Skip to content

Commit 33d8c05

Browse files
Harshal5Harshal5
committed
feat(esp_key_mgr): Support Digital Signature key deployments using Key Manager
1 parent 265b0d7 commit 33d8c05

File tree

9 files changed

+103
-18
lines changed

9 files changed

+103
-18
lines changed

‎components/esp_security/src/esp_ds.c‎

Lines changed: 25 additions & 13 deletions
Original file line numberDiff line numberDiff line change
@@ -17,6 +17,7 @@
1717
#include "esp_cpu.h"
1818
#endif
1919

20+
#include "soc/soc_caps.h"
2021
#include "esp_ds.h"
2122
#include "esp_crypto_lock.h"
2223
#include "esp_crypto_periph_clk.h"
@@ -37,6 +38,10 @@
3738
#include "hal/sha_ll.h"
3839
#endif /* !CONFIG_IDF_TARGET_ESP32S2 */
3940

41+
#ifdef SOC_KEY_MANAGER_DS_KEY_DEPLOY
42+
#include "hal/key_mgr_hal.h"
43+
#endif
44+
4045
/**
4146
* The vtask delay \c esp_ds_sign() is using while waiting for completion of the signing operation.
4247
*/
@@ -247,22 +252,14 @@ static void ds_acquire_enable(void)
247252

248253
// We also enable SHA and HMAC here. SHA is used by HMAC, HMAC is used by DS.
249254
esp_crypto_hmac_enable_periph_clk(true);
250-
251255
esp_crypto_sha_enable_periph_clk(true);
252-
253256
esp_crypto_ds_enable_periph_clk(true);
254-
255-
hmac_hal_start();
256257
}
257258

258259
static void ds_disable_release(void)
259260
{
260-
ds_hal_finish();
261-
262261
esp_crypto_ds_enable_periph_clk(false);
263-
264262
esp_crypto_sha_enable_periph_clk(false);
265-
266263
esp_crypto_hmac_enable_periph_clk(false);
267264

268265
esp_crypto_ds_lock_release();
@@ -326,19 +323,32 @@ esp_err_t esp_ds_start_sign(const void *message,
326323

327324
ds_acquire_enable();
328325

329-
// initiate hmac
330-
uint32_t conf_error = hmac_hal_configure(HMAC_OUTPUT_DS, key_id);
331-
if (conf_error) {
332-
ds_disable_release();
333-
return ESP_ERR_HW_CRYPTO_DS_HMAC_FAIL;
326+
#if SOC_KEY_MANAGER_DS_KEY_DEPLOY
327+
if (key_id == HMAC_KEY_KM) {
328+
key_mgr_hal_set_key_usage(ESP_KEY_MGR_DS_KEY, ESP_KEY_MGR_USE_OWN_KEY);
329+
ds_hal_set_key_source(DS_KEY_SOURCE_KEY_MGR);
330+
} else {
331+
key_mgr_hal_set_key_usage(ESP_KEY_MGR_DS_KEY, ESP_KEY_MGR_USE_EFUSE_KEY);
332+
ds_hal_set_key_source(DS_KEY_SOURCE_EFUSE);
333+
#endif
334+
// initiate hmac
335+
hmac_hal_start();
336+
uint32_t conf_error = hmac_hal_configure(HMAC_OUTPUT_DS, key_id);
337+
if (conf_error) {
338+
ds_disable_release();
339+
return ESP_ERR_HW_CRYPTO_DS_HMAC_FAIL;
340+
}
341+
#if SOC_KEY_MANAGER_DS_KEY_DEPLOY
334342
}
343+
#endif
335344

336345
ds_hal_start();
337346

338347
// check encryption key from HMAC
339348
int64_t start_time = get_time_us();
340349
while (ds_ll_busy() != 0) {
341350
if ((get_time_us() - start_time) > SOC_DS_KEY_CHECK_MAX_WAIT_US) {
351+
ds_hal_finish();
342352
ds_disable_release();
343353
return ESP_ERR_HW_CRYPTO_DS_INVALID_KEY;
344354
}
@@ -348,6 +358,7 @@ esp_err_t esp_ds_start_sign(const void *message,
348358
*esp_ds_ctx = malloc(sizeof(esp_ds_context_t));
349359
#endif
350360
if (!*esp_ds_ctx) {
361+
ds_hal_finish();
351362
ds_disable_release();
352363
return ESP_ERR_NO_MEM;
353364
}
@@ -398,6 +409,7 @@ esp_err_t esp_ds_finish_sign(void *signature, esp_ds_context_t *esp_ds_ctx)
398409
#endif
399410

