Merge branch 'fix/disable_secure_boot_v2_ecdsa_v6.1' into 'release/v6.1'

Fix/disable secure boot v2 ecdsa (v6.1) See merge request espressif/esp-idf!49469
2026-10-02 03:00:34 +03:00 · 2026-06-10 14:39:06 +05:30
parent 83abf396e3 4f2f37ca69
commit 3664bd2d7e
24 changed files with 131 additions and 17 deletions
@@ -476,6 +476,18 @@ menu "Security features"
        default y
        depends on SOC_SECURE_BOOT_V2_ECC

+    # ECDSA based Secure Boot V2 is not functional for certain input vectors on these
+    # SoCs. The scheme stays available but, for hardware Secure Boot, must be explicitly
+    # turned on via SECURE_BOOT_V2_FORCE_ENABLE_ECDSA under "Allow potentially insecure
+    # options" (CONFIG_SECURE_BOOT_INSECURE).
+    #
+    # TODO: IDF-15721 - drop a SoC from this list once a fixing hardware ECO revision
+    # ships, gating on the selected minimum chip revision, e.g.:
+    #     default y if IDF_TARGET_ESP32C5 && ESP32C5_REV_MIN_FULL < <fixed_rev>
+    config SECURE_BOOT_V2_ECDSA_INSECURE
+        bool
+        default y if IDF_TARGET_ESP32C5 || IDF_TARGET_ESP32C61 || IDF_TARGET_ESP32H2 || IDF_TARGET_ESP32P4
+
    config SECURE_BOOT_V1_SUPPORTED
        bool
        default y
@@ -547,6 +559,10 @@ menu "Security features"
        config SECURE_SIGNED_APPS_ECDSA_V2_SCHEME
            bool "ECDSA (V2)"
            depends on SECURE_BOOT_V2_ECC_SUPPORTED && (SECURE_SIGNED_APPS_NO_SECURE_BOOT || SECURE_BOOT_V2_ENABLED)
+            # On the affected SoCs (SECURE_BOOT_V2_ECDSA_INSECURE), hardware Secure Boot with ECDSA
+            # is offered only when SECURE_BOOT_V2_FORCE_ENABLE_ECDSA is explicitly set. App signing
+            # without hardware Secure Boot is not affected by this gate.
+            depends on !SECURE_BOOT_V2_ENABLED || (!SECURE_BOOT_V2_ECDSA_INSECURE || SECURE_BOOT_V2_FORCE_ENABLE_ECDSA)
            help
                For Secure boot V2 (e.g., ESP32-C2 SoC), appends ECDSA based signature block to the application.
                Refer to documentation before enabling.
@@ -929,6 +945,19 @@ menu "Security features"
        # it's possible for the insecure menu to be disabled but the insecure option
        # to remain on which is very bad.)

+        config SECURE_BOOT_V2_FORCE_ENABLE_ECDSA
+            bool "Force enable ECDSA based Secure Boot V2"
+            depends on SECURE_BOOT_INSECURE && SECURE_BOOT_V2_ECDSA_INSECURE
+            default n
+            help
+                ECDSA based Secure Boot V2 is not functional for certain input vectors on this SoC
+                and is therefore not offered by default. Refer to the hardware errata document for
+                details.
+
+                Setting this option re-enables the ECDSA based Secure Boot V2 signing scheme despite
+                the known vulnerability. Only set this option if you fully understand the risk. RSA
+                based Secure Boot V2 is the recommended scheme on SoCs that support it.
+
        config SECURE_BOOT_ALLOW_ROM_BASIC
            bool "Leave ROM BASIC Interpreter available on reset"
            depends on (SECURE_BOOT_INSECURE || SECURE_FLASH_ENCRYPTION_MODE_DEVELOPMENT) && IDF_TARGET_ESP32
@@ -1,3 +1,6 @@
+# NOTE: This sdkconfig is intended solely for CI build purposes - to verify ESP-TEE
+# builds across various configurations - and is not intended for production use.
+
 # Reducing TEE IRAM size
 # 29KB
 CONFIG_SECURE_TEE_IRAM_SIZE=0x7400
@@ -12,6 +15,9 @@ CONFIG_SECURE_TEE_EXT_FLASH_MEMPROT_SPI1=n
 # Secure Boot
 CONFIG_PARTITION_TABLE_OFFSET=0xF000
 CONFIG_SECURE_BOOT=y
+# ECDSA Secure Boot V2 is gated behind the insecure option on the affected SoCs
+CONFIG_SECURE_BOOT_INSECURE=y
+CONFIG_SECURE_BOOT_V2_FORCE_ENABLE_ECDSA=y
 CONFIG_SECURE_SIGNED_APPS_ECDSA_V2_SCHEME=y
 CONFIG_SECURE_BOOT_BUILD_SIGNED_BINARIES=y
 CONFIG_SECURE_BOOT_SIGNING_KEY="test_keys/secure_boot_signing_key_ecdsa_p256.pem"
@@ -1,3 +1,6 @@
+# NOTE: This sdkconfig is intended solely for CI build purposes - to verify ESP-TEE
+# builds across various configurations - and is not intended for production use.
+
 # Increasing TEE I/DRAM sizes
 # 34KB
 CONFIG_SECURE_TEE_IRAM_SIZE=0x8800
@@ -9,6 +12,9 @@ CONFIG_PARTITION_TABLE_OFFSET=0xf000

