Merge branch 'fix/supported_key_mgr_key_types_check_v5.5' into 'release/v5.5'

fix(esp_security): guard key manager APIs against unsupported chip revs (v5.5)

See merge request espressif/esp-idf!48010

components/esp_security/src/esp_ds.c

@@ -339,15 +339,17 @@ esp_err_t esp_ds_start_sign(const void *message,
     ds_acquire_enable();
 
 #if SOC_KEY_MANAGER_DS_KEY_DEPLOY
-    if (!key_mgr_ll_is_supported()) {
-        assert(false && "Key manager is not supported");
-    }
-
     if (key_id == HMAC_KEY_KM) {
+        if (!key_mgr_ll_is_supported()) {
+            ds_disable_release();
+            assert(false && "Key manager is not supported");
+        }
         key_mgr_hal_set_key_usage(ESP_KEY_MGR_DS_KEY, ESP_KEY_MGR_USE_OWN_KEY);
         ds_hal_set_key_source(DS_KEY_SOURCE_KEY_MGR);
     } else {
-        key_mgr_hal_set_key_usage(ESP_KEY_MGR_DS_KEY, ESP_KEY_MGR_USE_EFUSE_KEY);
+        if (key_mgr_ll_is_supported()) {
+            key_mgr_hal_set_key_usage(ESP_KEY_MGR_DS_KEY, ESP_KEY_MGR_USE_EFUSE_KEY);
+        }
         ds_hal_set_key_source(DS_KEY_SOURCE_EFUSE);
 #endif
         // initiate hmac

components/esp_security/src/esp_key_mgr.c

@@ -1,5 +1,5 @@
 /*
- * SPDX-FileCopyrightText: 2023-2025 Espressif Systems (Shanghai) CO LTD
+ * SPDX-FileCopyrightText: 2023-2026 Espressif Systems (Shanghai) CO LTD
  *
  * SPDX-License-Identifier: Apache-2.0
  */
@@ -17,6 +17,7 @@
 #include "esp_efuse.h"
 #include "hal/key_mgr_types.h"
 #include "hal/key_mgr_hal.h"
+#include "hal/key_mgr_ll.h"
 #include "hal/huk_types.h"
 #include "hal/huk_hal.h"
 #include "rom/key_mgr.h"
@@ -350,6 +351,10 @@ static esp_err_t key_mgr_deploy_key_aes_mode(aes_deploy_config_t *config)
 
 esp_err_t esp_key_mgr_deploy_key_in_aes_mode(const esp_key_mgr_aes_key_config_t *key_config, esp_key_mgr_key_recovery_info_t *key_recovery_info)
 {
+    if (!key_mgr_ll_is_supported()) {
+        return ESP_ERR_NOT_SUPPORTED;
+    }
+
     if (key_config == NULL || key_recovery_info == NULL) {
         return ESP_ERR_INVALID_ARG;
     }
@@ -498,6 +503,10 @@ static esp_err_t key_mgr_recover_key(key_recovery_config_t *config)
 
 esp_err_t esp_key_mgr_activate_key(esp_key_mgr_key_recovery_info_t *key_recovery_info)
 {
+    if (!key_mgr_ll_is_supported()) {
+        return ESP_ERR_NOT_SUPPORTED;
+    }
+
     if (key_recovery_info == NULL) {
         return ESP_ERR_INVALID_ARG;
     }
@@ -681,6 +690,10 @@ static esp_err_t key_mgr_deploy_key_ecdh0_mode(ecdh0_deploy_config_t *config)
 esp_err_t esp_key_mgr_deploy_key_in_ecdh0_mode(const esp_key_mgr_ecdh0_key_config_t *key_config,
                                                esp_key_mgr_key_recovery_info_t *key_info, esp_key_mgr_ecdh0_info_t *ecdh0_key_info)
 {
+    if (!key_mgr_ll_is_supported()) {
+        return ESP_ERR_NOT_SUPPORTED;
+    }
+
     if (key_config == NULL || key_info == NULL || ecdh0_key_info == NULL) {
         return ESP_ERR_INVALID_ARG;
     }
@@ -846,6 +859,10 @@ static esp_err_t key_mgr_deploy_key_random_mode(random_deploy_config_t *config)
 
