Timing tests for RSA signing and sub-components thereof.

This is not the sort of thing that should go anywhere near production
code, so it's on a dangling branch. I may rebase it from time to time.

11 files changed, 737 insertions, 48 deletions

diff --git a/libraries/libhal/Makefile b/libraries/libhal/Makefile
index d71956f..3845b90 100644
--- a/libraries/libhal/Makefile
+++ b/libraries/libhal/Makefile
@@ -2,5 +2,6 @@ vpath %.c ${LIBHAL_SRC}
 vpath %.h ${LIBHAL_SRC}
 
 CFLAGS += -Wno-missing-field-initializers -Wno-unused-parameter
+#CFLAGS += -DHAL_RSA_BLINDING_CACHE_SIZE=0
 
 include ${LIBHAL_SRC}/Makefile
diff --git a/projects/cli-test/Makefile b/projects/cli-test/Makefile
index fadf2cf..6f82fc5 100644
--- a/projects/cli-test/Makefile
+++ b/projects/cli-test/Makefile
@@ -12,9 +12,12 @@ OBJS = \
 	mgmt-test.o \
 	test-fmc.o \
 	test-mkmif.o \
-	test_sdram.o
+	test_sdram.o \
+	mgmt-timing.o
 
 CFLAGS += -I$(LIBCLI_SRC) -I$(LIBHAL_SRC)
+CFLAGS += -I$(LIBTFM_BLD)
+CFLAGS += -Wno-missing-field-initializers
 
 LIBS += $(LIBCLI_BLD)/libcli.a $(LIBHAL_BLD)/libhal.a $(LIBTFM_BLD)/libtfm.a
 
diff --git a/projects/cli-test/cli-test.c b/projects/cli-test/cli-test.c
index c0fe57e..c50338b 100644
--- a/projects/cli-test/cli-test.c
+++ b/projects/cli-test/cli-test.c
@@ -57,9 +57,18 @@ int
 main()
 {
     stm_init();
-
     led_on(LED_GREEN);
 
+    /* For the hsm, the keystores are initialized in hal_rpc_server_init(),
+     * which is...less than optimal, but this is not the time or place to fix
+     * it, especially in light of all the terrible things I'm doing in this
+     * version of cli-test.
+     */
+    extern void *hal_ks_token, *hal_ks_volatile;
+    extern int hal_ks_init(void *, int);
+    if (hal_ks_init(hal_ks_volatile, 1) != 0 || hal_ks_init(hal_ks_token, 1) != 0)
+        Error_Handler();
+
     while (1) {
         cli_main();
         /* embedded_cli_loop returns when the user enters 'quit' or 'exit' */
@@ -70,23 +79,36 @@ main()
 }
 
 
-/*
- * Dummy to solve link problem.  Not obvious to me that a program
- * called "cli-test" should be duplicating all of the HSM keystore
- * logic, let alone that it should be doing it badly, but, whatever.
- *
- * We could just copy the sdram_malloc() code from hsm.c, but since
- * one of the other commands linked into cli-test goes merrily stomping
- * all over the entire SDRAM chip, that might not work out so well.
- *
- * Issue deferred until somebody cares.
- */
+/* end of variables declared with __attribute__((section(".sdram1"))) */
+extern uint8_t _esdram1 __asm ("_esdram1");
+/* end of SDRAM1 section */
+extern uint8_t __end_sdram1 __asm ("__end_sdram1");
+static uint8_t *sdram_heap = &_esdram1;
 
-#warning hal_allocate_static_memory() stubbed out in cli-test, see source code
+/* Allocate memory from SDRAM1. */
+static uint8_t *sdram_malloc(size_t size)
+{
+    uint8_t *p = sdram_heap;
 
+#define pad(n) (((n) + 3) & ~3)
+    size = pad(size);
+
+    if (p + size + sizeof(uint32_t) > &__end_sdram1)
+        return NULL;
+
+    *(uint32_t *)p = (uint32_t)size;
+    p += sizeof(uint32_t);
+
+    sdram_heap += size + sizeof(uint32_t);
+    return p;
+}
+
+/* Implement static memory allocation for libhal over sdram_malloc().
+ * Used in hal_ks_init.
+ */
 void *hal_allocate_static_memory(const size_t size)
 {
-    return NULL;
+    return sdram_malloc(size);
 }
 
 int hal_free_static_memory(const void * const ptr)
diff --git a/projects/cli-test/mgmt-cli.c b/projects/cli-test/mgmt-cli.c
index 416be77..055838e 100644
--- a/projects/cli-test/mgmt-cli.c
+++ b/projects/cli-test/mgmt-cli.c
@@ -48,6 +48,7 @@
 #include "mgmt-keystore.h"
 #include "mgmt-masterkey.h"
 #include "mgmt-keywrap.h"
+#include "mgmt-timing.h"
 
 #undef HAL_OK
 #define HAL_OK LIBHAL_OK
@@ -177,6 +178,7 @@ int cli_main(void)
     configure_cli_keystore(cli);
     configure_cli_masterkey(cli);
     configure_cli_keywrap(cli);
+    configure_cli_timing(cli);
 
     while (1) {
         control_mgmt_uart_dma_rx(DMA_RX_START);
diff --git a/projects/cli-test/mgmt-keywrap.c b/projects/cli-test/mgmt-keywrap.c
index 7d3e219..920d1ee 100644
--- a/projects/cli-test/mgmt-keywrap.c
+++ b/projects/cli-test/mgmt-keywrap.c
@@ -232,10 +232,19 @@ static int cmd_keywrap_test(struct cli_def *cli, const char *command, char *argv
         cli_print(cli, "with %s: OK", i ? "keywrap core" : "software keywrap");
     }
 
+    uint32_t start, elapsed, per;
+#define TIMER_START() \
+    start = HAL_GetTick()
+#define TIMER_STOP(op) \
+    elapsed = HAL_GetTick() - start; \
+    per = 1000 * elapsed / iterations; \
+    cli_print(cli, "%ld.%03lds total, %ld.%03ldms per " op, \
+              elapsed / 1000, elapsed % 1000, per / 1000, per % 1000)
+
     cli_print(cli, "\n2. wrap timing with software keywrap");
 
     hal_aes_use_keywrap_core(0);
-    uint32_t start = HAL_GetTick();
+    TIMER_START();
     for (int i = 0; i < iterations; ++i) {
         C_len = sizeof(C);
         if ((err = hal_aes_keywrap(NULL, K_256, sizeof(K_256), Q, keysize, C, &C_len)) != LIBHAL_OK) {
@@ -243,10 +252,7 @@ static int cmd_keywrap_test(struct cli_def *cli, const char *command, char *argv
             return CLI_ERROR;
         }
     }
-    uint32_t elapsed = HAL_GetTick() - start;
-    uint32_t per = 1000 * elapsed / iterations;
-    cli_print(cli, "%ld.%03lds total, %ld.%03ldms per wrap",
-              elapsed / 1000, elapsed % 1000, per / 1000, per % 1000);
+    TIMER_STOP("wrap");
 
     cli_print(cli, "\n3. wrap timing with keywrap core");
 
