espressif/esp-idf
1
0
Fork 0
mirror of https://github.com/espressif/esp-idf.git synced 2026-04-27 19:13:21 +00:00
Code Issues Packages Projects Releases Wiki Activity

feat(bootloader_support): Support FE XTS-AES-256 using Key Manager for ESP32-C5

Browse Source
This commit is contained in:
harshal.patil
2025-11-05 08:32:19 +05:30
parent 9c823cdf38
commit 172f904e23
26 changed files with 95 additions and 15 deletions
Download Patch File Download Diff File Expand all files Collapse all files
components/bootloader/Kconfig.projbuild
+7 -2
View File
@@ -880,11 +880,16 @@ menu "Security features"
config SECURE_FLASH_ENCRYPTION_AES128
bool "AES-128 (256-bit key)"
depends on SOC_FLASH_ENCRYPTION_XTS_AES_128 && !(IDF_TARGET_ESP32C2 && SECURE_BOOT)
depends on SOC_FLASH_ENCRYPTION_XTS_AES_128 && \
((SECURE_FLASH_ENCRYPTION_KEY_SOURCE_EFUSES && SOC_EFUSE_XTS_AES_KEY_128) || \
(SECURE_FLASH_ENCRYPTION_KEY_SOURCE_KEY_MGR && SOC_KEY_MANAGER_FE_KEY_DEPLOY_XTS_AES_128)) && \
!(IDF_TARGET_ESP32C2 && SECURE_BOOT)
config SECURE_FLASH_ENCRYPTION_AES256
bool "AES-256 (512-bit key)"
depends on SOC_FLASH_ENCRYPTION_XTS_AES_256
depends on SOC_FLASH_ENCRYPTION_XTS_AES_256 && \
((SECURE_FLASH_ENCRYPTION_KEY_SOURCE_EFUSES && SOC_EFUSE_XTS_AES_KEY_256) || \
(SECURE_FLASH_ENCRYPTION_KEY_SOURCE_KEY_MGR && SOC_KEY_MANAGER_FE_KEY_DEPLOY_XTS_AES_256))
endchoice
choice SECURE_FLASH_ENCRYPTION_MODE
components/bootloader_support/src/flash_encrypt.c
+2 -2
View File
@@ -450,11 +450,11 @@ bool esp_flash_encryption_cfg_verify_release_mode(void)
#if CONFIG_SECURE_FLASH_ENCRYPTION_KEY_SOURCE_EFUSES
esp_efuse_purpose_t purposes[] = {
#if SOC_FLASH_ENCRYPTION_XTS_AES_256
#if SOC_EFUSE_XTS_AES_KEY_256
ESP_EFUSE_KEY_PURPOSE_XTS_AES_256_KEY_1,
ESP_EFUSE_KEY_PURPOSE_XTS_AES_256_KEY_2,
#endif
#if SOC_FLASH_ENCRYPTION_XTS_AES_128
#if SOC_EFUSE_XTS_AES_KEY_128
ESP_EFUSE_KEY_PURPOSE_XTS_AES_128_KEY,
#endif
};
components/efuse/src/efuse_controller/keys/with_key_purposes/esp_efuse_api_key.c
+3 -3
View File
@@ -286,7 +286,7 @@ esp_err_t esp_efuse_write_key(esp_efuse_block_t block, esp_efuse_purpose_t purpo
#if SOC_EFUSE_BLOCK9_KEY_PURPOSE_QUIRK
if (block == EFUSE_BLK9 && (
#if SOC_FLASH_ENCRYPTION_XTS_AES_256
#if SOC_EFUSE_XTS_AES_KEY_256
purpose == ESP_EFUSE_KEY_PURPOSE_XTS_AES_256_KEY_1 ||
purpose == ESP_EFUSE_KEY_PURPOSE_XTS_AES_256_KEY_2 ||
#endif
@@ -301,10 +301,10 @@ esp_err_t esp_efuse_write_key(esp_efuse_block_t block, esp_efuse_purpose_t purpo
#endif // SOC_EFUSE_BLOCK9_KEY_PURPOSE_QUIRK
if (purpose == ESP_EFUSE_KEY_PURPOSE_XTS_AES_128_KEY ||
#ifdef SOC_FLASH_ENCRYPTION_XTS_AES_256
#ifdef SOC_EFUSE_XTS_AES_KEY_256
purpose == ESP_EFUSE_KEY_PURPOSE_XTS_AES_256_KEY_1 ||
