[esp32] Add NVS encryption (HMAC scheme) (#17004)

tests/component_tests/esp32/config/nvs_encryption_s3.yaml

@@ -0,0 +1,10 @@
+esphome:
+  name: test
+
+esp32:
+  variant: esp32s3
+  framework:
+    type: esp-idf
+    advanced:
+      nvs_encryption:
+        key_id: 0

tests/component_tests/esp32/test_esp32.py

@@ -175,6 +175,29 @@ def test_esp32_default_toolchain_is_esp_idf(
             r"'ignore_efuse_mac_crc' is not supported on ESP32S3 @ data\['framework'\]\['advanced'\]\['ignore_efuse_mac_crc'\]",
             id="ignore_efuse_mac_crc_only_on_esp32",
         ),
+        pytest.param(
+            {
+                "variant": "esp32",
+                "board": "esp32dev",
+                "framework": {
+                    "type": "esp-idf",
+                    "advanced": {"nvs_encryption": {"key_id": 0}},
+                },
+            },
+            r"NVS encryption \(HMAC scheme\) is not supported on ESP32 .* @ data\['framework'\]\['advanced'\]\['nvs_encryption'\]",
+            id="nvs_encryption_unsupported_on_esp32",
+        ),
+        pytest.param(
+            {
+                "variant": "esp32s3",
+                "framework": {
+                    "type": "esp-idf",
+                    "advanced": {"nvs_encryption": {"key_id": 6}},
+                },
+            },
+            r"value must be at most 5 .* @ data\['framework'\]\['advanced'\]\['nvs_encryption'\]\['key_id'\]",
+            id="nvs_encryption_key_id_out_of_range",
+        ),
     ],
 )
 def test_esp32_configuration_errors(
@@ -214,6 +237,21 @@ def test_execute_from_psram_p4_sdkconfig(
     assert "CONFIG_SPIRAM_RODATA" not in sdkconfig
 
 
+def test_nvs_encryption_sdkconfig(
+    generate_main: Callable[[str | Path], str],
+    component_config_path: Callable[[str], Path],
+    caplog: pytest.LogCaptureFixture,
+) -> None:
+    """Test that nvs_encryption sets the HMAC scheme sdkconfig options."""
+    generate_main(component_config_path("nvs_encryption_s3.yaml"))
+    sdkconfig = CORE.data[KEY_ESP32][KEY_SDKCONFIG_OPTIONS]
+    assert sdkconfig.get("CONFIG_NVS_ENCRYPTION") is True
+    assert sdkconfig.get("CONFIG_NVS_SEC_KEY_PROTECT_USING_HMAC") is True
+    assert sdkconfig.get("CONFIG_NVS_SEC_HMAC_EFUSE_KEY_ID") == 0
+    # The permanent/irreversible eFuse burn is warned about at config time.
+    assert "PERMANENT and IRREVERSIBLE" in caplog.text
+
+
 @pytest.mark.parametrize(
     ("fixture", "expect_warning"),
     [