@@ -254,7 +260,7 @@ static int cmd_keywrap_test(struct cli_def *cli, const char *command, char *argv
         cli_print(cli, "keywrap core not found, skipping");
     }
     else {
-        start = HAL_GetTick();
+        TIMER_START();
         for (int i = 0; i < iterations; ++i) {
             C_len = sizeof(C);
             if ((err = hal_aes_keywrap(NULL, K_256, sizeof(K_256), Q, keysize, C, &C_len)) != LIBHAL_OK) {
@@ -262,16 +268,13 @@ static int cmd_keywrap_test(struct cli_def *cli, const char *command, char *argv
                 return CLI_ERROR;
             }
         }
-        elapsed = HAL_GetTick() - start;
-        per = 1000 * elapsed / iterations;
-        cli_print(cli, "%ld.%03lds total, %ld.%03ldms per wrap",
-                  elapsed / 1000, elapsed % 1000, per / 1000, per % 1000);
+        TIMER_STOP("wrap");
     }
 
     cli_print(cli, "\n4. unwrap timing with software keywrap");
 
     hal_aes_use_keywrap_core(0);
-    start = HAL_GetTick();
+    TIMER_START();
     for (int i = 0; i < iterations; ++i) {
         Q_len = sizeof(Q);
         if ((err = hal_aes_keyunwrap(NULL, K_256, sizeof(K_256), C, C_len, Q, &Q_len)) != LIBHAL_OK) {
@@ -279,10 +282,7 @@ static int cmd_keywrap_test(struct cli_def *cli, const char *command, char *argv
             return CLI_ERROR;
         }
     }
-    elapsed = HAL_GetTick() - start;
-    per = 1000 * elapsed / iterations;
-    cli_print(cli, "%ld.%03lds total, %ld.%03ldms per wrap",
-              elapsed / 1000, elapsed % 1000, per / 1000, per % 1000);
+    TIMER_STOP("unwrap");
 
     cli_print(cli, "\n5. unwrap timing with keywrap core");
 
@@ -290,7 +290,7 @@ static int cmd_keywrap_test(struct cli_def *cli, const char *command, char *argv
         cli_print(cli, "keywrap core not found, skipping");
     }
     else {
-        start = HAL_GetTick();
+        TIMER_START();
         for (int i = 0; i < iterations; ++i) {
             Q_len = sizeof(Q);
             if ((err = hal_aes_keyunwrap(NULL, K_256, sizeof(K_256), C, C_len, Q, &Q_len)) != LIBHAL_OK) {
@@ -298,19 +298,60 @@ static int cmd_keywrap_test(struct cli_def *cli, const char *command, char *argv
                 return CLI_ERROR;
             }
         }
-        elapsed = HAL_GetTick() - start;
-        per = 1000 * elapsed / iterations;
-        cli_print(cli, "%ld.%03lds total, %ld.%03ldms per wrap",
-                  elapsed / 1000, elapsed % 1000, per / 1000, per % 1000);
+        TIMER_STOP("unwrap");
+    }
+
+    uint8_t kek[KEK_LENGTH];
+    size_t kek_len;
+    cli_print(cli, "\n6. hal_mkm_get_kek");
+    TIMER_START();
+    for (int i = 0; i < iterations; ++i) {
+        if ((err = hal_mkm_get_kek(kek, &kek_len, sizeof(kek))) != LIBHAL_OK) {
+            cli_print(cli, "hal_mkm_get_kek: %s", hal_error_string(err));
+            return CLI_ERROR;
+        }
     }
+    TIMER_STOP("fetch");
+
+#undef TIMER_START
+#undef TIMER_STOP
 
     return CLI_OK;
 }
 
+static int cmd_keywrap_core(struct cli_def *cli, const char *command, char *argv[], int argc)
+{
+    command = command;
+
+    if (argc == 1) {
+        int onoff = -1;
+        if (strcmp(argv[0], "on") == 0)
+            onoff = 1;
+        else if (strcmp(argv[0], "off") == 0)
+            onoff = 0;
+        if (onoff >= 0) {
+            int ret = hal_aes_use_keywrap_core(onoff);
+            if (ret)
+                cli_print(cli, "keywrap core enabled");
+            else if (onoff)
+                cli_print(cli, "keywrap core not found");
+            else
+                cli_print(cli, "keywrap core disabled");
+            return CLI_OK;
+        }
+    }
+
+    cli_print(cli, "Syntax: keywrap core <on|off>");
+    return CLI_ERROR;
+}
+
 void configure_cli_keywrap(struct cli_def *cli)
 {
     struct cli_command *c_keywrap = cli_register_command(cli, NULL, "keywrap", NULL, 0, 0, NULL);
 
+    /* keywrap core */
+    cli_register_command(cli, c_keywrap, "core", cmd_keywrap_core, 0, 0, "Toggle use of the keywrap core");
+
     /* keywrap test */
     cli_register_command(cli, c_keywrap, "test", cmd_keywrap_test, 0, 0, "Test the keywrap core");
 }
diff --git a/projects/cli-test/mgmt-timing.c b/projects/cli-test/mgmt-timing.c
new file mode 100644
index 0000000..d3e0245
--- /dev/null
+++ b/projects/cli-test/mgmt-timing.c
@@ -0,0 +1,578 @@
+/*
+ * mgmt-timing.c
+ * -------------
+ * Timing tests for RSA signing and sub-components thereof.
+ *
+ * Copyright (c) 2018-2019, NORDUnet A/S All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions are
+ * met:
+ * - Redistributions of source code must retain the above copyright notice,
+ *   this list of conditions and the following disclaimer.
+ *
+ * - Redistributions in binary form must reproduce the above copyright
+ *   notice, this list of conditions and the following disclaimer in the
+ *   documentation and/or other materials provided with the distribution.
+ *
+ * - Neither the name of the NORDUnet nor the names of its contributors may
+ *   be used to endorse or promote products derived from this software
+ *   without specific prior written permission.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS
+ * IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED
+ * TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A
+ * PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+ * HOLDER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+ * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED
+ * TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF
+ * LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING
+ * NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS
+ * SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#include <string.h>
+
+#define HAL_OK CMSIS_HAL_OK
+#include "stm-init.h"
+#include "stm-uart.h"
+#include "mgmt-cli.h"
+#include "mgmt-timing.h"
+#undef HAL_OK
+
+/* Include the code we're going to be testing, since a lot of the
+ * functions we want to test are static.
+ */
+#define HAL_OK LIBHAL_OK
+#define STATIC_PKEY_STATE_BLOCKS 256
+#define HAL_STATIC_PKEY_STATE_BLOCKS STATIC_PKEY_STATE_BLOCKS
+#include "rpc_pkey.c"
+#include "rsa.c"
+static void hal_rsa_clear_blinding_cache(void)
+{
+  memset(&bfc, 0, sizeof(bfc));
+}
+#undef HAL_OK
+
+/*
+ * Message and der-encoded key are derived from libhal/tests/parallel-signatures.py.
+ */
+
+/*
+ *   m = pkcs1_hash_and_pad("Hamsters'R'Us")
+ */
+static const uint8_t m[] = {
+  0x30, 0x31, 0x30, 0x0d, 0x06, 0x09, 0x60, 0x86, 0x48, 0x01, 0x65, 0x03,
+  0x04, 0x02, 0x01, 0x05, 0x00, 0x04, 0x20, 0xe6, 0xbe, 0x9e, 0x24, 0x79,
+  0xbc, 0xad, 0xc7, 0x22, 0x81, 0x72, 0xe2, 0xc3, 0x3a, 0xdb, 0x8b, 0x3f,
+  0xfe, 0xfb, 0x3b, 0x87, 0x23, 0x76, 0xbd, 0x60, 0xfb, 0xe5, 0x8f, 0x8d,
+  0x3c, 0xbf, 0x44
+};
+
+/*
+ *   d = key_table["rsa_2048"].exportKey(format = "DER", pkcs = 8)
+ */
+static const uint8_t d[] = {
+  0x30, 0x82, 0x04, 0xbe, 0x02, 0x01, 0x00, 0x30, 0x0d, 0x06, 0x09, 0x2a,
+  0x86, 0x48, 0x86, 0xf7, 0x0d, 0x01, 0x01, 0x01, 0x05, 0x00, 0x04, 0x82,
+  0x04, 0xa8, 0x30, 0x82, 0x04, 0xa4, 0x02, 0x01, 0x00, 0x02, 0x82, 0x01,
+  0x01, 0x00, 0xb1, 0xbb, 0xea, 0xea, 0xcc, 0xa1, 0x0d, 0x70, 0xff, 0x38,
+  0xc5, 0x40, 0xb8, 0xba, 0x0c, 0x71, 0xe1, 0x90, 0x2d, 0x42, 0x22, 0x7b,
+  0x37, 0xd2, 0x85, 0x5a, 0x85, 0x7f, 0x23, 0x2a, 0x00, 0x38, 0xea, 0x84,
+  0x54, 0x56, 0x59, 0xba, 0x27, 0x9f, 0x45, 0xd5, 0xf5, 0x99, 0x32, 0xa5,
+  0x4e, 0x08, 0x6f, 0xd9, 0xfa, 0x3e, 0xd2, 0xc0, 0x4c, 0xd6, 0x9e, 0x7e,
+  0x1a, 0x6c, 0x52, 0x52, 0x38, 0xb3, 0xed, 0xb4, 0x61, 0x39, 0x50, 0xec,
+  0x68, 0xb0, 0x27, 0xda, 0x7d, 0xef, 0xf3, 0x75, 0xa3, 0x5b, 0xb4, 0xeb,
+  0x48, 0xda, 0xe0, 0xb7, 0x6a, 0x85, 0xf6, 0x2d, 0x9f, 0xc1, 0x99, 0x5f,
+  0xe2, 0x40, 0x7d, 0xae, 0x4d, 0xaa, 0x99, 0x8b, 0x28, 0x22, 0x79, 0xf1,
+  0x72, 0x77, 0xab, 0x6f, 0x0c, 0x3c, 0xb4, 0x70, 0x62, 0x9e, 0x72, 0x29,
+  0xc9, 0x23, 0x93, 0x37, 0x21, 0x64, 0x71, 0x72, 0x8e, 0xcd, 0x56, 0xee,
+  0xbe, 0x5a, 0x25, 0xf7, 0x89, 0xfe, 0xfb, 0x10, 0xba, 0xc5, 0xf7, 0x92,
+  0x59, 0x82, 0x7a, 0x12, 0x75, 0x8f, 0x14, 0x87, 0x3e, 0x1f, 0x28, 0xea,
+  0x54, 0xe3, 0x14, 0xc9, 0xc1, 0x2b, 0xcb, 0x77, 0xeb, 0x46, 0x13, 0xbb,
+  0x45, 0x06, 0x2b, 0xf4, 0x54, 0x70, 0x40, 0x18, 0x3b, 0xb9, 0x7b, 0x15,
+  0x68, 0xdd, 0xf0, 0xf8, 0xd9, 0x7d, 0xac, 0x17, 0x22, 0xb3, 0x80, 0x84,
+  0x22, 0xe4, 0x56, 0xf0, 0xc5, 0x7e, 0x9b, 0x25, 0xda, 0x8c, 0x85, 0x20,
+  0xbf, 0x5d, 0xd5, 0x01, 0x3c, 0xed, 0x67, 0x72, 0xc9, 0x95, 0xc0, 0xb5,
+  0x62, 0xec, 0xeb, 0x68, 0x27, 0x5f, 0xe9, 0x22, 0x06, 0xaf, 0x60, 0x52,
+  0x1b, 0xb9, 0x1a, 0xc8, 0x1c, 0x42, 0x27, 0xc7, 0x05, 0xc4, 0x62, 0x19,
+  0x97, 0xc7, 0xd1, 0x34, 0x48, 0x32, 0x02, 0x2c, 0x4a, 0x3b, 0x28, 0xaf,
+  0x31, 0xea, 0x27, 0xdb, 0xa8, 0x43, 0x02, 0x03, 0x01, 0x00, 0x01, 0x02,
+  0x82, 0x01, 0x00, 0x6a, 0xb3, 0xc7, 0x9f, 0xf9, 0x03, 0xc3, 0x5f, 0x10,
+  0x4a, 0x53, 0xd9, 0xbc, 0x4d, 0x2d, 0xc5, 0x7c, 0xc6, 0xa2, 0xf5, 0x2e,
+  0x60, 0x4d, 0x2e, 0x1d, 0x13, 0x30, 0x4c, 0x18, 0x9f, 0x51, 0x8c, 0xd9,
+  0xf6, 0x61, 0xef, 0x89, 0x64, 0xc1, 0xfe, 0xd3, 0xdd, 0x54, 0xda, 0x09,
+  0x56, 0xc6, 0x97, 0x38, 0x17, 0x64, 0x2e, 0x2d, 0x36, 0x77, 0xaa, 0xed,
+  0x72, 0x05, 0x88, 0xfc, 0x8f, 0x12, 0x2d, 0xab, 0x4a, 0x7c, 0x87, 0xfd,
+  0x76, 0x40, 0x8f, 0x69, 0x0d, 0xba, 0x47, 0xc1, 0x20, 0xe1, 0xd6, 0xdf,
+  0xb1, 0xd5, 0x86, 0x5a, 0x1c, 0xa3, 0x5e, 0x13, 0x62, 0x66, 0xa3, 0xc2,
+  0xe1, 0x96, 0xa2, 0x63, 0x11, 0xae, 0xdc, 0xf9, 0xdb, 0x5a, 0x58, 0x00,
+  0x5f, 0x9c, 0xfa, 0x0d, 0x38, 0xd8, 0xde, 0xe4, 0xf1, 0x07, 0xb3, 0xda,
+  0x14, 0x0e, 0x06, 0x46, 0x8e, 0x75, 0x84, 0xa8, 0xbb, 0x3e, 0xd1, 0x35,
+  0xd2, 0x54, 0x19, 0x4a, 0x1c, 0x46, 0x17, 0x12, 0x92, 0x1f, 0x90, 0x65,
+  0x30, 0x70, 0xb5, 0x0c, 0x6b, 0x92, 0xe8, 0x61, 0x1c, 0xdf, 0xb3, 0x90,
+  0x8a, 0xe2, 0xf9, 0x0d, 0x3d, 0x84, 0x5d, 0xa1, 0x02, 0x58, 0x87, 0xae,
+  0x1e, 0xa6, 0xa3, 0x0f, 0x1c, 0x8b, 0x48, 0x11, 0xb1, 0x79, 0xd9, 0xce,
+  0xc7, 0x49, 0x7d, 0x35, 0xfc, 0x09, 0xab, 0x07, 0x59, 0x32, 0x25, 0x97,
+  0x88, 0x1f, 0xae, 0xf5, 0xa7, 0x51, 0x8e, 0xe2, 0x62, 0xa0, 0x7a, 0xca,
+  0x74, 0x54, 0x60, 0xdf, 0xbb, 0x22, 0x04, 0x17, 0x31, 0x41, 0x4b, 0xce,
+  0x22, 0x25, 0x1f, 0x5a, 0x8d, 0xf8, 0x39, 0x44, 0x61, 0xdc, 0xe7, 0xb2,
