michele/DigiRadio
1
0
Fork 0
Code Issues Packages Projects Releases Wiki Activity

Enable NVS and flash encryption at rest (fw 0.8.3).

Browse Source 
Add initEncryptedStorage, development-mode Kconfig defaults, production overlay, and security HIL docs; wire NetBootstrap through encrypted NVS bring-up.

Co-authored-by: Cursor <cursoragent@cursor.com>
This commit is contained in:
michele
2026-07-07 07:46:59 +02:00
co-authored by Cursor
parent 9b46fe9465
commit a8f2fd1c6c
17 changed files with 259 additions and 48 deletions
Download Patch File Download Diff File Expand all files Collapse all files
Software/sdkconfig.defaults
+14 -3
View File
@@ -1,9 +1,20 @@
# DigiRadio — default Kconfig
# NVS encryption: enable CONFIG_NVS_ENCRYPTION and flash encryption for
# production; nvs_keys partition is reserved in partitions.csv.
# DigiRadio — default Kconfig (development / first-board bring-up)
# Security: NVS + flash encryption — see docs/security-flash-nvs.md
# Production release mode: sdkconfig.defaults.production (overlay at build time)
CONFIG_IDF_TARGET="esp32s3"
# Custom partition table (nvs + nvs_keys for encrypted storage)
CONFIG_PARTITION_TABLE_CUSTOM=y
CONFIG_PARTITION_TABLE_CUSTOM_FILENAME="partitions.csv"
# Flash encryption — DEVELOPMENT mode (re-flash plaintext until eFuse policy set)
CONFIG_SECURE_FLASH_ENC_ENABLED=y
CONFIG_SECURE_FLASH_ENCRYPTION_MODE_DEVELOPMENT=y
# NVS encryption at rest (XTS-AES; keys in nvs_keys, protected by flash encryption)
CONFIG_NVS_ENCRYPTION=y
# C++23, exceptions and RTTI off (AGENTS.md §2)
CONFIG_COMPILER_CXX_EXCEPTIONS=n
CONFIG_COMPILER_CXX_RTTI=n