Mirrors/esp-idf
1
0
Fork 0
mirror of https://github.com/espressif/esp-idf.git synced 2026-07-14 06:53:05 +03:00
Code Issues Packages Projects Releases Wiki Activity

Merge branch 'feat/generic_key_mgr_key_types_v5.5' into 'release/v5.5'

Browse Source 
Store key_len field in the key_config (v5.5)

See merge request espressif/esp-idf!48145
This commit is contained in:
Aditya Patwardhan
2026-05-28 10:42:25 +05:30
parent 36d2235696 fcb5e51c6d
commit 9234e95e20
19 changed files with 521 additions and 462 deletions
Download Patch File Download Diff File Expand all files Collapse all files

1
components/bootloader/subproject/main/ld/esp32c5/bootloader.ld
View File

@@ -88,6 +88,7 @@ SECTIONS
*libhal.a:mmu_hal.*(.literal .text .literal.* .text.*)
*libhal.a:cache_hal.*(.literal .text .literal.* .text.*)
*libhal.a:efuse_hal.*(.literal .text .literal.* .text.*)
*libhal.a:key_mgr_hal.*(.literal.key_mgr_hal_set_key_usage .text.key_mgr_hal_set_key_usage)
*libesp_hw_support.a:rtc_clk.*(.literal .text .literal.* .text.*)
*libesp_hw_support.a:rtc_time.*(.literal .text .literal.* .text.*)
*libesp_hw_support.a:regi2c_ctrl.*(.literal .text .literal.* .text.*)

4
components/bootloader_support/src/esp32c5/flash_encryption_secure_features.c
View File

@@ -11,6 +11,7 @@
#include "esp_efuse.h"
#include "esp_efuse_table.h"
#include "esp_log.h"
#include "hal/key_mgr_hal.h"
#include "hal/key_mgr_ll.h"
#include "hal/mspi_ll.h"
#include "soc/soc_caps.h"
@@ -79,8 +80,7 @@ esp_err_t esp_flash_encryption_enable_key_mgr(void)
};
// Force Key Manager to use eFuse key for XTS-AES operation
key_mgr_ll_set_key_usage(ESP_KEY_MGR_XTS_AES_128_KEY, ESP_KEY_MGR_USE_EFUSE_KEY);
_mspi_timing_ll_reset_mspi();
key_mgr_hal_set_key_usage(ESP_KEY_MGR_FLASH_XTS_AES_KEY, ESP_KEY_MGR_USE_EFUSE_KEY);
return ESP_OK;
}

4
components/bootloader_support/src/esp32p4/flash_encryption_secure_features.c
View File

@@ -11,6 +11,7 @@
#include "esp_efuse_table.h"
#include "esp_log.h"
#include "sdkconfig.h"
#include "hal/key_mgr_hal.h"
#include "hal/key_mgr_ll.h"
#include "hal/mspi_ll.h"
@@ -61,8 +62,7 @@ esp_err_t esp_flash_encryption_enable_key_mgr(void)
};
// Force Key Manager to use eFuse key for XTS-AES operation
key_mgr_ll_set_key_usage(ESP_KEY_MGR_XTS_AES_128_KEY, ESP_KEY_MGR_USE_EFUSE_KEY);
_mspi_timing_ll_reset_mspi();
key_mgr_hal_set_key_usage(ESP_KEY_MGR_FLASH_XTS_AES_KEY, ESP_KEY_MGR_USE_EFUSE_KEY);
return ESP_OK;
}

1
components/esp_hw_support/include/esp_ds.h
View File

@@ -27,6 +27,7 @@ extern "C" {
#define ESP_DS_SIGNATURE_M_PRIME_BIT_LEN 32
#define ESP_DS_SIGNATURE_L_BIT_LEN 32
#define ESP_DS_SIGNATURE_PADDING_BIT_LEN 64
#define ESP_DS_DATA_KEY_SIZE 32
/* Length of parameter 'C' stored in flash, in bytes
- Operands Y, M and r_bar; each equal to maximum RSA bit length

4
components/esp_security/include/esp_key_mgr.h
View File

@@ -33,6 +33,7 @@ extern "C" {
typedef struct {
esp_key_mgr_key_type_t key_type;
esp_key_mgr_key_len_t key_len;
bool use_pre_generated_huk_info;
bool use_pre_generated_sw_init_key;
WORD_ALIGNED_ATTR esp_key_mgr_huk_info_t huk_info;
@@ -43,6 +44,7 @@ typedef struct {
typedef struct {
esp_key_mgr_key_type_t key_type;
esp_key_mgr_key_len_t key_len;
bool use_pre_generated_huk_info;
WORD_ALIGNED_ATTR esp_key_mgr_huk_info_t huk_info;
WORD_ALIGNED_ATTR uint8_t k1_G[2][KEY_MGR_ECDH0_INFO_SIZE];
@@ -50,12 +52,14 @@ typedef struct {
typedef struct {
esp_key_mgr_key_type_t key_type;
esp_key_mgr_key_len_t key_len;
bool use_pre_generated_huk_info;
WORD_ALIGNED_ATTR esp_key_mgr_huk_info_t huk_info;
} esp_key_mgr_random_key_config_t;
typedef struct {
esp_key_mgr_key_type_t key_type;
esp_key_mgr_key_len_t key_len;
WORD_ALIGNED_ATTR uint8_t k2_G[2][KEY_MGR_ECDH0_INFO_SIZE];
} esp_key_mgr_ecdh0_info_t;

