Mirrors/esp-idf
1
0
Fork 0
mirror of https://github.com/espressif/esp-idf.git synced 2026-10-02 03:00:34 +03:00
Code Issues Packages Projects Releases Wiki Activity

Merge branch 'fix/disable_secure_boot_v2_ecdsa_v6.1' into 'release/v6.1'

Browse Source 
Fix/disable secure boot v2 ecdsa (v6.1)

See merge request espressif/esp-idf!49469
This commit is contained in:
Mahavir Jain
2026-06-10 14:39:06 +05:30
parent 83abf396e3 4f2f37ca69
commit 3664bd2d7e
24 changed files with 131 additions and 17 deletions
Download Patch File Download Diff File Expand all files Collapse all files
examples/system/efuse/sdkconfig.ci.virt_sb_v2_and_fe.esp32c5
+3
View File
@@ -8,6 +8,9 @@ CONFIG_PARTITION_TABLE_CUSTOM_FILENAME="test/partitions_efuse_emul.csv"
CONFIG_SECURE_BOOT=y
CONFIG_SECURE_BOOT_V2_ENABLED=y
# ECDSA Secure Boot V2 is gated behind the insecure option on the affected SoCs
CONFIG_SECURE_BOOT_INSECURE=y
CONFIG_SECURE_BOOT_V2_FORCE_ENABLE_ECDSA=y
CONFIG_SECURE_SIGNED_APPS_ECDSA_V2_SCHEME=y
CONFIG_SECURE_BOOT_SIGNING_KEY="test/secure_boot_signing_key_ecdsa_nistp256.pem"
CONFIG_SECURE_ENABLE_SECURE_ROM_DL_MODE=y
examples/system/efuse/sdkconfig.ci.virt_sb_v2_and_fe.esp32c61
+3
View File
@@ -8,6 +8,9 @@ CONFIG_PARTITION_TABLE_CUSTOM_FILENAME="test/partitions_efuse_emul.csv"
CONFIG_SECURE_BOOT=y
CONFIG_SECURE_BOOT_V2_ENABLED=y
# ECDSA based Secure Boot V2 is not recommended on ESP32-C61 and must be force-enabled.
CONFIG_SECURE_BOOT_INSECURE=y
CONFIG_SECURE_BOOT_V2_FORCE_ENABLE_ECDSA=y
CONFIG_SECURE_SIGNED_APPS_ECDSA_V2_SCHEME=y
CONFIG_SECURE_BOOT_SIGNING_KEY="test/secure_boot_signing_key_ecdsa_nistp256.pem"
CONFIG_SECURE_ENABLE_SECURE_ROM_DL_MODE=y
examples/system/efuse/sdkconfig.ci.virt_sb_v2_ecdsa_p384_and_fe
+3
View File
@@ -8,6 +8,9 @@ CONFIG_PARTITION_TABLE_CUSTOM_FILENAME="test/partitions_efuse_emul.csv"
CONFIG_SECURE_BOOT=y
CONFIG_SECURE_BOOT_V2_ENABLED=y
# ECDSA Secure Boot V2 is gated behind the insecure option on the affected SoCs
CONFIG_SECURE_BOOT_INSECURE=y
CONFIG_SECURE_BOOT_V2_FORCE_ENABLE_ECDSA=y
CONFIG_SECURE_SIGNED_APPS_ECDSA_V2_SCHEME=y
CONFIG_SECURE_BOOT_ECDSA_KEY_LEN_384_BITS=y
CONFIG_SECURE_BOOT_SIGNING_KEY="test/secure_boot_signing_key_ecdsa_nistp384.pem"
examples/system/efuse/sdkconfig.ci.virt_secure_boot_v2.esp32c5
+3
View File
@@ -8,6 +8,9 @@ CONFIG_PARTITION_TABLE_CUSTOM_FILENAME="test/partitions_efuse_emul.csv"
CONFIG_SECURE_BOOT=y
