Skip to content

Commit 02c5f2d

Browse files
author
Jiang Jiang Jian
committed
Merge branch 'fix/disable_efuse_xts_aes_256_esp32c5_v5.5' into 'release/v5.5'
Disable XTS-AES-256 using efuse key for ESP32-C5 (v5.5) See merge request espressif/esp-idf!41364
2 parents d20fb26 + 4213e41 commit 02c5f2d

File tree

8 files changed

+50
-36
lines changed

8 files changed

+50
-36
lines changed

‎components/efuse/esp32c5/include/esp_efuse_chip.h‎

Lines changed: 0 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -64,8 +64,6 @@ typedef enum {
6464
ESP_EFUSE_KEY_PURPOSE_USER = 0, /**< User purposes (software-only use) */
6565
ESP_EFUSE_KEY_PURPOSE_ECDSA_KEY = 1, /**< ECDSA private key (P256) (Expected in little endian order)*/
6666
ESP_EFUSE_KEY_PURPOSE_ECDSA_KEY_P256 = ESP_EFUSE_KEY_PURPOSE_ECDSA_KEY, /**< ECDSA private key (P256) (Expected in little endian order)*/
67-
ESP_EFUSE_KEY_PURPOSE_XTS_AES_256_KEY_1 = 2, /**< XTS_AES_256_KEY_1 (flash/PSRAM encryption) */
68-
ESP_EFUSE_KEY_PURPOSE_XTS_AES_256_KEY_2 = 3, /**< XTS_AES_256_KEY_2 (flash/PSRAM encryption) */
6967
ESP_EFUSE_KEY_PURPOSE_XTS_AES_128_KEY = 4, /**< XTS_AES_128_KEY (flash/PSRAM encryption) */
7068
ESP_EFUSE_KEY_PURPOSE_HMAC_DOWN_ALL = 5, /**< HMAC Downstream mode */
7169
ESP_EFUSE_KEY_PURPOSE_HMAC_DOWN_JTAG = 6, /**< JTAG soft enable key (uses HMAC Downstream mode) */
@@ -75,8 +73,6 @@ typedef enum {
7573
ESP_EFUSE_KEY_PURPOSE_SECURE_BOOT_DIGEST1 = 10, /**< SECURE_BOOT_DIGEST1 (Secure Boot key digest) */
7674
ESP_EFUSE_KEY_PURPOSE_SECURE_BOOT_DIGEST2 = 11, /**< SECURE_BOOT_DIGEST2 (Secure Boot key digest) */
7775
ESP_EFUSE_KEY_PURPOSE_KM_INIT_KEY = 12, /**< KM_INIT_KEY (Key Manager initialization key) */
78-
ESP_EFUSE_KEY_PURPOSE_XTS_AES_256_PSRAM_KEY_1 = 13, /**< XTS_AES_256_PSRAM_KEY_1 (PSRAM encryption) */
79-
ESP_EFUSE_KEY_PURPOSE_XTS_AES_256_PSRAM_KEY_2 = 14, /**< XTS_AES_256_PSRAM_KEY_2 (PSRAM encryption) */
8076
ESP_EFUSE_KEY_PURPOSE_XTS_AES_128_PSRAM_KEY = 15, /**< XTS_AES_128_PSRAM_KEY (PSRAM encryption) */
8177
ESP_EFUSE_KEY_PURPOSE_ECDSA_KEY_P192 = 16, /**< ECDSA private key (P192) */
8278
ESP_EFUSE_KEY_PURPOSE_ECDSA_KEY_P384_L = 17, /**< ECDSA private key (P384) */

‎components/hal/test_apps/crypto/main/key_manager/test_key_manager.c‎

Lines changed: 16 additions & 16 deletions
Original file line numberDiff line numberDiff line change
@@ -84,7 +84,7 @@ static void test_xts_aes_key_ecdh0_mode(test_data_ecdh0_mode_t *test_data)
8484
ESP_LOG_BUFFER_HEXDUMP("Encrypted data", read_data, data_size, ESP_LOG_DEBUG);
8585
}
8686