441
components/esp_security/src/esp_key_mgr.c
View File

@@ -39,13 +39,10 @@ ESP_STATIC_ASSERT(sizeof(esp_key_mgr_huk_info_t) == sizeof(struct huk_info), "Si
static void esp_key_mgr_acquire_key_lock(esp_key_mgr_key_type_t key_type)
{
switch (key_type) {
case ESP_KEY_MGR_ECDSA_192_KEY:
case ESP_KEY_MGR_ECDSA_256_KEY:
case ESP_KEY_MGR_ECDSA_384_KEY:
case ESP_KEY_MGR_ECDSA_KEY:
_lock_acquire(&s_key_mgr_ecdsa_key_lock);
break;
case ESP_KEY_MGR_XTS_AES_128_KEY:
case ESP_KEY_MGR_XTS_AES_256_KEY:
case ESP_KEY_MGR_FLASH_XTS_AES_KEY:
_lock_acquire(&s_key_mgr_xts_aes_key_lock);
break;
case ESP_KEY_MGR_HMAC_KEY:
@@ -54,8 +51,7 @@ static void esp_key_mgr_acquire_key_lock(esp_key_mgr_key_type_t key_type)
case ESP_KEY_MGR_DS_KEY:
_lock_acquire(&s_key_mgr_ds_key_lock);
break;
case ESP_KEY_MGR_PSRAM_128_KEY:
case ESP_KEY_MGR_PSRAM_256_KEY:
case ESP_KEY_MGR_PSRAM_XTS_AES_KEY:
_lock_acquire(&s_key_mgr_psram_key_lock);
break;
default:
@@ -68,13 +64,10 @@ static void esp_key_mgr_acquire_key_lock(esp_key_mgr_key_type_t key_type)
static void esp_key_mgr_release_key_lock(esp_key_mgr_key_type_t key_type)
{
switch (key_type) {
case ESP_KEY_MGR_ECDSA_192_KEY:
case ESP_KEY_MGR_ECDSA_256_KEY:
case ESP_KEY_MGR_ECDSA_384_KEY:
case ESP_KEY_MGR_ECDSA_KEY:
_lock_release(&s_key_mgr_ecdsa_key_lock);
break;
case ESP_KEY_MGR_XTS_AES_128_KEY:
case ESP_KEY_MGR_XTS_AES_256_KEY:
case ESP_KEY_MGR_FLASH_XTS_AES_KEY:
_lock_release(&s_key_mgr_xts_aes_key_lock);
break;
case ESP_KEY_MGR_HMAC_KEY:
@@ -83,8 +76,7 @@ static void esp_key_mgr_release_key_lock(esp_key_mgr_key_type_t key_type)
case ESP_KEY_MGR_DS_KEY:
_lock_release(&s_key_mgr_ds_key_lock);
break;
case ESP_KEY_MGR_PSRAM_128_KEY:
case ESP_KEY_MGR_PSRAM_256_KEY:
case ESP_KEY_MGR_PSRAM_XTS_AES_KEY:
_lock_release(&s_key_mgr_psram_key_lock);
break;
default:
@@ -127,21 +119,59 @@ static void esp_key_mgr_release_hardware(bool deployment_mode)
esp_crypto_key_mgr_enable_periph_clk(false);
}
static void key_mgr_wait_for_state(esp_key_mgr_state_t state)
static esp_key_mgr_key_purpose_t get_key_purpose(const esp_key_mgr_key_type_t key_type, const esp_key_mgr_key_len_t key_len)
{
switch (key_type) {
case ESP_KEY_MGR_ECDSA_KEY:
switch (key_len) {
case ESP_KEY_MGR_ECDSA_LEN_192:
return ESP_KEY_MGR_KEY_PURPOSE_ECDSA_192;
case ESP_KEY_MGR_ECDSA_LEN_256:
return ESP_KEY_MGR_KEY_PURPOSE_ECDSA_256;
case ESP_KEY_MGR_ECDSA_LEN_384:
// TODO: Verify: (IDF-14120)
return ESP_KEY_MGR_KEY_PURPOSE_ECDSA_384_H;
default:
return ESP_KEY_MGR_KEY_PURPOSE_INVALID;
}
case ESP_KEY_MGR_FLASH_XTS_AES_KEY:
switch (key_len) {
case ESP_KEY_MGR_XTS_AES_LEN_128:
return ESP_KEY_MGR_KEY_PURPOSE_FLASH_128;
case ESP_KEY_MGR_XTS_AES_LEN_256:
return ESP_KEY_MGR_KEY_PURPOSE_FLASH_256_1;
default:
return ESP_KEY_MGR_KEY_PURPOSE_INVALID;
}
case ESP_KEY_MGR_HMAC_KEY:
return ESP_KEY_MGR_KEY_PURPOSE_HMAC;
case ESP_KEY_MGR_DS_KEY:
return ESP_KEY_MGR_KEY_PURPOSE_DS;
case ESP_KEY_MGR_PSRAM_XTS_AES_KEY:
switch (key_len) {
case ESP_KEY_MGR_XTS_AES_LEN_128:
return ESP_KEY_MGR_KEY_PURPOSE_PSRAM_128;
case ESP_KEY_MGR_XTS_AES_LEN_256:
return ESP_KEY_MGR_KEY_PURPOSE_PSRAM_256_1;
default:
return ESP_KEY_MGR_KEY_PURPOSE_INVALID;
}
default:
return ESP_KEY_MGR_KEY_PURPOSE_INVALID;
}
}
void key_mgr_wait_for_state(esp_key_mgr_state_t state)
{
while (key_mgr_hal_get_state() != state) {
;
}
}
typedef struct aes_deploy {
esp_key_mgr_key_purpose_t key_purpose;
const uint8_t *k1_encrypted;
const esp_key_mgr_aes_key_config_t *key_config;
esp_key_mgr_key_recovery_info_t *key_info;
bool huk_deployed;
} aes_deploy_config_t;
static void check_huk_risk_level(void)
{
uint8_t huk_risk_level = huk_hal_get_risk_level();
@@ -213,6 +243,8 @@ static esp_err_t deploy_huk(huk_deploy_config_t *config)
return ESP_ERR_NO_MEM;
}
if (config->use_pre_generated_huk_info) {
ESP_LOGD(TAG, "Using pre-generated HUK info");
// If HUK info is provided then recover the HUK from given info
check_huk_risk_level();
@@ -256,44 +288,56 @@ static esp_err_t deploy_huk(huk_deploy_config_t *config)
return ESP_OK;
}
typedef struct aes_deploy {
esp_key_mgr_key_purpose_t key_purpose;
const uint8_t *k1_encrypted;
const esp_key_mgr_aes_key_config_t *key_config;
esp_key_mgr_key_recovery_info_t *key_info;
bool huk_deployed;
} aes_deploy_config_t;
static esp_err_t key_mgr_deploy_key_aes_mode(aes_deploy_config_t *config)
{
esp_err_t esp_ret = ESP_FAIL;
key_mgr_wait_for_state(ESP_KEY_MGR_STATE_IDLE);
if ((!key_mgr_hal_is_huk_valid()) || (!config->huk_deployed)) {
// For purpose ESP_KEY_MGR_KEY_PURPOSE_XTS_AES_256_2 or ESP_KEY_MGR_KEY_PURPOSE_PSRAM_256_2 this part shall be already executed
huk_deploy_config_t huk_deploy_config = {};
huk_deploy_config.use_pre_generated_huk_info = config->key_config->use_pre_generated_huk_info;
huk_deploy_config.pre_generated_huk_info = &config->key_config->huk_info;
huk_deploy_config.huk_recovery_info = &config->key_info->huk_info;
// For purpose ESP_KEY_MGR_KEY_PURPOSE_FLASH_256_2 or ESP_KEY_MGR_KEY_PURPOSE_PSRAM_256_2 this part shall be already executed
huk_deploy_config_t huk_deploy_config = {
.use_pre_generated_huk_info = config->key_config->use_pre_generated_huk_info,
.pre_generated_huk_info = &config->key_config->huk_info,
.huk_recovery_info = &config->key_info->huk_info,
};
esp_ret = deploy_huk(&huk_deploy_config);
if (esp_ret != ESP_OK) {
return esp_ret;
}
ESP_LOGD(TAG, "HUK deployed successfully");
}
// TODO: Could we use config->key_info->info directly instead of allocating a copy of it?
// Advantage: BOOTLOADER_BUILD would be able to use this function.
// Note: We can memset it to zeros in case of an error.
uint8_t *key_recovery_info = (uint8_t *) heap_caps_calloc(1, KEY_MGR_KEY_RECOVERY_INFO_SIZE, MALLOC_CAP_INTERNAL);
if (!key_recovery_info) {
return ESP_ERR_NO_MEM;
}
// STEP 1: Init Step
// Set mode
key_mgr_hal_set_key_generator_mode(ESP_KEY_MGR_KEYGEN_MODE_AES);
uint8_t *key_recovery_info = (uint8_t *) heap_caps_calloc(1, KEY_MGR_KEY_RECOVERY_INFO_SIZE, MALLOC_CAP_INTERNAL);
if (!key_recovery_info) {
return ESP_ERR_NO_MEM;
}
// Set key purpose
ESP_LOGD(TAG, "Key purpose = %d", config->key_purpose);
key_mgr_hal_set_key_purpose(config->key_purpose);
// Set key length for XTS-AES key
esp_key_mgr_key_type_t key_type = (esp_key_mgr_key_type_t) config->key_config->key_type;
esp_key_mgr_key_type_t key_type = config->key_config->key_type;
esp_key_mgr_key_len_t key_len = config->key_config->key_len;
if (key_type == ESP_KEY_MGR_XTS_AES_128_KEY || key_type == ESP_KEY_MGR_PSRAM_128_KEY) {
key_mgr_hal_set_xts_aes_key_len(key_type, ESP_KEY_MGR_XTS_AES_LEN_256);
} else if (key_type == ESP_KEY_MGR_XTS_AES_256_KEY || key_type == ESP_KEY_MGR_PSRAM_256_KEY) {
key_mgr_hal_set_xts_aes_key_len(key_type, ESP_KEY_MGR_XTS_AES_LEN_512);
if (key_type == ESP_KEY_MGR_FLASH_XTS_AES_KEY || key_type == ESP_KEY_MGR_PSRAM_XTS_AES_KEY) {
key_mgr_hal_set_xts_aes_key_len(key_type, key_len);
}
if (config->key_config->use_pre_generated_sw_init_key) {
@@ -315,7 +359,6 @@ static esp_err_t key_mgr_deploy_key_aes_mode(aes_deploy_config_t *config)
}
ESP_LOGD(TAG, "Writing Information into Key Manager Registers");
key_mgr_hal_write_assist_info(config->key_config->k2_info, KEY_MGR_K2_INFO_SIZE);
ESP_LOG_BUFFER_HEX_LEVEL("K2_INFO", config->key_config->k2_info, KEY_MGR_K2_INFO_SIZE, ESP_LOG_DEBUG);
@@ -330,14 +373,14 @@ static esp_err_t key_mgr_deploy_key_aes_mode(aes_deploy_config_t *config)
key_mgr_hal_read_public_info(key_recovery_info, KEY_MGR_KEY_RECOVERY_INFO_SIZE);
ESP_LOG_BUFFER_HEX_LEVEL("KEY_RECOVERY_INFO", key_recovery_info, KEY_MGR_KEY_RECOVERY_INFO_SIZE, ESP_LOG_DEBUG);
if (config->key_purpose != ESP_KEY_MGR_KEY_PURPOSE_XTS_AES_256_1 && config->key_purpose != ESP_KEY_MGR_KEY_PURPOSE_PSRAM_256_1) {
if (!key_mgr_hal_is_key_deployment_valid(config->key_config->key_type)) {
if (config->key_purpose != ESP_KEY_MGR_KEY_PURPOSE_FLASH_256_1 && config->key_purpose != ESP_KEY_MGR_KEY_PURPOSE_PSRAM_256_1) {
if (!key_mgr_hal_is_key_deployment_valid(key_type, key_len)) {
ESP_LOGE(TAG, "Key deployment is not valid");
heap_caps_free(key_recovery_info);
return ESP_FAIL;
}
ESP_LOGD(TAG, "Key deployment valid");
}
ESP_LOGD(TAG, "Key deployment valid");
// Wait till Key Manager deployment is complete
key_mgr_hal_continue();
@@ -353,7 +396,10 @@ static esp_err_t key_mgr_deploy_key_aes_mode(aes_deploy_config_t *config)
}
heap_caps_free(key_recovery_info);
config->key_info->key_type = config->key_config->key_type;
config->key_info->key_type = key_type;
config->key_info->key_len = key_len;
config->key_info->key_deployment_mode = ESP_KEY_MGR_KEYGEN_MODE_AES;
config->key_info->magic = KEY_HUK_SECTOR_MAGIC;
return ESP_OK;
@@ -371,38 +417,16 @@ esp_err_t esp_key_mgr_deploy_key_in_aes_mode(const esp_key_mgr_aes_key_config_t
ESP_LOGD(TAG, "Key deployment in AES mode");
aes_deploy_config_t aes_deploy_config = {};
aes_deploy_config.key_config = key_config;
aes_deploy_config.key_info = key_recovery_info;
aes_deploy_config.k1_encrypted = key_config->k1_encrypted[0];
// TODO: Would making this static help in saving static memory?
// if so, memset the structure to 0 before using it
aes_deploy_config_t aes_deploy_config = {
.key_config = key_config,
.key_info = key_recovery_info,
.k1_encrypted = key_config->k1_encrypted[0],
};
esp_key_mgr_key_type_t key_type = (esp_key_mgr_key_type_t) key_config->key_type;
switch (key_type) {
case ESP_KEY_MGR_ECDSA_192_KEY:
aes_deploy_config.key_purpose = ESP_KEY_MGR_KEY_PURPOSE_ECDSA_192;
break;
case ESP_KEY_MGR_ECDSA_256_KEY:
aes_deploy_config.key_purpose = ESP_KEY_MGR_KEY_PURPOSE_ECDSA_256;
break;
case ESP_KEY_MGR_XTS_AES_128_KEY:
aes_deploy_config.key_purpose = ESP_KEY_MGR_KEY_PURPOSE_XTS_AES_128;
break;
case ESP_KEY_MGR_XTS_AES_256_KEY:
aes_deploy_config.key_purpose = ESP_KEY_MGR_KEY_PURPOSE_XTS_AES_256_1;
break;
case ESP_KEY_MGR_HMAC_KEY:
aes_deploy_config.key_purpose = ESP_KEY_MGR_KEY_PURPOSE_HMAC;
break;
case ESP_KEY_MGR_DS_KEY:
aes_deploy_config.key_purpose = ESP_KEY_MGR_KEY_PURPOSE_DS;
break;
case ESP_KEY_MGR_PSRAM_128_KEY:
aes_deploy_config.key_purpose = ESP_KEY_MGR_KEY_PURPOSE_PSRAM_128;
break;
case ESP_KEY_MGR_PSRAM_256_KEY:
aes_deploy_config.key_purpose = ESP_KEY_MGR_KEY_PURPOSE_PSRAM_256_1;
break;
default:
aes_deploy_config.key_purpose = get_key_purpose(key_config->key_type, key_config->key_len);
if (aes_deploy_config.key_purpose == ESP_KEY_MGR_KEY_PURPOSE_INVALID) {
ESP_LOGE(TAG, "Invalid key type");
return ESP_ERR_INVALID_ARG;
}
@@ -417,8 +441,8 @@ esp_err_t esp_key_mgr_deploy_key_in_aes_mode(const esp_key_mgr_aes_key_config_t
aes_deploy_config.huk_deployed = true;
if (key_type == ESP_KEY_MGR_XTS_AES_256_KEY || key_type == ESP_KEY_MGR_PSRAM_256_KEY) {
aes_deploy_config.key_purpose = key_type == ESP_KEY_MGR_XTS_AES_256_KEY ? ESP_KEY_MGR_KEY_PURPOSE_XTS_AES_256_2 : ESP_KEY_MGR_KEY_PURPOSE_PSRAM_256_2;
if (aes_deploy_config.key_purpose == ESP_KEY_MGR_KEY_PURPOSE_FLASH_256_1 || aes_deploy_config.key_purpose == ESP_KEY_MGR_KEY_PURPOSE_PSRAM_256_1) {
aes_deploy_config.key_purpose = key_config->key_type == ESP_KEY_MGR_FLASH_XTS_AES_KEY ? ESP_KEY_MGR_KEY_PURPOSE_FLASH_256_2 : ESP_KEY_MGR_KEY_PURPOSE_PSRAM_256_2;
aes_deploy_config.k1_encrypted = key_config->k1_encrypted[1];
esp_ret = key_mgr_deploy_key_aes_mode(&aes_deploy_config);
if (esp_ret != ESP_OK) {
@@ -428,7 +452,7 @@ esp_err_t esp_key_mgr_deploy_key_in_aes_mode(const esp_key_mgr_aes_key_config_t
}
// Set the Key Manager Static Register to use own key for the respective key type
key_mgr_hal_set_key_usage(key_type, ESP_KEY_MGR_USE_OWN_KEY);
key_mgr_hal_set_key_usage(key_config->key_type, ESP_KEY_MGR_USE_OWN_KEY);
cleanup:
esp_key_mgr_release_hardware(true);
@@ -444,6 +468,7 @@ typedef struct key_recovery_config {
static esp_err_t key_mgr_recover_key(key_recovery_config_t *config)
{
key_mgr_wait_for_state(ESP_KEY_MGR_STATE_IDLE);
if (!check_huk_info_validity(&config->key_recovery_info->huk_info)) {
ESP_LOGE(TAG, "HUK info is not valid");
return ESP_ERR_INVALID_ARG;
@@ -465,12 +490,12 @@ static esp_err_t key_mgr_recover_key(key_recovery_config_t *config)
key_mgr_hal_set_key_generator_mode(ESP_KEY_MGR_KEYGEN_MODE_RECOVER);
// Set AES-XTS key len
esp_key_mgr_key_type_t key_type = (esp_key_mgr_key_type_t) config->key_recovery_info->key_type;
if (key_type == ESP_KEY_MGR_XTS_AES_128_KEY || key_type == ESP_KEY_MGR_PSRAM_128_KEY) {
key_mgr_hal_set_xts_aes_key_len(key_type, ESP_KEY_MGR_XTS_AES_LEN_256);
} else if (key_type == ESP_KEY_MGR_XTS_AES_256_KEY || key_type == ESP_KEY_MGR_PSRAM_256_KEY) {
key_mgr_hal_set_xts_aes_key_len(key_type, ESP_KEY_MGR_XTS_AES_LEN_512);
// Set XTS-AES key length
esp_key_mgr_key_type_t key_type = config->key_recovery_info->key_type;
esp_key_mgr_key_len_t key_len = config->key_recovery_info->key_len;
if (key_type == ESP_KEY_MGR_FLASH_XTS_AES_KEY || key_type == ESP_KEY_MGR_PSRAM_XTS_AES_KEY) {
key_mgr_hal_set_xts_aes_key_len(key_type, key_len);
}
key_mgr_hal_set_key_purpose(config->key_purpose);
@@ -479,7 +504,7 @@ static esp_err_t key_mgr_recover_key(key_recovery_config_t *config)
key_mgr_wait_for_state(ESP_KEY_MGR_STATE_LOAD);
if (config->key_purpose == ESP_KEY_MGR_KEY_PURPOSE_XTS_AES_256_2 || config->key_purpose == ESP_KEY_MGR_KEY_PURPOSE_PSRAM_256_2) {
if (config->key_purpose == ESP_KEY_MGR_KEY_PURPOSE_FLASH_256_2 || config->key_purpose == ESP_KEY_MGR_KEY_PURPOSE_PSRAM_256_2) {
if (!check_key_info_validity(&config->key_recovery_info->key_info[1])) {
ESP_LOGE(TAG, "Key info not valid");
return ESP_FAIL;
@@ -498,13 +523,14 @@ static esp_err_t key_mgr_recover_key(key_recovery_config_t *config)
key_mgr_hal_continue();
key_mgr_wait_for_state(ESP_KEY_MGR_STATE_GAIN);
if (config->key_purpose != ESP_KEY_MGR_KEY_PURPOSE_XTS_AES_256_1) {
if (!key_mgr_hal_is_key_deployment_valid(config->key_recovery_info->key_type)) {
// TODO: Maybe need to extend this to ECDSA_384_L and ECDSA_384_H (IDF-14120)
if (config->key_purpose != ESP_KEY_MGR_KEY_PURPOSE_FLASH_256_1 && config->key_purpose != ESP_KEY_MGR_KEY_PURPOSE_PSRAM_256_1) {
if (!key_mgr_hal_is_key_deployment_valid(key_type, key_len)) {
ESP_LOGD(TAG, "Key deployment is not valid");
return ESP_FAIL;
}
ESP_LOGD(TAG, "Key Recovery valid");
}
ESP_LOGD(TAG, "Key Recovery valid");
key_mgr_hal_continue();
key_mgr_wait_for_state(ESP_KEY_MGR_STATE_IDLE);
@@ -521,59 +547,40 @@ esp_err_t esp_key_mgr_activate_key(esp_key_mgr_key_recovery_info_t *key_recovery
return ESP_ERR_INVALID_ARG;
}
ESP_LOGD(TAG, "Activating key of type %d", key_recovery_info->key_type);
if (key_recovery_info->magic != KEY_HUK_SECTOR_MAGIC) {
ESP_LOGE(TAG, "Invalid key recovery info magic");
return ESP_ERR_INVALID_ARG;
}
esp_key_mgr_key_type_t key_type = (esp_key_mgr_key_type_t) key_recovery_info->key_type;
esp_key_mgr_key_purpose_t key_purpose;
esp_key_mgr_key_type_t key_type = key_recovery_info->key_type;
switch (key_type) {
case ESP_KEY_MGR_ECDSA_192_KEY:
key_purpose = ESP_KEY_MGR_KEY_PURPOSE_ECDSA_192;
break;
case ESP_KEY_MGR_ECDSA_256_KEY:
key_purpose = ESP_KEY_MGR_KEY_PURPOSE_ECDSA_256;
break;
case ESP_KEY_MGR_XTS_AES_128_KEY:
key_purpose = ESP_KEY_MGR_KEY_PURPOSE_XTS_AES_128;
break;
case ESP_KEY_MGR_XTS_AES_256_KEY:
key_purpose = ESP_KEY_MGR_KEY_PURPOSE_XTS_AES_256_1;
break;
case ESP_KEY_MGR_HMAC_KEY:
key_purpose = ESP_KEY_MGR_KEY_PURPOSE_HMAC;
break;
case ESP_KEY_MGR_DS_KEY:
key_purpose = ESP_KEY_MGR_KEY_PURPOSE_DS;
break;
case ESP_KEY_MGR_PSRAM_128_KEY:
key_purpose = ESP_KEY_MGR_KEY_PURPOSE_PSRAM_128;
break;
case ESP_KEY_MGR_PSRAM_256_KEY:
key_purpose = ESP_KEY_MGR_KEY_PURPOSE_PSRAM_256_1;
break;
default:
ESP_LOGD(TAG, "Activating key of type %d", key_type);
// TODO: Would making this static help in saving static memory?
// if so, memset the structure to 0 before using it
key_recovery_config_t key_recovery_config = {
.key_recovery_info = key_recovery_info,
};
key_recovery_config.key_purpose = get_key_purpose(key_type, key_recovery_info->key_len);