 esp_err_t esp_key_mgr_deploy_key_in_random_mode(const esp_key_mgr_random_key_config_t *key_config, esp_key_mgr_key_recovery_info_t *key_recovery_info)
 {
+    if (!key_mgr_ll_is_supported()) {
+        return ESP_ERR_NOT_SUPPORTED;
+    }
+
     if (key_config == NULL || key_recovery_info == NULL) {
         return ESP_ERR_INVALID_ARG;
     }

components/esp_security/test_apps/.build-test-rules.yml

@@ -3,9 +3,5 @@
 components/esp_security/test_apps/crypto_drivers:
   enable:
     - if: ((SOC_HMAC_SUPPORTED == 1) or (SOC_DIG_SIGN_SUPPORTED == 1)) or (SOC_KEY_MANAGER_SUPPORTED == 1)
-  disable_test:
-    - if: IDF_TARGET == "esp32p4"
-      temporary: true
-      reason: p4 rev3 migration # TODO: IDF-14418
   depends_components:
     - esp_security

components/esp_security/test_apps/crypto_drivers/main/test_key_mgr.c

@@ -1,5 +1,5 @@
 /*
- * SPDX-FileCopyrightText: 2024-2025 Espressif Systems (Shanghai) CO LTD
+ * SPDX-FileCopyrightText: 2024-2026 Espressif Systems (Shanghai) CO LTD
  *
  * SPDX-License-Identifier: Unlicense OR CC0-1.0
  */
@@ -41,13 +41,33 @@ typedef struct {
 
 #if SOC_RSA_MAX_BIT_LEN == 4096
 #include "digital_signature_test_cases_4096.h"
+
+// Note: generated using the hmac_key_idx = 2 of digital_signature_test_cases_4096
+#define DS_KEY_IDX 1
+static const uint8_t k1_ds_encrypt[] = {
+    0xf1, 0xbf, 0xa0, 0x27, 0x83, 0x02, 0x85, 0x94, 0x07, 0xb4, 0x20, 0x46, 0x1f, 0x1d, 0x4e, 0x24, 0x1d, 0x38, 0xcb, 0x21, 0xed, 0xcf, 0x85, 0x79, 0xe7, 0x17, 0xbf, 0x9d, 0xbb, 0xb8, 0x6f, 0xbd
+};
+
 #elif SOC_RSA_MAX_BIT_LEN == 3072
 #include "digital_signature_test_cases_3072.h"
+
+// Note: generated using the hmac_key_idx = 0 of digital_signature_test_cases_3072
+#define DS_KEY_IDX 0
+static const uint8_t k1_ds_encrypt[] = {
+    0xdc, 0xcc, 0x8e, 0xd4, 0x66, 0xb4, 0x1a, 0x4b, 0x9f, 0xba, 0xa3, 0x2e, 0x99, 0x6b, 0x45, 0x07, 0xd4, 0xf6, 0xe4, 0x4e, 0x6f, 0x26, 0xca, 0x20, 0xbd, 0xb4, 0x98, 0x7c, 0x32, 0x4f, 0x21, 0x55
+};
 #endif
 #endif /* SOC_KEY_MANAGER_DS_KEY_DEPLOY */
 
 static const char *TAG = "key_mgr_test";
 
+#define SKIP_IF_KEY_MGR_NOT_SUPPORTED()                                                   \
+    do {                                                                                  \
+        if (!key_mgr_ll_is_supported()) {                                                 \
+            TEST_IGNORE_MESSAGE("Key Manager not supported on this chip");                \
+        }                                                                                 \
+    } while (0)
+
 #define ENCRYPTED_DATA_SIZE 128
 static const uint8_t plaintext_data[ENCRYPTED_DATA_SIZE] = {
     0x01, 0x02, 0x03, 0x04, 0x05, 0x06, 0x07, 0x08, 0x09, 0x0a, 0x0b, 0x0c, 0x0d, 0x0e, 0x0f, 0x10,
@@ -61,14 +81,14 @@ static const uint8_t plaintext_data[ENCRYPTED_DATA_SIZE] = {
 };
 