purpose == ESP_EFUSE_KEY_PURPOSE_XTS_AES_256_KEY_2 ||
#endif //#ifdef SOC_EFUSE_SUPPORT_XTS_AES_256_KEYS
#endif //#ifdef SOC_EFUSE_XTS_AES_KEY_256
#if SOC_EFUSE_ECDSA_KEY
purpose == ESP_EFUSE_KEY_PURPOSE_ECDSA_KEY ||
#endif
components/efuse/test_apps/main/with_key_purposes/test_efuse_keys.c
+5 -5
View File
@@ -57,7 +57,7 @@ TEST_CASE("Test efuse API blocks burning XTS and ECDSA keys into BLOCK9", "[efus
uint8_t key[32] = {0};
esp_efuse_purpose_t purpose = ESP_EFUSE_KEY_PURPOSE_XTS_AES_128_KEY;
TEST_ESP_ERR(ESP_ERR_NOT_SUPPORTED, esp_efuse_write_key(EFUSE_BLK9, purpose, &key, sizeof(key)));
#if SOC_FLASH_ENCRYPTION_XTS_AES_256
#if SOC_EFUSE_XTS_AES_KEY_256
purpose = ESP_EFUSE_KEY_PURPOSE_XTS_AES_256_KEY_1;
TEST_ESP_ERR(ESP_ERR_NOT_SUPPORTED, esp_efuse_write_key(EFUSE_BLK9, purpose, &key, sizeof(key)));
purpose = ESP_EFUSE_KEY_PURPOSE_XTS_AES_256_KEY_2;
@@ -86,7 +86,7 @@ static esp_err_t s_check_key(esp_efuse_block_t num_key, void* wr_key)
TEST_ASSERT_TRUE(esp_efuse_get_key_dis_write(num_key));
if (purpose == ESP_EFUSE_KEY_PURPOSE_XTS_AES_128_KEY ||
#ifdef SOC_FLASH_ENCRYPTION_XTS_AES_256
#ifdef SOC_EFUSE_XTS_AES_KEY_256
purpose == ESP_EFUSE_KEY_PURPOSE_XTS_AES_256_KEY_1 ||
purpose == ESP_EFUSE_KEY_PURPOSE_XTS_AES_256_KEY_2 ||
#endif
@@ -180,7 +180,7 @@ TEST_CASE("Test esp_efuse_write_key for virt mode", "[efuse]")
esp_efuse_purpose_t purpose = g_purpose;
#if SOC_EFUSE_BLOCK9_KEY_PURPOSE_QUIRK
if (num_key == EFUSE_BLK9 && (
#ifdef SOC_FLASH_ENCRYPTION_XTS_AES_256
#ifdef SOC_EFUSE_XTS_AES_KEY_256
purpose == ESP_EFUSE_KEY_PURPOSE_XTS_AES_256_KEY_1 ||
purpose == ESP_EFUSE_KEY_PURPOSE_XTS_AES_256_KEY_2 ||
#endif //#ifdef SOC_EFUSE_SUPPORT_XTS_AES_256_KEYS
@@ -224,7 +224,7 @@ TEST_CASE("Test 1 esp_efuse_write_key for FPGA", "[efuse]")
#else
ESP_EFUSE_KEY_PURPOSE_RESERVED,
#endif
#ifdef SOC_FLASH_ENCRYPTION_XTS_AES_256
#ifdef SOC_EFUSE_XTS_AES_KEY_256
ESP_EFUSE_KEY_PURPOSE_XTS_AES_256_KEY_1,
ESP_EFUSE_KEY_PURPOSE_XTS_AES_256_KEY_2,
#else
@@ -300,7 +300,7 @@ TEST_CASE("Test esp_efuse_write_keys", "[efuse]")
esp_efuse_block_t key_block = EFUSE_BLK_MAX;
enum { BLOCKS_NEEDED1 = 2 };
#ifdef SOC_FLASH_ENCRYPTION_XTS_AES_256
#ifdef SOC_EFUSE_XTS_AES_KEY_256
esp_efuse_purpose_t purpose1[BLOCKS_NEEDED1] = {
ESP_EFUSE_KEY_PURPOSE_XTS_AES_256_KEY_1,
ESP_EFUSE_KEY_PURPOSE_XTS_AES_256_KEY_2,
components/soc/esp32c2/include/soc/Kconfig.soc_caps.in
+4
View File
@@ -603,6 +603,10 @@ config SOC_EFUSE_DIS_DIRECT_BOOT
bool
default y
config SOC_EFUSE_XTS_AES_KEY_128
bool
default y
config SOC_SECURE_BOOT_V2_ECC
bool
default y
components/soc/esp32c2/include/soc/soc_caps.h
+1
View File
@@ -275,6 +275,7 @@
