Chapter 4. Software framework
4.7.7 After enabling ash encryption and secure boot for ESP32, how to disable them?
• If you are using the one-time ash (Release) mode, both ash encryption and secure boot cannot be disabled.
• If you are using the reashable (Development (NOT SECURE)) mode, the ash encryption can be disabled,
please refer to Disabling Flash Encryption; while the secure boot cannot be disabled.
4.7.8 Is there any security strategy for ESP32 to protect its rmware?
• ESP32 supports ash encryption and secure boot.
• For ash encryption, please refer to ash encryption.
• For secure boot, please refer to secure boot.
• For secure boot V2, please refer to secure boot V2 for chip revision v3.0.
4.7.9 When ESP32 debugging GDB after enabling ash encryption, why does it continu-
ously reset and restart?
• After ESP32 enabling ash encryption or secure boot, it will restrict JTAG debugging by default, please refer
to Tips and Quirks.
• You can read the current JTAG status of your chip using the espefuse.py summary command from
esptool.
4.7.10 How to enable ash encryption for ESP32?
• It can be enabled via menucong or idf.py menucong by conguring Security features -> Enable
flash encryption on boot (READ DOCS FIRST).
• Please refer to Flash encryption instructions.
4.7.11 After GPIO0 is pulled down, the ESP32 cannot enter download mode and prints
“download mode is disable”. What could be the reason?
• The log means the chip’s UART Download mode has been disabled. You can check this via the
UART_DOWNLOAD_DIS bit in eFuse.
• Please note that after the Production mode of ash encryption is enabled, the UART Download mode will be
disabled by default. For more information, please refer to UART ROM download mode.
4.7.12 Can the secure boot function be enabled for ESP32 in Arduino development envi-
ronment?
• No. If you want to use Arduino for development, the only way to enable the secure boot function is to use
Arduino as an IDF component.
Espressif Systems 106
Submit Document Feedback
Release master