Mirrors/esp-idf
1
0
Fork 0
mirror of https://github.com/espressif/esp-idf.git synced 2026-10-01 18:50:34 +03:00
Code Issues Packages Projects Releases Wiki Activity

Merge branch 'backport/44987_v6.1' into 'release/v6.1'

Browse Source 
feat(esp-tls): Added a PSA driver for Secure Element (backport v6.1)

See merge request espressif/esp-idf!50334
This commit is contained in:
Aditya Patwardhan
2026-07-16 15:37:49 +05:30
parent 8158e1d350 3e6429e881
commit 9dc17f98b0
34 changed files with 1328 additions and 286 deletions
Download Patch File Download Diff File Expand all files Collapse all files
docs/en/api-reference/protocols/esp_http_client.rst
+8 -3
View File
@@ -36,13 +36,18 @@ To allow ESP HTTP client to take full advantage of persistent connections, one s
Use Secure Element (ATECC608) for TLS
^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
A secure element (ATECC608) can be also used for the underlying TLS connection in the HTTP client connection. Please refer to the **ATECC608A (Secure Element) with ESP-TLS** section in the :doc:`ESP-TLS documentation </api-reference/protocols/esp_tls>` for more details. The secure element support has to be first enabled in menuconfig through :ref:`CONFIG_ESP_TLS_USE_SECURE_ELEMENT`. Then the HTTP client can be configured to use secure element as follows:
A secure element (ATECC608) can be used for the underlying TLS connection in the HTTP client connection via the PSA Crypto opaque driver interface. Please refer to the **ATECC608A (Secure Element) with ESP-TLS** section in the :doc:`ESP-TLS documentation </api-reference/protocols/esp_tls>` for details on setting up the PSA key. Then configure the HTTP client to use the secure element via the ``client_key`` field in :cpp:type:`esp_http_client_config_t`:
.. code-block:: c
esp_key_config_t key_config = {
.source = ESP_KEY_SOURCE_PSA,
.psa.key_id = psa_key_id, /* obtained via psa_import_key() */
};
esp_http_client_config_t cfg = {
/* other configurations options */
.use_secure_element = true,
/* other configuration options */
.client_key = &key_config,
};
.. only:: SOC_ECDSA_SUPPORTED
docs/en/api-reference/protocols/esp_tls.rst
+43 -9
View File
@@ -204,26 +204,28 @@ To use a custom TLS stack in your project, follow these steps:
* For detailed function signatures and requirements, see :component_file:`esp-tls/esp_tls_custom_stack.h`.
.. _atecc608a-with-esp-tls:
ATECC608A (Secure Element) with ESP-TLS
--------------------------------------------------
ESP-TLS provides support for using ATECC608A cryptoauth chip with ESP32 series of SoCs. The use of ATECC608A is supported only when ESP-TLS is used with MbedTLS as its underlying SSL/TLS stack. ESP-TLS uses MbedTLS as its underlying TLS/SSL stack by default unless changed manually.
ESP-TLS provides support for using ATECC608A cryptoauth chip with ESP32 series of SoCs via the PSA Crypto opaque driver interface. The use of ATECC608A is supported only when ESP-TLS is used with MbedTLS as its underlying SSL/TLS stack. ESP-TLS uses MbedTLS as its underlying TLS/SSL stack by default unless changed manually.
.. note::
ATECC608A chip interfaced to ESP32 series must be already configured. For details, please refer to `esp_cryptoauth_utility <https://github.com/espressif/esp-cryptoauthlib/blob/master/esp_cryptoauth_utility/README.md#esp_cryptoauth_utility>`_.
To enable the secure element support, and use it in your project for TLS connection, you have to follow the below steps:
To enable the secure element support, and use it in your project for TLS connection, follow the steps below:
1) Add `esp-cryptoauthlib <https://github.com/espressif/esp-cryptoauthlib>`_ in your project, for details please refer `how to use esp-cryptoauthlib with ESP-IDF <https://github.com/espressif/esp-cryptoauthlib#how-to-use-esp-cryptoauthlib-with-esp-idf>`_.
1) Add `esp-cryptoauthlib <https://github.com/espressif/esp-cryptoauthlib>`_ as a dependency in your project. For details, please refer to `how to use esp-cryptoauthlib with ESP-IDF <https://github.com/espressif/esp-cryptoauthlib#how-to-use-esp-cryptoauthlib-with-esp-idf>`_.
2) Enable the menuconfig option :ref:`CONFIG_ESP_TLS_USE_SECURE_ELEMENT`:
2) Enable the menuconfig option :ref:`CONFIG_MBEDTLS_SECURE_ELEMENT_DRIVER_ENABLED`:
.. code-block:: none
menuconfig > Component config > ESP-TLS > Use Secure Element (ATECC608A) with ESP-TLS
menuconfig > Component config > mbedTLS > Enable secure element hardware support
3) Select type of ATECC608A chip with following option:
3) Select the type of ATECC608A chip:
.. code-block:: none
@@ -231,13 +233,45 @@ To enable the secure element support, and use it in your project for TLS connect
To know more about different types of ATECC608A chips and how to obtain the type of ATECC608A connected to your ESP module, please visit `ATECC608A chip type <https://github.com/espressif/esp-cryptoauthlib/blob/master/esp_cryptoauth_utility/README.md#find-type-of-atecc608a-chip-connected-to-esp32-wroom32-se>`_.
4) Enable the use of ATECC608A in ESP-TLS by providing the following config option in :cpp:type:`esp_tls_cfg_t`:
4) Import the ATECC608A key and configure ESP-TLS to use it via :cpp:type:`esp_key_config_t`:
.. code-block:: c
#include "psa/crypto.h"
#include "psa_crypto_driver_secure_element.h"
#include "psa_crypto_driver_secure_element_contexts.h"
#include "esp_key_config.h"
/* Import ATECC608A key reference into PSA */
psa_key_attributes_t key_attr = PSA_KEY_ATTRIBUTES_INIT;
psa_set_key_lifetime(&key_attr, PSA_KEY_LIFETIME_SECURE_ELEMENT_VOLATILE);
psa_set_key_usage_flags(&key_attr, PSA_KEY_USAGE_SIGN_HASH);
psa_set_key_algorithm(&key_attr, PSA_ALG_ECDSA(PSA_ALG_SHA_256));
psa_set_key_type(&key_attr, PSA_KEY_TYPE_ECC_KEY_PAIR(PSA_ECC_FAMILY_SECP_R1));
psa_set_key_bits(&key_attr, 256);
secure_element_opaque_key_t opaque_key = {
.slot_id = 0, /* Private key slot on ATECC608A */
};
psa_key_id_t psa_key_id;
psa_status_t status = psa_import_key(&key_attr, (const uint8_t *)&opaque_key,
sizeof(opaque_key), &psa_key_id);
if (status != PSA_SUCCESS) {
/* Handle error - typically means the SE callbacks are not registered
* or the attributes are invalid. */
return;
}
/* Configure ESP-TLS to use the PSA key */
esp_key_config_t key_config = {
.source = ESP_KEY_SOURCE_PSA,
.psa.key_id = psa_key_id,
};
esp_tls_cfg_t cfg = {
/* other configurations options */
.use_secure_element = true,
/* other configuration options */
.client_key = &key_config,
};
.. only:: SOC_DIG_SIGN_SUPPORTED