Mirrors/esp-idf
1
0
Fork 0
mirror of https://github.com/espressif/esp-idf.git synced 2026-10-02 11:10:54 +03:00
Code Issues Packages Projects Releases Wiki Activity
49,628 Commits 25 Branches 192 Tags
e9ea55bea2a6d01437cf6e8fd4a8d3a60460bfc0
Commit Graph
100 Commits
This Branch
This Branch
All Branches
Author SHA1 Message Date
harshal.patil e9ea55bea2 feat(mbedtls/ecdsa): Introduce PSA ECDSA driver 2026-01-19 09:14:37 +05:30
harshal.patil 488ee5dfbc fix(mbedtls/aes): Cache invalidate the output buffer before the AES-DMA operation 
Instead of performing the cache-to-memory (C2M) operation on the output buffer,
even a cache invalidate (M2C) is sufficient to ensure that no write-back occurs
during the DMA write operation
 2026-01-07 23:40:59 +05:30
Harshal Patil eec7e5bb64 Merge branch 'fix/partial-hardware-aes-gcm-and-software-non-aes-ciphers' into 'master' 
Fix partial hardware AES-GCM, software-fallback for non-AES ciphers

Closes IDF-12474, IDF-15050, and IDF-15051

See merge request espressif/esp-idf!44616
 2026-01-05 18:34:34 +05:30
harshal.patil e91d50ed1e fix(mbedtls): Support partial hardware AES-GCM and s/w fallback for non-AES ciphers 
- Support software-fallback for unsupported hardware AES lengths
 2026-01-03 12:17:50 +05:30
harshal.patil 35b305f916 fix(mbedlts/aes): Ensure cache coherency when DMA writes to cacheable PSRAM buffers 2025-12-26 12:26:36 +05:30
harshal.patil 60637470c2 test(ota): Add tests for verifying app build's SBv2 ECDSA signature verify APIs 2025-12-23 23:24:46 +05:30
harshal.patil bf16835aa1 test(mbedtls): Run mbedtls HW tests only if HW enabled 2025-12-16 10:05:25 +05:30
harshal.patil 2f3fdba22f fix(mbedtls/aes): Reallocate buffers only if in external RAM 2025-12-12 14:44:24 +05:30
harshal.patil 37251c2ce2 test(mbedtls): add more tests for alignment, buffer size related 
- Also, enabled Flash Encryption enabled tests for ESP32-C5
- Removed ESP32-P4 specific configs, as those configs are set as default now
 2025-12-12 14:44:22 +05:30
harshal.patil 4263319f27 fix(secure_boot): Application's Secure Boot verify API support ECDSA-P384 2025-12-12 12:33:49 +05:30
harshal.patil 19cddd6739 fix(key_mgr): Correct XTS-AES key length register configuration 
The key_mgr_ll_set_xts_aes_key_len() function was incorrectly using
REG_SET_FIELD() with the key_len enum value directly. Since
KEYMNG_FLASH_KEY_LEN is a 1-bit register field (0=128-bit, 1=256-bit),
writing ESP_KEY_MGR_XTS_AES_LEN_128 (value 3) resulted in the LSB (1)
being stored, incorrectly configuring 256-bit mode.

Fixed by using a switch statement to properly map:
- ESP_KEY_MGR_XTS_AES_LEN_128 → REG_CLR_BIT (0)
- ESP_KEY_MGR_XTS_AES_LEN_256 → REG_SET_BIT (1)

Thus, matching the correct ESP32-C5 implementation.
 2025-12-04 13:56:00 +05:30
harshal.patil 55fd8a5fb2 fix(mbedtls/port): Use internal buffers to perform chunkwise operations 
when the external input and output buffers are unaligned.
This also fixes as a recursion loop that occurs when the size of the input
buffer is not aligned to dcache_line_size but is aligned to AES_BLOCK_BYTES
 2025-12-01 14:43:10 +05:30
Harshal Patil b873a82d5b Merge branch 'feat/generic_key_mgr_key_types' into 'master' 
Store key_len field in the key_config

See merge request espressif/esp-idf!42692
 2025-11-18 15:12:03 +05:30
harshal.patil 1c1bcf44be feat(esp_security): Support ECDSA-P384 key deployment using Key Manager 2025-11-17 12:34:09 +05:30
harshal.patil dac0bbfcc2 change(mbedtls): Generalize key source union for the hardware ECDSA context 2025-11-17 12:34:09 +05:30
harshal.patil 1f2cbde525 change(esp_key_mgr): Store key_len field in the key_info 
- Update the Key Manager key types to be generic
- Define a new enum to determine the length of the keys
- Refactor the Key Manager driver support generic key types and key lengths
- Also store key deployment mode in the key recovery info
 2025-11-17 12:34:09 +05:30
harshal.patil 25fe0d6786 test(examples): Fix cert bundle stress test 2025-11-13 12:34:56 +05:30
Harshal Patil 0debe71b3d Merge branch 'feat/flash_enc_using_key_manager' into 'master' 
Support Flash Encryption using Key Manager

Closes IDF-13462 and IDF-14278

See merge request espressif/esp-idf!41879
 2025-11-13 07:55:15 +05:30
harshal.patil 0c3c284819 feat(bootloader_support): Support FE XTS-AES-256 using Key Manager for ESP32-C5 2025-11-11 12:23:27 +05:30
harshal.patil f73cfa5def fix(hal): Force HUK power up when configuring HUK for ESP32-C5 2025-11-11 12:23:27 +05:30
harshal.patil 38f8b57fe5 feat(flash_encryption): Remove mspi reset when switching the XTS-AES key source 2025-11-11 12:23:27 +05:30
harshal.patil c9417e418b change(bootloader_support): Rename the esp_flash_encryption_enable_key_mgr() API 2025-11-11 12:23:26 +05:30
harshal.patil 540c719c66 change(esp_key_mgr): Make Key Manager driver bootloader compatible 
- Independent of heap
 2025-11-11 12:23:26 +05:30
harshal.patil 8abea3c537 feat(bootloader_support): Support Flash Encryption using Key Manager 2025-11-11 12:23:25 +05:30
harshal.patil 304bd1c77b fix(esp_security/esp_key_mgr): Fix missed error codes and some cleanup 2025-11-11 12:22:08 +05:30
Harshal Patil ed57a94687 Merge branch 'feat/extend_pmp_protection_esp32p4_eco5' into 'master' 
Extend PMP memprot for ESP32-P4 V3

Closes IDF-14075

See merge request espressif/esp-idf!42402
 2025-11-11 10:07:21 +05:30
harshal.patil a6de2c79ed fix(mbedtls/port): Align AES and SHA DMA buffers to 16 when SPIRAM encryption is enabled 
- Targets that support GDMA and MSPI encryption module need data and addresses aligned to 16
 2025-11-06 12:28:19 +05:30
harshal.patil c66ef46f99 feat(cpu_region_protect): Extend PMP memprot for ESP32-P4 V3 2025-11-05 13:34:47 +05:30
harshal.patil 3090e91e60 fix(esp_security): Set WR_DIS_SECURE_BOOT_SHA384_EN by default when 
Flash Encryption Release mode is enabled and Secure Boot P384 scheme not is enabled.
 2025-11-05 08:39:55 +05:30
harshal.patil 7168b9f7d3 fix(esp_security): Fix undefined efuse build failure in case of ESP32-P4 
- The `wr_dis` efuse bit corresponding to `SECURE_BOOT_SHA384_EN` is absent in P4
 2025-11-05 08:39:55 +05:30
harshal.patil 86b52c4f64 change(efuse): Fix the incorrect efuse field name of SECURE_BOOT_EN_SHA384 2025-11-05 08:39:50 +05:30
harshal.patil 9840685b2d fix(build_system): Add Bootloader and Partition Table as dependencies for encrypted-flash 
- If ESP-TEE is enabled, also add it as the dependency for the encrypted-flash target
 2025-10-31 14:15:26 +05:30
harshal.patil fbcb51653a fix(hal): Fix MMU PSRAM anti-fi MMU target check 
In case of ESP32-C5 and ESP32-C61, mmu_ids for PSRAM and Flash
MMU are the same due to their shared memory space. Thus, instead of
mmu_id we should use mmu_target_t.
 2025-10-27 19:10:48 +05:30
harshal.patil 609d52c6bf feat(esp32p4): Support newer Key Manager key sources for ESP32-P4 V3 2025-10-15 15:49:20 +05:30
Harshal Patil f088a128ac Merge branch 'test/set_minimal_build_for_security_test_apps' into 'master' 
test(security): Use minimal build in the security test apps

Closes IDF-14203

See merge request espressif/esp-idf!42292
 2025-09-30 11:38:21 +05:30
harshal.patil 1d4a634b98 test(security): Use minimal build in the security test apps 2025-09-30 10:52:03 +05:30
Harshal Patil fd7d9c9ee9 Merge branch 'fix/key_mgr_use_default_efuse_key' into 'master' 
Configure the Key Manager to use XTS-AES efuse key by-default

Closes IDFCI-3135 and IDFCI-3136

See merge request espressif/esp-idf!42032
 2025-09-26 12:34:19 +05:30
Harshal Patil c6e65586e3 Merge branch 'feat/support_aes_block_and_dma_modes_during_runtime' into 'master' 
Support AES block and DMA modes during runtime

Closes IDFGH-15251 and IDF-2594

See merge request espressif/esp-idf!40917
 2025-09-23 19:46:49 +05:30
harshal.patil 8b663ebe4d fix(esp_security): Configure the Key Manager to use XTS-AES efuse key by-default 2025-09-22 12:22:07 +05:30
harshal.patil ade76189c5 test(hal/crypto): Update AES test app to remove redundant block operation 2025-09-20 10:55:07 +05:30
harshal.patil c36aef9c19 change(mbedtls/port): Wrap headers with relevant soc_caps 
- Needed to fix builds for the targets that are yet to supported
 2025-09-20 10:55:07 +05:30
harshal.patil 8992f08bef feat(mbedtls/aes): Add config to support AES block and DMA modes during runtime 
- Dynamically switch the AES operation modes based on the buffer operating length
- Shorter AES and SHA operations can now run faster and concurrently as well

Closes https://github.com/espressif/esp-idf/issues/15914
 2025-09-20 10:55:07 +05:30
harshal.patil 5aa5366e7f fix(bootloader_support): Reorder write disabling ECDSA_CURVE_MODE 2025-09-19 17:01:23 +05:30
harshal.patil 6be7a17ce0 fix(bootloader_support): Allow pre-programmed XTS-AES psuedo round level efuses 
- The API esp_flash_encryption_set_release_mode() by defualt programs
the XTS-AES pseudo round level efuse to level low but did not considered
any existing value that would have been programmed in the efuse bit.
 2025-09-19 13:55:50 +05:30
harshal.patil d6c1184676 fix(bootloader_support): Reorder write protection bits of some shared security efuses 2025-09-19 13:02:00 +05:30
Harshal Patil de36c80335 Merge branch 'fix/key_mgr_state_management' into 'master' 
Fix incorrect key manager state management

See merge request espressif/esp-idf!41796
 2025-09-12 17:09:52 +05:30
harshal.patil 854ec3590f fix(esp_key_mgr): Fix incorrect key manager state management 2025-09-12 11:02:45 +05:30
Harshal Patil 511292ba41 Merge branch 'fix/disable_efuse_xts_aes_256_esp32c5' into 'master' 
Disable XTS-AES-256 using efuse key for ESP32-C5

See merge request espressif/esp-idf!41348
 2025-08-20 21:33:39 +05:30
harshal.patil d59bcb633c fix(soc): Disable XTS-AES-256 using efuse key for ESP32-C5 2025-08-19 21:54:26 +05:30
harshal.patil da5dda1131 fix(esp_tee): Fix build failure due to ECDSA-P384 2025-08-15 12:10:36 +05:30
Harshal Patil 2f15501cae Merge branch 'ci/enable_flash_enc_test_esp32p4' into 'master' 
Enable flash encryption test case for ESP32-P4 in the CI

Closes IDF-10982

See merge request espressif/esp-idf!41026
 2025-08-13 09:46:04 +05:30
harshal.patil 16873520fd ci(flash_enc): Extend flash encryption and mbedtls test case to test PSRAM encryption 2025-08-12 11:29:00 +05:30
harshal.patil 9e87b50307 change(mbedtls/ecdsa): The ECDSA module of ESP32-H2 ECO5 does not use MPI module 2025-08-11 12:08:51 +05:30
Harshal Patil eae2f70381 Merge branch 'change/remove_esp_security_dependency_from_esp_hw_support' into 'master' 
Move security-related modules present in esp_hw_support component to esp_security

Closes IDF-10733

See merge request espressif/esp-idf!39490
 2025-08-06 06:27:12 +05:30
harshal.patil 60ff4bca9b refactor(esp_system): Update all references of the memory protection configs 2025-08-04 11:43:01 +05:30
harshal.patil abaef73667 refactor(esp_system): Place all memory protection options under one option 2025-08-04 11:43:01 +05:30
harshal.patil 5c6c73ece4 change(riscv): Remove redundant definition of MEMPROT_ISR 2025-08-04 11:43:01 +05:30
harshal.patil d70b5000cc remove(esp_hw_support): Remove redundant and unsupported memprot mentions 2025-08-04 11:43:01 +05:30
harshal.patil 55e0730a8d change(esp_hw_support): Move security-related modules to the esp_security component 
- Also adds support to whitelist target specific expected dependency violations
in check_dependencies.py
 2025-08-04 11:43:01 +05:30
Harshal Patil 7043cbf615 Merge branch 'docs/update_bootloader_max_size' into 'master' 
docs(bootloader): Update the maximum supported bootloader size

See merge request espressif/esp-idf!40787
 2025-07-24 17:34:06 +05:30
harshal.patil 35944b8a4d docs(bootloader): Change the default value of maximum supported bootloader size 2025-07-24 15:56:41 +05:30
Harshal Patil 8ab9e36eec Merge branch 'docs/update_bootloader_max_size' into 'master' 
Update the maximum supported bootloader size

See merge request espressif/esp-idf!40506
 2025-07-24 15:42:40 +05:30
harshal.patil c8e4b69e7f fix(mbedtls/gcm): Allow enabling GCM fallback only if software GCM is available 2025-07-24 12:42:57 +05:30
harshal.patil f4b329386f docs(bootloader): Update the maximum supported bootloader size 2025-07-23 11:17:54 +05:30
harshal.patil 4fc9fd4891 fix(esp_system): Remove redundant crypto clock source selection 2025-07-21 09:19:42 +05:30
harshal.patil 94019776bd ci(security): Security test app updated yml 
- Also fixes the errors generated by the check-test-scripts command
 2025-07-21 09:19:42 +05:30
harshal.patil dbcaddb745 docs(secure-boot-v2): Update the signature verification timings 
- THe timings are calculated for the ROM verifying the bootloader's signature
 2025-07-21 09:19:42 +05:30
harshal.patil 37e5c0701a docs(secure_boot_v2): Add documentation for Secure Boot V2 using ECDSA-P384 2025-07-21 09:19:42 +05:30
harshal.patil 0f51640674 test(secure_boot): Add tests for ECDSA-based secure boot scheme 2025-07-21 09:19:42 +05:30
harshal.patil 5699619606 test(examples/efuse): Add test for secure boot v2 using ecdsa-p384 2025-07-21 09:19:42 +05:30
harshal.patil 130e72f82b feat(bootloader_support): Support Secure Boot using ECDSA-P384 curve 2025-07-21 09:19:42 +05:30
harshal.patil 03ea07155a change(bootloader_support/secure_boot): Allow NULL as verified_digest for app build 
The esp_secure_boot_verify_sbv2_signature_block() and esp_secure_boot_verify_rsa_signature_block()
APIs need and use the verified_digest argument only for BOOTLOADER_BUILD, but the argument is
not used in the application code, and the value present in verified_digest is considered invalid.
Thus, allow passing NULL as the verified_digest parameter to help some save space.
 2025-07-21 09:19:42 +05:30
harshal.patil 3f9ab5d5e7 fix(bootloader_support/secure_boot): Fix incorrect usage of ESP_SECURE_BOOT_KEY_DIGEST_LEN 2025-07-21 09:19:42 +05:30
harshal.patil dce0925f40 fix(esp_security/esp_key_mgr): Incorrect overlapping comparisons 2025-07-03 15:05:50 +05:30
Harshal Patil 78faa2535c Merge branch 'feat/support_key_manager_esp32c5' into 'master' 
Support key manager esp32c5

Closes IDF-12626, IDF-12628, IDF-12629, IDF-8621, IDF-9007, IDF-12855, IDF-9070, IDF-7902, and IDF-7548

See merge request espressif/esp-idf!38894
 2025-07-01 11:36:19 +05:30
harshal.patil bba1448128 feat(esp_key_mgr): Support PSRAM XTS-AES key deployments using Key Manager 2025-06-27 15:15:26 +05:30
harshal.patil ffefa9902d test(mbedtls): Extend the mbedtls ecdsa tests 2025-06-27 15:15:26 +05:30
harshal.patil eb7c5654f6 test(esp_security): Extend the key manager tests 2025-06-27 15:15:26 +05:30
harshal.patil ea322ee6ef test(hal/crypto): Add HMAC and DS using Key Manager key tests 
- Also updated the test app to use esp_crypto_periph_clk.h
 2025-06-27 15:15:26 +05:30
harshal.patil 6ca4d621b5 test(crypto): Change partition address and update the test cases 
- Also format key manager test cases generation script
 2025-06-27 15:15:26 +05:30
harshal.patil 50c41c3b59 change(esp_key_mgr): Refactor Key Manager driver to reduce logs 2025-06-27 15:15:26 +05:30
harshal.patilandLi HongXi a7af364112 fix(esp_security): Power up MPI memory registers when enabling MPI 
Co-authored-by: Li HongXi <lihongxi@espressif.com>
 2025-06-27 15:15:26 +05:30
harshal.patil 33d8c05d95 feat(esp_key_mgr): Support Digital Signature key deployments using Key Manager 2025-06-27 15:15:26 +05:30
harshal.patil 265b0d7579 feat(esp_key_mgr): Support HMAC key deployments using Key Manager 2025-06-27 15:15:26 +05:30
harshal.patil 8ab6b4d694 fix(esp_security/esp_key_mgr): Recharge HUK before the first usage 2025-06-27 15:15:26 +05:30
harshal.patil a7c7b75dfd feat(soc): Update ESP32-C5's key manager reg and struct files to ECO2 
- Also added a new soc_cap to denote if key manager key deployment is available
 2025-06-27 15:15:26 +05:30
harshal.patil 8de2eb01da fix(bootlaoder): Fix documentation as ESP32 does not support secure download mode 2025-06-20 10:50:28 +05:30
harshal.patil 6fe38c7efd fix(mbedtls): re-include Comodo AAA Services root 2025-06-16 15:55:39 +05:30
Harshal Patil c85075dc12 Merge branch 'update/update_cmn_crt_authorities_csv' into 'master' 
Update common cert authorities csv

See merge request espressif/esp-idf!39564
 2025-06-09 12:08:03 +05:30
harshal.patil 85ec4df4db change(mbedlts/port): Remove deprecated header files 2025-06-06 14:52:03 +05:30
harshal.patil fe78370ec9 feat(mbedtls/sha): New API for setting SHA mode 2025-06-06 14:51:44 +05:30
harshal.patil afdf1a31c8 feat(soc): Update ESP32-C5 ECO2 to support SHA512 2025-06-06 14:51:44 +05:30
Harshal Patil e05390f338 Merge branch 'update/update_certs_bundle' into 'master' 
Update esp_crt_bundle certificates

See merge request espressif/esp-idf!39302
 2025-05-29 11:12:38 +05:30
harshal.patil 65642866bc change(mbedtls/esp_crt_bundle): Remove deprecated certs for the major release version (v6.0) 2025-05-28 23:16:47 +05:30
Harshal Patil fe40cc8f8b Merge branch 'fix/suppress_cert_bundle_serial_number_warning' into 'master' 
fix(mbedtls/esp_crt_bundle): Suppress non-negative serial number warning

Closes IDFCI-2945

See merge request espressif/esp-idf!39381
 2025-05-26 13:19:00 +05:30
Harshal Patil d8d8e91a80 Merge branch 'fix/all_crypto_periphs_reset_cause_sec_reset' into 'master' 
fix(system_internal): Avoid the sec clock reset caused due to resetting all crypto peripherals

Closes IDF-13064, IDFCI-2878, and IDFCI-2877

See merge request espressif/esp-idf!39357
 2025-05-26 11:40:06 +05:30
harshal.patilandMahavir Jain 5ae42e6f0b fix(mbedtls/esp_crt_bundle): Suppress non-negative serial number warning 
Co-authored-by: Mahavir Jain <mahavir.jain@espressif.com>
 2025-05-23 09:28:42 +05:30
harshal.patil e08189f37b fix(system_internal): Avoid the sec clock reset caused due to resetting all crypto peripherals 2025-05-22 16:01:02 +05:30
Harshal Patil e70f2705f3 Merge branch 'fix/enable_ecdsa_verify_sw_fallback_when_p192_disabled' into 'master' 
Enable signature verification s/w fallback when ECDSA-P192 is disabled

See merge request espressif/esp-idf!39039
 2025-05-14 21:06:03 +08:00
harshal.patil 0154c7cfe3 fix(mbedtls): Enable signature verification s/w fallback when ECDSA curve is disabled 2025-05-14 12:31:56 +05:30