      - The random number information context handle.
+ * \~english @param [in] seed_buffer
+ *        uint8_t*    - The random number seed buffer.
+ * \~english @param [in] buffer_len
+ *        uint32_t    - The random number seed buffer length.
+ * \~english @retval eFrameworkunifiedStatusOK :          indicates success
+ * \~english @retval eFrameworkunifiedStatusFail :        indicates the hardware/handle initialize fail or hardware I/O operation
+ *                                           fail or hardware device busy or allocate context handle fail.
+ * \~english @retval eFrameworkunifiedStatusInvldParam :  indicates parameter error.
+ * \~english @par Prerequisite
+ *        - None.
+ * \~english @par Change of internal state
+ *        - Change of internal state according to the API does not occur.
+ * \~english @par Conditions of processing failure
+ *        - If the parameter "ctx" is NULL [eFrameworkunifiedStatusInvldParam]
+ *        - If the parameter "seed_buffer" is NULL [eFrameworkunifiedStatusInvldParam]
+ *        - If the parameter "buffer_len" is 0 [eFrameworkunifiedStatusInvldParam]
+ *        - If the hardware/handle initialize failed [eFrameworkunifiedStatusFail]
+ *        - If the hardware I/O operation failed [eFrameworkunifiedStatusFail]
+ *        - If the hardware device is busy [eFrameworkunifiedStatusFail]
+ *        - If ctx can not be allocated [eFrameworkunifiedStatusFail]
+ * \~english @par Detail
+ *        - Initialize random number context information according to random number seed.
+ *        - If RandomInit() was called successfully, RandomCleanup() should be called to
+ *          clean up random number context information. If RandomInit() was called faild,
+ *          RandomCleanup() must not be called.
+ *        - The API can be used by multiple processes.
+ * \~english @par Classification
+ *        Public
+ * \~english @par Type
+ *        Sync
+ * \~english @see
+ *        RandomGet, RandomCleanup
+ */
+EFrameworkunifiedStatus RandomInit(void** ctx, uint8_t* seed_buffer, uint32_t buffer_len);
+
+/**
+ * \ingroup RandomGet
+ * \~english @par Brief
+ *        Get random number.
+ * \~english @param [in] ctx
+ *        void*    - The random number information context handle.
+ * \~english @param [out] out
+ *        uint8_t*      - The random number that caculated by random number seed.
+ * \~english @param [in] out_len
+ *        uint32_t      - The output buffer length.
+ * \~english @param [out] true_length
+ *        uint32_t*      - The random number length.
+ * \~english @retval eFrameworkunifiedStatusOK :          indicates success
+ * \~english @retval eFrameworkunifiedStatusFail :        indicates the hardware/handle initialize fail, hardware I/O operation fail,
+ *                                           hardware device busy or allocate context handle fail.
+ * \~english @retval eFrameworkunifiedStatusInvldParam :  indicates parameter error.
+ * \~english @par Prerequisite
+ *        - RandomInit() was called successfully.
+ * \~english @par Change of internal state
+ *        - Change of internal state according to the API does not occur
+ * \~english @par Conditions of processing failure
+ *        - If the parameter "ctx" is NULL [eFrameworkunifiedStatusInvldParam]
+ *        - If the parameter "out" is NULL [eFrameworkunifiedStatusInvldParam]
+ *        - If the parameter "out_len" is 0 [eFrameworkunifiedStatusInvldParam]
+ *        - If the parameter "true_length" is NULL [eFrameworkunifiedStatusInvldParam]
+ *        - If the hardware/handle init failed [eFrameworkunifiedStatusFail]
+ *        - If the hardware I/O operation failed [eFrameworkunifiedStatusFail]
+ *        - If the hardware device is busy [eFrameworkunifiedStatusFail]
+ *        - If ctx can not be allocated [eFrameworkunifiedStatusFail]
+ * \~english @par Detail
+ *        - Get random number.
+ *        - The API can be used by multiple processes.
+ * \~english @par Classification
+ *        Public
+ * \~english @par Type
+ *        Sync
+ * \~english @see
+ *        RandomInit, RandomCleanup
+ */
+EFrameworkunifiedStatus RandomGet(void* ctx, uint8_t* out, uint32_t out_len, uint32_t* true_length);
+
+/**
+ * \ingroup RandomCleanup
+ * \~english @par Brief
+ *        Clean up random number context information.
+ * \~english @param [in] ctx
+ *        void*    - The random number information context handle.
+ * \~english @retval eFrameworkunifiedStatusOK :          indicates success
+ * \~english @retval eFrameworkunifiedStatusInvldParam :  indicates parameter error.
+ * \~english @par Prerequisite
+ *        - RandomInit() was called successfully.
+ * \~english @par Change of internal state
+ *        - Change of internal state according to the API does not occur
+ * \~english @par Conditions of processing failure
+ *        - If the parameter "ctx" is NULL [eFrameworkunifiedStatusInvldParam]
+ * \~english @par Detail
+ *        - Clean up random number context information.
+ *        - The API can be used by multiple processes.
+ * \~english @par Classification
+ *        Public
+ * \~english @par Type
+ *        Sync
+ * \~english @see
+ *        RandomInit, RandomGet
+ */
+EFrameworkunifiedStatus RandomCleanup(void* ctx);
+
+/**
+ * \ingroup ResetSecurityIC
+ * \~english @par Brief
+ *        Security IC Reset.
+ * \~english @param none
+ * \~english @retval eFrameworkunifiedStatusOK :    indicates success
+ * \~english @retval eFrameworkunifiedStatusFail :  indicates the hardware initialize fail, hardware I/O operation fail,
+ *                                     hardware device busy.