+  0x00, 0x0f, 0x49, 0x2d, 0xc9, 0x75, 0x35, 0xa1, 0xd1, 0xcb, 0xe3, 0x88,
+  0xef, 0x30, 0x4c, 0x50, 0x27, 0x38, 0x87, 0x6c, 0x8f, 0xe0, 0x69, 0x2a,
+  0x80, 0xc1, 0x3c, 0xad, 0xb3, 0xcc, 0x39, 0x02, 0x81, 0x81, 0x00, 0xdd,
+  0x33, 0xfc, 0x87, 0x80, 0xec, 0xff, 0x2d, 0x6d, 0x0e, 0x28, 0xc4, 0xdd,
+  0x26, 0xab, 0xae, 0x0d, 0x2f, 0x5a, 0xe6, 0x3d, 0xee, 0xc2, 0x66, 0x02,
+  0x56, 0xb8, 0xa8, 0x51, 0xc7, 0xe2, 0x1b, 0x1c, 0x67, 0xce, 0x0d, 0x0f,
+  0x34, 0xcc, 0x23, 0xfa, 0x21, 0x2c, 0xf2, 0x60, 0xa5, 0xe4, 0x76, 0x31,
+  0xa0, 0x6a, 0x66, 0x65, 0x64, 0xf5, 0x41, 0x6b, 0x77, 0x7a, 0xdd, 0xb7,
+  0x7f, 0xe5, 0x5f, 0xa9, 0x12, 0x3b, 0xb2, 0x9f, 0x7d, 0xaf, 0x6b, 0x56,
+  0x07, 0xce, 0x07, 0x80, 0xaa, 0x27, 0x88, 0xe8, 0xb2, 0x8d, 0xe3, 0xd2,
+  0xa6, 0x3c, 0x57, 0xf8, 0x95, 0x05, 0xc0, 0xdc, 0x0f, 0x58, 0x78, 0x69,
+  0x70, 0x91, 0x5f, 0x6b, 0x4c, 0x24, 0x80, 0x94, 0x4e, 0x05, 0x54, 0xfc,
+  0xdf, 0x3f, 0xdb, 0x00, 0x44, 0x12, 0x57, 0x0e, 0x52, 0x36, 0x47, 0x1a,
+  0x57, 0x07, 0x99, 0xb1, 0xe7, 0x76, 0x55, 0x02, 0x81, 0x81, 0x00, 0xcd,
+  0xb1, 0x66, 0xb6, 0xd3, 0xee, 0x20, 0x7a, 0xd8, 0x1e, 0x49, 0x8e, 0x9b,
+  0xf0, 0xe3, 0x60, 0x1e, 0xb9, 0xf9, 0x60, 0xfc, 0x81, 0xf3, 0xcc, 0x75,
+  0xe5, 0x1b, 0x9f, 0x1f, 0xb2, 0x22, 0xde, 0x71, 0xc2, 0x29, 0x88, 0x6e,
+  0xad, 0x6a, 0x5b, 0x39, 0x78, 0xfb, 0xe8, 0x28, 0x4c, 0x00, 0x32, 0x69,
+  0x4f, 0xfb, 0xa8, 0xcf, 0x48, 0x7e, 0xf7, 0x91, 0xb9, 0xed, 0x01, 0xef,
+  0x28, 0xe7, 0x3d, 0xaf, 0x1f, 0x8c, 0xdf, 0x82, 0x71, 0x73, 0x06, 0x33,
+  0xa6, 0xb7, 0x04, 0x8a, 0x9e, 0x22, 0xfd, 0x62, 0x71, 0xf8, 0x23, 0x1f,
+  0x19, 0x6d, 0xec, 0x3f, 0xba, 0xe0, 0x5a, 0x44, 0x35, 0x65, 0xc7, 0xbc,
+  0x51, 0x34, 0x32, 0x14, 0x65, 0x88, 0x83, 0x5f, 0x91, 0x31, 0xe6, 0xf9,
+  0x4e, 0x3e, 0xd6, 0xcd, 0x34, 0xe3, 0x96, 0xbe, 0x6c, 0xb7, 0x53, 0x6d,
+  0xf5, 0x65, 0xcb, 0x58, 0x00, 0x4c, 0x37, 0x02, 0x81, 0x81, 0x00, 0xc8,
+  0xe6, 0xa8, 0x5a, 0x61, 0x4b, 0xde, 0x4e, 0xe1, 0x97, 0x54, 0x8b, 0xc7,
+  0xd7, 0x91, 0x61, 0x58, 0xf4, 0x43, 0x78, 0x8d, 0x93, 0x45, 0xd7, 0xe4,
+  0x13, 0xe3, 0x4e, 0x6c, 0x48, 0x40, 0x21, 0x23, 0x61, 0x5c, 0x11, 0x1c,
+  0x58, 0x75, 0x77, 0xcf, 0x7b, 0x46, 0x19, 0x34, 0x92, 0x36, 0xb6, 0xea,
+  0x47, 0xa9, 0x9b, 0x2a, 0x47, 0xd1, 0x40, 0x03, 0x5c, 0xd6, 0xa8, 0x7c,
+  0x3a, 0x9a, 0x96, 0x91, 0x35, 0xd0, 0x26, 0x61, 0x18, 0x83, 0xb3, 0xd6,
+  0xc4, 0xeb, 0xe8, 0x80, 0x81, 0x09, 0xbb, 0x1c, 0xac, 0xde, 0x95, 0xa6,
+  0x01, 0xf9, 0x18, 0x64, 0xda, 0xe4, 0x08, 0xcf, 0x54, 0xd8, 0xa3, 0x34,
+  0x10, 0x5a, 0xd7, 0xf0, 0xd9, 0x8c, 0xe5, 0x82, 0xcc, 0x81, 0xa7, 0x38,
+  0xab, 0x82, 0x91, 0x62, 0xe2, 0x70, 0x4d, 0xc4, 0xe2, 0x02, 0x0d, 0xfd,
+  0xec, 0x41, 0x28, 0xe4, 0x1d, 0x36, 0xa9, 0x02, 0x81, 0x81, 0x00, 0x8c,
+  0x0e, 0x4f, 0x32, 0x0d, 0xfc, 0x06, 0x81, 0x9e, 0xc6, 0x80, 0xaf, 0x69,
+  0xdf, 0x0b, 0xf3, 0x56, 0xf8, 0xaa, 0xa5, 0x2f, 0x4a, 0x0d, 0x07, 0x1a,
+  0xff, 0x75, 0x5f, 0x53, 0xe5, 0xa7, 0x78, 0x6f, 0x5d, 0x15, 0x8a, 0xa0,
+  0x51, 0xd4, 0x29, 0x69, 0x68, 0xc7, 0x9d, 0xbc, 0x52, 0x83, 0x8f, 0xcf,
+  0xc5, 0x76, 0x45, 0xeb, 0x5e, 0x21, 0x95, 0xd0, 0xd4, 0x18, 0x5d, 0x48,
+  0xcb, 0x41, 0x28, 0xef, 0x25, 0x3c, 0x76, 0xb4, 0x0b, 0x2b, 0x96, 0xfd,
+  0x74, 0x77, 0x09, 0xd0, 0x98, 0xfc, 0x9a, 0x2b, 0x7e, 0x0e, 0xc7, 0x5b,
+  0x55, 0xa5, 0x53, 0x47, 0xd1, 0xa7, 0x11, 0xcf, 0x7f, 0xcc, 0x5d, 0xc4,
+  0x0c, 0x46, 0xce, 0x12, 0xb5, 0x4f, 0xce, 0xa4, 0x33, 0xe9, 0x16, 0xac,
+  0x8a, 0x6a, 0x9f, 0x37, 0xfa, 0xdb, 0x3c, 0xb9, 0x4c, 0xad, 0x47, 0x51,
+  0x87, 0xd6, 0x58, 0x2f, 0x03, 0x84, 0xe1, 0x02, 0x81, 0x80, 0x73, 0x53,
+  0xc8, 0x48, 0x03, 0x43, 0xd4, 0xed, 0xa4, 0x4f, 0x52, 0xcd, 0x28, 0xf4,
+  0xc3, 0xbd, 0x5d, 0xcb, 0xd5, 0x3e, 0xf7, 0x57, 0xe9, 0x43, 0x8a, 0x74,
+  0xd6, 0xfd, 0x0a, 0x70, 0x4c, 0xb9, 0xd4, 0xbf, 0x72, 0x12, 0x87, 0x25,
+  0x46, 0x0f, 0x77, 0x47, 0xc5, 0x02, 0x25, 0x5a, 0x45, 0x7d, 0x09, 0x31,
+  0x0d, 0x11, 0x4a, 0xb7, 0xa7, 0xc4, 0x2a, 0x9f, 0x59, 0x5b, 0x56, 0xdd,
+  0x3d, 0xf0, 0x15, 0x83, 0x47, 0x07, 0xf2, 0x05, 0x44, 0x85, 0x13, 0xdc,
+  0x8e, 0x38, 0xc3, 0x05, 0xc9, 0x4c, 0xd3, 0x9e, 0xa2, 0x2d, 0xc5, 0x0d,
+  0x33, 0x31, 0x11, 0x07, 0xdc, 0xd1, 0x41, 0x68, 0x14, 0x7c, 0x9c, 0xde,
+  0x66, 0x04, 0x29, 0x1e, 0x33, 0x1e, 0x17, 0xaa, 0x40, 0x6e, 0x4e, 0x14,
+  0x13, 0x7c, 0xf4, 0xba, 0x86, 0xdd, 0x2f, 0x8e, 0xeb, 0xdb, 0xdc, 0xd6,
+  0xac, 0x02, 0xbc, 0xd2, 0x8b, 0xf9
+};
+
+#define TIMER_START()                                                   \
+    uint32_t start = HAL_GetTick()
+#define TIMER_STOP(op)                                                  \
+    uint32_t elapsed = HAL_GetTick() - start;                           \
+    uint32_t per = 1000 * elapsed / iterations;                         \
+    cli_print(cli, "%ld.%03lds total, %ld.%03ldms per " op,             \
+              elapsed / 1000, elapsed % 1000, per / 1000, per % 1000)
+
+hal_pkey_handle_t pkey = { HAL_HANDLE_NONE };
+hal_uuid_t name;
+
+static int cmd_timing_hal_rpc_pkey_sign(struct cli_def *cli, const char *command, char *argv[], int argc)
+{
+#define SETUP_hal_rpc_pkey_sign()                                       \
+    hal_error_t err;                                                    \
+    int keep;                                                           \
+                                                                        \
+    if (argc < 2) {                                                     \
+        cli_print(cli, "Syntax: %s <pin> <iterations> [keep]", command); \
+        return CLI_ERROR;                                               \
+    }                                                                   \
+    keep = (argc > 2);                                                  \
+                                                                        \
+    const int iterations = atoi(argv[1]);                               \
+    if (iterations == 0) {                                              \
+        cli_print(cli, "invalid value of iterations: %s", argv[1]);     \
+        return CLI_ERROR;                                               \
+    }                                                                   \
+                                                                        \
+    const hal_client_handle_t client = { 0 };                           \
+    const hal_session_handle_t session = { 0 };                         \
