Skip to content

Commit 18c09cf

Browse files
committed
Merge branch 'fix/fix_security_app_readme' into 'master'
fix(security): Fixed README for security features app See merge request espressif/esp-idf!37140
2 parents e2fc363 + 786dcac commit 18c09cf

File tree

1 file changed

+6
-6
lines changed
  • examples/security/security_features_app

1 file changed

+6
-6
lines changed

examples/security/security_features_app/README.md

Lines changed: 6 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -111,13 +111,13 @@ The necessary `security eFuses` are yet to be burned. They shall be burned by th
111111
When the application is built (later in the workflow) the `bootloader` and `application` shall only be signed with the first key. To sign it with multiple keys, please follow below additional steps:
112112

113113
- Repeat `Step 1` to `Step 3` for `secure_boot_signing_key_2.pem` and `secure_boot_signing_key_3.pem` respectively.
114-
- Sign it with remaining two keys by executing following commands for `secure_boot_signing_key_2.pem` and `secure_boot_signing_key_3.pem` respectively:
114+
- Sign it with remaining two keys by executing following commands with adding `-a` option for `secure_boot_signing_key_2.pem` and `secure_boot_signing_key_3.pem` respectively:
115115

116116
```
117117
espsecure.py sign_data --version 2 --keyfile /* Signing key placeholder */ --output bootloader-signed.bin build/bootloader/bootloader.bin
118118
```
119119
```
120-
espsecure.py sign_data --version 2 --keyfile /* Signing key placeholder */ --output my-app-signed.bin build/security_features.bin
120+
espsecure.py sign_data --version 2 --keyfile /* Signing key placeholder */ --output my-app-signed.bin build/security_features_app.bin
121121
```
122122

123123

@@ -150,7 +150,7 @@ Follow below steps to enable Flash Encryption:
150150
espefuse.py --port $ESPPORT --chip esp32c3 burn_efuse SPI_BOOT_CRYPT_CNT 7
151151
```
152152

153-
At this point the Flash Encryption feature is enabled for the device. The necessary `security eFuses` shall be enabled by the `security_features` firmware.
153+
At this point the Flash Encryption feature is enabled for the device. The necessary `security eFuses` shall be enabled by the `security_features_app` firmware.
154154

155155
#### Encrypting the partitions
156156
After the application is built (Later in the workflow), all partitions that need encryption can be encrypted with the following command:
@@ -161,7 +161,7 @@ espsecure.py encrypt_flash_data --aes_xts --keyfile my_flash_encryption_key.bin
161161

162162
The bootloader offset for esp32c3 is `0x0`. The partition table offset for the example has been set to `0xD000` which can be changed through menuconfig. The partition offset for other partitions can be obtained by running ```idf.py partition-table```
163163

164-
For this example we need to encrypt only the following 3 partitions: `bootloader.bin`, `partition-table.bin`, `security_features.bin`.
164+
For this example we need to encrypt only the following 3 partitions: `bootloader.bin`, `partition-table.bin`, `security_features_app.bin`.
165165

166166
It can be done with following commands:
167167

@@ -213,7 +213,7 @@ We shall use the [nvs_partition_gen.py](../../../components/nvs_flash/nvs_partit
213213

214214
4. This shall generate `nvs_encr_partition.bin` which we shall flash later at the [Flash stage](README.md#flash) of the workflow.
215215

216-
### Enabling Secure JTAG Return Material Access (RMA)
216+
### Enabling Secure JTAG Return Material Authorization (RMA)
217217

218218
The target provides an ability to disable JTAG access in the device for the software. Which can be re-enabled in future after authentication using a unique token generated beforehand. This way the module can be opened up by bypassing security features after authentication for debugging purposes after it has returned back to the manufacturer due to some issue. This way when a security wise locked device comes back to the ODM/OEM due to some issue, the module can be opened up by bypassing security features after successful authentication.
219219

@@ -250,7 +250,7 @@ The target provides an ability to disable JTAG access in the device for the soft
250250

251251
5. Configuring appropriate JTAG interface
252252

253-
By default esp32c3 is set to use the [built-in JTAG interface](https://docs.espressif.com/projects/esp-idf/en/v4.3/esp32c3/api-guides/jtag-debugging/configure-builtin-jtag.html). Please follow the steps given [here](https://docs.espressif.com/projects/esp-idf/en/v4.3/esp32c3/api-guides/jtag-debugging/configure-other-jtag.html) to configure the alternative JTAG interface.
253+
By default esp32c3 is set to use the [built-in JTAG interface](https://docs.espressif.com/projects/esp-idf/en/stable/esp32c3/api-guides/jtag-debugging/configure-builtin-jtag.html). Please follow the steps given [here](https://docs.espressif.com/projects/esp-idf/en/stable/esp32c3/api-guides/jtag-debugging/configure-other-jtag.html) to configure the alternative JTAG interface.
254254
Please note that JTAG configuration cannot be done once the application firmware is flashed on the device.
255255

256256
## Build

0 commit comments

Comments
 (0)