Mirrors/esp-idf
1
0
Fork 0
mirror of https://github.com/espressif/esp-idf.git synced 2026-10-02 03:00:34 +03:00
Code Issues Packages Projects Releases Wiki Activity

fix(esp_security): guard key manager APIs against unsupported chip revs

Browse Source 
On ESP32-P4 rev < 3.0, Key Manager is software-disabled, but the public
esp_key_mgr.h APIs had no runtime check.
Calls using HMAC/DS/PSRAM key types fell through to
HAL_ASSERT("Unsupported ...") paths in key_mgr_ll.h. Gate
each public API with key_mgr_ll_is_supported() and return
ESP_ERR_NOT_SUPPORTED cleanly instead.
This commit is contained in:
harshal.patil
2026-04-27 15:18:34 +05:30
parent 41e67e1efb
commit 8bfc4f7255
6 changed files with 72 additions and 5 deletions
Download Patch File Download Diff File Expand all files Collapse all files
components/esp_security/test_apps/crypto_drivers/main/test_key_mgr.c
+28 -1
View File
@@ -1,5 +1,5 @@
/*
* SPDX-FileCopyrightText: 2024-2025 Espressif Systems (Shanghai) CO LTD
* SPDX-FileCopyrightText: 2024-2026 Espressif Systems (Shanghai) CO LTD
*
* SPDX-License-Identifier: Unlicense OR CC0-1.0
*/
@@ -61,6 +61,13 @@ static const uint8_t k1_ds_encrypt[] = {
static const char *TAG = "key_mgr_test";
#define SKIP_IF_KEY_MGR_NOT_SUPPORTED() \
do { \
if (!key_mgr_ll_is_supported()) { \
TEST_IGNORE_MESSAGE("Key Manager not supported on this chip"); \
} \
} while (0)
#define ENCRYPTED_DATA_SIZE 128
static const uint8_t plaintext_data[ENCRYPTED_DATA_SIZE] = {
0x01, 0x02, 0x03, 0x04, 0x05, 0x06, 0x07, 0x08, 0x09, 0x0a, 0x0b, 0x0c, 0x0d, 0x0e, 0x0f, 0x10,
@@ -147,6 +154,8 @@ static esp_err_t test_xts_aes_key(bool verify)
TEST_CASE("Key Manager AES mode: XTS-AES-128 key deployment", "[hw_crypto] [key_mgr]")
{
SKIP_IF_KEY_MGR_NOT_SUPPORTED();
esp_key_mgr_aes_key_config_t *key_config = calloc(1, sizeof(esp_key_mgr_aes_key_config_t));
TEST_ASSERT_NOT_NULL(key_config);
@@ -171,6 +180,8 @@ TEST_CASE("Key Manager AES mode: XTS-AES-128 key deployment", "[hw_crypto] [key_
TEST_CASE("Key Manager ECDH0 mode: XTS-AES-128 key deployment", "[hw_crypto] [key_mgr]")
{
SKIP_IF_KEY_MGR_NOT_SUPPORTED();
esp_key_mgr_ecdh0_key_config_t *key_config = calloc(1, sizeof(esp_key_mgr_ecdh0_key_config_t));
TEST_ASSERT_NOT_NULL(key_config);
@@ -196,6 +207,8 @@ TEST_CASE("Key Manager ECDH0 mode: XTS-AES-128 key deployment", "[hw_crypto] [ke
TEST_CASE("Key Manager Random mode: XTS-AES-128 key deployment", "[hw_crypto] [key_mgr]")
{
SKIP_IF_KEY_MGR_NOT_SUPPORTED();
esp_key_mgr_random_key_config_t *key_config = calloc(1, sizeof(esp_key_mgr_random_key_config_t));
TEST_ASSERT_NOT_NULL(key_config);
@@ -218,6 +231,8 @@ TEST_CASE("Key Manager Random mode: XTS-AES-128 key deployment", "[hw_crypto] [k
#if SOC_KEY_MANAGER_ECDSA_KEY_DEPLOY
TEST_CASE("Key Manager random mode: ECDSA key deployment", "[hw_crypto] [key_mgr]")
{
SKIP_IF_KEY_MGR_NOT_SUPPORTED();
esp_key_mgr_random_key_config_t *key_config = calloc(1, sizeof(esp_key_mgr_random_key_config_t));
TEST_ASSERT_NOT_NULL(key_config);
@@ -249,6 +264,8 @@ static esp_err_t test_hmac_key(bool verify)
TEST_CASE("Key Manager AES mode: HMAC key deployment", "[hw_crypto] [key_mgr]")
{
SKIP_IF_KEY_MGR_NOT_SUPPORTED();
esp_key_mgr_aes_key_config_t *key_config = calloc(1, sizeof(esp_key_mgr_aes_key_config_t));
TEST_ASSERT_NOT_NULL(key_config);
@@ -272,6 +289,8 @@ TEST_CASE("Key Manager AES mode: HMAC key deployment", "[hw_crypto] [key_mgr]")
TEST_CASE("Key Manager ECDH0 mode: HMAC key deployment", "[hw_crypto] [key_mgr]")
{
SKIP_IF_KEY_MGR_NOT_SUPPORTED();
esp_key_mgr_ecdh0_key_config_t *key_config = calloc(1, sizeof(esp_key_mgr_ecdh0_key_config_t));
TEST_ASSERT_NOT_NULL(key_config);
@@ -296,6 +315,8 @@ TEST_CASE("Key Manager ECDH0 mode: HMAC key deployment", "[hw_crypto] [key_mgr]"
TEST_CASE("Key Manager random mode: HMAC key deployment", "[hw_crypto] [key_mgr]")
{
SKIP_IF_KEY_MGR_NOT_SUPPORTED();
esp_key_mgr_random_key_config_t *key_config = calloc(1, sizeof(esp_key_mgr_random_key_config_t));
TEST_ASSERT_NOT_NULL(key_config);
@@ -344,6 +365,8 @@ static esp_err_t test_ds_key(void)
TEST_CASE("Key Manager AES mode: DS key deployment", "[hw_crypto] [key_mgr]")
{
SKIP_IF_KEY_MGR_NOT_SUPPORTED();
esp_key_mgr_aes_key_config_t *key_config = calloc(1, sizeof(esp_key_mgr_aes_key_config_t));
TEST_ASSERT_NOT_NULL(key_config);
@@ -367,6 +390,8 @@ TEST_CASE("Key Manager AES mode: DS key deployment", "[hw_crypto] [key_mgr]")
TEST_CASE("Key Manager ECDH0 mode: DS key deployment", "[hw_crypto] [key_mgr]")
{
SKIP_IF_KEY_MGR_NOT_SUPPORTED();
esp_key_mgr_ecdh0_key_config_t *key_config = calloc(1, sizeof(esp_key_mgr_ecdh0_key_config_t));
TEST_ASSERT_NOT_NULL(key_config);
@@ -391,6 +416,8 @@ TEST_CASE("Key Manager ECDH0 mode: DS key deployment", "[hw_crypto] [key_mgr]")
TEST_CASE("Key Manager random mode: DS key deployment", "[hw_crypto] [key_mgr]")
{
SKIP_IF_KEY_MGR_NOT_SUPPORTED();
esp_key_mgr_random_key_config_t *key_config = calloc(1, sizeof(esp_key_mgr_random_key_config_t));
TEST_ASSERT_NOT_NULL(key_config);