+    if (pkey.handle == HAL_HANDLE_NONE) {                               \
+        if ((err = hal_rpc_login(client, HAL_USER_NORMAL, argv[0],      \
+                                 strlen(argv[0]))) != LIBHAL_OK) {      \
+            cli_print(cli, "login: %s", hal_error_string(err));         \
+            return CLI_ERROR;                                           \
+        }                                                               \
+                                                                        \
+        if ((err = hal_rpc_pkey_load(client, session, &pkey, &name,     \
+                                     d, sizeof(d),                      \
+                                     HAL_KEY_FLAG_USAGE_DIGITALSIGNATURE)) \
+            != LIBHAL_OK) {                                             \
+            cli_print(cli, "hal_rpc_pkey_load: %s", hal_error_string(err)); \
+            return CLI_ERROR;                                           \
+        }                                                               \
+    }
+
+    SETUP_hal_rpc_pkey_sign();
+
+    const hal_hash_handle_t hash = { 0 };
+    uint8_t sig[1024];
+    size_t sig_len;
+    TIMER_START();
+    for (int i = 0; i < iterations; ++i) {
+        if ((err = hal_rpc_pkey_sign(pkey, hash, m, sizeof(m), sig, &sig_len, sizeof(sig))) != LIBHAL_OK) {
+            cli_print(cli, "hal_rpc_pkey_sign: %s", hal_error_string(err));
+            return CLI_ERROR;
+        }
+    }
+    TIMER_STOP("signature");
+
+#define TEARDOWN()                                                      \
+    if (!keep) {                                                        \
+        if ((err = hal_rpc_pkey_delete(pkey)) != LIBHAL_OK) {           \
+            cli_print(cli, "hal_rpc_pkey_delete: %s", hal_error_string(err)); \
+            return CLI_ERROR;                                           \
+        }                                                               \
+        pkey.handle = HAL_HANDLE_NONE;                                  \
+                                                                        \
+        if ((err = hal_rpc_logout(client)) != LIBHAL_OK) {              \
+            cli_print(cli, "logout: %s", hal_error_string(err));        \
+            return CLI_ERROR;                                           \
+        }                                                               \
+    }                                                                   \
+    return CLI_OK
+
+    TEARDOWN();
+}
+
+static int cmd_timing_pkey_local_sign_rsa(struct cli_def *cli, const char *command, char *argv[], int argc)
+{
+/* do one signature to do the precalc, then read back the rewritten key */
+#define SETUP_pkey_local_sign_rsa()                                     \
+    SETUP_hal_rpc_pkey_sign();                                          \
+                                                                        \
+    hal_pkey_slot_t slot = {                                            \
+        .client = client,                                               \
+        .session = session,                                             \
+        .pkey = pkey,                                                   \
+        .type = HAL_KEY_TYPE_RSA_PRIVATE,                               \
+        .curve = HAL_CURVE_NONE,                                        \
+        .flags = HAL_KEY_FLAG_USAGE_DIGITALSIGNATURE,                   \
+        .name = name                                                    \
+    };                                                                  \
+    const hal_hash_handle_t hash = { 0 };                               \
+    uint8_t sig[1024];                                                  \
+    size_t sig_len;                                                     \
+    if ((err = hal_rpc_pkey_sign(pkey, hash, m, sizeof(m),              \
+                                 sig, &sig_len, sizeof(sig))) != LIBHAL_OK) { \
+        cli_print(cli, "hal_rpc_pkey_sign: %s", hal_error_string(err)); \
+        return CLI_ERROR;                                               \
+    }                                                                   \
+    uint8_t der[HAL_KS_WRAPPED_KEYSIZE];                                \
+    size_t der_len;                                                     \
+    if ((err = hal_ks_fetch(hal_ks_volatile, &slot,                     \
+                            der, &der_len, sizeof(der))) != LIBHAL_OK) { \
+        cli_print(cli, "hal_ks_fetch: %s", hal_error_string(err));      \
+        return CLI_ERROR;                                               \
+    }
+
+    SETUP_pkey_local_sign_rsa();
+
+    uint8_t keybuf[hal_rsa_key_t_size];
+    TIMER_START();
+    for (int i = 0; i < iterations; ++i) {
+        if ((err = pkey_local_sign_rsa(&slot, keybuf, sizeof(keybuf), der, der_len, hash,
+                                       m, sizeof(m), sig, &sig_len, sizeof(sig))) != LIBHAL_OK) {
+            cli_print(cli, "pkey_local_sign_rsa: %s", hal_error_string(err));
+            return CLI_ERROR;
+        }
+    }
+    TIMER_STOP("signature");
+
+    TEARDOWN();
+}
+
+static int cmd_timing_hal_rsa_private_key_from_der(struct cli_def *cli, const char *command, char *argv[], int argc)
+{
+    SETUP_pkey_local_sign_rsa();
+
+    hal_rsa_key_t *key = NULL;
+    uint8_t keybuf[hal_rsa_key_t_size];
+    TIMER_START();
+    for (int i = 0; i < iterations; ++i) {
+        if ((err = hal_rsa_private_key_from_der(&key, keybuf, sizeof(keybuf), der, der_len)) != LIBHAL_OK) {
+            cli_print(cli, "hal_rsa_private_key_from_der: %s", hal_error_string(err));
+            return CLI_ERROR;
+        }
+    }
+    TIMER_STOP("read");
+
+    TEARDOWN();
+}
+
+static int cmd_timing_hal_rsa_decrypt(struct cli_def *cli, const char *command, char *argv[], int argc)
+{
+#define SETUP_hal_rsa_decrypt()                                         \
+    SETUP_pkey_local_sign_rsa();                                        \
+                                                			\
+    hal_rsa_key_t *key = NULL;                                          \
+    uint8_t keybuf[hal_rsa_key_t_size];                                 \
