Mirrors/esp-idf
1
0
Fork 0
mirror of https://github.com/espressif/esp-idf.git synced 2026-09-22 13:01:16 +03:00
Code Issues Packages Projects Releases Wiki Activity

Merge branch 'fix/fix_sbv2_psa_algo_check_v6.0' into 'release/v6.0'

Browse Source 
fix(secure_boot_v2): select correct secure boot algorithm based on key

See merge request espressif/esp-idf!49856
This commit is contained in:
Mahavir Jain
2026-06-30 18:17:45 +05:30
parent 3a070009e9 20289c2f08
commit 93056b5253
1 changed files with 7 additions and 2 deletions
Download Patch File Download Diff File Expand all files Collapse all files

9
components/bootloader_support/src/secure_boot_v2/secure_boot_ecdsa_signature.c
View File

@@ -58,7 +58,12 @@ esp_err_t verify_ecdsa_signature_block(const ets_secure_boot_signature_t *sig_bl
return ESP_ERR_INVALID_ARG;
}
psa_set_key_algorithm(&key_attributes, PSA_ALG_ECDSA(PSA_ALG_SHA_256));
#if CONFIG_SECURE_BOOT_ECDSA_KEY_LEN_384_BITS
const psa_algorithm_t alg = PSA_ALG_ECDSA(PSA_ALG_SHA_384);
#else
const psa_algorithm_t alg = PSA_ALG_ECDSA(PSA_ALG_SHA_256);
#endif
psa_set_key_algorithm(&key_attributes, alg);
psa_set_key_type(&key_attributes, PSA_KEY_TYPE_ECC_PUBLIC_KEY(curve_family));
/* Prepare the public key data from X and Y coordinates */
@@ -95,7 +100,7 @@ esp_err_t verify_ecdsa_signature_block(const ets_secure_boot_signature_t *sig_bl
}
/* Verify the signature */
status = psa_verify_hash(key_handle, PSA_ALG_ECDSA(PSA_ALG_SHA_256),
status = psa_verify_hash(key_handle, alg,
image_digest, ESP_SECURE_BOOT_DIGEST_LEN,
signature, 2 * key_size);