if (key_recovery_config.key_purpose == ESP_KEY_MGR_KEY_PURPOSE_INVALID) {
ESP_LOGE(TAG, "Invalid key type");
return ESP_ERR_INVALID_ARG;
}
esp_err_t esp_ret = ESP_FAIL;
esp_key_mgr_acquire_key_lock(key_type);
key_recovery_config_t key_recovery_config = {
.key_recovery_info = key_recovery_info,
.key_purpose = key_purpose,
};
esp_key_mgr_acquire_hardware(false);
esp_ret = key_mgr_recover_key(&key_recovery_config);
esp_err_t esp_ret = key_mgr_recover_key(&key_recovery_config);
if (esp_ret != ESP_OK) {
ESP_LOGE(TAG, "Failed to recover key");
esp_key_mgr_release_key_lock(key_type);
goto cleanup;
}
if (key_type == ESP_KEY_MGR_XTS_AES_256_KEY || key_type == ESP_KEY_MGR_PSRAM_256_KEY) {
key_recovery_config.key_purpose = key_type == ESP_KEY_MGR_XTS_AES_256_KEY ? ESP_KEY_MGR_KEY_PURPOSE_XTS_AES_256_2 : ESP_KEY_MGR_KEY_PURPOSE_PSRAM_256_2;
if (key_recovery_config.key_purpose == ESP_KEY_MGR_KEY_PURPOSE_FLASH_256_1 || key_recovery_config.key_purpose == ESP_KEY_MGR_KEY_PURPOSE_PSRAM_256_1) {
key_recovery_config.key_purpose = key_recovery_config.key_purpose == ESP_KEY_MGR_KEY_PURPOSE_FLASH_256_1 ? ESP_KEY_MGR_KEY_PURPOSE_FLASH_256_2 : ESP_KEY_MGR_KEY_PURPOSE_PSRAM_256_2;
esp_ret = key_mgr_recover_key(&key_recovery_config);
if (esp_ret != ESP_OK) {
ESP_LOGE(TAG, "Failed to recover key");
@@ -584,7 +591,6 @@ esp_err_t esp_key_mgr_activate_key(esp_key_mgr_key_recovery_info_t *key_recovery
// Set the Key Manager Static Register to use own key for the respective key type
key_mgr_hal_set_key_usage(key_type, ESP_KEY_MGR_USE_OWN_KEY);
esp_key_mgr_release_key_lock(key_type);
ESP_LOGD(TAG, "Key activation for type %d successful", key_type);
return ESP_OK;
@@ -618,15 +624,18 @@ static esp_err_t key_mgr_deploy_key_ecdh0_mode(ecdh0_deploy_config_t *config)
key_mgr_wait_for_state(ESP_KEY_MGR_STATE_IDLE);
if ((!key_mgr_hal_is_huk_valid()) || (!config->huk_deployed)) {
// For purpose ESP_KEY_MGR_KEY_PURPOSE_XTS_AES_256_2 or ESP_KEY_MGR_KEY_PURPOSE_PSRAM_256_2 this part shall be already executed
huk_deploy_config_t huk_deploy_config;
huk_deploy_config.use_pre_generated_huk_info = config->key_config->use_pre_generated_huk_info;
huk_deploy_config.pre_generated_huk_info = &config->key_config->huk_info;
huk_deploy_config.huk_recovery_info = &config->key_info->huk_info;
// For purpose ESP_KEY_MGR_KEY_PURPOSE_FLASH_256_2 or ESP_KEY_MGR_KEY_PURPOSE_PSRAM_256_2 this part shall be already executed
huk_deploy_config_t huk_deploy_config = {
.use_pre_generated_huk_info = config->key_config->use_pre_generated_huk_info,
.pre_generated_huk_info = &config->key_config->huk_info,
.huk_recovery_info = &config->key_info->huk_info,
};
esp_ret = deploy_huk(&huk_deploy_config);
if (esp_ret != ESP_OK) {
return esp_ret;
}
ESP_LOGD(TAG, "HUK deployed successfully");
}
@@ -639,17 +648,17 @@ static esp_err_t key_mgr_deploy_key_ecdh0_mode(ecdh0_deploy_config_t *config)
// Configure deployment mode to ECDH0
key_mgr_hal_set_key_generator_mode(ESP_KEY_MGR_KEYGEN_MODE_ECDH0);
// Set AES-XTS key len
esp_key_mgr_key_type_t key_type = (esp_key_mgr_key_type_t) config->key_config->key_type;
if (key_type == ESP_KEY_MGR_XTS_AES_128_KEY || key_type == ESP_KEY_MGR_PSRAM_128_KEY) {
key_mgr_hal_set_xts_aes_key_len(key_type, ESP_KEY_MGR_XTS_AES_LEN_256);
} else if (key_type == ESP_KEY_MGR_XTS_AES_256_KEY || key_type == ESP_KEY_MGR_PSRAM_256_KEY) {
key_mgr_hal_set_xts_aes_key_len(key_type, ESP_KEY_MGR_XTS_AES_LEN_512);
}
// Set key purpose
key_mgr_hal_set_key_purpose(config->key_purpose);
// Set XTS-AES key length
esp_key_mgr_key_type_t key_type = config->key_config->key_type;
esp_key_mgr_key_len_t key_len = config->key_config->key_len;
if (key_type == ESP_KEY_MGR_FLASH_XTS_AES_KEY || key_type == ESP_KEY_MGR_PSRAM_XTS_AES_KEY) {
key_mgr_hal_set_xts_aes_key_len(key_type, key_len);
}
key_mgr_hal_start();
// Step 2: Load phase
@@ -665,18 +674,16 @@ static esp_err_t key_mgr_deploy_key_ecdh0_mode(ecdh0_deploy_config_t *config)
key_mgr_hal_read_public_info(key_recovery_info, KEY_MGR_KEY_RECOVERY_INFO_SIZE);
key_mgr_hal_read_assist_info(config->ecdh0_key_info);
ESP_LOG_BUFFER_HEX_LEVEL("KEY_MGR KEY INFO", key_recovery_info, KEY_MGR_KEY_RECOVERY_INFO_SIZE, ESP_LOG_DEBUG);
ESP_LOG_BUFFER_HEX_LEVEL("KEY_RECOVERY_INFO", key_recovery_info, KEY_MGR_KEY_RECOVERY_INFO_SIZE, ESP_LOG_DEBUG);
ESP_LOGD(TAG, "HUK deployed is valid");
if (config->key_purpose != ESP_KEY_MGR_KEY_PURPOSE_XTS_AES_256_1 && config->key_purpose != ESP_KEY_MGR_KEY_PURPOSE_PSRAM_256_1) {
if (!key_mgr_hal_is_key_deployment_valid(config->key_config->key_type)) {
if (config->key_purpose != ESP_KEY_MGR_KEY_PURPOSE_FLASH_256_1 && config->key_purpose != ESP_KEY_MGR_KEY_PURPOSE_PSRAM_256_1) {
if (!key_mgr_hal_is_key_deployment_valid(key_type, key_len)) {
ESP_LOGE(TAG, "Key deployment is not valid");
heap_caps_free(key_recovery_info);
return ESP_FAIL;
}
ESP_LOGD(TAG, "Key deployment valid");
}
ESP_LOGD(TAG, "Key deployment valid");
// Wait till Key Manager deployment is complete
key_mgr_hal_continue();
@@ -690,10 +697,13 @@ static esp_err_t key_mgr_deploy_key_ecdh0_mode(ecdh0_deploy_config_t *config)
config->key_info->key_info[0].crc = esp_rom_crc32_le(0, key_recovery_info, KEY_MGR_KEY_RECOVERY_INFO_SIZE);
}
config->key_info->key_type = config->key_config->key_type;
heap_caps_free(key_recovery_info);
config->key_info->key_type = key_type;
config->key_info->key_len = key_len;
config->key_info->key_deployment_mode = ESP_KEY_MGR_KEYGEN_MODE_ECDH0;
config->key_info->magic = KEY_HUK_SECTOR_MAGIC;
heap_caps_free(key_recovery_info);
return ESP_OK;
}
@@ -710,48 +720,19 @@ esp_err_t esp_key_mgr_deploy_key_in_ecdh0_mode(const esp_key_mgr_ecdh0_key_confi
ESP_LOGD(TAG, "Key Deployment in ECDH0 mode");
esp_key_mgr_key_type_t key_type = (esp_key_mgr_key_type_t) key_config->key_type;
esp_key_mgr_key_type_t key_type = key_config->key_type;
// TODO: Would making this static help in saving static memory?
// if so, memset the structure to 0 before using it
ecdh0_deploy_config_t ecdh0_deploy_config = {
.key_config = key_config,
.key_info = key_info,
.k1_G = key_config->k1_G[0],
.ecdh0_key_info = ecdh0_key_info->k2_G[0],
};
switch (key_type) {
case ESP_KEY_MGR_ECDSA_192_KEY:
ecdh0_deploy_config.key_purpose = ESP_KEY_MGR_KEY_PURPOSE_ECDSA_192;
ecdh0_deploy_config.ecdh0_key_info = ecdh0_key_info->k2_G[0];
break;
case ESP_KEY_MGR_ECDSA_256_KEY:
ecdh0_deploy_config.key_purpose = ESP_KEY_MGR_KEY_PURPOSE_ECDSA_256;
ecdh0_deploy_config.ecdh0_key_info = ecdh0_key_info->k2_G[0];
break;
case ESP_KEY_MGR_XTS_AES_128_KEY:
ecdh0_deploy_config.key_purpose = ESP_KEY_MGR_KEY_PURPOSE_XTS_AES_128;
ecdh0_deploy_config.ecdh0_key_info = ecdh0_key_info->k2_G[0];
break;
case ESP_KEY_MGR_XTS_AES_256_KEY:
ecdh0_deploy_config.key_purpose = ESP_KEY_MGR_KEY_PURPOSE_XTS_AES_256_1;
ecdh0_deploy_config.ecdh0_key_info = ecdh0_key_info->k2_G[0];
break;
case ESP_KEY_MGR_HMAC_KEY:
ecdh0_deploy_config.key_purpose = ESP_KEY_MGR_KEY_PURPOSE_HMAC;
ecdh0_deploy_config.ecdh0_key_info = ecdh0_key_info->k2_G[0];
break;
case ESP_KEY_MGR_DS_KEY:
ecdh0_deploy_config.key_purpose = ESP_KEY_MGR_KEY_PURPOSE_DS;
ecdh0_deploy_config.ecdh0_key_info = ecdh0_key_info->k2_G[0];
break;
case ESP_KEY_MGR_PSRAM_128_KEY:
ecdh0_deploy_config.key_purpose = ESP_KEY_MGR_KEY_PURPOSE_PSRAM_128;
ecdh0_deploy_config.ecdh0_key_info = ecdh0_key_info->k2_G[0];
break;
case ESP_KEY_MGR_PSRAM_256_KEY:
ecdh0_deploy_config.key_purpose = ESP_KEY_MGR_KEY_PURPOSE_PSRAM_256_1;
ecdh0_deploy_config.ecdh0_key_info = ecdh0_key_info->k2_G[0];
break;
default:
ecdh0_deploy_config.key_purpose = get_key_purpose(key_type, key_config->key_len);
if (ecdh0_deploy_config.key_purpose == ESP_KEY_MGR_KEY_PURPOSE_INVALID) {
ESP_LOGE(TAG, "Invalid key type");
return ESP_ERR_INVALID_ARG;
}
@@ -760,26 +741,29 @@ esp_err_t esp_key_mgr_deploy_key_in_ecdh0_mode(const esp_key_mgr_ecdh0_key_confi
esp_err_t esp_ret = key_mgr_deploy_key_ecdh0_mode(&ecdh0_deploy_config);
if (esp_ret != ESP_OK) {
ESP_LOGE(TAG, "Failed to deploy key in ECDH0 mode");
ESP_LOGE(TAG, "Key deployment in ECDH0 mode failed");
goto cleanup;
}
ecdh0_deploy_config.huk_deployed = true;
if (key_type == ESP_KEY_MGR_XTS_AES_256_KEY || key_type == ESP_KEY_MGR_PSRAM_256_KEY) {
ecdh0_deploy_config.key_purpose = key_type == ESP_KEY_MGR_XTS_AES_256_KEY ? ESP_KEY_MGR_KEY_PURPOSE_XTS_AES_256_2 : ESP_KEY_MGR_KEY_PURPOSE_PSRAM_256_2;
if (ecdh0_deploy_config.key_purpose == ESP_KEY_MGR_KEY_PURPOSE_FLASH_256_1 || ecdh0_deploy_config.key_purpose == ESP_KEY_MGR_KEY_PURPOSE_PSRAM_256_1) {
ecdh0_deploy_config.key_purpose = key_type == ESP_KEY_MGR_FLASH_XTS_AES_KEY ? ESP_KEY_MGR_KEY_PURPOSE_FLASH_256_2 : ESP_KEY_MGR_KEY_PURPOSE_PSRAM_256_2;
ecdh0_deploy_config.k1_G = key_config->k1_G[1];
ecdh0_deploy_config.ecdh0_key_info = ecdh0_key_info->k2_G[1];
esp_ret = key_mgr_deploy_key_ecdh0_mode(&ecdh0_deploy_config);
if (esp_ret != ESP_OK) {
ESP_LOGE(TAG, "Failed to deploy key in ECDH0 mode");
ESP_LOGE(TAG, "Key deployment in ECDH0 mode failed");
goto cleanup;
}
}
// Set the Key Manager Static Register to use own key for the respective key type
key_mgr_hal_set_key_usage(key_type, ESP_KEY_MGR_USE_OWN_KEY);
cleanup:
esp_key_mgr_release_hardware(true);
return ESP_OK;
return esp_ret;
}
typedef struct random_deploy {
@@ -795,7 +779,7 @@ static esp_err_t key_mgr_deploy_key_random_mode(random_deploy_config_t *config)
key_mgr_wait_for_state(ESP_KEY_MGR_STATE_IDLE);
if ((!key_mgr_hal_is_huk_valid()) || (!config->huk_deployed)) {
// For purpose ESP_KEY_MGR_KEY_PURPOSE_XTS_AES_256_2 or ESP_KEY_MGR_KEY_PURPOSE_PSRAM_256_2 this part shall be already executed
// For purpose ESP_KEY_MGR_KEY_PURPOSE_FLASH_256_2 or ESP_KEY_MGR_KEY_PURPOSE_PSRAM_256_2 this part shall be already executed
huk_deploy_config_t huk_deploy_config = {
.use_pre_generated_huk_info = config->key_config->use_pre_generated_huk_info,
.pre_generated_huk_info = &config->key_config->huk_info,
@@ -809,25 +793,25 @@ static esp_err_t key_mgr_deploy_key_random_mode(random_deploy_config_t *config)
ESP_LOGD(TAG, "HUK deployed successfully");
}
// Configure deployment mode to RANDOM
key_mgr_hal_set_key_generator_mode(ESP_KEY_MGR_KEYGEN_MODE_RANDOM);
// Set AES-XTS key len
esp_key_mgr_key_type_t key_type = (esp_key_mgr_key_type_t) config->key_config->key_type;
if (key_type == ESP_KEY_MGR_XTS_AES_128_KEY || key_type == ESP_KEY_MGR_PSRAM_128_KEY) {
key_mgr_hal_set_xts_aes_key_len(key_type, ESP_KEY_MGR_XTS_AES_LEN_256);
} else if (key_type == ESP_KEY_MGR_XTS_AES_256_KEY || key_type == ESP_KEY_MGR_PSRAM_256_KEY) {
key_mgr_hal_set_xts_aes_key_len(key_type, ESP_KEY_MGR_XTS_AES_LEN_512);
}
uint8_t *key_recovery_info = (uint8_t *) heap_caps_calloc(1, KEY_MGR_KEY_RECOVERY_INFO_SIZE, MALLOC_CAP_INTERNAL);
if (!key_recovery_info) {
return ESP_ERR_NO_MEM;
}
// Set key purpose (XTS/ECDSA)
// Configure deployment mode to RANDOM
key_mgr_hal_set_key_generator_mode(ESP_KEY_MGR_KEYGEN_MODE_RANDOM);
// Set key purpose
key_mgr_hal_set_key_purpose(config->key_purpose);
// Set XTS-AES key length
esp_key_mgr_key_type_t key_type = config->key_config->key_type;
esp_key_mgr_key_len_t key_len = config->key_config->key_len;
if (key_type == ESP_KEY_MGR_FLASH_XTS_AES_KEY || key_type == ESP_KEY_MGR_PSRAM_XTS_AES_KEY) {
key_mgr_hal_set_xts_aes_key_len(key_type, key_len);
}
key_mgr_hal_start();
key_mgr_wait_for_state(ESP_KEY_MGR_STATE_LOAD);
@@ -837,16 +821,16 @@ static esp_err_t key_mgr_deploy_key_random_mode(random_deploy_config_t *config)
// No configuration for Random deploy mode
key_mgr_wait_for_state(ESP_KEY_MGR_STATE_GAIN);
key_mgr_hal_read_public_info(key_recovery_info, KEY_MGR_KEY_RECOVERY_INFO_SIZE);
ESP_LOG_BUFFER_HEX_LEVEL("KEY_MGR KEY INFO", key_recovery_info, KEY_MGR_KEY_RECOVERY_INFO_SIZE, ESP_LOG_DEBUG);
ESP_LOG_BUFFER_HEX_LEVEL("KEY_RECOVERY_INFO", key_recovery_info, KEY_MGR_KEY_RECOVERY_INFO_SIZE, ESP_LOG_DEBUG);
if (config->key_purpose != ESP_KEY_MGR_KEY_PURPOSE_XTS_AES_256_1 && config->key_purpose != ESP_KEY_MGR_KEY_PURPOSE_PSRAM_256_1) {
if (!key_mgr_hal_is_key_deployment_valid(config->key_config->key_type)) {
if (config->key_purpose != ESP_KEY_MGR_KEY_PURPOSE_FLASH_256_1 && config->key_purpose != ESP_KEY_MGR_KEY_PURPOSE_PSRAM_256_1) {
if (!key_mgr_hal_is_key_deployment_valid(key_type, key_len)) {
ESP_LOGE(TAG, "Key deployment is not valid");
heap_caps_free(key_recovery_info);
return ESP_FAIL;
}
ESP_LOGD(TAG, "Key deployment valid");
}
ESP_LOGD(TAG, "Key deployment valid");
// Wait till Key Manager deployment is complete
key_mgr_hal_continue();
@@ -862,8 +846,11 @@ static esp_err_t key_mgr_deploy_key_random_mode(random_deploy_config_t *config)
heap_caps_free(key_recovery_info);
config->key_info->key_type = config->key_config->key_type;
config->key_info->key_type = key_type;
config->key_info->key_len = key_len;
config->key_info->key_deployment_mode = ESP_KEY_MGR_KEYGEN_MODE_RANDOM;
config->key_info->magic = KEY_HUK_SECTOR_MAGIC;
return ESP_OK;
}
@@ -879,39 +866,15 @@ esp_err_t esp_key_mgr_deploy_key_in_random_mode(const esp_key_mgr_random_key_con
ESP_LOGD(TAG, "Key deployment in Random mode");
// TODO: Would making this static help in saving static memory?
// if so, memset the structure to 0 before using it
random_deploy_config_t random_deploy_config = {
.key_config = key_config,
.key_info = key_recovery_info,
};
esp_key_mgr_key_type_t key_type = (esp_key_mgr_key_type_t) key_config->key_type;
switch (key_type) {
case ESP_KEY_MGR_ECDSA_192_KEY:
random_deploy_config.key_purpose = ESP_KEY_MGR_KEY_PURPOSE_ECDSA_192;
break;
case ESP_KEY_MGR_ECDSA_256_KEY:
random_deploy_config.key_purpose = ESP_KEY_MGR_KEY_PURPOSE_ECDSA_256;
break;
case ESP_KEY_MGR_XTS_AES_128_KEY:
random_deploy_config.key_purpose = ESP_KEY_MGR_KEY_PURPOSE_XTS_AES_128;
break;
case ESP_KEY_MGR_XTS_AES_256_KEY:
random_deploy_config.key_purpose = ESP_KEY_MGR_KEY_PURPOSE_XTS_AES_256_1;
break;
case ESP_KEY_MGR_HMAC_KEY:
random_deploy_config.key_purpose = ESP_KEY_MGR_KEY_PURPOSE_HMAC;
break;
case ESP_KEY_MGR_DS_KEY:
random_deploy_config.key_purpose = ESP_KEY_MGR_KEY_PURPOSE_DS;
break;
case ESP_KEY_MGR_PSRAM_128_KEY:
random_deploy_config.key_purpose = ESP_KEY_MGR_KEY_PURPOSE_PSRAM_128;
break;
case ESP_KEY_MGR_PSRAM_256_KEY:
random_deploy_config.key_purpose = ESP_KEY_MGR_KEY_PURPOSE_PSRAM_256_1;
break;
default:
random_deploy_config.key_purpose = get_key_purpose(key_config->key_type, key_config->key_len);
if (random_deploy_config.key_purpose == ESP_KEY_MGR_KEY_PURPOSE_INVALID) {
ESP_LOGE(TAG, "Invalid key type");
return ESP_ERR_INVALID_ARG;
}
@@ -921,25 +884,25 @@ esp_err_t esp_key_mgr_deploy_key_in_random_mode(const esp_key_mgr_random_key_con
esp_err_t esp_ret = key_mgr_deploy_key_random_mode(&random_deploy_config);
if (esp_ret != ESP_OK) {
ESP_LOGE(TAG, "Key deployment in Random mode failed");
return ESP_FAIL;
goto cleanup;
}
random_deploy_config.huk_deployed = true;
if (key_type == ESP_KEY_MGR_XTS_AES_256_KEY || key_type == ESP_KEY_MGR_PSRAM_256_KEY) {
random_deploy_config.key_purpose = key_type == ESP_KEY_MGR_XTS_AES_256_KEY ? ESP_KEY_MGR_KEY_PURPOSE_XTS_AES_256_2 : ESP_KEY_MGR_KEY_PURPOSE_PSRAM_256_2;
if (random_deploy_config.key_purpose == ESP_KEY_MGR_KEY_PURPOSE_FLASH_256_1 || random_deploy_config.key_purpose == ESP_KEY_MGR_KEY_PURPOSE_PSRAM_256_1) {
random_deploy_config.key_purpose = key_config->key_type == ESP_KEY_MGR_FLASH_XTS_AES_KEY ? ESP_KEY_MGR_KEY_PURPOSE_FLASH_256_2 : ESP_KEY_MGR_KEY_PURPOSE_PSRAM_256_2;
esp_ret = key_mgr_deploy_key_random_mode(&random_deploy_config);
if (esp_ret != ESP_OK) {
ESP_LOGE(TAG, "Key deployment in Random mode failed");
return ESP_FAIL;
goto cleanup;
}
}
// Set the Key Manager Static Register to use own key for the respective key type
key_mgr_hal_set_key_usage(key_type, ESP_KEY_MGR_USE_OWN_KEY);
key_mgr_hal_set_key_usage(key_config->key_type, ESP_KEY_MGR_USE_OWN_KEY);
cleanup:
esp_key_mgr_release_hardware(true);
return esp_ret;
}
#endif

