Outline ![]()
Files ![]()
loading (3/5)...
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
173
174
175
176
177
178
179
180
181
182
183
184
185
186
187
188
189
190
191
192
193
194
195
196
197
198
199
200
201
202
203
204
205
206
207
208
209
210
211
212
213
214
215
216
217
218
219
220
221
222
223
224
225
226
227
228
229
230
231
232
233
234
235
236
237
238
239
240
241
242
243
244
245
246
247
248
249
250
251
252
253
254
255
256
257
258
259
260
261
262
263
264
265
266
267
268
269
270
271
272
273
274
275
276
277
278
279
280
281
282
283
284
285
286
287
288
289
290
291
292
293
294
295
296
297
298
299
/*
* SPDX-FileCopyrightText: 2023-2024 Espressif Systems (Shanghai) CO LTD
*
* SPDX-License-Identifier: Apache-2.0
*/
#include <string.h>
#include "esp_err.h"
#include "esp_log.h"
#include "esp_fault.h"
#include "soc/soc_caps.h"
#include "sdkconfig.h"
#include "nvs_flash.h"
#include "nvs_sec_provider.h"
#include "esp_private/startup_internal.h"
#if SOC_HMAC_SUPPORTED
#include "bootloader_random.h"
#include "esp_random.h"
#include "esp_efuse.h"
#include "esp_efuse_chip.h"
#endif // SOC_HMAC_SUPPORTED
static __attribute__((unused)) const char *TAG = "nvs_sec_provider";
#if CONFIG_NVS_SEC_KEY_PROTECT_USING_FLASH_ENC
static esp_err_t generate_keys_flash_enc(const void* sec_scheme_cfg, nvs_sec_cfg_t* cfg)
{
if (sec_scheme_cfg == NULL || cfg == NULL) {
return ESP_ERR_INVALID_ARG;
}
nvs_sec_config_flash_enc_t *scheme_cfg_flash_enc = (nvs_sec_config_flash_enc_t *)sec_scheme_cfg;
return nvs_flash_generate_keys(scheme_cfg_flash_enc->nvs_keys_part, cfg);
}
static esp_err_t read_security_cfg_flash_enc(const void* sec_scheme_cfg, nvs_sec_cfg_t* cfg)
{
if (sec_scheme_cfg == NULL || cfg == NULL) {
return ESP_ERR_INVALID_ARG;
}
nvs_sec_config_flash_enc_t *scheme_cfg_flash_enc = (nvs_sec_config_flash_enc_t *)sec_scheme_cfg;
return nvs_flash_read_security_cfg(scheme_cfg_flash_enc->nvs_keys_part, cfg);
}
esp_err_t nvs_sec_provider_register_flash_enc(const nvs_sec_config_flash_enc_t *sec_scheme_cfg, nvs_sec_scheme_t **sec_scheme_handle_out)
{
if (sec_scheme_cfg == NULL || sec_scheme_handle_out == NULL) {
return ESP_ERR_INVALID_ARG;
}
nvs_sec_scheme_t *sec_scheme = calloc(1, sizeof(nvs_sec_scheme_t));
if (sec_scheme == NULL) {
return ESP_ERR_NO_MEM;
}
sec_scheme->scheme_id = NVS_SEC_SCHEME_FLASH_ENC;
sec_scheme->nvs_flash_key_gen = &generate_keys_flash_enc;
sec_scheme->nvs_flash_read_cfg = &read_security_cfg_flash_enc;
sec_scheme->scheme_data = calloc(1, sizeof(nvs_sec_config_flash_enc_t));
if (sec_scheme->scheme_data == NULL) {
free(sec_scheme);
return ESP_ERR_NO_MEM;
}
memcpy(sec_scheme->scheme_data, (void *)sec_scheme_cfg, sizeof(nvs_sec_config_flash_enc_t));
esp_err_t err = nvs_flash_register_security_scheme(sec_scheme);
if (err != ESP_OK) {
free(sec_scheme->scheme_data);
free(sec_scheme);
return err;
}
*sec_scheme_handle_out = sec_scheme;
return ESP_OK;
}
ESP_SYSTEM_INIT_FN(nvs_sec_provider_register_flash_enc_scheme, SECONDARY, BIT(0), 150)
{
ESP_EARLY_LOGI(TAG, "NVS Encryption - Registering Flash encryption-based scheme...");
nvs_sec_config_flash_enc_t sec_scheme_cfg = NVS_SEC_PROVIDER_CFG_FLASH_ENC_DEFAULT();
/*
* This checks partition with subtype nvs_keys from partition table, if NVS Encryption is enabled
* and "nvs_keys" do not exist in partition table, then execution gets aborted. To fix the problem,
* please introduce partition with subtype "nvs_keys" in the partition table.