CONFIG_SECURE_BOOT_V2_ENABLED=y
# ECDSA Secure Boot V2 is gated behind the insecure option on the affected SoCs
CONFIG_SECURE_BOOT_INSECURE=y
CONFIG_SECURE_BOOT_V2_FORCE_ENABLE_ECDSA=y
CONFIG_SECURE_SIGNED_APPS_ECDSA_V2_SCHEME=y
CONFIG_SECURE_BOOT_SIGNING_KEY="test/secure_boot_signing_key_ecdsa_nistp256.pem"
CONFIG_SECURE_INSECURE_ALLOW_DL_MODE=y
examples/system/efuse/sdkconfig.ci.virt_secure_boot_v2.esp32c61
+3
View File
@@ -8,6 +8,9 @@ CONFIG_PARTITION_TABLE_CUSTOM_FILENAME="test/partitions_efuse_emul.csv"
CONFIG_SECURE_BOOT=y
CONFIG_SECURE_BOOT_V2_ENABLED=y
# ECDSA based Secure Boot V2 is not recommended on ESP32-C61 and must be force-enabled.
CONFIG_SECURE_BOOT_INSECURE=y
CONFIG_SECURE_BOOT_V2_FORCE_ENABLE_ECDSA=y
CONFIG_SECURE_SIGNED_APPS_ECDSA_V2_SCHEME=y
CONFIG_SECURE_BOOT_SIGNING_KEY="test/secure_boot_signing_key_ecdsa_nistp256.pem"
CONFIG_SECURE_INSECURE_ALLOW_DL_MODE=y
examples/system/efuse/sdkconfig.ci.virt_secure_boot_v2_ecdsa_p384
+3
View File
@@ -8,6 +8,9 @@ CONFIG_PARTITION_TABLE_CUSTOM_FILENAME="test/partitions_efuse_emul.csv"
CONFIG_SECURE_BOOT=y
CONFIG_SECURE_BOOT_V2_ENABLED=y
# ECDSA Secure Boot V2 is gated behind the insecure option on the affected SoCs
CONFIG_SECURE_BOOT_INSECURE=y
CONFIG_SECURE_BOOT_V2_FORCE_ENABLE_ECDSA=y
CONFIG_SECURE_SIGNED_APPS_ECDSA_V2_SCHEME=y
CONFIG_SECURE_BOOT_ECDSA_KEY_LEN_384_BITS=y
CONFIG_SECURE_BOOT_SIGNING_KEY="test/secure_boot_signing_key_ecdsa_nistp384.pem"
examples/system/ota/partitions_ota/sdkconfig.ci.virt_sb_v2_and_fe.esp32c61
+6
View File
@@ -0,0 +1,6 @@
# ESP32-C61 has no RSA based Secure Boot V2; the ECDSA scheme is gated behind the
# insecure option (see SECURE_BOOT_V2_ECDSA_INSECURE), so force-enable it and use an ECDSA key.
CONFIG_SECURE_BOOT_INSECURE=y
CONFIG_SECURE_BOOT_V2_FORCE_ENABLE_ECDSA=y
CONFIG_SECURE_SIGNED_APPS_ECDSA_V2_SCHEME=y
CONFIG_SECURE_BOOT_SIGNING_KEY="test/secure_boot_signing_key_ecdsa.pem"
examples/system/ota/partitions_ota/sdkconfig.ci.virt_sb_v2_and_fe_2.esp32c61
+6
View File
@@ -0,0 +1,6 @@
# ESP32-C61 has no RSA based Secure Boot V2; the ECDSA scheme is gated behind the
# insecure option (see SECURE_BOOT_V2_ECDSA_INSECURE), so force-enable it and use an ECDSA key.
CONFIG_SECURE_BOOT_INSECURE=y
CONFIG_SECURE_BOOT_V2_FORCE_ENABLE_ECDSA=y
CONFIG_SECURE_SIGNED_APPS_ECDSA_V2_SCHEME=y
CONFIG_SECURE_BOOT_SIGNING_KEY="test/secure_boot_signing_key_ecdsa.pem"