2
components/esp_security/src/init.c
View File

@@ -48,7 +48,7 @@ static void esp_key_mgr_init(void)
};
// Force Key Manager to use eFuse key by-default for an XTS-AES operation.
key_mgr_ll_set_key_usage(ESP_KEY_MGR_XTS_AES_128_KEY, ESP_KEY_MGR_USE_EFUSE_KEY);
key_mgr_ll_set_key_usage(ESP_KEY_MGR_FLASH_XTS_AES_KEY, ESP_KEY_MGR_USE_EFUSE_KEY);
}
}
#endif /* SOC_KEY_MANAGER_SUPPORT_KEY_DEPLOYMENT */

12
components/esp_security/test_apps/crypto_drivers/main/test_key_mgr.c
View File

@@ -163,7 +163,8 @@ TEST_CASE("Key Manager AES mode: XTS-AES-128 key deployment", "[hw_crypto] [key_
memcpy(key_config->k1_encrypted, (uint8_t*) k1_xts_aes_encrypt, KEY_MGR_K1_ENCRYPTED_SIZE);
memcpy(key_config->sw_init_key, (uint8_t*) init_key, KEY_MGR_SW_INIT_KEY_SIZE);
key_config->use_pre_generated_sw_init_key = 1;
key_config->key_type = ESP_KEY_MGR_XTS_AES_128_KEY;
key_config->key_type = ESP_KEY_MGR_FLASH_XTS_AES_KEY;
key_config->key_len = ESP_KEY_MGR_XTS_AES_LEN_128;
esp_key_mgr_key_recovery_info_t *key_recovery_info = calloc(1, sizeof(esp_key_mgr_key_recovery_info_t));
TEST_ASSERT_NOT_NULL(key_recovery_info);
@@ -185,7 +186,8 @@ TEST_CASE("Key Manager ECDH0 mode: XTS-AES-128 key deployment", "[hw_crypto] [ke
TEST_ASSERT_NOT_NULL(key_config);
memcpy(key_config->k1_G, (uint8_t*) k1_G, KEY_MGR_ECDH0_INFO_SIZE);
key_config->key_type = ESP_KEY_MGR_XTS_AES_128_KEY;
key_config->key_type = ESP_KEY_MGR_FLASH_XTS_AES_KEY;
key_config->key_len = ESP_KEY_MGR_XTS_AES_LEN_128;
esp_key_mgr_key_recovery_info_t *key_recovery_info = calloc(1, sizeof(esp_key_mgr_key_recovery_info_t));
TEST_ASSERT_NOT_NULL(key_recovery_info);
@@ -210,7 +212,8 @@ TEST_CASE("Key Manager Random mode: XTS-AES-128 key deployment", "[hw_crypto] [k
esp_key_mgr_random_key_config_t *key_config = calloc(1, sizeof(esp_key_mgr_random_key_config_t));
TEST_ASSERT_NOT_NULL(key_config);
key_config->key_type = ESP_KEY_MGR_XTS_AES_128_KEY;
key_config->key_type = ESP_KEY_MGR_FLASH_XTS_AES_KEY;
key_config->key_len = ESP_KEY_MGR_XTS_AES_LEN_128;
esp_key_mgr_key_recovery_info_t *key_recovery_info = calloc(1, sizeof(esp_key_mgr_key_recovery_info_t));
TEST_ASSERT_NOT_NULL(key_recovery_info);
@@ -233,7 +236,8 @@ TEST_CASE("Key Manager random mode: ECDSA key deployment", "[hw_crypto] [key_mgr
esp_key_mgr_random_key_config_t *key_config = calloc(1, sizeof(esp_key_mgr_random_key_config_t));
TEST_ASSERT_NOT_NULL(key_config);
key_config->key_type = ESP_KEY_MGR_ECDSA_256_KEY;
key_config->key_type = ESP_KEY_MGR_ECDSA_KEY;
key_config->key_len = ESP_KEY_MGR_ECDSA_LEN_256;
esp_key_mgr_key_recovery_info_t *key_recovery_info = calloc(1, sizeof(esp_key_mgr_key_recovery_info_t));
TEST_ASSERT_NOT_NULL(key_recovery_info);

12
components/hal/ecdsa_hal.c
View File

@@ -35,11 +35,7 @@ static void configure_ecdsa_periph(ecdsa_hal_config_t *conf)
#if SOC_KEY_MANAGER_ECDSA_KEY_DEPLOY
// Force Key Manager to use eFuse key for XTS-AES operation
if (conf->curve == ECDSA_CURVE_SECP192R1) {
key_mgr_hal_set_key_usage(ESP_KEY_MGR_ECDSA_192_KEY, ESP_KEY_MGR_USE_EFUSE_KEY);
} else {
key_mgr_hal_set_key_usage(ESP_KEY_MGR_ECDSA_256_KEY, ESP_KEY_MGR_USE_EFUSE_KEY);
}
key_mgr_hal_set_key_usage(ESP_KEY_MGR_ECDSA_KEY, ESP_KEY_MGR_USE_EFUSE_KEY);
#endif
}
#if SOC_KEY_MANAGER_SUPPORTED
@@ -48,11 +44,7 @@ static void configure_ecdsa_periph(ecdsa_hal_config_t *conf)
HAL_ASSERT(false && "Key manager is not supported");
}
if (conf->curve == ECDSA_CURVE_SECP192R1) {
key_mgr_hal_set_key_usage(ESP_KEY_MGR_ECDSA_192_KEY, ESP_KEY_MGR_USE_OWN_KEY);
} else {
key_mgr_hal_set_key_usage(ESP_KEY_MGR_ECDSA_256_KEY, ESP_KEY_MGR_USE_OWN_KEY);
}
key_mgr_hal_set_key_usage(ESP_KEY_MGR_ECDSA_KEY, ESP_KEY_MGR_USE_OWN_KEY);
}
#endif

