Mirrors/esp-idf
1
0
Fork 0
mirror of https://github.com/espressif/esp-idf.git synced 2026-10-02 03:00:34 +03:00
Code Issues Packages Projects Releases Wiki Activity
54,501 Commits 25 Branches 192 Tags
36586b15d629a4ffbe43adf98b94e6c5d5dfd3a2
Commit Graph
153 Commits
Author SHA1 Message Date
Ashish Sharma 20ee0021e9 feat(mbedtls): add option to choose constant-time prime generation 
mbedtls 4.1.1 made the small-factor test in prime generation
constant-time (a CT GCD against the product of primes up to 997, run
for every prime candidate). This makes RSA key generation roughly ten
times slower on ESP chips and starves the idle task since the software
GCD never yields, tripping the task watchdog.

Add MBEDTLS_CONSTANT_TIME_PRIME_GEN under the new "Security hardening"
menu, default y so the upstream constant-time behavior ships as the
secure default. When disabled, esp_config.h defines
MBEDTLS_MPI_PRIME_SIEVE_VARIABLE_TIME and mbedtls uses the pre-3.6.7
variable-time trial division, restoring key generation performance on
devices where no untrusted co-resident code could time key generation.
 2026-07-16 14:38:48 +08:00
Ashish Sharma 5ea5256b96 feat(mbedtls): enable cross signed certificate verification support by default 2026-07-06 15:34:51 +08:00
Aditya Patwardhan 1c20f525b4 feat(mbedtls): Add PSA Crypto driver for external secure elements 
Add generic secure element PSA driver with runtime callback registration.
Consolidate Kconfig into single MBEDTLS_SECURE_ELEMENT_DRIVER_ENABLED option.

Closes https://github.com/espressif/esp-idf/issues/18388
 2026-06-29 19:20:07 +05:30
harshal.patil 3494df8c85 feat(mbedtls): Support custom storage backend for persistent PSA keys 2026-06-18 09:37:15 +05:30
Jiang Jiang Jian b6a2af2fe1 Merge branch 'fix/mbedtls-threading-impl-kconfig' into 'master' 
fix(mbedtls): make threading implementation exclusive

See merge request espressif/esp-idf!48846
 2026-05-25 18:08:30 +08:00
Jiang Guang Ming cdfbee61a9 fix(mbedtls): make threading implementation exclusive 
Ensure the pthread and alternate threading implementations cannot be enabled at the same time.
 2026-05-25 11:13:51 +08:00
Jiang Guang Ming d5a712f1f8 feat(mbedtls): enable ROM mbedTLS pytest with esp32c2 rev2.0 2026-05-20 14:15:19 +08:00
Jiang Guang Ming 5d5b8200dc feat(mbedtls): enable ESP32-C2(Rev2.0) ROM crypto for PSA 2026-05-20 14:10:14 +08:00
Ashish Sharma 881dc4193a fix(mbedtls): bring back deprecated config MBEDTLS_ECJPAKE_C 2026-05-13 14:25:28 +08:00
Ashish Sharma 3b3372df18 fix(mbedtls): remove deprecated configs and migrate to PSA 2026-04-30 18:02:06 +08:00
Ashish Sharma bcf0acdead fix(mbedtls): remove not required MBEDTLS_TLS_DISABLED config 
Closes https://github.com/espressif/esp-idf/issues/18458
 2026-04-21 17:48:48 +08:00
Mahavir Jain 89a44d513c fix(mbedtls): fix MBEDTLS_POLY1305_C build config 
Closes https://github.com/espressif/esp-idf/issues/18243
 2026-02-17 20:09:13 +05:30
Ashish Sharma 8a8c4c175e fix(mbedtls): enable pthread threading by default 2026-02-11 17:59:04 +08:00
Ashish Sharma e06a7dd791 feat: adds new Kconfig variable for DS peripheral 2026-02-05 10:12:25 +08:00
Ashish Sharma 08f02b0faa change(mbedtls): update mbedTLS default configs 
1. Disables MBEDTLS_ARIA_C by default
2. SECP192R1 support is disabled by default
 2026-02-03 14:55:44 +08:00
harshal.patil 7750c40c45 feat(mbedlts/hmac): Support HMAC(MD5) using the MD5 driver 2026-01-31 00:45:12 +05:30
harshal.patil e91d50ed1e fix(mbedtls): Support partial hardware AES-GCM and s/w fallback for non-AES ciphers 
- Support software-fallback for unsupported hardware AES lengths
 2026-01-03 12:17:50 +05:30
Ashish Sharma 7310184949 feat: migrates mbedtls to PSA APIs 2025-12-30 09:31:49 +05:30
Ashish Sharma 69ea28c886 feat: add Kconfig option for mbedTLS 4.x 2025-12-01 14:05:05 +08:00
Ashish Sharma acf89924c8 feat(esp_http): migrate esp_http to PSA API 2025-10-26 10:13:14 +08:00
Peter Dragun e3198fff3c feat: Update esptool to v5 2025-09-30 15:28:55 +02:00
harshal.patil c36aef9c19 change(mbedtls/port): Wrap headers with relevant soc_caps 
- Needed to fix builds for the targets that are yet to supported
 2025-09-20 10:55:07 +05:30
harshal.patil 8992f08bef feat(mbedtls/aes): Add config to support AES block and DMA modes during runtime 
- Dynamically switch the AES operation modes based on the buffer operating length
- Shorter AES and SHA operations can now run faster and concurrently as well