 # Secure Boot
 CONFIG_SECURE_BOOT=y
+# ECDSA Secure Boot V2 is gated behind the insecure option on the affected SoCs
+CONFIG_SECURE_BOOT_INSECURE=y
+CONFIG_SECURE_BOOT_V2_FORCE_ENABLE_ECDSA=y
 CONFIG_SECURE_SIGNED_APPS_ECDSA_V2_SCHEME=y
 CONFIG_SECURE_BOOT_BUILD_SIGNED_BINARIES=y
 CONFIG_SECURE_BOOT_SIGNING_KEY="test_keys/secure_boot_signing_key_ecdsa_p256.pem"
@@ -837,7 +837,7 @@ config SOC_SECURE_BOOT_V2_RSA

 config SOC_SECURE_BOOT_V2_ECC
    bool
-    default y
+    default n

 config SOC_EFUSE_SECURE_BOOT_KEY_DIGESTS
    int
@@ -397,7 +397,7 @@

 /*-------------------------- Secure Boot CAPS----------------------------*/
 #define SOC_SECURE_BOOT_V2_RSA              1
-#define SOC_SECURE_BOOT_V2_ECC              1
+#define SOC_SECURE_BOOT_V2_ECC              0
 #define SOC_EFUSE_SECURE_BOOT_KEY_DIGESTS   3
 #define SOC_EFUSE_REVOKE_BOOT_KEY_DIGESTS   1
 #define SOC_SUPPORT_SECURE_BOOT_REVOKE_KEY  1
@@ -157,7 +157,7 @@ config SOC_FLASH_ENC_SUPPORTED

 config SOC_SECURE_BOOT_SUPPORTED
    bool
-    default y
+    default n

 config SOC_BOD_SUPPORTED
    bool
@@ -1013,7 +1013,7 @@ config SOC_SECURE_BOOT_V2_RSA

 config SOC_SECURE_BOOT_V2_ECC
    bool
-    default y
+    default n

 config SOC_EFUSE_SECURE_BOOT_KEY_DIGESTS
    int
@@ -72,7 +72,7 @@
 #define SOC_ECC_SUPPORTED               1
 #define SOC_ECC_EXTENDED_MODES_SUPPORTED   1
 #define SOC_FLASH_ENC_SUPPORTED         1
-#define SOC_SECURE_BOOT_SUPPORTED       1
+#define SOC_SECURE_BOOT_SUPPORTED       0
 #define SOC_BOD_SUPPORTED               1
 // #define SOC_APM_SUPPORTED               1    // TODO: [ESP32H4] IDF-12256
 #define SOC_PMU_SUPPORTED               1    // TODO: [ESP32H4] IDF-12286
@@ -431,7 +431,7 @@

 /*-------------------------- Secure Boot CAPS----------------------------*/
 #define SOC_SECURE_BOOT_V2_RSA              0
-#define SOC_SECURE_BOOT_V2_ECC              1
+#define SOC_SECURE_BOOT_V2_ECC              0
 #define SOC_EFUSE_SECURE_BOOT_KEY_DIGESTS   3
 #define SOC_EFUSE_SECURE_BOOT_P384_WR_DIS   1
 #define SOC_EFUSE_REVOKE_BOOT_KEY_DIGESTS   1