Mirrors/esp-idf
1
0
Fork 0
mirror of https://github.com/espressif/esp-idf.git synced 2026-08-18 06:35:35 +03:00
Code Issues Packages Projects Releases Wiki Activity

Merge branch 'fix/nvs-encrypted-partition-destructor-zeroize' into 'master'

Browse Source 
fix(nvs_flash): zeroize XTS contexts when encrypted partition is destroyed

See merge request espressif/esp-idf!47585
This commit is contained in:
Aditya Patwardhan
2026-07-06 14:29:27 +05:30
parent 7eb664f61f 65e77bcfd3
commit 5ee87f7b2c
2 changed files with 19 additions and 3 deletions
Download Patch File Download Diff File Expand all files Collapse all files

20
components/nvs_flash/src/nvs_encrypted_partition.cpp
View File

@@ -13,12 +13,28 @@ namespace nvs {
#ifdef CONFIG_NVS_BDL_STACK
NVSEncryptedPartition::NVSEncryptedPartition(const char* label, const esp_blockdev_handle_t bdl, const bool managed_bdl)
: NVSPartition(label, bdl, managed_bdl) { }
: NVSPartition(label, bdl, managed_bdl)
{
XTS_FUNC(xts_init)(&mEctxt);
XTS_FUNC(xts_init)(&mDctxt);
}
#else
NVSEncryptedPartition::NVSEncryptedPartition(const esp_partition_t *partition)
: NVSPartition(partition) { }
: NVSPartition(partition)
{
XTS_FUNC(xts_init)(&mEctxt);
XTS_FUNC(xts_init)(&mDctxt);
}
#endif // CONFIG_NVS_BDL_STACK
NVSEncryptedPartition::~NVSEncryptedPartition()
{
/* Wipe AES round keys derived from the NVS encryption key so they are not
* left in DRAM after the partition object is destroyed. */
XTS_FUNC(xts_free)(&mEctxt);
XTS_FUNC(xts_free)(&mDctxt);
}
esp_err_t NVSEncryptedPartition::init(nvs_sec_cfg_t* cfg)
{
uint8_t* eky = reinterpret_cast<uint8_t*>(cfg);

2
components/nvs_flash/src/nvs_encrypted_partition.hpp
View File

@@ -23,7 +23,7 @@ public:
NVSEncryptedPartition(const esp_partition_t *partition);
#endif
virtual ~NVSEncryptedPartition() { }
virtual ~NVSEncryptedPartition();
/**
* Initializes the AES encryption components with the provided configuration.