Mirrors/esp-idf
1
0
Fork 0
mirror of https://github.com/espressif/esp-idf.git synced 2026-10-02 11:10:54 +03:00
Code Issues Packages Projects Releases Wiki Activity

fix(esp_security): fix ECDH1 key manager multi-stage helper

Browse Source
This commit is contained in:
muhaidong
2026-05-11 12:03:17 +05:30
committed by harshal.patil
parent bc8db060f1
commit 14e964c0fa
2 changed files with 5 additions and 25 deletions
Download Patch File Download Diff File Expand all files Collapse all files
components/esp_hal_security/test_apps/crypto/main/key_manager/test_key_manager.c
-22
View File
@@ -641,28 +641,6 @@ static void key_mgr_test_hmac_ecdh1_mode(void)
#endif /* SOC_KEY_MANAGER_HMAC_KEY_DEPLOY */ #endif /* SOC_KEY_MANAGER_HMAC_KEY_DEPLOY */
#if SOC_KEY_MANAGER_FE_KEY_DEPLOY && SOC_KEY_MANAGER_FE_KEY_DEPLOY_XTS_AES_128 #if SOC_KEY_MANAGER_FE_KEY_DEPLOY && SOC_KEY_MANAGER_FE_KEY_DEPLOY_XTS_AES_128
/* Common XTS-AES verify body. Used by both the AES-mode and ECDH1-mode XTS
* tests, which carry their own struct types but share the same plaintext +
* expected-ciphertext layout. */
static void verify_xts_aes_test_data(const uint8_t *plaintext_data,
const test_xts_data_t *xts_test_data)
{
const esp_partition_t *partition = get_test_storage_partition();
ESP_ERROR_CHECK(esp_partition_erase_range(partition, 0, partition->size));
uint8_t read_data[128];
for (int i = 0; i < TEST_COUNT; i++) {
memset(read_data, 0, sizeof(read_data));
uint32_t address = xts_test_data[i].data_offset;
uint32_t data_size = xts_test_data[i].data_size;
ESP_ERROR_CHECK(esp_flash_write_encrypted(NULL, address, plaintext_data, data_size));
ESP_ERROR_CHECK(esp_flash_read(NULL, read_data, address, data_size));
TEST_ASSERT_EQUAL_HEX8_ARRAY(xts_test_data[i].ciphertext, read_data, data_size);
}
}
static void key_mgr_test_xts_aes_128_ecdh1_mode(void) static void key_mgr_test_xts_aes_128_ecdh1_mode(void)
{ {
static esp_key_mgr_ecdh1_key_config_t key_config; static esp_key_mgr_ecdh1_key_config_t key_config;
components/esp_security/src/esp_key_mgr.c
+5 -3
View File
@@ -795,6 +795,7 @@ typedef struct ecdh1_deploy {
const esp_key_mgr_ecdh1_key_config_t *key_config; const esp_key_mgr_ecdh1_key_config_t *key_config;
esp_key_mgr_key_recovery_info_t *key_info; esp_key_mgr_key_recovery_info_t *key_info;
bool huk_deployed; bool huk_deployed;
bool multi_stage_deployment;
} ecdh1_deploy_config_t; } ecdh1_deploy_config_t;
static esp_err_t key_mgr_deploy_key_ecdh1_mode(ecdh1_deploy_config_t *config) static esp_err_t key_mgr_deploy_key_ecdh1_mode(ecdh1_deploy_config_t *config)
@@ -817,7 +818,7 @@ static esp_err_t key_mgr_deploy_key_ecdh1_mode(ecdh1_deploy_config_t *config)
ESP_LOGD(TAG, "HUK deployed successfully"); ESP_LOGD(TAG, "HUK deployed successfully");
} }
uint8_t key_recovery_info_index = is_multi_stage_key_purpose(config->key_purpose) ? 0 : 1; uint8_t key_recovery_info_index = config->multi_stage_deployment ? 1 : 0;
uint8_t *key_recovery_info = config->key_info->key_info[key_recovery_info_index].info; uint8_t *key_recovery_info = config->key_info->key_info[key_recovery_info_index].info;
@@ -868,7 +869,7 @@ static esp_err_t key_mgr_deploy_key_ecdh1_mode(ecdh1_deploy_config_t *config)
// Check if key deployment validation should be skipped for this purpose // Check if key deployment validation should be skipped for this purpose
// Primary purposes in multi-stage deployments skip validation after the first stage // Primary purposes in multi-stage deployments skip validation after the first stage
// because the key is not yet completely deployed. // because the key is not yet completely deployed.
if (!is_multi_stage_key_purpose(config->key_purpose)) { if (!multi_stage_deployment_key_purpose(config->key_purpose)) {
if (!key_mgr_hal_is_key_deployment_valid(key_type, key_len)) { if (!key_mgr_hal_is_key_deployment_valid(key_type, key_len)) {
ESP_LOGE(TAG, "Key deployment is not valid"); ESP_LOGE(TAG, "Key deployment is not valid");
return ESP_FAIL; return ESP_FAIL;
@@ -920,9 +921,10 @@ esp_err_t esp_key_mgr_deploy_key_in_ecdh1_mode(const esp_key_mgr_ecdh1_key_confi
ecdh1_deploy_config.huk_deployed = true; ecdh1_deploy_config.huk_deployed = true;
if (is_multi_stage_key_purpose(ecdh1_deploy_config.key_purpose)) { if (multi_stage_deployment_key_purpose(ecdh1_deploy_config.key_purpose)) {
ecdh1_deploy_config.key_purpose = get_secondary_key_purpose(ecdh1_deploy_config.key_purpose); ecdh1_deploy_config.key_purpose = get_secondary_key_purpose(ecdh1_deploy_config.key_purpose);
ecdh1_deploy_config.k1_G = key_config->k1_G[1]; ecdh1_deploy_config.k1_G = key_config->k1_G[1];
ecdh1_deploy_config.multi_stage_deployment = true;
esp_ret = key_mgr_deploy_key_ecdh1_mode(&ecdh1_deploy_config); esp_ret = key_mgr_deploy_key_ecdh1_mode(&ecdh1_deploy_config);
if (esp_ret != ESP_OK) { if (esp_ret != ESP_OK) {
ESP_LOGE(TAG, "Key deployment in ECDH1 mode failed"); ESP_LOGE(TAG, "Key deployment in ECDH1 mode failed");