Closes https://github.com/espressif/esp-idf/issues/15914
 2025-09-20 10:55:07 +05:30
Ashish Sharma 2b8703ef9f fix(mbedtls): enable ssl cookie support by default 2025-08-14 12:05:02 +08:00
Ashish Sharma d9c431268a feat(mbedtls): restructure mbedtls configuration page 2025-07-30 17:47:54 +08:00
Ashish Sharma f7be43c83d feat(mbedtls): adds more configuration options 2025-07-30 17:47:54 +08:00
harshal.patil c8e4b69e7f fix(mbedtls/gcm): Allow enabling GCM fallback only if software GCM is available 2025-07-24 12:42:57 +05:30
Mahavir Jain 7c792377e9 fix(mbedtls): remove Wunterminated-string-initialization 
- Fixed in upstream release 3.6.4
- Addressed few typos in Kconfig
 2025-07-04 09:59:20 +05:30
Ashish Sharma 9c546002cb feat(mbedtls): update to version 3.6.4 2025-07-03 11:23:34 +08:00
Ashish Sharma cabb5009f2 feat(esp_crt): adds support for cross signed root certificates 2025-06-26 16:01:11 +08:00
Zhang Xiao Yan 97f904b6fb Merge branch 'docs/fix_some_typos' into 'master' 
docs: Fix some typos

Closes DOC-10600, DOC-10605, DOC-10606, DOC-10607, DOC-10608, and DOC-10671

See merge request espressif/esp-idf!37977
 2025-04-30 18:35:40 +08:00
Shen Meng Jing 62d4115e08 docs: Fix some typos 2025-04-30 18:35:39 +08:00
Ashish Sharma 415e0f3c86 feat(mbedtls): add support for dynamic buffer for TLS1.3 
Closes https://github.com/espressif/esp-idf/issues/15448
 2025-04-24 12:05:36 +08:00
Laukik Hase 3fd107aa04 feat(mbedtls): Add support for ECDSA signing with TEE secure storage 2025-04-03 15:35:15 +05:30
Ashish Sharma b126ebb596 feat(mbedtls): new config to allow weak cert verification 2025-03-28 15:46:48 +08:00
harshal.patil e442f11320 feat(mbedtls): Make mbedtls SHA1 support configurable 2025-03-19 14:28:40 +05:30
harshal.patil 37de702e97 feat(nvs_flash): Enable the usage of mbedtls from ROM for bootloader NVS decryption 
Bootloader NVS decryption uses hardware ROM APIs to decrypt the NVS contents,
but for targets that do not support AES hardware we could benefit by using the
software mbedtls library that is present in the ROM directly.
 2025-01-29 18:51:29 +05:30
Aditya Patwardhan 839c18c762 feat(docs): Update minimizing binary size 
The ESP32-H2 software countermeasure may not be necessary
        for ESP32-H2 v1.2 and above, this commit updates
        the relevant documentation
 2025-01-24 11:50:17 +08:00
Aditya Patwardhan d8d9ba3dc2 fix(soc): Fixed ECDSA register compatibility 2025-01-24 11:50:17 +08:00
Mahavir Jain 6875cbf022 feat(ecc): enable ECC constant time mode for ESP32-H2 ECO5 2025-01-24 11:50:17 +08:00
harshal.patil c6ea979efa feat(hal/aes): Enable pseudo rounds function during AES operations 2024-12-03 11:17:54 +05:30
harshal.patil 4cdfdac18c fix(mbedtls): Fix the increase in build size of mbedtls when upgrading to v3.x 2024-10-24 14:45:57 +05:30
Aditya Patwardhan 1b770c3931 fix(mbedtls): Fix the MBEDTLS_FS_IO dependency on vfs 
By default MBEDTLS_FS_IO option in mbedtls uses the filesystem supported
added by vfs component.
If the vfs support is disabled by user then mbedtls raises a warning
that the filesystem realted operation shall always fail
This commit fixes the behaviour by enabling respective depedency check for the
MBEDTLS_FS_IO option

Closes https://github.com/espressif/esp-idf/issues/14409
 2024-09-30 13:43:29 +05:30
Aditya Patwardhan 11128b73f5 feat(hal): Add countermeasure for ECDSA generate signature 
The ECDSA peripheral before ECO5 of esp32h2 does not perform the ECDSA
    sign operation in constant time. This allows an attacker to read the
    power signature of the ECDSA sign operation and then calculate the
    ECDSA key stored inside the eFuse. The commit adds a countermeasure
    for this attack. In this case the real ECDSA sign operation is
    masked under dummy ECDSA sign operations to hide its real power
    signature
 2024-09-23 18:55:43 +08:00
JiangGuangMing ee9a072c82 feat(mbedtls): bringup rom mbedtls feature to formal 2024-09-13 16:40:20 +08:00
Jiang Guang Ming 5bb93061a3 feat(mbedtls): support rom mbedtls threading layer 2024-09-06 19:27:57 +08:00
Jiang Guang Ming d0ec6fc04d fix(mbedtls): MBEDTLS_CMAC_C not effective when MBEDTLS_USE_CRYPTO_ROM_IMPL enabled 2024-09-06 09:55:27 +08:00
Jiang Guang Ming d74ff5224c feat(mbedtls): support ROM mbedtls v3.6.0 on C2 rev2.0(ECO4) 2024-09-06 09:55:27 +08:00
harshal.patil c94986d793 fix(mbedtls): Fix https_request example build failure for mbedtls_config 
- This was caused due to some mbedtls confisg being defined but their all prerequisites were not
 2024-08-27 14:09:21 +05:30
Harshit Malpani e9acc309dc fix: Fixed build errors with TLS 1.3 only configuration 2024-07-24 13:31:07 +05:30