Skip to content

Commit 1ea0fc2

Browse files
laukik-haselaukik-hase
committed
change(nvs_sec_provider): Make the HMAC-based NVS security scheme default for supported SoCs
- When NVS encryption is enabled on SoCs with the HMAC peripheral that have flash encryption enabled, the HMAC-based NVS encryption scheme is now selected as default instead of the flash encryption-based scheme. - If your application previously used the flash encryption-based scheme, you need to manually configure the NVS encryption scheme to flash encryption from HMAC through ``menuconfig`` or your project's ``sdkconfig`` (i.e., setting ``CONFIG_NVS_SEC_KEY_PROTECT_USING_FLASH_ENC=y``).
1 parent f565fc2 commit 1ea0fc2

File tree

17 files changed

+25
-1
lines changed

17 files changed

+25
-1
lines changed

‎components/esp_tee/test_apps/tee_cli_app/sdkconfig.ci.sb_fe‎

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -9,6 +9,8 @@ CONFIG_SECURE_BOOT_SIGNING_KEY="test_keys/secure_boot_signing_key.pem"
99
# Flash Encryption
1010
CONFIG_SECURE_FLASH_ENC_ENABLED=y
1111
CONFIG_SECURE_FLASH_ENCRYPTION_MODE_RELEASE=y
12+
# NVS Encryption
13+
CONFIG_NVS_SEC_KEY_PROTECT_USING_FLASH_ENC=y
1214

1315
# TEE Secure Storage: Release mode
1416
CONFIG_SECURE_TEE_SEC_STG_MODE_RELEASE=y

‎components/nvs_sec_provider/Kconfig‎

Lines changed: 2 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -4,7 +4,8 @@ menu "NVS Security Provider"
44
choice NVS_SEC_KEY_PROTECTION_SCHEME
55
prompt "NVS Encryption: Key Protection Scheme"
66
depends on NVS_ENCRYPTION
7-
default NVS_SEC_KEY_PROTECT_USING_FLASH_ENC
7+
default NVS_SEC_KEY_PROTECT_USING_HMAC if SOC_HMAC_SUPPORTED
8+
default NVS_SEC_KEY_PROTECT_USING_FLASH_ENC if !SOC_HMAC_SUPPORTED
89
help
910
This choice defines the default NVS encryption keys protection scheme;
1011
which will be used for the default NVS partition.

‎docs/en/migration-guides/release-6.x/6.0/security.rst‎

Lines changed: 7 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -30,3 +30,10 @@ Bootloader Support
3030
The following deprecated functions have been removed:
3131

3232
- :cpp:func:`esp_secure_boot_verify_signature_block` – Use :cpp:func:`esp_secure_boot_verify_ecdsa_signature_block` instead.
33+
34+
.. only:: SOC_HMAC_SUPPORTED
35+
36+
NVS Security Provider
37+
---------------------
38+
39+
- When NVS encryption is enabled on SoCs with the HMAC peripheral that have flash encryption enabled, the HMAC-based NVS encryption scheme is now selected as default instead of the flash encryption-based scheme. If your application previously used the flash encryption-based scheme, you need to manually configure the NVS encryption scheme to flash encryption from HMAC through ``menuconfig`` or your project's ``sdkconfig`` (i.e., setting ``CONFIG_NVS_SEC_KEY_PROTECT_USING_FLASH_ENC=y``).

‎examples/security/flash_encryption/sdkconfig.ci‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -10,3 +10,4 @@ CONFIG_SECURE_FLASH_UART_BOOTLOADER_ALLOW_ENC=y
1010
CONFIG_SECURE_FLASH_UART_BOOTLOADER_ALLOW_DEC=y
1111
CONFIG_SECURE_FLASH_UART_BOOTLOADER_ALLOW_CACHE=y
1212
CONFIG_SECURE_FLASH_REQUIRE_ALREADY_ENABLED=y
13+
CONFIG_NVS_SEC_KEY_PROTECT_USING_FLASH_ENC=y