+ * \~english @par Prerequisite
+ *        - None.
+ * \~english @par Change of internal state
+ *        - Change of internal state according to the API does not occur
+ * \~english @par Conditions of processing failure
+ *        - If the hardware initialize failed [eFrameworkunifiedStatusFail]
+ *        - If the hardware I/O operation failed [eFrameworkunifiedStatusFail]
+ *        - If the hardware device is busy [eFrameworkunifiedStatusFail]
+ * \~english @par Classification
+ *        Public
+ * \~english @par Type
+ *        Sync
+ * \~english @par Detail
+ *        - Security IC Reset.
+ *        - The API can be used by multiple processes.
+ *        - This API does not cleanup context information when EncryptStart(), DecryptStart() or HashStart() is successfull.
+ *          Use EncryptCleanup(), DecryptCleanup() or RandomCleanup() to cleanup context information.
+ * \~english @see
+ *        None
+ */
+EFrameworkunifiedStatus ResetSecurityIC(void);
+
+/** @}*/  // end of security_hal
+/** @}*/  // end of update_service
+
+#endif  // HAL_API_SECURITY_HAL_H_
diff --git a/inc/security_hal_securityhallog.h b/inc/security_hal_securityhallog.h
new file mode 100644
index 00000000..44de2ace
--- /dev/null
+++ b/inc/security_hal_securityhallog.h
@@ -0,0 +1,76 @@
+/*
+ * @copyright Copyright (c) 2018-2020 TOYOTA MOTOR CORPORATION.
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+#ifndef INC_SECURITY_HAL_SECURITYHALLOG_H_
+#define INC_SECURITY_HAL_SECURITYHALLOG_H_
+
+#include <native_service/ns_logger_if.h>
+
+#define ZONE_INIT         ZONEMASK(10)
+#define ZONE_FUNC         ZONEMASK(11)
+#define ZONE_MEM          ZONEMASK(12)
+#define ZONE_13           ZONEMASK(13)
+#define ZONE_14           ZONEMASK(14)
+#define ZONE_15           ZONEMASK(15)
+#define ZONE_16           ZONEMASK(16)
+#define ZONE_17           ZONEMASK(17)
+#define ZONE_18           ZONEMASK(18)
+#define ZONE_19           ZONEMASK(19)
+#define ZONE_20           ZONEMASK(20)
+#define ZONE_21           ZONEMASK(21)
+#define ZONE_22           ZONEMASK(22)
+#define ZONE_23           ZONEMASK(23)
+#define ZONE_24           ZONEMASK(24)
+#define ZONE_25           ZONEMASK(25)
+#define ZONE_26           ZONEMASK(26)
+#define ZONE_27           ZONEMASK(27)
+#define ZONE_28           ZONEMASK(28)
+#define ZONE_INFO         ZONEMASK(29)
+#define ZONE_WARN         ZONEMASK(30)
+#define ZONE_ERR          ZONEMASK(31)
+
+#define ZONE_TEXT_10      "Init"
+#define ZONE_TEXT_11      "Function"
+#define ZONE_TEXT_12      "Memory"
+#define ZONE_TEXT_13      ""
+#define ZONE_TEXT_14      ""
+#define ZONE_TEXT_15      ""
+#define ZONE_TEXT_16      ""
+#define ZONE_TEXT_17      ""
+#define ZONE_TEXT_18      ""
+#define ZONE_TEXT_19      ""
+#define ZONE_TEXT_20      ""
+#define ZONE_TEXT_21      ""
+#define ZONE_TEXT_22      ""
+#define ZONE_TEXT_23      ""
+#define ZONE_TEXT_24      ""
+#define ZONE_TEXT_25      ""
+#define ZONE_TEXT_26      ""
+#define ZONE_TEXT_27      ""
+#define ZONE_TEXT_28      ""
+#define ZONE_TEXT_29      "Info"
+#define ZONE_TEXT_30      "Warning"
+#define ZONE_TEXT_31      "Error"
+
+#ifndef  FRAMEWORKUNIFIEDLOGOPTIONS
+#define FRAMEWORKUNIFIEDLOGOPTIONS (LSHAREDMEM)  // LPRINT , LMSGQ, LSLOGGER
+#endif
+
+#ifndef FRAMEWORKUNIFIEDLOGAPPZONES
+#define FRAMEWORKUNIFIEDLOGAPPZONES ZONE_ERR, ZONE_WARN, ZONE_INFO
+#endif
+
+extern const CHAR AppName[];  // NOLINT (defind outside)
+#endif  // INC_SECURITY_HAL_SECURITYHALLOG_H_
diff --git a/src/security_hal.cpp b/src/security_hal.cpp
new file mode 100644
index 00000000..ee9f7ea0
--- /dev/null
+++ b/src/security_hal.cpp
@@ -0,0 +1,615 @@
+/*
+ * @copyright Copyright (c) 2018-2020 TOYOTA MOTOR CORPORATION.