400411
hmac_hal_clean();
412+
ds_hal_finish();
401413

402414
ds_disable_release();
403415

‎components/esp_security/src/esp_key_mgr.c‎

Lines changed: 16 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -35,6 +35,7 @@ static const char *TAG = "esp_key_mgr";
3535
static _lock_t s_key_mgr_ecdsa_key_lock;
3636
static _lock_t s_key_mgr_xts_aes_key_lock;
3737
static _lock_t s_key_mgr_hmac_key_lock;
38+
static _lock_t s_key_mgr_ds_key_lock;
3839

3940
ESP_STATIC_ASSERT(sizeof(esp_key_mgr_key_recovery_info_t) == sizeof(struct huk_key_block), "Size of esp_key_mgr_key_recovery_info_t should match huk_key_block (from ROM)");
4041

@@ -57,6 +58,9 @@ static void esp_key_mgr_acquire_key_lock(esp_key_mgr_key_type_t key_type)
5758
case ESP_KEY_MGR_HMAC_KEY:
5859
_lock_acquire(&s_key_mgr_hmac_key_lock);
5960
break;
61+
case ESP_KEY_MGR_DS_KEY:
62+
_lock_acquire(&s_key_mgr_ds_key_lock);
63+
break;
6064
default:
6165
ESP_LOGE(TAG, "Invalid key type");
6266
break;
@@ -79,6 +83,9 @@ static void esp_key_mgr_release_key_lock(esp_key_mgr_key_type_t key_type)
7983
case ESP_KEY_MGR_HMAC_KEY:
8084
_lock_release(&s_key_mgr_hmac_key_lock);
8185
break;
86+
case ESP_KEY_MGR_DS_KEY:
87+
_lock_release(&s_key_mgr_ds_key_lock);
88+
break;
8289
default:
8390
ESP_LOGE(TAG, "Invalid key type");
8491
break;
@@ -351,6 +358,8 @@ esp_err_t esp_key_mgr_deploy_key_in_aes_mode(const esp_key_mgr_aes_key_config_t
351358
aes_deploy_config.key_purpose = ESP_KEY_MGR_KEY_PURPOSE_XTS_AES_256_1;
352359
} else if (key_type == ESP_KEY_MGR_HMAC_KEY) {
353360
aes_deploy_config.key_purpose = ESP_KEY_MGR_KEY_PURPOSE_HMAC;
361+
} else if (key_type == ESP_KEY_MGR_DS_KEY) {
362+
aes_deploy_config.key_purpose = ESP_KEY_MGR_KEY_PURPOSE_DS;
354363
} else {
355364
ESP_LOGE(TAG, "Invalid key type");
356365
return ESP_ERR_INVALID_ARG;
@@ -472,6 +481,8 @@ esp_err_t esp_key_mgr_activate_key(esp_key_mgr_key_recovery_info_t *key_recovery
472481
key_purpose = ESP_KEY_MGR_KEY_PURPOSE_XTS_AES_256_1;
473482
} else if (key_type == ESP_KEY_MGR_HMAC_KEY) {
474483
key_purpose = ESP_KEY_MGR_KEY_PURPOSE_HMAC;
484+
} else if (key_type == ESP_KEY_MGR_DS_KEY) {
485+
key_purpose = ESP_KEY_MGR_KEY_PURPOSE_DS;
475486
} else {
476487
ESP_LOGE(TAG, "Invalid key type");
477488
return ESP_ERR_INVALID_ARG;
@@ -643,6 +654,9 @@ esp_err_t esp_key_mgr_deploy_key_in_ecdh0_mode(const esp_key_mgr_ecdh0_key_confi
643654
} else if (key_type == ESP_KEY_MGR_HMAC_KEY) {
644655
ecdh0_deploy_config.key_purpose = ESP_KEY_MGR_KEY_PURPOSE_HMAC;
645656
ecdh0_deploy_config.ecdh0_key_info = ecdh0_key_info->k2_G[0];
657+
} else if (key_type == ESP_KEY_MGR_DS_KEY) {
658+
ecdh0_deploy_config.key_purpose = ESP_KEY_MGR_KEY_PURPOSE_DS;
659+
ecdh0_deploy_config.ecdh0_key_info = ecdh0_key_info->k2_G[0];
646660
} else {
647661
ESP_LOGE(TAG, "Invalid key type");
648662
return ESP_ERR_INVALID_ARG;
@@ -777,6 +791,8 @@ esp_err_t esp_key_mgr_deploy_key_in_random_mode(const esp_key_mgr_random_key_con
777791
random_deploy_config.key_purpose = ESP_KEY_MGR_KEY_PURPOSE_XTS_AES_256_1;
778792
} else if (key_type == ESP_KEY_MGR_HMAC_KEY) {
779793
random_deploy_config.key_purpose = ESP_KEY_MGR_KEY_PURPOSE_HMAC;
794+
} else if (key_type == ESP_KEY_MGR_DS_KEY) {
795+
random_deploy_config.key_purpose = ESP_KEY_MGR_KEY_PURPOSE_DS;
780796
} else {
781797
ESP_LOGE(TAG, "Invalid key type");
782798
return ESP_ERR_INVALID_ARG;

