pioduino/esp-idf
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Merge branch 'feat/secure_boot_ecdsa_p384_v5.5' into 'release/v5.5'

Browse Source 
Support Secure Boot using ECDSA-P384 curve (v5.5)

See merge request espressif/esp-idf!40822
This commit is contained in:
Jiang Jiang Jian
2025-07-31 21:24:55 +08:00
parent f997e42e56 01f8074a3d
commit dafdf1205d
42 changed files with 1215 additions and 436 deletions
Download Patch File Download Diff File Expand all files Collapse all files
docs/en/security/secure-boot-v2.rst
+143 -36
View File
@@ -5,21 +5,27 @@ Secure Boot v2
:link_to_translation:`zh_CN:[中文]`
{IDF_TARGET_SBV2_SCHEME:default="RSA-PSS", esp32c2="ECDSA", esp32c6="RSA-PSS or ECDSA", esp32h2="RSA-PSS or ECDSA", esp32p4="RSA-PSS or ECDSA", esp32c5="RSA-PSS or ECDSA", esp32c61="ECDSA", esp32h21="RSA-PSS or ECDSA"}
{IDF_TARGET_SBV2_SCHEME:default="RSA-PSS", esp32c2, esp32c61="ECDSA", esp32c6, esp32h2, esp32p4, esp32c5, esp32h21="RSA-PSS or ECDSA"}
{IDF_TARGET_SBV2_KEY:default="RSA-3072", esp32c2="ECDSA-256 or ECDSA-192", esp32c6="RSA-3072, ECDSA-256, or ECDSA-192", esp32h2="RSA-3072, ECDSA-256, or ECDSA-192", esp32p4="RSA-3072, ECDSA-256, or ECDSA-192", esp32c5="RSA-3072, ECDSA-256, or ECDSA-192", esp32c61="ECDSA-256 or ECDSA-192", esp32h21="RSA-3072, ECDSA-256, or ECDSA-192"}
{IDF_TARGET_SBV2_KEY:default="RSA-3072", esp32c2, esp32c61="ECDSA-256 or ECDSA-192", esp32c6, esp32h2, esp32p4, esp32h21="RSA-3072, ECDSA-256, or ECDSA-192", esp32c5="RSA-3072, ECDSA-384, ECDSA-256, or ECDSA-192"}
{IDF_TARGET_SECURE_BOOT_OPTION_TEXT:default="", esp32c6="RSA is recommended for faster verification. You can choose either the RSA or ECDSA scheme from the menu.", esp32h2="RSA is recommended for faster verification. You can choose either the RSA or ECDSA scheme from the menu.", esp32p4="RSA is recommended for faster verification. You can choose either the RSA or ECDSA scheme from the menu.", esp32c5="RSA is recommended for faster verification. You can choose either the RSA or ECDSA scheme from the menu.", esp32h21="RSA is recommended for faster verification. You can choose either the RSA or ECDSA scheme from the menu."}
{IDF_TARGET_SECURE_BOOT_OPTION_TEXT:default="", esp32c6, esp32h2, esp32p4, esp32h21="RSA is recommended for faster verification. You can choose either the RSA or ECDSA scheme from the menu.", esp32c5="ECDSA is recommended for faster verification. You can choose either the RSA or ECDSA scheme from the menu."}
{IDF_TARGET_SBV2_SCHEME_RECOMMENDATION:default="RSA is recommended for use cases where fast boot-up time is required whereas ECDSA is recommended for use cases where shorter key length is required.", esp32c5="ECDSA is recommended for use cases where fast boot-up time and shorter key length is required."}
{IDF_TARGET_ECO_VERSION:default="", esp32="(v3.0 onwards)", esp32c3="(v0.3 onwards)"}
{IDF_TARGET_RSA_TIME:default="", esp32c6="about 2.7 ms", esp32h2="about 4.5 ms", esp32p4="about 2.4 ms"}
{IDF_TARGET_RSA_TIME:default="", esp32c5="about 12.1 ms", esp32c6="about 10.2 ms", esp32h2="about 18.3 ms", esp32p4="about 14.8 ms"}
{IDF_TARGET_ECDSA_TIME:default="", esp32c6="about 21.5 ms", esp32h2="about 36 ms", esp32p4="about 10.3 ms"}
{IDF_TARGET_ECDSA_P256_TIME:default="", esp32c5="about 5.6 ms", esp32c6="about 83.9 ms", esp32h2="about 76.2 ms", esp32p4="about 61.1 ms"}
{IDF_TARGET_CPU_FREQ:default="", esp32c6="160 MHz", esp32h2="96 MHz", esp32p4="360 MHz"}
{IDF_TARGET_ECDSA_P384_TIME:default="", esp32c5="about 20.6 ms"}
{IDF_TARGET_SBV2_DEFAULT_SCHEME:default="RSA", esp32c2="ECDSA (v2)", esp32c5="ECDSA (v2)", esp32c61="ECDSA (v2)"}
{IDF_TARGET_ROM_CPU_FREQ:default="", esp32c5="48 MHz", esp32c6="40 MHz", esp32h2="32 MHz", esp32p4="40 MHz"}
{IDF_TARGET_CPU_FREQ:default="", esp32c5="240 MHz", esp32c6="160 MHz", esp32h2="96 MHz", esp32p4="360 MHz"}
{IDF_TARGET_SBV2_DEFAULT_SCHEME:default="RSA", esp32c2, esp32c61, esp32c5="ECDSA (v2)"}
{IDF_TARGET_EFUSE_WR_DIS_RD_DIS:default="ESP_EFUSE_WR_DIS_RD_DIS", esp32="ESP_EFUSE_WR_DIS_EFUSE_RD_DISABLE"}
@@ -136,6 +142,59 @@ The Secure Boot v2 process follows these steps:
7. The bootloader executes the verified application image.
.. only:: SOC_SECURE_BOOT_V2_RSA and SOC_SECURE_BOOT_V2_ECC
.. _secure-boot-v2-scheme-selection:
Secure Boot v2 Scheme Selection
^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
{IDF_TARGET_NAME} has a provision to choose between the RSA scheme and the ECDSA scheme. Only one scheme can be used per device.
ECDSA provides similar security strength, compared to RSA, with shorter key lengths. Current estimates are that ECDSA with curve P-256 has an approximate equivalent strength to RSA with 3072-bit keys. However, ECDSA signature verification takes considerably more amount of time as compared to RSA signature verification.
{IDF_TARGET_SBV2_SCHEME_RECOMMENDATION}
.. only:: SOC_ECDSA_SUPPORT_CURVE_P384
{IDF_TARGET_NAME} also supports Secure Boot v2 with the ECDSA signature scheme using the P-384 curve. This provides stronger security than both ECDSA-P256 and RSA-3072, but at the cost of increased signature verification time. Therefore, for use cases that require higher security strength, Secure Boot v2 should be enabled with the ECDSA P-384 signature scheme.
.. list-table:: Comparison Between Signature Verification Time
:widths: 10 10 20
:header-rows: 1
* - **Verification Scheme**
- **Time**
- **CPU Frequency**
* - RSA-3072
- {IDF_TARGET_RSA_TIME}
- {IDF_TARGET_ROM_CPU_FREQ}
* - ECDSA-P256
- {IDF_TARGET_ECDSA_P256_TIME}
- {IDF_TARGET_ROM_CPU_FREQ}
* - ECDSA-P384
- {IDF_TARGET_ECDSA_P384_TIME}
- {IDF_TARGET_ROM_CPU_FREQ}
.. only:: not SOC_ECDSA_SUPPORT_CURVE_P384
.. list-table:: Comparison Between Signature Verification Time
:widths: 10 10 20
:header-rows: 1
* - **Verification Scheme**
- **Time**
- **CPU Frequency**
* - RSA-3072
- {IDF_TARGET_RSA_TIME}
- {IDF_TARGET_ROM_CPU_FREQ}
* - ECDSA-P256
- {IDF_TARGET_ECDSA_P256_TIME}
- {IDF_TARGET_ROM_CPU_FREQ}
The above table compares the time taken for the first stage (ROM) bootloader to just verify the signature of the bootloader image in a particular scheme. It does not indicate the boot-up time. Also, note that the CPU frequency is lower because it is the frequency of the CPU when the first stage (ROM) bootloader is running.
.. _signature-block-format:
Signature Block Format
@@ -143,34 +202,6 @@ Signature Block Format
The signature block starts on a 4 KB aligned boundary and has a flash sector of its own. The signature is calculated over all bytes in the image including the padding bytes, see :ref:`secure_padding`.
.. only:: SOC_SECURE_BOOT_V2_RSA and SOC_SECURE_BOOT_V2_ECC
.. note::
{IDF_TARGET_NAME} has a provision to choose between the RSA scheme and the ECDSA scheme. Only one scheme can be used per device.
ECDSA provides similar security strength, compared to RSA, with shorter key lengths. Current estimates are that ECDSA with curve P-256 has an approximate equivalent strength to RSA with 3072-bit keys. However, ECDSA signature verification takes considerably more amount of time as compared to RSA signature verification.
RSA is recommended for use cases where fast boot-up time is required whereas ECDSA is recommended for use cases where shorter key length is required.
.. only:: not esp32p4 or not esp32c5
.. list-table:: Comparison between signature verification time
:widths: 10 10 20
:header-rows: 1
* - **Verification scheme**
- **Time**
- **CPU Frequency**
* - RSA-3072
- {IDF_TARGET_RSA_TIME}
- {IDF_TARGET_CPU_FREQ}
* - ECDSA-P256
- {IDF_TARGET_ECDSA_TIME}
- {IDF_TARGET_CPU_FREQ}
The above table compares the time taken to verify a signature in a particular scheme. It does not indicate the boot-up time.
The content of each signature block is shown in the following table:
.. only:: esp32 or SOC_SECURE_BOOT_V2_RSA
@@ -223,7 +254,7 @@ The content of each signature block is shown in the following table:
.. only:: SOC_SECURE_BOOT_V2_ECC
.. list-table:: Content of an ECDSA Signature Block
.. list-table:: Content of an ECDSA-256 / ECDSA-192 Signature Block
:widths: 10 10 40
:header-rows: 1
@@ -261,6 +292,50 @@ The content of each signature block is shown in the following table:
- 16
- Zero padding to length 1216 bytes.
.. only:: SOC_ECDSA_SUPPORT_CURVE_P384
.. list-table:: Content of an ECDSA-384 Signature Block
:widths: 10 10 40
:header-rows: 1
* - **Offset**
- **Size (bytes)**
- **Description**
* - 0
- 1
- Magic byte.
* - 1
- 1
- Version number byte, currently 0x03.
* - 2
- 1
- SHA Version used for digest calculation when generating the signature (1 for SHA-384)
* - 3
- 1
- Padding bytes. Reserved, should be zero.
* - 4
- 48
- SHA-384 hash of only the image content, not including the signature block.
* - 52
- 1
- Curve ID. 3 for NIST384p curve
* - 53
- 96
- ECDSA Public key: 48-byte X coordinate followed by 48-byte Y coordinate.
* - 149
- 96
- ECDSA Signature result (section 5.3.2 of RFC6090) of the image content: 48-byte R component followed by-48 byte S component.
* - 245
- 951
- Reserved.
* - 1196
- 4
- CRC32 of the preceding 1196 bytes.
* - 1200
- 16
- Zero padding to length 1216 bytes.
The remainder of the signature sector is erased flash (0xFF) which allows writing other signature blocks after the previous signature block.
@@ -358,6 +433,10 @@ eFuse Usage
- SECURE_BOOT_EN - Enables Secure Boot protection on boot.
.. only:: SOC_SECURE_BOOT_V2_ECC and SOC_ECDSA_SUPPORT_CURVE_P384
- SECURE_BOOT_SHA384_EN - Enables SHA-384 digest calculation for Secure Boot signature verification.
.. only:: SOC_EFUSE_KEY_PURPOSE_FIELD
- KEY_PURPOSE_X - Set the purpose of the key block on {IDF_TARGET_NAME} by programming SECURE_BOOT_DIGESTX (X = 0, 1, 2) into KEY_PURPOSE_X (X = 0, 1, 2, 3, 4, 5). Example: If KEY_PURPOSE_2 is set to SECURE_BOOT_DIGEST1, then BLOCK_KEY2 will have the Secure Boot v2 public key digest. The write-protection bit must be set, and this field does not have a read-protection bit.
@@ -489,6 +568,12 @@ The build system will prompt you with a command to generate a new signing key vi
.. only:: SOC_SECURE_BOOT_V2_ECC
.. only:: SOC_ECDSA_SUPPORT_CURVE_P384
Select the ECDSA scheme by passing ``--version 2 --scheme ecdsa384``, ``--version 2 --scheme ecdsa256`` or ``--version 2 --scheme ecdsa192`` to generate corresponding ECDSA private key.
.. only:: not SOC_ECDSA_SUPPORT_CURVE_P384
Select the ECDSA scheme by passing ``--version 2 --scheme ecdsa256`` or ``--version 2 --scheme ecdsa192`` to generate corresponding ECDSA private key.
The strength of the signing key is proportional to (a) the random number source of the system, and (b) the correctness of the algorithm used. For production devices, we recommend generating signing keys from a system with a quality entropy source and using the best available {IDF_TARGET_SBV2_SCHEME} key generation utilities.
@@ -517,6 +602,14 @@ For example, to generate a signing key using the OpenSSL command line:
openssl ecparam -name prime256v1 -genkey -noout -out my_secure_boot_signing_key.pem
.. only:: SOC_ECDSA_SUPPORT_CURVE_P384
For the ECC NIST384p curve
.. code-block::
openssl ecparam -name secp384r1 -genkey -noout -out my_secure_boot_signing_key.pem
Remember that the strength of the Secure Boot system depends on keeping the signing key private.