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+#include "security_hal.h"
+
+#include <errno.h>
+#include <stdlib.h>
+#include <string.h>
+
+#include "security_hal_securityhallog.h"
+
+#define MD5_DIGEST_LENGTH 16      // md5 digest length
+#define SHA1_DIGEST_LENGTH 20     // sha1 digest length
+#define SHA224_DIGEST_LENGTH 28   // sha224 digest length
+#define SHA256_DIGEST_LENGTH 32   // sha256 digest length
+#define SHA384_DIGEST_LENGTH 48   // sha384 digest length
+#define SHA512_DIGEST_LENGTH 64   // sha512 digest length
+#define BITS_PER_BYTE 8           // the number of bits per byte
+#define KEY_SOURCE_SIZE_128  16   // the size of key source is 128 bits
+#define KEY_SOURCE_SIZE_192  24   // the size of key source is 192 bits
+#define KEY_SOURCE_SIZE_256  32   // the size of key source is 256 bits
+
+/**
+ * the max length of input buffer for RSA asymmetric encrypt or
+ * the minimum length of output buffer for RSA asymmetric decrypt
+ */
+#define RSA_PRIVATE_MAX_SIZE_BYTE \
+        (RSA_PRIVATE_EXPONENT_MAX_SIZE/BITS_PER_BYTE - RSA_PADDING_MINIMUM_SIZE)
+
+/**
+ * cipher context information
+ */
+struct CipherContext {
+  enum CipherType cipher_type;
+  union CipherParameter cipher_parameter;
+  union KeyParam key_param;
+};
+
+/**
+ * hash context information
+ */
+struct HashContext {
+  enum HashType hash_type;
+};
+
+/**
+ * random number context information
+ */
+struct RandomContext {
+  uint8_t* seed_buffer;
+  uint32_t buffer_len;
+};
+
+bool CheckParameterVaildity(enum CipherType cipher_type,
+                            union CipherParameter* param, union KeyParam* key) {
+  if (SYMMETRIC_CIPHER_AES == cipher_type) {
+    // check cipher mode for symmetric encrypt/decrypt
+    if (SYMMETRIC_CIPHER_MODE_BLOCK_ECB != param->symmetric.mode &&
+        SYMMETRIC_CIPHER_MODE_BLOCK_CBC != param->symmetric.mode &&
+        SYMMETRIC_CIPHER_MODE_BLOCK_CFB != param->symmetric.mode &&
+        SYMMETRIC_CIPHER_MODE_BLOCK_OFB != param->symmetric.mode) {
+      FRAMEWORKUNIFIEDLOG(ZONE_ERR, __FUNCTION__,
+        "don't support the cipher mode for AES symmetric encrypt/decrypt");
+      return false;
+    }
+    // check cipher block size for AES symmetric encrypt/decrypt
+    if (SYMMETRIC_CIPHER_BLOCK_SIZE_16 != param->symmetric.block_size) {
+      FRAMEWORKUNIFIEDLOG(ZONE_ERR, __FUNCTION__,
+        "don't support the block size for AES symmetric encrypt/decrypt");
+      return false;
+    }
+    // check cipher key type for AES symmetric encrypt/decrypt
+    if (SYMMETRIC_CIPHER_KEY_TYPE_MANAGED != key->symmetric.key_type &&
+        SYMMETRIC_CIPHER_KEY_TYPE_USER != key->symmetric.key_type) {
+      FRAMEWORKUNIFIEDLOG(ZONE_ERR, __FUNCTION__,
+        "don't support the cipher key type for AES symmetric encrypt/decrypt");
+      return false;
+    }
+    if (SYMMETRIC_CIPHER_KEY_TYPE_MANAGED == key->symmetric.key_type) {
+      // check cipher rounds for AES symmetric encrypt/decrypt
+      if (SYMMETRIC_CIPHER_ROUND_10 != param->symmetric.round &&
+          SYMMETRIC_CIPHER_ROUND_12 != param->symmetric.round &&
+          SYMMETRIC_CIPHER_ROUND_14 != param->symmetric.round) {
+        FRAMEWORKUNIFIEDLOG(ZONE_ERR, __FUNCTION__,
+          "don't support the cipher round for AES symmetric encrypt/decrypt");
+        return false;
+     }
+    } else {
+      // check parameter of key provided by user for AES symmetric encrypt/decrypt
+      if (NULL == key->symmetric.key_param.user_key.key) {
+        FRAMEWORKUNIFIEDLOG(ZONE_ERR, __FUNCTION__, "user_key.key is NULL");
+        return false;
+      }
+      if (KEY_SOURCE_SIZE_128 == key->symmetric.key_param.user_key.key_len) {
+        if (SYMMETRIC_CIPHER_ROUND_10 != param->symmetric.round) {
+          FRAMEWORKUNIFIEDLOG(ZONE_ERR, __FUNCTION__,
+          "cipher round should be 10 if key len is 128 bits");
+          return false;
+        }
+      } else if (KEY_SOURCE_SIZE_192 == key->symmetric.key_param.user_key.key_len) {
+        if (SYMMETRIC_CIPHER_ROUND_12 != param->symmetric.round) {
+          FRAMEWORKUNIFIEDLOG(ZONE_ERR, __FUNCTION__,
+          "cipher round should be 12 if key len is 192 bits");
+          return false;
+        }
+      } else if (KEY_SOURCE_SIZE_256 == key->symmetric.key_param.user_key.key_len) {
+        if (SYMMETRIC_CIPHER_ROUND_14 != param->symmetric.round) {
+          FRAMEWORKUNIFIEDLOG(ZONE_ERR, __FUNCTION__,
+          "cipher round should be 14 if key len is 256 bits");
+          return false;
+        }
+      } else {
+        FRAMEWORKUNIFIEDLOG(ZONE_ERR, __FUNCTION__,
+          "key len should be 128, 192 or 256 bits for AES symmetric encrypt/decrypt");
+        return false;
+      }
+      if (SYMMETRIC_CIPHER_MODE_BLOCK_ECB != param->symmetric.mode) {
+        if (NULL == key->symmetric.key_param.user_key.iv) {
+          FRAMEWORKUNIFIEDLOG(ZONE_ERR, __FUNCTION__, "user_key.iv is NULL");
+          return false;
+        }
+        if (key->symmetric.key_param.user_key.iv_len != param->symmetric.block_size) {
+          FRAMEWORKUNIFIEDLOG(ZONE_ERR, __FUNCTION__,
+          "user_key.iv_len is not equal to block size for AES symmetric encrypt/decrypt");
+          return false;
+        }
+      }
+    }
+  } else if (ASYMMETRIC_CIPHER_RSA == cipher_type) {
+    // check the padding mode for RSA asymmetric encrypt/decrypt
+    if (ASYMMETRIC_PADDING_MODE_RSA_PKCS1 != param->asymmetric.mode &&
+        ASYMMETRIC_PADDING_MODE_RSA_SSLV23 != param->asymmetric.mode &&
+        ASYMMETRIC_PADDING_MODE_RSA_NOPADDING != param->asymmetric.mode &&
+        ASYMMETRIC_PADDING_MODE_RSA_OAEP != param->asymmetric.mode &&
+        ASYMMETRIC_PADDING_MODE_RSA_PSS != param->asymmetric.mode) {
+      FRAMEWORKUNIFIEDLOG(ZONE_ERR, __FUNCTION__,
+        "don't support the cipher mode for asymmetric encrypt/decrypt");
+      return false;
+    }
+    // check cipher key type for RSA asymmetric encrypt/decrypt
+    if (ASYMMETRIC_CIPHER_KEY_TYPE_MANAGED != key->asymmetric.key_type &&
+        ASYMMETRIC_CIPHER_KEY_TYPE_USER_PUBLIC != key->asymmetric.key_type &&
+        ASYMMETRIC_CIPHER_KEY_TYPE_USER_PRIVATE != key->asymmetric.key_type) {
+      FRAMEWORKUNIFIEDLOG(ZONE_ERR, __FUNCTION__,
+        "don't support the cipher key type for asymmetric encrypt/decrypt");
+      return false;
+    }
+    if (ASYMMETRIC_CIPHER_KEY_TYPE_USER_PUBLIC == key->asymmetric.key_type) {
+      // check parameter of public key provided by user for RSA asymmetric encrypt/decrypt
+      if (NULL == key->asymmetric.key_param.user_key.public_key) {
+        FRAMEWORKUNIFIEDLOG(ZONE_ERR, __FUNCTION__, "public_key is NULL");
+        return false;
+      }
+      if (RSA_PUBLIC_EXPONENT_MAX_SIZE <
+          key->asymmetric.key_param.user_key.public_key->rsa.e_length ||
+          RSA_MODULUS_MAX_SIZE <
+          key->asymmetric.key_param.user_key.public_key->rsa.n_length) {
+        FRAMEWORKUNIFIEDLOG(ZONE_ERR, __FUNCTION__,
+          "e_length or n_length is too large, e_length:%d, n_length:%d",
+          key->asymmetric.key_param.user_key.public_key->rsa.e_length,
+          key->asymmetric.key_param.user_key.public_key->rsa.n_length);
+        return false;
+      }
+    } else if (ASYMMETRIC_CIPHER_KEY_TYPE_USER_PRIVATE == key->asymmetric.key_type) {
+      // check parameter of key provided by user for RSA asymmetric encrypt/decrypt
+      if (NULL == key->asymmetric.key_param.user_key.private_key) {
+        FRAMEWORKUNIFIEDLOG(ZONE_ERR, __FUNCTION__, "private_key is NULL");
+        return false;
+      }
+      if (RSA_PRIVATE_EXPONENT_MAX_SIZE <
+          key->asymmetric.key_param.user_key.private_key->rsa.d_length ||
+          RSA_MODULUS_MAX_SIZE <
+          key->asymmetric.key_param.user_key.private_key->rsa.n_length) {
+        FRAMEWORKUNIFIEDLOG(ZONE_ERR, __FUNCTION__,
+          "d_length or n_length is too large, d_length:%d, n_length:%d",
+          key->asymmetric.key_param.user_key.private_key->rsa.d_length,
+          key->asymmetric.key_param.user_key.private_key->rsa.n_length);
+        return false;
+      }
+    }
+  } else {
+    FRAMEWORKUNIFIEDLOG(ZONE_ERR, __FUNCTION__, "the cipher_type isn't support");
+    return false;
+  }
+  return true;
+}
+
+// Initialize the encrypt context information
+EFrameworkunifiedStatus EncryptStart(enum CipherType cipher_type, union CipherParameter* param,
+                        union KeyParam* key, void** ctx) {
+  if (SYMMETRIC_CIPHER_AES != cipher_type && ASYMMETRIC_CIPHER_RSA != cipher_type) {
+    FRAMEWORKUNIFIEDLOG(ZONE_ERR, __FUNCTION__, "the cipher_type isn't support");
+    return eFrameworkunifiedStatusInvldParam;
+  }
+  if (NULL == param || NULL == key || NULL == ctx) {
+    FRAMEWORKUNIFIEDLOG(ZONE_ERR, __FUNCTION__,
+      "param, key or ctx is NULL, param:%p key:%p ctx:%p", param, key, ctx);
+    return eFrameworkunifiedStatusInvldParam;
+  }
+  bool ret = CheckParameterVaildity(cipher_type, param, key);
+  if (true != ret) {
+    FRAMEWORKUNIFIEDLOG(ZONE_ERR, __FUNCTION__, "parameter error");
+    return eFrameworkunifiedStatusInvldParam;
+  }
+
+  void* ctx_temp = malloc(sizeof(CipherContext));
+  if (NULL == ctx_temp) {
+    FRAMEWORKUNIFIEDLOG(ZONE_ERR, __FUNCTION__, "Failed to malloc %lu byte for ctx, errno=%d",
+      sizeof(CipherContext), errno);
+    return eFrameworkunifiedStatusFail;
+  }
+  memset(ctx_temp, 0, sizeof(CipherContext));
+  CipherContext* pcipher_context = reinterpret_cast<CipherContext*>(ctx_temp);
+  pcipher_context->cipher_type = cipher_type;
+  pcipher_context->cipher_parameter = *param;
+  pcipher_context->key_param = *key;
+  *ctx = ctx_temp;
+  return eFrameworkunifiedStatusOK;
+}
+
+// Encrypt plaintext information
+EFrameworkunifiedStatus EncryptUpdate(void* ctx, const uint8_t* in, uint32_t in_len,
+                      uint8_t* out, uint32_t out_len, uint32_t* true_length) {
+  if (NULL == ctx || NULL == in || NULL == out || NULL == true_length) {
+    FRAMEWORKUNIFIEDLOG(ZONE_ERR, __FUNCTION__,
+      "ctx, in, out or true_length is NULL, ctx:%p in:%p out:%p true_length:%p",
+      ctx, in, out, true_length);
+    return eFrameworkunifiedStatusInvldParam;
+  }
+  if (0 == in_len) {
+    FRAMEWORKUNIFIEDLOG(ZONE_ERR, __FUNCTION__, "in_len is equal to 0");
+    return eFrameworkunifiedStatusInvldParam;
+  }
+
+  CipherContext* pcipher_context = reinterpret_cast<CipherContext*>(ctx);
+  if (SYMMETRIC_CIPHER_AES == pcipher_context->cipher_type) {  // symmetric encrypt
+    uint32_t block_size = pcipher_context->cipher_parameter.symmetric.block_size;
+    if (out_len < in_len + block_size) {
+      FRAMEWORKUNIFIEDLOG(ZONE_ERR, __FUNCTION__, "out_len is less than in_len plus block_size");
+      return eFrameworkunifiedStatusInvldParam;
+    }
+    memcpy(out, in, in_len);
+    *true_length = in_len;
+  } else if (ASYMMETRIC_CIPHER_RSA == pcipher_context->cipher_type) {  // asymmetric encrypt
+    if (RSA_PRIVATE_MAX_SIZE_BYTE < in_len) {
+      FRAMEWORKUNIFIEDLOG(ZONE_ERR, __FUNCTION__,
+        "in_len is greater than RSA_PRIVATE_MAX_SIZE_BYTE");
+      return eFrameworkunifiedStatusInvldParam;
+    }
+    if (RSA_PRIVATE_EXPONENT_MAX_SIZE/BITS_PER_BYTE > out_len) {
+      FRAMEWORKUNIFIEDLOG(ZONE_ERR, __FUNCTION__,
+        "out_len is less than RSA_PRIVATE_EXPONENT_MAX_SIZE/BITS_PER_BYTE");
+      return eFrameworkunifiedStatusInvldParam;
+    }
+    // out_len is greater than in_len
+    memcpy(out, in, in_len);
+    *true_length = in_len;
+  } else {
+    FRAMEWORKUNIFIEDLOG(ZONE_ERR, __FUNCTION__,
+      "the cipher_type isn't support, cipher_type:%d", pcipher_context->cipher_type);
+    return eFrameworkunifiedStatusInvldParam;
+  }
+
+  return eFrameworkunifiedStatusOK;
+}
+
+// Encrypt the final plaintext information
+EFrameworkunifiedStatus EncryptFinish(void* ctx, uint8_t* out, uint32_t out_len, uint32_t* true_length) {
+  if (NULL == ctx) {
+    FRAMEWORKUNIFIEDLOG(ZONE_ERR, __FUNCTION__, "ctx is NULL");
+    return eFrameworkunifiedStatusInvldParam;
+  }
+  CipherContext* pcipher_context = reinterpret_cast<CipherContext*>(ctx);
+  if (SYMMETRIC_CIPHER_AES == pcipher_context->cipher_type) {  // symmetric encrypt
+    if (NULL == out || NULL == true_length) {
+      FRAMEWORKUNIFIEDLOG(ZONE_ERR, __FUNCTION__,
+        "out or true_length is NULL, out:%p true_length:%p", out, true_length);
+      return eFrameworkunifiedStatusInvldParam;
+    }
+    uint32_t block_size = pcipher_context->cipher_parameter.symmetric.block_size;
+    if (out_len < block_size) {
+      FRAMEWORKUNIFIEDLOG(ZONE_ERR, __FUNCTION__, "out_len is less than block_size");
+      return eFrameworkunifiedStatusInvldParam;
+    }
+    if (true == pcipher_context->cipher_parameter.symmetric.to_pad) {
+      // Padding on, the true_length is equal to block_size.
+      *true_length = block_size;
+    } else {
+      // Padding off, true_length is equal to 0.
+      *true_length = 0;
+    }
+  } else if (ASYMMETRIC_CIPHER_RSA == pcipher_context->cipher_type) {
+    // EncryptFinish is useless for RSA asymmetric encrypt. So do nothing.
+  } else {
+    FRAMEWORKUNIFIEDLOG(ZONE_ERR, __FUNCTION__,
+      "the cipher_type isn't support, cipher_type:%d", pcipher_context->cipher_type);
+    return eFrameworkunifiedStatusInvldParam;
+  }
+  return eFrameworkunifiedStatusOK;
+}
+
+// Clean up encrypt context information
+EFrameworkunifiedStatus EncryptCleanup(void* ctx) {
+  if (NULL == ctx) {
+    FRAMEWORKUNIFIEDLOG(ZONE_ERR, __FUNCTION__, "ctx is NULL");
+    return eFrameworkunifiedStatusInvldParam;
+  }
+  memset(ctx, 0, sizeof(CipherContext));
+  free(ctx);
+  return eFrameworkunifiedStatusOK;
+}
+
+// Initialize the decrypt context information
+EFrameworkunifiedStatus DecryptStart(enum CipherType cipher_type, union CipherParameter* param,
+                        union KeyParam *key, void** ctx) {
+  if (SYMMETRIC_CIPHER_AES != cipher_type && ASYMMETRIC_CIPHER_RSA != cipher_type) {
+    FRAMEWORKUNIFIEDLOG(ZONE_ERR, __FUNCTION__, "the cipher_type isn't support");
+    return eFrameworkunifiedStatusInvldParam;
+  }
+  if (NULL == param || NULL == key || NULL == ctx) {
+    FRAMEWORKUNIFIEDLOG(ZONE_ERR, __FUNCTION__,
+      "param, key or ctx is NULL, param:%p key:%p ctx:%p", param, key, ctx);
+    return eFrameworkunifiedStatusInvldParam;
+  }
+  bool ret = CheckParameterVaildity(cipher_type, param, key);
+  if (true != ret) {
+    FRAMEWORKUNIFIEDLOG(ZONE_ERR, __FUNCTION__, "parameter error");
+    return eFrameworkunifiedStatusInvldParam;
+  }
+
+  void* ctx_temp = malloc(sizeof(CipherContext));
+  if (NULL == ctx_temp) {
+    FRAMEWORKUNIFIEDLOG(ZONE_ERR, __FUNCTION__, "Failed to malloc %lu byte for ctx, errno=%d",
+           sizeof(CipherContext), errno);
+    return eFrameworkunifiedStatusFail;
+  }
+  memset(ctx_temp, 0, sizeof(CipherContext));
+  CipherContext* pcipher_context = reinterpret_cast<CipherContext*>(ctx_temp);
+  pcipher_context->cipher_type = cipher_type;
+  pcipher_context->cipher_parameter = *param;
+  pcipher_context->key_param = *key;
+  *ctx = ctx_temp;
+  return eFrameworkunifiedStatusOK;
+}
+
+// Decrypt ciphertext information
+EFrameworkunifiedStatus DecryptUpdate(void* ctx, const uint8_t* in, uint32_t in_len,
+                      uint8_t* out, uint32_t out_len, uint32_t* true_length) {
+  if (NULL == ctx || NULL == in || NULL == out || NULL == true_length) {
+    FRAMEWORKUNIFIEDLOG(ZONE_ERR, __FUNCTION__,
+      "ctx, in, out or true_length is NULL, ctx:%p in:%p out:%p true_length:%p",
+      ctx, in, out, true_length);
+    return eFrameworkunifiedStatusInvldParam;
+  }
+
+  CipherContext* pcipher_context = reinterpret_cast<CipherContext*>(ctx);
+  if (SYMMETRIC_CIPHER_AES == pcipher_context->cipher_type) {  // symmetric decrypt
+    if (0 == in_len) {
+      FRAMEWORKUNIFIEDLOG(ZONE_ERR, __FUNCTION__, "in_len is equal to 0");
+      return eFrameworkunifiedStatusInvldParam;
+    }
+    uint32_t block_size = pcipher_context->cipher_parameter.symmetric.block_size;
+    if (out_len < in_len + block_size) {
+      FRAMEWORKUNIFIEDLOG(ZONE_ERR, __FUNCTION__, "out_len is less than in_len plus block_size");
+      return eFrameworkunifiedStatusInvldParam;
+    }
+    memcpy(out, in, in_len);
+    *true_length = in_len;
+  } else if (ASYMMETRIC_CIPHER_RSA == pcipher_context->cipher_type) {  // asymmetric decrypt
+    if (RSA_PRIVATE_EXPONENT_MAX_SIZE/BITS_PER_BYTE != in_len) {
+      FRAMEWORKUNIFIEDLOG(ZONE_ERR, __FUNCTION__,
+        "in_len isn't equal to RSA_PRIVATE_EXPONENT_MAX_SIZE/BITS_PER_BYTE");
+      return eFrameworkunifiedStatusInvldParam;
+    }
+    if (SHA256_DIGEST_LENGTH > out_len) {
+      FRAMEWORKUNIFIEDLOG(ZONE_ERR, __FUNCTION__,
+        "out_len is less than SHA256_DIGEST_LENGTH");
+      return eFrameworkunifiedStatusInvldParam;
+    }
+    memcpy(out, in, SHA256_DIGEST_LENGTH);
+    *true_length = SHA256_DIGEST_LENGTH;
+  } else {
+    FRAMEWORKUNIFIEDLOG(ZONE_ERR, __FUNCTION__,
+      "the cipher_type isn't support, cipher_type:%d", pcipher_context->cipher_type);
+    return eFrameworkunifiedStatusInvldParam;
+  }
+
+  return eFrameworkunifiedStatusOK;
+}
+
+// Decrypt the final ciphertext information
+EFrameworkunifiedStatus DecryptFinish(void* ctx, uint8_t* out, uint32_t out_len, uint32_t* true_length) {
+  if (NULL == ctx) {
+    FRAMEWORKUNIFIEDLOG(ZONE_ERR, __FUNCTION__, "ctx is NULL");
+    return eFrameworkunifiedStatusInvldParam;
+  }
+  CipherContext* pcipher_context = reinterpret_cast<CipherContext*>(ctx);
+  if (SYMMETRIC_CIPHER_AES == pcipher_context->cipher_type) {  // symmetric encrypt
+    if (NULL == out || NULL == true_length) {
+      FRAMEWORKUNIFIEDLOG(ZONE_ERR, __FUNCTION__,
+        "out or true_length is NULL, out:%p true_length:%p", out, true_length);
+      return eFrameworkunifiedStatusInvldParam;
+    }
+    uint32_t block_size = pcipher_context->cipher_parameter.symmetric.block_size;
+    if (out_len < block_size) {
+      FRAMEWORKUNIFIEDLOG(ZONE_ERR, __FUNCTION__, "out_len is less than block_size");
+      return eFrameworkunifiedStatusInvldParam;
+    }
+    if (true == pcipher_context->cipher_parameter.symmetric.to_pad) {
+      // Padding on, the true_length is equal to block_size - padding_length. Because security_hal
+      // is stub implement, padding_length is unknown. Set true_length to 0.
+      *true_length = 0;
+    } else {
+      // Padding off, true_length is equal to 0.
+      *true_length = 0;
+    }
+  } else if (ASYMMETRIC_CIPHER_RSA == pcipher_context->cipher_type) {
+    // EncryptFinish is useless for RSA asymmetric decrypt. So do nothing.
+  } else {
+    FRAMEWORKUNIFIEDLOG(ZONE_ERR, __FUNCTION__,
+      "the cipher_type isn't support, cipher_type:%d", pcipher_context->cipher_type);
+    return eFrameworkunifiedStatusInvldParam;
+  }
+  return eFrameworkunifiedStatusOK;
+}
+
+// Clean up decrypt context information
+EFrameworkunifiedStatus DecryptCleanup(void* ctx) {
+  if (NULL == ctx) {
+    FRAMEWORKUNIFIEDLOG(ZONE_ERR, __FUNCTION__, "ctx is NULL");
+    return eFrameworkunifiedStatusInvldParam;
+  }
+  memset(ctx, 0, sizeof(CipherContext));
+  free(ctx);
+  return eFrameworkunifiedStatusOK;
+}
+
+// Initialize hash context information
+EFrameworkunifiedStatus HashStart(enum HashType hash_type, void** ctx) {
+  if (HASH_TYPE_MD5 > hash_type || HASH_TYPE_SHA512 < hash_type) {
+    FRAMEWORKUNIFIEDLOG(ZONE_ERR, __FUNCTION__, "the hash_type isn't support");
+    return eFrameworkunifiedStatusInvldParam;
+  }
+  if (NULL == ctx) {
+    FRAMEWORKUNIFIEDLOG(ZONE_ERR, __FUNCTION__, "ctx is NULL");
+    return eFrameworkunifiedStatusInvldParam;
+  }
+  void* ctx_temp = malloc(sizeof(HashContext));
+  if (NULL == ctx_temp) {
+    FRAMEWORKUNIFIEDLOG(ZONE_ERR, __FUNCTION__, "Failed to malloc %lu byte for ctx, errno=%d",
+           sizeof(HashContext), errno);
+    return eFrameworkunifiedStatusFail;
+  }
+  memset(ctx_temp, 0, sizeof(HashContext));
+  HashContext* phash_context = reinterpret_cast<HashContext*>(ctx_temp);
+  phash_context->hash_type = hash_type;
+  *ctx = ctx_temp;
+  return eFrameworkunifiedStatusOK;
+}
+
+// Caculate hash value of input data
+EFrameworkunifiedStatus HashUpdate(void* ctx, const uint8_t* in, uint32_t in_len) {
+  if (NULL == ctx || NULL == in) {
+    FRAMEWORKUNIFIEDLOG(ZONE_ERR, __FUNCTION__, "ctx or in is NULL, ctx:%p in:%p", ctx, in);
+    return eFrameworkunifiedStatusInvldParam;
+  }
+  if (0 == in_len) {
+    FRAMEWORKUNIFIEDLOG(ZONE_ERR, __FUNCTION__, "in_len is equal to 0");
+    return eFrameworkunifiedStatusInvldParam;
+  }
+  return eFrameworkunifiedStatusOK;
+}
+
+// Caculate final message digest
+EFrameworkunifiedStatus HashFinish(void* ctx, uint8_t* out, uint32_t out_len, uint32_t* true_length) {
+  if (NULL == ctx || NULL == out || NULL == true_length) {
+    FRAMEWORKUNIFIEDLOG(ZONE_ERR, __FUNCTION__,
+      "ctx, out or true_length is NULL, ctx:%p out:%p true_length:%p",
+      ctx, out, true_length);
+    return eFrameworkunifiedStatusInvldParam;
+  }
+  HashContext* phash_context = reinterpret_cast<HashContext*>(ctx);
+  uint32_t digest_length = 0;
+  switch (phash_context->hash_type) {
+    case HASH_TYPE_MD5:
+      digest_length = HASH_TYPE_MD5;
+      break;
+    case HASH_TYPE_SHA1:
+      digest_length = SHA1_DIGEST_LENGTH;
+      break;
+    case HASH_TYPE_SHA224:
+      digest_length = SHA224_DIGEST_LENGTH;
+      break;
+    case HASH_TYPE_SHA256:
+      digest_length = SHA256_DIGEST_LENGTH;
+      break;
+    case HASH_TYPE_SHA384:
+      digest_length = SHA384_DIGEST_LENGTH;
+      break;
+    case HASH_TYPE_SHA512:
+      digest_length = SHA512_DIGEST_LENGTH;
+      break;
+    default:
+      FRAMEWORKUNIFIEDLOG(ZONE_ERR, __FUNCTION__,
+        "the hash_type isn't support, hash_type:%d", phash_context->hash_type);
+      return eFrameworkunifiedStatusInvldParam;
+  }
+  if (out_len < digest_length) {
+    FRAMEWORKUNIFIEDLOG(ZONE_ERR, __FUNCTION__, "out_len is less than %u", digest_length);
+    return eFrameworkunifiedStatusInvldParam;
+  }
+  memset(out, 0x00, digest_length);
+  *true_length = digest_length;
+  return eFrameworkunifiedStatusOK;
+}
+
+// Clean up hash context information
+EFrameworkunifiedStatus HashCleanup(void* ctx) {
+  if (NULL == ctx) {
+    FRAMEWORKUNIFIEDLOG(ZONE_ERR, __FUNCTION__, "ctx is NULL");
+    return eFrameworkunifiedStatusInvldParam;
+  }
+  memset(ctx, 0, sizeof(HashContext));
+  free(ctx);
+  return eFrameworkunifiedStatusOK;
+}
+
+// Initialize random number context information
+EFrameworkunifiedStatus RandomInit(void** ctx, uint8_t* seed_buffer, uint32_t buffer_len) {
+  if (NULL == ctx || NULL == seed_buffer) {
+    FRAMEWORKUNIFIEDLOG(ZONE_ERR, __FUNCTION__,
+      "ctx or seed_buffer is NULL, ctx:%p seed_buffer:%p", ctx, seed_buffer);
+    return eFrameworkunifiedStatusInvldParam;
+  }
+  if (0 == buffer_len) {
+    FRAMEWORKUNIFIEDLOG(ZONE_ERR, __FUNCTION__, "buffer_len is equal to 0");
+    return eFrameworkunifiedStatusInvldParam;
+  }
+  void* ctx_temp = malloc(sizeof(RandomContext));
+  if (NULL == ctx_temp) {
+    FRAMEWORKUNIFIEDLOG(ZONE_ERR, __FUNCTION__, "Failed to malloc %lu byte for ctx, errno=%d",
+           sizeof(RandomContext), errno);
+    return eFrameworkunifiedStatusFail;
+  }
+  memset(ctx_temp, 0, sizeof(RandomContext));
+  RandomContext* prandom_context = reinterpret_cast<RandomContext*>(ctx_temp);
+  prandom_context->seed_buffer = reinterpret_cast<uint8_t*>(malloc(buffer_len));
+  if (NULL == prandom_context->seed_buffer) {
+    FRAMEWORKUNIFIEDLOG(ZONE_ERR, __FUNCTION__, "Failed to malloc %d byte for seed_buffer, errno=%d",
+           buffer_len, errno);
+    free(ctx_temp);
+    ctx_temp = NULL;
+    return eFrameworkunifiedStatusFail;
+  }
+  memcpy(prandom_context->seed_buffer, seed_buffer, buffer_len);
+  prandom_context->buffer_len = buffer_len;
+  *ctx = ctx_temp;
+  return eFrameworkunifiedStatusOK;
+}
+
+// Get random number
+EFrameworkunifiedStatus RandomGet(void* ctx, uint8_t* out, uint32_t out_len, uint32_t* true_length) {
+  if (NULL == ctx || NULL == out || NULL == true_length) {
+    FRAMEWORKUNIFIEDLOG(ZONE_ERR, __FUNCTION__,
+      "ctx, out or true_length is NULL, ctx:%p out:%p true_length:%p",
+      ctx, out, true_length);
+    return eFrameworkunifiedStatusInvldParam;
+  }
+  if (0 == out_len) {
+    FRAMEWORKUNIFIEDLOG(ZONE_ERR, __FUNCTION__, "out_len is equal to 0");
+    return eFrameworkunifiedStatusInvldParam;
+  }
+  // Because security_hal is stub implement, don't assignment value to out or true_length.
+  return eFrameworkunifiedStatusOK;
+}
+
+// Clean up random number context information
+EFrameworkunifiedStatus RandomCleanup(void* ctx) {
+  if (NULL == ctx) {
+    FRAMEWORKUNIFIEDLOG(ZONE_ERR, __FUNCTION__, "ctx is NULL");
+    return eFrameworkunifiedStatusInvldParam;
+  }
+  RandomContext* prandom_context;
+  prandom_context = reinterpret_cast<RandomContext*>(ctx);
+  if (NULL != prandom_context->seed_buffer) {
+    memset(prandom_context->seed_buffer, 0, prandom_context->buffer_len);
+    free(prandom_context->seed_buffer);
+    prandom_context->seed_buffer = NULL;
+  }
+  memset(prandom_context, 0, sizeof(RandomContext));
+  free(prandom_context);
+  prandom_context = NULL;
+  return eFrameworkunifiedStatusOK;
+}
+
+// Reset Security IC
+EFrameworkunifiedStatus ResetSecurityIC(void) {
+  /*
+   *  Note.
+   *  This feature needs to be implemented by the vendor.
+   */
+  return eFrameworkunifiedStatusOK;
+}