alex/esp-idf
alex/esp-idf
1
0
Fork 0
mirror of https://github.com/espressif/esp-idf.git synced 2024-10-05 20:47:46 -04:00
Code Issues Actions 2 Packages Projects Releases Wiki Activity

Merge b5f0e5c6af into 3c99557eee

Browse Source
This commit is contained in:
Lucas Dekker 2024-09-17 07:18:04 +00:00 committed by GitHub
commit fa28ffa9e5
No known key found for this signature in database
GPG Key ID: B5690EEEBB952194
1 changed files with 6 additions and 0 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

6
docs/en/security/secure-boot-v2.rst
View File

@ -610,6 +610,7 @@ Secure Boot Best Practices
-------------- --------------
* Keys are processed in a linear order, i.e., key #0, key #1, key #2. * Keys are processed in a linear order, i.e., key #0, key #1, key #2.
* When a key is revoked, all remaining unrevoked keys can still be used to sign applications. For instance, if key #1 is revoked, keys such as key #0 and key #2 will remain valid for signing the application.
* Applications should be signed with only one key at a time, to minimize the exposure of unused private keys. * Applications should be signed with only one key at a time, to minimize the exposure of unused private keys.
* The bootloader can be signed with multiple keys from the factory. * The bootloader can be signed with multiple keys from the factory.
@ -634,6 +635,11 @@ Secure Boot Best Practices
* A similar approach can also be used to physically re-flash with a new key. For physical re-flashing, the bootloader content can also be changed at the same time. * A similar approach can also be used to physically re-flash with a new key. For physical re-flashing, the bootloader content can also be changed at the same time.
.. note::
It may be necessary to revoke a key that isn't currently being used.
For example, if the active application is signed with key #0, but key #1 becomes compromised, you should revoke key #1 by using the above approach. The new OTA update should continue to be signed with key #0, and the API `esp_ota_revoke_secure_boot_public_key(SECURE_BOOT_PUBLIC_KEY_INDEX_[N])` can be used to revoke the key #N (N would be 1 in this case). After revoking, all remaining unrevoked keys can still be used to sign future applications.
.. _secure-boot-v2-aggressive-key-revocation: .. _secure-boot-v2-aggressive-key-revocation: