Does anyone know whether arduino-esp32 supports Flash encryption and how to configure it

[miaoyizi]

Related area

Flash encryption

Hardware specification

ESP32

Is your feature request related to a problem?

I have implemented and verified Flash encryption in the idf development environment. Now I use arduino-esp32 and found that there is no flash encryption-related configuration in sdkconfig. It should be supported in theory, but I am not sure how to configure it.

Describe the solution you'd like

Does anyone know whether arduino-esp32 supports Flash encryption and how to configure it

[lbernstone]

arduino-esp32 does not support secure boot and encryption. However, you can burn the necessary efuses, and then install an ESP-IDF firmware with a properly configured boot loader and a simple OTA app. If you get that basic infrastructure in place, you can then develop your firmware in Arduino and use the OTA tools to upload it.

[miaoyizi]

arduino-esp32 does not support secure boot and encryption. However, you can burn the necessary efuses, and then install an ESP-IDF firmware with a properly configured boot loader and a simple OTA app. If you get that basic infrastructure in place, you can then develop your firmware in Arduino and use the OTA tools to upload it.

Thank you very much, this is a good idea and I will try it out.

[miaoyizi]

arduino-esp32 does not support secure boot and encryption. However, you can burn the necessary efuses, and then install an ESP-IDF firmware with a properly configured boot loader and a simple OTA app. If you get that basic infrastructure in place, you can then develop your firmware in Arduino and use the OTA tools to upload it.

First of all, I have implemented flash encryption under idf and can start normally. Now I just replace the app firmware with the app firmware under the arduino framework, encrypt it and download it with the same key, the bootloader and the partition table have not changed. Of course, the two projects use the same partition table, and then the error still reports when starting.

log：

I (781) flash_encrypt: flash encryption is enabled (0 plaintext flashes left)
I (789) boot: Disabling RNG early entropy source...
[ 6][E][esp32-hal-gpio.c:102] __pinMode(): Invalid pin selected
E (829) gpio: gpio_set_level(227): GPIO output gpio_num error
E (831) partition: No MD5 found in partition table
E (831) partition: load_partitions returned 0x105
E (834) esp_core_dump_flash: No core dump partition found!
E (839) partition: No MD5 found in partition table
E (844) partition: load_partitions returned 0x105
E (848) esp_core_dump_flash: No core dump partition found!
E (857) partition: No MD5 found in partition table
E (859) partition: load_partitions returned 0x105

assert failed: esp_ota_get_running_partition esp_ota_ops.c:558 (it != NULL)

Backtrace: 0x40083d21:0x3ffbc120 0x40095c31:0x3ffbc140 0x4009c1e9:0x3ffbc160 0x4011b36d:0x3ffbc290 0x40112fcf:0x3ffbc2b0 0x40114e54:0x3ffbc2e0 0x401d8f0f:0x3ffbc310
0x40083d21: Cache_Flush at D:/Espressif/frameworks/esp-idf-v4.4.7/components/esp_rom/include/esp32/rom/cache.h:141
(inlined by) spi_flash_mmap_pages at D:/Espressif/frameworks/esp-idf-v4.4.7/components/spi_flash/flash_mmap.c:287

ELF file SHA256: b6bf9bbca4d58cd5

E (888) esp_core_dump_flash: Core dump flash config is corrupted! CRC=0x7bd5c66f instead of 0x0
Rebooting...
ets Jun 8 2016 00:22:57

[lbernstone]

Did you read through the whole of that security_features_app README? It mentions in there that you can use a qemu environment to test all these features. I'd strongly recommend that so that you can verify all this without bricking devices.
Are you able to OTA upload a firmware built in IDF to that device? If you can't do that, then you won't be able to do it with Arduino. The reason this is not supported in arduino-esp32 has a lot to do with how complicated the process is to get everything lined up for secure boot, and the high possibility of making it impossible to recover a device. If you are comfortable enough to build out a firmware that can do this in IDF, you will probably be better served using Arduino as an IDF component, and having direct access to the sdkconfig, and building the bootloader from scratch.

[miaoyizi]

Did you read through the whole of that security_features_app README? It mentions in there that you can use a qemu environment to test all these features. I'd strongly recommend that so that you can verify all this without bricking devices. Are you able to OTA upload a firmware built in IDF to that device? If you can't do that, then you won't be able to do it with Arduino. The reason this is not supported in arduino-esp32 has a lot to do with how complicated the process is to get everything lined up for secure boot, and the high possibility of making it impossible to recover a device. If you are comfortable enough to build out a firmware that can do this in IDF, you will probably be better served using Arduino as an IDF component, and having direct access to the sdkconfig, and building the bootloader from scratch.

Finally OK, thank you very much. Need to update the firmware using OTA method