*/
if (sec_scheme_cfg.nvs_keys_part == NULL) {
ESP_EARLY_LOGE(TAG, "partition with subtype \"nvs_keys\" not found");
return ESP_FAIL;
}
nvs_sec_scheme_t *sec_scheme_handle_out = NULL;
return nvs_sec_provider_register_flash_enc(&sec_scheme_cfg, &sec_scheme_handle_out);
}
#endif
#if SOC_HMAC_SUPPORTED
#if CONFIG_NVS_SEC_HMAC_EFUSE_KEY_ID > 5
#error "NVS Encryption (HMAC): Configured eFuse block (CONFIG_NVS_SEC_HMAC_EFUSE_KEY_ID) out of range!"
#endif
static esp_err_t compute_nvs_keys_with_hmac(hmac_key_id_t hmac_key_id, nvs_sec_cfg_t* cfg)
{
uint32_t ekey_seed[8] = {[0 ... 7] = 0xAEBE5A5A};
uint32_t tkey_seed[8] = {[0 ... 7] = 0xCEDEA5A5};
esp_err_t err = esp_hmac_calculate(hmac_key_id, ekey_seed, sizeof(ekey_seed), (uint8_t *)cfg->eky);
if (err != ESP_OK) {
ESP_LOGE(TAG, "Failed to calculate seed HMAC: [0x%02X] (%s)", err, esp_err_to_name(err));
return err;
}
ESP_FAULT_ASSERT(err == ESP_OK);
err = esp_hmac_calculate(hmac_key_id, tkey_seed, sizeof(tkey_seed), (uint8_t *)cfg->tky);
if (err != ESP_OK) {
ESP_LOGE(TAG, "Failed to calculate seed HMAC: [0x%02X] (%s)", err, esp_err_to_name(err));
return err;
}
ESP_FAULT_ASSERT(err == ESP_OK);
/* NOTE: If the XTS E-key and T-key are the same, we have a hash collision */
ESP_FAULT_ASSERT(memcmp(cfg->eky, cfg->tky, NVS_KEY_SIZE) != 0);
return ESP_OK;
}
static esp_efuse_block_t convert_key_type(hmac_key_id_t key_id) {
return (esp_efuse_block_t)(EFUSE_BLK_KEY0 + (esp_efuse_block_t) key_id);
}
static bool is_hmac_key_burnt_in_efuse(hmac_key_id_t hmac_key_id)
{
bool ret = false;
esp_efuse_block_t hmac_key_blk = convert_key_type(hmac_key_id);
esp_efuse_purpose_t hmac_efuse_blk_purpose = esp_efuse_get_key_purpose(hmac_key_blk);
if (hmac_efuse_blk_purpose == ESP_EFUSE_KEY_PURPOSE_HMAC_UP) {
ret = true;
}
return ret;
}
static esp_err_t generate_keys_hmac(const void* scheme_cfg, nvs_sec_cfg_t* cfg)
{
if (cfg == NULL) {
return ESP_ERR_INVALID_ARG;
}
nvs_sec_config_hmac_t *scheme_cfg_hmac = (nvs_sec_config_hmac_t *)scheme_cfg;
hmac_key_id_t hmac_key = scheme_cfg_hmac->hmac_key_id;
if (hmac_key >= HMAC_KEY_MAX) {
ESP_LOGE(TAG, "Invalid HMAC key ID received!");
return ESP_ERR_INVALID_ARG;
}
esp_err_t err = ESP_FAIL;
if (!is_hmac_key_burnt_in_efuse(hmac_key)) {
uint8_t hmac_key_buf[32] = {0};
bootloader_random_enable();
esp_fill_random(hmac_key_buf, sizeof(hmac_key_buf));
bootloader_random_disable();
esp_efuse_block_t hmac_key_blk = convert_key_type(hmac_key);
err = esp_efuse_write_key(hmac_key_blk, ESP_EFUSE_KEY_PURPOSE_HMAC_UP, hmac_key_buf, sizeof(hmac_key_buf));
if (err != ESP_OK) {
if (err == ESP_ERR_EFUSE_REPEATED_PROG) {
ESP_LOGE(TAG, "Configured eFuse block for HMAC key already-in-use!");
return ESP_ERR_NVS_SEC_HMAC_KEY_BLK_ALREADY_USED;
}
ESP_LOGE(TAG, "Failed to write the HMAC key to eFuse: [0x%02X] (%s)", err, esp_err_to_name(err));
return ESP_ERR_NVS_SEC_HMAC_KEY_GENERATION_FAILED;
}
memset(hmac_key_buf, 0x00, sizeof(hmac_key_buf));
} else {
ESP_LOGW(TAG, "HMAC Key already present in configured eFuse block, using the same for NVS encryption!");
