espressif/esptool
1
0
Fork 0
mirror of https://github.com/espressif/esptool.git synced 2025-10-21 06:40:00 +08:00
Code Issues Packages Projects Releases Wiki Activity

fix(espefuse): Disable programming and usage of XTS-AES-256 efuse key for ESP32-C5

Browse Source
This commit is contained in:
harshal.patil
2025-08-18 16:30:52 +05:30
parent a510446628
commit c85a93dc0c
5 changed files with 7 additions and 21 deletions
Download Patch File Download Diff File Expand all files Collapse all files

9
docs/en/espefuse/burn-key-cmd.rst
View File

@@ -63,8 +63,8 @@ Optional arguments:
- USER. - USER.
- RESERVED. - RESERVED.
:esp32c5 or esp32p4 or esp32s2 or esp32s3: - XTS_AES_256_KEY_1. The first 256 bits of 512bit flash encryption key. :esp32p4 or esp32s2 or esp32s3: - XTS_AES_256_KEY_1. The first 256 bits of 512bit flash encryption key.
:esp32c5 or esp32p4 or esp32s2 or esp32s3: - XTS_AES_256_KEY_2. The second 256 bits of 512bit flash encryption key. :esp32p4 or esp32s2 or esp32s3: - XTS_AES_256_KEY_2. The second 256 bits of 512bit flash encryption key.
:esp32c5 or esp32c61 or esp32h2 or esp32h21 or esp32h4 or esp32p4: - ECDSA_KEY. It can be ECDSA private keys based on NIST192p or NIST256p curve. The private key is extracted from the given file and written into a eFuse block with write and read protection enabled. This private key shall be used by ECDSA accelerator for the signing purpose. :esp32c5 or esp32c61 or esp32h2 or esp32h21 or esp32h4 or esp32p4: - ECDSA_KEY. It can be ECDSA private keys based on NIST192p or NIST256p curve. The private key is extracted from the given file and written into a eFuse block with write and read protection enabled. This private key shall be used by ECDSA accelerator for the signing purpose.
:esp32c5: - ECDSA_KEY_P192. ECDSA private keys based on NIST192p curve. :esp32c5: - ECDSA_KEY_P192. ECDSA private keys based on NIST192p curve.
:esp32c5: - ECDSA_KEY_P256. ECDSA private keys based on NIST256p curve. :esp32c5: - ECDSA_KEY_P256. ECDSA private keys based on NIST256p curve.
@@ -79,10 +79,7 @@ Optional arguments:
- SECURE_BOOT_DIGEST0. 1 secure boot key. - SECURE_BOOT_DIGEST0. 1 secure boot key.
- SECURE_BOOT_DIGEST1. 2 secure boot key. - SECURE_BOOT_DIGEST1. 2 secure boot key.
- SECURE_BOOT_DIGEST2. 3 secure boot key. - SECURE_BOOT_DIGEST2. 3 secure boot key.
:esp32c5 or esp32p4 or esp32s2 or esp32s3: - XTS_AES_256_KEY. This is a virtual key purpose for flash encryption key. This allows you to write a whole 512-bit key into two blocks with ``XTS_AES_256_KEY_1`` and ``XTS_AES_256_KEY_2`` purposes without splitting the key file. :esp32p4 or esp32s2 or esp32s3: - XTS_AES_256_KEY. This is a virtual key purpose for flash encryption key. This allows you to write a whole 512-bit key into two blocks with ``XTS_AES_256_KEY_1`` and ``XTS_AES_256_KEY_2`` purposes without splitting the key file.
:esp32c5: - XTS_AES_256_PSRAM_KEY. This is a virtual key purpose for psram encryption key. This allows you to write a whole 512-bit key into two blocks with ``XTS_AES_256_PSRAM_KEY_1`` and ``XTS_AES_256_PSRAM_KEY_2`` purposes without splitting the key file.
:esp32c5: - XTS_AES_256_PSRAM_KEY_1. The first 256 bits of 512bit psram encryption key.
:esp32c5: - XTS_AES_256_PSRAM_KEY_2. The second 256 bits of 512bit psram encryption key.
:esp32c5 or esp32h4 or esp32p4: - KM_INIT_KEY. This is a key that is used for the generation of AES/ECDSA keys by the key manager. :esp32c5 or esp32h4 or esp32p4: - KM_INIT_KEY. This is a key that is used for the generation of AES/ECDSA keys by the key manager.
.. only:: esp32c5 or esp32c61 or esp32h2 or esp32h21 or esp32h4 or esp32p4 .. only:: esp32c5 or esp32c61 or esp32h2 or esp32h21 or esp32h4 or esp32p4

