ESP32 Flash Encryption

user_9115897 0
Viewed 393

Working on implementing flash encryption and secure boot on ESP32. The first step is to get flash encryption working. I am targeting the following settings:

  • Release Mode
  • No reflash over UART.
  • Use the esp generated key (no need to reflash anything).

MAlong with my 2 OTA app partitions, I have used a data partition of sub-type nvs to store my device security certificate for access to my cloud backend.

In my partitions.csv file, I don't think I can set the nvs partition to encrypted as it would brick my device. How can this be made secure?

Do I need to add nvs encryption an nvs_keys partition?

esp-idf esp32
1 Answers

NVS partitions can also be encrypted, but it's done differently from encrypting everything else in Flash. In short, you need two partitions. One is your NVS data partition which gets encrypted using NVS encryption algorithm. Other is the "NVS keys" partition which holds the encryption keys for previous, and this one gets encrypted using the standard Flash encryption algorithm. If it sounds confusing, welcome to the club. But once you dig through this, it works fine.

Pre-generating an encrypted NVS data partition with some data on it (e.g. your certificate) now gets an extra step where you encrypt it on your computer before writing it to Flash.

user_99891410
Related