@@ -620,6 +713,12 @@ Secure Boot Best Practices
espsecure.py signature_info_v2 datafile.bin
.. only:: SOC_ECDSA_SUPPORT_CURVE_P384
.. note::
If Secure Boot v2 is configured using the ECDSA P-384 signature scheme, all signing keys used must be ECDSA-P384 keys. Using keys with different elliptic curves (e.g., P-192 or P-256) alongside P-384 is not supported and will cause signature verification to fail during boot.
.. _secure-boot-v2-key-revocation:
Key Revocation
@@ -711,6 +810,14 @@ It is preferred to use the ``idf.py`` tool to generate and verify signatures, bu
openssl dgst -sha256 -binary BINARY_FILE > DIGEST_BINARY_FILE
.. only:: SOC_ECDSA_SUPPORT_CURVE_P384
In case of ECDSA-P384 signature scheme, SHA-384 must be used to calculate the digest of the image.
.. code-block:: bash
openssl dgst -sha384 -binary BINARY_FILE > DIGEST_BINARY_FILE
2. Generate signature of the image using the above calculated digest.
.. only:: SOC_SECURE_BOOT_V2_RSA
docs/en/security/security-features-enablement-workflows.rst
+18 -2
View File
@@ -406,7 +406,13 @@ In this workflow we shall use ``espsecure`` tool to generate signing keys and us
espsecure.py generate_signing_key --version 2 --scheme ecdsa256 secure_boot_signing_key.pem
The scheme in the above command can be changed to ``ecdsa192`` to generate ecdsa192 private key.
.. only:: not SOC_ECDSA_SUPPORT_CURVE_P384
The scheme in the above command can be changed to ``ecdsa192`` to generate ecdsa192 private key.
.. only:: SOC_ECDSA_SUPPORT_CURVE_P384
The scheme in the above command can be changed to ``ecdsa384`` or ``ecdsa192`` to generate ecdsa384 or ecdsa192 private key.
.. only:: SOC_EFUSE_REVOKE_BOOT_KEY_DIGESTS
@@ -466,6 +472,15 @@ In this workflow we shall use ``espsecure`` tool to generate signing keys and us
espefuse.py --port PORT --chip {IDF_TARGET_PATH_NAME} burn_efuse SECURE_BOOT_EN
.. only:: SOC_ECDSA_SUPPORT_CURVE_P384
In case Secure Boot v2 is enabled with the ECDSA-P384 signature scheme, SHA-384 must be used to calculate the digest of the image. Thus, the following eFuse needs to be burned:
.. code:: bash
espefuse.py --port PORT --chip {IDF_TARGET_PATH_NAME} burn_efuse SECURE_BOOT_SHA384_EN
5. Burn relevant eFuses
A) Burn security eFuses
@@ -485,7 +500,8 @@ In this workflow we shall use ``espsecure`` tool to generate signing keys and us
:SOC_EFUSE_DIS_USB_JTAG: - ``DIS_USB_JTAG``: Disable USB switch to JTAG.
:SOC_EFUSE_DIS_PAD_JTAG: - ``DIS_PAD_JTAG``: Disable JTAG permanently.
:SOC_EFUSE_REVOKE_BOOT_KEY_DIGESTS: - ``SECURE_BOOT_AGGRESSIVE_REVOKE``: Aggressive revocation of key digests, see :ref:`secure-boot-v2-aggressive-key-revocation` for more details.
:SOC_ECDSA_P192_CURVE_DEFAULT_DISABLED: - ``WR_DIS_ECDSA_CURVE_MODE``: Disable ECDSA curve mode.
:SOC_ECDSA_P192_CURVE_DEFAULT_DISABLED: - ``WR_DIS_ECDSA_CURVE_MODE``: Disable writing to the ECDSA curve mode eFuse bit.
:SOC_ECDSA_SUPPORT_CURVE_P384: - ``WR_DIS_SECURE_BOOT_SHA384_EN``: Disable writing to the SHA-384 secure boot eFuse bit.
