nilesh.kale
97c2fcf66a
feat: update docs for ESP32H4 security chapters
2026-07-06 10:12:35 +05:30
Mahavir Jain
e1713f44fb
Merge branch 'fix/sb_digest_revocation_workflow' into 'master'
...
change(bootloader): honor SECURE_BOOT_ALLOW_UNUSED_DIGEST_SLOTS during first boot
See merge request espressif/esp-idf!49553
2026-06-11 13:34:01 +05:30
Mahavir Jain
8da7627526
change(bootloader): honor SECURE_BOOT_ALLOW_UNUSED_DIGEST_SLOTS during first boot
...
Previously the bootloader unconditionally revoked unused secure boot key
digest slots while permanently enabling secure boot on the first boot,
ignoring CONFIG_SECURE_BOOT_ALLOW_UNUSED_DIGEST_SLOTS. Now the config is
honored on this path too: when set, the unused digest slots are left
un-revoked. This is safe as long as the debug and download interfaces are
disabled.
Update the Kconfig help and the Secure Boot v2 guide (en and zh_CN)
accordingly.
2026-06-10 13:09:10 +05:30
Mahavir Jain
fa28dd8c12
docs(security): fix typos in security guides
...
- security.rst: remove duplicated word in OTA encryption note
- tee.rst: remove duplicated word in memory allocation note
- flash-encryption.rst: drop redundant phrase and fix subject-verb agreement
2026-06-10 13:09:09 +05:30
Aditya Patwardhan
67e10e2b56
change(secure_boot): mark ECDSA based Secure Boot V2 as insecure on affected SoCs
...
ECDSA based Secure Boot V2 is not functional for certain input vectors on
ESP32-C5/C61/H2/P4 and on the preview targets ESP32-H4/H21. RSA based Secure
Boot V2 is the recommended scheme where the SoC supports it. This issue will be
fixed in a future hardware ECO revision; more details will be shared through the
hardware errata document.
A new hidden Kconfig option SECURE_BOOT_V2_ECDSA_INSECURE marks the affected
mass-production SoCs (ESP32-C5/C61/H2/P4). On these SoCs, when hardware Secure
Boot V2 is enabled, the ECDSA (V2) signing scheme is no longer offered by
default; it must be turned on explicitly via SECURE_BOOT_V2_FORCE_ENABLE_ECDSA
under "Allow potentially insecure options" (CONFIG_SECURE_BOOT_INSECURE). App
signing without hardware Secure Boot is not affected. Note that ESP32-C61 has no
RSA based Secure Boot V2, so it has no Secure Boot scheme enabled by default.
The preview targets ESP32-H4 and ESP32-H21 mark ECDSA Secure Boot V2 as not
supported in their SoC capabilities instead of using the option above. As
ESP32-H4 has no other Secure Boot V2 scheme, Secure Boot is disabled entirely on
it; ESP32-H21 retains RSA based Secure Boot V2.
The security documentation keeps the ECDSA Secure Boot V2 content visible and
adds a warning describing the limitation (including that ECDSA Secure Boot V2 on
ESP32-C61 is not recommended for production). CI apps that exercise ECDSA Secure
Boot V2 on the affected SoCs set CONFIG_SECURE_BOOT_V2_FORCE_ENABLE_ECDSA
accordingly.
2026-06-09 16:55:57 +05:30
nilesh.kale
fe257f699e
feat: enable Secure Boot, Flash Encryption and Key Manager support for S31
2026-05-26 12:57:34 +08:00
Nilesh Kale
2fa9fba978
Merge branch 'feat/add_flash_encryption_support_for_esp32h4' into 'master'
...
feat: enable flash encryption support in ESP32H4
Closes IDF-12261, IDF-12969, and IDF-12506
See merge request espressif/esp-idf!45613
2026-05-20 17:45:13 +08:00
nilesh.kale
a530aab0a6
feat: enable key manager and HUK support for S31
2026-05-20 10:17:34 +05:30
nilesh.kale
cae147af08
feat: enable flash encryption for ESP32-H4
2026-05-20 09:29:20 +05:30
Ashish Sharma
96d8dbd781
docs(vulnerabilities): sync vulnerability list for 5 advisories
2026-05-19 17:42:56 +08:00
Jiang Jiang Jian
8f57c5232d
Merge branch 'feat/support_persistent_esp_rsa_ds_keys' into 'master'
...
Support persistent ESP RSA DS keys
Closes IDF-15427
See merge request espressif/esp-idf!46358
2026-05-15 15:42:54 +08:00
harshal.patil
4821f331fe
refactor(mbedtls/test): Move the mbedtls test app to support multiple test apps
2026-05-15 09:09:15 +05:30
renpeiying
d771b41400
docs: Update translation for security docs
2026-05-15 10:46:59 +08:00
Mahavir Jain
cee71ceb39
Merge branch 'feat/enable_secure_boot_support_for_esp32h4' into 'master'
...
feat: enable support for secure boot in esp32h4
Closes IDF-12262 and IDF-12966
See merge request espressif/esp-idf!45603
2026-05-13 19:07:25 +05:30
Laukik Hase
4f3f1dff5a
feat(esp_tee): Add some required fields in the attestation token
...