8
components/hal/esp32c5/include/hal/huk_ll.h
View File

@@ -29,6 +29,14 @@
extern "C" {
#endif
static inline void huk_ll_power_up(void)
{
/* huk force_pd MUST be cleared!!! */
REG_CLR_BIT(LP_AON_MEM_CTRL_REG, LP_AON_HUK_MEM_FORCE_PD);
/* huk force_pu MUST be set!!! */
REG_SET_BIT(LP_AON_MEM_CTRL_REG, LP_AON_HUK_MEM_FORCE_PU);
}
/* @brief Configure the HUK mode */
static inline void huk_ll_configure_mode(const esp_huk_mode_t huk_mode)
{

128
components/hal/esp32c5/include/hal/key_mgr_ll.h
View File

@@ -162,9 +162,7 @@ static inline void key_mgr_ll_use_sw_init_key(void)
static inline void key_mgr_ll_set_key_usage(const esp_key_mgr_key_type_t key_type, const esp_key_mgr_key_usage_t key_usage)
{
switch (key_type) {
case ESP_KEY_MGR_ECDSA_192_KEY:
case ESP_KEY_MGR_ECDSA_256_KEY:
case ESP_KEY_MGR_ECDSA_384_KEY:
case ESP_KEY_MGR_ECDSA_KEY:
if (key_usage == ESP_KEY_MGR_USE_EFUSE_KEY) {
REG_SET_BIT(KEYMNG_STATIC_REG, KEYMNG_USE_EFUSE_KEY_ECDSA);
} else {
@@ -172,8 +170,7 @@ static inline void key_mgr_ll_set_key_usage(const esp_key_mgr_key_type_t key_typ
}
break;
case ESP_KEY_MGR_XTS_AES_128_KEY:
case ESP_KEY_MGR_XTS_AES_256_KEY:
case ESP_KEY_MGR_FLASH_XTS_AES_KEY:
if (key_usage == ESP_KEY_MGR_USE_EFUSE_KEY) {
REG_SET_BIT(KEYMNG_STATIC_REG, KEYMNG_USE_EFUSE_KEY_FLASH);
} else {
@@ -197,8 +194,7 @@ static inline void key_mgr_ll_set_key_usage(const esp_key_mgr_key_type_t key_typ
}
break;
case ESP_KEY_MGR_PSRAM_128_KEY:
case ESP_KEY_MGR_PSRAM_256_KEY:
case ESP_KEY_MGR_PSRAM_XTS_AES_KEY:
if (key_usage == ESP_KEY_MGR_USE_EFUSE_KEY) {
REG_SET_BIT(KEYMNG_STATIC_REG, KEYMNG_USE_EFUSE_KEY_PSRAM);
} else {
@@ -214,13 +210,10 @@ static inline void key_mgr_ll_set_key_usage(const esp_key_mgr_key_type_t key_typ
static inline esp_key_mgr_key_usage_t key_mgr_ll_get_key_usage(esp_key_mgr_key_type_t key_type)
{
switch (key_type) {
case ESP_KEY_MGR_ECDSA_192_KEY:
case ESP_KEY_MGR_ECDSA_256_KEY:
case ESP_KEY_MGR_ECDSA_384_KEY:
case ESP_KEY_MGR_ECDSA_KEY:
return (esp_key_mgr_key_usage_t) (REG_GET_BIT(KEYMNG_STATIC_REG, KEYMNG_USE_EFUSE_KEY_ECDSA));
case ESP_KEY_MGR_XTS_AES_128_KEY:
case ESP_KEY_MGR_XTS_AES_256_KEY:
case ESP_KEY_MGR_FLASH_XTS_AES_KEY:
return (esp_key_mgr_key_usage_t) (REG_GET_BIT(KEYMNG_STATIC_REG, KEYMNG_USE_EFUSE_KEY_FLASH));
case ESP_KEY_MGR_HMAC_KEY:
@@ -229,15 +222,13 @@ static inline esp_key_mgr_key_usage_t key_mgr_ll_get_key_usage(esp_key_mgr_key_t
case ESP_KEY_MGR_DS_KEY:
return (esp_key_mgr_key_usage_t) (REG_GET_BIT(KEYMNG_STATIC_REG, KEYMNG_USE_EFUSE_KEY_DS));
case ESP_KEY_MGR_PSRAM_128_KEY:
case ESP_KEY_MGR_PSRAM_256_KEY:
case ESP_KEY_MGR_PSRAM_XTS_AES_KEY:
return (esp_key_mgr_key_usage_t) (REG_GET_BIT(KEYMNG_STATIC_REG, KEYMNG_USE_EFUSE_KEY_PSRAM));
default:
HAL_ASSERT(false && "Unsupported key type");
return ESP_KEY_MGR_USAGE_INVALID;
}
return ESP_KEY_MGR_USAGE_INVALID;
}
/**
@@ -258,14 +249,11 @@ static inline void key_mgr_ll_lock_use_sw_init_key_reg(void)
static inline void key_mgr_ll_lock_use_efuse_key_reg(esp_key_mgr_key_type_t key_type)
{
switch(key_type) {
case ESP_KEY_MGR_ECDSA_192_KEY:
case ESP_KEY_MGR_ECDSA_256_KEY:
case ESP_KEY_MGR_ECDSA_384_KEY:
case ESP_KEY_MGR_ECDSA_KEY:
REG_SET_BIT(KEYMNG_LOCK_REG, KEYMNG_USE_EFUSE_KEY_LOCK_ECDSA);
break;
case ESP_KEY_MGR_XTS_AES_128_KEY:
case ESP_KEY_MGR_XTS_AES_256_KEY:
case ESP_KEY_MGR_FLASH_XTS_AES_KEY:
REG_SET_BIT(KEYMNG_LOCK_REG, KEYMNG_USE_EFUSE_KEY_LOCK_FLASH);
break;
@@ -277,8 +265,7 @@ static inline void key_mgr_ll_lock_use_efuse_key_reg(esp_key_mgr_key_type_t key_
REG_SET_BIT(KEYMNG_LOCK_REG, KEYMNG_USE_EFUSE_KEY_LOCK_DS);
break;
case ESP_KEY_MGR_PSRAM_128_KEY:
case ESP_KEY_MGR_PSRAM_256_KEY:
case ESP_KEY_MGR_PSRAM_XTS_AES_KEY:
REG_SET_BIT(KEYMNG_LOCK_REG, KEYMNG_USE_EFUSE_KEY_LOCK_PSRAM);
break;
@@ -317,19 +304,30 @@ static inline bool key_mgr_ll_is_result_success(void)
* @return 1 for Success
* 0 for failure
*/
static inline bool key_mgr_ll_is_key_deployment_valid(const esp_key_mgr_key_type_t key_type)
static inline bool key_mgr_ll_is_key_deployment_valid(const esp_key_mgr_key_type_t key_type, const esp_key_mgr_key_len_t key_len)
{
switch (key_type) {
case ESP_KEY_MGR_ECDSA_192_KEY:
return REG_GET_FIELD(KEYMNG_KEY_VLD_REG, KEYMNG_KEY_ECDSA_192_VLD);
case ESP_KEY_MGR_ECDSA_256_KEY:
return REG_GET_FIELD(KEYMNG_KEY_VLD_REG, KEYMNG_KEY_ECDSA_256_VLD);
case ESP_KEY_MGR_ECDSA_384_KEY:
return REG_GET_FIELD(KEYMNG_KEY_VLD_REG, KEYMNG_KEY_ECDSA_384_VLD);
case ESP_KEY_MGR_XTS_AES_128_KEY:
case ESP_KEY_MGR_XTS_AES_256_KEY:
return REG_GET_FIELD(KEYMNG_KEY_VLD_REG, KEYMNG_KEY_FLASH_VLD);
case ESP_KEY_MGR_ECDSA_KEY:
switch (key_len) {
case ESP_KEY_MGR_ECDSA_LEN_192:
return REG_GET_FIELD(KEYMNG_KEY_VLD_REG, KEYMNG_KEY_ECDSA_192_VLD);
case ESP_KEY_MGR_ECDSA_LEN_256:
return REG_GET_FIELD(KEYMNG_KEY_VLD_REG, KEYMNG_KEY_ECDSA_256_VLD);
case ESP_KEY_MGR_ECDSA_LEN_384:
return REG_GET_FIELD(KEYMNG_KEY_VLD_REG, KEYMNG_KEY_ECDSA_384_VLD);
default:
HAL_ASSERT(false && "Unsupported key type");
return 0;
}
case ESP_KEY_MGR_FLASH_XTS_AES_KEY:
switch (key_len) {
case ESP_KEY_MGR_XTS_AES_LEN_128:
case ESP_KEY_MGR_XTS_AES_LEN_256:
return REG_GET_FIELD(KEYMNG_KEY_VLD_REG, KEYMNG_KEY_FLASH_VLD);
default:
HAL_ASSERT(false && "Unsupported key type");
return 0;
}
case ESP_KEY_MGR_HMAC_KEY:
return REG_GET_FIELD(KEYMNG_KEY_VLD_REG, KEYMNG_KEY_HMAC_VLD);
@@ -337,12 +335,18 @@ static inline bool key_mgr_ll_is_key_deployment_valid(const esp_key_mgr_key_type
case ESP_KEY_MGR_DS_KEY:
return REG_GET_FIELD(KEYMNG_KEY_VLD_REG, KEYMNG_KEY_DS_VLD);
case ESP_KEY_MGR_PSRAM_128_KEY:
case ESP_KEY_MGR_PSRAM_256_KEY:
return REG_GET_FIELD(KEYMNG_KEY_VLD_REG, KEYMNG_KEY_PSRAM_VLD);
case ESP_KEY_MGR_PSRAM_XTS_AES_KEY:
switch (key_len) {
case ESP_KEY_MGR_XTS_AES_LEN_128:
case ESP_KEY_MGR_XTS_AES_LEN_256:
return REG_GET_FIELD(KEYMNG_KEY_VLD_REG, KEYMNG_KEY_PSRAM_VLD);
default:
HAL_ASSERT(false && "Unsupported key type");
return 0;
}
default:
HAL_ASSERT(false && "Unsupported key type");
HAL_ASSERT(false && "Unsupported mode");
return 0;
}
}
@@ -410,22 +414,54 @@ static inline bool key_mgr_ll_is_huk_valid(void)
}
/* @brief Set the XTS-AES (Flash Encryption) key length for the Key Manager */
static inline void key_mgr_ll_set_xts_aes_key_len(const esp_key_mgr_key_type_t key_type, const esp_key_mgr_xts_aes_key_len_t key_len)
static inline void key_mgr_ll_set_xts_aes_key_len(const esp_key_mgr_key_type_t key_type, const esp_key_mgr_key_len_t key_len)
{
if (key_type == ESP_KEY_MGR_XTS_AES_128_KEY || key_type == ESP_KEY_MGR_XTS_AES_256_KEY) {
REG_SET_FIELD(KEYMNG_STATIC_REG, KEYMNG_FLASH_KEY_LEN, key_len);
} else if (key_type == ESP_KEY_MGR_PSRAM_128_KEY || key_type == ESP_KEY_MGR_PSRAM_256_KEY) {
REG_SET_FIELD(KEYMNG_STATIC_REG, KEYMNG_PSRAM_KEY_LEN, key_len);
uint32_t key_len_bit_mask;
if (key_type == ESP_KEY_MGR_FLASH_XTS_AES_KEY) {
key_len_bit_mask = KEYMNG_FLASH_KEY_LEN;
} else if (key_type == ESP_KEY_MGR_PSRAM_XTS_AES_KEY) {
key_len_bit_mask = KEYMNG_PSRAM_KEY_LEN;
} else {
HAL_ASSERT(false && "Unsupported key type");
return;
}
switch (key_len) {
case ESP_KEY_MGR_XTS_AES_LEN_128:
REG_CLR_BIT(KEYMNG_STATIC_REG, key_len_bit_mask);
break;
case ESP_KEY_MGR_XTS_AES_LEN_256:
REG_SET_BIT(KEYMNG_STATIC_REG, key_len_bit_mask);
break;
default:
HAL_ASSERT(false && "Unsupported key length");
return;
}
}
/* @brief Get the XTS-AES (Flash Encryption) key length for the Key Manager */
static inline esp_key_mgr_xts_aes_key_len_t key_mgr_ll_get_xts_aes_key_len(const esp_key_mgr_key_type_t key_type)
static inline esp_key_mgr_key_len_t key_mgr_ll_get_xts_aes_key_len(const esp_key_mgr_key_type_t key_type)
{
if (key_type == ESP_KEY_MGR_PSRAM_128_KEY || key_type == ESP_KEY_MGR_PSRAM_256_KEY) {
return (esp_key_mgr_xts_aes_key_len_t) REG_GET_FIELD(KEYMNG_STATIC_REG, KEYMNG_PSRAM_KEY_LEN);
uint32_t key_len_bit = 0;
if (key_type == ESP_KEY_MGR_FLASH_XTS_AES_KEY) {
key_len_bit = REG_GET_BIT(KEYMNG_STATIC_REG, KEYMNG_FLASH_KEY_LEN);
} else if (key_type == ESP_KEY_MGR_PSRAM_XTS_AES_KEY) {
key_len_bit = REG_GET_BIT(KEYMNG_STATIC_REG, KEYMNG_PSRAM_KEY_LEN);
} else {
return (esp_key_mgr_xts_aes_key_len_t) REG_GET_FIELD(KEYMNG_STATIC_REG, KEYMNG_FLASH_KEY_LEN);
HAL_ASSERT(false && "Unsupported key type");
return (esp_key_mgr_key_len_t) key_len_bit;
}
switch (key_len_bit) {
case 0:
return ESP_KEY_MGR_XTS_AES_LEN_128;
case 1:
return ESP_KEY_MGR_XTS_AES_LEN_256;
default:
HAL_ASSERT(false && "Unsupported key length");
return (esp_key_mgr_key_len_t) key_len_bit;
}
}

7
components/hal/esp32p4/include/hal/huk_ll.h
View File

@@ -1,5 +1,5 @@
/*
* SPDX-FileCopyrightText: 2023-2024 Espressif Systems (Shanghai) CO LTD
* SPDX-FileCopyrightText: 2023-2025 Espressif Systems (Shanghai) CO LTD
*
* SPDX-License-Identifier: Apache-2.0
*/
@@ -27,6 +27,11 @@
extern "C" {
#endif
static inline void huk_ll_power_up(void)
{
}
/* @brief Configure the HUK mode */
static inline void huk_ll_configure_mode(const esp_huk_mode_t huk_mode)
{