The respective eFuses can be burned by running:
docs/zh_CN/security/secure-boot-v2.rst
+151 -44
View File
@@ -1,25 +1,31 @@
:orphan:
安全启动 (secure boot) v2
安全启动 (Secure Boot) v2
=========================
:link_to_translation:`en:[English]`
{IDF_TARGET_SBV2_SCHEME:default="RSA-PSS", esp32c2="ECDSA", esp32c6="RSA-PSS 或 ECDSA", esp32h2="RSA-PSS 或 ECDSA", esp32p4="RSA-PSS 或 ECDSA", esp32c5="RSA-PSS 或 ECDSA", esp32c61="ECDSA", esp32h21="RSA-PSS 或 ECDSA"}
{IDF_TARGET_SBV2_SCHEME:default="RSA-PSS", esp32c2, esp32c61="ECDSA", esp32c6, esp32h2, esp32p4, esp32c5, esp32h21="RSA-PSS 或 ECDSA"}
{IDF_TARGET_SBV2_KEY:default="RSA-3072", esp32c2="ECDSA-256 或 ECDSA-192", esp32c6="RSA-3072、ECDSA-256 或 ECDSA-192", esp32h2="RSA-3072、ECDSA-256 或 ECDSA-192", esp32p4="RSA-3072、ECDSA-256 或 ECDSA-192", esp32c5="RSA-3072、ECDSA-256 或 ECDSA-192", esp32c61="ECDSA-256 或 ECDSA-192", esp32h21="RSA-3072、ECDSA-256 或 ECDSA-192"}
{IDF_TARGET_SBV2_KEY:default="RSA-3072", esp32c2, esp32c61="ECDSA-256 或 ECDSA-192", esp32c6, esp32h2, esp32p4, esp32h21="RSA-3072、ECDSA-256 或 ECDSA-192", esp32c5="RSA-3072、ECDSA-384、ECDSA-256 或 ECDSA-192"}
{IDF_TARGET_SECURE_BOOT_OPTION_TEXT:default="", esp32c6="推荐使用 RSA，其验证时间更短。可以在菜单中选择 RSA 或 ECDSA 方案。", esp32h2="推荐使用 RSA，其验证时间更短。可以在菜单中选择 RSA 或 ECDSA 方案。", esp32p4="推荐使用 RSA，其验证时间更短。可以在菜单中选择 RSA 或 ECDSA 方案。", esp32c5="推荐使用 RSA，其验证时间更短。可以在菜单中选择 RSA 或 ECDSA 方案。", esp32h21="推荐使用 RSA，其验证时间更短。可以在菜单中选择 RSA 或 ECDSA 方案。"}
{IDF_TARGET_SECURE_BOOT_OPTION_TEXT:default="", esp32c6, esp32h2, esp32p4, esp32h21="推荐使用 RSA，其验证时间更短。可以在菜单中选择 RSA 或 ECDSA 方案。", esp32c5="推荐使用 ECDSA，其验证时间更短。可以在菜单中选择 RSA 或 ECDSA 方案。"}
{IDF_TARGET_SBV2_SCHEME_RECOMMENDATION:default="如果需要快速启动，推荐使用 RSA；如果需要较短的密钥长度，建议使用 ECDSA。", esp32c5="如果需要快速启动且需要较短的密钥长度，建议使用 ECDSA。"}
{IDF_TARGET_ECO_VERSION:default="", esp32="（v3.0 及以上版本）", esp32c3="（v0.3 及以上版本）"}
{IDF_TARGET_RSA_TIME:default="", esp32c6="约 2.7 ms", esp32h2="约 4.5 ms", esp32p4="约 2.4 ms"}
{IDF_TARGET_RSA_TIME:default="", esp32c5="约 12.1 ms", esp32c6="约 10.2 ms", esp32h2="约 18.3 ms", esp32p4="约 14.8 ms"}
{IDF_TARGET_ECDSA_TIME:default="", esp32c6="约 21.5 ms", esp32h2="约 36 ms", esp32p4="约 10.3 ms"}
{IDF_TARGET_ECDSA_P256_TIME:default="", esp32c5="约 5.6 ms", esp32c6="约 83.9 ms", esp32h2="约 76.2 ms", esp32p4="约 61.1 ms"}
{IDF_TARGET_CPU_FREQ:default="", esp32c6="160 MHz", esp32h2="96 MHz", esp32p4="360 MHz"}
{IDF_TARGET_ECDSA_P384_TIME:default="", esp32c5="20.6 ms"}
