From 516e849636e1313004b9374df4742841788db99d Mon Sep 17 00:00:00 2001 From: "harshal.patil" Date: Tue, 21 Jul 2026 11:58:12 +0530 Subject: [PATCH] change(security): disable Key Manager support on ESP32-C5/P4/S31 The Key Manager hardware peripheral in its current form needs further design changes before it can be offered as a production feature. Until a revised peripheral design is available, withdraw ESP-IDF support for it on all Key Manager capable targets. --- components/esp_hal_security/CMakeLists.txt | 5 ++++- components/esp_hal_security/ecdsa_hal.c | 2 +- .../esp_hal_security/esp32c5/include/hal/huk_ll.h | 2 +- .../esp_hal_security/esp32p4/include/hal/huk_ll.h | 4 ++-- components/esp_hal_security/huk_hal.c | 2 +- .../esp_hal_security/include/hal/huk_types.h | 4 ++-- .../esp_hal_security/include/hal/key_mgr_hal.h | 6 +++--- .../test_apps/crypto/main/Kconfig.projbuild | 5 ++++- .../esp_rom/esp32c5/include/esp32c5/rom/key_mgr.h | 4 +--- .../esp_rom/esp32c5/include/esp32c5/rom/km.h | 4 +--- .../esp_rom/esp32p4/include/esp32p4/rom/key_mgr.h | 4 +--- .../esp_rom/esp32p4/include/esp32p4/rom/km.h | 4 +--- components/esp_security/CMakeLists.txt | 2 +- components/esp_security/include/esp_crypto_lock.h | 6 +++--- components/esp_security/include/esp_key_mgr.h | 2 +- components/esp_security/src/esp_crypto_lock.c | 14 +++++++------- .../esp_security/src/esp_crypto_periph_clk.c | 4 ++-- components/esp_security/src/esp_key_mgr.c | 2 -- .../soc/esp32c5/include/soc/Kconfig.soc_caps.in | 2 +- components/soc/esp32c5/include/soc/soc_caps.h | 2 +- .../soc/esp32p4/include/soc/Kconfig.soc_caps.in | 2 +- components/soc/esp32p4/include/soc/soc_caps.h | 2 +- examples/security/flash_encryption/README.md | 2 +- 23 files changed, 41 insertions(+), 45 deletions(-) diff --git a/components/esp_hal_security/CMakeLists.txt b/components/esp_hal_security/CMakeLists.txt index 805c58455a3..182e94010bc 100644 --- a/components/esp_hal_security/CMakeLists.txt +++ b/components/esp_hal_security/CMakeLists.txt @@ -72,8 +72,11 @@ elseif(NOT BOOTLOADER_BUILD) endif() # Key Manager and HUK HAL (available in both bootloader and app builds) -if(CONFIG_SOC_KEY_MANAGER_SUPPORTED) +if(CONFIG_SOC_KEY_MANAGER_SUPPORT_KEY_DEPLOYMENT) list(APPEND srcs "key_mgr_hal.c") +endif() + +if(CONFIG_SOC_HUK_SUPPORTED) list(APPEND srcs "huk_hal.c") endif() diff --git a/components/esp_hal_security/ecdsa_hal.c b/components/esp_hal_security/ecdsa_hal.c index 5356e4e2cc6..6f76a10faa9 100644 --- a/components/esp_hal_security/ecdsa_hal.c +++ b/components/esp_hal_security/ecdsa_hal.c @@ -49,7 +49,7 @@ static void configure_ecdsa_periph(ecdsa_hal_config_t *conf) key_mgr_hal_set_key_usage(ESP_KEY_MGR_ECDSA_KEY, ESP_KEY_MGR_USE_EFUSE_KEY); #endif } -#if SOC_KEY_MANAGER_SUPPORTED +#if SOC_KEY_MANAGER_ECDSA_KEY_DEPLOY else { if (!key_mgr_ll_is_supported()) { HAL_ASSERT(false && "Key manager is not supported"); diff --git a/components/esp_hal_security/esp32c5/include/hal/huk_ll.h b/components/esp_hal_security/esp32c5/include/hal/huk_ll.h index 