Merge branch 'feature/add_data_partition_secure_boot_verification' into 'master'

feat(secure_boot): adds api to verify data partition integrity

Closes IDFGH-16339

See merge request espressif/esp-idf!41721

docs/en/api-reference/system/ota.rst

@@ -229,6 +229,23 @@ The verification of signed OTA updates can be performed even without enabling ha
 
   For more information, please refer to :ref:`signed-app-verify`.
 
+.. _secure-signed-data-partition:
+
+Signed Data Partition Updates
+------------------------------
+
+Data partition images can be verified using the same Secure Boot v2 signature mechanism as application images. Enable :ref:`CONFIG_SECURE_SIGNED_DATA_PARTITION` to verify data partitions with subtype ``ESP_PARTITION_SUBTYPE_DATA_UNDEFINED`` during OTA updates.
+
+Sign data partition images using:
+
+.. code-block:: bash
+
+    idf.py secure-sign-data --keyfile PRIVATE_SIGNING_KEY --output signed_data.bin data.bin
+
+The signing key must match the one used for application signing, with its public key digest programmed into eFuse. The signed image format is: data content (padded to 4 KB) + 4 KB signature block (see :ref:`signature-block-format` in :doc:`/security/secure-boot-v2`).
+
+For a complete example, see :example:`system/ota/partitions_ota`.
+
 Tuning OTA Performance
 ----------------------
 

docs/en/security/secure-boot-v2.rst

@@ -408,6 +408,16 @@ An image is verified if the public key stored in any signature block is valid fo
     3. Use the public key to verify the signature of the bootloader image, using either RSA-PSS (section 8.1.2 of RFC8017) or ECDSA signature verification (section 5.3.3 of RFC6090) with the image digest calculated in step (2) for comparison.
 
 
+Verifying Data Partitions
+--------------------------
+
+The Secure Boot v2 signature verification can also verify data partition images during OTA updates. Enable :ref:`CONFIG_SECURE_SIGNED_DATA_PARTITION` to verify data partitions with subtype ``ESP_PARTITION_SUBTYPE_DATA_UNDEFINED``.
+
+Data partition images must be signed using ``idf.py secure-sign-data`` with the same signing key and follow the same format as application images. The verification uses the public key digest(s) stored in eFuse and follows the process described in :ref:`verify_image`.
+
+For detailed information including OTA procedures and partition configuration, see :ref:`secure-signed-data-partition`.
+
+
 Bootloader Size
 ---------------