pioduino/esp-idf
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

feat: enabled ECDSA-P192 support for ESP32H2

Browse Source
This commit is contained in:
nilesh.kale
2025-05-13 17:01:07 +05:30
committed by Nilesh Kale
parent 908ff6e5df
commit 2d5d7b819f
15 changed files with 138 additions and 43 deletions
Download Patch File Download Diff File Expand all files Collapse all files
components/bootloader_support/src/esp32h2/secure_boot_secure_features.c
+8 -1
View File
@@ -1,10 +1,11 @@
/*
* SPDX-FileCopyrightText: 2022 Espressif Systems (Shanghai) CO LTD
* SPDX-FileCopyrightText: 2022-2025 Espressif Systems (Shanghai) CO LTD
*
* SPDX-License-Identifier: Apache-2.0
*/
#include <strings.h>
#include "hal/ecdsa_ll.h"
#include "esp_flash_encrypt.h"
#include "esp_secure_boot.h"
#include "esp_efuse.h"
@@ -36,6 +37,12 @@ esp_err_t esp_secure_boot_enable_secure_features(void)
ESP_LOGW(TAG, "UART ROM Download mode kept enabled - SECURITY COMPROMISED");
#endif
#ifdef SOC_ECDSA_P192_CURVE_DEFAULT_DISABLED
if (ecdsa_ll_is_configurable_curve_supported()) {
esp_efuse_write_field_bit(ESP_EFUSE_WR_DIS_ECDSA_CURVE_MODE);
}
#endif
#ifndef CONFIG_SECURE_BOOT_ALLOW_JTAG
ESP_LOGI(TAG, "Disable hardware & software JTAG...");
esp_efuse_write_field_bit(ESP_EFUSE_DIS_PAD_JTAG);
components/bootloader_support/src/secure_boot.c
+15 -9
View File
@@ -12,6 +12,10 @@
#include "esp_secure_boot.h"
#include "hal/efuse_hal.h"
#ifdef SOC_ECDSA_SUPPORTED
#include "hal/ecdsa_ll.h"
#endif
#ifndef BOOTLOADER_BUILD
static __attribute__((unused)) const char *TAG = "secure_boot";
@@ -341,15 +345,17 @@ bool esp_secure_boot_cfg_verify_release_mode(void)
}
#ifdef SOC_ECDSA_P192_CURVE_DEFAULT_DISABLED
secure = esp_efuse_read_field_bit(ESP_EFUSE_WR_DIS_ECDSA_CURVE_MODE);
if (!secure) {
uint8_t current_curve;
esp_err_t err = esp_efuse_read_field_blob(ESP_EFUSE_ECDSA_CURVE_MODE, &current_curve, ESP_EFUSE_ECDSA_CURVE_MODE[0]->bit_count);
if (err == ESP_OK) {
if (current_curve != ESP_EFUSE_ECDSA_CURVE_MODE_ALLOW_ONLY_P256_BIT_LOCKED) {
// If not P256 mode
result &= secure;
ESP_LOGW(TAG, "Not write disabled ECDSA curve mode (set WR_DIS_ECDSA_CURVE_MODE->1)");
if (ecdsa_ll_is_configurable_curve_supported()) {
secure = esp_efuse_read_field_bit(ESP_EFUSE_WR_DIS_ECDSA_CURVE_MODE);
if (!secure) {
uint8_t current_curve;
esp_err_t err = esp_efuse_read_field_blob(ESP_EFUSE_ECDSA_CURVE_MODE, &current_curve, ESP_EFUSE_ECDSA_CURVE_MODE[0]->bit_count);
if (err == ESP_OK) {
if (current_curve != ESP_EFUSE_ECDSA_CURVE_MODE_ALLOW_ONLY_P256_BIT_LOCKED) {
// If not P256 mode
result &= secure;
ESP_LOGW(TAG, "Not write disabled ECDSA curve mode (set WR_DIS_ECDSA_CURVE_MODE->1)");
}
}
}
}