Mirrors/esp-idf
1
0
Fork 0
mirror of https://github.com/espressif/esp-idf.git synced 2026-10-02 03:00:34 +03:00
Code Issues Packages Projects Releases Wiki Activity

fix(esp_security): Enable Key Manager clocks even for efuse key operations

Browse Source 
The Key Manager holds a key usage register, thus, the Key Manager peripheral
clock must be enabled even for efuses-based key operations to route the
crypto operations to correctly to the efuses (default is Key Manager)
This commit is contained in:
harshal.patil
2026-04-06 18:36:17 +05:30
parent 8dafc3b75f
commit 9c86e8bdc1
4 changed files with 96 additions and 12 deletions
Download Patch File Download Diff File Expand all files Collapse all files
components/mbedtls/port/ecdsa/ecdsa_alt.c
+12
View File
@@ -105,6 +105,14 @@ static void esp_ecdsa_acquire_hardware(void)
esp_crypto_ecc_enable_periph_clk(true);
#if SOC_KEY_MANAGER_ECDSA_KEY_DEPLOY
/* Key Manager holds the key usage selector register (efuse vs own key).
Thus, we need to enable the Key Manager peripheral clock to ensure
that the key usage selector register is properly set.
*/
esp_crypto_key_mgr_enable_periph_clk(true);
#endif /* SOC_KEY_MANAGER_ECDSA_KEY_DEPLOY */
#if SOC_ECDSA_USES_MPI
if (ecdsa_ll_is_mpi_required()) {
/* We need to reset the MPI peripheral because ECDSA peripheral
@@ -121,6 +129,10 @@ static void esp_ecdsa_release_hardware(void)
esp_crypto_ecc_enable_periph_clk(false);
#if SOC_KEY_MANAGER_ECDSA_KEY_DEPLOY
esp_crypto_key_mgr_enable_periph_clk(false);
#endif /* SOC_KEY_MANAGER_ECDSA_KEY_DEPLOY */
#if SOC_ECDSA_USES_MPI
if (ecdsa_ll_is_mpi_required()) {
esp_crypto_mpi_enable_periph_clk(false);
components/mbedtls/test_apps/main/test_mbedtls_ecdsa.c
+59 -11
View File
@@ -170,6 +170,50 @@ const uint8_t ecdsa192_pub_y[] = {
0x7e, 0x4b, 0x23, 0xad, 0x46, 0x5c, 0x87, 0xc2
};
#if SOC_KEY_MANAGER_SUPPORTED
// Test cases from components/hal/test_apps/crypto
const uint8_t ecdsa192_pub_x_km[] = {
0xd6, 0x9a, 0x24, 0x27, 0xa6, 0x33, 0x3c, 0xc7,
0x4b, 0x91, 0x28, 0xf3, 0xed, 0xc3, 0x93, 0x97,
0x07, 0x75, 0xaf, 0x28, 0x62, 0x1d, 0x45, 0x69
};
const uint8_t ecdsa192_pub_y_km[] = {
0xd2, 0x1b, 0x54, 0xb8, 0x67, 0x24, 0x0e, 0x44,
0x1e, 0xb0, 0xef, 0xf1, 0x07, 0xd2, 0xb4, 0x25,
0x4c, 0x4b, 0x05, 0x78, 0x98, 0xaa, 0x15, 0xe0
};
