Skip to content

Commit 265b0d7

Browse files
Harshal5Harshal5
committed
feat(esp_key_mgr): Support HMAC key deployments using Key Manager
1 parent 8ab6b4d commit 265b0d7

File tree

7 files changed

+84
-16
lines changed

7 files changed

+84
-16
lines changed

‎components/esp_hw_support/include/esp_hmac.h‎

Lines changed: 2 additions & 14 deletions
Original file line numberDiff line numberDiff line change
@@ -1,5 +1,5 @@
11
/*
2-
* SPDX-FileCopyrightText: 2015-2021 Espressif Systems (Shanghai) CO LTD
2+
* SPDX-FileCopyrightText: 2015-2025 Espressif Systems (Shanghai) CO LTD
33
*
44
* SPDX-License-Identifier: Apache-2.0
55
*/
@@ -9,6 +9,7 @@
99
#include <stdbool.h>
1010
#include "esp_err.h"
1111
#include "soc/soc_caps.h"
12+
#include "hal/hmac_types.h"
1213

1314
#if !SOC_HMAC_SUPPORTED && !CI_HEADER_CHECK
1415
#error "HMAC peripheral is not supported for the selected target"
@@ -18,19 +19,6 @@
1819
extern "C" {
1920
#endif
2021

21-
/**
22-
* The possible efuse keys for the HMAC peripheral
23-
*/
24-
typedef enum {
25-
HMAC_KEY0 = 0,
26-
HMAC_KEY1,
27-
HMAC_KEY2,
28-
HMAC_KEY3,
29-
HMAC_KEY4,
30-
HMAC_KEY5,
31-
HMAC_KEY_MAX
32-
} hmac_key_id_t;
33-
3422
/**
3523
* @brief
3624
* Calculate the HMAC of a given message.

‎components/esp_security/src/esp_key_mgr.c‎

Lines changed: 16 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -34,6 +34,7 @@ static const char *TAG = "esp_key_mgr";
3434

3535
static _lock_t s_key_mgr_ecdsa_key_lock;
3636
static _lock_t s_key_mgr_xts_aes_key_lock;
37+
static _lock_t s_key_mgr_hmac_key_lock;
3738

3839
ESP_STATIC_ASSERT(sizeof(esp_key_mgr_key_recovery_info_t) == sizeof(struct huk_key_block), "Size of esp_key_mgr_key_recovery_info_t should match huk_key_block (from ROM)");
3940

