Mirrors/esp-idf
1
0
Fork 0
mirror of https://github.com/espressif/esp-idf.git synced 2026-10-02 03:00:34 +03:00
Code Issues Packages Projects Releases Wiki Activity

fix(secure_boot): marks 192 bit support curve legacy

Browse Source
This commit is contained in:
Ashish Sharma
2026-03-17 10:25:44 +08:00
parent 2757e0b87e
commit d8b02883dc
4 changed files with 21 additions and 2 deletions
Download Patch File Download Diff File Expand all files Collapse all files
components/bootloader/Kconfig.projbuild
+4 -2
View File
@@ -563,7 +563,7 @@ menu "Security features"
help
Select the ECDSA key size. Three key sizes are supported depending upon on the target:
- 192 bit key using NISTP192 curve
- 192 bit key using NISTP192 curve (Legacy, not recommended)
- 256 bit key using NISTP256 curve (Recommended)
- 384 bit key using NISTP384 curve (Recommended)
@@ -572,8 +572,10 @@ menu "Security features"
At present, both key sizes are practically implausible to bruteforce.
config SECURE_BOOT_ECDSA_KEY_LEN_192_BITS
bool "Using ECC curve NISTP192"
bool "Using ECC curve NISTP192 (Legacy, not recommended)"
depends on SECURE_SIGNED_APPS_ECDSA_V2_SCHEME
help
This legacy option is not recommended for new designs. Prefer NISTP256 or NISTP384.
config SECURE_BOOT_ECDSA_KEY_LEN_256_BITS
bool "Using ECC curve NISTP256 (Recommended)"
components/mbedtls/port/include/mbedtls/esp_config.h
+5
View File
@@ -539,6 +539,11 @@
#undef MBEDTLS_ECP_DP_SECP384R1_ENABLED
#undef PSA_WANT_ECC_SECP_R1_384
#endif
#ifdef CONFIG_SECURE_BOOT_ECDSA_KEY_LEN_192_BITS
#define PSA_WANT_ECC_SECP_R1_192 1
#else
#undef PSA_WANT_ECC_SECP_R1_192
#endif
#ifdef CONFIG_MBEDTLS_ECP_DP_SECP521R1_ENABLED
#define MBEDTLS_ECP_DP_SECP521R1_ENABLED
#else