secure boot and flash encryption on esp32 using esp-idf
Asked 2 years, 5 months ago Modified 2 years, 5 months ago Viewed 2k times
2 I am implementing secure boot and flash encryption on esp32
So far.
1. I successfully implemented secure boot with reflashable bootloader
a-> idf.py menuconfig
b-> set secureboot with reflasbale bootloader
c-> genrated secure_boot_key using espsecue.py and given this name to secre boot key in menuconfig
d-> bootloader config->bootloader log verbosity(error)
e-> idf.py build
f-> Burn secure boot key to efuse using: D:\esp\tools.espressif\python_env\idf4.1_py3.9_env\Scripts\python.exe D:/esp/esp-idf/components
/esptool_py/esptool/espefuse.py burn_key secure_boot D:/ESP32_Projects/blink/build/bootloader/secure-bootloader-key-256.bin
g-> Burn efuse of secureboot
espefuse -p COM4 burn_efuse ABS_DONE_0
h->First time flash command is: D:\esp\tools.espressif\python_env\idf4.1_py3.9_env\Scripts\python.exe D:/esp/esp-idf/components/esptool_py
/esptool/esptool.py --chip esp32 --port (PORT) --baud (BAUD) --before default_reset --after no_reset write_flash --flash_mode dio --flash_freq
40m --flash_size 2MB
-u 0x1000 D:/ESP32_Projects/blink/build/bootloader/bootloader.bin
i->To reflash the bootloader after initial flash: D:\esp\tools.espressif\python_env\idf4.1_py3.9_env\Scripts\python.exe D:/esp/esp-idf/components
/esptool_py/esptool/esptool.py --chip esp32 --port (PORT) --baud (BAUD) --before default_reset --after no_reset write_flash --flash_mode dio
--flash_freq 40m --flash_size 2MB
-u 0x0 D:/ESP32_Projects/blink/build/bootloader/bootloader-reflash-digest.bin
j-> idf.py flash monitor and secureboot is enabled with reflasbable bootloader
j-> idf.py flash monitor and secureboot is enabled with reflasbable bootloader
2. Now for Flash Encryption -> gone through the flash_encryption example is security esp-idf and it worked.
3. Now for both Secure boot with flash encryption where I am facing problem
What I did
-> Enabled flash encryption first
->then enabled secure boot using same method explained above using (a-i)
-> idf.py encrypted-flash monitor
Output is given below kindly have look and kindly tell me what should I do next..Thanks
D:\ESP32_Projects\flash_encryption>idf.py encrypted-flash monitor
Adding "encrypted-flash"'s dependency "all" to list of commands with default set of options.
Executing action: all (aliases: build)
Running ninja in directory d:\esp32_projects\flash_encryption\build
Executing "ninja all"...
[1/4] cmd.exe /C "cd /D D:\ESP32_Projects\flash_encryption\build\esp...*******************************************************************"
Partition table binary generated. Contents:
*******************************************************************************
# Espressif ESP32 Partition Table
# Name, Type, SubType, Offset, Size, Flags
nvs,data,nvs,0x9000,24K,
storage,data,255,0xf000,4K,encrypted
factory,app,factory,0x10000,1M,
*******************************************************************************
[2/4] Performing build step for 'bootloader'
ninja: no work to do.
Executing action: encrypted-flash
Choosing default port b'COM4' (use '-p PORT' option to set a specific serial port)
Running esptool.py in directory d:\esp32_projects\flash_encryption\build
Executing "D:\esp\tools\.espressif\python_env\idf4.1_py3.9_env\Scripts\python.exe D:\esp\esp-idf\components/esptool_py/esptool/esptool.py -p
COM4 -b 460800 --before default_reset --after no_reset --chip esp32 write_flash @flash_encrypted_project_args"...
esptool.py -p COM4 -b 460800 --before default_reset --after no_reset --chip esp32 write_flash --encrypt 0x8000 partition_table/partition-
table.bin 0x10000 flash_encryption.bin
esptool.py v2.9-dev
Serial port COM4
Serial port COM4
Connecting........__
Chip is ESP32D0WDQ6 (revision 1)
Features: WiFi, BT, Dual Core, 240MHz, VRef calibration in efuse, Coding Scheme None
Crystal is 40MHz
MAC: 30:ae:a4:fe:62:c8
Uploading stub...
Running stub...
Stub running...
Changing baud rate to 460800
Changed.
Configuring flash size...
Auto-detected Flash size: 4MB
security esp32
Share Follow asked Jun 28, 2021 at 15:44
Abdul Wasey
21 2
According to the ESP IDF Flash Encryption documentation this error means the ROM bootloader cannot load the second stage bootloader, probably because the
latter has not been encrypted. – Tarmo Jun 29, 2021 at 7:35
2 Yes the problem is solved my adding --encrypt in flash command for flashing the bootloader-reflash-digest.bin at 0x0 i-e D:\esp\tools\.espressif\python_env
\idf4.1_py3.9_env\Scripts\python.exe D:/esp/esp-idf/components/esptool_py/esptool/esptool.py --chip esp32 --port (PORT) --baud (BAUD) --before default_reset
--after no_reset write_flash --flash_mode dio --flash_freq 40m --flash_size 2MB --encrypt 0x0 D:/ESP32_Projects/flash_encryption/build/bootloader/bootloader-
reflash-digest.bin – Abdul Wasey Jun 30, 2021 at 5:48