@@ -53,6 +54,9 @@ static void esp_key_mgr_acquire_key_lock(esp_key_mgr_key_type_t key_type)
5354
case ESP_KEY_MGR_XTS_AES_256_KEY:
5455
_lock_acquire(&s_key_mgr_xts_aes_key_lock);
5556
break;
57+
case ESP_KEY_MGR_HMAC_KEY:
58+
_lock_acquire(&s_key_mgr_hmac_key_lock);
59+
break;
5660
default:
5761
ESP_LOGE(TAG, "Invalid key type");
5862
break;
@@ -72,6 +76,9 @@ static void esp_key_mgr_release_key_lock(esp_key_mgr_key_type_t key_type)
7276
case ESP_KEY_MGR_XTS_AES_256_KEY:
7377
_lock_release(&s_key_mgr_xts_aes_key_lock);
7478
break;
79+
case ESP_KEY_MGR_HMAC_KEY:
80+
_lock_release(&s_key_mgr_hmac_key_lock);
81+
break;
7582
default:
7683
ESP_LOGE(TAG, "Invalid key type");
7784
break;
@@ -342,6 +349,8 @@ esp_err_t esp_key_mgr_deploy_key_in_aes_mode(const esp_key_mgr_aes_key_config_t
342349
aes_deploy_config.key_purpose = ESP_KEY_MGR_KEY_PURPOSE_XTS_AES_128;
343350
} else if (key_type == ESP_KEY_MGR_XTS_AES_256_KEY) {
344351
aes_deploy_config.key_purpose = ESP_KEY_MGR_KEY_PURPOSE_XTS_AES_256_1;
352+
} else if (key_type == ESP_KEY_MGR_HMAC_KEY) {
353+
aes_deploy_config.key_purpose = ESP_KEY_MGR_KEY_PURPOSE_HMAC;
345354
} else {
346355
ESP_LOGE(TAG, "Invalid key type");
347356
return ESP_ERR_INVALID_ARG;
@@ -461,6 +470,8 @@ esp_err_t esp_key_mgr_activate_key(esp_key_mgr_key_recovery_info_t *key_recovery
461470
key_purpose = ESP_KEY_MGR_KEY_PURPOSE_XTS_AES_128;
462471
} else if (key_type == ESP_KEY_MGR_XTS_AES_256_KEY) {
463472
key_purpose = ESP_KEY_MGR_KEY_PURPOSE_XTS_AES_256_1;
473+
} else if (key_type == ESP_KEY_MGR_HMAC_KEY) {
474+
key_purpose = ESP_KEY_MGR_KEY_PURPOSE_HMAC;
464475
} else {
465476
ESP_LOGE(TAG, "Invalid key type");
466477
return ESP_ERR_INVALID_ARG;
@@ -629,6 +640,9 @@ esp_err_t esp_key_mgr_deploy_key_in_ecdh0_mode(const esp_key_mgr_ecdh0_key_confi
629640
} else if (key_type == ESP_KEY_MGR_XTS_AES_256_KEY) {
630641
ecdh0_deploy_config.key_purpose = ESP_KEY_MGR_KEY_PURPOSE_XTS_AES_256_1;
631642
ecdh0_deploy_config.ecdh0_key_info = ecdh0_key_info->k2_G[0];
643+
} else if (key_type == ESP_KEY_MGR_HMAC_KEY) {
644+
ecdh0_deploy_config.key_purpose = ESP_KEY_MGR_KEY_PURPOSE_HMAC;
645+
ecdh0_deploy_config.ecdh0_key_info = ecdh0_key_info->k2_G[0];
632646
} else {
633647
ESP_LOGE(TAG, "Invalid key type");
634648
return ESP_ERR_INVALID_ARG;
@@ -761,6 +775,8 @@ esp_err_t esp_key_mgr_deploy_key_in_random_mode(const esp_key_mgr_random_key_con
761775
random_deploy_config.key_purpose = ESP_KEY_MGR_KEY_PURPOSE_XTS_AES_128;
762776
} else if (key_type == ESP_KEY_MGR_XTS_AES_256_KEY) {
763777
random_deploy_config.key_purpose = ESP_KEY_MGR_KEY_PURPOSE_XTS_AES_256_1;
778+
} else if (key_type == ESP_KEY_MGR_HMAC_KEY) {
779+
random_deploy_config.key_purpose = ESP_KEY_MGR_KEY_PURPOSE_HMAC;
764780
} else {
765781
ESP_LOGE(TAG, "Invalid key type");
766782
return ESP_ERR_INVALID_ARG;

‎components/hal/esp32c5/include/hal/key_mgr_ll.h‎

Lines changed: 23 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -171,6 +171,7 @@ static inline void key_mgr_ll_set_key_usage(const esp_key_mgr_key_type_t key_typ
171171
REG_CLR_BIT(KEYMNG_STATIC_REG, KEYMNG_USE_EFUSE_KEY_ECDSA);
172172
}
173173
break;
174+
174175
case ESP_KEY_MGR_XTS_AES_128_KEY:
175176
case ESP_KEY_MGR_XTS_AES_256_KEY:
176177
if (key_usage == ESP_KEY_MGR_USE_EFUSE_KEY) {
@@ -180,6 +181,14 @@ static inline void key_mgr_ll_set_key_usage(const esp_key_mgr_key_type_t key_typ
180181
}
181182
break;
182183