234
components/hal/esp32p4/include/hal/key_mgr_ll.h
View File

@@ -178,9 +178,7 @@ static inline void key_mgr_ll_use_sw_init_key(void)
static inline void key_mgr_ll_set_key_usage(const esp_key_mgr_key_type_t key_type, const esp_key_mgr_key_usage_t key_usage)
{
switch (key_type) {
case ESP_KEY_MGR_ECDSA_192_KEY:
case ESP_KEY_MGR_ECDSA_256_KEY:
case ESP_KEY_MGR_ECDSA_384_KEY:
case ESP_KEY_MGR_ECDSA_KEY:
if (key_usage == ESP_KEY_MGR_USE_EFUSE_KEY) {
REG_SET_BIT(KEYMNG_STATIC_REG, KEYMNG_USE_EFUSE_KEY_ECDSA);
} else {
@@ -188,42 +186,41 @@ static inline void key_mgr_ll_set_key_usage(const esp_key_mgr_key_type_t key_typ
}
break;
case ESP_KEY_MGR_XTS_AES_128_KEY:
case ESP_KEY_MGR_XTS_AES_256_KEY:
if (key_usage == ESP_KEY_MGR_USE_EFUSE_KEY) {
REG_SET_BIT(KEYMNG_STATIC_REG, KEYMNG_USE_EFUSE_KEY_FLASH);
} else {
REG_CLR_BIT(KEYMNG_STATIC_REG, KEYMNG_USE_EFUSE_KEY_FLASH);
}
break;
#if HAL_CONFIG(CHIP_SUPPORT_MIN_REV) >= 300
case ESP_KEY_MGR_HMAC_KEY:
if (key_usage == ESP_KEY_MGR_USE_EFUSE_KEY) {
REG_SET_BIT(KEYMNG_STATIC_REG, KEYMNG_USE_EFUSE_KEY_HMAC);
} else {
REG_CLR_BIT(KEYMNG_STATIC_REG, KEYMNG_USE_EFUSE_KEY_HMAC);
}
break;
case ESP_KEY_MGR_DS_KEY:
if (key_usage == ESP_KEY_MGR_USE_EFUSE_KEY) {
REG_SET_BIT(KEYMNG_STATIC_REG, KEYMNG_USE_EFUSE_KEY_DS);
} else {
REG_CLR_BIT(KEYMNG_STATIC_REG, KEYMNG_USE_EFUSE_KEY_DS);
}
break;
case ESP_KEY_MGR_PSRAM_128_KEY:
case ESP_KEY_MGR_PSRAM_256_KEY:
if (key_usage == ESP_KEY_MGR_USE_EFUSE_KEY) {
REG_SET_BIT(KEYMNG_STATIC_REG, KEYMNG_USE_EFUSE_KEY_PSRAM);
} else {
REG_CLR_BIT(KEYMNG_STATIC_REG, KEYMNG_USE_EFUSE_KEY_PSRAM);
}
case ESP_KEY_MGR_FLASH_XTS_AES_KEY:
if (key_usage == ESP_KEY_MGR_USE_EFUSE_KEY) {
REG_SET_BIT(KEYMNG_STATIC_REG, KEYMNG_USE_EFUSE_KEY_FLASH);
} else {
REG_CLR_BIT(KEYMNG_STATIC_REG, KEYMNG_USE_EFUSE_KEY_FLASH);
}
break;
#if HAL_CONFIG(CHIP_SUPPORT_MIN_REV) >= 300
case ESP_KEY_MGR_HMAC_KEY:
if (key_usage == ESP_KEY_MGR_USE_EFUSE_KEY) {
REG_SET_BIT(KEYMNG_STATIC_REG, KEYMNG_USE_EFUSE_KEY_HMAC);
} else {
REG_CLR_BIT(KEYMNG_STATIC_REG, KEYMNG_USE_EFUSE_KEY_HMAC);
}
break;
case ESP_KEY_MGR_DS_KEY:
if (key_usage == ESP_KEY_MGR_USE_EFUSE_KEY) {
REG_SET_BIT(KEYMNG_STATIC_REG, KEYMNG_USE_EFUSE_KEY_DS);
} else {
REG_CLR_BIT(KEYMNG_STATIC_REG, KEYMNG_USE_EFUSE_KEY_DS);
}
break;
case ESP_KEY_MGR_PSRAM_XTS_AES_KEY:
if (key_usage == ESP_KEY_MGR_USE_EFUSE_KEY) {
REG_SET_BIT(KEYMNG_STATIC_REG, KEYMNG_USE_EFUSE_KEY_PSRAM);
} else {
REG_CLR_BIT(KEYMNG_STATIC_REG, KEYMNG_USE_EFUSE_KEY_PSRAM);
}
break;
#endif
default:
HAL_ASSERT(false && "Unsupported mode");
HAL_ASSERT(false && "Unsupported key type");
return;
}
}
@@ -231,35 +228,26 @@ static inline void key_mgr_ll_set_key_usage(const esp_key_mgr_key_type_t key_typ
static inline esp_key_mgr_key_usage_t key_mgr_ll_get_key_usage(esp_key_mgr_key_type_t key_type)
{
switch (key_type) {
case ESP_KEY_MGR_ECDSA_192_KEY:
case ESP_KEY_MGR_ECDSA_256_KEY:
case ESP_KEY_MGR_ECDSA_384_KEY:
case ESP_KEY_MGR_ECDSA_KEY:
return (esp_key_mgr_key_usage_t) (REG_GET_BIT(KEYMNG_STATIC_REG, KEYMNG_USE_EFUSE_KEY_ECDSA));
break;
case ESP_KEY_MGR_XTS_AES_128_KEY:
case ESP_KEY_MGR_XTS_AES_256_KEY:
return (esp_key_mgr_key_usage_t) (REG_GET_BIT(KEYMNG_STATIC_REG, KEYMNG_USE_EFUSE_KEY_FLASH));
break;
case ESP_KEY_MGR_FLASH_XTS_AES_KEY:
return (esp_key_mgr_key_usage_t) (REG_GET_BIT(KEYMNG_STATIC_REG, KEYMNG_USE_EFUSE_KEY_FLASH));
#if HAL_CONFIG(CHIP_SUPPORT_MIN_REV) >= 300
case ESP_KEY_MGR_HMAC_KEY:
return (esp_key_mgr_key_usage_t) (REG_GET_BIT(KEYMNG_STATIC_REG, KEYMNG_USE_EFUSE_KEY_HMAC));
break;
case ESP_KEY_MGR_HMAC_KEY:
return (esp_key_mgr_key_usage_t) (REG_GET_BIT(KEYMNG_STATIC_REG, KEYMNG_USE_EFUSE_KEY_HMAC));
case ESP_KEY_MGR_DS_KEY:
return (esp_key_mgr_key_usage_t) (REG_GET_BIT(KEYMNG_STATIC_REG, KEYMNG_USE_EFUSE_KEY_DS));
break;
case ESP_KEY_MGR_DS_KEY:
return (esp_key_mgr_key_usage_t) (REG_GET_BIT(KEYMNG_STATIC_REG, KEYMNG_USE_EFUSE_KEY_DS));
case ESP_KEY_MGR_PSRAM_128_KEY:
case ESP_KEY_MGR_PSRAM_256_KEY:
return (esp_key_mgr_key_usage_t) (REG_GET_BIT(KEYMNG_STATIC_REG, KEYMNG_USE_EFUSE_KEY_PSRAM));
break;
case ESP_KEY_MGR_PSRAM_XTS_AES_KEY:
return (esp_key_mgr_key_usage_t) (REG_GET_BIT(KEYMNG_STATIC_REG, KEYMNG_USE_EFUSE_KEY_PSRAM));
#endif
default:
HAL_ASSERT(false && "Unsupported mode");
HAL_ASSERT(false && "Unsupported key type");
return ESP_KEY_MGR_USAGE_INVALID;
}
return ESP_KEY_MGR_USAGE_INVALID;
}
/**
@@ -280,29 +268,26 @@ static inline void key_mgr_ll_lock_use_sw_init_key_reg(void)
static inline void key_mgr_ll_lock_use_efuse_key_reg(esp_key_mgr_key_type_t key_type)
{
switch(key_type) {
case ESP_KEY_MGR_ECDSA_192_KEY:
case ESP_KEY_MGR_ECDSA_256_KEY:
case ESP_KEY_MGR_ECDSA_384_KEY:
case ESP_KEY_MGR_ECDSA_KEY:
REG_SET_BIT(KEYMNG_LOCK_REG, KEYMNG_USE_EFUSE_KEY_LOCK_ECDSA);
break;
case ESP_KEY_MGR_XTS_AES_128_KEY:
case ESP_KEY_MGR_XTS_AES_256_KEY:
REG_SET_BIT(KEYMNG_LOCK_REG, KEYMNG_USE_EFUSE_KEY_LOCK_FLASH);
break;
case ESP_KEY_MGR_FLASH_XTS_AES_KEY:
REG_SET_BIT(KEYMNG_LOCK_REG, KEYMNG_USE_EFUSE_KEY_LOCK_FLASH);
break;
#if HAL_CONFIG(CHIP_SUPPORT_MIN_REV) >= 300
case ESP_KEY_MGR_HMAC_KEY:
REG_SET_BIT(KEYMNG_LOCK_REG, KEYMNG_USE_EFUSE_KEY_LOCK_HMAC);
break;
case ESP_KEY_MGR_HMAC_KEY:
REG_SET_BIT(KEYMNG_LOCK_REG, KEYMNG_USE_EFUSE_KEY_LOCK_HMAC);
break;
case ESP_KEY_MGR_DS_KEY:
REG_SET_BIT(KEYMNG_LOCK_REG, KEYMNG_USE_EFUSE_KEY_LOCK_DS);
break;
case ESP_KEY_MGR_DS_KEY:
REG_SET_BIT(KEYMNG_LOCK_REG, KEYMNG_USE_EFUSE_KEY_LOCK_DS);
break;
case ESP_KEY_MGR_PSRAM_128_KEY:
case ESP_KEY_MGR_PSRAM_256_KEY:
REG_SET_BIT(KEYMNG_LOCK_REG, KEYMNG_USE_EFUSE_KEY_LOCK_PSRAM);
break;
case ESP_KEY_MGR_PSRAM_XTS_AES_KEY:
REG_SET_BIT(KEYMNG_LOCK_REG, KEYMNG_USE_EFUSE_KEY_LOCK_PSRAM);
break;
#endif
default:
HAL_ASSERT(false && "Unsupported key type");
@@ -339,19 +324,32 @@ static inline bool key_mgr_ll_is_result_success(void)
* @return 1 for Success
* 0 for failure
*/
static inline bool key_mgr_ll_is_key_deployment_valid(const esp_key_mgr_key_type_t key_type)
static inline bool key_mgr_ll_is_key_deployment_valid(const esp_key_mgr_key_type_t key_type, const esp_key_mgr_key_len_t key_len)
{
switch (key_type) {
case ESP_KEY_MGR_ECDSA_192_KEY:
return REG_GET_FIELD(KEYMNG_KEY_VLD_REG, KEYMNG_KEY_ECDSA_192_VLD);
case ESP_KEY_MGR_ECDSA_256_KEY:
return REG_GET_FIELD(KEYMNG_KEY_VLD_REG, KEYMNG_KEY_ECDSA_256_VLD);
case ESP_KEY_MGR_ECDSA_384_KEY:
return REG_GET_FIELD(KEYMNG_KEY_VLD_REG, KEYMNG_KEY_ECDSA_384_VLD);
case ESP_KEY_MGR_ECDSA_KEY:
switch (key_len) {
case ESP_KEY_MGR_ECDSA_LEN_192:
return REG_GET_FIELD(KEYMNG_KEY_VLD_REG, KEYMNG_KEY_ECDSA_192_VLD);
case ESP_KEY_MGR_ECDSA_LEN_256:
return REG_GET_FIELD(KEYMNG_KEY_VLD_REG, KEYMNG_KEY_ECDSA_256_VLD);
case ESP_KEY_MGR_ECDSA_LEN_384:
return REG_GET_FIELD(KEYMNG_KEY_VLD_REG, KEYMNG_KEY_ECDSA_384_VLD);
default:
HAL_ASSERT(false && "Unsupported key type");
return 0;
}
case ESP_KEY_MGR_FLASH_XTS_AES_KEY:
switch (key_len) {
case ESP_KEY_MGR_XTS_AES_LEN_128:
case ESP_KEY_MGR_XTS_AES_LEN_256:
return REG_GET_FIELD(KEYMNG_KEY_VLD_REG, KEYMNG_KEY_FLASH_VLD);
default:
HAL_ASSERT(false && "Unsupported key type");
return 0;
}
case ESP_KEY_MGR_XTS_AES_128_KEY:
case ESP_KEY_MGR_XTS_AES_256_KEY:
return REG_GET_FIELD(KEYMNG_KEY_VLD_REG, KEYMNG_KEY_FLASH_VLD);
#if HAL_CONFIG(CHIP_SUPPORT_MIN_REV) >= 300
case ESP_KEY_MGR_HMAC_KEY:
return REG_GET_FIELD(KEYMNG_KEY_VLD_REG, KEYMNG_KEY_HMAC_VLD);
@@ -359,9 +357,15 @@ static inline bool key_mgr_ll_is_key_deployment_valid(const esp_key_mgr_key_type
case ESP_KEY_MGR_DS_KEY:
return REG_GET_FIELD(KEYMNG_KEY_VLD_REG, KEYMNG_KEY_DS_VLD);
case ESP_KEY_MGR_PSRAM_128_KEY:
case ESP_KEY_MGR_PSRAM_256_KEY:
return REG_GET_FIELD(KEYMNG_KEY_VLD_REG, KEYMNG_KEY_PSRAM_VLD);
case ESP_KEY_MGR_PSRAM_XTS_AES_KEY:
switch (key_len) {
case ESP_KEY_MGR_XTS_AES_LEN_128:
case ESP_KEY_MGR_XTS_AES_LEN_256:
return REG_GET_FIELD(KEYMNG_KEY_VLD_REG, KEYMNG_KEY_PSRAM_VLD);
default:
HAL_ASSERT(false && "Unsupported key type");
return 0;
}
#endif
default:
HAL_ASSERT(false && "Unsupported mode");
@@ -430,30 +434,64 @@ static inline bool key_mgr_ll_is_huk_valid(void)
{
return REG_GET_FIELD(KEYMNG_HUK_VLD_REG, KEYMNG_HUK_VALID);
}
/* @brief Set the XTS-AES (Flash Encryption) key length for the Key Manager */
static inline void key_mgr_ll_set_xts_aes_key_len(const esp_key_mgr_key_type_t key_type, const esp_key_mgr_xts_aes_key_len_t key_len)
static inline void key_mgr_ll_set_xts_aes_key_len(const esp_key_mgr_key_type_t key_type, const esp_key_mgr_key_len_t key_len)
{
if (key_type == ESP_KEY_MGR_XTS_AES_128_KEY || key_type == ESP_KEY_MGR_XTS_AES_256_KEY) {
REG_SET_FIELD(KEYMNG_STATIC_REG, KEYMNG_FLASH_KEY_LEN, key_len);
uint32_t key_len_bit_mask;
if (key_type == ESP_KEY_MGR_FLASH_XTS_AES_KEY) {
key_len_bit_mask = KEYMNG_FLASH_KEY_LEN;
}
#if HAL_CONFIG(CHIP_SUPPORT_MIN_REV) >= 300
else if (key_type == ESP_KEY_MGR_PSRAM_128_KEY || key_type == ESP_KEY_MGR_PSRAM_256_KEY) {
REG_SET_FIELD(KEYMNG_STATIC_REG, KEYMNG_PSRAM_KEY_LEN, key_len);
else if (key_type == ESP_KEY_MGR_PSRAM_XTS_AES_KEY) {
key_len_bit_mask = KEYMNG_PSRAM_KEY_LEN;
}
#endif
else {
HAL_ASSERT(false && "Unsupported key type");
return;
}
switch (key_len) {
case ESP_KEY_MGR_XTS_AES_LEN_128:
REG_CLR_BIT(KEYMNG_STATIC_REG, key_len_bit_mask);
break;
case ESP_KEY_MGR_XTS_AES_LEN_256:
REG_SET_BIT(KEYMNG_STATIC_REG, key_len_bit_mask);
break;
default:
HAL_ASSERT(false && "Unsupported key length");
return;
}
}
/* @brief Get the XTS-AES (Flash Encryption) key length for the Key Manager */
static inline esp_key_mgr_xts_aes_key_len_t key_mgr_ll_get_xts_aes_key_len(const esp_key_mgr_key_type_t key_type)
static inline esp_key_mgr_key_len_t key_mgr_ll_get_xts_aes_key_len(const esp_key_mgr_key_type_t key_type)
{
if (key_type == ESP_KEY_MGR_XTS_AES_128_KEY || key_type == ESP_KEY_MGR_XTS_AES_256_KEY) {
return (esp_key_mgr_xts_aes_key_len_t) REG_GET_FIELD(KEYMNG_STATIC_REG, KEYMNG_FLASH_KEY_LEN);
} else {
uint32_t key_len_bit = 0;
if (key_type == ESP_KEY_MGR_FLASH_XTS_AES_KEY) {
key_len_bit = REG_GET_BIT(KEYMNG_STATIC_REG, KEYMNG_FLASH_KEY_LEN);
}
#if HAL_CONFIG(CHIP_SUPPORT_MIN_REV) >= 300
return (esp_key_mgr_xts_aes_key_len_t) REG_GET_FIELD(KEYMNG_STATIC_REG, KEYMNG_PSRAM_KEY_LEN);
#else
HAL_ASSERT(false && "Unsupported key type");
else if (key_type == ESP_KEY_MGR_PSRAM_XTS_AES_KEY) {
key_len_bit = REG_GET_BIT(KEYMNG_STATIC_REG, KEYMNG_PSRAM_KEY_LEN);
}
#endif
else {
HAL_ASSERT(false && "Unsupported key type");
return (esp_key_mgr_key_len_t) key_len_bit;
}
switch (key_len_bit) {
case 0:
return ESP_KEY_MGR_XTS_AES_LEN_128;
case 1:
return ESP_KEY_MGR_XTS_AES_LEN_256;
default:
HAL_ASSERT(false && "Unsupported key length");
return (esp_key_mgr_key_len_t) key_len_bit;
}
}

