diff --git a/components/esp-tls/esp_tls_mbedtls.c b/components/esp-tls/esp_tls_mbedtls.c index 5c0050091b8..9d62b5debea 100644 --- a/components/esp-tls/esp_tls_mbedtls.c +++ b/components/esp-tls/esp_tls_mbedtls.c @@ -763,8 +763,11 @@ static esp_err_t set_server_config(esp_tls_cfg_server_t *cfg, esp_tls_t *tls) return esp_ret; } } else if (cfg->server_key != NULL && cfg->server_key->source == ESP_KEY_SOURCE_PSA) { + if (cfg->servercert_buf == NULL) { + ESP_LOGE(TAG, "Server certificate is required when using a PSA-backed server key"); + return ESP_ERR_INVALID_ARG; + } mbedtls_svc_key_id_t key_id = cfg->server_key->psa.key_id; - mbedtls_pk_init(&tls->serverkey); ret = mbedtls_pk_wrap_psa(&tls->serverkey, key_id); if (ret != 0) { ESP_LOGE(TAG, "mbedtls_pk_wrap_psa returned -0x%04X", -ret); @@ -772,22 +775,19 @@ static esp_err_t set_server_config(esp_tls_cfg_server_t *cfg, esp_tls_t *tls) ESP_INT_EVENT_TRACKER_CAPTURE(tls->error_handle, ESP_TLS_ERR_TYPE_MBEDTLS, -ret); return ESP_ERR_MBEDTLS_PK_PARSE_KEY_FAILED; } - if (cfg->servercert_buf != NULL) { - mbedtls_x509_crt_init(&tls->servercert); - ret = mbedtls_x509_crt_parse(&tls->servercert, cfg->servercert_buf, cfg->servercert_bytes); - if (ret < 0) { - ESP_LOGE(TAG, "mbedtls_x509_crt_parse returned -0x%04X", -ret); - mbedtls_print_error_msg(ret); - ESP_INT_EVENT_TRACKER_CAPTURE(tls->error_handle, ESP_TLS_ERR_TYPE_MBEDTLS, -ret); - return ESP_ERR_MBEDTLS_X509_CRT_PARSE_FAILED; - } - ret = mbedtls_ssl_conf_own_cert(&tls->conf, &tls->servercert, &tls->serverkey); - if (ret != 0) { - ESP_LOGE(TAG, "mbedtls_ssl_conf_own_cert returned -0x%04X", -ret); - mbedtls_print_error_msg(ret); - ESP_INT_EVENT_TRACKER_CAPTURE(tls->error_handle, ESP_TLS_ERR_TYPE_MBEDTLS, -ret); - return ESP_ERR_MBEDTLS_SSL_CONF_OWN_CERT_FAILED; - } + ret = mbedtls_x509_crt_parse(&tls->servercert, cfg->servercert_buf, cfg->servercert_bytes); + if (ret < 0) { + ESP_LOGE(TAG, "mbedtls_x509_crt_parse returned -0x%04X", -ret); + mbedtls_print_error_msg(ret); + ESP_INT_EVENT_TRACKER_CAPTURE(tls->error_handle, ESP_TLS_ERR_TYPE_MBEDTLS, -ret); + return ESP_ERR_MBEDTLS_X509_CRT_PARSE_FAILED; + } + ret = mbedtls_ssl_conf_own_cert(&tls->conf, &tls->servercert, &tls->serverkey); + if (ret != 0) { + ESP_LOGE(TAG, "mbedtls_ssl_conf_own_cert returned -0x%04X", -ret); + mbedtls_print_error_msg(ret); + ESP_INT_EVENT_TRACKER_CAPTURE(tls->error_handle, ESP_TLS_ERR_TYPE_MBEDTLS, -ret); + return ESP_ERR_MBEDTLS_SSL_CONF_OWN_CERT_FAILED; } } else if (cfg->use_ecdsa_peripheral) { #ifdef CONFIG_MBEDTLS_HARDWARE_ECDSA_SIGN @@ -1026,8 +1026,11 @@ esp_err_t set_client_config(const char *hostname, size_t hostlen, esp_tls_cfg_t return esp_ret; } } else if (cfg->client_key != NULL && cfg->client_key->source == ESP_KEY_SOURCE_PSA) { + if (cfg->clientcert_buf == NULL) { + ESP_LOGE(TAG, "Client certificate is required when using a PSA-backed client key"); + return ESP_ERR_INVALID_ARG; + } mbedtls_svc_key_id_t key_id = cfg->client_key->psa.key_id; - mbedtls_pk_init(&tls->clientkey); ret = mbedtls_pk_wrap_psa(&tls->clientkey, key_id); if (ret != 0) { ESP_LOGE(TAG, "mbedtls_pk_wrap_psa returned -0x%04X", -ret); @@ -1035,22 +1038,19 @@ esp_err_t set_client_config(const char *hostname, size_t hostlen, esp_tls_cfg_t ESP_INT_EVENT_TRACKER_CAPTURE(tls->error_handle, ESP_TLS_ERR_TYPE_MBEDTLS, -ret); return ESP_ERR_MBEDTLS_PK_PARSE_KEY_FAILED; } - if (cfg->clientcert_buf != NULL) { - mbedtls_x509_crt_init(&tls->clientcert); - ret = mbedtls_x509_crt_parse(&tls->clientcert, cfg->clientcert_buf, cfg->clientcert_bytes); - if (ret < 0) { - ESP_LOGE(TAG, "mbedtls_x509_crt_parse returned -0x%04X", -ret); - mbedtls_print_error_msg(ret); - ESP_INT_EVENT_TRACKER_CAPTURE(tls->error_handle, ESP_TLS_ERR_TYPE_MBEDTLS, -ret); - return ESP_ERR_MBEDTLS_X509_CRT_PARSE_FAILED; - } - ret = mbedtls_ssl_conf_own_cert(&tls->conf, &tls->clientcert, &tls->clientkey); - if (ret != 0) { - ESP_LOGE(TAG, "mbedtls_ssl_conf_own_cert returned -0x%04X", -ret); - mbedtls_print_error_msg(ret); - ESP_INT_EVENT_TRACKER_CAPTURE(tls->error_handle, ESP_TLS_ERR_TYPE_MBEDTLS, -ret); - return ESP_ERR_MBEDTLS_SSL_CONF_OWN_CERT_FAILED; - } + ret = mbedtls_x509_crt_parse(&tls->clientcert, cfg->clientcert_buf, cfg->clientcert_bytes); + if (ret < 0) { + ESP_LOGE(TAG, "mbedtls_x509_crt_parse returned -0x%04X", -ret); + mbedtls_print_error_msg(ret); + ESP_INT_EVENT_TRACKER_CAPTURE(tls->error_handle, ESP_TLS_ERR_TYPE_MBEDTLS, -ret); + return ESP_ERR_MBEDTLS_X509_CRT_PARSE_FAILED; + } + ret = mbedtls_ssl_conf_own_cert(&tls->conf, &tls->clientcert, &tls->clientkey); + if (ret != 0) { + ESP_LOGE(TAG, "mbedtls_ssl_conf_own_cert returned -0x%04X", -ret); + mbedtls_print_error_msg(ret); + ESP_INT_EVENT_TRACKER_CAPTURE(tls->error_handle, ESP_TLS_ERR_TYPE_MBEDTLS, -ret); + return ESP_ERR_MBEDTLS_SSL_CONF_OWN_CERT_FAILED; } } else if (cfg->ds_data != NULL) { #ifdef CONFIG_ESP_TLS_USE_DS_PERIPHERAL diff --git a/components/esp-tls/hints.yml b/components/esp-tls/hints.yml index 6cf22e110ec..44263c1d148 100644 --- a/components/esp-tls/hints.yml +++ b/components/esp-tls/hints.yml @@ -3,4 +3,4 @@ hint: "The struct 'esp_tls_t' has now been made private - its elements can be only be accessed/modified through respective getter/setter functions. Please refer to the migration guide for more information." - re: "fatal error: .*atca_mbedtls_wrap\\.h: No such file or directory" - hint: "To use CONFIG_ESP_TLS_USE_SECURE_ELEMENT option, please install `esp-cryptoauthlib` using 'idf.py add-dependency espressif/esp-cryptoauthlib'" + hint: "To use the ATECC608A secure element, enable CONFIG_MBEDTLS_SECURE_ELEMENT_DRIVER_ENABLED and install `esp-cryptoauthlib` using 'idf.py add-dependency espressif/esp-cryptoauthlib'" diff --git a/components/esp-tls/test_apps/README.md b/components/esp-tls/test_apps/README.md index 67844e9673a..d76348d52c2 100644 --- a/components/esp-tls/test_apps/README.md +++ b/components/esp-tls/test_apps/README.md @@ -1,2 +1,2 @@ -| Supported Targets | ESP32-C3 | -| ----------------- | -------- | +| Supported Targets | ESP32 | ESP32-C2 | ESP32-C3 | ESP32-C5 | ESP32-C6 | ESP32-C61 | ESP32-H2 | ESP32-H21 | ESP32-H4 | ESP32-P4 | ESP32-S2 | ESP32-S3 | ESP32-S31 | +| ----------------- | ----- | -------- | -------- | -------- | -------- | --------- | -------- | --------- | -------- | -------- | -------- | -------- | --------- | diff --git a/components/esp_https_server/include/esp_https_server.h b/components/esp_https_server/include/esp_https_server.h index 58d568e21ea..288d1bbf72d 100644 --- a/components/esp_https_server/include/esp_https_server.h +++ b/components/esp_https_server/include/esp_https_server.h @@ -219,6 +219,7 @@ typedef struct httpd_ssl_config httpd_ssl_config_t; HTTPD_SSL_CONFIG_CLIENT_AUTH_OPTIONAL_INIT \ .prvtkey_pem = NULL, \ .prvtkey_len = 0, \ + .server_key = NULL, \ .use_ecdsa_peripheral = false, \ .ecdsa_key_efuse_blk = 0, \ .ecdsa_key_efuse_blk_high = 0, \ diff --git a/components/mbedtls/CMakeLists.txt b/components/mbedtls/CMakeLists.txt index fe4acc1e8c3..abe54e8412e 100644 --- a/components/mbedtls/CMakeLists.txt +++ b/components/mbedtls/CMakeLists.txt @@ -485,8 +485,6 @@ if(CONFIG_MBEDTLS_SECURE_ELEMENT_DRIVER_ENABLED) target_sources(tfpsacrypto PRIVATE "${COMPONENT_DIR}/port/psa_driver/secure_element/psa_crypto_driver_secure_element.c") target_include_directories(tfpsacrypto PUBLIC "${COMPONENT_DIR}/port/psa_driver/include") - target_compile_definitions(tfpsacrypto PRIVATE - SECURE_ELEMENT_DRIVER_ENABLED) endif() if(CONFIG_COMPILER_STATIC_ANALYZER AND CMAKE_C_COMPILER_ID STREQUAL "GNU") diff --git a/components/mbedtls/port/include/mbedtls/esp_config.h b/components/mbedtls/port/include/mbedtls/esp_config.h index fd67f7bccb3..596a30faddb 100644 --- a/components/mbedtls/port/include/mbedtls/esp_config.h +++ b/components/mbedtls/port/include/mbedtls/esp_config.h @@ -267,8 +267,9 @@ #endif #endif -/* SECURE_ELEMENT_DRIVER_ENABLED is set via target_compile_definitions in - * CMakeLists.txt when CONFIG_MBEDTLS_SECURE_ELEMENT_DRIVER_ENABLED is set. */ +#ifdef CONFIG_MBEDTLS_SECURE_ELEMENT_DRIVER_ENABLED +#define SECURE_ELEMENT_DRIVER_ENABLED +#endif #ifdef CONFIG_MBEDTLS_HARDWARE_ECC #ifdef CONFIG_MBEDTLS_ECC_OTHER_CURVES_SOFT_FALLBACK diff --git a/components/mbedtls/port/psa_driver/include/psa_crypto_driver_secure_element.h b/components/mbedtls/port/psa_driver/include/psa_crypto_driver_secure_element.h index 6a0831ba0ab..665cc56855c 100644 --- a/components/mbedtls/port/psa_driver/include/psa_crypto_driver_secure_element.h +++ b/components/mbedtls/port/psa_driver/include/psa_crypto_driver_secure_element.h @@ -113,10 +113,12 @@ typedef struct { * @brief Register secure element callbacks * * Must be called once during application initialization, before any PSA - * operations targeting PSA_KEY_LOCATION_SECURE_ELEMENT. Uses atomic - * compare-and-swap so only the first call succeeds. + * operations targeting PSA_KEY_LOCATION_SECURE_ELEMENT. Only the first + * call succeeds; subsequent calls return PSA_ERROR_BAD_STATE. * - * @param callbacks Pointer to callback table (must remain valid for program lifetime) + * @param callbacks Pointer to callback table. The contents are copied + * internally, so the struct need not remain valid after + * this call returns. * @return PSA_SUCCESS on success * @return PSA_ERROR_BAD_STATE if callbacks were already registered * @return PSA_ERROR_INVALID_ARGUMENT if callbacks is NULL diff --git a/components/mbedtls/port/psa_driver/include/psa_crypto_driver_secure_element_contexts.h b/components/mbedtls/port/psa_driver/include/psa_crypto_driver_secure_element_contexts.h index 351e513fa01..da7e236b022 100644 --- a/components/mbedtls/port/psa_driver/include/psa_crypto_driver_secure_element_contexts.h +++ b/components/mbedtls/port/psa_driver/include/psa_crypto_driver_secure_element_contexts.h @@ -56,7 +56,7 @@ typedef struct { uint8_t sha[SECURE_ELEMENT_MAX_KEY_BYTES]; size_t key_len; size_t sha_len; - secure_element_opaque_key_t *opaque_key; + secure_element_opaque_key_t opaque_key; unsigned int alg; } secure_element_opaque_sign_hash_operation_t; diff --git a/components/mbedtls/port/psa_driver/secure_element/psa_crypto_driver_secure_element.c b/components/mbedtls/port/psa_driver/secure_element/psa_crypto_driver_secure_element.c index 351dc6348bd..91456dfd443 100644 --- a/components/mbedtls/port/psa_driver/secure_element/psa_crypto_driver_secure_element.c +++ b/components/mbedtls/port/psa_driver/secure_element/psa_crypto_driver_secure_element.c @@ -18,10 +18,9 @@ */ #include -#include #include "sdkconfig.h" -#ifdef SECURE_ELEMENT_DRIVER_ENABLED +#ifdef CONFIG_MBEDTLS_SECURE_ELEMENT_DRIVER_ENABLED #include "esp_log.h" #include "psa_crypto_driver_secure_element.h" @@ -30,8 +29,10 @@ static const char *TAG = "psa_crypto_driver_secure_element"; #define UNCOMPRESSED_POINT_FORMAT 0x04 -/* Runtime-registered SE callbacks (set once via secure_element_register_callbacks) */ -static const secure_element_callbacks_t *s_se_callbacks = NULL; +/* Runtime-registered SE callbacks (set once via secure_element_register_callbacks). + * We keep a value copy so the caller's struct lifetime does not matter. */ +static secure_element_callbacks_t s_se_callbacks; +static const secure_element_callbacks_t *s_se_callbacks_ptr = NULL; psa_status_t secure_element_register_callbacks(const secure_element_callbacks_t *callbacks) { @@ -44,14 +45,14 @@ psa_status_t secure_element_register_callbacks(const secure_element_callbacks_t return PSA_ERROR_INVALID_ARGUMENT; } - /* Atomic compare-and-swap: only the first registration succeeds */ - const secure_element_callbacks_t *expected = NULL; - if (!atomic_compare_exchange_strong((volatile _Atomic(const secure_element_callbacks_t *) *)&s_se_callbacks, - &expected, callbacks)) { + if (s_se_callbacks_ptr != NULL) { ESP_LOGE(TAG, "Secure element callbacks already registered"); return PSA_ERROR_BAD_STATE; } + s_se_callbacks = *callbacks; + s_se_callbacks_ptr = &s_se_callbacks; + return PSA_SUCCESS; } @@ -60,7 +61,7 @@ psa_status_t secure_element_register_callbacks(const secure_element_callbacks_t */ static inline const secure_element_callbacks_t *se_get_callbacks(void) { - return s_se_callbacks; + return s_se_callbacks_ptr; } /** @@ -93,6 +94,11 @@ static psa_status_t validate_request(psa_algorithm_t alg, const psa_key_attribut if (!PSA_ALG_IS_RSA_PKCS1V15_SIGN(alg)) { return PSA_ERROR_NOT_SUPPORTED; } + /* If registered with a specific hash, check it matches */ + psa_algorithm_t reg_hash = PSA_ALG_SIGN_GET_HASH(registered_alg); + if (reg_hash != PSA_ALG_ANY_HASH && reg_hash != PSA_ALG_SIGN_GET_HASH(alg)) { + return PSA_ERROR_NOT_SUPPORTED; + } } else if (registered_alg != alg) { return PSA_ERROR_NOT_SUPPORTED; } @@ -336,7 +342,7 @@ psa_status_t secure_element_opaque_sign_hash_start( memset(operation, 0, sizeof(secure_element_opaque_sign_hash_operation_t)); operation->key_len = component_len; memcpy(operation->sha, hash, component_len); - operation->opaque_key = (secure_element_opaque_key_t *) key_buffer; + memcpy(&operation->opaque_key, key_buffer, sizeof(secure_element_opaque_key_t)); operation->alg = alg; operation->sha_len = hash_length; @@ -367,7 +373,7 @@ psa_status_t secure_element_opaque_sign_hash_complete( /* Sign using registered SE callback */ uint8_t sig[2 * SECURE_ELEMENT_MAX_KEY_BYTES]; size_t sig_len = 0; - psa_status_t status = cbs->sign(operation->opaque_key->slot_id, + psa_status_t status = cbs->sign(operation->opaque_key.slot_id, operation->sha, operation->sha_len, sig, sizeof(sig), &sig_len); @@ -376,9 +382,18 @@ psa_status_t secure_element_opaque_sign_hash_complete( return status; } + if (sig_len == 0 || sig_len > sizeof(sig)) { + ESP_LOGE(TAG, "SE returned invalid signature length: %zu", sig_len); + return PSA_ERROR_GENERIC_ERROR; + } + + if (sig_len > signature_size) { + return PSA_ERROR_BUFFER_TOO_SMALL; + } + /* Copy signature to output (R || S format, big-endian - matches PSA) */ - memcpy(signature, sig, 2 * component_len); - *signature_length = 2 * component_len; + memcpy(signature, sig, sig_len); + *signature_length = sig_len; return PSA_SUCCESS; } @@ -463,6 +478,14 @@ psa_status_t secure_element_opaque_export_public_key( return status; } + /* Callback must have written exactly 2 * key_len bytes (X || Y) - reject anything else + * to avoid copying uninitialized stack memory into the caller's buffer. */ + if (pubkey_len != 2 * key_len) { + ESP_LOGE(TAG, "SE export_pubkey returned %u bytes, expected %u", + (unsigned)pubkey_len, (unsigned)(2 * key_len)); + return PSA_ERROR_HARDWARE_FAILURE; + } + /* Format: uncompressed point (0x04 followed by x and y coordinates) */ data[0] = UNCOMPRESSED_POINT_FORMAT; memcpy(data + 1, pubkey, key_len); /* X coordinate */ @@ -484,4 +507,4 @@ size_t secure_element_opaque_size_function( return sizeof(secure_element_opaque_key_t); } -#endif /* SECURE_ELEMENT_DRIVER_ENABLED */ +#endif /* CONFIG_MBEDTLS_SECURE_ELEMENT_DRIVER_ENABLED */ diff --git a/docs/en/api-reference/protocols/esp_http_client.rst b/docs/en/api-reference/protocols/esp_http_client.rst index c9fe9f9ec34..b3e157b60e0 100644 --- a/docs/en/api-reference/protocols/esp_http_client.rst +++ b/docs/en/api-reference/protocols/esp_http_client.rst @@ -36,7 +36,7 @@ To allow ESP HTTP client to take full advantage of persistent connections, one s Use Secure Element (ATECC608) for TLS ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^ -A secure element (ATECC608) can be used for the underlying TLS connection in the HTTP client connection via the PSA Crypto opaque driver interface. Please refer to the **ATECC608A (Secure Element) with ESP-TLS** section in the :doc:`ESP-TLS documentation ` for details on setting up the PSA key. Then configure the HTTP client to use the secure element via the ``client_key`` field in :cpp:type:`esp_tls_cfg_t`: +A secure element (ATECC608) can be used for the underlying TLS connection in the HTTP client connection via the PSA Crypto opaque driver interface. Please refer to the **ATECC608A (Secure Element) with ESP-TLS** section in the :doc:`ESP-TLS documentation ` for details on setting up the PSA key. Then configure the HTTP client to use the secure element via the ``client_key`` field in :cpp:type:`esp_http_client_config_t`: .. code-block:: c diff --git a/docs/en/api-reference/protocols/esp_tls.rst b/docs/en/api-reference/protocols/esp_tls.rst index 8e97b8d33fa..6b5500f0629 100644 --- a/docs/en/api-reference/protocols/esp_tls.rst +++ b/docs/en/api-reference/protocols/esp_tls.rst @@ -255,8 +255,13 @@ To enable the secure element support, and use it in your project for TLS connect }; psa_key_id_t psa_key_id; - psa_import_key(&key_attr, (const uint8_t *)&opaque_key, - sizeof(opaque_key), &psa_key_id); + psa_status_t status = psa_import_key(&key_attr, (const uint8_t *)&opaque_key, + sizeof(opaque_key), &psa_key_id); + if (status != PSA_SUCCESS) { + /* Handle error - typically means the SE callbacks are not registered + * or the attributes are invalid. */ + return; + } /* Configure ESP-TLS to use the PSA key */ esp_key_config_t key_config = { diff --git a/docs/zh_CN/api-reference/protocols/esp_http_client.rst b/docs/zh_CN/api-reference/protocols/esp_http_client.rst index 95b44a33d64..057eed20cb0 100644 --- a/docs/zh_CN/api-reference/protocols/esp_http_client.rst +++ b/docs/zh_CN/api-reference/protocols/esp_http_client.rst @@ -35,7 +35,7 @@ HTTP 基本请求 为 TLS 使用安全元件 (ATECC608) ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^ -安全元件 (ATECC608) 可通过 PSA Crypto 不透明驱动接口用于 HTTP 客户端连接中的底层 TLS 连接。有关设置 PSA 密钥的详细内容，请参考 :doc:`ESP-TLS 文档 ` 中的 **ESP-TLS 中的 ATECC608A（安全元件）** 小节。然后通过 :cpp:type:`esp_tls_cfg_t` 中的 ``client_key`` 字段配置 HTTP 客户端使用安全元件： +安全元件 (ATECC608) 可通过 PSA Crypto 不透明驱动接口用于 HTTP 客户端连接中的底层 TLS 连接。有关设置 PSA 密钥的详细内容，请参考 :doc:`ESP-TLS 文档 ` 中的 **ESP-TLS 中的 ATECC608A（安全元件）** 小节。然后通过 :cpp:type:`esp_http_client_config_t` 中的 ``client_key`` 字段配置 HTTP 客户端使用安全元件： .. code-block:: c diff --git a/docs/zh_CN/api-reference/protocols/esp_tls.rst b/docs/zh_CN/api-reference/protocols/esp_tls.rst index b01bfc0253b..1967aed1cae 100644 --- a/docs/zh_CN/api-reference/protocols/esp_tls.rst +++ b/docs/zh_CN/api-reference/protocols/esp_tls.rst @@ -255,8 +255,12 @@ ESP-TLS 支持通过 PSA Crypto 不透明驱动接口在 ESP32 系列芯片上 }; psa_key_id_t psa_key_id; - psa_import_key(&key_attr, (const uint8_t *)&opaque_key, - sizeof(opaque_key), &psa_key_id); + psa_status_t status = psa_import_key(&key_attr, (const uint8_t *)&opaque_key, + sizeof(opaque_key), &psa_key_id); + if (status != PSA_SUCCESS) { + /* 处理错误 - 通常表示安全元件回调未注册或属性无效。 */ + return; + } /* 配置 ESP-TLS 使用 PSA 密钥 */ esp_key_config_t key_config = { diff --git a/tools/test_idf_py/error_output.yml b/tools/test_idf_py/error_output.yml index 3cc548d0be3..6512c615f27 100644 --- a/tools/test_idf_py/error_output.yml +++ b/tools/test_idf_py/error_output.yml @@ -50,7 +50,7 @@ "HINT: The component 'component' could not be found. This could be because: component name was misspelled, the component was not added to the build, the component has been moved to the IDF component manager, the component has been removed and refactored into some other component or the component may not be supported by the selected target.\nPlease look out for component in 'https://components.espressif.com' and add using 'idf.py add-dependency' command.\nRefer to the migration guide for more details about moved components.\nRefer to the build-system guide for more details about how components are found and included in the build." 'fatal error: tmp/atca_mbedtls_wrap.h: No such file or directory\n': - "HINT: To use CONFIG_ESP_TLS_USE_SECURE_ELEMENT option, please install `esp-cryptoauthlib` using 'idf.py add-dependency espressif/esp-cryptoauthlib'" + "HINT: To use the ATECC608A secure element, enable CONFIG_MBEDTLS_SECURE_ELEMENT_DRIVER_ENABLED and install `esp-cryptoauthlib` using 'idf.py add-dependency espressif/esp-cryptoauthlib'" 'fatal error: brownout.h: No such file or directory\n': 'HINT: The Brownout API (functions/types/macros prefixed with "esp_brownout") has been made into a private API. If users still require usage of the Brownout API (though this is not recommended), it can be included via #include "esp_private/brownout.h".'