}
err = compute_nvs_keys_with_hmac(hmac_key, cfg);
if (err != ESP_OK) {
ESP_LOGE(TAG, "Failed to derive the encryption keys using HMAC!");
return ESP_ERR_NVS_SEC_HMAC_XTS_KEYS_DERIV_FAILED;
}
return ESP_OK;
}
static esp_err_t read_security_cfg_hmac(const void* scheme_cfg, nvs_sec_cfg_t* cfg)
{
if (cfg == NULL) {
return ESP_ERR_INVALID_ARG;
}
nvs_sec_config_hmac_t *scheme_cfg_hmac = (nvs_sec_config_hmac_t *)scheme_cfg;
hmac_key_id_t hmac_key = scheme_cfg_hmac->hmac_key_id;
if (hmac_key >= HMAC_KEY_MAX) {
ESP_LOGE(TAG, "Invalid HMAC key ID received!");
return ESP_ERR_INVALID_ARG;
}
if (!is_hmac_key_burnt_in_efuse(hmac_key)) {
ESP_LOGE(TAG, "Could not find HMAC key in configured eFuse block!");
return ESP_ERR_NVS_SEC_HMAC_KEY_NOT_FOUND;
}
esp_err_t err = compute_nvs_keys_with_hmac(hmac_key, cfg);
if (err != ESP_OK) {
ESP_LOGE(TAG, "Failed to derive the encryption keys using HMAC!");
return ESP_ERR_NVS_SEC_HMAC_XTS_KEYS_DERIV_FAILED;
}
return ESP_OK;
}
esp_err_t nvs_sec_provider_register_hmac(const nvs_sec_config_hmac_t *sec_scheme_cfg, nvs_sec_scheme_t **sec_scheme_handle_out)
{
if (sec_scheme_cfg == NULL || sec_scheme_handle_out == NULL) {
return ESP_ERR_INVALID_ARG;
}
nvs_sec_scheme_t *sec_scheme = calloc(1, sizeof(nvs_sec_scheme_t));
if (sec_scheme == NULL) {
return ESP_ERR_NO_MEM;
}
sec_scheme->scheme_id = NVS_SEC_SCHEME_HMAC;
sec_scheme->nvs_flash_key_gen = &generate_keys_hmac;
sec_scheme->nvs_flash_read_cfg = &read_security_cfg_hmac;
sec_scheme->scheme_data = calloc(1, sizeof(nvs_sec_config_hmac_t));
if (sec_scheme->scheme_data == NULL) {
free(sec_scheme);
return ESP_ERR_NO_MEM;
}
memcpy(sec_scheme->scheme_data, (void *)sec_scheme_cfg, sizeof(nvs_sec_config_hmac_t));
esp_err_t err = nvs_flash_register_security_scheme(sec_scheme);
if (err != ESP_OK) {
free(sec_scheme->scheme_data);
free(sec_scheme);
return err;
}
*sec_scheme_handle_out = sec_scheme;
return ESP_OK;
}
#if CONFIG_NVS_SEC_KEY_PROTECT_USING_HMAC
ESP_SYSTEM_INIT_FN(nvs_sec_provider_register_hmac_scheme, SECONDARY, BIT(0), 151)
{
ESP_EARLY_LOGI(TAG, "NVS Encryption - Registering HMAC-based scheme...");
nvs_sec_config_hmac_t sec_scheme_cfg = NVS_SEC_PROVIDER_CFG_HMAC_DEFAULT();
nvs_sec_scheme_t *sec_scheme_handle_out = NULL;
return nvs_sec_provider_register_hmac(&sec_scheme_cfg, &sec_scheme_handle_out);
}
#endif // CONFIG_NVS_SEC_KEY_PROTECT_USING_HMAC
#endif // SOC_HMAC_SUPPORTED
esp_err_t nvs_sec_provider_deregister(nvs_sec_scheme_t *sec_scheme_handle)
{
if (sec_scheme_handle == NULL) {
return ESP_ERR_INVALID_ARG;
}
if (sec_scheme_handle->scheme_data != NULL) {
free(sec_scheme_handle->scheme_data);
}
free(sec_scheme_handle);
return ESP_OK;
}
void nvs_sec_provider_include_impl(void)
{
// Linker hook, exists for no other purpose
}
Details ![]()
Show: from Types: Columns: ![]( "Show Project Names")
![]( "Show Locations")
![]( "Show Referring Symbols")
![]( "Show Scope")
This file uses the notable symbols shown below. Click anywhere in the file to view more details.