2
components/hal/huk_hal.c
View File

@@ -30,6 +30,8 @@ static void inline huk_hal_wait_for_state(esp_huk_state_t state)
esp_err_t huk_hal_configure(const esp_huk_mode_t huk_mode, uint8_t *huk_info_buf)
{
huk_ll_power_up();
if (esp_rom_km_huk_conf(huk_mode, huk_info_buf) != ETS_OK) {
return ESP_FAIL;
}

8
components/hal/include/hal/key_mgr_hal.h
View File

@@ -1,5 +1,5 @@
/*
* SPDX-FileCopyrightText: 2023-2025 Espressif Systems (Shanghai) CO LTD
* SPDX-FileCopyrightText: 2023-2026 Espressif Systems (Shanghai) CO LTD
*
* SPDX-License-Identifier: Apache-2.0
*/
@@ -57,7 +57,7 @@ bool key_mgr_hal_is_result_success(void);
* @return 1 for Success
* 0 for failure
*/
bool key_mgr_hal_is_key_deployment_valid(const esp_key_mgr_key_type_t key_type);
bool key_mgr_hal_is_key_deployment_valid(const esp_key_mgr_key_type_t key_type, const esp_key_mgr_key_len_t key_len);
/**
* @brief Check if the HUK is valid or not
@@ -112,10 +112,10 @@ void key_mgr_hal_write_public_info(const uint8_t *public_info_buf, const size_t
void key_mgr_hal_read_public_info(uint8_t *public_info_buf, const size_t read_len);
/* @brief Set the XTS-AES key length for the Key Manager */
void key_mgr_hal_set_xts_aes_key_len(const esp_key_mgr_key_type_t key_type, const esp_key_mgr_xts_aes_key_len_t key_len);
void key_mgr_hal_set_xts_aes_key_len(const esp_key_mgr_key_type_t key_type, const esp_key_mgr_key_len_t key_len);
/* @brief Get the XTS-AES key length for the Key Manager */
esp_key_mgr_xts_aes_key_len_t key_mgr_hal_get_xts_aes_key_len(const esp_key_mgr_key_type_t key_type);
esp_key_mgr_key_len_t key_mgr_hal_get_xts_aes_key_len(const esp_key_mgr_key_type_t key_type);
/**
* @brief Read state of Key Manager

46
components/hal/include/hal/key_mgr_types.h
View File

@@ -1,5 +1,5 @@
/*
* SPDX-FileCopyrightText: 2023-2025 Espressif Systems (Shanghai) CO LTD
* SPDX-FileCopyrightText: 2023-2026 Espressif Systems (Shanghai) CO LTD
*
* SPDX-License-Identifier: Apache-2.0
*/
@@ -20,41 +20,32 @@ extern "C" {
* @brief State of Key Manager: idle, load, gain or busy.
*/
typedef enum {
ESP_KEY_MGR_STATE_IDLE = 0, /* Key Manager is idle */
ESP_KEY_MGR_STATE_IDLE = 0, /* Key Manager is idle */
ESP_KEY_MGR_STATE_LOAD = 1, /* Key Manager is ready to receive input */
ESP_KEY_MGR_STATE_GAIN = 2, /* Key Manager is ready to provide output */
ESP_KEY_MGR_STATE_BUSY = 3, /* Key Manager is busy */
ESP_KEY_MGR_STATE_BUSY = 3, /* Key Manager is busy */
} esp_key_mgr_state_t;
/**
* @brief Length of the XTS AES key
* @brief Length of the deployed key (XTS-AES, ECDSA)
*/
typedef enum {
ESP_KEY_MGR_XTS_AES_LEN_256 = 0, /* xts-aes key is 256 bit, please note that xts-aes algorithm is XTS_AES_128 */
ESP_KEY_MGR_XTS_AES_LEN_512, /* xts-aes key is 512 bit, please note that xts-aes algorithm is XTS_AES_256 */
} esp_key_mgr_xts_aes_key_len_t;
ESP_KEY_MGR_ECDSA_LEN_192 = 0, /* ecdsa key is 192 bit */
ESP_KEY_MGR_ECDSA_LEN_256, /* ecdsa key is 256 bit */
ESP_KEY_MGR_ECDSA_LEN_384, /* ecdsa key is 384 bit */
ESP_KEY_MGR_XTS_AES_LEN_128, /* xts-aes key is 128 bit */
ESP_KEY_MGR_XTS_AES_LEN_256, /* xts-aes key is 512 bit, please note that xts-aes algorithm is XTS_AES_256 */
} esp_key_mgr_key_len_t;
/**
* @brief Length of the PSRAM key
* @brief Type of the key
*/
typedef enum {
ESP_KEY_MGR_PSRAM_LEN_256 = 0, /* psram key is 256 bit, please note that xts-aes algorithm is XTS_AES_128 */
ESP_KEY_MGR_PSRAM_LEN_512, /* psram key is 512 bit, please note that xts-aes algorithm is XTS_AES_256 */
} esp_key_mgr_psram_key_len_t;
/**
* @brief Type of the key: ECDSA, XTS
*/
typedef enum {
ESP_KEY_MGR_XTS_AES_128_KEY, /* XTS-AES 128-bit key */
ESP_KEY_MGR_XTS_AES_256_KEY, /* XTS-AES 256-bit key */
ESP_KEY_MGR_ECDSA_192_KEY, /* ECDSA 192-bit key */
ESP_KEY_MGR_ECDSA_256_KEY, /* ECDSA 256-bit key */
ESP_KEY_MGR_ECDSA_384_KEY, /* ECDSA 384-bit key */
ESP_KEY_MGR_HMAC_KEY, /* HMAC key */
ESP_KEY_MGR_DS_KEY, /* Digital signature key */
ESP_KEY_MGR_PSRAM_128_KEY, /* PSRAM 128-bit key */
ESP_KEY_MGR_PSRAM_256_KEY, /* PSRAM 256-bit key */
ESP_KEY_MGR_ECDSA_KEY = 0, /* ECDSA key */
ESP_KEY_MGR_FLASH_XTS_AES_KEY, /* XTS-AES key */
ESP_KEY_MGR_HMAC_KEY, /* HMAC key */
ESP_KEY_MGR_DS_KEY, /* Digital signature key */
ESP_KEY_MGR_PSRAM_XTS_AES_KEY, /* PSRAM XTS-AES key */
} esp_key_mgr_key_type_t;
/*
@@ -70,6 +61,7 @@ typedef enum {
* @brief Key Purpose to be set for a particular key in the Key Manager
*/
typedef enum {
ESP_KEY_MGR_KEY_PURPOSE_INVALID = 0,
ESP_KEY_MGR_KEY_PURPOSE_ECDSA_192 = 1, /* ECDSA 192-bit key */
ESP_KEY_MGR_KEY_PURPOSE_ECDSA_256 = 2, /* ECDSA 256-bit key */
ESP_KEY_MGR_KEY_PURPOSE_FLASH_256_1 = 3, /* First half of flash 256-bit key */
@@ -128,7 +120,9 @@ typedef struct WORD_ALIGNED_ATTR PACKED_ATTR {
uint32_t magic;
uint32_t version; // for backward compatibility
uint8_t key_type;
uint8_t reserved[15];
uint8_t key_len;
uint8_t key_deployment_mode;
uint8_t reserved[13];
esp_key_mgr_huk_info_t huk_info;
esp_key_mgr_key_info_t key_info[2]; // at most 2 key info (XTS-512_1 and XTS-512_2), at least use 1
} esp_key_mgr_key_recovery_info_t;

10
components/hal/key_mgr_hal.c
View File

@@ -1,5 +1,5 @@
/*
* SPDX-FileCopyrightText: 2023-2025 Espressif Systems (Shanghai) CO LTD
* SPDX-FileCopyrightText: 2023-2026 Espressif Systems (Shanghai) CO LTD
*
* SPDX-License-Identifier: Apache-2.0
*/
@@ -44,9 +44,9 @@ bool key_mgr_hal_is_result_success(void)
return key_mgr_ll_is_result_success();
}
bool key_mgr_hal_is_key_deployment_valid(const esp_key_mgr_key_type_t key_type)
bool key_mgr_hal_is_key_deployment_valid(const esp_key_mgr_key_type_t key_type, const esp_key_mgr_key_len_t key_len)
{
return key_mgr_ll_is_key_deployment_valid(key_type);
return key_mgr_ll_is_key_deployment_valid(key_type, key_len);
}
void key_mgr_hal_write_sw_init_key(const uint8_t *sw_init_key_buf, const size_t data_len)
@@ -79,12 +79,12 @@ bool key_mgr_hal_is_huk_valid(void)
return key_mgr_ll_is_huk_valid();
}
void key_mgr_hal_set_xts_aes_key_len(const esp_key_mgr_key_type_t key_type, const esp_key_mgr_xts_aes_key_len_t key_len)
void key_mgr_hal_set_xts_aes_key_len(const esp_key_mgr_key_type_t key_type, const esp_key_mgr_key_len_t key_len)
{
key_mgr_ll_set_xts_aes_key_len(key_type, key_len);
}
esp_key_mgr_xts_aes_key_len_t key_mgr_hal_get_xts_aes_key_len(const esp_key_mgr_key_type_t key_type)
esp_key_mgr_key_len_t key_mgr_hal_get_xts_aes_key_len(const esp_key_mgr_key_type_t key_type)
{
return key_mgr_ll_get_xts_aes_key_len(key_type);
}