 static const uint8_t expected_ciphertext[ENCRYPTED_DATA_SIZE] = {
-    0xf9, 0xb6, 0x08, 0x0f, 0xfb, 0x37, 0x46, 0xe4, 0x99, 0x3c, 0xf9, 0x29, 0xab, 0x90, 0xd5, 0x3f,
-    0xc8, 0x70, 0x45, 0xae, 0x28, 0x16, 0xbd, 0x83, 0x66, 0x16, 0x83, 0x86, 0x01, 0xc9, 0xa2, 0x97,
-    0xa4, 0xf6, 0xf0, 0x40, 0xb5, 0xfd, 0xb7, 0x13, 0x60, 0xc3, 0x39, 0xf2, 0x32, 0x5a, 0xa3, 0x89,
-    0xfd, 0x77, 0x9c, 0x6b, 0x0e, 0x98, 0xdf, 0x8f, 0xf7, 0xcc, 0x2a, 0x1e, 0xce, 0xdc, 0xef, 0x41,
-    0xac, 0x0f, 0x48, 0x97, 0xa1, 0x1a, 0xc0, 0x82, 0x42, 0x7e, 0x1a, 0x35, 0xcd, 0xcb, 0x2b, 0x1d,
-    0x72, 0xc6, 0x78, 0xab, 0x35, 0x58, 0xd1, 0xe3, 0xb1, 0x61, 0x8d, 0x11, 0x70, 0x91, 0x62, 0xb4,
-    0x5f, 0xdd, 0x75, 0x2f, 0x78, 0xc4, 0x95, 0x67, 0x3a, 0xd3, 0x87, 0x02, 0x35, 0x78, 0x48, 0xef,
-    0xf2, 0xde, 0xdb, 0x59, 0xda, 0x33, 0xa6, 0x27, 0xdd, 0x33, 0x18, 0x0c, 0x57, 0x24, 0x95, 0x38,
+    0xa, 0x6, 0x88, 0xb9, 0x9f, 0x3e, 0xff, 0xf5, 0x63, 0x37, 0xa2, 0xd6, 0xbb, 0x71, 0x50, 0x89,
+    0xa7, 0xbf, 0xa1, 0x5d, 0x3a, 0xc7, 0x18, 0x66, 0xa7, 0xab, 0x5f, 0x7, 0xd, 0x7c, 0xad, 0xcc,
+    0x8c, 0x9a, 0xc7, 0xff, 0x10, 0xf6, 0xab, 0xef, 0x62, 0x71, 0xdf, 0xc, 0x60, 0x18, 0x4f, 0xa2,
+    0x2c, 0x55, 0x14, 0x41, 0xd5, 0xfc, 0x87, 0x44, 0xe1, 0xd1, 0xd1, 0x78, 0x76, 0x9f, 0x43, 0x87,
+    0xa0, 0xb4, 0xea, 0x66, 0xbc, 0x56, 0x35, 0x39, 0x53, 0x60, 0xa6, 0xea, 0x1e, 0x7d, 0x48, 0x17,
+    0x6e, 0x58, 0x4c, 0x68, 0xc0, 0xfb, 0x54, 0x35, 0x92, 0x7b, 0x89, 0x9f, 0x69, 0x33, 0x1, 0x17,
+    0x85, 0xe2, 0x69, 0x26, 0xfb, 0x61, 0x7e, 0x15, 0x11, 0x26, 0x59, 0xf1, 0x4f, 0xeb, 0x4d, 0x25,
+    0x8e, 0xc5, 0xb9, 0x64, 0xdf, 0xc7, 0x52, 0x87, 0x2d, 0xb, 0xd6, 0xdd, 0xb1, 0xb3, 0xfe, 0xaf,
 };
 
 /* Big endian */
@@ -79,27 +99,21 @@ static const uint8_t init_key[] = {
 
 /* Big endian */
 static const uint8_t k2_info[] = {
-    0x8f, 0x96, 0x33, 0x47, 0xe1, 0xa5, 0x57, 0xe9, 0x2a, 0x51, 0xa9, 0xbe, 0x48, 0x84, 0x25, 0x4e,
-    0x6f, 0x50, 0x1c, 0x45, 0xdb, 0xb6, 0xfa, 0xeb, 0x35, 0xd2, 0x27, 0x91, 0x3f, 0x67, 0x57, 0xd9,
-    0xcb, 0x55, 0xe4, 0x2b, 0x18, 0x16, 0xe7, 0xce, 0x6c, 0xf2, 0x58, 0x71, 0x17, 0x76, 0x2a, 0x86,
-    0x05, 0xe7, 0x37, 0x45, 0x71, 0x34, 0xca, 0xaf, 0x60, 0x07, 0xdf, 0xf4, 0xd2, 0xee, 0x3d, 0x4b,
+    0xba, 0x7f, 0xe1, 0x43, 0xce, 0x19, 0xaf, 0xe8, 0xee, 0x04, 0x17, 0xcf, 0x67, 0x9d, 0xf4, 0xeb,
+    0x44, 0x12, 0x6f, 0xee, 0x9f, 0xfe, 0x9f, 0x5f, 0x20, 0x18, 0x9f, 0x27, 0x3f, 0xcb, 0x7b, 0xba,
+    0x92, 0x37, 0x07, 0x92, 0x47, 0xee, 0x1a, 0xbe, 0xa8, 0x7e, 0x32, 0x70, 0xc1, 0x05, 0x42, 0xe4,
+    0x88, 0x9d, 0x0b, 0x2b, 0x40, 0x87, 0x6e, 0x58, 0xf3, 0xf3, 0x63, 0x62, 0xd1, 0x5c, 0x9a, 0xe8
 };
 