const uint8_t ecdsa256_pub_x_km[] = {
0xb4, 0xad, 0xac, 0x2f, 0x89, 0x0a, 0x55, 0x7f,
0x69, 0xac, 0xfb, 0x7a, 0x0e, 0xa6, 0x41, 0xc4,
0x9d, 0xb8, 0x66, 0x45, 0xc7, 0x9d, 0x8d, 0xbf,
0xa1, 0x06, 0x6a, 0x9e, 0x7e, 0x04, 0xd7, 0x0e,
};
const uint8_t ecdsa256_pub_y_km[] = {
0x17, 0xb5, 0x21, 0xef, 0x22, 0x01, 0x53, 0x5d,
0xd3, 0xd6, 0x43, 0xce, 0x11, 0x60, 0x2e, 0xc8,
0x6e, 0xb3, 0xe6, 0x2f, 0x7e, 0xa8, 0xd1, 0xfb,
0x4a, 0x63, 0x5c, 0x56, 0xb6, 0x03, 0x21, 0x15,
};
const uint8_t ecdsa384_pub_x_km[] = {
0x12, 0x87, 0xb9, 0xef, 0x26, 0x94, 0x7c, 0x99,
0x1a, 0xe2, 0x48, 0x28, 0xeb, 0x35, 0x5d, 0xa9,
0x02, 0x86, 0xcb, 0x3a, 0x28, 0x1d, 0xa2, 0xc6,
0x2d, 0xbb, 0xd2, 0x3b, 0x12, 0xf4, 0xd4, 0xe0,
0x39, 0x94, 0xb6, 0x12, 0x08, 0xb8, 0x52, 0x28,
0x39, 0xd8, 0xe4, 0x83, 0xca, 0xaf, 0x2b, 0x6b,
};
const uint8_t ecdsa384_pub_y_km[] = {
0x2e, 0x70, 0x77, 0x3b, 0xb1, 0x37, 0x53, 0xc7,
0x60, 0x55, 0xc1, 0x3f, 0x01, 0x78, 0x10, 0xa4,
0x4f, 0x03, 0xf0, 0xa9, 0x63, 0xdc, 0xe6, 0xf9,
0xcd, 0x18, 0x4b, 0xd5, 0x7a, 0x0f, 0xf7, 0x0e,
0xb6, 0xc0, 0xe2, 0x4f, 0x0c, 0x8d, 0x3e, 0x73,
0xe0, 0x2d, 0x9c, 0x9f, 0xbe, 0x76, 0x00, 0xcd,
};
#endif /* SOC_KEY_MANAGER_SUPPORTED */
void test_ecdsa_verify(mbedtls_ecp_group_id id, const uint8_t *hash, const uint8_t *r_comp, const uint8_t *s_comp,
const uint8_t *pub_x, const uint8_t *pub_y)
{
@@ -309,12 +353,17 @@ const uint8_t k2_info[] = {
0x8f, 0x96, 0x33, 0x47, 0xe1, 0xa5, 0x57, 0xe9, 0x2a, 0x51, 0xa9, 0xbe, 0x48, 0x84, 0x25, 0x4e, 0x6f, 0x50, 0x1c, 0x45, 0xdb, 0xb6, 0xfa, 0xeb, 0x35, 0xd2, 0x27, 0x91, 0x3f, 0x67, 0x57, 0xd9, 0xcb, 0x55, 0xe4, 0x2b, 0x18, 0x16, 0xe7, 0xce, 0x6c, 0xf2, 0x58, 0x71, 0x17, 0x76, 0x2a, 0x86, 0x05, 0xe7, 0x37, 0x45, 0x71, 0x34, 0xca, 0xaf, 0x60, 0x07, 0xdf, 0xf4, 0xd2, 0xee, 0x3d, 0x4b,
};
const uint8_t k1_ecdsa384_encrypt[] = {
0x48, 0x6e, 0xbe, 0x82, 0xce, 0xa9, 0xc8, 0xd5, 0x98, 0x11, 0x24, 0xcc, 0x83, 0xf8, 0xf9, 0x53, 0x1b, 0x44, 0xdf, 0x62, 0x72, 0x6e, 0xff, 0x10, 0xcf, 0x9b, 0xff, 0xac, 0xb3, 0x9f, 0xec, 0x22,
0x31, 0xd4, 0x4f, 0xf4, 0xf6, 0x1d, 0xa1, 0xc7, 0x1f, 0x2c, 0x11, 0xca, 0x9f, 0x21, 0x26, 0xaa, 0x37, 0xcf, 0x5b, 0x9e, 0x08, 0x26, 0x36, 0x31, 0xd7, 0x51, 0x3c, 0x33, 0x0d, 0x5d, 0x03, 0xad,
};
const uint8_t k1_ecdsa256_encrypt[] = {