8444e04e6f6..393ebd497d5 100644 --- a/components/esp_hal_security/esp32c5/include/hal/huk_ll.h +++ b/components/esp_hal_security/esp32c5/include/hal/huk_ll.h @@ -13,7 +13,7 @@ #include "soc/soc_caps.h" -#if SOC_KEY_MANAGER_SUPPORTED +#if SOC_HUK_SUPPORTED #include #include diff --git a/components/esp_hal_security/esp32p4/include/hal/huk_ll.h b/components/esp_hal_security/esp32p4/include/hal/huk_ll.h index dc624890501..d4c8b5b23ec 100644 --- a/components/esp_hal_security/esp32p4/include/hal/huk_ll.h +++ b/components/esp_hal_security/esp32p4/include/hal/huk_ll.h @@ -1,5 +1,5 @@ /* - * SPDX-FileCopyrightText: 2023-2025 Espressif Systems (Shanghai) CO LTD + * SPDX-FileCopyrightText: 2023-2026 Espressif Systems (Shanghai) CO LTD * * SPDX-License-Identifier: Apache-2.0 */ @@ -13,7 +13,7 @@ #include "soc/soc_caps.h" -#if SOC_KEY_MANAGER_SUPPORTED +#if SOC_HUK_SUPPORTED #include #include diff --git a/components/esp_hal_security/huk_hal.c b/components/esp_hal_security/huk_hal.c index 22de4d30efb..50dde52187f 100644 --- a/components/esp_hal_security/huk_hal.c +++ b/components/esp_hal_security/huk_hal.c @@ -14,7 +14,7 @@ #include "esp_err.h" #include "soc/soc_caps.h" -#if SOC_KEY_MANAGER_SUPPORTED +#if SOC_HUK_SUPPORTED esp_huk_state_t huk_hal_get_state(void) { return huk_ll_get_state(); diff --git a/components/esp_hal_security/include/hal/huk_types.h b/components/esp_hal_security/include/hal/huk_types.h index a0f63193139..b85c86b7ab4 100644 --- a/components/esp_hal_security/include/hal/huk_types.h +++ b/components/esp_hal_security/include/hal/huk_types.h @@ -1,5 +1,5 @@ /* - * SPDX-FileCopyrightText: 2023 Espressif Systems (Shanghai) CO LTD + * SPDX-FileCopyrightText: 2023-2026 Espressif Systems (Shanghai) CO LTD * * SPDX-License-Identifier: Apache-2.0 */ @@ -7,7 +7,7 @@ #include "soc/soc_caps.h" -#if SOC_KEY_MANAGER_SUPPORTED +#if SOC_HUK_SUPPORTED #include "esp_assert.h" #include "rom/km.h" diff --git a/components/esp_hal_security/include/hal/key_mgr_hal.h b/components/esp_hal_security/include/hal/key_mgr_hal.h index f5427814545..001ad4a9754 100644 --- a/components/esp_hal_security/include/hal/key_mgr_hal.h +++ b/components/esp_hal_security/include/hal/key_mgr_hal.h @@ -1,5 +1,5 @@ /* - * SPDX-FileCopyrightText: 2023-2025 Espressif Systems (Shanghai) CO LTD + * SPDX-FileCopyrightText: 2023-2026 Espressif Systems (Shanghai) CO LTD * * SPDX-License-Identifier: Apache-2.0 */ @@ -9,7 +9,7 @@ #include "soc/soc_caps.h" -#if SOC_KEY_MANAGER_SUPPORTED +#if SOC_KEY_MANAGER_SUPPORT_KEY_DEPLOYMENT #include "hal/key_mgr_types.h" #ifdef __cplusplus @@ -138,4 +138,4 @@ void key_mgr_hal_set_date_info(const uint32_t date_info); #ifdef __cplusplus } #endif -#endif /* SOC_KEY_MANAGER_SUPPORTED */ +#endif /* SOC_KEY_MANAGER_SUPPORT_KEY_DEPLOYMENT */ diff --git a/components/esp_hal_security/test_apps/crypto/main/Kconfig.projbuild b/components/esp_hal_security/test_apps/crypto/main/Kconfig.projbuild index 823eeb9bc6e..ba7778f670a 100644 --- a/components/esp_hal_security/test_apps/crypto/main/Kconfig.projbuild +++ b/components/esp_hal_security/test_apps/crypto/main/Kconfig.projbuild @@ -46,8 +46,11 @@ menu "Test App Configuration" bool default n if IDF_TARGET_ESP32P4 && ESP32P4_SELECTS_REV_LESS_V3 default y - depends on SOC_KEY_MANAGER_SUPPORTED + depends on SOC_KEY_MANAGER_SUPPORT_KEY_DEPLOYMENT help A hidden config to determine if the Key Manager tests should be included. + The tests build the esp_key_mgr driver from source so that the Key Manager + hardware stays covered by CI even on targets where IDF does not support + the Key Manager (SOC_KEY_MANAGER_SUPPORTED = 0). endmenu diff --git a/components/esp_rom/esp32c5/include/esp32c5/rom/key_mgr.h b/components/esp_rom/esp32c5/include/esp32c5/rom/key_mgr.h index 15be126268d..5dd53a841a9 100644 --- a/components/esp_rom/esp32c5/include/esp32c5/rom/key_mgr.h +++ b/components/esp_rom/esp32c5/include/esp32c5/rom/key_mgr.h @@ -1,5 +1,5 @@ /* - * SPDX-FileCopyrightText: 2022-2025 Espressif Systems (Shanghai) CO LTD + * SPDX-FileCopyrightText: 2022-2026 Espressif Systems (Shanghai) CO LTD * * SPDX-License-Identifier: Apache-2.0 */ @@ -8,7 +8,6 @@ #include "soc/soc_caps.h" -#if SOC_KEY_MANAGER_SUPPORTED #include "rom/ets_sys.h" #include "esp_attr.h" @@ -112,4 +111,3 @@ struct km_deploy_ops { #if __cplusplus } #endif -#endif diff --git a/components/esp_rom/esp32c5/include/esp32c5/rom/km.h b/components/esp_rom/esp32c5/include/esp32c5/rom/km.h index 2fe74e77a56..f1bba0c540f 100644 --- a/components/esp_rom/esp32c5/include/esp32c5/rom/km.h +++ b/components/esp_rom/esp32c5/include/esp32c5/rom/km.h @@ -1,5 +1,5 @@ /* - * SPDX-FileCopyrightText: 2015-2024 Espressif Systems (Shanghai) CO LTD + * SPDX-FileCopyrightText: 2015-2026 Espressif Systems (Shanghai) CO LTD * * SPDX-License-Identifier: Apache-2.0 */ @@ -8,7 +8,6 @@ #define _KM_H #include "soc/soc_caps.h" -#if SOC_KEY_MANAGER_SUPPORTED #include #include "soc/soc.h" @@ -58,6 +57,5 @@ int esp_rom_km_huk_risk(void); #ifdef __cplusplus } #endif -#endif /* SOC_KEY_MANAGER_SUPPORTED */ #endif /* _KM_H */ diff --git a/components/esp_rom/esp32p4/include/esp32p4/rom/key_mgr.h b/components/esp_rom/esp32p4/include/esp32p4/rom/key_mgr.h index c28d56c1218..6ee0cb12af9 100644 --- a/components/esp_rom/esp32p4/include/esp32p4/rom/key_mgr.h +++ b/components/esp_rom/esp32p4/include/esp32p4/rom/key_mgr.h @@ -1,5 +1,5 @@ /* - * SPDX-FileCopyrightText: 2022-2025 Espressif Systems (Shanghai) CO LTD + * SPDX-FileCopyrightText: 2022-2026 Espressif Systems (Shanghai) CO LTD * * SPDX-License-Identifier: Apache-2.0 */ @@ -7,7 +7,6 @@ #include "soc/soc_caps.h" -#if SOC_KEY_MANAGER_SUPPORTED #include #include "esp_attr.h" #include "ets_sys.h" @@ -109,4 +108,3 @@ struct km_deploy_ops { #if __cplusplus } #endif -#endif diff --git a/components/esp_rom/esp32p4/include/esp32p4/rom/km.h b/components/esp_rom/esp32p4/include/esp32p4/rom/km.h index 395f5908d28..f1bba0c540f 100644 --- a/components/esp_rom/esp32p4/include/esp32p4/rom/km.h +++ b/components/esp_rom/esp32p4/include/esp32p4/rom/km.h @@ -1,5 +1,5 @@ /* - * SPDX-FileCopyrightText: 2015-2023 Espressif Systems (Shanghai) CO LTD + * SPDX-FileCopyrightText: 2015-2026 Espressif Systems (Shanghai) CO LTD * * SPDX-License-Identifier: Apache-2.0 */ @@ -8,7 +8,6 @@ #define _KM_H #include "soc/soc_caps.h" -#if SOC_KEY_MANAGER_SUPPORTED #include #include "soc/soc.h" @@ -58,6 +57,5 @@ int esp_rom_km_huk_risk(void); #ifdef __cplusplus } #endif -#endif #endif /* _KM_H */ diff --git a/components/esp_security/CMakeLists.txt b/components/esp_security/CMakeLists.txt index 452161103ee..ce904c930fa 100644 --- a/components/esp_security/CMakeLists.txt +++ b/components/esp_security/CMakeLists.txt @@ -48,7 +48,7 @@ elseif(esp_tee_build) else() # BOOTLOADER_BUILD list(APPEND srcs "src/esp_crypto_lock.c" "src/esp_crypto_periph_clk.c") - if(CONFIG_SOC_KEY_MANAGER_FE_KEY_DEPLOY) + if(CONFIG_SOC_KEY_MANAGER_SUPPORTED AND CONFIG_SOC_KEY_MANAGER_FE_KEY_DEPLOY) list(APPEND srcs "src/esp_key_mgr.c") endif() endif() diff --git a/components/esp_security/include/esp_crypto_lock.h b/components/esp_security/include/esp_crypto_lock.h index b3996868196..76200e66194 100644 --- a/components/esp_security/include/esp_crypto_lock.h +++ b/components/esp_security/include/esp_crypto_lock.h @@ -1,5 +1,5 @@ /* - * SPDX-FileCopyrightText: 2023-2025 Espressif Systems (Shanghai) CO LTD + * SPDX-FileCopyrightText: 2023-2026 Espressif Systems (Shanghai) CO LTD * * SPDX-License-Identifier: Apache-2.0 */ @@ -122,7 +122,7 @@ void esp_crypto_ecdsa_lock_acquire(void); void esp_crypto_ecdsa_lock_release(void); #endif /* SOC_ECDSA_SUPPORTED */ -#ifdef SOC_KEY_MANAGER_SUPPORTED +#if SOC_KEY_MANAGER_SUPPORT_KEY_DEPLOYMENT /** * @brief Acquire lock for Key Manager peripheral * @@ -134,7 +134,7 @@ void esp_crypto_key_manager_lock_acquire(void); * */ void esp_crypto_key_manager_lock_release(void); -#endif /* SOC_KEY_MANAGER_SUPPORTED */ +#endif /* SOC_KEY_MANAGER_SUPPORT_KEY_DEPLOYMENT */ #ifdef __cplusplus } diff --git a/components/esp_security/include/esp_key_mgr.h b/components/esp_security/include/esp_key_mgr.h index 72d31163ceb..b86f5965a8a 100644 --- a/components/esp_security/include/esp_key_mgr.h +++ b/components/esp_security/include/esp_key_mgr.h @@ -8,7 +8,7 @@ #include "esp_err.h" #include "soc/soc_caps.h" -#if SOC_KEY_MANAGER_SUPPORTED +#if SOC_KEY_MANAGER_SUPPORT_KEY_DEPLOYMENT #ifdef __cplusplus extern "C" { diff --git a/components/esp_security/src/esp_crypto_lock.c b/components/esp_security/src/esp_crypto_lock.c index d0ed96311f6..2633e7ac25b 100644 --- a/components/esp_security/src/esp_crypto_lock.c +++ b/components/esp_security/src/esp_crypto_lock.c @@ -1,5 +1,5 @@ /* - * SPDX-FileCopyrightText: 2022-2025 Espressif Systems (Shanghai) CO LTD + * SPDX-FileCopyrightText: 2022-2026 Espressif Systems (Shanghai) CO LTD * * SPDX-License-Identifier: Apache-2.0 */ @@ -52,10 +52,10 @@ static _lock_t s_crypto_ecdsa_lock; #endif /* SOC_ECDSA_USES_MPI */ #endif /* SOC_ECDSA_SUPPORTED */ -#ifdef SOC_KEY_MANAGER_SUPPORTED +#if SOC_KEY_MANAGER_SUPPORT_KEY_DEPLOYMENT /* Lock for