Mirrors/esp-idf
1
0
Fork 0
mirror of https://github.com/espressif/esp-idf.git synced 2026-09-28 09:14:28 +03:00
Code Issues Packages Projects Releases Wiki Activity
45,699 Commits 25 Branches 192 Tags
df3df94c58d58ecce2e152c1ef49f5ef8a2d4e49
Commit Graph
203 Commits
Author SHA1 Message Date
Aditya Patwardhan ef0b3dd4f9 change(secure_boot): mark ECDSA based Secure Boot V2 as insecure on affected SoCs 
ECDSA based Secure Boot V2 is not functional for certain input vectors on
ESP32-C5/C61/H2/P4 and on the preview targets ESP32-H4/H21. RSA based Secure
Boot V2 is the recommended scheme where the SoC supports it. This issue will be
fixed in a future hardware ECO revision; more details will be shared through the
hardware errata document.

A new hidden Kconfig option SECURE_BOOT_V2_ECDSA_INSECURE marks the affected
mass-production SoCs (ESP32-C5/C61/H2/P4). On these SoCs, when hardware Secure
Boot V2 is enabled, the ECDSA (V2) signing scheme is no longer offered by
default; it must be turned on explicitly via SECURE_BOOT_V2_FORCE_ENABLE_ECDSA
under "Allow potentially insecure options" (CONFIG_SECURE_BOOT_INSECURE). App
signing without hardware Secure Boot is not affected. Note that ESP32-C61 has no
RSA based Secure Boot V2, so it has no Secure Boot scheme enabled by default.

The preview targets ESP32-H4 and ESP32-H21 mark ECDSA Secure Boot V2 as not
supported in their SoC capabilities instead of using the option above. As
ESP32-H4 has no other Secure Boot V2 scheme, Secure Boot is disabled entirely on
it; ESP32-H21 retains RSA based Secure Boot V2.

The security documentation keeps the ECDSA Secure Boot V2 content visible and
adds a warning describing the limitation (including that ECDSA Secure Boot V2 on
ESP32-C61 is not recommended for production). CI apps that exercise ECDSA Secure
Boot V2 on the affected SoCs set CONFIG_SECURE_BOOT_V2_FORCE_ENABLE_ECDSA
accordingly.
 2026-06-19 15:26:43 +05:30
armando 604772875c fix(spm): rename scp (scratchpad) to spm (scratchpad memory) 2026-03-19 16:27:44 +08:00
armando 01942e4eef change(mem): deprecated tcm and added scp memory utils 2026-03-18 09:48:08 +08:00
Kapil Gupta f973a3292f docs: update vulnerabilities guide to mention CVE-2026-25532 2026-02-04 14:31:02 +05:30
Zhang Shuxian 7514c17c76 docs: implement comments 2025-11-28 10:19:15 +08:00
Zheng Zhong a4e05f49c0 fix : apply the suggestion from doc team 2025-11-28 10:19:15 +08:00
Zheng Zhong e3a34f5453 docs: fix some description in security guide docs 2025-11-28 10:19:08 +08:00
Shen Mengjing 8d9f3669c7 docs: Add the updated CN translation 2025-09-30 15:38:38 +05:30
harshal.patil dd3d58a315 fix(bootloader_support): Reorder write disabling ECDSA_CURVE_MODE 2025-09-30 15:38:27 +05:30
Zhang Hai Peng 96c2152f7f docs(ble): add advisory for CVE-2025-55297 found in Blufi example 
(cherry picked from commit 1952f0333c)

Co-authored-by: zhanghaipeng <zhanghaipeng@espressif.com>
 2025-08-25 17:53:34 +08:00
zhangyanjiao cf21272c94 fix(wifi): Added CVE-2025-52471 to vulnerabilities list 2025-06-30 11:49:10 +08:00
zhangyanjiao f373165b24 fix(wifi): Added CVE-2024-53845 to vulnerabilities list 2025-06-30 11:48:29 +08:00
harshal.patil 9276f7b294 fix(docs): Fix unterminated quotes in secure-boot-v2.rst 2025-05-02 15:16:39 +05:30
Aditya Patwardhan d2b7479f6f Merge branch 'refactor/security_docs_re-org_v5.4' into 'release/v5.4' 
refactor(docs): re-organize security docs for better navigation (v5.4)

