Commit Graph

110 Commits

Author SHA1 Message Date
Harshit Malpani
a7f654fd64
feat: Add API to verify the bootloader and app image
Added an API to verify the bootloader and app image before revoking the key in Secure Boot V2.
This will help in preventing the device to be bricked if the bootloader/application cannot be
verified by any other keys in efuse
2024-01-19 14:04:06 +05:30
Aditya Patwardhan
514cd783a3 Merge branch 'bugfix/esp32h2_ecdsa_hardware_k_v5.1' into 'release/v5.1'
fix(esp32h2): program use_hardware_k efuse bit for ECDSA key purpose (v5.1)

See merge request espressif/esp-idf!27271
2023-11-21 13:57:38 +08:00
Mahavir Jain
d9abb44049
docs: add ECDSA peripheral chapter for H2/P4
- Add ECDSA peripheral chapter and instructions to program efuse key block
- Update security guide for ECDSA peripheral mention for device identity
- Link with ESP-TLS guide about using ECDSA peripheral in TLS connection
2023-11-20 16:13:35 +05:30
Mahavir Jain
5f9f8ac068
fix(docs): correct the target specific macros for secure boot v2 guide
It appears that target specific or'ing is not supported through the
docs build. Actual text rendering on the docs site was still using
"default" field from the custom macro, rather than using target
specific.
2023-11-15 15:37:59 +05:30
KonstantinKondrashov
d612db3bca fix(doc): Fix incorrect description for xts_key_length_256 efuse 2023-09-12 14:52:48 +08:00
Mahavir Jain
1764a0bd28
crypto: add support for DPA protection configuration in C6/H2
- Technical details covered in section "15.3.2 Anti-DPA Attack Security
Control" chapter of the ESP32-C6 TRM
- Default configuration sets the security level low for the DPA
protection
- This change applies to all the crypto peripherals where the clock
frequency is dynamically adjusted to create randomness in the power
consumption trajectory
- This configuration helps to make the SCA attacks difficult on the
crypto peripherals
2023-06-08 20:37:03 +05:30
Mahavir Jain
a88130a71e
docs: add flash enc process logs for ESP32-H2 and ESP32-C6 2023-03-27 22:27:09 +05:30
Mahavir Jain
11e034b387
docs: add ESP32-H2 secure boot guide
Close IDF-6681
2023-03-06 16:58:08 +05:30
Aditya Patwardhan
7b40852d2f docs/flash_encryption: Update docs for esp32h2 target 2023-02-24 15:21:51 +05:30
Sachin Parekh
2bb9499a7e esp32c6: Enable ECDSA based secure boot
- Updated documentation for C6
2023-02-13 13:02:11 +05:30
Mahavir Jain
02fb6fab09
docs: secure-boot-v2: add a section about secure padding 2023-02-08 12:01:52 +05:30
harshal.patil
3c0778a069
docs: refactored Secure Boot V2 documentation
- Added "Signing using pre-calculate signatures" section
- Refactored "Signing using an external HSM" section
2023-02-08 12:01:47 +05:30
Aditya Patwardhan
b06a029677 esp32c6: update documentation for flash encryption 2023-02-03 16:01:06 +05:30
Marius Vikhammer
7100b7d1ff docs: add support for building H2 docs 2023-01-17 10:04:26 +08:00
mofeifei
3bdad0032e docs: update cn trans for flash-encryptions 2023-01-03 19:32:41 +08:00
Zhang Xiao Yan
ae639f68a6 Merge branch 'docs/update_USB-OTG_ESP32S2_ESP32S3' into 'master'
updated USB_OTG in dfu.rst, usb_device.rst and secure-boot-v2.rst

Closes DOC-3565

See merge request espressif/esp-idf!20144
2022-12-27 14:38:51 +08:00
Mahavir Jain
5b6cc09dce
docs: remove mention of DIS_BOOT_REMAP for chips other than ESP32-S2
Relevant: https://esp32.com/viewtopic.php?f=13&t=31188
2022-12-21 14:16:50 +05:30
Mahavir Jain
371a6abdca Merge branch 'docs/support_for_pre_calculated_signatures' into 'master'
docs: Added documetation for using pre-calculated signatures

See merge request espressif/esp-idf!21377
2022-12-20 14:03:04 +08:00
Mahavir Jain
46588e7126
docs: security: enable memory protection section for ESP32-C2/ESP32-C6 2022-12-14 10:03:47 +05:30
Mahavir Jain
188017d6b1
docs: Fix Secure DL mode documentation about flash read being unsupported
Simple flash read command is not supported if Secure DL mode is enabled on the target.
Remove reference of this from the relevant docs part.

Related: https://github.com/espressif/esptool/issues/810
Related: ESPTOOL-567
Closes IDF-6468
2022-12-14 10:03:46 +05:30
harshal.patil
54d6ab2044 docs: Added documentation for using pre-calculated signatures
to generate secure boot enabled binaries.
2022-12-06 10:23:45 +05:30
harshal.patil
6809eaf375 docs: fix secure boot "Remote Signing of Images" section command 2022-12-01 18:03:44 +05:30
Linda
9c0d573eae updated USB_OTG in dfu.rst, usb_device.rst and secure-boot-v2.rst 2022-11-29 10:08:59 +08:00
Mahavir Jain
11f2683c27 docs: add chapter about overall "security" area guide
List down considerations for the following areas:

- Hardware security
- Network security
- Product security

Also added brief explanation about "Security Policy" for ESP-IDF.

Closes IDF-1565
2022-11-25 03:17:05 +00:00
Marius Vikhammer
ca4ad3ce7c docs: add support for building C6 docs 2022-10-13 04:39:16 +00:00
Mahavir Jain
e40d733d5a
secure-boot-v2: fix minor typo (s/MFG1/MGF1) 2022-08-23 16:37:14 +05:30
Wang Fang
83a0cd33ce docs: updated documents related to wakeup source, ulp, flash-encryption and memory types 2022-07-25 10:57:40 +08:00
Linda
3d5f2fbafc docs:updates based on feedbacks 2022-07-22 15:58:09 +08:00
Shang Zhou
7f8fae8548 docs: update CN translation for flash_encryption 2022-07-08 11:15:57 +08:00
Mahavir Jain
26514959dd
docs: secure-boot-v2: remove incorrect note about bootloader re-flash
In secure-boot-v2 scheme, one can always regenerate signature using
secure boot signing key and re-flash either bootloader or application.
2022-06-27 14:24:42 +05:30
KonstantinKondrashov
6e6b5474c3 doc(esp32c2): Updates Flash Encryption chapter 2022-05-31 11:12:21 +00:00
Stefan Wallentowitz
dd7aece4bf
Secure boot v2 image format: CRC size
The CRC size is documented as 1095 bytes, but in the code I find 1196 bytes:
https://github.com/espressif/esp-idf/blob/master/components/bootloader_support/src/secure_boot_v2/secure_boot.c#L35
2022-05-30 23:30:34 +02:00
Sachin Parekh
2c725264f7
esp32c2: Support Secure Boot V2 based on ECDSA scheme 2022-05-11 18:00:03 +05:30
Marius Vikhammer
a6543f0d21 docs: fix broken references to misc API functions and types. 2022-03-27 16:46:57 +08:00
Mahavir Jain
a0c5d845eb
doc/security: fix re-flashable bootloader section
- Add pointer to key generation section
- Fix sequence point ordering
2022-03-11 15:56:06 +05:30
laokaiyao
cf049e15ed esp8684: rename target to esp32c2 2022-01-19 11:08:57 +08:00
Marius Vikhammer
82325f6037 docs: update docs to be able to build with esp8684 2021-12-20 10:32:49 +08:00
Mahavir Jain
1501a22e02 docs: fix salt length in secure-boot-v2 docs 2021-12-07 09:49:28 +05:30
Roland Dobai
9c1d4f5b54 Build & config: Remove the "make" build system
The "make" build system was deprecated in v4.0 in favor of idf.py
(cmake). The remaining support is removed in v5.0.
2021-11-10 09:53:53 +01:00
daiziyan
e79b8c1b6a docs: update CN trans for external-ram and flash-encryption 2021-11-05 19:23:10 +08:00
Sachin Parekh
8ff3dbc05d secure_boot: Added Kconfig option for aggressive key revoke
Applicable to S2, C3, and S3
2021-10-22 12:20:14 +05:30
Marius Vikhammer
95d824fbb0 Merge branch 'docs/flash_enc_512bits' into 'master'
docs: update flash encryption docs with 512bit key related info

Closes IDF-3867

See merge request espressif/esp-idf!15318
2021-10-13 08:49:37 +00:00
Jakob Hasse
ea2e2b0d62 [docs]: Clarified and improved Secure Boot docs 2021-10-13 11:41:53 +08:00
Marius Vikhammer
b62f2b33e9 docs: update flash encryption docs with 512bit key related info 2021-10-11 12:31:16 +08:00
Sachin Parekh
2d82560ed5 bootloader: Enable Secure boot V2 for ESP32-S3 2021-08-19 14:08:12 +05:30
daiziyan
c399251eda docs: update CN trans for flash-encryption 2021-08-16 16:46:04 +08:00
KonstantinKondrashov
93512edc7a secure_boot_v2(doc): secure_boot_v2 key/s must be readable 2021-08-04 15:39:48 +05:00
Sachin Parekh
082cc36532 doc/secure_boot_v2: Fix the steps mentioned for enabling secure boot 2021-07-30 14:40:32 +08:00
Mahavir Jain
77c96e51bb docs: security: fix minor formatting issues or typos 2021-07-22 15:18:56 +05:30
Marius Vikhammer
fe0600b859 docs: add note about PSRAM encryption 2021-07-19 13:53:21 +08:00