jmrp.io / kleidos
[READ-ONLY] Mirror of https://github.com/jmrplens/kleidos. Kleidos — Hardware BLE password manager for ESP32-S3 (M5StickC Plus2, StickS3, M5Stack Gray, T-Deck, Cardputer) jmrplens.github.io/kleidos/
0
Fork 0

Configure Feed

Select the types of activity you want to include in your feed.

Fix secure-build NVS key protection under ESP-IDF 6

ESP-IDF 6.0 flipped the nvs_sec_provider default key-protection scheme from
flash-encryption to HMAC while leaving CONFIG_NVS_SEC_HMAC_EFUSE_KEY_ID at its
-1 default. The HMAC provider then hard #errors at compile time
("Configured eFuse block out of range") on a negative key id, breaking every
_secure build (nvs_sec_provider.c).

The device already burns the flash-encryption key, so protect the NVS keys with
it — the natural pairing — by explicitly selecting
CONFIG_NVS_SEC_KEY_PROTECT_USING_FLASH_ENC in the secure opt-in fragment (and
unsetting the HMAC scheme). This needs no extra eFuse HMAC block and avoids the
broken negative key id. Build-only verification (no eFuse burn).

Verified (build only, NOT flashed): pio run -e sticks3_secure SUCCESS under
ESP-IDF 6.0.1 — Secure Boot v2 image signing ("1 signing key(s) found"),
flash encryption, NVS encryption, and the 0x10000 secure partition table all
configure and build (RAM 22.0%, Flash 41.8%).

José M. Requena Plens (Jun 18, 2026, 9:46 PM +0200) 62fa2b6e 92cc8929

+9
+9
sdkconfig.release.defaults.opt-in
··· 27 27 # needed here. 28 28 CONFIG_NVS_ENCRYPTION=y 29 29 30 + # --- NVS key-protection scheme: flash-encryption based --- 31 + # ESP-IDF 6.0 flipped the nvs_sec_provider default from flash-encryption to HMAC 32 + # and left CONFIG_NVS_SEC_HMAC_EFUSE_KEY_ID at -1; the HMAC provider then hard 33 + # #errors at compile time on a negative key id. We already burn the flash 34 + # encryption key, so protect the NVS keys with it (no extra eFuse HMAC block to 35 + # manage) by explicitly selecting the flash-encryption scheme. 36 + CONFIG_NVS_SEC_KEY_PROTECT_USING_FLASH_ENC=y 37 + # CONFIG_NVS_SEC_KEY_PROTECT_USING_HMAC is not set 38 + 30 39 # --- Partition Table Offset (Secure Boot v2) --- 31 40 # The signed bootloader carries a 4 KB signature block and grows past the 32 41 # default 0x8000 table offset (~33 KB measured on ESP32-S3), which would overlap