Crate espsign

Utilities for ESP Secure Boot V2 RSA signature block verification and signing

For now, only Secure Boot V2 is supported, with the RSA-based signature block, as this is what seemingly Espressif recommends*. In future, it can be extended with support for ECC signatures, as well as Secure Boot V1.

The module is no_std (but needs alloc because Rust Crypto RSA needs it) so that it can also be used on the chip itself for e.g. verifying image signatures during OTA updates for baremetal apps. Note though that the on-chip verification would be slow(er), because the Esp RSA and SHA peripherals are not utilized yet.

• https://docs.espressif.com/projects/esp-idf/en/v5.3.1/esp32h2/security/secure-boot-v2.html#signature-block-format

Modules

rsa

The RSA crate is re-exported for user convenience so that users of the lib do not have to explicitly depend on it

Structs

AsyncIo

A blocking wrapper for types implementing std::io::Read and std::io::Write to implement Read and Write for async I/O.

NullWrite

A null writer that writes to nowhere Implements the Write trait from embedded-io-async

SBV2RsaPubKey

ESP Secure Boot V2 RSA Public key

SBV2RsaSignatureBlock

ESP Secure Boot V2 RSA Signature Block https://docs.espressif.com/projects/esp-idf/en/stable/esp32/security/secure-boot-v2.html#signature-block-format

Enums

ImageType

Type of image to sign or verify

SignError

Errors that can occur during verification

VerifyError

Errors that can occur during verification