1

I’ve successfully enabled Secure Boot V2 on my ESP32 device using ESP-IDF, and everything is working fine. Now, I want to enable Flash Encryption as the next step in securing my firmware.

I’m referring to the official ESP-IDF documentation: https://docs.espressif.com/projects/esp-idf/en/latest/esp32/security/security-features-enablement-workflows.html#enable-flash-encryption-externally

According to this, the first step to enable flash encryption externally is: esptool.py --port PORT erase_flash

I am following the documentation, but if there is a way to enable Flash Encryption using menuconfig after Secure Boot V2 has already been enabled, I’m open to that approach as well.

This command erases the entire flash, including the bootloader region (< 0x8000). However, from my understanding, once Secure Boot V2 is enabled and applied, the bootloader cannot be rewritten (as Secure Boot expects a verified bootloader with a valid signature). This raises some concerns:

  1. If I erase the flash, including the bootloader, how can I safely re-flash it again, given that Secure Boot V2 is already enforced?

  2. Is there a safe workflow for enabling Flash Encryption after Secure Boot V2 is enabled, without violating the secure boot policy or bricking the device?

  3. What are the specific challenges or caveats I should be aware of when enabling Flash Encryption after Secure Boot V2?

My goal is to enable both Secure Boot V2 and Flash Encryption, but I’m doing them step-by-step. What can I try next?

Improve this question

2 Answers 2

Reset to default
0

After you've enabled Secure Boot you're free to erase and flash both the second stage bootloader and the app any way you wish. The only restriction is that both bootloader and app images must be signed with the key that you've configured.

  1. You can flash as before, taking into account that both bootloader and app must be correctly signed

  2. There is very little interaction between Secure Boot and Flash Encryption. One does not disturb the other. Easiest and most foolproof is the standard Flash Encryption scenario where second stage bootloader does the encrypting when it starts.

  3. No need to worry too much.

If you're worried about bricking your nice devkit, buy a few bare ESP32-WROOM modules and a socket that accepts them. This allows you to brick the cheap modules during your experiments, causing least damage.

Improve this answer
Sign up to request clarification or add additional context in comments.

Comments

0

I read the ESP-IDF documentation about secure boot and flash encryption, and also asked some questions on the forum. I got answers stating that flash encryption cannot be enabled on a device where secure boot is already enabled.

Improve this answer

Comments

Start asking to get answers

Find the answer to your question by asking.

Ask question

Explore related questions

See similar questions with these tags.