29
components/hal/test_apps/crypto/main/key_manager/test_key_manager.c
View File

@@ -1,5 +1,5 @@
/*
* SPDX-FileCopyrightText: 2024-2025 Espressif Systems (Shanghai) CO LTD
* SPDX-FileCopyrightText: 2024-2026 Espressif Systems (Shanghai) CO LTD
*
* SPDX-License-Identifier: Unlicense OR CC0-1.0
*/
@@ -92,7 +92,8 @@ static void key_mgr_test_xts_aes_128_aes_mode(void)
memcpy(key_config.k1_encrypted, (uint8_t*) test_data_xts_aes_128.k1_encrypted, KEY_MGR_K1_ENCRYPTED_SIZE);
memcpy(key_config.sw_init_key, (uint8_t*) test_data_xts_aes_128.init_key, KEY_MGR_SW_INIT_KEY_SIZE);
key_config.use_pre_generated_sw_init_key = 1;
key_config.key_type = ESP_KEY_MGR_XTS_AES_128_KEY;
key_config.key_type = ESP_KEY_MGR_FLASH_XTS_AES_KEY;
key_config.key_len = ESP_KEY_MGR_XTS_AES_LEN_128;
static esp_key_mgr_key_recovery_info_t key_recovery_info;
TEST_ASSERT_EQUAL(ESP_OK, esp_key_mgr_deploy_key_in_aes_mode(&key_config, &key_recovery_info));
@@ -105,7 +106,8 @@ static void key_mgr_test_xts_aes_128_ecdh0_mode(void)
{
static esp_key_mgr_ecdh0_key_config_t key_config;
memcpy(key_config.k1_G[0], (uint8_t*) test_data_ecdh0.k1_G[0], KEY_MGR_ECDH0_INFO_SIZE);
key_config.key_type = ESP_KEY_MGR_XTS_AES_128_KEY;
key_config.key_type = ESP_KEY_MGR_FLASH_XTS_AES_KEY;
key_config.key_len = ESP_KEY_MGR_XTS_AES_LEN_128;
static esp_key_mgr_key_recovery_info_t key_recovery_info;
static esp_key_mgr_ecdh0_info_t ecdh0_info;
@@ -128,7 +130,8 @@ static void key_mgr_test_xts_aes_256_aes_mode(void)
memcpy(key_config.k1_encrypted[1], (uint8_t*) test_data_xts_aes_256.k1_encrypted[1], KEY_MGR_K1_ENCRYPTED_SIZE);
memcpy(key_config.sw_init_key, (uint8_t*) test_data_xts_aes_256.init_key, KEY_MGR_SW_INIT_KEY_SIZE);
key_config.use_pre_generated_sw_init_key = 1;
key_config.key_type = ESP_KEY_MGR_XTS_AES_256_KEY;
key_config.key_type = ESP_KEY_MGR_FLASH_XTS_AES_KEY;
key_config.key_len = ESP_KEY_MGR_XTS_AES_LEN_256;
static esp_key_mgr_key_recovery_info_t key_recovery_info;
TEST_ASSERT_EQUAL(ESP_OK, esp_key_mgr_deploy_key_in_aes_mode(&key_config, &key_recovery_info));
@@ -142,7 +145,8 @@ static void key_mgr_test_xts_aes_256_ecdh0_mode(void)
static esp_key_mgr_ecdh0_key_config_t key_config;
memcpy(key_config.k1_G[0], (uint8_t*) test_data_ecdh0.k1_G[0], KEY_MGR_ECDH0_INFO_SIZE);
memcpy(key_config.k1_G[1], (uint8_t*) test_data_ecdh0.k1_G[1], KEY_MGR_ECDH0_INFO_SIZE);
key_config.key_type = ESP_KEY_MGR_XTS_AES_256_KEY;
key_config.key_type = ESP_KEY_MGR_FLASH_XTS_AES_KEY;
key_config.key_len = ESP_KEY_MGR_XTS_AES_LEN_256;
static esp_key_mgr_key_recovery_info_t key_recovery_info;
static esp_key_mgr_ecdh0_info_t ecdh0_info;
@@ -177,7 +181,8 @@ static void test_xts_aes_key_random_mode(void)
static void key_mgr_test_xts_aes_128_random_mode(void)
{
static esp_key_mgr_random_key_config_t key_config;
key_config.key_type = ESP_KEY_MGR_XTS_AES_128_KEY;
key_config.key_type = ESP_KEY_MGR_FLASH_XTS_AES_KEY;
key_config.key_len = ESP_KEY_MGR_XTS_AES_LEN_128;
static esp_key_mgr_key_recovery_info_t key_recovery_info;
TEST_ASSERT_EQUAL(ESP_OK, esp_key_mgr_deploy_key_in_random_mode(&key_config, &key_recovery_info));
@@ -191,7 +196,8 @@ static void key_mgr_test_xts_aes_128_random_mode(void)
static void key_mgr_test_xts_aes_256_random_mode(void)
{
static esp_key_mgr_random_key_config_t key_config;
key_config.key_type = ESP_KEY_MGR_XTS_AES_256_KEY;
key_config.key_type = ESP_KEY_MGR_FLASH_XTS_AES_KEY;
key_config.key_len = ESP_KEY_MGR_XTS_AES_LEN_256;
static esp_key_mgr_key_recovery_info_t key_recovery_info;
TEST_ASSERT_EQUAL(ESP_OK, esp_key_mgr_deploy_key_in_random_mode(&key_config, &key_recovery_info));
@@ -257,7 +263,8 @@ static void key_mgr_test_ecdsa_p256_aes_mode(void)
memcpy(key_config.k1_encrypted, (uint8_t*) test_data_ecdsa.k1_encrypted, KEY_MGR_K1_ENCRYPTED_SIZE);
memcpy(key_config.sw_init_key, (uint8_t*) test_data_ecdsa.init_key, KEY_MGR_SW_INIT_KEY_SIZE);
key_config.use_pre_generated_sw_init_key = 1;
key_config.key_type = ESP_KEY_MGR_ECDSA_256_KEY;
key_config.key_type = ESP_KEY_MGR_ECDSA_KEY;
key_config.key_len = ESP_KEY_MGR_ECDSA_LEN_256;
static esp_key_mgr_key_recovery_info_t key_recovery_info;
TEST_ASSERT_EQUAL(ESP_OK, esp_key_mgr_deploy_key_in_aes_mode(&key_config, &key_recovery_info));
@@ -274,7 +281,8 @@ static void key_mgr_test_ecdsa_ecdh0_mode(void)
{
static esp_key_mgr_ecdh0_key_config_t key_config;
memcpy(key_config.k1_G[0], (uint8_t*) test_data_ecdh0.k1_G[0], KEY_MGR_ECDH0_INFO_SIZE);
key_config.key_type = ESP_KEY_MGR_ECDSA_256_KEY;
key_config.key_type = ESP_KEY_MGR_ECDSA_KEY;
key_config.key_len = ESP_KEY_MGR_ECDSA_LEN_256;
static esp_key_mgr_key_recovery_info_t key_recovery_info;
static esp_key_mgr_ecdh0_info_t ecdh0_info;
@@ -292,7 +300,8 @@ static void key_mgr_test_ecdsa_ecdh0_mode(void)
static void key_mgr_test_ecdsa_random_mode(void)
{
static esp_key_mgr_random_key_config_t key_config;
key_config.key_type = ESP_KEY_MGR_ECDSA_256_KEY;
key_config.key_type = ESP_KEY_MGR_ECDSA_KEY;
key_config.key_len = ESP_KEY_MGR_ECDSA_LEN_256;
static esp_key_mgr_key_recovery_info_t key_recovery_info;
TEST_ASSERT_EQUAL(ESP_OK, esp_key_mgr_deploy_key_in_random_mode(&key_config, &key_recovery_info));

30
components/mbedtls/test_apps/main/test_mbedtls_ecdsa.c
View File

@@ -455,12 +455,13 @@ TEST_CASE("mbedtls ECDSA signature generation on SECP384R1", "[mbedtls][efuse_ke
#endif /* SOC_ECDSA_SUPPORT_CURVE_P384 */
#if SOC_KEY_MANAGER_SUPPORTED
static void deploy_key_in_key_manager(const uint8_t *k1_encrypted, esp_key_mgr_key_type_t key_type) {
static void deploy_key_in_key_manager(const uint8_t *k1_encrypted, esp_key_mgr_key_type_t key_type, esp_key_mgr_key_len_t key_len) {
esp_key_mgr_aes_key_config_t *key_config = NULL;
key_config = heap_caps_calloc(1, sizeof(esp_key_mgr_aes_key_config_t), MALLOC_CAP_INTERNAL);
TEST_ASSERT_NOT_NULL(key_config);
key_config->key_type = key_type;
key_config->key_len = key_len;
key_config->use_pre_generated_sw_init_key = 1;
memcpy(key_config->k2_info, (uint8_t*) k2_info, KEY_MGR_K2_INFO_SIZE);
memcpy(key_config->k1_encrypted[0], (uint8_t*) k1_encrypted, KEY_MGR_K1_ENCRYPTED_SIZE);
@@ -488,9 +489,9 @@ TEST_CASE("mbedtls ECDSA signature generation on SECP192R1", "[mbedtls][key_mana
TEST_IGNORE_MESSAGE("Key manager is not supported");
}
deploy_key_in_key_manager(k1_ecdsa192_encrypt, ESP_KEY_MGR_ECDSA_192_KEY);
deploy_key_in_key_manager(k1_ecdsa192_encrypt, ESP_KEY_MGR_ECDSA_KEY, ESP_KEY_MGR_ECDSA_LEN_192);
test_ecdsa_sign(MBEDTLS_ECP_DP_SECP192R1, sha, ecdsa192_pub_x_km, ecdsa192_pub_y_km, false, USE_ECDSA_KEY_FROM_KEY_MANAGER);
esp_key_mgr_deactivate_key(ESP_KEY_MGR_ECDSA_192_KEY);
esp_key_mgr_deactivate_key(ESP_KEY_MGR_ECDSA_KEY);
}
TEST_CASE("mbedtls ECDSA signature generation on SECP256R1", "[mbedtls][key_manager_key]")
@@ -501,9 +502,10 @@ TEST_CASE("mbedtls ECDSA signature generation on SECP256R1", "[mbedtls][key_mana
if (!key_mgr_ll_is_supported()) {
TEST_IGNORE_MESSAGE("Key manager is not supported");
}
deploy_key_in_key_manager(k1_ecdsa256_encrypt, ESP_KEY_MGR_ECDSA_256_KEY);
deploy_key_in_key_manager(k1_ecdsa256_encrypt, ESP_KEY_MGR_ECDSA_KEY, ESP_KEY_MGR_ECDSA_LEN_256);
test_ecdsa_sign(MBEDTLS_ECP_DP_SECP256R1, sha, ecdsa256_pub_x_km, ecdsa256_pub_y_km, false, USE_ECDSA_KEY_FROM_KEY_MANAGER);
esp_key_mgr_deactivate_key(ESP_KEY_MGR_ECDSA_256_KEY);
esp_key_mgr_deactivate_key(ESP_KEY_MGR_ECDSA_KEY);
}
#endif /* SOC_KEY_MANAGER_SUPPORTED */
@@ -556,9 +558,9 @@ TEST_CASE("mbedtls ECDSA deterministic signature generation on SECP192R1", "[mbe
if (!ecdsa_ll_is_deterministic_mode_supported()) {
ESP_LOGI(TAG, "Skipping test because ECDSA deterministic mode is not supported.");
} else {
deploy_key_in_key_manager(k1_ecdsa192_encrypt, ESP_KEY_MGR_ECDSA_192_KEY);
test_ecdsa_sign(MBEDTLS_ECP_DP_SECP192R1, sha, ecdsa192_pub_x_km, ecdsa192_pub_y_km, true, USE_ECDSA_KEY_FROM_KEY_MANAGER);
esp_key_mgr_deactivate_key(ESP_KEY_MGR_ECDSA_192_KEY);
deploy_key_in_key_manager(k1_ecdsa192_encrypt, ESP_KEY_MGR_ECDSA_KEY, ESP_KEY_MGR_ECDSA_LEN_192);
test_ecdsa_sign(MBEDTLS_ECP_DP_SECP192R1, sha, ecdsa192_pub_x_km, ecdsa192_pub_x_km, true, USE_ECDSA_KEY_FROM_KEY_MANAGER);
esp_key_mgr_deactivate_key(ESP_KEY_MGR_ECDSA_KEY);
}
}
@@ -571,9 +573,9 @@ TEST_CASE("mbedtls ECDSA deterministic signature generation on SECP256R1", "[mbe
if (!ecdsa_ll_is_deterministic_mode_supported()) {
ESP_LOGI(TAG, "Skipping test because ECDSA deterministic mode is not supported.");
} else {
deploy_key_in_key_manager(k1_ecdsa256_encrypt, ESP_KEY_MGR_ECDSA_256_KEY);
deploy_key_in_key_manager(k1_ecdsa256_encrypt, ESP_KEY_MGR_ECDSA_KEY, ESP_KEY_MGR_ECDSA_LEN_256);
test_ecdsa_sign(MBEDTLS_ECP_DP_SECP256R1, sha, ecdsa256_pub_x_km, ecdsa256_pub_y_km, true, USE_ECDSA_KEY_FROM_KEY_MANAGER);
esp_key_mgr_deactivate_key(ESP_KEY_MGR_ECDSA_256_KEY);
esp_key_mgr_deactivate_key(ESP_KEY_MGR_ECDSA_KEY);
}
}
#endif /* SOC_KEY_MANAGER_SUPPORTED */
@@ -661,9 +663,9 @@ TEST_CASE("mbedtls ECDSA export public key on SECP192R1", "[mbedtls][key_manager
TEST_IGNORE_MESSAGE("Key manager is not supported");
}
deploy_key_in_key_manager(k1_ecdsa192_encrypt, ESP_KEY_MGR_ECDSA_192_KEY);
deploy_key_in_key_manager(k1_ecdsa192_encrypt, ESP_KEY_MGR_ECDSA_KEY, ESP_KEY_MGR_ECDSA_LEN_192);
test_ecdsa_export_pubkey(MBEDTLS_ECP_DP_SECP192R1, ecdsa192_pub_x_km, ecdsa192_pub_y_km, USE_ECDSA_KEY_FROM_KEY_MANAGER);
esp_key_mgr_deactivate_key(ESP_KEY_MGR_ECDSA_192_KEY);
esp_key_mgr_deactivate_key(ESP_KEY_MGR_ECDSA_KEY);
}
TEST_CASE("mbedtls ECDSA export public key on SECP256R1", "[mbedtls][key_manager_key]")
@@ -675,9 +677,9 @@ TEST_CASE("mbedtls ECDSA export public key on SECP256R1", "[mbedtls][key_manager
TEST_IGNORE_MESSAGE("Key manager is not supported");
}
deploy_key_in_key_manager(k1_ecdsa256_encrypt, ESP_KEY_MGR_ECDSA_256_KEY);
deploy_key_in_key_manager(k1_ecdsa256_encrypt, ESP_KEY_MGR_ECDSA_KEY, ESP_KEY_MGR_ECDSA_LEN_256);
test_ecdsa_export_pubkey(MBEDTLS_ECP_DP_SECP256R1, ecdsa256_pub_x_km, ecdsa256_pub_y_km, USE_ECDSA_KEY_FROM_KEY_MANAGER);
esp_key_mgr_deactivate_key(ESP_KEY_MGR_ECDSA_256_KEY);
esp_key_mgr_deactivate_key(ESP_KEY_MGR_ECDSA_KEY);
}
#endif /* SOC_KEY_MANAGER_SUPPORTED */
#endif /* SOC_ECDSA_SUPPORT_EXPORT_PUBKEY */