Key Manager peripheral */ static _lock_t s_crypto_key_manager_lock; -#endif /* SOC_KEY_MANAGER_SUPPORTED */ +#endif /* SOC_KEY_MANAGER_SUPPORT_KEY_DEPLOYMENT */ #ifdef SOC_HMAC_SUPPORTED void esp_crypto_hmac_lock_acquire(void) @@ -159,7 +159,7 @@ void esp_crypto_ecdsa_lock_release(void) } #endif /* SOC_ECDSA_SUPPORTED */ -#ifdef SOC_KEY_MANAGER_SUPPORTED +#if SOC_KEY_MANAGER_SUPPORT_KEY_DEPLOYMENT void esp_crypto_key_manager_lock_acquire(void) { _lock_acquire(&s_crypto_key_manager_lock); @@ -169,7 +169,7 @@ void esp_crypto_key_manager_lock_release(void) { _lock_release(&s_crypto_key_manager_lock); } -#endif /* SOC_KEY_MANAGER_SUPPORTED */ +#endif /* SOC_KEY_MANAGER_SUPPORT_KEY_DEPLOYMENT */ #else /* NON_OS_BUILD */ #ifdef SOC_HMAC_SUPPORTED void esp_crypto_hmac_lock_acquire(void) {} @@ -213,9 +213,9 @@ void esp_crypto_ecdsa_lock_acquire(void) {} void esp_crypto_ecdsa_lock_release(void) {} #endif /* SOC_ECDSA_SUPPORTED */ -#ifdef SOC_KEY_MANAGER_SUPPORTED +#if SOC_KEY_MANAGER_SUPPORT_KEY_DEPLOYMENT void esp_crypto_key_manager_lock_acquire(void) {} void esp_crypto_key_manager_lock_release(void) {} -#endif /* SOC_KEY_MANAGER_SUPPORTED */ +#endif /* SOC_KEY_MANAGER_SUPPORT_KEY_DEPLOYMENT */ #endif /* !NON_OS_BUILD */ diff --git a/components/esp_security/src/esp_crypto_periph_clk.c b/components/esp_security/src/esp_crypto_periph_clk.c index f5fa2dc2e79..29617a95e89 100644 --- a/components/esp_security/src/esp_crypto_periph_clk.c +++ b/components/esp_security/src/esp_crypto_periph_clk.c @@ -31,7 +31,7 @@ #if SOC_ECDSA_SUPPORTED #include "hal/ecdsa_ll.h" #endif -#if SOC_KEY_MANAGER_SUPPORTED +#if SOC_KEY_MANAGER_SUPPORT_KEY_DEPLOYMENT #include "hal/key_mgr_ll.h" #endif /* Crypto DMA, shared between AES and SHA */ @@ -146,7 +146,7 @@ void esp_crypto_ecdsa_enable_periph_clk(bool enable) } #endif -#if SOC_KEY_MANAGER_SUPPORTED +#if SOC_KEY_MANAGER_SUPPORT_KEY_DEPLOYMENT void esp_crypto_key_mgr_enable_periph_clk(bool enable) { KEY_MANAGER_RCC_ATOMIC() { diff --git a/components/esp_security/src/esp_key_mgr.c b/components/esp_security/src/esp_key_mgr.c index 7f5046ba49c..2540573f457 100644 --- a/components/esp_security/src/esp_key_mgr.c +++ b/components/esp_security/src/esp_key_mgr.c @@ -20,7 +20,6 @@ #include "hal/huk_hal.h" #include "rom/key_mgr.h" -#if SOC_KEY_MANAGER_SUPPORTED static const char *TAG = "esp_key_mgr"; ESP_STATIC_ASSERT(sizeof(esp_key_mgr_key_recovery_info_t) == sizeof(struct huk_key_block), "Size of esp_key_mgr_key_recovery_info_t should match huk_key_block (from ROM)"); @@ -1072,4 +1071,3 @@ cleanup: esp_key_mgr_release_hardware(true); return esp_ret; } -#endif diff --git a/components/soc/esp32c5/include/soc/Kconfig.soc_caps.in b/components/soc/esp32c5/include/soc/Kconfig.soc_caps.in index d24da7e619c..538073e7465 100644 --- a/components/soc/esp32c5/include/soc/Kconfig.soc_caps.in +++ b/components/soc/esp32c5/include/soc/Kconfig.soc_caps.in @@ -253,7 +253,7 @@ config SOC_RNG_SUPPORTED config SOC_KEY_MANAGER_SUPPORTED bool - default y + default n config SOC_HUK_SUPPORTED