Ashish Sharma
b912691fcd
refactor(app_update): rename SECURE_SIGNED_DATA_PARTITION Kconfig option
2026-08-12 08:39:18 +05:30
Marius Vikhammer
4d332f710e
docs(kconfig): update kconfig ref links to use menuitem
2026-08-11 11:19:45 +02:00
Aditya Patwardhan
bbe2a7d984
docs(security): show ECDSA-P384 Secure Boot notes only on targets supporting it
...
Gate these notes on SOC_SECURE_BOOT_V2_ECC in addition to the ECDSA
peripheral P-384 capability, so they are not rendered for targets
without the ECDSA Secure Boot scheme.
2026-07-15 12:40:20 +05:30
nilesh.kale
97c2fcf66a
feat: update docs for ESP32H4 security chapters
2026-07-06 10:12:35 +05:30
Mahavir Jain
e1713f44fb
Merge branch 'fix/sb_digest_revocation_workflow' into 'master'
...
change(bootloader): honor SECURE_BOOT_ALLOW_UNUSED_DIGEST_SLOTS during first boot
See merge request espressif/esp-idf!49553
2026-06-11 13:34:01 +05:30
Mahavir Jain
8da7627526
change(bootloader): honor SECURE_BOOT_ALLOW_UNUSED_DIGEST_SLOTS during first boot
...
Previously the bootloader unconditionally revoked unused secure boot key
digest slots while permanently enabling secure boot on the first boot,
ignoring CONFIG_SECURE_BOOT_ALLOW_UNUSED_DIGEST_SLOTS. Now the config is
honored on this path too: when set, the unused digest slots are left
un-revoked. This is safe as long as the debug and download interfaces are
disabled.
Update the Kconfig help and the Secure Boot v2 guide (en and zh_CN)
accordingly.
2026-06-10 13:09:10 +05:30
Aditya Patwardhan
67e10e2b56
change(secure_boot): mark ECDSA based Secure Boot V2 as insecure on affected SoCs
...
ECDSA based Secure Boot V2 is not functional for certain input vectors on
ESP32-C5/C61/H2/P4 and on the preview targets ESP32-H4/H21. RSA based Secure
Boot V2 is the recommended scheme where the SoC supports it. This issue will be
fixed in a future hardware ECO revision; more details will be shared through the
hardware errata document.
A new hidden Kconfig option SECURE_BOOT_V2_ECDSA_INSECURE marks the affected
mass-production SoCs (ESP32-C5/C61/H2/P4). On these SoCs, when hardware Secure
Boot V2 is enabled, the ECDSA (V2) signing scheme is no longer offered by
default; it must be turned on explicitly via SECURE_BOOT_V2_FORCE_ENABLE_ECDSA
under "Allow potentially insecure options" (CONFIG_SECURE_BOOT_INSECURE). App
signing without hardware Secure Boot is not affected. Note that ESP32-C61 has no
RSA based Secure Boot V2, so it has no Secure Boot scheme enabled by default.
The preview targets ESP32-H4 and ESP32-H21 mark ECDSA Secure Boot V2 as not
supported in their SoC capabilities instead of using the option above. As
ESP32-H4 has no other Secure Boot V2 scheme, Secure Boot is disabled entirely on
it; ESP32-H21 retains RSA based Secure Boot V2.
The security documentation keeps the ECDSA Secure Boot V2 content visible and
adds a warning describing the limitation (including that ECDSA Secure Boot V2 on
ESP32-C61 is not recommended for production). CI apps that exercise ECDSA Secure
Boot V2 on the affected SoCs set CONFIG_SECURE_BOOT_V2_FORCE_ENABLE_ECDSA
accordingly.
2026-06-09 16:55:57 +05:30
nilesh.kale
fe257f699e
feat: enable Secure Boot, Flash Encryption and Key Manager support for S31
2026-05-26 12:57:34 +08:00
Nilesh Kale
2fa9fba978
Merge branch 'feat/add_flash_encryption_support_for_esp32h4' into 'master'
...
feat: enable flash encryption support in ESP32H4
Closes IDF-12261, IDF-12969, and IDF-12506
See merge request espressif/esp-idf!45613
2026-05-20 17:45:13 +08:00
nilesh.kale
a530aab0a6
feat: enable key manager and HUK support for S31
2026-05-20 10:17:34 +05:30
nilesh.kale
cae147af08
feat: enable flash encryption for ESP32-H4
2026-05-20 09:29:20 +05:30
Jiang Jiang Jian
8f57c5232d
Merge branch 'feat/support_persistent_esp_rsa_ds_keys' into 'master'
...