See merge request espressif/esp-idf!36960
 2025-02-14 16:32:05 +08:00
Mahavir Jain 721b0de1b1 refactor(docs): re-organize security docs for better navigation 2025-02-14 11:45:04 +05:30
renpeiying 69f788024c docs: Update CN trans for security docs 2025-01-21 12:28:23 +05:30
harshal.patil b06a4c198a feat(bootloader_support): Permanently enable XTS-AES pseudo rounds when FE release mode is enabled 2025-01-21 12:28:23 +05:30
harshal.patil 7d803e661e feat(hal/aes): Enable pseudo rounds function during AES operations 2025-01-21 12:28:23 +05:30
renpeiying 46770a50a6 docs: standardize the names of bootloaders in esp-idf 2024-10-23 11:29:24 +08:00
Aditya Patwardhan 6dc8fe3db3 Merge branch 'docs/update_cn_trans_for_secure_boot_v2' into 'master' 
docs: Update CN translation for secure-boot-v2.rst

Closes DOC-9082

See merge request espressif/esp-idf!33895
 2024-10-08 15:13:59 +08:00
Mahavir Jain 27bcb047b4 Merge branch 'feature/qemu_doc_guide_updates' into 'master' 
docs: misc updates to qemu guide, now enabled for ESP32-S3

See merge request espressif/esp-idf!33854
 2024-10-08 12:45:23 +08:00
Zhang Shuxian 808a82de81 docs: Update CN translation for secure-boot-v2.rst 2024-10-08 11:09:40 +08:00
Mahavir Jain c90dd52974 Merge branch 'feat/newlib-sbom-exclude_cve-2024-30949' into 'master' 
fix(newlib): sbom: add CVE-2024-30949 to cve-exclude-list

See merge request espressif/esp-idf!33947
 2024-10-03 12:30:44 +08:00
Alexey Lapshin c4acf3faad fix(newlib): sbom: add CVE-2024-30949 to cve-exclude-list 2024-10-02 18:01:14 +07:00
Aditya Patwardhan 2c11c2ab81 fix(docs): Fix secure boot v2 documentation 
Update the secure boot v2 documentation
    about the limitation of read-protection
    when secure boot is enabled

    Closes https://github.com/espressif/esp-idf/issues/14587
 2024-10-01 11:56:37 +08:00
Mahavir Jain 1e94096e16 docs: update qemu guide for efuse commands 
- add mention of qemu guide in security related chapters
- also added a note about secure boot v2 config in qemu workflow
 2024-09-27 13:36:15 +05:30
Lucas DekkerandAditya Patwardhan 232f219321 docs: Explain revocation of unused but compromised keys 
Explain the revocation of unused but compromised keys.

docs: Apply updates from code review

Add some nitpicks from AdityaHPatwardhan.

Closes  https://github.com/espressif/esp-idf/pull/14563

Co-authored-by: Aditya Patwardhan <aditya.patwardhan@espressif.com>
 2024-09-23 12:23:28 +05:30
Mahavir Jain 2b806c9772 Merge branch 'feature/update_security_docs_for_c61' into 'master' 
feat: update security documents for ESP32C61

Closes IDF-10154, IDF-10155, IDF-10156, IDF-10157, and IDF-10158

See merge request espressif/esp-idf!31959
 2024-09-03 19:11:09 +08:00
nilesh.kale 3550e36a68 feat: updated security docs for ESP32C5 
This commit modified document files for ESP32C5.
This revised chnages for security components, RNG, provisioning and
some minor changes in sample output for flash encryption example.
 2024-09-02 11:50:07 +05:30
nilesh.kale 1011cee7a7 feat: udpate security docs for c61 and c5 
This commit update security documents for ESP32C61.
 2024-09-02 11:04:38 +05:30
harshal.patil e5f22521da docs(secure_boot_v2): Mention idf.py and openssl commands to generate and verify signatures 
- Adds support for verify_signature command in idf.py