0xcb, 0x8b, 0x74, 0xfb, 0xdf, 0x8f, 0x52, 0x0a, 0xff, 0x00, 0xf2, 0x83, 0xfa, 0xdb, 0x34, 0x18, 0xbe, 0xae, 0xe2, 0x58, 0x75, 0x94, 0x69, 0x89, 0xdd, 0x72, 0xdb, 0x04, 0x2c, 0xad, 0x4e, 0x3a,
0x37, 0xcf, 0x5b, 0x9e, 0x08, 0x26, 0x36, 0x31, 0xd7, 0x51, 0x3c, 0x33, 0x0d, 0x5d, 0x03, 0xad, 0x48, 0x6e, 0xbe, 0x82, 0xce, 0xa9, 0xc8, 0xd5, 0x98, 0x11, 0x24, 0xcc, 0x83, 0xf8, 0xf9, 0x53,
};
const uint8_t k1_ecdsa192_encrypt[] = {
0xde, 0xe9, 0x9c, 0x89, 0xf2, 0x3b, 0x29, 0xb7, 0x9e, 0x33, 0xec, 0x76, 0x75, 0x2f, 0x3e, 0xab, 0x61, 0x06, 0x4d, 0xea, 0x05, 0x2c, 0xc3, 0x29, 0x1c, 0x7f, 0xb7, 0x3d, 0xb8, 0x1c, 0xb2, 0x17,
0xf2, 0x97, 0xcb, 0x28, 0xe0, 0x9b, 0xae, 0xc8, 0xa3, 0xbe, 0x53, 0xa0, 0xde, 0x43, 0xbe, 0xdd, 0xab, 0x93, 0x78, 0xf9, 0x05, 0x69, 0xd0, 0x8c, 0x80, 0x03, 0x07, 0x4c, 0x12, 0x17, 0x5a, 0xb3,
};
void test_ecdsa_sign(mbedtls_ecp_group_id id, const uint8_t *hash, const uint8_t *pub_x, const uint8_t *pub_y, bool is_deterministic, int efuse_key_block)
@@ -405,8 +454,6 @@ TEST_CASE("mbedtls ECDSA signature generation on SECP384R1", "[mbedtls][efuse_ke
}
#endif /* SOC_ECDSA_SUPPORT_CURVE_P384 */
#if SOC_KEY_MANAGER_SUPPORTED
static void deploy_key_in_key_manager(const uint8_t *k1_encrypted, esp_key_mgr_key_type_t key_type) {
esp_key_mgr_aes_key_config_t *key_config = NULL;
@@ -442,7 +489,7 @@ TEST_CASE("mbedtls ECDSA signature generation on SECP192R1", "[mbedtls][key_mana
}
deploy_key_in_key_manager(k1_ecdsa192_encrypt, ESP_KEY_MGR_ECDSA_192_KEY);
test_ecdsa_sign(MBEDTLS_ECP_DP_SECP192R1, sha, ecdsa192_sign_pub_x, ecdsa192_sign_pub_y, false, USE_ECDSA_KEY_FROM_KEY_MANAGER);
test_ecdsa_sign(MBEDTLS_ECP_DP_SECP192R1, sha, ecdsa192_pub_x_km, ecdsa192_pub_y_km, false, USE_ECDSA_KEY_FROM_KEY_MANAGER);
esp_key_mgr_deactivate_key(ESP_KEY_MGR_ECDSA_192_KEY);
}
@@ -455,7 +502,8 @@ TEST_CASE("mbedtls ECDSA signature generation on SECP256R1", "[mbedtls][key_mana
TEST_IGNORE_MESSAGE("Key manager is not supported");
}
deploy_key_in_key_manager(k1_ecdsa256_encrypt, ESP_KEY_MGR_ECDSA_256_KEY);
test_ecdsa_sign(MBEDTLS_ECP_DP_SECP256R1, sha, ecdsa256_sign_pub_x, ecdsa256_sign_pub_y, false, USE_ECDSA_KEY_FROM_KEY_MANAGER);
test_ecdsa_sign(MBEDTLS_ECP_DP_SECP256R1, sha, ecdsa256_pub_x_km, ecdsa256_pub_y_km, false, USE_ECDSA_KEY_FROM_KEY_MANAGER);
esp_key_mgr_deactivate_key(ESP_KEY_MGR_ECDSA_256_KEY);
}
#endif /* SOC_KEY_MANAGER_SUPPORTED */
@@ -509,7 +557,7 @@ TEST_CASE("mbedtls ECDSA deterministic signature generation on SECP192R1", "[mbe
ESP_LOGI(TAG, "Skipping test because ECDSA deterministic mode is not supported.");
} else {
deploy_key_in_key_manager(k1_ecdsa192_encrypt, ESP_KEY_MGR_ECDSA_192_KEY);
test_ecdsa_sign(MBEDTLS_ECP_DP_SECP192R1, sha, ecdsa192_sign_pub_x, ecdsa192_sign_pub_y, true, USE_ECDSA_KEY_FROM_KEY_MANAGER);
test_ecdsa_sign(MBEDTLS_ECP_DP_SECP192R1, sha, ecdsa192_pub_x_km, ecdsa192_pub_y_km, true, USE_ECDSA_KEY_FROM_KEY_MANAGER);
esp_key_mgr_deactivate_key(ESP_KEY_MGR_ECDSA_192_KEY);
}
}
@@ -524,7 +572,7 @@ TEST_CASE("mbedtls ECDSA deterministic signature generation on SECP256R1", "[mbe
ESP_LOGI(TAG, "Skipping test because ECDSA deterministic mode is not supported.");
} else {
deploy_key_in_key_manager(k1_ecdsa256_encrypt, ESP_KEY_MGR_ECDSA_256_KEY);
test_ecdsa_sign(MBEDTLS_ECP_DP_SECP256R1, sha, ecdsa256_sign_pub_x, ecdsa256_sign_pub_y, true, USE_ECDSA_KEY_FROM_KEY_MANAGER);
test_ecdsa_sign(MBEDTLS_ECP_DP_SECP256R1, sha, ecdsa256_pub_x_km, ecdsa256_pub_y_km, true, USE_ECDSA_KEY_FROM_KEY_MANAGER);
esp_key_mgr_deactivate_key(ESP_KEY_MGR_ECDSA_256_KEY);
}
}
@@ -614,7 +662,7 @@ TEST_CASE("mbedtls ECDSA export public key on SECP192R1", "[mbedtls][key_manager
}
deploy_key_in_key_manager(k1_ecdsa192_encrypt, ESP_KEY_MGR_ECDSA_192_KEY);
test_ecdsa_export_pubkey(MBEDTLS_ECP_DP_SECP192R1, ecdsa192_sign_pub_x, ecdsa192_sign_pub_y, USE_ECDSA_KEY_FROM_KEY_MANAGER);
test_ecdsa_export_pubkey(MBEDTLS_ECP_DP_SECP192R1, ecdsa192_pub_x_km, ecdsa192_pub_y_km, USE_ECDSA_KEY_FROM_KEY_MANAGER);
esp_key_mgr_deactivate_key(ESP_KEY_MGR_ECDSA_192_KEY);
}
@@ -628,9 +676,9 @@ TEST_CASE("mbedtls ECDSA export public key on SECP256R1", "[mbedtls][key_manager
}
deploy_key_in_key_manager(k1_ecdsa256_encrypt, ESP_KEY_MGR_ECDSA_256_KEY);
test_ecdsa_export_pubkey(MBEDTLS_ECP_DP_SECP256R1, ecdsa256_sign_pub_x, ecdsa256_sign_pub_y, USE_ECDSA_KEY_FROM_KEY_MANAGER);
test_ecdsa_export_pubkey(MBEDTLS_ECP_DP_SECP256R1, ecdsa256_pub_x_km, ecdsa256_pub_y_km, USE_ECDSA_KEY_FROM_KEY_MANAGER);
esp_key_mgr_deactivate_key(ESP_KEY_MGR_ECDSA_256_KEY);
}
#endif
#endif /* SOC_KEY_MANAGER_SUPPORTED */
#endif /* SOC_ECDSA_SUPPORT_EXPORT_PUBKEY */
#endif /* CONFIG_MBEDTLS_HARDWARE_ECDSA_SIGN */