6
espefuse/efuse/esp32c5/fields.py
View File

@@ -437,9 +437,6 @@ class EfuseKeyPurposeField(EfuseField):
("ECDSA_KEY_P256", 1, None, "Reverse", "need_rd_protect"), # ECDSA key P256 ("ECDSA_KEY_P256", 1, None, "Reverse", "need_rd_protect"), # ECDSA key P256
("ECDSA_KEY", 1, None, "Reverse", "need_rd_protect"), # ECDSA key P256 ("ECDSA_KEY", 1, None, "Reverse", "need_rd_protect"), # ECDSA key P256
("RESERVED", 1, None, None, "no_need_rd_protect"), # Reserved ("RESERVED", 1, None, None, "no_need_rd_protect"), # Reserved
("XTS_AES_256_KEY_1", 2, None, "Reverse", "need_rd_protect"), # XTS_AES_256_KEY_1 (flash/PSRAM encryption)
("XTS_AES_256_KEY_2", 3, None, "Reverse", "need_rd_protect"), # XTS_AES_256_KEY_2 (flash/PSRAM encryption)
("XTS_AES_256_KEY", -1, "VIRTUAL", None, "no_need_rd_protect"), # Virtual purpose splits to XTS_AES_256_KEY_1 and XTS_AES_256_KEY_2
("XTS_AES_128_KEY", 4, None, "Reverse", "need_rd_protect"), # XTS_AES_128_KEY (flash/PSRAM encryption) ("XTS_AES_128_KEY", 4, None, "Reverse", "need_rd_protect"), # XTS_AES_128_KEY (flash/PSRAM encryption)
("HMAC_DOWN_ALL", 5, None, None, "need_rd_protect"), # HMAC Downstream mode ("HMAC_DOWN_ALL", 5, None, None, "need_rd_protect"), # HMAC Downstream mode
("HMAC_DOWN_JTAG", 6, None, None, "need_rd_protect"), # JTAG soft enable key (uses HMAC Downstream mode) ("HMAC_DOWN_JTAG", 6, None, None, "need_rd_protect"), # JTAG soft enable key (uses HMAC Downstream mode)
@@ -449,9 +446,6 @@ class EfuseKeyPurposeField(EfuseField):
("SECURE_BOOT_DIGEST1", 10, "DIGEST", None, "no_need_rd_protect"), # SECURE_BOOT_DIGEST1 (Secure Boot key digest) ("SECURE_BOOT_DIGEST1", 10, "DIGEST", None, "no_need_rd_protect"), # SECURE_BOOT_DIGEST1 (Secure Boot key digest)
("SECURE_BOOT_DIGEST2", 11, "DIGEST", None, "no_need_rd_protect"), # SECURE_BOOT_DIGEST2 (Secure Boot key digest) ("SECURE_BOOT_DIGEST2", 11, "DIGEST", None, "no_need_rd_protect"), # SECURE_BOOT_DIGEST2 (Secure Boot key digest)
("KM_INIT_KEY", 12, None, None, "need_rd_protect"), # init key that is used for the generation of AES/ECDSA key ("KM_INIT_KEY", 12, None, None, "need_rd_protect"), # init key that is used for the generation of AES/ECDSA key
("XTS_AES_256_PSRAM_KEY_1", 13, None, "Reverse", "need_rd_protect"), # XTS_AES_256_PSRAM_KEY_1 (PSRAM encryption)
("XTS_AES_256_PSRAM_KEY_2", 14, None, "Reverse", "need_rd_protect"), # XTS_AES_256_PSRAM_KEY_1 (PSRAM encryption)
("XTS_AES_256_PSRAM_KEY", -2, "VIRTUAL", None, "no_need_rd_protect"), # Virtual purpose splits to XTS_AES_256_PSRAM_KEY_1 and XTS_AES_256_PSRAM_KEY_1
("XTS_AES_128_PSRAM_KEY", 15, None, "Reverse", "need_rd_protect"), # XTS_AES_128_PSRAM_KEY (PSRAM encryption) ("XTS_AES_128_PSRAM_KEY", 15, None, "Reverse", "need_rd_protect"), # XTS_AES_128_PSRAM_KEY (PSRAM encryption)
("ECDSA_KEY_P192", 16, None, "Reverse", "need_rd_protect"), # ECDSA key P192 ("ECDSA_KEY_P192", 16, None, "Reverse", "need_rd_protect"), # ECDSA key P192
("ECDSA_KEY_P384_L", 17, None, "Reverse", "need_rd_protect"), # ECDSA key P384 low ("ECDSA_KEY_P384_L", 17, None, "Reverse", "need_rd_protect"), # ECDSA key P384 low

