espressif/esp-idf
1
0
Fork 1
mirror of https://github.com/espressif/esp-idf.git synced 2025-11-30 22:30:24 +01:00
Code Issues Packages Projects Releases Wiki Activity

Merge branch 'add_agressive_revoke' into 'master'

Browse Source 
secure_boot: Added Kconfig option for aggressive key revoke

See merge request espressif/esp-idf!14957
This commit is contained in:
Mahavir Jain
2021-10-25 04:00:20 +00:00
parent 912d831dfa 724fdbc9f1
commit c499fe5fa5
3 changed files with 34 additions and 1 deletions
Download Patch File Download Diff File Expand all files Collapse all files

16
components/bootloader/Kconfig.projbuild
View File

@@ -614,6 +614,22 @@ menu "Security features"
Refer to the Secure Boot section of the ESP-IDF Programmer's Guide for this version before enabling.
config SECURE_BOOT_ENABLE_AGGRESSIVE_KEY_REVOKE
bool "Enable Aggressive key revoke strategy"
depends on SECURE_BOOT && (IDF_TARGET_ESP32S2 || IDF_TARGET_ESP32C3 || IDF_TARGET_ESP32S3)
default N
help
If this option is set, ROM bootloader will revoke the public key digest burned in efuse block
if it fails to verify the signature of software bootloader with it.
Revocation of keys does not happen when enabling secure boot. Once secure boot is enabled,
key revocation checks will be done on subsequent boot-up, while verifying the software bootloader
This feature provides a strong resistance against physical attacks on the device.
NOTE: Once a digest slot is revoked, it can never be used again to verify an image
This can lead to permanent bricking of the device, in case all keys are revoked
because of signature verification failure.
choice SECURE_BOOTLOADER_KEY_ENCODING
bool "Hardware Key Encoding"
depends on SECURE_BOOTLOADER_REFLASHABLE

5
components/bootloader_support/src/secure_boot_v2/secure_boot_signatures_bootloader.c
View File

@@ -137,10 +137,13 @@ esp_err_t esp_secure_boot_verify_rsa_signature_block(const ets_secure_boot_signa
#if SOC_EFUSE_SECURE_BOOT_KEY_DIGESTS == 1
int sb_result = ets_secure_boot_verify_signature(sig_block, image_digest, trusted.key_digests[0], verified_digest);
#else
ets_secure_boot_key_digests_t trusted_key_digests;
ets_secure_boot_key_digests_t trusted_key_digests = {0};
for (unsigned i = 0; i < SECURE_BOOT_NUM_BLOCKS; i++) {
trusted_key_digests.key_digests[i] = &trusted.key_digests[i];
}
// Key revocation happens in ROM bootloader.
// Do NOT allow key revocation while verifying application
trusted_key_digests.allow_key_revoke = false;
int sb_result = ets_secure_boot_verify_signature(sig_block, image_digest, &trusted_key_digests, verified_digest);
#endif
if (sb_result != SB_SUCCESS) {