#define SOC_EFUSE_DIS_DOWNLOAD_ICACHE 1
#define SOC_EFUSE_DIS_PAD_JTAG 1
#define SOC_EFUSE_DIS_DIRECT_BOOT 1
#define SOC_EFUSE_XTS_AES_KEY_128 1
/*-------------------------- Secure Boot CAPS----------------------------*/
#define SOC_SECURE_BOOT_V2_ECC 1
components/soc/esp32c3/include/soc/Kconfig.soc_caps.in
+4
View File
@@ -879,6 +879,10 @@ config SOC_EFUSE_BLOCK9_KEY_PURPOSE_QUIRK
bool
default y
config SOC_EFUSE_XTS_AES_KEY_128
bool
default y
config SOC_SECURE_BOOT_V2_RSA
bool
default y
components/soc/esp32c3/include/soc/soc_caps.h
+1
View File
@@ -374,6 +374,7 @@
#define SOC_EFUSE_SOFT_DIS_JTAG 1
#define SOC_EFUSE_DIS_ICACHE 1
#define SOC_EFUSE_BLOCK9_KEY_PURPOSE_QUIRK 1 // XTS-AES key purpose not supported for this block
#define SOC_EFUSE_XTS_AES_KEY_128 1
/*-------------------------- Secure Boot CAPS----------------------------*/
#define SOC_SECURE_BOOT_V2_RSA 1
components/soc/esp32c5/include/soc/Kconfig.soc_caps.in
+8
View File
@@ -1279,6 +1279,10 @@ config SOC_EFUSE_ECDSA_KEY_P384
bool
default y
config SOC_EFUSE_XTS_AES_KEY_128
bool
default y
config SOC_HUK_MEM_NEEDS_RECHARGE
bool
default y
@@ -1347,6 +1351,10 @@ config SOC_FLASH_ENCRYPTION_XTS_AES_128
bool
default y
config SOC_FLASH_ENCRYPTION_XTS_AES_256
bool
default y
config SOC_FLASH_ENCRYPTION_XTS_AES_SUPPORT_PSEUDO_ROUND
bool
default y
components/soc/esp32c5/include/soc/soc_caps.h
+3 -1
View File
@@ -510,6 +510,7 @@
#define SOC_EFUSE_ECDSA_KEY 1
#define SOC_EFUSE_ECDSA_KEY_P192 1
#define SOC_EFUSE_ECDSA_KEY_P384 1
#define SOC_EFUSE_XTS_AES_KEY_128 1
/*-------------------------- HUK CAPS----------------------------*/
#define SOC_HUK_MEM_NEEDS_RECHARGE 1
@@ -534,7 +535,8 @@
#define SOC_FLASH_ENCRYPTED_XTS_AES_BLOCK_MAX (64)
#define SOC_FLASH_ENCRYPTION_XTS_AES 1
#define SOC_FLASH_ENCRYPTION_XTS_AES_OPTIONS 1
#define SOC_FLASH_ENCRYPTION_XTS_AES_128 1
#define SOC_FLASH_ENCRYPTION_XTS_AES_128 1 /* SOC_EFUSE_XTS_AES_KEY_128 (1) || SOC_KEY_MANAGER_FE_KEY_DEPLOY_XTS_AES_128 (1) */
#define SOC_FLASH_ENCRYPTION_XTS_AES_256 1 /* SOC_EFUSE_XTS_AES_KEY_256 (0) || SOC_KEY_MANAGER_FE_KEY_DEPLOY_XTS_AES_256 (1) */
#define SOC_FLASH_ENCRYPTION_XTS_AES_SUPPORT_PSEUDO_ROUND 1
/*-------------------------- PSRAM Encryption CAPS----------------------------*/
components/soc/esp32c6/include/soc/Kconfig.soc_caps.in
+4
View File
@@ -1119,6 +1119,10 @@ config SOC_EFUSE_BLOCK9_KEY_PURPOSE_QUIRK
bool
default y
config SOC_EFUSE_XTS_AES_KEY_128
bool
default y
config SOC_SECURE_BOOT_V2_RSA
bool
default y
components/soc/esp32c6/include/soc/soc_caps.h
+1
View File
@@ -454,6 +454,7 @@
#define SOC_EFUSE_SOFT_DIS_JTAG 1
#define SOC_EFUSE_DIS_ICACHE 1