87-
#if SOC_FLASH_ENCRYPTION_XTS_AES_128
87+
#if SOC_KEY_MANAGER_FE_KEY_DEPLOY_XTS_AES_128
8888
static void key_mgr_test_xts_aes_128_aes_mode(void)
8989
{
9090
static esp_key_mgr_aes_key_config_t key_config;
@@ -117,9 +117,9 @@ static void key_mgr_test_xts_aes_128_ecdh0_mode(void)
117117
test_xts_aes_key_ecdh0_mode(&test_data_ecdh0);
118118
TEST_ASSERT_EQUAL(ESP_OK, esp_key_mgr_deactivate_key(key_recovery_info.key_type));
119119
}
120-
#endif /* SOC_FLASH_ENCRYPTION_XTS_AES_128 */
120+
#endif /* SOC_KEY_MANAGER_FE_KEY_DEPLOY_XTS_AES_128 */
121121

122-
#if SOC_FLASH_ENCRYPTION_XTS_AES_256
122+
#if SOC_KEY_MANAGER_FE_KEY_DEPLOY_XTS_AES_256
123123
static void key_mgr_test_xts_aes_256_aes_mode(void)
124124
{
125125
static esp_key_mgr_aes_key_config_t key_config;
@@ -155,7 +155,7 @@ static void key_mgr_test_xts_aes_256_ecdh0_mode(void)
155155
test_xts_aes_key_ecdh0_mode(&test_data_ecdh0);
156156
TEST_ASSERT_EQUAL(ESP_OK, esp_key_mgr_deactivate_key(key_recovery_info.key_type));
157157
}
158-
#endif /* SOC_FLASH_ENCRYPTION_XTS_AES_256 */
158+
#endif /* SOC_KEY_MANAGER_FE_KEY_DEPLOY_XTS_AES_256 */
159159

160160
#if CONFIG_CRYPTO_TEST_APP_ENABLE_FPGA_TESTS
161161
static void test_xts_aes_key_random_mode(void)
@@ -173,7 +173,7 @@ static void test_xts_aes_key_random_mode(void)
173173
}
174174
}
175175

176-
#if SOC_FLASH_ENCRYPTION_XTS_AES_128
176+
#if SOC_KEY_MANAGER_FE_KEY_DEPLOY_XTS_AES_128
177177
static void key_mgr_test_xts_aes_128_random_mode(void)
178178
{
179179
static esp_key_mgr_random_key_config_t key_config;
@@ -185,9 +185,9 @@ static void key_mgr_test_xts_aes_128_random_mode(void)
185185
test_xts_aes_key_random_mode();
186186
TEST_ASSERT_EQUAL(ESP_OK, esp_key_mgr_deactivate_key(key_recovery_info.key_type));
187187
}
188-
#endif /* SOC_FLASH_ENCRYPTION_XTS_AES_128 */
188+
#endif /* SOC_KEY_MANAGER_FE_KEY_DEPLOY_XTS_AES_128 */
189189

190-
#if SOC_FLASH_ENCRYPTION_XTS_AES_256
190+
#if SOC_KEY_MANAGER_FE_KEY_DEPLOY_XTS_AES_256
191191
static void key_mgr_test_xts_aes_256_random_mode(void)
192192
{
193193
static esp_key_mgr_random_key_config_t key_config;
@@ -199,7 +199,7 @@ static void key_mgr_test_xts_aes_256_random_mode(void)
199199
test_xts_aes_key_random_mode();
200200
TEST_ASSERT_EQUAL(ESP_OK, esp_key_mgr_deactivate_key(key_recovery_info.key_type));
201201
}
202-
#endif /* SOC_FLASH_ENCRYPTION_XTS_AES_256 */
202+
#endif /* SOC_KEY_MANAGER_FE_KEY_DEPLOY_XTS_AES_256 */
203203
#endif /* CONFIG_CRYPTO_TEST_APP_ENABLE_FPGA_TESTS */
204204
#endif /* SOC_KEY_MANAGER_FE_KEY_DEPLOY */
205205

@@ -436,7 +436,7 @@ TEST_TEAR_DOWN(key_manager)
436436
}
437437

438438
#if SOC_KEY_MANAGER_FE_KEY_DEPLOY
439-
#if SOC_FLASH_ENCRYPTION_XTS_AES_128
439+
#if SOC_KEY_MANAGER_FE_KEY_DEPLOY_XTS_AES_128
440440
TEST(key_manager, xts_aes_128_key_aes_deployment)
441441
{
442442
key_mgr_test_xts_aes_128_aes_mode();
@@ -453,9 +453,9 @@ TEST(key_manager, xts_key_128_random_deployment)
453453
key_mgr_test_xts_aes_128_random_mode();
454454
}
455455
#endif /* CONFIG_CRYPTO_TEST_APP_ENABLE_FPGA_TESTS */
456-
#endif /* SOC_FLASH_ENCRYPTION_XTS_AES_128 */
456+
#endif /* SOC_KEY_MANAGER_FE_KEY_DEPLOY_XTS_AES_128 */
457457

458-
#if SOC_FLASH_ENCRYPTION_XTS_AES_256
458+
#if SOC_KEY_MANAGER_FE_KEY_DEPLOY_XTS_AES_256
459459
TEST(key_manager, xts_aes_256_key_aes_deployment)
460460
{
461461
key_mgr_test_xts_aes_256_aes_mode();
@@ -472,7 +472,7 @@ TEST(key_manager, xts_key_256_random_deployment)
472472
key_mgr_test_xts_aes_256_random_mode();
473473
}
474474
#endif /* CONFIG_CRYPTO_TEST_APP_ENABLE_FPGA_TESTS */
475-
#endif /* SOC_FLASH_ENCRYPTION_XTS_AES_256 */
475+
#endif /* SOC_KEY_MANAGER_FE_KEY_DEPLOY_XTS_AES_256 */
476476
#endif /* SOC_KEY_MANAGER_FE_KEY_DEPLOY */
477477

478478
#if SOC_KEY_MANAGER_ECDSA_KEY_DEPLOY
@@ -519,22 +519,22 @@ TEST(key_manager, ds_key_aes_deployment)
519519
TEST_GROUP_RUNNER(key_manager)
520520
{
521521
#if SOC_KEY_MANAGER_FE_KEY_DEPLOY
522-
#if SOC_FLASH_ENCRYPTION_XTS_AES_128
522+
#if SOC_KEY_MANAGER_FE_KEY_DEPLOY_XTS_AES_128
523523
RUN_TEST_CASE(key_manager, xts_aes_128_key_aes_deployment);
524524
RUN_TEST_CASE(key_manager, xts_key_128_ecdh0_deployment);
525525
#if CONFIG_CRYPTO_TEST_APP_ENABLE_FPGA_TESTS
526526
// This tests expects Flash encryption to be enabled as the test compares the decrypted flash data with the plaintext data
527527
RUN_TEST_CASE(key_manager, xts_key_128_random_deployment);
528528
#endif /* CONFIG_CRYPTO_TEST_APP_ENABLE_FPGA_TESTS */
529-
#endif /* SOC_FLASH_ENCRYPTION_XTS_AES_128 */
529+
#endif /* SOC_KEY_MANAGER_FE_KEY_DEPLOY_XTS_AES_128 */
530530

531-
#if SOC_FLASH_ENCRYPTION_XTS_AES_256
531+
#if SOC_KEY_MANAGER_FE_KEY_DEPLOY_XTS_AES_256
532532
RUN_TEST_CASE(key_manager, xts_aes_256_key_aes_deployment);
533533
RUN_TEST_CASE(key_manager, xts_key_256_ecdh0_deployment);
534534
#if CONFIG_CRYPTO_TEST_APP_ENABLE_FPGA_TESTS
535535
RUN_TEST_CASE(key_manager, xts_key_256_random_deployment);
536536
#endif /* CONFIG_CRYPTO_TEST_APP_ENABLE_FPGA_TESTS */
537-
#endif /* SOC_FLASH_ENCRYPTION_XTS_AES_256 */
537+
#endif /* SOC_KEY_MANAGER_FE_KEY_DEPLOY_XTS_AES_256 */
538538
#endif /* SOC_KEY_MANAGER_FE_KEY_DEPLOY */
539539

540540
#if SOC_KEY_MANAGER_ECDSA_KEY_DEPLOY

‎components/soc/esp32c5/include/soc/Kconfig.soc_caps.in‎

Lines changed: 8 additions & 8 deletions
Original file line numberDiff line numberDiff line change
@@ -1427,6 +1427,14 @@ config SOC_KEY_MANAGER_FE_KEY_DEPLOY
14271427
bool
14281428
default y
14291429

1430+
config SOC_KEY_MANAGER_FE_KEY_DEPLOY_XTS_AES_128
1431+
bool
1432+
default y
1433+
1434+
config SOC_KEY_MANAGER_FE_KEY_DEPLOY_XTS_AES_256
1435+
bool
1436+
default y
1437+
14301438
config SOC_KEY_MANAGER_HMAC_KEY_DEPLOY
14311439
bool
14321440
default y
@@ -1467,10 +1475,6 @@ config SOC_FLASH_ENCRYPTION_XTS_AES_128
14671475
bool
14681476
default y
14691477

1470-
config SOC_FLASH_ENCRYPTION_XTS_AES_256
1471-
bool
1472-
default y
1473-
14741478
config SOC_FLASH_ENCRYPTION_XTS_AES_SUPPORT_PSEUDO_ROUND
14751479
bool
14761480
default y
@@ -1479,10 +1483,6 @@ config SOC_PSRAM_ENCRYPTION_XTS_AES_128
14791483
bool
14801484
default y
14811485

1482-
config SOC_PSRAM_ENCRYPTION_XTS_AES_256
1483-
bool
1484-
default y
1485-
14861486
config SOC_RECOVERY_BOOTLOADER_SUPPORTED
14871487
bool
14881488
default y

‎components/soc/esp32c5/include/soc/soc_caps.h‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -548,6 +548,8 @@
548548
#define SOC_KEY_MANAGER_SUPPORT_KEY_DEPLOYMENT 1 /*!< Key manager supports key deployment */
549549
#define SOC_KEY_MANAGER_ECDSA_KEY_DEPLOY 1 /*!< Key manager responsible to deploy ECDSA key */
550550
#define SOC_KEY_MANAGER_FE_KEY_DEPLOY 1 /*!< Key manager responsible to deploy Flash Encryption key */
551+
#define SOC_KEY_MANAGER_FE_KEY_DEPLOY_XTS_AES_128 1 /*!< Key manager responsible to deploy the XTS-AES-128 key */
552+
#define SOC_KEY_MANAGER_FE_KEY_DEPLOY_XTS_AES_256 1 /*!< Key manager responsible to deploy the XTS-AES-256 key */
551553
#define SOC_KEY_MANAGER_HMAC_KEY_DEPLOY 1 /*!< Key manager responsible to deploy HMAC key */
552554
#define SOC_KEY_MANAGER_DS_KEY_DEPLOY 1 /*!< Key manager responsible to deploy DS key */
553555

@@ -562,12 +564,10 @@
562564
#define SOC_FLASH_ENCRYPTED_XTS_AES_BLOCK_MAX (64)
563565
#define SOC_FLASH_ENCRYPTION_XTS_AES 1
564566
#define SOC_FLASH_ENCRYPTION_XTS_AES_128 1
565-
#define SOC_FLASH_ENCRYPTION_XTS_AES_256 1
566567
#define SOC_FLASH_ENCRYPTION_XTS_AES_SUPPORT_PSEUDO_ROUND 1
567568

568569
/*-------------------------- PSRAM Encryption CAPS----------------------------*/
569570
#define SOC_PSRAM_ENCRYPTION_XTS_AES_128 (1)
570-
#define SOC_PSRAM_ENCRYPTION_XTS_AES_256 (1)
571571

572572
/*------------------------Bootloader CAPS---------------------------------*/
573573
/* Support Recovery Bootloader */

‎components/soc/esp32p4/include/soc/Kconfig.soc_caps.in‎

Lines changed: 8 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -1847,6 +1847,14 @@ config SOC_KEY_MANAGER_FE_KEY_DEPLOY
18471847
bool
18481848
default y
18491849

1850+
config SOC_KEY_MANAGER_FE_KEY_DEPLOY_XTS_AES_128
1851+
bool
1852+
default y
1853+
1854+
config SOC_KEY_MANAGER_FE_KEY_DEPLOY_XTS_AES_256
1855+
bool
1856+
default y
1857+
18501858
config SOC_SECURE_BOOT_V2_RSA
18511859
bool
18521860
default y