3
espefuse/efuse/esp32h4/fields.py
View File

@@ -387,8 +387,6 @@ class EfuseKeyPurposeField(EfuseField):
KEY_PURPOSES = [ KEY_PURPOSES = [
("USER", 0, None, None, "no_need_rd_protect"), # User purposes (software-only use) ("USER", 0, None, None, "no_need_rd_protect"), # User purposes (software-only use)
("ECDSA_KEY", 1, None, "Reverse", "need_rd_protect"), # ECDSA key ("ECDSA_KEY", 1, None, "Reverse", "need_rd_protect"), # ECDSA key
("XTS_AES_256_KEY_1", 2, None, "Reverse", "need_rd_protect"), # XTS_AES_256_KEY_1 (flash/PSRAM encryption)
("XTS_AES_256_KEY_2", 3, None, "Reverse", "need_rd_protect"), # XTS_AES_256_KEY_2 (flash/PSRAM encryption)
("XTS_AES_128_KEY", 4, None, "Reverse", "need_rd_protect"), # XTS_AES_128_KEY (flash/PSRAM encryption) ("XTS_AES_128_KEY", 4, None, "Reverse", "need_rd_protect"), # XTS_AES_128_KEY (flash/PSRAM encryption)
("HMAC_DOWN_ALL", 5, None, None, "need_rd_protect"), # HMAC Downstream mode ("HMAC_DOWN_ALL", 5, None, None, "need_rd_protect"), # HMAC Downstream mode
("HMAC_DOWN_JTAG", 6, None, None, "need_rd_protect"), # JTAG soft enable key (uses HMAC Downstream mode) ("HMAC_DOWN_JTAG", 6, None, None, "need_rd_protect"), # JTAG soft enable key (uses HMAC Downstream mode)
@@ -398,7 +396,6 @@ class EfuseKeyPurposeField(EfuseField):
("SECURE_BOOT_DIGEST1", 10, "DIGEST", None, "no_need_rd_protect"), # SECURE_BOOT_DIGEST1 (Secure Boot key digest) ("SECURE_BOOT_DIGEST1", 10, "DIGEST", None, "no_need_rd_protect"), # SECURE_BOOT_DIGEST1 (Secure Boot key digest)
("SECURE_BOOT_DIGEST2", 11, "DIGEST", None, "no_need_rd_protect"), # SECURE_BOOT_DIGEST2 (Secure Boot key digest) ("SECURE_BOOT_DIGEST2", 11, "DIGEST", None, "no_need_rd_protect"), # SECURE_BOOT_DIGEST2 (Secure Boot key digest)
("KM_INIT_KEY", 12, None, None, "need_rd_protect"), # init key that is used for the generation of AES/ECDSA key ("KM_INIT_KEY", 12, None, None, "need_rd_protect"), # init key that is used for the generation of AES/ECDSA key
("XTS_AES_256_KEY", -1, "VIRTUAL", None, "no_need_rd_protect"), # Virtual purpose splits to XTS_AES_256_KEY_1 and XTS_AES_256_KEY_2
] ]
# fmt: on # fmt: on

6
esptool/targets/esp32c5.py
View File

@@ -83,8 +83,6 @@ class ESP32C5ROM(ESP32C6ROM):
KEY_PURPOSES: dict[int, str] = { KEY_PURPOSES: dict[int, str] = {
0: "USER/EMPTY", 0: "USER/EMPTY",
1: "ECDSA_KEY", 1: "ECDSA_KEY",
2: "XTS_AES_256_KEY_1",
3: "XTS_AES_256_KEY_2",
4: "XTS_AES_128_KEY", 4: "XTS_AES_128_KEY",
5: "HMAC_DOWN_ALL", 5: "HMAC_DOWN_ALL",
6: "HMAC_DOWN_JTAG", 6: "HMAC_DOWN_JTAG",
@@ -94,6 +92,10 @@ class ESP32C5ROM(ESP32C6ROM):
10: "SECURE_BOOT_DIGEST1", 10: "SECURE_BOOT_DIGEST1",
11: "SECURE_BOOT_DIGEST2", 11: "SECURE_BOOT_DIGEST2",
12: "KM_INIT_KEY", 12: "KM_INIT_KEY",
15: "XTS_AES_128_PSRAM_KEY",
16: "ECDSA_KEY_P192",
17: "ECDSA_KEY_P384_L",
18: "ECDSA_KEY_P384_H",
} }
def get_pkg_version(self): def get_pkg_version(self):

4
esptool/targets/esp32c61.py
View File

@@ -69,8 +69,6 @@ class ESP32C61ROM(ESP32C6ROM):
KEY_PURPOSES: dict[int, str] = { KEY_PURPOSES: dict[int, str] = {
0: "USER/EMPTY", 0: "USER/EMPTY",
1: "ECDSA_KEY", 1: "ECDSA_KEY",
2: "XTS_AES_256_KEY_1",
3: "XTS_AES_256_KEY_2",
4: "XTS_AES_128_KEY", 4: "XTS_AES_128_KEY",
5: "HMAC_DOWN_ALL", 5: "HMAC_DOWN_ALL",
6: "HMAC_DOWN_JTAG", 6: "HMAC_DOWN_JTAG",
@@ -80,8 +78,6 @@ class ESP32C61ROM(ESP32C6ROM):
10: "SECURE_BOOT_DIGEST1", 10: "SECURE_BOOT_DIGEST1",
11: "SECURE_BOOT_DIGEST2", 11: "SECURE_BOOT_DIGEST2",
12: "KM_INIT_KEY", 12: "KM_INIT_KEY",
13: "XTS_AES_256_KEY_1_PSRAM",
14: "XTS_AES_256_KEY_2_PSRAM",
15: "XTS_AES_128_KEY_PSRAM", 15: "XTS_AES_128_KEY_PSRAM",
} }