‎components/hal/ds_hal.c‎

Lines changed: 9 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1,12 +1,13 @@
11
/*
2-
* SPDX-FileCopyrightText: 2015-2023 Espressif Systems (Shanghai) CO LTD
2+
* SPDX-FileCopyrightText: 2015-2025 Espressif Systems (Shanghai) CO LTD
33
*
44
* SPDX-License-Identifier: Apache-2.0
55
*/
66

77
#include "hal/systimer_hal.h"
88
#include "hal/ds_hal.h"
99
#include "hal/ds_ll.h"
10+
#include "soc/soc_caps.h"
1011

1112
void ds_hal_start(void)
1213
{
@@ -23,6 +24,13 @@ void ds_hal_configure_iv(const uint32_t *iv)
2324
ds_ll_configure_iv(iv);
2425
}
2526

27+
#if SOC_KEY_MANAGER_DS_KEY_DEPLOY
28+
void ds_hal_set_key_source(ds_key_source_t key_source)
29+
{
30+
ds_ll_set_key_source(key_source);
31+
}
32+
#endif
33+
2634
void ds_hal_write_message(const uint8_t *msg, size_t size)
2735
{
2836
ds_ll_write_message(msg, size);

‎components/hal/esp32c5/include/hal/ds_ll.h‎

Lines changed: 9 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1,5 +1,5 @@
11
/*
2-
* SPDX-FileCopyrightText: 2023-2024 Espressif Systems (Shanghai) CO LTD
2+
* SPDX-FileCopyrightText: 2023-2025 Espressif Systems (Shanghai) CO LTD
33
*
44
* SPDX-License-Identifier: Apache-2.0
55
*/
@@ -78,6 +78,14 @@ static inline ds_key_check_t ds_ll_key_error_source(void)
7878
}
7979
}
8080

81+
/**
82+
* @brief Set the DS key source.
83+
*/
84+
static inline void ds_ll_set_key_source(ds_key_source_t key_source)
85+
{
86+
REG_WRITE(DS_KEY_SOURCE_REG, key_source);
87+
}
88+
8189
/**
8290
* @brief Write the initialization vector to the corresponding register field.
8391
*/

‎components/hal/esp32c5/include/hal/key_mgr_ll.h‎

Lines changed: 20 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -189,6 +189,14 @@ static inline void key_mgr_ll_set_key_usage(const esp_key_mgr_key_type_t key_typ
189189
}
190190
break;
191191

192+
case ESP_KEY_MGR_DS_KEY:
193+
if (key_usage == ESP_KEY_MGR_USE_EFUSE_KEY) {
194+
REG_SET_BIT(KEYMNG_STATIC_REG, KEYMNG_USE_EFUSE_KEY_DS);
195+
} else {
196+
REG_CLR_BIT(KEYMNG_STATIC_REG, KEYMNG_USE_EFUSE_KEY_DS);
197+
}
198+
break;
199+
192200
default:
193201
HAL_ASSERT(false && "Unsupported mode");
194202
return;
@@ -213,6 +221,10 @@ static inline esp_key_mgr_key_usage_t key_mgr_ll_get_key_usage(esp_key_mgr_key_t
213221
return (esp_key_mgr_key_usage_t) (REG_GET_BIT(KEYMNG_STATIC_REG, KEYMNG_USE_EFUSE_KEY_HMAC));
214222
break;
215223

224+
case ESP_KEY_MGR_DS_KEY:
225+
return (esp_key_mgr_key_usage_t) (REG_GET_BIT(KEYMNG_STATIC_REG, KEYMNG_USE_EFUSE_KEY_DS));
226+
break;
227+
216228
default:
217229
HAL_ASSERT(false && "Unsupported mode");
218230
return ESP_KEY_MGR_USAGE_INVALID;
@@ -253,6 +265,10 @@ static inline void key_mgr_ll_lock_use_efuse_key_reg(esp_key_mgr_key_type_t key_
253265
REG_SET_BIT(KEYMNG_LOCK_REG, KEYMNG_USE_EFUSE_KEY_LOCK_HMAC);
254266
break;
255267