 /* Big endian */
-static const uint8_t k1_encrypt[] = {
-    0xe0, 0xe8, 0x41, 0xe3, 0xd0, 0x92, 0x71, 0x84, 0x4b, 0x02, 0x1e, 0xec, 0x14, 0xdd, 0xaf, 0xf8,
-    0x39, 0xf9, 0x6a, 0x8d, 0x1b, 0xd7, 0x64, 0x3b, 0x7b, 0xa6, 0x05, 0x42, 0x01, 0xfb, 0xab, 0xe1,
+static const uint8_t k1_xts_aes_encrypt[] = {
+    0x0a, 0x43, 0x2a, 0xee, 0xb5, 0xd0, 0x6b, 0x58, 0x34, 0x2d, 0x0d, 0xbf, 0xf7, 0x04, 0x60, 0x81,
+    0x08, 0x79, 0x38, 0xb3, 0xb5, 0xdf, 0x25, 0xb4, 0x38, 0x8e, 0x93, 0x5d, 0xbf, 0xd1, 0x91, 0x6d,
 };
 
 static const uint8_t k1_hmac_encrypt[] = {
-    0x9e, 0xd8, 0x62, 0x4f, 0x27, 0xe1, 0x13, 0xfc, 0x50, 0x4b, 0x7f, 0x68, 0x70, 0x7b, 0xa1, 0xb2,
-    0xb1, 0x75, 0x21, 0x43, 0x88, 0x7d, 0xed, 0x4b, 0x58, 0x27, 0xb4, 0x15, 0x57, 0xc2, 0x46, 0x78,
-};
-
-// Note: generated using the hmac_key_idx = 0 of digital_signature_test_cases_3072
-static const uint8_t k1_ds_encrypt[] = {
-    0xa9, 0xf7, 0xd1, 0xd9, 0xaa, 0x80, 0xfa, 0x6f, 0xfa, 0x34, 0xf6, 0x66, 0xbf, 0xba, 0x7b, 0xc9,
-    0xa9, 0xf4, 0xeb, 0xba, 0x43, 0x61, 0x59, 0x32, 0x5d, 0xa0, 0xda, 0xd9, 0x0d, 0xc7, 0xde, 0xb2,
+    0x02, 0xf7, 0x05, 0x75, 0xfd, 0x12, 0x99, 0xc2, 0xb9, 0xc0, 0x2e, 0x40, 0xd0, 0x69, 0xb0, 0x83,
+    0x13, 0xfc, 0x74, 0xc3, 0xec, 0x4f, 0xf4, 0xd4, 0xe2, 0x35, 0xb5, 0x42, 0x4e, 0x61, 0x0f, 0x6d,
 };
 
 static const uint8_t k1_G[] = {
@@ -140,11 +154,13 @@ static esp_err_t test_xts_aes_key(bool verify)
 
 TEST_CASE("Key Manager AES mode: XTS-AES-128 key deployment", "[hw_crypto] [key_mgr]")
 {
+    SKIP_IF_KEY_MGR_NOT_SUPPORTED();
+
     esp_key_mgr_aes_key_config_t *key_config = calloc(1, sizeof(esp_key_mgr_aes_key_config_t));
     TEST_ASSERT_NOT_NULL(key_config);
 
     memcpy(key_config->k2_info, (uint8_t*) k2_info, KEY_MGR_K2_INFO_SIZE);
-    memcpy(key_config->k1_encrypted, (uint8_t*) k1_encrypt, KEY_MGR_K1_ENCRYPTED_SIZE);
+    memcpy(key_config->k1_encrypted, (uint8_t*) k1_xts_aes_encrypt, KEY_MGR_K1_ENCRYPTED_SIZE);
     memcpy(key_config->sw_init_key, (uint8_t*) init_key, KEY_MGR_SW_INIT_KEY_SIZE);
     key_config->use_pre_generated_sw_init_key = 1;
     key_config->key_type = ESP_KEY_MGR_XTS_AES_128_KEY;
@@ -163,6 +179,8 @@ TEST_CASE("Key Manager AES mode: XTS-AES-128 key deployment", "[hw_crypto] [key_
 