‎examples/security/flash_encryption/sdkconfig.ci.psram‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -7,6 +7,7 @@ CONFIG_SECURE_FLASH_UART_BOOTLOADER_ALLOW_ENC=y
77
CONFIG_SECURE_FLASH_UART_BOOTLOADER_ALLOW_DEC=y
88
CONFIG_SECURE_FLASH_UART_BOOTLOADER_ALLOW_CACHE=y
99
CONFIG_SECURE_FLASH_REQUIRE_ALREADY_ENABLED=y
10+
CONFIG_NVS_SEC_KEY_PROTECT_USING_FLASH_ENC=y
1011

1112
CONFIG_SPIRAM=y
1213
CONFIG_SPIRAM_BOOT_INIT=y

‎examples/security/flash_encryption/sdkconfig.ci.rom_impl‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -7,6 +7,7 @@ CONFIG_SECURE_FLASH_UART_BOOTLOADER_ALLOW_ENC=y
77
CONFIG_SECURE_FLASH_UART_BOOTLOADER_ALLOW_DEC=y
88
CONFIG_SECURE_FLASH_UART_BOOTLOADER_ALLOW_CACHE=y
99
CONFIG_SECURE_FLASH_REQUIRE_ALREADY_ENABLED=y
10+
CONFIG_NVS_SEC_KEY_PROTECT_USING_FLASH_ENC=y
1011

1112
CONFIG_SPI_FLASH_ROM_IMPL=y
1213
CONFIG_COMPILER_OPTIMIZATION_SIZE=y

‎examples/security/security_features_app/sdkconfig.defaults‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -29,3 +29,4 @@ CONFIG_SECURE_FLASH_ENCRYPT_ONLY_IMAGE_LEN_IN_APP_PART=y
2929
CONFIG_SECURE_FLASH_CHECK_ENC_EN_IN_APP=y
3030
CONFIG_SECURE_ROM_DL_MODE_ENABLED=y
3131
CONFIG_SECURE_ENABLE_SECURE_ROM_DL_MODE=y
32+
CONFIG_NVS_SEC_KEY_PROTECT_USING_FLASH_ENC=y

‎examples/system/ota/advanced_https_ota/sdkconfig.ci.anti_rollback‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -38,3 +38,4 @@ CONFIG_SECURE_FLASH_UART_BOOTLOADER_ALLOW_DEC=y
3838
CONFIG_SECURE_FLASH_UART_BOOTLOADER_ALLOW_CACHE=y
3939
CONFIG_SECURE_FLASH_REQUIRE_ALREADY_ENABLED=y
4040
CONFIG_NVS_ENCRYPTION=n # this test combination is only for flash encryption and anti-rollback use-case and hence disabling it.
41+
CONFIG_NVS_SEC_KEY_PROTECT_USING_FLASH_ENC=y

‎examples/system/ota/partitions_ota/sdkconfig.ci.flash_enc_wifi‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -16,6 +16,7 @@ CONFIG_SECURE_FLASH_UART_BOOTLOADER_ALLOW_ENC=y
1616
CONFIG_SECURE_FLASH_UART_BOOTLOADER_ALLOW_DEC=y
1717
CONFIG_SECURE_FLASH_UART_BOOTLOADER_ALLOW_CACHE=y
1818
CONFIG_SECURE_FLASH_REQUIRE_ALREADY_ENABLED=y
19+
CONFIG_NVS_SEC_KEY_PROTECT_USING_FLASH_ENC=y
1920

2021
# This is required for nvs encryption (which is enabled by default with flash encryption)
2122
CONFIG_PARTITION_TABLE_OFFSET=0x9000

‎examples/system/ota/partitions_ota/sdkconfig.ci.flash_enc_wifi_2‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -16,6 +16,7 @@ CONFIG_SECURE_FLASH_UART_BOOTLOADER_ALLOW_ENC=y
1616
CONFIG_SECURE_FLASH_UART_BOOTLOADER_ALLOW_DEC=y
1717
CONFIG_SECURE_FLASH_UART_BOOTLOADER_ALLOW_CACHE=y
1818
CONFIG_SECURE_FLASH_REQUIRE_ALREADY_ENABLED=y
19+
CONFIG_NVS_SEC_KEY_PROTECT_USING_FLASH_ENC=y
1920

2021
# This is required for nvs encryption (which is enabled by default with flash encryption)
2122
CONFIG_PARTITION_TABLE_OFFSET=0x9000

0 commit comments

Comments
 (0)