268+
case ESP_KEY_MGR_DS_KEY:
269+
REG_SET_BIT(KEYMNG_LOCK_REG, KEYMNG_USE_EFUSE_KEY_LOCK_DS);
270+
break;
271+
256272
default:
257273
HAL_ASSERT(false && "Unsupported mode");
258274
return;
@@ -291,7 +307,6 @@ static inline bool key_mgr_ll_is_result_success(void)
291307
static inline bool key_mgr_ll_is_key_deployment_valid(const esp_key_mgr_key_type_t key_type)
292308
{
293309
switch (key_type) {
294-
295310
case ESP_KEY_MGR_ECDSA_192_KEY:
296311
return REG_GET_FIELD(KEYMNG_KEY_VLD_REG, KEYMNG_KEY_ECDSA_192_VLD);
297312
case ESP_KEY_MGR_ECDSA_256_KEY:
@@ -309,6 +324,10 @@ static inline bool key_mgr_ll_is_key_deployment_valid(const esp_key_mgr_key_type
309324
return REG_GET_FIELD(KEYMNG_KEY_VLD_REG, KEYMNG_KEY_HMAC_VLD);
310325
break;
311326

327+
case ESP_KEY_MGR_DS_KEY:
328+
return REG_GET_FIELD(KEYMNG_KEY_VLD_REG, KEYMNG_KEY_DS_VLD);
329+
break;
330+
312331
default:
313332
HAL_ASSERT(false && "Unsupported mode");
314333
return 0;

‎components/hal/include/hal/ds_hal.h‎

Lines changed: 9 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1,5 +1,5 @@
11
/*
2-
* SPDX-FileCopyrightText: 2020-2023 Espressif Systems (Shanghai) CO LTD
2+
* SPDX-FileCopyrightText: 2020-2025 Espressif Systems (Shanghai) CO LTD
33
*
44
* SPDX-License-Identifier: Apache-2.0
55
*/
@@ -15,6 +15,7 @@
1515
#include <stdint.h>
1616
#include <stddef.h>
1717
#include <stdbool.h>
18+
#include "soc/soc_caps.h"
1819
#include "hal/ds_types.h"
1920

2021
#ifdef __cplusplus
@@ -38,6 +39,13 @@ void ds_hal_finish(void);
3839
*/
3940
void ds_hal_configure_iv(const uint32_t *iv);
4041

42+
#if SOC_KEY_MANAGER_DS_KEY_DEPLOY
43+
/**
44+
* @brief Set the DS key source.
45+
*/
46+
void ds_hal_set_key_source(ds_key_source_t key_source);
47+
#endif
48+
4149
/**
4250
* @brief Write the message which should be signed.
4351
*

‎components/hal/include/hal/ds_types.h‎

Lines changed: 10 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1,5 +1,5 @@
11
/*
2-
* SPDX-FileCopyrightText: 2023 Espressif Systems (Shanghai) CO LTD
2+
* SPDX-FileCopyrightText: 2023-2025 Espressif Systems (Shanghai) CO LTD
33
*
44
* SPDX-License-Identifier: Apache-2.0
55
*/
@@ -9,6 +9,8 @@
99
extern "C" {
1010
#endif
1111

12+
#include "soc/soc_caps.h"
13+
1214
/**
1315
* The result when checking whether the key to decrypt the RSA parameters is ready.
1416
*/
@@ -25,6 +27,13 @@ typedef enum {
2527
DS_SIGNATURE_PADDING_AND_MD_FAIL = 3, /**< Both padding and MD check failed. */
2628
} ds_signature_check_t;
2729

30+
#if SOC_KEY_MANAGER_DS_KEY_DEPLOY
31+
typedef enum {
32+
DS_KEY_SOURCE_EFUSE = 0,
33+
DS_KEY_SOURCE_KEY_MGR = 1,
34+
} ds_key_source_t;
35+
#endif
36+
2837
#ifdef __cplusplus
2938
}
3039
#endif

‎components/soc/esp32c5/include/soc/Kconfig.soc_caps.in‎

Lines changed: 4 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -1427,6 +1427,10 @@ config SOC_KEY_MANAGER_HMAC_KEY_DEPLOY
14271427
bool
14281428
default y
14291429

1430+
config SOC_KEY_MANAGER_DS_KEY_DEPLOY
1431+
bool
1432+
default y
1433+
14301434
config SOC_SECURE_BOOT_V2_RSA
14311435
bool
14321436
default y

‎components/soc/esp32c5/include/soc/soc_caps.h‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -548,6 +548,7 @@
548548
#define SOC_KEY_MANAGER_ECDSA_KEY_DEPLOY 1 /*!< Key manager responsible to deploy ECDSA key */
549549
#define SOC_KEY_MANAGER_FE_KEY_DEPLOY 1 /*!< Key manager responsible to deploy Flash Encryption key */
550550
#define SOC_KEY_MANAGER_HMAC_KEY_DEPLOY 1 /*!< Key manager responsible to deploy HMAC key */
551+
#define SOC_KEY_MANAGER_DS_KEY_DEPLOY 1 /*!< Key manager responsible to deploy DS key */
551552

552553
/*-------------------------- Secure Boot CAPS----------------------------*/
553554
#define SOC_SECURE_BOOT_V2_RSA 1

0 commit comments

Comments
 (0)