184+
case ESP_KEY_MGR_HMAC_KEY:
185+
if (key_usage == ESP_KEY_MGR_USE_EFUSE_KEY) {
186+
REG_SET_BIT(KEYMNG_STATIC_REG, KEYMNG_USE_EFUSE_KEY_HMAC);
187+
} else {
188+
REG_CLR_BIT(KEYMNG_STATIC_REG, KEYMNG_USE_EFUSE_KEY_HMAC);
189+
}
190+
break;
191+
183192
default:
184193
HAL_ASSERT(false && "Unsupported mode");
185194
return;
@@ -200,6 +209,10 @@ static inline esp_key_mgr_key_usage_t key_mgr_ll_get_key_usage(esp_key_mgr_key_t
200209
return (esp_key_mgr_key_usage_t) (REG_GET_BIT(KEYMNG_STATIC_REG, KEYMNG_USE_EFUSE_KEY_FLASH));
201210
break;
202211

212+
case ESP_KEY_MGR_HMAC_KEY:
213+
return (esp_key_mgr_key_usage_t) (REG_GET_BIT(KEYMNG_STATIC_REG, KEYMNG_USE_EFUSE_KEY_HMAC));
214+
break;
215+
203216
default:
204217
HAL_ASSERT(false && "Unsupported mode");
205218
return ESP_KEY_MGR_USAGE_INVALID;
@@ -230,10 +243,16 @@ static inline void key_mgr_ll_lock_use_efuse_key_reg(esp_key_mgr_key_type_t key_
230243
case ESP_KEY_MGR_ECDSA_384_KEY:
231244
REG_SET_BIT(KEYMNG_LOCK_REG, KEYMNG_USE_EFUSE_KEY_LOCK_ECDSA);
232245
break;
246+
233247
case ESP_KEY_MGR_XTS_AES_128_KEY:
234248
case ESP_KEY_MGR_XTS_AES_256_KEY:
235249
REG_SET_BIT(KEYMNG_LOCK_REG, KEYMNG_USE_EFUSE_KEY_LOCK_FLASH);
236250
break;
251+
252+
case ESP_KEY_MGR_HMAC_KEY:
253+
REG_SET_BIT(KEYMNG_LOCK_REG, KEYMNG_USE_EFUSE_KEY_LOCK_HMAC);
254+
break;
255+
237256
default:
238257
HAL_ASSERT(false && "Unsupported mode");
239258
return;
@@ -286,6 +305,10 @@ static inline bool key_mgr_ll_is_key_deployment_valid(const esp_key_mgr_key_type
286305
return REG_GET_FIELD(KEYMNG_KEY_VLD_REG, KEYMNG_KEY_FLASH_VLD);
287306
break;
288307

308+
case ESP_KEY_MGR_HMAC_KEY:
309+
return REG_GET_FIELD(KEYMNG_KEY_VLD_REG, KEYMNG_KEY_HMAC_VLD);
310+
break;
311+
289312
default:
290313
HAL_ASSERT(false && "Unsupported mode");
291314
return 0;

‎components/hal/hmac_hal.c‎

Lines changed: 20 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1,12 +1,17 @@
11
/*
2-
* SPDX-FileCopyrightText: 2020-2022 Espressif Systems (Shanghai) CO LTD
2+
* SPDX-FileCopyrightText: 2020-2025 Espressif Systems (Shanghai) CO LTD
33
*
44
* SPDX-License-Identifier: Apache-2.0
55
*/
66

77
#include "stdio.h"
88
#include "hal/hmac_hal.h"
99
#include "hal/hmac_ll.h"
10+
#include "soc/soc_caps.h"
11+
12+
#if SOC_KEY_MANAGER_HMAC_KEY_DEPLOY
13+
#include "hal/key_mgr_hal.h"
14+
#endif
1015

