Add Authenticated HTTPS Admin Foundation

src/secure_random.h

@@ -0,0 +1,32 @@
+/* SPDX-License-Identifier: GPL-3.0-only */
+/* Device-wide cryptographic random generator shared by security subsystems. */
+
+#pragma once
+
+#include <stddef.h>
+
+#include "esp_err.h"
+
+#ifdef __cplusplus
+extern "C" {
+#endif
+
+/*
+ * Seed the sole CTR_DRBG while bootloader entropy is safe to enable. Call this
+ * before Wi-Fi, Bluetooth, or ADC startup; later calls are idempotent and do
+ * not touch the hardware entropy source.
+ */
+esp_err_t secure_random_init(void);
+
+/* Fill output from the already-seeded, mutex-protected device DRBG. */
+esp_err_t secure_random_fill(void *output, size_t length);
+
+/* Mbed TLS-compatible adapter: zero means success, negative means failure. */
+int secure_random_mbedtls(void *context, unsigned char *output, size_t length);
+
+/* Volatile stores keep cleanup of key material from being optimized away. */
+void secure_wipe(void *data, size_t size);
+
+#ifdef __cplusplus
+}
+#endif