 TEST_CASE("Key Manager ECDH0 mode: XTS-AES-128 key deployment", "[hw_crypto] [key_mgr]")
 {
+    SKIP_IF_KEY_MGR_NOT_SUPPORTED();
+
     esp_key_mgr_ecdh0_key_config_t *key_config = calloc(1, sizeof(esp_key_mgr_ecdh0_key_config_t));
     TEST_ASSERT_NOT_NULL(key_config);
 
@@ -187,6 +205,8 @@ TEST_CASE("Key Manager ECDH0 mode: XTS-AES-128 key deployment", "[hw_crypto] [ke
 
 TEST_CASE("Key Manager Random mode: XTS-AES-128 key deployment", "[hw_crypto] [key_mgr]")
 {
+    SKIP_IF_KEY_MGR_NOT_SUPPORTED();
+
     esp_key_mgr_random_key_config_t *key_config = calloc(1, sizeof(esp_key_mgr_random_key_config_t));
     TEST_ASSERT_NOT_NULL(key_config);
 
@@ -208,6 +228,8 @@ TEST_CASE("Key Manager Random mode: XTS-AES-128 key deployment", "[hw_crypto] [k
 #if SOC_KEY_MANAGER_ECDSA_KEY_DEPLOY
 TEST_CASE("Key Manager random mode: ECDSA key deployment", "[hw_crypto] [key_mgr]")
 {
+    SKIP_IF_KEY_MGR_NOT_SUPPORTED();
+
     esp_key_mgr_random_key_config_t *key_config = calloc(1, sizeof(esp_key_mgr_random_key_config_t));
     TEST_ASSERT_NOT_NULL(key_config);
 
@@ -238,6 +260,8 @@ static esp_err_t test_hmac_key(bool verify)
 
 TEST_CASE("Key Manager AES mode: HMAC key deployment", "[hw_crypto] [key_mgr]")
 {
+    SKIP_IF_KEY_MGR_NOT_SUPPORTED();
+
     esp_key_mgr_aes_key_config_t *key_config = calloc(1, sizeof(esp_key_mgr_aes_key_config_t));
     TEST_ASSERT_NOT_NULL(key_config);
 
@@ -261,6 +285,8 @@ TEST_CASE("Key Manager AES mode: HMAC key deployment", "[hw_crypto] [key_mgr]")
 
 TEST_CASE("Key Manager ECDH0 mode: HMAC key deployment", "[hw_crypto] [key_mgr]")
 {
+    SKIP_IF_KEY_MGR_NOT_SUPPORTED();
+
     esp_key_mgr_ecdh0_key_config_t *key_config = calloc(1, sizeof(esp_key_mgr_ecdh0_key_config_t));
     TEST_ASSERT_NOT_NULL(key_config);
 
@@ -285,6 +311,8 @@ TEST_CASE("Key Manager ECDH0 mode: HMAC key deployment", "[hw_crypto] [key_mgr]"
 
 TEST_CASE("Key Manager random mode: HMAC key deployment", "[hw_crypto] [key_mgr]")
 {
+    SKIP_IF_KEY_MGR_NOT_SUPPORTED();
+
     esp_key_mgr_random_key_config_t *key_config = calloc(1, sizeof(esp_key_mgr_random_key_config_t));
     TEST_ASSERT_NOT_NULL(key_config);
 
@@ -313,7 +341,7 @@ static esp_err_t test_ds_key(void)
     for (int i = 0; i < NUM_MESSAGES; i++) {
         printf("Running test case %d...\n", i);
         const encrypt_testcase_t *t = &test_cases[0];
-        assert(t->hmac_key_idx == 0); // as the key deployed using Key Manager is the HMAC key ID 0
+        assert(t->hmac_key_idx == DS_KEY_IDX); // as the key deployed using Key Manager is the HMAC key with index DS_KEY_IDX
 
         // copy encrypt parameter test case into ds_data structure
         memcpy(ds_data.iv, t->iv, ESP_DS_IV_LEN);
@@ -333,6 +361,8 @@ static esp_err_t test_ds_key(void)
 
