Mirrors/esp-idf
1
0
Fork 0
mirror of https://github.com/espressif/esp-idf.git synced 2026-09-22 13:01:16 +03:00
Code Issues Packages Projects Releases Wiki Activity

Merge branch 'feature/esp32h2_eco5_ecc_v5.2' into 'release/v5.2'

Browse Source 
feat(ecc): enable ECC constant time mode for ESP32-H2 ECO5 (v5.2)

See merge request espressif/esp-idf!36586
This commit is contained in:
Aditya Patwardhan
2025-02-11 09:54:03 +08:00
parent b8b0046903 cc64fb4338
commit 4c281f8eee
28 changed files with 1390 additions and 545 deletions
Download Patch File Download Diff File Expand all files Collapse all files

5
components/mbedtls/Kconfig
View File

@@ -575,16 +575,16 @@ menu "mbedTLS"
config MBEDTLS_HARDWARE_ECDSA_SIGN_MASKING_CM
bool "Mask original ECDSA sign operation under dummy sign operations"
select HAL_ECDSA_GEN_SIG_CM
# ToDo: IDF-11051
default y
help
The ECDSA peripheral before ECO5 does not offer constant time ECDSA sign operation.
The ECDSA peripheral before ESP32-H2 v1.2 does not offer constant time ECDSA sign operation.
This time can be observed through power profiling of the device,
making the ECDSA private key vulnerable to side-channel timing attacks.
This countermeasure masks the real ECDSA sign operation
under dummy sign operations to add randomness in the generated power signature.
It is highly recommended to also enable Secure Boot for the device in addition to this countermeasure
so that only trusted software can execute on the device.
This countermeasure can be safely disabled for ESP32-H2 v1.2 and above.
config MBEDTLS_HARDWARE_ECDSA_SIGN_CONSTANT_TIME_CM
bool "Make ECDSA signature operation pseudo constant time for software"
@@ -597,6 +597,7 @@ menu "mbedTLS"
of an arbitrary message.
The signature time would appear to be constant to the external entity after enabling
this option.
This countermeasure can be safely disabled for ESP32-H2 v1.2 and above.
endmenu

8
components/mbedtls/port/ecc/esp_ecc.c
View File

@@ -44,6 +44,14 @@ int esp_ecc_point_multiply(const ecc_point_t *point, const uint8_t *scalar, ecc_
ecc_hal_write_mul_param(scalar, point->x, point->y, len);
ecc_hal_set_mode(work_mode);
/*
* Enable constant-time point multiplication operations for the ECC hardware accelerator,
* if supported for the given target. This protects the ECC multiplication operation from
* timing attacks. This increases the time taken (by almost 50%) for some point
* multiplication operations performed by the ECC hardware accelerator.
*/
ecc_hal_enable_constant_time_point_mul(true);
ecc_hal_start_calc();
memset(result, 0, sizeof(ecc_point_t));

10
components/mbedtls/port/ecdsa/ecdsa_alt.c
View File

@@ -25,6 +25,8 @@
#if CONFIG_MBEDTLS_HARDWARE_ECDSA_SIGN_CONSTANT_TIME_CM
#include "esp_timer.h"
#include "soc/chip_revision.h"
#include "hal/efuse_hal.h"
#if CONFIG_ESP_CRYPTO_DPA_PROTECTION_LEVEL_HIGH
/*
@@ -316,9 +318,11 @@ static int esp_ecdsa_sign(mbedtls_ecp_group *grp, mbedtls_mpi* r, mbedtls_mpi* s
#endif
ecdsa_hal_gen_signature(&conf, sha_le, r_le, s_le, len);
#if CONFIG_MBEDTLS_HARDWARE_ECDSA_SIGN_CONSTANT_TIME_CM
sig_time = esp_timer_get_time() - sig_time;
if (sig_time < ECDSA_CM_FIXED_SIG_TIME) {
esp_rom_delay_us(ECDSA_CM_FIXED_SIG_TIME - sig_time);
if (!ESP_CHIP_REV_ABOVE(efuse_hal_chip_revision(), 102)) {
sig_time = esp_timer_get_time() - sig_time;
if (sig_time < ECDSA_CM_FIXED_SIG_TIME) {
esp_rom_delay_us(ECDSA_CM_FIXED_SIG_TIME - sig_time);
}
}
#endif
process_again = !ecdsa_hal_get_operation_result()