‎components/soc/esp32p4/include/soc/soc_caps.h‎

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -675,6 +675,8 @@
675675
#define SOC_KEY_MANAGER_SUPPORT_KEY_DEPLOYMENT 1 /*!< Key manager supports key deployment */
676676
#define SOC_KEY_MANAGER_ECDSA_KEY_DEPLOY 1 /*!< Key manager responsible to deploy ECDSA key */
677677
#define SOC_KEY_MANAGER_FE_KEY_DEPLOY 1 /*!< Key manager responsible to deploy Flash Encryption key */
678+
#define SOC_KEY_MANAGER_FE_KEY_DEPLOY_XTS_AES_128 1 /*!< Key manager responsible to deploy the XTS-AES-128 key */
679+
#define SOC_KEY_MANAGER_FE_KEY_DEPLOY_XTS_AES_256 1 /*!< Key manager responsible to deploy the XTS-AES-256 key */
678680

679681
/*-------------------------- Secure Boot CAPS----------------------------*/
680682
#define SOC_SECURE_BOOT_V2_RSA 1

‎docs/en/api-reference/peripherals/ecdsa.rst‎

Lines changed: 7 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -12,9 +12,13 @@ ECDSA peripheral can help to establish **Secure Device Identity** for TLS mutual
1212
Supported Features
1313
------------------
1414

15-
- ECDSA digital signature generation and verification
16-
- Two different elliptic curves, namely P-192 and P-256 (FIPS 186-3 specification)
17-
- Two hash algorithms for message hash in the ECDSA operation, namely SHA-224 and SHA-256 (FIPS PUB 180-4 specification)
15+
.. list::
16+
17+
- ECDSA digital signature generation and verification
18+
:SOC_ECDSA_SUPPORT_CURVE_P384: - Three different elliptic curves, namely P-192, P-256 and P-384 (FIPS 186-3 specification)
19+
:not SOC_ECDSA_SUPPORT_CURVE_P384: - Two different elliptic curves, namely P-192 and P-256 (FIPS 186-3 specification)
20+
:SOC_ECDSA_SUPPORT_CURVE_P384: - Three hash algorithms for message hash in the ECDSA operation, namely SHA-224, SHA-256 and SHA-384 (FIPS PUB 180-4 specification)
21+
:not SOC_ECDSA_SUPPORT_CURVE_P384: - Two hash algorithms for message hash in the ECDSA operation, namely SHA-224 and SHA-256 (FIPS PUB 180-4 specification)
1822

1923

2024
ECDSA on {IDF_TARGET_NAME}

‎docs/zh_CN/api-reference/peripherals/ecdsa.rst‎

Lines changed: 7 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -12,9 +12,13 @@ ECDSA 外设可以为 TLS 双向身份验证等用例建立 **安全设备身份
1212
支持的特性
1313
----------
1414

15-
- ECDSA 数字签名生成和验证
16-
- 两种不同的椭圆曲线，P-192 和 P-256（FIPS 186-3 规范）
17-
- ECDSA 操作中哈希消息的两种哈希算法，SHA-224 和 SHA-256（FIPS PUB 180-4 规范）
15+
.. list::
16+
17+
- ECDSA 数字签名生成和验证
18+
:SOC_ECDSA_SUPPORT_CURVE_P384: - 三种不同的椭圆曲线，P-192，P-256 和 P-384（FIPS 186-3 规范）
19+
:not SOC_ECDSA_SUPPORT_CURVE_P384: - 两种不同的椭圆曲线，P-192 和 P-256（FIPS 186-3 规范）
20+
:SOC_ECDSA_SUPPORT_CURVE_P384: - ECDSA 操作中用于散列消息的三种哈希算法，SHA-224, SHA-256 和 SHA-384（FIPS PUB 180-4 规范）
21+
:not SOC_ECDSA_SUPPORT_CURVE_P384: - ECDSA 操作中哈希消息的两种哈希算法，SHA-224 和 SHA-256（FIPS PUB 180-4 规范）
1822

1923

2024
{IDF_TARGET_NAME} 上的 ECDSA

0 commit comments

Comments
 (0)