#define SOC_EFUSE_BLOCK9_KEY_PURPOSE_QUIRK 1 // XTS-AES key purpose not supported for this block
#define SOC_EFUSE_XTS_AES_KEY_128 1
/*-------------------------- Secure Boot CAPS----------------------------*/
#define SOC_SECURE_BOOT_V2_RSA 1
components/soc/esp32c61/include/soc/Kconfig.soc_caps.in
+4
View File
@@ -911,6 +911,10 @@ config SOC_EFUSE_ECDSA_KEY
bool
default y
config SOC_EFUSE_XTS_AES_KEY_128
bool
default y
config SOC_SECURE_BOOT_V2_RSA
bool
default n
components/soc/esp32c61/include/soc/soc_caps.h
+1
View File
@@ -378,6 +378,7 @@
#define SOC_EFUSE_SOFT_DIS_JTAG 0
#define SOC_EFUSE_DIS_ICACHE 1
#define SOC_EFUSE_ECDSA_KEY 1
#define SOC_EFUSE_XTS_AES_KEY_128 1
/*-------------------------- Secure Boot CAPS----------------------------*/
#define SOC_SECURE_BOOT_V2_RSA 0
components/soc/esp32h2/include/soc/Kconfig.soc_caps.in
+4
View File
@@ -1131,6 +1131,10 @@ config SOC_EFUSE_ECDSA_KEY
bool
default y
config SOC_EFUSE_XTS_AES_KEY_128
bool
default y
config SOC_SECURE_BOOT_V2_RSA
bool
default y
components/soc/esp32h2/include/soc/soc_caps.h
+1
View File
@@ -473,6 +473,7 @@
#define SOC_EFUSE_ECDSA_USE_HARDWARE_K 1 // Force use hardware TRNG supplied K for ECDSA
#endif
#define SOC_EFUSE_ECDSA_KEY 1
#define SOC_EFUSE_XTS_AES_KEY_128 1
/*-------------------------- Secure Boot CAPS----------------------------*/
#define SOC_SECURE_BOOT_V2_RSA 1
components/soc/esp32h21/include/soc/Kconfig.soc_caps.in
+4
View File
@@ -819,6 +819,10 @@ config SOC_EFUSE_ECDSA_KEY
bool
default y
config SOC_EFUSE_XTS_AES_KEY_128
bool
default y
config SOC_SECURE_BOOT_V2_RSA
bool
default y
components/soc/esp32h21/include/soc/soc_caps.h
+1
View File
@@ -451,6 +451,7 @@
#define SOC_EFUSE_DIS_ICACHE 1
// #define SOC_EFUSE_ECDSA_USE_HARDWARE_K 1 // Force use hardware TRNG supplied K for ECDSA
#define SOC_EFUSE_ECDSA_KEY 1
#define SOC_EFUSE_XTS_AES_KEY_128 1
/*-------------------------- Secure Boot CAPS----------------------------*/
#define SOC_SECURE_BOOT_V2_RSA 1
components/soc/esp32h4/include/soc/Kconfig.soc_caps.in
+4
View File
@@ -811,6 +811,10 @@ config SOC_EFUSE_ECDSA_KEY
bool
default n
config SOC_EFUSE_XTS_AES_KEY_128
bool
default y
config SOC_SECURE_BOOT_V2_RSA
bool
default y
components/soc/esp32h4/include/soc/soc_caps.h
+1
View File
@@ -437,6 +437,7 @@
#define SOC_EFUSE_DIS_ICACHE 0
#define SOC_EFUSE_BLOCK9_KEY_PURPOSE_QUIRK 1 // XTS-AES key purpose not supported for this block
#define SOC_EFUSE_ECDSA_KEY 0 // TODO: [ESP32H4] IDF-12259
#define SOC_EFUSE_XTS_AES_KEY_128 1
/*-------------------------- Secure Boot CAPS----------------------------*/
#define SOC_SECURE_BOOT_V2_RSA 1
components/soc/esp32p4/include/soc/Kconfig.soc_caps.in
+8
View File
@@ -1679,6 +1679,14 @@ config SOC_EFUSE_ECDSA_KEY