bool diff --git a/components/soc/esp32c5/include/soc/soc_caps.h b/components/soc/esp32c5/include/soc/soc_caps.h index 38d3fd6cf6d..9dbc9c3d241 100644 --- a/components/soc/esp32c5/include/soc/soc_caps.h +++ b/components/soc/esp32c5/include/soc/soc_caps.h @@ -85,7 +85,7 @@ #define SOC_SPI_FLASH_SUPPORTED 1 // TODO: [ESP32C5] IDF-8715 #define SOC_ECDSA_SUPPORTED 1 #define SOC_RNG_SUPPORTED 1 -#define SOC_KEY_MANAGER_SUPPORTED 1 +#define SOC_KEY_MANAGER_SUPPORTED 0 #define SOC_HUK_SUPPORTED 1 #define SOC_MODEM_CLOCK_SUPPORTED 1 #define SOC_LIGHT_SLEEP_SUPPORTED 1 diff --git a/components/soc/esp32p4/include/soc/Kconfig.soc_caps.in b/components/soc/esp32p4/include/soc/Kconfig.soc_caps.in index 9229f10dd75..7a4d03bb422 100644 --- a/components/soc/esp32p4/include/soc/Kconfig.soc_caps.in +++ b/components/soc/esp32p4/include/soc/Kconfig.soc_caps.in @@ -217,7 +217,7 @@ config SOC_ECDSA_SUPPORTED config SOC_KEY_MANAGER_SUPPORTED bool - default y + default n config SOC_HUK_SUPPORTED bool diff --git a/components/soc/esp32p4/include/soc/soc_caps.h b/components/soc/esp32p4/include/soc/soc_caps.h index 8c236201355..910d571760f 100644 --- a/components/soc/esp32p4/include/soc/soc_caps.h +++ b/components/soc/esp32p4/include/soc/soc_caps.h @@ -76,7 +76,7 @@ #define SOC_ECC_SUPPORTED 1 #define SOC_ECC_EXTENDED_MODES_SUPPORTED 1 #define SOC_ECDSA_SUPPORTED 1 -#define SOC_KEY_MANAGER_SUPPORTED 1 +#define SOC_KEY_MANAGER_SUPPORTED 0 #define SOC_HUK_SUPPORTED 1 #define SOC_FLASH_ENC_SUPPORTED 1 #define SOC_SECURE_BOOT_SUPPORTED 1 diff --git a/examples/security/flash_encryption/README.md b/examples/security/flash_encryption/README.md index 533028dc66e..d1864a6754b 100644 --- a/examples/security/flash_encryption/README.md +++ b/examples/security/flash_encryption/README.md @@ -71,7 +71,7 @@ FATFS encryption example uses two additional partitions in the partition table. > **Note:** This feature is only available on targets with the Key Manager peripheral: **ESP32-C5** and **ESP32-P4**. -On supported targets, the Flash Encryption key can be deployed into and managed by the [Key Manager](https://docs.espressif.com/projects/esp-idf/en/latest/esp32c5/api-reference/peripherals/key_manager.html) peripheral instead of an eFuse block. This means the plaintext key material is never stored in eFuses, RAM, or flash - it is bound to the device's Hardware Unique Key (HUK) and accessible only to hardware peripherals. +On supported targets, the Flash Encryption key can be deployed into and managed by the [Key Manager](../../../docs/en/api-reference/peripherals/key_manager.rst) peripheral instead of an eFuse block. This means the plaintext key material is never stored in eFuses, RAM, or flash - it is bound to the device's Hardware Unique Key (HUK) and accessible only to hardware peripherals. For the full workflow (key deployment, eFuse programming, and boot sequence), refer to the [Flash Encryption documentation](https://docs.espressif.com/projects/esp-idf/en/latest/esp32c5/security/flash-encryption.html).