mirror of
https://github.com/espressif/esp-idf.git
synced 2026-10-01 18:50:34 +03:00
Aditya Patwardhan
66156479d2
ECDSA based Secure Boot V2 is not functional for certain input vectors on ESP32-C5/C61/H2/P4 and on the preview targets ESP32-H4/H21. RSA based Secure Boot V2 is the recommended scheme where the SoC supports it. This issue will be fixed in a future hardware ECO revision; more details will be shared through the hardware errata document. A new hidden Kconfig option SECURE_BOOT_V2_ECDSA_INSECURE marks the affected mass-production SoCs (ESP32-C5/C61/H2/P4). On these SoCs, when hardware Secure Boot V2 is enabled, the ECDSA (V2) signing scheme is no longer offered by default; it must be turned on explicitly via SECURE_BOOT_V2_FORCE_ENABLE_ECDSA under "Allow potentially insecure options" (CONFIG_SECURE_BOOT_INSECURE). App signing without hardware Secure Boot is not affected. Note that ESP32-C61 has no RSA based Secure Boot V2, so it has no Secure Boot scheme enabled by default. The preview targets ESP32-H4 and ESP32-H21 mark ECDSA Secure Boot V2 as not supported in their SoC capabilities instead of using the option above. As ESP32-H4 has no other Secure Boot V2 scheme, Secure Boot is disabled entirely on it; ESP32-H21 retains RSA based Secure Boot V2. The security documentation keeps the ECDSA Secure Boot V2 content visible and adds a warning describing the limitation (including that ECDSA Secure Boot V2 on ESP32-C61 is not recommended for production). CI apps that exercise ECDSA Secure Boot V2 on the affected SoCs set CONFIG_SECURE_BOOT_V2_FORCE_ENABLE_ECDSA accordingly.
14 lines
502 B
Plaintext
14 lines
502 B
Plaintext
|
|
CONFIG_PARTITION_TABLE_OFFSET=0xD000
|
|
|
|
CONFIG_SECURE_BOOT=y
|
|
CONFIG_SECURE_BOOT_V2_ENABLED=y
|
|
# ECDSA based Secure Boot V2 is not recommended on the affected SoCs (see
|
|
# SECURE_BOOT_V2_ECDSA_INSECURE) and must be force-enabled to be selected.
|
|
CONFIG_SECURE_BOOT_INSECURE=y
|
|
CONFIG_SECURE_BOOT_V2_FORCE_ENABLE_ECDSA=y
|
|
CONFIG_SECURE_SIGNED_APPS_ECDSA_V2_SCHEME=y
|
|
CONFIG_SECURE_BOOT_ECDSA_KEY_LEN_384_BITS=y
|
|
CONFIG_SECURE_BOOT_SIGNING_KEY="test_ecdsa_p384_key.pem"
|
|
CONFIG_SECURE_BOOT_BUILD_SIGNED_BINARIES=y
|