Name: Espressif ESP32-S2
Brand: Espressif
Rating: 5 (1 reviews)

To Next Page

To Previous Page

Chapter 4. API Guides

ﬁrmware bootloader encrypts: the ﬁrmware bootloader, application partitions and partitions marked as

encrypted then resets. Encrypting in-place can take time, up to a minute for large partitions. After

that, the application is decrypted at runtime and executed.

Once the ﬂash encryption is enabled in Release mode, the bootloader will write-protect the

SPI_BOOT_CRYPT_CNT eFuse.

For subsequent plaintext ﬁeld updates, use OTA scheme.

Note: If you have pre-generated the ﬂash encryption key and stored a copy, and the UART download mode is not

permanently disabled via CONFIG_SECURE_UART_ROM_DL_MODE , then it is possible to update the ﬂash locally

by pre-encrypting the ﬁles and then ﬂashing the ciphertext. See Manually Encrypting Files.

Best Practices

When using Flash Encryption in production:

• Do not reuse the same ﬂash encryption key between multiple devices. This means that an attacker who copies

encrypted data from one device cannot transfer it to a second device.

• The UART ROM Download Mode should be disabled entirely if it is not needed, or permanently

set to “Secure Download Mode”otherwise. Secure Download Mode permanently limits the avail-

able commands to basic ﬂash read and write only. The default behaviour is to set Secure Down-

load Mode on ﬁrst boot in Release mode. To disable Download Mode entirely select select the CON-

FIG_SECURE_UART_ROM_DL_MODE to “Permanently disable ROM Download Mode (recommended)”

or call esp_efuse_disable_rom_download_mode() at runtime.

• Enable Secure Boot as an extra layer of protection, and to prevent an attacker from selectively corrupting any

part of the ﬂash before boot.

4.13.5 Possible Failures

Once ﬂash encryption is enabled, the SPI_BOOT_CRYPT_CNT eFuse value will have an odd number of bits set. It

means that all the partitions marked with the encryption ﬂag are expected to contain encrypted ciphertext. Below are

the three typical failure cases if the ESP32-S2 is erroneously loaded with plaintext data:

1. If the bootloader partition is re-ﬂashed with a plaintext ﬁrmware bootloader image, the ROM bootloader

will fail to load the ﬁrmware bootloader resulting in the following failure:

rst:0x3 (SW_RESET),boot:0x13 (SPI_FAST_FLASH_BOOT)

invalid header: 0xb414f76b

Note: The value of invalid header will be diﬀerent for every application.

Note: This error also appears if the ﬂash contents are erased or corrupted.

2. If the ﬁrmware bootloader is encrypted, but the partition table is re-ﬂashed with a plaintext partition table

image, the bootloader will fail to read the partition table resulting in the following failure:

Espressif Systems 1351

Submit Document Feedback

Release v4.4

Espressif ESP32-S2 User Manual

Questions and Answers: