SHA-224 for IoT and Embedded Devices

#include 
#include 

// SHA-224 context structure
typedef struct {
    uint32_t state[8];       // Hash state
    uint32_t count[2];       // 64-bit bit count
    uint8_t buffer[64];      // Input buffer
} SHA224_CTX;

// SHA-224 initial hash values
static const uint32_t sha224_h0[8] = {
    0xc1059ed8, 0x367cd507, 0x3070dd17, 0xf70e5939,
    0xffc00b31, 0x68581511, 0x64f98fa7, 0xbefa4fa4
};

// SHA-224/256 constants
static const uint32_t K[64] = {
    0x428a2f98, 0x71374491, 0xb5c0fbcf, 0xe9b5dba5,
    0x3956c25b, 0x59f111f1, 0x923f82a4, 0xab1c5ed5,
    0xd807aa98, 0x12835b01, 0x243185be, 0x550c7dc3,
    0x72be5d74, 0x80deb1fe, 0x9bdc06a7, 0xc19bf174,
    0xe49b69c1, 0xefbe4786, 0x0fc19dc6, 0x240ca1cc,
    0x2de92c6f, 0x4a7484aa, 0x5cb0a9dc, 0x76f988da,
    0x983e5152, 0xa831c66d, 0xb00327c8, 0xbf597fc7,
    0xc6e00bf3, 0xd5a79147, 0x06ca6351, 0x14292967,
    0x27b70a85, 0x2e1b2138, 0x4d2c6dfc, 0x53380d13,
    0x650a7354, 0x766a0abb, 0x81c2c92e, 0x92722c85,
    0xa2bfe8a1, 0xa81a664b, 0xc24b8b70, 0xc76c51a3,
    0xd192e819, 0xd6990624, 0xf40e3585, 0x106aa070,
    0x19a4c116, 0x1e376c08, 0x2748774c, 0x34b0bcb5,
    0x391c0cb3, 0x4ed8aa4a, 0x5b9cca4f, 0x682e6ff3,
    0x748f82ee, 0x78a5636f, 0x84c87814, 0x8cc70208,
    0x90befffa, 0xa4506ceb, 0xbef9a3f7, 0xc67178f2
};

// Byte-swap functions for big-endian conversion
// Many embedded processors are little-endian, so conversion is needed
static uint32_t swap32(uint32_t x) {
    return ((x << 24) & 0xff000000) | 
           ((x <<  8) & 0x00ff0000) | 
           ((x >>  8) & 0x0000ff00) | 
           ((x >> 24) & 0x000000ff);
}

// Right-rotate a 32-bit value by n bits
static uint32_t ROTR(uint32_t x, uint8_t n) {
    return (x >> n) | (x << (32 - n));
}

// SHA-256 functions
#define Ch(x, y, z)     ((x & y) ^ (~x & z))
#define Maj(x, y, z)    ((x & y) ^ (x & z) ^ (y & z))
#define Sigma0(x)       (ROTR(x, 2) ^ ROTR(x, 13) ^ ROTR(x, 22))
#define Sigma1(x)       (ROTR(x, 6) ^ ROTR(x, 11) ^ ROTR(x, 25))
#define sigma0(x)       (ROTR(x, 7) ^ ROTR(x, 18) ^ (x >> 3))
#define sigma1(x)       (ROTR(x, 17) ^ ROTR(x, 19) ^ (x >> 10))

// Initialize SHA-224 context
void sha224_init(SHA224_CTX *ctx) {
    // Copy initial hash values
    memcpy(ctx->state, sha224_h0, sizeof(sha224_h0));
    ctx->count[0] = ctx->count[1] = 0;
}

// Process a single 64-byte block
// This is the core transformation and is called from sha224_update
void sha224_transform(SHA224_CTX *ctx, const uint8_t block[64]) {
    uint32_t W[16]; // Reduced message schedule array (reuses memory)
    uint32_t a, b, c, d, e, f, g, h;
    uint32_t T1, T2;
    uint32_t i, j;
    
    // Initialize working variables with current hash state
    a = ctx->state[0];
    b = ctx->state[1];
    c = ctx->state[2];
    d = ctx->state[3];
    e = ctx->state[4];
    f = ctx->state[5];
    g = ctx->state[6];
    h = ctx->state[7];
    
    // Process the message schedule in 16-word chunks to save memory
    // This is a memory-optimized version that processes the message in chunks
    for (i = 0; i < 64; i += 16) {
        // Prepare the message schedule
        for (j = 0; j < 16; j++) {
            if (i + j < 16) {
                // Directly read from input block (big-endian conversion)
                W[j] = (uint32_t)block[j*4] << 24 |
                       (uint32_t)block[j*4+1] << 16 |
                       (uint32_t)block[j*4+2] << 8 |
                       (uint32_t)block[j*4+3];
            } else {
                // Calculate extended message schedule
                W[j % 16] = sigma1(W[(j - 2) % 16]) + W[(j - 7) % 16] +
                            sigma0(W[(j - 15) % 16]) + W[(j - 16) % 16];
            }
            
            // Main loop
            T1 = h + Sigma1(e) + Ch(e, f, g) + K[i+j] + W[j % 16];
            T2 = Sigma0(a) + Maj(a, b, c);
            
            h = g;
            g = f;
            f = e;
            e = d + T1;
            d = c;
            c = b;
            b = a;
            a = T1 + T2;
        }
    }
    
    // Add result to current hash state
    ctx->state[0] += a;
    ctx->state[1] += b;
    ctx->state[2] += c;
    ctx->state[3] += d;
    ctx->state[4] += e;
    ctx->state[5] += f;
    ctx->state[6] += g;
    ctx->state[7] += h;
}

// Update SHA-224 context with input data
void sha224_update(SHA224_CTX *ctx, const uint8_t *data, size_t len) {
    size_t i;
    uint32_t index;
    uint32_t MSB, LSB;
    
    // Compute number of bytes mod 64
    index = (ctx->count[0] >> 3) & 0x3F;
    
    // Update bit count
    // Note: This is a 64-bit counter implemented with two 32-bit values
    LSB = ctx->count[0];
    MSB = ctx->count[1];
    if ((ctx->count[0] += (len << 3)) < LSB) {
        ctx->count[1]++;
    }
    ctx->count[1] += (len >> 29);
    
    // Process data in 64-byte chunks
    if (index) {
        i = 64 - index;
        if (len < i) {
            // Not enough data for a complete block
            memcpy(&ctx->buffer[index], data, len);
            return;
        }
        
        // Complete current block
        memcpy(&ctx->buffer[index], data, i);
        sha224_transform(ctx, ctx->buffer);
        data += i;
        len -= i;
    }
    
    // Process full blocks directly from input
    while (len >= 64) {
        sha224_transform(ctx, data);
        data += 64;
        len -= 64;
    }
    
    // Buffer remaining input
    if (len) {
        memcpy(ctx->buffer, data, len);
    }
}

// Finalize SHA-224 hash
void sha224_final(SHA224_CTX *ctx, uint8_t digest[28]) {
    uint8_t finalcount[8];
    uint32_t i;
    
    // Store bit count in big endian format
    for (i = 0; i < 8; i++) {
        finalcount[i] = (uint8_t)((ctx->count[(i >= 4 ? 0 : 1)] >>
                                   ((3 - (i & 3)) * 8)) & 255);
    }
    
    // Pad with 0x80 followed by zeros, then bit count
    sha224_update(ctx, (uint8_t *)"\x80", 1);
    while ((ctx->count[0] & 504) != 448) {
        sha224_update(ctx, (uint8_t *)"\0", 1);
    }
    
    // Append bit count
    sha224_update(ctx, finalcount, 8);
    
    // Convert hash to bytes (big endian) - only use first 7 words for SHA-224
    for (i = 0; i < 7; i++) {
        uint32_t val = ctx->state[i];
        digest[i*4] = (uint8_t)(val >> 24);
        digest[i*4+1] = (uint8_t)(val >> 16);
        digest[i*4+2] = (uint8_t)(val >> 8);
        digest[i*4+3] = (uint8_t)val;
    }
}

// Convenient all-in-one SHA-224 computation
void sha224(const uint8_t *data, size_t len, uint8_t digest[28]) {
    SHA224_CTX ctx;
    sha224_init(&ctx);
    sha224_update(&ctx, data, len);
    sha224_final(&ctx, digest);
}

#include "SHA224.h"  // Optimized SHA-224 implementation from above
#include    // For persistent storage
#include     // Hypothetical flash memory access library

// Structure for firmware header
typedef struct {
  uint32_t version;             // Firmware version number
  uint32_t size;                // Size of firmware binary in bytes
  uint8_t sha224Hash[28];       // SHA-224 hash of firmware
  uint8_t signatureRS[64];      // ECDSA signature (r,s) - external authentication
} FirmwareHeader;

// Define firmware storage areas
#define FIRMWARE_BASE_ADDR     0x08010000   // Starting address for firmware
#define FIRMWARE_HEADER_ADDR   0x08009000   // Address for firmware header
#define FIRMWARE_MAX_SIZE      (256 * 1024) // Maximum firmware size
#define CHUNK_SIZE             1024         // Process firmware in chunks

// Public key for verifying signatures (defined elsewhere)
extern const uint8_t publicKeyXY[64];

// Buffer for processing (kept small to minimize RAM usage)
uint8_t buffer[CHUNK_SIZE];

// Verify firmware integrity using SHA-224
bool verifyFirmwareIntegrity() {
  FirmwareHeader header;
  SHA224_CTX ctx;
  uint8_t calculatedHash[28];
  uint32_t remainingBytes, chunkSize;
  uint32_t currentAddr = FIRMWARE_BASE_ADDR;
  
  // Read firmware header
  Flash.read(FIRMWARE_HEADER_ADDR, (uint8_t*)&header, sizeof(FirmwareHeader));
  
  // Check if firmware size is valid
  if (header.size == 0 || header.size > FIRMWARE_MAX_SIZE) {
    return false;
  }
  
  // Initialize SHA-224
  sha224_init(&ctx);
  
  // Process firmware in chunks to minimize memory usage
  remainingBytes = header.size;
  while (remainingBytes > 0) {
    // Determine chunk size for this iteration
    chunkSize = (remainingBytes > CHUNK_SIZE) ? CHUNK_SIZE : remainingBytes;
    
    // Read chunk from flash
    Flash.read(currentAddr, buffer, chunkSize);
    
    // Update hash with this chunk
    sha224_update(&ctx, buffer, chunkSize);
    
    // Move to next chunk
    currentAddr += chunkSize;
    remainingBytes -= chunkSize;
    
    // Optional: Feed watchdog timer to prevent timeouts during long operations
    wdt_reset();
    
    // Optional: Allow system to perform other critical tasks
    yield();
  }
  
  // Finalize hash
  sha224_final(&ctx, calculatedHash);
  
  // Compare calculated hash with expected hash
  for (int i = 0; i < 28; i++) {
    if (calculatedHash[i] != header.sha224Hash[i]) {
      return false; // Hash mismatch
    }
  }
  
  // Hash verification successful
  // For production systems, also verify the signature
  // return verifyECDSASignature(calculatedHash, header.signatureRS, publicKeyXY);
  
  return true;
}

// Apply new firmware update from external source (e.g., OTA)
bool applyFirmwareUpdate(uint8_t* firmwareData, uint32_t firmwareSize, 
                         FirmwareHeader* newHeader) {
  SHA224_CTX ctx;
  uint8_t calculatedHash[28];
  
  // Verify firmware size
  if (firmwareSize == 0 || firmwareSize > FIRMWARE_MAX_SIZE) {
    return false;
  }
  
  // Calculate firmware hash
  sha224_init(&ctx);
  
  // For very memory-constrained devices, process in smaller chunks
  uint32_t offset = 0;
  const uint32_t chunkSize = 256; // Smaller chunks for extreme memory constraints
  
  while (offset < firmwareSize) {
    uint32_t bytesToProcess = min(chunkSize, firmwareSize - offset);
    sha224_update(&ctx, &firmwareData[offset], bytesToProcess);
    offset += bytesToProcess;
    yield(); // Allow system to perform other tasks
  }
  
  sha224_final(&ctx, calculatedHash);
  
  // Compare with provided hash in header
  for (int i = 0; i < 28; i++) {
    if (calculatedHash[i] != newHeader->sha224Hash[i]) {
      return false; // Hash mismatch
    }
  }
  
  // Hash verification successful - write firmware to flash
  // In a real implementation, write to backup location first, then swap
  offset = 0;
  while (offset < firmwareSize) {
    uint32_t bytesToWrite = min(chunkSize, firmwareSize - offset);
    Flash.write(FIRMWARE_BASE_ADDR + offset, &firmwareData[offset], bytesToWrite);
    offset += bytesToWrite;
    yield();
  }
  
  // Write header last (atomicity marker)
  Flash.write(FIRMWARE_HEADER_ADDR, (uint8_t*)newHeader, sizeof(FirmwareHeader));
  
  return true;
}

// Bootloader security check - typically run at startup
bool performSecureBootValidation() {
  // First, read and validate the firmware header
  FirmwareHeader header;
  Flash.read(FIRMWARE_HEADER_ADDR, (uint8_t*)&header, sizeof(FirmwareHeader));
  
  // Check for valid firmware version
  uint32_t storedVersion;
  EEPROM.get(0, storedVersion);
  
  // Basic anti-rollback protection
  if (header.version < storedVersion) {
    return false; // Attempt to downgrade firmware
  }
  
  // Verify firmware integrity
  if (!verifyFirmwareIntegrity()) {
    return false;
  }
  
  // Update stored version if higher
  if (header.version > storedVersion) {
    EEPROM.put(0, header.version);
  }
  
  return true;
}

#include "sha224.h"  // From the optimized implementation above
#include    // For random numbers
#include    // For memcmp

// HMAC-SHA224 implementation optimized for IoT devices
void hmac_sha224(const uint8_t *key, size_t keylen, 
                const uint8_t *data, size_t datalen, 
                uint8_t digest[28]) {
    SHA224_CTX ctx;
    uint8_t k_ipad[64] = {0};  // Inner padding - key XORd with ipad
    uint8_t k_opad[64] = {0};  // Outer padding - key XORd with opad
    uint8_t tk[28];            // Temporary key
    size_t i;
    
    // If key is longer than 64 bytes, use hash of key
    if (keylen > 64) {
        SHA224_CTX tctx;
        sha224_init(&tctx);
        sha224_update(&tctx, key, keylen);
        sha224_final(&tctx, tk);
        
        key = tk;
        keylen = 28;
    }
    
    // Prepare inner and outer paddings
    for (i = 0; i < keylen; i++) {
        k_ipad[i] = key[i] ^ 0x36;
        k_opad[i] = key[i] ^ 0x5c;
    }
    for (; i < 64; i++) {
        k_ipad[i] = 0x36;
        k_opad[i] = 0x5c;
    }
    
    // Inner hash: H(K XOR ipad || data)
    sha224_init(&ctx);
    sha224_update(&ctx, k_ipad, 64);
    sha224_update(&ctx, data, datalen);
    sha224_final(&ctx, digest);
    
    // Outer hash: H(K XOR opad || inner_hash)
    sha224_init(&ctx);
    sha224_update(&ctx, k_opad, 64);
    sha224_update(&ctx, digest, 28);
    sha224_final(&ctx, digest);
}

// Device-specific shared secret key (in a real implementation, store securely)
static const uint8_t deviceSecretKey[16] = {
    0x01, 0x23, 0x45, 0x67, 0x89, 0xAB, 0xCD, 0xEF,
    0xFE, 0xDC, 0xBA, 0x98, 0x76, 0x54, 0x32, 0x10
};

// Generate a challenge-response pair
// In a real system, the server generates the challenge and the device responds
bool generateChallengeResponse(uint8_t challenge[8], uint8_t response[28]) {
    // Generate random challenge
    for (int i = 0; i < 8; i++) {
        challenge[i] = rand() & 0xFF;
    }
    
    // Calculate HMAC-SHA224 of challenge using device secret key
    hmac_sha224(deviceSecretKey, sizeof(deviceSecretKey),
                challenge, 8, response);
    
    return true;
}

// Verify a challenge-response pair
bool verifyChallengeResponse(const uint8_t challenge[8], const uint8_t response[28]) {
    uint8_t expectedResponse[28];
    
    // Calculate expected response
    hmac_sha224(deviceSecretKey, sizeof(deviceSecretKey),
                challenge, 8, expectedResponse);
    
    // Compare with actual response (constant-time comparison)
    int result = 0;
    for (int i = 0; i < 28; i++) {
        result |= expectedResponse[i] ^ response[i];
    }
    
    return result == 0;
}

// Protocol interactions between device and server
// This simulates the flow in a device's authentication module
typedef enum {
    AUTH_IDLE,
    AUTH_CHALLENGE_RECEIVED,
    AUTH_AUTHENTICATED,
    AUTH_FAILED
} AuthState;

// Authentication state machine
typedef struct {
    AuthState state;
    uint8_t challenge[8];
    uint8_t lastNonce[4];      // Anti-replay protection
    uint32_t lastAuthTime;     // Timestamp of last authentication
    uint16_t failedAttempts;   // Count of failed authentication attempts
} AuthContext;

// Initialize authentication context
void auth_init(AuthContext *ctx) {
    ctx->state = AUTH_IDLE;
    ctx->failedAttempts = 0;
    ctx->lastAuthTime = 0;
    memset(ctx->lastNonce, 0, sizeof(ctx->lastNonce));
}

// Process received challenge from server
bool auth_process_challenge(AuthContext *ctx, const uint8_t *challengeData, 
                           size_t challengeLen, uint32_t currentTime) {
    // Validate challenge format and freshness
    if (challengeLen != 12) {  // 8 bytes challenge + 4 bytes nonce
        return false;
    }
    
    // Extract components
    uint8_t receivedChallenge[8];
    uint8_t receivedNonce[4];
    
    memcpy(receivedChallenge, challengeData, 8);
    memcpy(receivedNonce, challengeData + 8, 4);
    
    // Anti-replay protection
    if (memcmp(receivedNonce, ctx->lastNonce, 4) == 0) {
        return false;  // Replay attack detected
    }
    
    // Rate limiting
    if (ctx->failedAttempts >= 5 && 
        (currentTime - ctx->lastAuthTime) < 30000) {  // 30-second lockout
        return false;
    }
    
    // Store challenge for response generation
    memcpy(ctx->challenge, receivedChallenge, 8);
    memcpy(ctx->lastNonce, receivedNonce, 4);
    ctx->lastAuthTime = currentTime;
    ctx->state = AUTH_CHALLENGE_RECEIVED;
    
    return true;
}

// Generate response to challenge
bool auth_generate_response(AuthContext *ctx, uint8_t response[28]) {
    if (ctx->state != AUTH_CHALLENGE_RECEIVED) {
        return false;
    }
    
    // Generate HMAC-SHA224 response
    hmac_sha224(deviceSecretKey, sizeof(deviceSecretKey),
                ctx->challenge, 8, response);
    
    return true;
}

// Process authentication result
void auth_process_result(AuthContext *ctx, bool authenticated, uint32_t currentTime) {
    if (authenticated) {
        ctx->state = AUTH_AUTHENTICATED;
        ctx->failedAttempts = 0;
    } else {
        ctx->state = AUTH_FAILED;
        ctx->failedAttempts++;
        ctx->lastAuthTime = currentTime;
    }
}

// Example usage in IoT device main loop
void auth_example() {
    // This would be part of your device's communication module
    AuthContext authCtx;
    uint8_t receivedChallenge[12];  // Challenge with nonce
    uint8_t response[28];
    uint32_t currentTime = 0;  // In real code, get from system
    
    // Initialize auth context
    auth_init(&authCtx);
    
    // Simulation: server sends challenge (in real code, this comes from network)
    generateChallengeResponse(receivedChallenge, NULL);  // Just generate challenge part
    // Add nonce for anti-replay protection
    *(uint32_t*)(receivedChallenge + 8) = rand();
    
    // Process received challenge
    if (auth_process_challenge(&authCtx, receivedChallenge, 12, currentTime)) {
        // Generate response
        if (auth_generate_response(&authCtx, response)) {
            // In real code, send response to server
            
            // Simulate server verification
            bool verified = verifyChallengeResponse(receivedChallenge, response);
            
            // Process result
            auth_process_result(&authCtx, verified, currentTime);
            
            if (authCtx.state == AUTH_AUTHENTICATED) {
                // Authentication successful, proceed with secure communications
            }
        }
    }
}

#include "sha224.h"
#include 
#include 
#include 

// Data structure for sensor readings
struct SensorReading {
    uint32_t timestamp;      // Unix timestamp
    uint16_t sensorId;       // Sensor identifier
    uint16_t readingType;    // Type of measurement (temp, humidity, etc.)
    float value;             // Sensor value
};

// Data structure for a batch of readings with authentication
struct SensorDataBatch {
    uint32_t deviceId;                     // Device identifier
    uint32_t batchId;                      // Batch sequence number
    uint32_t timestamp;                    // Batch creation timestamp
    uint8_t readingCount;                  // Number of readings (max 255)
    SensorReading readings[32];            // Array of readings (adjust size as needed)
    uint8_t hmac[28];                      // HMAC-SHA224 authentication code
};

// HMAC-SHA224 implementation (from previous example)
extern void hmac_sha224(const uint8_t *key, size_t keylen, 
                        const uint8_t *data, size_t datalen, 
                        uint8_t digest[28]);

// Device-specific key (in production, store in secure element)
static const uint8_t dataAuthKey[16] = {
    0xA1, 0xB2, 0xC3, 0xD4, 0xE5, 0xF6, 0x07, 0x18,
    0x29, 0x3A, 0x4B, 0x5C, 0x6D, 0x7E, 0x8F, 0x90
};

// Authenticate a batch of sensor readings
void authenticateSensorBatch(SensorDataBatch *batch) {
    // Calculate HMAC over the entire batch structure except the HMAC field itself
    size_t dataSize = sizeof(SensorDataBatch) - sizeof(batch->hmac);
    
    // Calculate HMAC
    hmac_sha224(dataAuthKey, sizeof(dataAuthKey), 
                (uint8_t*)batch, dataSize, 
                batch->hmac);
}

// Verify authenticity of a received sensor batch
bool verifySensorBatch(const SensorDataBatch *batch) {
    uint8_t calculatedHmac[28];
    size_t dataSize = sizeof(SensorDataBatch) - sizeof(batch->hmac);
    
    // Calculate expected HMAC
    hmac_sha224(dataAuthKey, sizeof(dataAuthKey), 
                (uint8_t*)batch, dataSize, 
                calculatedHmac);
    
    // Constant-time comparison
    int result = 0;
    for (int i = 0; i < 28; i++) {
        result |= calculatedHmac[i] ^ batch->hmac[i];
    }
    
    return result == 0;
}

// Add a sensor reading to a batch
bool addSensorReading(SensorDataBatch *batch, const SensorReading *reading) {
    if (batch->readingCount >= 32) {
        return false; // Batch full
    }
    
    // Copy reading to batch
    memcpy(&batch->readings[batch->readingCount], reading, sizeof(SensorReading));
    batch->readingCount++;
    
    return true;
}

// Create and authenticate a new batch with initial configuration
void createSensorBatch(SensorDataBatch *batch, uint32_t deviceId, uint32_t batchId, uint32_t timestamp) {
    // Initialize batch
    batch->deviceId = deviceId;
    batch->batchId = batchId;
    batch->timestamp = timestamp;
    batch->readingCount = 0;
    
    // Clear readings array
    memset(batch->readings, 0, sizeof(batch->readings));
    
    // Initialize HMAC field
    memset(batch->hmac, 0, sizeof(batch->hmac));
}

// Energy-efficient progressive authentication for low-power devices
class ProgressiveDataAuthenticator {
private:
    SHA224_CTX ctx;
    bool initialized;
    uint32_t messageCount;
    uint8_t key[64];        // HMAC padded key (ipad)
    uint8_t outerKey[64];   // HMAC padded key (opad)
    
public:
    ProgressiveDataAuthenticator() : initialized(false), messageCount(0) {}
    
    // Initialize with key
    void init(const uint8_t *authKey, size_t keyLen) {
        uint8_t keyHash[28];
        
        // Prepare keys for HMAC
        memset(key, 0x36, 64);      // ipad
        memset(outerKey, 0x5c, 64); // opad
        
        if (keyLen > 64) {
            // If key is too long, hash it first
            SHA224_CTX tmpCtx;
            sha224_init(&tmpCtx);
            sha224_update(&tmpCtx, authKey, keyLen);
            sha224_final(&tmpCtx, keyHash);
            
            // XOR with pads
            for (int i = 0; i < 28; i++) {
                key[i] ^= keyHash[i];
                outerKey[i] ^= keyHash[i];
            }
        } else {
            // XOR with pads
            for (int i = 0; i < keyLen; i++) {
                key[i] ^= authKey[i];
                outerKey[i] ^= authKey[i];
            }
        }
        
        // Initialize inner hash
        sha224_init(&ctx);
        sha224_update(&ctx, key, 64);
        
        initialized = true;
        messageCount = 0;
    }
    
    // Add data incrementally
    void update(const void *data, size_t len) {
        if (!initialized) return;
        
        sha224_update(&ctx, (const uint8_t*)data, len);
        messageCount++;
    }
    
    // Add a sensor reading to authentication context
    void addReading(const SensorReading *reading) {
        update(reading, sizeof(SensorReading));
    }
    
    // Finalize and get authentication tag
    void finalize(uint8_t hmac[28]) {
        if (!initialized) return;
        
        uint8_t innerHash[28];
        
        // Complete inner hash
        SHA224_CTX innerCtx = ctx; // Make a copy of current context
        sha224_final(&innerCtx, innerHash);
        
        // Compute outer hash
        SHA224_CTX outerCtx;
        sha224_init(&outerCtx);
        sha224_update(&outerCtx, outerKey, 64);
        sha224_update(&outerCtx, innerHash, 28);
        sha224_final(&outerCtx, hmac);
        
        // Reset for next batch
        initialized = false;
    }
    
    // Reset authenticator
    void reset() {
        initialized = false;
        messageCount = 0;
    }
    
    // Get message count
    uint32_t getMessageCount() const {
        return messageCount;
    }
};

// Example usage in an IoT sensor node
void sensorNodeExample() {
    // Device configuration
    const uint32_t deviceId = 0x12345678;
    static uint32_t batchId = 0;
    
    // Create a new batch
    SensorDataBatch batch;
    createSensorBatch(&batch, deviceId, batchId++, time(NULL));
    
    // Add some sensor readings
    SensorReading reading;
    
    // Temperature reading
    reading.timestamp = time(NULL);
    reading.sensorId = 1;
    reading.readingType = 1; // Temperature
    reading.value = 25.7f;   // 25.7°C
    addSensorReading(&batch, &reading);
    
    // Humidity reading
    reading.timestamp = time(NULL);
    reading.sensorId = 2;
    reading.readingType = 2; // Humidity
    reading.value = 48.3f;   // 48.3%
    addSensorReading(&batch, &reading);
    
    // Pressure reading
    reading.timestamp = time(NULL);
    reading.sensorId = 3;
    reading.readingType = 3; // Pressure
    reading.value = 101.325f; // 101.325 kPa
    addSensorReading(&batch, &reading);
    
    // Authenticate the batch
    authenticateSensorBatch(&batch);
    
    // In a real application, transmit the batch to the server
    // transmitData(&batch, sizeof(SensorDataBatch));
    
    // Demonstrate progressive authentication for constrained devices
    ProgressiveDataAuthenticator progressiveAuth;
    progressiveAuth.init(dataAuthKey, sizeof(dataAuthKey));
    
    // Progressive authentication can be done over time
    // Each reading can be added as it becomes available
    progressiveAuth.update(&batch.deviceId, sizeof(batch.deviceId));
    progressiveAuth.update(&batch.batchId, sizeof(batch.batchId));
    progressiveAuth.update(&batch.timestamp, sizeof(batch.timestamp));
    progressiveAuth.update(&batch.readingCount, sizeof(batch.readingCount));
    
    // Add readings one by one (could be done over time)
    for (int i = 0; i < batch.readingCount; i++) {
        progressiveAuth.addReading(&batch.readings[i]);
    }
    
    // Get the final authentication tag
    uint8_t progressiveHmac[28];
    progressiveAuth.finalize(progressiveHmac);
    
    // Verify progressive authentication matches batch authentication
    bool hmacMatches = (memcmp(progressiveHmac, batch.hmac, 28) == 0);
}

#include "stm32f4xx_hal.h"

// HASH handle structure
HASH_HandleTypeDef hhash;

// Initialize the HASH peripheral for SHA224
HAL_StatusTypeDef initHardwareSHA224() {
    // Initialize HASH handle
    hhash.Init.DataType = HASH_DATATYPE_8B;
    hhash.Init.pKey = NULL;
    hhash.Init.KeySize = 0;
    
    // Initialize HASH for SHA224 mode (not SHA256)
    return HAL_HASH_Init(&hhash);
}

// Calculate SHA-224 hash using hardware acceleration
HAL_StatusTypeDef hardwareSHA224(const uint8_t *data, size_t len, uint8_t hash[28]) {
    HAL_StatusTypeDef status;
    
    // Start the hash computation in SHA224 mode
    status = HAL_HASH_SHA224_Start(&hhash, (uint8_t*)data, len, hash, HAL_MAX_DELAY);
    
    return status;
}

// Calculate SHA-224 hash for large data using hardware acceleration
HAL_StatusTypeDef hardwareSHA224_Multipart(const uint8_t *data, size_t len, uint8_t hash[28]) {
    HAL_StatusTypeDef status;
    
    // Initialize SHA224 operation
    status = HAL_HASH_SHA224_Start(&hhash, NULL, 0, NULL, 0);
    if (status != HAL_OK) return status;
    