bool
default y
config SOC_EFUSE_XTS_AES_KEY_128
bool
default y
config SOC_EFUSE_XTS_AES_KEY_256
bool
default y
config SOC_KEY_MANAGER_SUPPORT_KEY_DEPLOYMENT
bool
default y
components/soc/esp32p4/include/soc/soc_caps.h
+4 -2
View File
@@ -634,6 +634,8 @@
/* Capability to disable the MSPI access in download mode */
#define SOC_EFUSE_DIS_DOWNLOAD_MSPI 1
#define SOC_EFUSE_ECDSA_KEY 1
#define SOC_EFUSE_XTS_AES_KEY_128 1
#define SOC_EFUSE_XTS_AES_KEY_256 1
/*-------------------------- Key Manager CAPS----------------------------*/
#define SOC_KEY_MANAGER_SUPPORT_KEY_DEPLOYMENT 1 /*!< Key manager supports key deployment */
@@ -655,8 +657,8 @@
#define SOC_FLASH_ENCRYPTED_XTS_AES_BLOCK_MAX (64)
#define SOC_FLASH_ENCRYPTION_XTS_AES 1
#define SOC_FLASH_ENCRYPTION_XTS_AES_OPTIONS 1
#define SOC_FLASH_ENCRYPTION_XTS_AES_128 1
#define SOC_FLASH_ENCRYPTION_XTS_AES_256 1
#define SOC_FLASH_ENCRYPTION_XTS_AES_128 1 /* SOC_EFUSE_XTS_AES_KEY_128 (1) || SOC_KEY_MANAGER_FE_KEY_DEPLOY_XTS_AES_128 (1) */
#define SOC_FLASH_ENCRYPTION_XTS_AES_256 1 /* SOC_EFUSE_XTS_AES_KEY_256 (1) || SOC_KEY_MANAGER_FE_KEY_DEPLOY_XTS_AES_256 (1) */
/*-------------------------- MEMPROT CAPS ------------------------------------*/
/*-------------------------- UART CAPS ---------------------------------------*/
components/soc/esp32s2/include/soc/Kconfig.soc_caps.in
+8
View File
@@ -915,6 +915,14 @@ config SOC_EFUSE_DIS_ICACHE
bool
default y
config SOC_EFUSE_XTS_AES_KEY_128
bool
default y
config SOC_EFUSE_XTS_AES_KEY_256
bool
default y
config SOC_SECURE_BOOT_V2_RSA
bool
default y
components/soc/esp32s2/include/soc/soc_caps.h
+2
View File
@@ -396,6 +396,8 @@
#define SOC_EFUSE_DIS_BOOT_REMAP 1
#define SOC_EFUSE_DIS_LEGACY_SPI_BOOT 1
#define SOC_EFUSE_DIS_ICACHE 1
#define SOC_EFUSE_XTS_AES_KEY_128 1
#define SOC_EFUSE_XTS_AES_KEY_256 1
/*-------------------------- Secure Boot CAPS----------------------------*/
#define SOC_SECURE_BOOT_V2_RSA 1
components/soc/esp32s3/include/soc/Kconfig.soc_caps.in
+8
View File
@@ -1163,6 +1163,14 @@ config SOC_EFUSE_BLOCK9_KEY_PURPOSE_QUIRK
bool
default y
config SOC_EFUSE_XTS_AES_KEY_128
bool
default y
config SOC_EFUSE_XTS_AES_KEY_256
bool
default y
config SOC_SECURE_BOOT_V2_RSA
bool
default y
components/soc/esp32s3/include/soc/soc_caps.h
+2
View File
@@ -470,6 +470,8 @@
#define SOC_EFUSE_DIS_DIRECT_BOOT 1
#define SOC_EFUSE_DIS_ICACHE 1
#define SOC_EFUSE_BLOCK9_KEY_PURPOSE_QUIRK 1 // XTS-AES key purpose not supported for this block
#define SOC_EFUSE_XTS_AES_KEY_128 1
#define SOC_EFUSE_XTS_AES_KEY_256 1
/*-------------------------- Secure Boot CAPS----------------------------*/
#define SOC_SECURE_BOOT_V2_RSA 1