 TEST_CASE("Key Manager AES mode: DS key deployment", "[hw_crypto] [key_mgr]")
 {
+    SKIP_IF_KEY_MGR_NOT_SUPPORTED();
+
     esp_key_mgr_aes_key_config_t *key_config = calloc(1, sizeof(esp_key_mgr_aes_key_config_t));
     TEST_ASSERT_NOT_NULL(key_config);
 
@@ -356,6 +386,8 @@ TEST_CASE("Key Manager AES mode: DS key deployment", "[hw_crypto] [key_mgr]")
 
 TEST_CASE("Key Manager ECDH0 mode: DS key deployment", "[hw_crypto] [key_mgr]")
 {
+    SKIP_IF_KEY_MGR_NOT_SUPPORTED();
+
     esp_key_mgr_ecdh0_key_config_t *key_config = calloc(1, sizeof(esp_key_mgr_ecdh0_key_config_t));
     TEST_ASSERT_NOT_NULL(key_config);
 
@@ -380,6 +412,8 @@ TEST_CASE("Key Manager ECDH0 mode: DS key deployment", "[hw_crypto] [key_mgr]")
 
 TEST_CASE("Key Manager random mode: DS key deployment", "[hw_crypto] [key_mgr]")
 {
+    SKIP_IF_KEY_MGR_NOT_SUPPORTED();
+
     esp_key_mgr_random_key_config_t *key_config = calloc(1, sizeof(esp_key_mgr_random_key_config_t));
     TEST_ASSERT_NOT_NULL(key_config);
 

components/esp_security/test_apps/crypto_drivers/pytest_crypto_drivers.py

@@ -9,6 +9,5 @@ from pytest_embedded_idf.utils import idf_parametrize
 @idf_parametrize(
     'target', ['esp32s2', 'esp32s3', 'esp32c3', 'esp32c6', 'esp32h2', 'esp32p4', 'esp32c5'], indirect=['target']
 )
-@pytest.mark.temp_skip_ci(targets=['esp32p4'], reason='p4 rev3 migration # TODO: IDF-14418')
 def test_crypto_drivers(dut: Dut) -> None:
     dut.run_all_single_board_cases(timeout=180)

components/esp_security/test_apps/crypto_drivers/test_gen/generate_km_test_cases.py

@@ -0,0 +1,80 @@
+# SPDX-FileCopyrightText: 2026 Espressif Systems (Shanghai) CO LTD
+# SPDX-License-Identifier: Unlicense OR CC0-1.0
+import hashlib
+import hmac
+import os
+from typing import Any
+
+from cryptography.hazmat.backends import default_backend
+from cryptography.hazmat.primitives.ciphers import Cipher
+from cryptography.hazmat.primitives.ciphers import algorithms
+from cryptography.hazmat.primitives.ciphers import modes
+
+
+def key_to_c_format(key: bytes) -> str:
+    return ', '.join([f'0x{byte:02x}' for byte in key])
+
+
+def calculate_aes_cipher(data: bytes, key: bytes) -> Any:
+    cipher = Cipher(algorithms.AES(key), modes.ECB(), backend=default_backend())
+    encryptor = cipher.encryptor()
+    return encryptor.update(data) + encryptor.finalize()
+
+
+# Helper functions
+def generate_random_key(size: int = 32) -> bytes:
+    return os.urandom(size)
+
+
+def save_key_to_file(key: bytes, filename: str) -> None:
+    with open(filename, 'wb') as file:
+        file.write(key)
+
+
+def key_from_file_or_generate(filename: str, size: int = 32) -> bytes:
+    if not os.path.exists(filename):
+        key = generate_random_key(size)
+        save_key_to_file(key, filename)
+
+    with open(filename, 'rb') as file:
+        return file.read()
+
+
+init_key = key_from_file_or_generate('init_key.bin', 32)
+k2 = key_from_file_or_generate('k2.bin', 32)
+rand_num = key_from_file_or_generate('rand_num.bin', 32)
+
+temp_result_inner = calculate_aes_cipher(k2, rand_num)
+temp_result_outer = calculate_aes_cipher(temp_result_inner + rand_num, init_key)
+k2_info = temp_result_outer
+
+print(f'init_key = {key_to_c_format(init_key)}')
+print(f'k2_info = {key_to_c_format(k2_info)}')
+
+# XTS-AES key
+k1_xts_aes = key_from_file_or_generate('k1_xts_aes.bin', 32)
+k1_xts_aes_reversed = k1_xts_aes[::-1]
+k1_xts_aes_encrypted_reversed = calculate_aes_cipher(k1_xts_aes_reversed, k2)
+print(f'k1_xts_aes_encrypt = {key_to_c_format(k1_xts_aes_encrypted_reversed)}')
+
+# HMAC Key
+# Key from hmac_test_cases.h
+# k1_hmac_reversed = bytes([
+#     1, 2, 3, 4, 5, 6, 7, 8, 9, 10, 11, 12, 13, 14, 15, 16,
+#     17, 18, 19, 20, 21, 22, 23, 24, 25, 26, 27, 28, 29, 30, 31, 32
+# ])
+k1_hmac_reversed = bytes([])
+k1_hmac_encrypted_reversed = calculate_aes_cipher(k1_hmac_reversed, k2)
+print(f'k1_hmac_encrypt = {key_to_c_format(k1_hmac_encrypted_reversed)}')
+
+# Digital Signature
+# Key DS_KEY_IDX from digital_signature_test_cases_<bits>.h
+# hmac_key_for_ds = bytes([
+#     0x3d, 0x71, 0xd5, 0xc7, 0xe0, 0x15, 0xe6, 0x30, 0x66, 0xe8, 0xee, 0x5d, 0x14, 0x1e, 0xe1, 0xa1,
+#     0x03, 0xd9, 0x7d, 0x48, 0x16, 0xde, 0xbc, 0xba, 0xaa, 0xf4, 0x3e, 0xd5, 0xb2, 0xbc, 0x46, 0xbc
+# ])
+hmac_key_for_ds = bytes([])
+k1_ds = hmac.HMAC(hmac_key_for_ds, b'\xff' * 32, hashlib.sha256).digest()
+k1_ds_reversed = k1_ds[::-1]
+k1_ds_encrypted_reversed = calculate_aes_cipher(k1_ds_reversed, k2)
+print(f'k1_ds_encrypt = {key_to_c_format(k1_ds_encrypted_reversed)}')