{IDF_TARGET_SBV2_DEFAULT_SCHEME:default="RSA", esp32c2="ECDSA (v2)", esp32c5="ECDSA (v2)", esp32c61="ECDSA (v2)"}
{IDF_TARGET_ROM_CPU_FREQ:default="", esp32c5="48 MHz", esp32c6="40 MHz", esp32h2="32 MHz", esp32p4="40 MHz"}
{IDF_TARGET_CPU_FREQ:default="", esp32c5="240 MHz", esp32c6="160 MHz", esp32h2="96 MHz", esp32p4="360 MHz"}
{IDF_TARGET_SBV2_DEFAULT_SCHEME:default="RSA", esp32c2, esp32c61, esp32c5="ECDSA (v2)"}
{IDF_TARGET_EFUSE_WR_DIS_RD_DIS:default="ESP_EFUSE_WR_DIS_RD_DIS", esp32="ESP_EFUSE_WR_DIS_EFUSE_RD_DISABLE"}
@@ -136,40 +142,65 @@
7. 引导加载程序执行经验证的应用程序镜像。
.. only:: SOC_SECURE_BOOT_V2_RSA and SOC_SECURE_BOOT_V2_ECC
.. _secure-boot-v2-scheme-selection:
安全启动 v2 签名方案选择
^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
{IDF_TARGET_NAME} 支持在 RSA 签名方案与 ECDSA 签名方案之间进行选择。每个设备只能使用一种签名方案。
与 RSA 相比，ECDSA 在提供类似安全强度的同时，密钥长度更短。目前估算表明，使用 P-256 曲线的 ECDSA 在安全强度上大致等同于使用 3072 位密钥的 RSA。然而，ECDSA 的签名验证所需时间明显多于 RSA。
{IDF_TARGET_SBV2_SCHEME_RECOMMENDATION}
.. only:: SOC_ECDSA_SUPPORT_CURVE_P384
{IDF_TARGET_NAME} 还支持使用 P-384 曲线的 ECDSA 签名方案进行 Secure Boot v2。这种方案比 ECDSA-P256 和 RSA-3072 具备更强的安全性，但签名验证时间也相应更长。因此，对于对安全强度有更高要求的场景，建议使用 ECDSA P-384 签名方案启用 Secure Boot v2。
.. list-table:: 签名验证时间对比
:widths: 10 10 20
:header-rows: 1
* - **验证方案**
- **耗时**
- **CPU 频率**
* - RSA-3072
- {IDF_TARGET_RSA_TIME}
- {IDF_TARGET_ROM_CPU_FREQ}
* - ECDSA-P256
- {IDF_TARGET_ECDSA_P256_TIME}
- {IDF_TARGET_ROM_CPU_FREQ}
* - ECDSA-P384
- {IDF_TARGET_ECDSA_P384_TIME}
- {IDF_TARGET_ROM_CPU_FREQ}
.. only:: not SOC_ECDSA_SUPPORT_CURVE_P384
.. list-table:: 签名验证时间对比
:widths: 10 10 20
:header-rows: 1
* - **验证方案**
- **耗时**
- **CPU 频率**
* - RSA-3072
- {IDF_TARGET_RSA_TIME}
- {IDF_TARGET_ROM_CPU_FREQ}
* - ECDSA-P256
- {IDF_TARGET_ECDSA_P256_TIME}
- {IDF_TARGET_ROM_CPU_FREQ}
以上表格比较的是第一阶段 (ROM) 引导加载程序在特定签名方案下仅用于验证引导加载程序镜像签名所耗费的时间。该数据不代表整体启动时间。另外请注意，表中的 CPU 频率较低，因为这是第一阶段 (ROM) 引导加载程序运行时的 CPU 频率。
.. _signature-block-format:
签名块格式
----------
签名块以 4 KB 的整数倍为起始位置，拥有独立 flash 扇区。签名计算覆盖了镜像中的所有字节，包括填充字节，请参阅 :ref:`secure_padding`。
.. only:: SOC_SECURE_BOOT_V2_RSA and SOC_SECURE_BOOT_V2_ECC
.. note::
{IDF_TARGET_NAME} 可以选择 RSA 或 ECDSA 方案，每个设备只能选择一种方案。
与 RSA 相比，ECDSA 拥有类似的安全性，但密钥长度更短。据估计，使用 P-256 曲线的 ECDSA 签名安全性大致相当于具有 3072 位密钥的 RSA。然而，ECDSA 签名验证耗时明显长于 RSA 签名验证。
如果需要快速启动，建议使用 RSA；如果需要较短的密钥，建议使用 ECDSA。
.. only:: not esp32p4 or not esp32c5
.. list-table:: 签名验证耗时比较
:widths: 10 10 20
:header-rows: 1
* - **验证方案**
- **耗时**
- **CPU 频率**
* - RSA-3072
- {IDF_TARGET_RSA_TIME}
- {IDF_TARGET_CPU_FREQ}