    // Process data in chunks (e.g., 512 bytes at a time)
    const size_t CHUNK_SIZE = 512;
    size_t remaining = len;
    size_t offset = 0;
    
    while (remaining > CHUNK_SIZE) {
        status = HAL_HASH_SHA224_Accmlt(&hhash, (uint8_t*)(data + offset), CHUNK_SIZE);
        if (status != HAL_OK) return status;
        
        remaining -= CHUNK_SIZE;
        offset += CHUNK_SIZE;
    }
    
    // Process the last chunk and get the hash
    status = HAL_HASH_SHA224_Accmlt_End(&hhash, (uint8_t*)(data + offset), remaining, hash, HAL_MAX_DELAY);
    
    return status;
}

// Calculate SHA-224 HMAC using hardware acceleration
HAL_StatusTypeDef hardwareHMAC_SHA224(const uint8_t *key, size_t keylen,
                                     const uint8_t *data, size_t datalen,
                                     uint8_t mac[28]) {
    HAL_StatusTypeDef status;
    
    // Configure HASH handle for HMAC
    hhash.Init.DataType = HASH_DATATYPE_8B;
    hhash.Init.pKey = (uint8_t*)key;
    hhash.Init.KeySize = keylen;
    
    status = HAL_HASH_Init(&hhash);
    if (status != HAL_OK) return status;
    
    // Compute HMAC-SHA224
    status = HAL_HASH_HMAC_SHA224_Start(&hhash, (uint8_t*)data, datalen, mac, HAL_MAX_DELAY);
    
    return status;
}

// DMA-based SHA-224 hashing for efficient memory usage
HAL_StatusTypeDef hardwareSHA224_DMA(const uint8_t *data, size_t len, uint8_t hash[28]) {
    // Configure the DMA
    __HAL_RCC_DMA2_CLK_ENABLE();
    
    // Configure DMA handle for HASH peripheral
    static DMA_HandleTypeDef hdma_hash_in;
    hdma_hash_in.Instance = DMA2_Stream7;
    hdma_hash_in.Init.Channel = DMA_CHANNEL_2;
    hdma_hash_in.Init.Direction = DMA_MEMORY_TO_PERIPH;
    hdma_hash_in.Init.PeriphInc = DMA_PINC_DISABLE;
    hdma_hash_in.Init.MemInc = DMA_MINC_ENABLE;
    hdma_hash_in.Init.PeriphDataAlignment = DMA_PDATAALIGN_WORD;
    hdma_hash_in.Init.MemDataAlignment = DMA_MDATAALIGN_WORD;
    hdma_hash_in.Init.Mode = DMA_NORMAL;
    hdma_hash_in.Init.Priority = DMA_PRIORITY_HIGH;
    hdma_hash_in.Init.FIFOMode = DMA_FIFOMODE_ENABLE;
    hdma_hash_in.Init.FIFOThreshold = DMA_FIFO_THRESHOLD_FULL;
    hdma_hash_in.Init.MemBurst = DMA_MBURST_SINGLE;
    hdma_hash_in.Init.PeriphBurst = DMA_PBURST_SINGLE;
    
    if (HAL_DMA_Init(&hdma_hash_in) != HAL_OK) {
        return HAL_ERROR;
    }
    
    // Associate DMA handle with HASH handle
    __HAL_LINKDMA(&hhash, hdmain, hdma_hash_in);
    
    // Configure NVIC for DMA interrupts
    HAL_NVIC_SetPriority(DMA2_Stream7_IRQn, 5, 0);
    HAL_NVIC_EnableIRQ(DMA2_Stream7_IRQn);
    
    // Start HASH processing with DMA
    return HAL_HASH_SHA224_Start_DMA(&hhash, (uint8_t*)data, len);
    
    // Note: In a real application, you'd need to handle the HAL_HASH_DMAInCpltCallback
    // and retrieve the hash value when DMA completes
}

// Example usage in low-power IoT application
void lowPowerHashExample() {
    uint8_t data[] = "Sensor data to hash with SHA-224";
    uint8_t hash[28];
    
    // Wake up from low-power mode
    
    // Initialize hardware
    initHardwareSHA224();
    
    // Calculate hash using hardware acceleration
    hardwareSHA224(data, sizeof(data)-1, hash);
    
    // Process hash result as needed
    
    // Return to low-power mode
}