components/esp_security/test_apps/crypto_drivers/test_gen/init_key.bin

@@ -0,0 +1 @@
+<EFBFBD><<3C>C<EFBFBD><43>K%[~<7E>W<EFBFBD><57>E<>v<EFBFBD>N.U<>%<25><>

components/esp_security/test_apps/crypto_drivers/test_gen/k2.bin

@@ -0,0 +1 @@
+"<22>Ɲ<EFBFBD><C69D>si<>%8<>	E3<03><>fb<66><62>2<EFBFBD><32><EFBFBD>$<24>

components/esp_security/test_apps/crypto_drivers/test_gen/rand_num.bin

@@ -0,0 +1 @@
+<EFBFBD>X<EFBFBD>Gȟk܀<6B><1C>u'<27><><14><><EFBFBD>

components/hal/ecdsa_hal.c

@@ -34,10 +34,6 @@ static void configure_ecdsa_periph(ecdsa_hal_config_t *conf)
         efuse_hal_set_ecdsa_key(conf->curve, conf->efuse_key_blk);
 
 #if SOC_KEY_MANAGER_ECDSA_KEY_DEPLOY
-        if (!key_mgr_ll_is_supported()) {
-            HAL_ASSERT(false && "Key manager is not supported");
-        }
-
         // Force Key Manager to use eFuse key for XTS-AES operation
         if (conf->curve == ECDSA_CURVE_SECP192R1) {
             key_mgr_hal_set_key_usage(ESP_KEY_MGR_ECDSA_192_KEY, ESP_KEY_MGR_USE_EFUSE_KEY);
@@ -48,6 +44,10 @@ static void configure_ecdsa_periph(ecdsa_hal_config_t *conf)
     }
 #if SOC_KEY_MANAGER_SUPPORTED
     else {
+        if (!key_mgr_ll_is_supported()) {
+            HAL_ASSERT(false && "Key manager is not supported");
+        }
+
         if (conf->curve == ECDSA_CURVE_SECP192R1) {
             key_mgr_hal_set_key_usage(ESP_KEY_MGR_ECDSA_192_KEY, ESP_KEY_MGR_USE_OWN_KEY);
         } else {

components/hal/hmac_hal.c

@@ -38,7 +38,7 @@ uint32_t hmac_hal_configure(hmac_hal_output_t config, uint32_t key_id)
             // No other HMAC output type is allowed when using key manager
             return 1;
         }
-    } else {
+    } else if (key_mgr_ll_is_supported()) {
         key_mgr_hal_set_key_usage(ESP_KEY_MGR_HMAC_KEY, ESP_KEY_MGR_USE_EFUSE_KEY);
     }
 #endif

