Mirrors/esp-idf
1
0
Fork 0
mirror of https://github.com/espressif/esp-idf.git synced 2026-08-18 06:35:35 +03:00
Code Issues Packages Projects Releases Wiki Activity

feat(bootloader_support): Permanently enable XTS-AES pseudo rounds when FE release mode is enabled

Browse Source
This commit is contained in:
harshal.patil
2025-01-17 10:56:59 +05:30
parent ae4e693cfc
commit ac0dc0d775
15 changed files with 139 additions and 24 deletions
Download Patch File Download Diff File Expand all files Collapse all files

38
components/bootloader/Kconfig.projbuild
View File

@@ -1131,6 +1131,44 @@ menu "Security features"
If not set, the app does not care if the flash encryption eFuse bit is set or not.
config SECURE_FLASH_PSEUDO_ROUND_FUNC
bool "Permanently enable XTS-AES's pseudo rounds function"
default y
depends on SECURE_FLASH_ENCRYPTION_MODE_RELEASE && SOC_FLASH_ENCRYPTION_XTS_AES_SUPPORT_PSEUDO_ROUND
help
If set (default), the bootloader will permanently enable the XTS-AES peripheral's pseudo rounds function.
Note: Enabling this config would burn an efuse.
choice SECURE_FLASH_PSEUDO_ROUND_FUNC_STRENGTH
prompt "Strength of the pseudo rounds function"
depends on SECURE_FLASH_PSEUDO_ROUND_FUNC
default SECURE_FLASH_PSEUDO_ROUND_FUNC_STRENGTH_LOW
help
The strength of the pseudo rounds functions can be configured to low, medium and high,
each denoting the values that would be stored in the efuses field.
By default the value to set to low.
You can configure the strength of the pseudo rounds functions according to your use cases,
for example, increasing the strength would provide higher security but would slow down the
flash encryption/decryption operations.
For more info regarding the performance impact, please checkout the pseudo round function section of the
security guide documentation.
config SECURE_FLASH_PSEUDO_ROUND_FUNC_STRENGTH_LOW
bool "Low"
config SECURE_FLASH_PSEUDO_ROUND_FUNC_STRENGTH_MEDIUM
bool "Medium"
config SECURE_FLASH_PSEUDO_ROUND_FUNC_STRENGTH_HIGH
bool "High"
endchoice
config SECURE_FLASH_PSEUDO_ROUND_FUNC_STRENGTH
int
default 1 if SECURE_FLASH_PSEUDO_ROUND_FUNC_STRENGTH_LOW
default 2 if SECURE_FLASH_PSEUDO_ROUND_FUNC_STRENGTH_MEDIUM
default 3 if SECURE_FLASH_PSEUDO_ROUND_FUNC_STRENGTH_HIGH
config SECURE_ROM_DL_MODE_ENABLED
bool
default y if SOC_SUPPORTS_SECURE_DL_MODE && !SECURE_FLASH_ENCRYPTION_MODE_DEVELOPMENT