1116
void hmac_hal_start(void)
1217
{
@@ -18,6 +23,20 @@ uint32_t hmac_hal_configure(hmac_hal_output_t config, uint32_t key_id)
1823
{
1924
hmac_ll_wait_idle();
2025
hmac_ll_config_output(config);
26+
27+
#if SOC_KEY_MANAGER_HMAC_KEY_DEPLOY
28+
if (key_id == HMAC_KEY_KM) {
29+
if (config == HMAC_OUTPUT_USER) {
30+
key_mgr_hal_set_key_usage(ESP_KEY_MGR_HMAC_KEY, ESP_KEY_MGR_USE_OWN_KEY);
31+
} else {
32+
// No other HMAC output type is allowed when using key manager
33+
return 1;
34+
}
35+
} else {
36+
key_mgr_hal_set_key_usage(ESP_KEY_MGR_HMAC_KEY, ESP_KEY_MGR_USE_EFUSE_KEY);
37+
}
38+
#endif
39+
2140
hmac_ll_config_hw_key_id(key_id);
2241
hmac_ll_config_finish();
2342
hmac_ll_wait_idle();

‎components/hal/include/hal/hmac_types.h‎

Lines changed: 18 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1,14 +1,31 @@
11
/*
2-
* SPDX-FileCopyrightText: 2023 Espressif Systems (Shanghai) CO LTD
2+
* SPDX-FileCopyrightText: 2023-2025 Espressif Systems (Shanghai) CO LTD
33
*
44
* SPDX-License-Identifier: Apache-2.0
55
*/
66
#pragma once
7+
#include "soc/soc_caps.h"
78

89
#ifdef __cplusplus
910
extern "C" {
1011
#endif
1112

13+
/**
14+
* The possible efuse keys for the HMAC peripheral
15+
*/
16+
typedef enum {
17+
HMAC_KEY0 = 0,
18+
HMAC_KEY1,
19+
HMAC_KEY2,
20+
HMAC_KEY3,
21+
HMAC_KEY4,
22+
HMAC_KEY5,
23+
#if SOC_KEY_MANAGER_HMAC_KEY_DEPLOY
24+
HMAC_KEY_KM = 7,
25+
#endif
26+
HMAC_KEY_MAX = 8,
27+
} hmac_key_id_t;
28+
1229
/**
1330
* The HMAC peripheral can be configured to deliver its output to the user directly, or to deliver
1431
* the output directly to another peripheral instead, e.g. the Digital Signature peripheral.

‎components/soc/esp32c5/include/soc/Kconfig.soc_caps.in‎

Lines changed: 4 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -1423,6 +1423,10 @@ config SOC_KEY_MANAGER_FE_KEY_DEPLOY
14231423
bool
14241424
default y
14251425

1426+
config SOC_KEY_MANAGER_HMAC_KEY_DEPLOY
1427+
bool
1428+
default y
1429+
14261430
config SOC_SECURE_BOOT_V2_RSA
14271431
bool
14281432
default y

‎components/soc/esp32c5/include/soc/soc_caps.h‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -547,6 +547,7 @@
547547
#define SOC_KEY_MANAGER_SUPPORT_KEY_DEPLOYMENT 1 /*!< Key manager supports key deployment */
548548
#define SOC_KEY_MANAGER_ECDSA_KEY_DEPLOY 1 /*!< Key manager responsible to deploy ECDSA key */
549549
#define SOC_KEY_MANAGER_FE_KEY_DEPLOY 1 /*!< Key manager responsible to deploy Flash Encryption key */
550+
#define SOC_KEY_MANAGER_HMAC_KEY_DEPLOY 1 /*!< Key manager responsible to deploy HMAC key */
550551

551552
/*-------------------------- Secure Boot CAPS----------------------------*/
552553
#define SOC_SECURE_BOOT_V2_RSA 1

0 commit comments

Comments
 (0)