Enable NVS and flash encryption at rest (fw 0.8.3).

Add initEncryptedStorage, development-mode Kconfig defaults, production overlay, and security HIL docs; wire NetBootstrap through encrypted NVS bring-up. Co-authored-by: Cursor <cursoragent@cursor.com>
2026-07-07 07:46:59 +02:00
parent 9b46fe9465
commit a8f2fd1c6c
17 changed files with 259 additions and 48 deletions
@@ -0,0 +1,48 @@
+/**
+ * @file    NvsPlatformInit.hpp
+ * @brief   Encrypted NVS partition bring-up for ISecureStore backends.
+ *
+ * DigiRadio firmware — https://github.com/manvalan/DigiRadio
+ *
+ * Copyright 2026 Michele Bigi
+ * SPDX-License-Identifier: Apache-2.0
+ *
+ * @author  Michele Bigi
+ * @date    2026-07-07
+ */
+#pragma once
+
+#include <expected>
+
+namespace secure_store {
+
+/**
+ * @brief    NvsInitError — failure mode for encrypted NVS initialisation.
+ *
+ * @dname    NvsInitError
+ * @return   n/a (type)
+ * @pubstate none
+ *
+ * @author   Michele Bigi
+ * @date     2026-07-07
+ */
+enum class NvsInitError {
+    EraseFailed, ///< nvs_flash_erase failed during recovery.
+    InitFailed,  ///< nvs_flash_init failed after recovery attempt.
+};
+
+/**
+ * @brief    initEncryptedStorage — initialise default NVS (+ nvs_keys when enabled).
+ *
+ * @dname    initEncryptedStorage
+ * @return   Ok on success, or NvsInitError describing the failure.
+ * @pubstate When CONFIG_NVS_ENCRYPTION is set, nvs_flash_init() uses the
+ *           nvs_keys partition and flash-encryption key protection per
+ *           ESP-IDF v5.5 security docs. Erases and retries on layout mismatch.
+ *
+ * @author   Michele Bigi
+ * @date     2026-07-07
+ */
+[[nodiscard]] std::expected<void, NvsInitError> initEncryptedStorage() noexcept;
+
+} // namespace secure_store
@@ -12,9 +12,9 @@
 * You may obtain a copy of the License at
 *     http://www.apache.org/licenses/LICENSE-2.0
 *
- * Production builds should enable NVS encryption (nvs_keys partition in
- * partitions.csv) per ESP-IDF security docs; this slice uses plain NVS
- * for development bring-up.
+ * Production: NVS encryption + flash encryption enabled in sdkconfig.defaults
+ * (fw 0.8.3+). Call secure_store::initEncryptedStorage() before first use;
+ * see docs/security-flash-nvs.md.
 *
 * @author  Michele Bigi
 * @date    2026-07-06