components/hal/test_apps/crypto/main/ds/test_ds.c

@@ -1,5 +1,5 @@
 /*
- * SPDX-FileCopyrightText: 2023-2025 Espressif Systems (Shanghai) CO LTD
+ * SPDX-FileCopyrightText: 2023-2026 Espressif Systems (Shanghai) CO LTD
  *
  * SPDX-License-Identifier: Apache-2.0
  */
@@ -24,6 +24,7 @@ const static char *TAG = "test_ds";
 #include "rom/hmac.h"
 
 #if SOC_KEY_MANAGER_DS_KEY_DEPLOY
+#include "hal/key_mgr_hal.h"
 #include "hal/key_mgr_ll.h"
 #endif
 
@@ -94,11 +95,15 @@ static esp_err_t esp_ds_start_sign(const void *message, const esp_ds_data_t *dat
 #if SOC_KEY_MANAGER_DS_KEY_DEPLOY
     if (key_id == HMAC_KEY_KM) {
         if (!key_mgr_ll_is_supported()) {
-            HAL_ASSERT(false && "Key manager is not supported");
+            ds_disable_release();
+            assert(false && "Key manager is not supported");
         }
-
+        key_mgr_hal_set_key_usage(ESP_KEY_MGR_DS_KEY, ESP_KEY_MGR_USE_OWN_KEY);
         ds_hal_set_key_source(DS_KEY_SOURCE_KEY_MGR);
     } else {
+        if (key_mgr_ll_is_supported()) {
+            key_mgr_hal_set_key_usage(ESP_KEY_MGR_DS_KEY, ESP_KEY_MGR_USE_EFUSE_KEY);
+        }
         ds_hal_set_key_source(DS_KEY_SOURCE_EFUSE);
 #endif
         hmac_hal_start();

components/hal/test_apps/crypto/main/key_manager/test_key_manager.c

@@ -425,6 +425,9 @@ TEST_GROUP(key_manager);
 
 TEST_SETUP(key_manager)
 {
+    if (!key_mgr_ll_is_supported()) {
+        TEST_IGNORE_MESSAGE("Key Manager not supported on this chip");
+    }
     test_utils_record_free_mem();
     TEST_ESP_OK(test_utils_set_leak_level(800, ESP_LEAK_TYPE_CRITICAL, ESP_COMP_LEAK_GENERAL));
 }

components/hal/test_apps/crypto/pytest_crypto.py

@@ -109,12 +109,24 @@ def test_ecdsa_key(
         raise
 
 
-@pytest.mark.generic
-@pytest.mark.parametrize('config', ['long_aes_operations'], indirect=True)
-@idf_parametrize('target', ['supported_targets'], indirect=['target'])
 def test_crypto_long_aes_operations(dut: Dut) -> None:
     # if the env variable IDF_FPGA_ENV is set, we would need a longer timeout
     # as tests for efuses burning security peripherals would be run
     timeout = 600 if os.environ.get('IDF_ENV_FPGA') else 60
 
     dut.expect('Tests finished', timeout=timeout)
+
+
+@pytest.mark.generic
+@pytest.mark.parametrize('config', ['long_aes_operations'], indirect=True)
+@idf_parametrize('target', ['supported_targets'], indirect=['target'])
+def test_crypto_long_aes_operations_generic(dut: Dut) -> None:
+    test_crypto_long_aes_operations(dut)
+
+
+@pytest.mark.generic
+@pytest.mark.esp32p4_rev1
+@pytest.mark.parametrize('config', ['long_aes_operations_esp32p4_rev1'], indirect=True)
+@idf_parametrize('target', ['esp32p4'], indirect=['target'])
+def test_crypto_long_aes_operations_esp32p4_rev1(dut: Dut) -> None:
+    test_crypto_long_aes_operations(dut)

components/hal/test_apps/crypto/sdkconfig.ci.long_aes_operations_esp32p4_rev1

@@ -0,0 +1,8 @@
+#
+# Example Configuration
+#
+CONFIG_IDF_TARGET="esp32p4"
+CONFIG_ESP32P4_SELECTS_REV_LESS_V3=y
+
+CONFIG_CRYPTO_TESTAPP_USE_AES_INTERRUPT=y
+# end of Example Configuration