- Chip ID from the ROM
- Device MAC address from eFuse BLK1
- Device Optional Unique ID from eFuse BLK2
2026-05-11 16:29:19 +05:30
nilesh.kale
76e2e6d53f
feat: enable support for secure boot in esp32h4
2026-05-11 16:26:01 +05:30
Shen Mengjing
1e71307770
docs: Sync CN and EN docs missing the translation label
2026-05-11 14:08:45 +08:00
Ashish Sharma
cd38d68bd1
feat(bootloader_support): remove P192 curve support
2026-04-30 18:04:00 +08:00
nilesh.kale
f43d0dbadc
docs: added guide to transit from dev mode to release mode of FE
2026-04-01 13:55:12 +05:30
nilesh.kale
85b5e6a231
fix: added reference to example security/security_features_app in docs
2026-04-01 13:54:34 +05:30
Krzysztof
bb0b907448
docs(security): Standardize naming of digital signature hardware modules
2026-03-24 16:21:22 +08:00
Shen Mengjing
5c66b1f529
docs: Update CN translation for key manager related docs
2026-03-18 16:27:39 +05:30
harshal.patil
5f647c0ba3
docs(key-manager): Add Key-Manager peripheral related documentation
2026-03-18 16:27:39 +05:30
Armando (Dou Yiwen)
660b4d36bf
Merge branch 'change/deprecate_tcm_and_use_scp' into 'master'
...
fix(spm): rename scp (scratchpad) to spm (scratchpad memory)
See merge request espressif/esp-idf!46659
2026-03-17 08:38:18 +00:00
Mahavir Jain
7a6cff801f
Merge branch 'bugfix/external_mem_enc_docs' into 'master'
...
docs: update PSRAM and flash encryption docs with per-page and separate key capabilities
Closes FCS-1859
See merge request espressif/esp-idf!46238
2026-03-17 11:15:40 +05:30
armando
c60ed4b338
fix(spm): rename scp (scratchpad) to spm (scratchpad memory)
2026-03-17 01:29:34 +00:00
armando
c96f69faef
change(mem): deprecated tcm and added scp memory utils
2026-03-11 11:18:15 +08:00
Mahavir Jain
e6319ef712
docs: update PSRAM and flash encryption docs with per-page and separate key capabilities
2026-03-05 12:03:53 +05:30
Ashish Sharma
abe0d37d94
docs(security): adds data partition verification docs
2026-03-04 10:22:33 +08:00
Rahul Tank
d3c1584238
docs(protocomm): add advisory for 2 new CVE
2026-02-11 12:06:03 +05:30
Chen Jichang
b8c527a87c
refactor(flash_enc): move esp_flash_encryption_enabled() to efuse component
2026-02-05 11:42:08 +08:00
Mahavir Jain
f2635f98d9
Merge branch 'fix/externsive_mbedtls_aes_sha_tests' into 'master'
...
Re-introduce the extensive mbedtls AES and SHA tests
Closes SHA-512
See merge request espressif/esp-idf!45489
2026-02-04 18:33:57 +05:30
Kapil Gupta
d83df5d9ea
docs: update vulnerabilities guide to mention CVE-2026-25532
2026-02-04 12:23:06 +05:30
harshal.patil
2bc49effb4
test(mbedtls): Re-introduce the extensive AES, AES-GCM and the SHA tests
...
- Also extend the PSRAM encryption test to ESP32-S3
2026-02-02 16:58:01 +05:30
Marius Vikhammer
79950e4783
docs(esp32s31): add support for building docs for esp32s31
2026-01-28 09:42:24 +08:00
Aditya Patwardhan
4ca334d3a7
fix(docs): Fix docs after esp_hal_security update
2026-01-21 10:02:47 +05:30
Mahavir Jain
2948a46371
Merge branch 'refactor/tee_sec_stg_remove_r192' into 'master'
...
refactor(esp_tee): Remove support for ECDSA `secp192r1` keys in TEE secure storage
See merge request espressif/esp-idf!45118
2026-01-18 18:24:04 +05:30
Laukik Hase
85681d7586
refactor(esp_tee): Remove support for ECDSA secp192r1 keys in TEE secure storage
2026-01-16 17:53:16 +05:30
Laukik Hase
2a0dffc437
docs(esp_tee): Update the TEE attestation documentation for the PSA interface
2026-01-16 12:28:59 +05:30
Jin Cheng
c1fdcddac4
docs: update vulnerabilities guide to mention CVE-2025-68473 and CVE-2025-68474
2025-12-25 13:40:14 +08:00
Jin Cheng
bdf9592803
docs: update vulnerabilities guide to mention CVE-2025-66409
2025-12-11 14:10:54 +08:00
Mahavir Jain
81c961a656
Merge branch 'refactor/esp_tee_soc_cap' into 'master'
...
feat(esp_tee): Mark ESP32-H2 as a supported target for ESP-TEE
See merge request espressif/esp-idf!43434
2025-12-08 14:11:15 +05:30
Laukik Hase
90d6394911
feat(esp_tee): Support ECDSA secp384r1 keys in TEE secure storage
2025-12-04 11:16:29 +05:30
Zhang Shu Xian
9ced000ac2
Merge branch 'docs/fix_some_expressions_in_security_guide' into 'master'
...
docs: fix some description in security guide docs
See merge request espressif/esp-idf!42083
2025-12-01 14:24:51 +08:00
Zheng Zhong
0c0b9c7d89
docs: fix some description in security guide docs
2025-12-01 14:24:51 +08:00
Mahavir Jain
20b1b14c5d
docs: update vulnerabilities guide to mention new CVEs
2025-11-26 10:08:12 +05:30
Laukik Hase
c88f9c3be1
feat(esp_tee): Mark ESP32-H2 as a supported target for ESP-TEE
2025-11-25 10:13:31 +05:30
Laukik Hase
7a1ab62cf7
docs(esp_tee): Enable ESP-TEE documentation for ESP32-C61
2025-11-12 12:48:27 +05:30
Laukik Hase
afe8fea489
docs(esp_tee): Enable ESP-TEE documentation for ESP32-C5
2025-10-06 18:49:01 +05:30
Peter Dragun
e3198fff3c
feat: Update esptool to v5
2025-09-30 15:28:55 +02:00