* - ECDSA-P256
- {IDF_TARGET_ECDSA_TIME}
- {IDF_TARGET_CPU_FREQ}
上表比较了特定方案中验证签名所需的时间，不代表启动时间。
签名块以一个 4 KB 的对齐边界为起始位置，占用一个独立的 flash 扇区。签名计算覆盖了镜像中的所有字节，包括填充字节，详情参见 :ref:`secure_padding`。
各签名块内容如下表所示：
@@ -184,7 +215,7 @@
- **描述**
* - 0
- 1
- 魔法字节。
- 魔术字节。
* - 1
- 1
- 版本号字节，当前为 0x02，安全启动 v1 的版本号字节为 0x01。
@@ -214,7 +245,7 @@
- CRC32 的前 1196 字节。
* - 1200
- 16
- 长度填充为 1216 字节的零填充。
- 补零填充，保证总长度为 1216 字节。
.. note::
@@ -223,7 +254,7 @@
.. only:: SOC_SECURE_BOOT_V2_ECC
.. list-table:: ECDSA 签名块的内容
.. list-table:: ECDSA-256 / ECDSA-192 签名块的内容
:widths: 10 10 40
:header-rows: 1
@@ -232,7 +263,7 @@
- **描述**
* - 0
- 1
- 魔法字节。
- 魔术字节。
* - 1
- 1
- 版本号字节，当前为 0x03。
@@ -250,16 +281,60 @@
- ECDSA 公钥：32 字节的 X 坐标，后跟 32 字节的 Y 坐标。
* - 101
- 64
- 对镜像内容的 ECDSA 签名结果（RFC6090 中的 5.3.2 节）：32 字节的 R 组件，后跟 32 字节的 S 组件。
- 对镜像内容的 ECDSA 签名结果（RFC6090 第 5.3.2 节）：32 字节的 R 分量，其后连接 32 字节的 S 分量。
* - 165
- 1031
- 保留。
- 保留字段。
* - 1196
- 4
- 前面 1196 字节的 CRC32。
* - 1200
- 16
- 长度填充为 1216 字节的零填充。
- 补零填充，保证总长度为 1216 字节。
.. only:: SOC_ECDSA_SUPPORT_CURVE_P384
.. list-table:: ECDSA-384 签名块的内容
:widths: 10 10 40
:header-rows: 1
* - **偏移量**
- **大小（字节）**
- **描述**
* - 0
- 1
- 魔术字节。
* - 1
- 1
- 版本号字节，当前为 0x03。
* - 2
- 1
- 生成签名时用于摘要计算的 SHA 版本（1 表示使用 SHA-384）。
* - 3
- 1
- 填充字节。保留，应设置为 0。
* - 4
- 48
- 仅针对镜像内容的 SHA-384 哈希值，不包括签名块。
* - 52
- 1
- 曲线 ID。3 代表 NIST384p 曲线。
* - 53
- 96
- ECDSA 公钥：48 字节的 X 坐标，后跟 48 字节的 Y 坐标。
* - 149
- 96
- 对镜像内容的 ECDSA 签名结果（RFC6090 第 5.3.2 节）：48 字节的 R 分量，其后连接 48 字节的 S 分量。
* - 245
- 951
- 保留字段。
* - 1196
- 4
- 前面 1196 字节的 CRC32。
* - 1200
- 16
- 补零填充，保证总长度为 1216 字节。
签名扇区的其余部分是已擦除的 flash (0xFF)，支持在前一个签名块之后写入其他签名块。
@@ -358,6 +433,10 @@
- SECURE_BOOT_EN - 在启动时启用安全启动保护。
.. only:: SOC_SECURE_BOOT_V2_ECC and SOC_ECDSA_SUPPORT_CURVE_P384
- SECURE_BOOT_SHA384_EN - 启用 SHA-384 摘要计算，用于 Secure Boot 签名验证。
.. only:: SOC_EFUSE_KEY_PURPOSE_FIELD
- KEY_PURPOSE_X - 将 SECURE_BOOT_DIGESTX (X = 0, 1, 2) 烧录到 KEY_PURPOSE_X (X = 0, 1, 2, 3, 4, 5)，设置密钥块功能。例如：若设置 KEY_PURPOSE_2 为 SECURE_BOOT_DIGEST1，则 BLOCK_KEY2 将具有安全启动 v2 公钥摘要。注意，必须设置写保护位，该字段无读保护位。
@@ -489,6 +568,12 @@
.. only:: SOC_SECURE_BOOT_V2_ECC
.. only:: SOC_ECDSA_SUPPORT_CURVE_P384
传递 ``--version 2 --scheme ecdsa384``、 ``--version 2 --scheme ecdsa256`` 或 ``--version 2 --scheme ecdsa192`` 选择 ECDSA 方案，生成相应的 ECDSA 私钥。
.. only:: not SOC_ECDSA_SUPPORT_CURVE_P384
传递 ``--version 2 --scheme ecdsa256`` 或 ``--version 2 --scheme ecdsa192`` 选择 ECDSA 方案，生成相应的 ECDSA 私钥。