+    if ((err = hal_rsa_private_key_from_der(&key, keybuf, sizeof(keybuf), \
+                                            der, der_len)) != LIBHAL_OK) { \
+        cli_print(cli, "hal_rsa_private_key_from_der: %s", hal_error_string(err)); \
+        return CLI_ERROR;                                               \
+    }                                                                   \
+    if ((err = hal_rsa_key_get_modulus(key, NULL, &sig_len, 0)) != LIBHAL_OK) { \
+        cli_print(cli, "hal_rsa_key_get_modulus: %s", hal_error_string(err)); \
+        return CLI_ERROR;                                               \
+    }                                                                   \
+                                                                        \
+    uint8_t msg[sig_len];                                               \
+    if ((err = pkcs1_5_pad(m, sizeof(m), msg, sig_len, 0x01)) != LIBHAL_OK) { \
+        cli_print(cli, "pkcs1_5_pad: %s", hal_error_string(err));       \
+        return CLI_ERROR;                                               \
+    }
+
+    SETUP_hal_rsa_decrypt();
+
+    TIMER_START();
+    for (int i = 0; i < iterations; ++i) {
+        if ((err = hal_rsa_decrypt(NULL, NULL, key, msg, sig_len, sig, sig_len)) != LIBHAL_OK) {
+            cli_print(cli, "hal_rsa_decrypt: %s", hal_error_string(err));
+            return CLI_ERROR;
+        }
+    }
+    TIMER_STOP("signature");
+
+    TEARDOWN();
+}
+
+static int cmd_timing_rsa_crt(struct cli_def *cli, const char *command, char *argv[], int argc)
+{
+#define SETUP_rsa_crt()                         			\
+    SETUP_hal_rsa_decrypt();                                            \
+                                                                        \
+    fp_int in[1] = INIT_FP_INT;                                         \
+    fp_read_unsigned_bin(in, msg, sig_len)
+
+    SETUP_rsa_crt();
+
+    fp_int out[1] = INIT_FP_INT;
+
+    TIMER_START();
+    for (int i = 0; i < iterations; ++i) {
+        if ((err = rsa_crt(NULL, NULL, key, in, out)) != LIBHAL_OK) {
+            cli_print(cli, "rsa_crt: %s", hal_error_string(err));
+            return CLI_ERROR;
+        }
+    }
+    TIMER_STOP("signature");
+
+    TEARDOWN();
+}
+
+static int cmd_timing_modexp2(struct cli_def *cli, const char *command, char *argv[], int argc)
+{
+#define SETUP_modexp2()                                                 \
+    SETUP_rsa_crt();                                                    \
+    				                                        \
+    fp_int bf[1]  = INIT_FP_INT;                                        \
+    fp_int ubf[1] = INIT_FP_INT;                                        \
+                                                                        \
+    if ((err = create_blinding_factors(key, bf, ubf)) != LIBHAL_OK) {   \
+        cli_print(cli, "create_blinding_factors: %s", hal_error_string(err)); \
+        return CLI_ERROR;                                               \
+    }                                                                   \
+    if (fp_mulmod(in, bf, (fp_int *)key->n, in) != FP_OKAY) {           \
+        cli_print(cli, "fp_mulmod error");                              \
+        return CLI_ERROR;                                               \
+    }
+
+    SETUP_modexp2();
+    
+    fp_int m1[1]  = INIT_FP_INT;
+    fp_int m2[1]  = INIT_FP_INT;
+
+    TIMER_START();
+    for (int i = 0; i < iterations; ++i) {
+        if ((err = modexp2(0, in,
+                           NULL, key->dP, key->p, m1, key->pC, sizeof(key->pC), key->pF, sizeof(key->pF),
+                           NULL, key->dQ, key->q, m2, key->qC, sizeof(key->qC), key->qF, sizeof(key->qF))) != LIBHAL_OK) {
+            cli_print(cli, "modexp2: %s", hal_error_string(err));
+            return CLI_ERROR;
+        }
+    }
+    TIMER_STOP("signature");
+
+    TEARDOWN();
+}
+
+static int cmd_timing_hal_modexp2(struct cli_def *cli, const char *command, char *argv[], int argc)
+{
+    SETUP_modexp2();
+    
+    const size_t msg_len  = (fp_unsigned_bin_size(unconst_fp_int(in))  + 3) & ~3;
+    const size_t exp1_len = (fp_unsigned_bin_size(unconst_fp_int(key->dP)) + 3) & ~3;
+    const size_t mod1_len = (fp_unsigned_bin_size(unconst_fp_int(key->p)) + 3) & ~3;
+    const size_t exp2_len = (fp_unsigned_bin_size(unconst_fp_int(key->dQ)) + 3) & ~3;
+    const size_t mod2_len = (fp_unsigned_bin_size(unconst_fp_int(key->q)) + 3) & ~3;
+
+    uint8_t msgbuf[msg_len];
+    uint8_t expbuf1[exp1_len], modbuf1[mod1_len], resbuf1[mod1_len];
+    uint8_t expbuf2[exp2_len], modbuf2[mod2_len], resbuf2[mod2_len];
+
+    hal_modexp_arg_t args1 = {
+        .core   = NULL,
+        .msg    = msgbuf,  .msg_len    = sizeof(msgbuf),
+        .exp    = expbuf1, .exp_len    = sizeof(expbuf1),
+        .mod    = modbuf1, .mod_len    = sizeof(modbuf1),
+        .result = resbuf1, .result_len = sizeof(resbuf1),
+        .coeff  = key->pC, .coeff_len  = sizeof(key->pC),
+        .mont   = key->pF, .mont_len   = sizeof(key->pF)
+    };
+
+    hal_modexp_arg_t args2 = {
+        .core   = NULL,
+        .msg    = msgbuf,  .msg_len    = sizeof(msgbuf),
+        .exp    = expbuf2, .exp_len    = sizeof(expbuf2),
+        .mod    = modbuf2, .mod_len    = sizeof(modbuf2),
+        .result = resbuf2, .result_len = sizeof(resbuf2),
+        .coeff  = key->qC, .coeff_len  = sizeof(key->qC),
+        .mont   = key->qF, .mont_len   = sizeof(key->qF)
+    };
+
+    if ((err = unpack_fp(in,      msgbuf,  sizeof(msgbuf)))  != LIBHAL_OK ||
+        (err = unpack_fp(key->dP, expbuf1, sizeof(expbuf1))) != LIBHAL_OK ||
+        (err = unpack_fp(key->p,  modbuf1, sizeof(modbuf1))) != LIBHAL_OK ||
+        (err = unpack_fp(key->dQ, expbuf2, sizeof(expbuf2))) != LIBHAL_OK ||
+        (err = unpack_fp(key->q,  modbuf2, sizeof(modbuf2))) != LIBHAL_OK) {
+        cli_print(cli, "unpack_fp: %s", hal_error_string(err));
+        return CLI_ERROR;
+    }
+
+    TIMER_START();
+    for (int i = 0; i < iterations; ++i) {
+        if ((err = hal_modexp2(0, &args1, &args2)) != LIBHAL_OK) {
+            cli_print(cli, "hal_modexp2: %s", hal_error_string(err));
+            return CLI_ERROR;
+        }
+    }
+    TIMER_STOP("signature");
+
+    TEARDOWN();
+}
+
+static int cmd_timing_hal_ks_fetch(struct cli_def *cli, const char *command, char *argv[], int argc)
+{
+    SETUP_pkey_local_sign_rsa();
+
+    TIMER_START();
+    for (int i = 0; i < iterations; ++i) {
+        if ((err = hal_ks_fetch(hal_ks_volatile, &slot, der, &der_len, sizeof(der))) != LIBHAL_OK) {
+            cli_print(cli, "hal_ks_fetch: %s", hal_error_string(err));
+            return CLI_ERROR;
+        }
+    }
+    TIMER_STOP("fetch");
+
+    TEARDOWN();
+}
+
+static int cmd_timing_hal_mkm_get_kek(struct cli_def *cli, const char *command, char *argv[], int argc)
+{
+    SETUP_hal_rpc_pkey_sign();
+
+    uint8_t kek[KEK_LENGTH];
+    size_t kek_len;
+    TIMER_START();
+    for (int i = 0; i < iterations; ++i) {
+        if ((err = hal_mkm_get_kek(kek, &kek_len, sizeof(kek))) != LIBHAL_OK) {
+            cli_print(cli, "hal_mkm_get_kek: %s", hal_error_string(err));
+            return CLI_ERROR;
+        }
+    }
+    TIMER_STOP("fetch");
+
+    TEARDOWN();
+}
+
+static int cmd_timing_hal_aes_keyunwrap(struct cli_def *cli, const char *command, char *argv[], int argc)
+{
+    SETUP_pkey_local_sign_rsa();
+
+    uint8_t kek[KEK_LENGTH];
+    size_t kek_len;
+    if ((err = hal_mkm_get_kek(kek, &kek_len, sizeof(kek))) != LIBHAL_OK) {
+        cli_print(cli, "hal_mkm_get_kek: %s", hal_error_string(err));
+        return CLI_ERROR;
+    }
+
+    uint8_t wrapped[HAL_KS_WRAPPED_KEYSIZE];
+    size_t wrapped_len;
+    if ((err = hal_aes_keywrap(NULL, kek, kek_len, der, der_len, wrapped, &wrapped_len)) != LIBHAL_OK) {
+        cli_print(cli, "hal_aes_keywrap: %s", hal_error_string(err));
+        return CLI_ERROR;
+    }
+
+    uint8_t unwrapped[HAL_KS_WRAPPED_KEYSIZE];
+    size_t unwrapped_len;
+    TIMER_START();
+    for (int i = 0; i < iterations; ++i) {
+        unwrapped_len = sizeof(unwrapped);
+        if ((err = hal_aes_keyunwrap(NULL, kek, kek_len, wrapped, wrapped_len, unwrapped, &unwrapped_len)) != LIBHAL_OK) {
+            cli_print(cli, "hal_aes_unkeywrap: %s", hal_error_string(err));
+            return CLI_ERROR;
+        }
+    }
+    TIMER_STOP("unwrap");
+
+    TEARDOWN();
+}
+
+static int cmd_blinding(struct cli_def *cli, const char *command, char *argv[], int argc)
+{
+    extern void hal_rsa_clear_blinding_cache(void);
+    command = command;
+
+    if (argc == 1) {
+        if (strcmp(argv[0], "on") == 0)
+            return hal_rsa_set_blinding(1), CLI_OK;
+        else if (strcmp(argv[0], "off") == 0)
+            return hal_rsa_set_blinding(0), CLI_OK;
+        else if (strcmp(argv[0], "clear") == 0)
+            return hal_rsa_clear_blinding_cache(), CLI_OK;
+    }
+
+    cli_print(cli, "Syntax: blinding <on|off|clear>");
+    return CLI_ERROR;
+}
+
+void configure_cli_timing(struct cli_def *cli)
+{
+    cli_register_command(cli, NULL, "blinding", cmd_blinding, 0, 0, "Toggle use of RSA blinding");
+
+    struct cli_command *c_timing = cli_register_command(cli, NULL, "timing", NULL, 0, 0, NULL);
+
+    cli_register_command(cli, c_timing, "hal_rpc_pkey_sign", cmd_timing_hal_rpc_pkey_sign, 0, 0, "Timing test for hal_rpc_pkey_sign");
+    cli_register_command(cli, c_timing, "hal_ks_fetch", cmd_timing_hal_ks_fetch, 0, 0, "Timing test for hal_ks_fetch");
+    cli_register_command(cli, c_timing, "hal_mkm_get_kek", cmd_timing_hal_mkm_get_kek, 0, 0, "Timing test for hal_mkm_get_kek");
+    cli_register_command(cli, c_timing, "hal_aes_keyunwrap", cmd_timing_hal_aes_keyunwrap, 0, 0, "Timing test for hal_aes_keyunwrap");
+    cli_register_command(cli, c_timing, "pkey_local_sign_rsa", cmd_timing_pkey_local_sign_rsa, 0, 0, "Timing test for pkey_local_sign_rsa");
+    cli_register_command(cli, c_timing, "hal_rsa_private_key_from_der", cmd_timing_hal_rsa_private_key_from_der, 0, 0, "Timing test for hal_rsa_private_key_from_der");
+    cli_register_command(cli, c_timing, "hal_rsa_decrypt", cmd_timing_hal_rsa_decrypt, 0, 0, "Timing test for hal_rsa_decrypt");
+    cli_register_command(cli, c_timing, "rsa_crt", cmd_timing_rsa_crt, 0, 0, "Timing test for rsa_crt");
+    cli_register_command(cli, c_timing, "modexp2", cmd_timing_modexp2, 0, 0, "Timing test for modexp2");
+    cli_register_command(cli, c_timing, "hal_modexp2", cmd_timing_hal_modexp2, 0, 0, "Timing test for hal_modexp2");
+}
diff --git a/projects/cli-test/mgmt-timing.h b/projects/cli-test/mgmt-timing.h
new file mode 100644
index 0000000..2321456
--- /dev/null
+++ b/projects/cli-test/mgmt-timing.h
@@ -0,0 +1,42 @@
+/*
+ * mgmt-timing.h
+ * -------------
+ * Management CLI functions related to timing tests
+ *
+ * Copyright (c) 2018-2019, NORDUnet A/S All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions are
+ * met:
+ * - Redistributions of source code must retain the above copyright notice,
+ *   this list of conditions and the following disclaimer.
+ *
+ * - Redistributions in binary form must reproduce the above copyright
+ *   notice, this list of conditions and the following disclaimer in the
+ *   documentation and/or other materials provided with the distribution.
+ *
+ * - Neither the name of the NORDUnet nor the names of its contributors may
+ *   be used to endorse or promote products derived from this software
+ *   without specific prior written permission.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS
+ * IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED
+ * TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A
+ * PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+ * HOLDER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+ * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED
+ * TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF
+ * LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING
+ * NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS
+ * SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#ifndef __STM32_CLI_MGMT_TIMING_H
+#define __STM32_CLI_MGMT_TIMING_H
+
+#include <libcli.h>
+
+extern void configure_cli_timing(struct cli_def *cli);
+
+#endif /* __STM32_CLI_MGMT_TIMING_H */
diff --git a/projects/cli-test/test-fmc.c b/projects/cli-test/test-fmc.c
index 6773cfc..d9b0c9b 100644
--- a/projects/cli-test/test-fmc.c
+++ b/projects/cli-test/test-fmc.c
@@ -80,16 +80,8 @@ static int _write_then_read(struct cli_def *cli, uint32_t addr, uint32_t write_b
 {
     int ok;
 
-    ok = fmc_write_32(addr, write_buf);
-    if (ok != 0) {
-	cli_print(cli, "FMC write failed: 0x%x", ok);
-	return 0;
-    }
-    ok = fmc_read_32(0, read_buf);
-    if (ok != 0) {
-	cli_print(cli, "FMC read failed: 0x%x", ok);
-	return 0;
-    }
+    fmc_write_32(addr, write_buf);
+    fmc_read_32(0, read_buf);
 
     return 1;
 }
diff --git a/projects/hsm/Makefile b/projects/hsm/Makefile
index 3430e14..cd2cfde 100644
--- a/projects/hsm/Makefile
+++ b/projects/hsm/Makefile
@@ -9,6 +9,7 @@ OBJS =	mgmt-cli.o \
 	mgmt-masterkey.o \
 	mgmt-misc.o \
 	mgmt-task.o \
+	../cli-test/mgmt-timing.o \
 	log.o \
 	$(TOPLEVEL)/task.o
 
@@ -16,6 +17,9 @@ CFLAGS += -DNUM_RPC_TASK=4
 
 CFLAGS += -I$(LIBHAL_SRC)
 CFLAGS += -I$(LIBCLI_SRC)
+CFLAGS += -I$(LIBTFM_BLD)
+CFLAGS += -I../cli-test
+CFLAGS += -Wno-missing-field-initializers
 
 LIBS += $(LIBHAL_BLD)/libhal.a $(LIBTFM_BLD)/libtfm.a
 LIBS += $(LIBCLI_BLD)/libcli.a
diff --git a/projects/hsm/hsm.c b/projects/hsm/hsm.c
index 29509e8..8075ed6 100644
--- a/projects/hsm/hsm.c
+++ b/projects/hsm/hsm.c
@@ -86,9 +86,8 @@ static uint8_t busy_stack[BUSY_STACK_SIZE];
  * 4096-byte block of an FPGA or bootloader image upload.
  */
 #ifndef CLI_STACK_SIZE
-#define CLI_STACK_SIZE 8*1024
+#define CLI_STACK_SIZE 200*1024
 #endif
-static uint8_t cli_stack[CLI_STACK_SIZE];
 
 /* RPC buffers. For each active request, there will be two - input and output.
  */
@@ -501,7 +500,10 @@ int main(void)
      */
 
     /* Create the CLI task. */
-    if (task_add("cli", (funcp_t)cli_main, NULL, cli_stack, sizeof(cli_stack)) == NULL)
+    void *cli_stack = (void *)sdram_malloc(CLI_STACK_SIZE);
+    if (cli_stack == NULL)
+        Error_Handler();
+    if (task_add("cli", (funcp_t)cli_main, NULL, cli_stack, CLI_STACK_SIZE) == NULL)
         Error_Handler();
 
     /* Start the tasker */
diff --git a/projects/hsm/mgmt-cli.c b/projects/hsm/mgmt-cli.c
index 2b5be1f..d417314 100644
--- a/projects/hsm/mgmt-cli.c
+++ b/projects/hsm/mgmt-cli.c
@@ -49,6 +49,7 @@
 #include "mgmt-keystore.h"
 #include "mgmt-masterkey.h"
 #include "mgmt-task.h"
+#include "mgmt-timing.h"
 
 #undef HAL_OK
 #define HAL_OK LIBHAL_OK
@@ -197,6 +198,7 @@ int cli_main(void)
     configure_cli_bootloader(cli);
     configure_cli_misc(cli);
     configure_cli_task(cli);
+    configure_cli_timing(cli);
 
     while (1) {
         control_mgmt_uart_dma_rx(DMA_RX_START);