Mirrors/esp-idf
1
0
Fork 0
mirror of https://github.com/espressif/esp-idf.git synced 2026-10-01 18:50:34 +03:00
Code Issues Packages Projects Releases Wiki Activity

change(secure_boot): mark ECDSA based Secure Boot V2 as insecure on affected SoCs

Browse Source 
ECDSA based Secure Boot V2 is not functional for certain input vectors on
ESP32-C5/C61/H2/P4 and on the preview targets ESP32-H4/H21. RSA based Secure
Boot V2 is the recommended scheme where the SoC supports it. This issue will be
fixed in a future hardware ECO revision; more details will be shared through the
hardware errata document.

A new hidden Kconfig option SECURE_BOOT_V2_ECDSA_INSECURE marks the affected
mass-production SoCs (ESP32-C5/C61/H2/P4). On these SoCs, when hardware Secure
Boot V2 is enabled, the ECDSA (V2) signing scheme is no longer offered by
default; it must be turned on explicitly via SECURE_BOOT_V2_FORCE_ENABLE_ECDSA
under "Allow potentially insecure options" (CONFIG_SECURE_BOOT_INSECURE). App
signing without hardware Secure Boot is not affected. Note that ESP32-C61 has no
RSA based Secure Boot V2, so it has no Secure Boot scheme enabled by default.

The preview targets ESP32-H4 and ESP32-H21 mark ECDSA Secure Boot V2 as not
supported in their SoC capabilities instead of using the option above. As
ESP32-H4 has no other Secure Boot V2 scheme, Secure Boot is disabled entirely on
it; ESP32-H21 retains RSA based Secure Boot V2.

The security documentation keeps the ECDSA Secure Boot V2 content visible and
adds a warning describing the limitation (including that ECDSA Secure Boot V2 on
ESP32-C61 is not recommended for production). CI apps that exercise ECDSA Secure
Boot V2 on the affected SoCs set CONFIG_SECURE_BOOT_V2_FORCE_ENABLE_ECDSA
accordingly.
This commit is contained in:
Aditya Patwardhan
2026-06-10 18:06:48 +05:30
parent a66f301ca2
commit 94be07050f
23 changed files with 139 additions and 17 deletions
Download Patch File Download Diff File Expand all files Collapse all files
tools/test_apps/security/.build-test-rules.yml
+2
View File
@@ -7,6 +7,8 @@ tools/test_apps/security/secure_boot:
disable:
- if: CONFIG_NAME != "qemu" or IDF_TARGET == "linux"
reason: Skipping redundant CI builds for all the targets.
- if: IDF_TARGET == "esp32h4"
reason: Secure Boot V2 is disabled on ESP32-H4 (ECDSA-only, vulnerable scheme), so the secure boot test app does not apply.
tools/test_apps/security/signed_app_no_secure_boot:
enable:
tools/test_apps/security/secure_boot/README.md
+2 -2
View File
@@ -1,5 +1,5 @@
| Supported Targets | ESP32 | ESP32-C2 | ESP32-C3 | ESP32-C5 | ESP32-C6 | ESP32-C61 | ESP32-H2 | ESP32-H21 | ESP32-H4 | ESP32-P4 | ESP32-S2 | ESP32-S3 |
| ----------------- | ----- | -------- | -------- | -------- | -------- | --------- | -------- | --------- | -------- | -------- | -------- | -------- |
| Supported Targets | ESP32 | ESP32-C2 | ESP32-C3 | ESP32-C5 | ESP32-C6 | ESP32-C61 | ESP32-H2 | ESP32-H21 | ESP32-P4 | ESP32-S2 | ESP32-S3 |
| ----------------- | ----- | -------- | -------- | -------- | -------- | --------- | -------- | --------- | -------- | -------- | -------- |
# Secure Boot
tools/test_apps/security/secure_boot/pytest_secure_boot.py
+3 -2
View File
@@ -38,14 +38,15 @@ SECURE_BOOT_RSA_TARGETS = [
'esp32c3',
'esp32c5',
'esp32c6',
'esp32c61',
'esp32h2',
'esp32h21',
'esp32s2',
'esp32s3',
'esp32p4',
]
SECURE_BOOT_ECDSA_TARGETS = ['esp32c2', 'esp32c5', 'esp32c6', 'esp32c61', 'esp32h2', 'esp32h21', 'esp32p4']
# ESP32-H21 is a preview target with ECDSA based Secure Boot V2 marked unsupported,
# so it is excluded here.
SECURE_BOOT_ECDSA_TARGETS = ['esp32c2', 'esp32c5', 'esp32c6', 'esp32c61', 'esp32h2', 'esp32p4']
SECURE_BOOT_ECDSA_P384_TARGETS = ['esp32c5']
CONFIGS_SECURE_BOOT_ECDSA = list(
tools/test_apps/security/secure_boot/sdkconfig.ci.ecdsa_p256
+4
View File
@@ -3,6 +3,10 @@ CONFIG_PARTITION_TABLE_OFFSET=0xD000
CONFIG_SECURE_BOOT=y
CONFIG_SECURE_BOOT_V2_ENABLED=y
# ECDSA based Secure Boot V2 is not recommended on the affected SoCs (see
# SECURE_BOOT_V2_ECDSA_INSECURE) and must be force-enabled to be selected.
CONFIG_SECURE_BOOT_INSECURE=y
CONFIG_SECURE_BOOT_V2_FORCE_ENABLE_ECDSA=y
CONFIG_SECURE_SIGNED_APPS_ECDSA_V2_SCHEME=y
CONFIG_SECURE_BOOT_ECDSA_KEY_LEN_256_BITS=y
CONFIG_SECURE_BOOT_SIGNING_KEY="test_ecdsa_p256_key.pem"
tools/test_apps/security/secure_boot/sdkconfig.ci.ecdsa_p384
+4
View File
@@ -3,6 +3,10 @@ CONFIG_PARTITION_TABLE_OFFSET=0xD000
CONFIG_SECURE_BOOT=y
CONFIG_SECURE_BOOT_V2_ENABLED=y
# ECDSA based Secure Boot V2 is not recommended on the affected SoCs (see
# SECURE_BOOT_V2_ECDSA_INSECURE) and must be force-enabled to be selected.
CONFIG_SECURE_BOOT_INSECURE=y
CONFIG_SECURE_BOOT_V2_FORCE_ENABLE_ECDSA=y
CONFIG_SECURE_SIGNED_APPS_ECDSA_V2_SCHEME=y
CONFIG_SECURE_BOOT_ECDSA_KEY_LEN_384_BITS=y
CONFIG_SECURE_BOOT_SIGNING_KEY="test_ecdsa_p384_key.pem"