Support persistent ESP RSA DS keys
Closes IDF-15427
See merge request espressif/esp-idf!46358
2026-05-15 15:42:54 +08:00
harshal.patil
4821f331fe
refactor(mbedtls/test): Move the mbedtls test app to support multiple test apps
2026-05-15 09:09:15 +05:30
renpeiying
d771b41400
docs: Update translation for security docs
2026-05-15 10:46:59 +08:00
nilesh.kale
76e2e6d53f
feat: enable support for secure boot in esp32h4
2026-05-11 16:26:01 +05:30
Shen Mengjing
1e71307770
docs: Sync CN and EN docs missing the translation label
2026-05-11 14:08:45 +08:00
Ashish Sharma
cd38d68bd1
feat(bootloader_support): remove P192 curve support
2026-04-30 18:04:00 +08:00
nilesh.kale
f43d0dbadc
docs: added guide to transit from dev mode to release mode of FE
2026-04-01 13:55:12 +05:30
nilesh.kale
85b5e6a231
fix: added reference to example security/security_features_app in docs
2026-04-01 13:54:34 +05:30
Zhang Shuxian
86403c2cfc
docs: Update CN translation for name change
2026-03-24 17:16:56 +08:00
Shen Mengjing
5c66b1f529
docs: Update CN translation for key manager related docs
2026-03-18 16:27:39 +05:30
harshal.patil
5f647c0ba3
docs(key-manager): Add Key-Manager peripheral related documentation
2026-03-18 16:27:39 +05:30
Armando (Dou Yiwen)
660b4d36bf
Merge branch 'change/deprecate_tcm_and_use_scp' into 'master'
...
fix(spm): rename scp (scratchpad) to spm (scratchpad memory)
See merge request espressif/esp-idf!46659
2026-03-17 08:38:18 +00:00
Mahavir Jain
7a6cff801f
Merge branch 'bugfix/external_mem_enc_docs' into 'master'
...
docs: update PSRAM and flash encryption docs with per-page and separate key capabilities
Closes FCS-1859
See merge request espressif/esp-idf!46238
2026-03-17 11:15:40 +05:30
armando
c60ed4b338
fix(spm): rename scp (scratchpad) to spm (scratchpad memory)
2026-03-17 01:29:34 +00:00
armando
c96f69faef
change(mem): deprecated tcm and added scp memory utils
2026-03-11 11:18:15 +08:00
Mahavir Jain
e6319ef712
docs: update PSRAM and flash encryption docs with per-page and separate key capabilities
2026-03-05 12:03:53 +05:30
Ashish Sharma
abe0d37d94
docs(security): adds data partition verification docs
2026-03-04 10:22:33 +08:00
Chen Jichang
b8c527a87c
refactor(flash_enc): move esp_flash_encryption_enabled() to efuse component
2026-02-05 11:42:08 +08:00
harshal.patil
2bc49effb4
test(mbedtls): Re-introduce the extensive AES, AES-GCM and the SHA tests
...
- Also extend the PSRAM encryption test to ESP32-S3
2026-02-02 16:58:01 +05:30
Marius Vikhammer
79950e4783
docs(esp32s31): add support for building docs for esp32s31
2026-01-28 09:42:24 +08:00
Aditya Patwardhan
4ca334d3a7
fix(docs): Fix docs after esp_hal_security update
2026-01-21 10:02:47 +05:30
Mahavir Jain
81c961a656
Merge branch 'refactor/esp_tee_soc_cap' into 'master'
...
feat(esp_tee): Mark ESP32-H2 as a supported target for ESP-TEE
See merge request espressif/esp-idf!43434
2025-12-08 14:11:15 +05:30
Zheng Zhong
0c0b9c7d89
docs: fix some description in security guide docs
2025-12-01 14:24:51 +08:00
Laukik Hase
c88f9c3be1
feat(esp_tee): Mark ESP32-H2 as a supported target for ESP-TEE
2025-11-25 10:13:31 +05:30
Laukik Hase
7a1ab62cf7
docs(esp_tee): Enable ESP-TEE documentation for ESP32-C61
2025-11-12 12:48:27 +05:30
Laukik Hase
afe8fea489
docs(esp_tee): Enable ESP-TEE documentation for ESP32-C5
2025-10-06 18:49:01 +05:30
Peter Dragun
e3198fff3c
feat: Update esptool to v5
2025-09-30 15:28:55 +02:00
Zhang Shuxian
ff8c82169f
docs: Correct wrong description in secure-boot-v2.rst
2025-09-26 17:23:05 +08:00
WanqQixiang
6b503d0db5
component: Remove wifi_provisioning component and esp_prov tool
2025-09-26 09:48:50 +08:00
Shen Mengjing
71f8405742
docs: Add the updated CN translation
2025-09-19 17:01:29 +05:30
harshal.patil
60ff4bca9b
refactor(esp_system): Update all references of the memory protection configs
2025-08-04 11:43:01 +05:30
Zhang Shuxian
b615ab5a40
docs: Update CN translation for secure boot
2025-07-22 19:14:46 +08:00
Marius Vikhammer
f3d1717408
docs(esp32h4): support building esp32h4 docs
2025-05-13 11:09:15 +08:00
nilesh.kale
4722f49bc7
feat: update documentation for esp32h21
...
This also updated log files for other targets to make consistent.
2025-05-12 12:07:36 +05:30
Zhang Shuxian
111e453c4d
docs: Update CN translation for Secure Boot
2025-04-30 14:20:45 +08:00
harshal.patil
75fd14efbc
fix(docs): Fix unterminated quotes in secure-boot-v2.rst
2025-04-21 11:18:22 +05:30
Marius Vikhammer
1e72b10b26
docs(build): add support for building H21 docs
2025-01-26 11:44:28 +08:00
Mahavir Jain
e1a737e401
refactor(docs): re-organize security docs for better navigation
2025-01-09 09:35:12 +05:30
Laukik Hase
cb84119600
docs(esp_tee): Added documentation for the ESP-TEE framework
...
- Co-authored-by: Shen Meng Jing <shenmengjing@espressif.com >
2025-01-08 11:37:42 +05:30