签名密钥的强度取决于 (a) 系统的随机数源和 (b) 所用算法的正确性。对于生产设备，建议从具有高质量熵源的系统生成签名密钥，并使用最佳的可用 {IDF_TARGET_SBV2_SCHEME} 密钥生成工具。
@@ -517,6 +602,14 @@
openssl ecparam -name prime256v1 -genkey -noout -out my_secure_boot_signing_key.pem
.. only:: SOC_ECDSA_SUPPORT_CURVE_P384
生成 ECC NIST384p 曲线密钥
.. code-block::
openssl ecparam -name secp384r1 -genkey -noout -out my_secure_boot_signing_key.pem
注意，安全启动系统的强度取决于能否保持签名密钥的私密性。
@@ -620,6 +713,12 @@
espsecure.py signature_info_v2 datafile.bin
.. only:: SOC_ECDSA_SUPPORT_CURVE_P384
.. note::
如果 Secure Boot v2 配置为使用 ECDSA P-384 签名方案，则所有用于签名的密钥必须为 ECDSA-P384 密钥。不支持与 P-384 同时使用其他椭圆曲线（例如 P-192 或 P-256）密钥，否则在启动过程中会导致签名验证失败。
.. _secure-boot-v2-key-revocation:
撤销密钥管理
@@ -711,6 +810,14 @@ Keyfile 是包含 {IDF_TARGET_SBV2_KEY} 签名公钥/私钥的 PEM 文件。
openssl dgst -sha256 -binary BINARY_FILE > DIGEST_BINARY_FILE
.. only:: SOC_ECDSA_SUPPORT_CURVE_P384
在使用 ECDSA-P384 签名方案的情况下，必须使用 SHA-384 来计算镜像的摘要。
.. code-block:: bash
openssl dgst -sha384 -binary BINARY_FILE > DIGEST_BINARY_FILE
2. 使用上述摘要，生成镜像签名。
.. only:: SOC_SECURE_BOOT_V2_RSA
docs/zh_CN/security/security-features-enablement-workflows.rst
+18 -2
View File
@@ -406,7 +406,13 @@ flash 加密指南
bashespsecure.py generate_signing_key --version 2 --scheme ecdsa256 secure_boot_signing_key.pem
将上述命令中的方案更改为 ``ecdsa192``，可生成 ecdsa192 私钥。
.. only:: not SOC_ECDSA_SUPPORT_CURVE_P384
将上述命令中的方案更改为 ``ecdsa192``，可生成 ecdsa192 私钥。
.. only:: SOC_ECDSA_SUPPORT_CURVE_P384
将上述命令中的方案更改为 ``ecdsa384`` 或 ``ecdsa192``，可生成 ecdsa384 或 ecdsa192 私钥。
.. only:: SOC_EFUSE_REVOKE_BOOT_KEY_DIGESTS
@@ -466,6 +472,15 @@ flash 加密指南
espefuse.py --port PORT --chip {IDF_TARGET_PATH_NAME} burn_efuse SECURE_BOOT_EN
.. only:: SOC_ECDSA_SUPPORT_CURVE_P384
如果启用了带有 ECDSA-P384 签名方案的 Secure Boot v2，则必须使用 SHA-384 来计算镜像的摘要。因此，需要烧录以下 eFuse：
.. code:: bash
espefuse.py --port PORT --chip {IDF_TARGET_PATH_NAME} burn_efuse SECURE_BOOT_SHA384_EN
5. 烧录相关 eFuse
A) 烧录安全 eFuse
@@ -485,7 +500,8 @@ flash 加密指南
:SOC_EFUSE_DIS_USB_JTAG: - ``DIS_USB_JTAG``：禁止从 USB 切换到 JTAG。
:SOC_EFUSE_DIS_PAD_JTAG: - ``DIS_PAD_JTAG``：永久禁用 JTAG。
:SOC_EFUSE_REVOKE_BOOT_KEY_DIGESTS: - ``SECURE_BOOT_AGGRESSIVE_REVOKE``：主动吊销密钥摘要。详请请参阅 :ref:`secure-boot-v2-aggressive-key-revocation`。
:SOC_ECDSA_P192_CURVE_DEFAULT_DISABLED: - ``WR_DIS_ECDSA_CURVE_MODE``：禁用 ECDSA 曲线模式。
:SOC_ECDSA_P192_CURVE_DEFAULT_DISABLED: - ``WR_DIS_ECDSA_CURVE_MODE``：禁止写入 ECDSA 曲线模式。
:SOC_ECDSA_SUPPORT_CURVE_P384: - ``WR_DIS_SECURE_BOOT_SHA384_EN``：禁止写入 SHA-384 Secure Boot 的 SHA-384 eFuse 位。
运行以下命令烧录相应的 eFuse：