Mirrors/esp-idf
1
0
Fork 0
mirror of https://github.com/espressif/esp-idf.git synced 2026-10-03 03:31:41 +03:00
Code Issues Packages Projects Releases Wiki Activity

fix(esp_security): harden crypto peripheral error handling

Browse Source
This commit is contained in:
Ashish Sharma
2026-06-19 18:27:22 +08:00
parent 2573bf3988
commit 1b8a365f16
4 changed files with 41 additions and 12 deletions
Download Patch File Download Diff File Expand all files Collapse all files
components/esp_security/src/esp_hmac.c
+13 -3
View File
@@ -91,6 +91,14 @@ esp_err_t esp_hmac_calculate(hmac_key_id_t key_id,
uint32_t conf_error = hmac_hal_configure(HMAC_OUTPUT_USER, key_id);
if (conf_error) {
esp_crypto_sha_enable_periph_clk(false);
esp_crypto_hmac_enable_periph_clk(false);
#if SOC_DIG_SIGN_SUPPORTED
esp_crypto_ds_enable_periph_clk(false);
#endif // SOC_DIG_SIGN_SUPPORTED
#if SOC_KEY_MANAGER_HMAC_KEY_DEPLOY
esp_crypto_key_mgr_enable_periph_clk(false);
#endif // SOC_KEY_MANAGER_HMAC_KEY_DEPLOY
esp_crypto_hmac_lock_release();
return ESP_FAIL;
}
@@ -99,7 +107,7 @@ esp_err_t esp_hmac_calculate(hmac_key_id_t key_id,
// If message including padding is only one block...
// Last message block, so apply SHA-256 padding rules in software
uint8_t block[SHA256_BLOCK_SZ];
uint64_t bit_len = __builtin_bswap64(message_len * 8 + 512);
uint64_t bit_len = __builtin_bswap64((uint64_t)message_len * 8 + 512);
write_and_padd(block, message_bytes, message_len);
// Final block: append the bit length in this block and signal padding to peripheral
@@ -126,7 +134,7 @@ esp_err_t esp_hmac_calculate(hmac_key_id_t key_id,
size_t remaining = message_len % SHA256_BLOCK_SZ;
// Last message block, so apply SHA-256 padding rules in software
uint8_t block[SHA256_BLOCK_SZ];
uint64_t bit_len = __builtin_bswap64(message_len * 8 + 512);
uint64_t bit_len = __builtin_bswap64((uint64_t)message_len * 8 + 512);
// If the remaining message and appended padding doesn't fit into a single block, we have to write an
// extra block with the rest of the message and potential padding first.
@@ -185,6 +193,8 @@ esp_err_t esp_hmac_jtag_enable(hmac_key_id_t key_id, const uint8_t *token)
}
esp_crypto_hmac_lock_acquire();
esp_crypto_hmac_enable_periph_clk(true);
esp_crypto_sha_enable_periph_clk(true);
ets_status = ets_jtag_enable_temporarily(token, convert_key_type(key_id));
@@ -196,8 +206,8 @@ esp_err_t esp_hmac_jtag_enable(hmac_key_id_t key_id, const uint8_t *token)
ESP_LOGD(TAG, "HMAC computation in downstream mode is completed.");
esp_crypto_sha_enable_periph_clk(false);
esp_crypto_hmac_enable_periph_clk(false);
esp_crypto_hmac_lock_release();
return err;