Closes https://github.com/espressif/esptool/issues/942
 2024-08-27 15:44:05 +05:30
harshal.patilandZhang Shuxian 03a15664ee change(bootloader_support/secure_boot): Improve description of the config SECURE_BOOT_V2_ALLOW_EFUSE_RD_DIS 
Co-authored-by: Zhang Shuxian <zhangshuxian@espressif.com>
 2024-08-21 16:32:54 +05:30
Mahavir Jain 3ec400b332 docs(security): fix ESP32-C3 minimum supported revision for secure boot v2 
Closes https://github.com/espressif/esp-idf/issues/14377
 2024-08-16 15:04:28 +05:30
renpeiying afd3179ae8 docs: Provide Chinese translation for host-based-security-workflows.rst 2024-08-08 11:03:24 +08:00
nilesh.kale 3aa448ee0d fix: disable config for RSA during secure boot 
support for RSA secure boot is disabled for ESP32-ECO0 due to
hardware issue. It will be re-enabled in future version ECO1.

For ESP32C5- ECO0 , ECDSA secure boot is the recommended option.
 2024-07-12 12:40:11 +05:30
Mahavir Jain f5f85803a2 docs(security): use target specific macro for bootloader flash offset 2024-07-09 09:43:16 +05:30
shenmengjing 3cb4880d02 docs: Add often used espefuse subcommands to idf.py 2024-07-03 17:55:26 +08:00
Jiang Jiang Jian 15219e2a7e Merge branch 'docs/phase2_auth_update' into 'master' 
docs: Adds document for wifi PEAP phase 2 authentication security advisory.

See merge request espressif/esp-idf!31829
 2024-07-02 10:36:44 +08:00
kindaTall 4259df3d56 docs(security): fix typo for key purpose field in flash encryption guide 2024-07-01 12:21:49 +00:00
aditi df9680b827 docs: Adds document for wifi PEAP phase 2 authentication security advisory. 2024-07-01 14:50:13 +05:30
harshal.patil 4d6cb7bf23 docs(secure_boot): Add secure boot signature verification time for esp32p4 2024-06-21 21:59:55 +05:30
Mahavir Jain 2a4f227c5c docs: add page to summarize the security vulnerabilities and advisories 2024-06-19 10:06:01 +08:00
shenmengjing 85557380dd docs: Update the CN translation for three docs in security 2024-06-12 19:01:11 +08:00
Jan Beran 950428c2f4 feat(tools): Add often used espefuse subcommands to idf.py 2024-06-07 16:23:17 +02:00
Aditya Patwardhan 874388c628 Merge branch 'feature/enable_flash_encryption_for_c5' into 'master' 
feat: enable flash encryption support for c5

Closes IDF-8622 and IDF-9480

See merge request espressif/esp-idf!29578
 2024-06-07 14:30:39 +08:00
caixinying-git 64dca12e76 docs: provide CN translation for security/secure-boot-v2.rst 2024-06-06 12:16:08 +08:00
Marius Vikhammer 21c111465a Merge branch 'docs/c61_support' into 'master' 
docs(c61): add docs build for C61

Closes IDF-9287

See merge request espressif/esp-idf!31182
 2024-06-04 18:13:38 +08:00
nilesh.kale d1fa51e3c9 feat: enable flash encryption support for c5 
This commit provide support for flash encryption feature in ESP32C5
 2024-06-04 14:10:21 +05:30
Aditya Patwardhan f412149dc9 Merge branch 'feat/enable_secure_boot_for_c5' into 'master' 
feat: enable secure boot for c5

Closes IDF-8623 and IDF-9478

See merge request espressif/esp-idf!29774
 2024-06-03 15:35:51 +08:00
Marius Vikhammer 2eb4cd3d84 docs(c61): add docs build for C61 2024-06-03 10:24:27 +08:00