Name: Espressif ESP32-S2
Brand: Espressif
Rating: 5 (1 reviews)

To Next Page

To Previous Page

Chapter 4. API Guides

espefuse.py -p PORT summary

4.13.7 Reading and Writing Data in Encrypted Flash

ESP32-S2 application code can check if ﬂash encryption is currently enabled by calling

esp_flash_encryption_enabled(). Also, a device can identify the ﬂash encryption mode by call-

ing esp_get_flash_encryption_mode().

Once ﬂash encryption is enabled, be more careful with accessing ﬂash contents from code.

Scope of Flash Encryption

Whenever the SPI_BOOT_CRYPT_CNT eFuse is set to a value with an odd number of bits, all ﬂash content accessed

via the MMU’s ﬂash cache is transparently decrypted. It includes:

• Executable application code in ﬂash (IROM).

• All read-only data stored in ﬂash (DROM).

• Any data accessed via spi_flash_mmap().

• The ﬁrmware bootloader image when it is read by the ROM bootloader.

Important: The MMU ﬂash cache unconditionally decrypts all existing data. Data which is stored unencrypted

in ﬂash memory will also be “transparently decrypted”via the ﬂash cache and will appear to software as random

garbage.

Reading from Encrypted Flash

To read data without using a ﬂash cache MMU mapping, you can use the partition read function

esp_partition_read(). This function will only decrypt data when it is read from an encrypted partition.

Data read from unencrypted partitions will not be decrypted. In this way, software can access encrypted and non-

encrypted ﬂash in the same way.

You can also use the following SPI ﬂash API functions:

• esp_flash_read() to read raw (encrypted) data which will not be decrypted

• esp_flash_read_encrypted() to read and decrypt data

The ROM function SPIRead() can read data without decryption, however, this function is not supported in esp-idf

applications.

Data stored using the Non-Volatile Storage (NVS) API is always stored and read decrypted from the perspective of

ﬂash encryption. It is up to the library to provide encryption feature if required. Refer to NVS Encryption for more

details.

Writing to Encrypted Flash

It is recommended to use the partition write function esp_partition_write(). This function will only encrypt

data when it is written to an encrypted partition. Data written to unencrypted partitions will not be encrypted. In this

way, software can access encrypted and non-encrypted ﬂash in the same way.

You can also pre-encrypt and write data using the function esp_flash_write_encrypted()

Also, the following ROM function exist but not supported in esp-idf applications:

• esp_rom_spiflash_write_encrypted pre-encrypts and writes data to ﬂash

• SPIWrite writes unencrypted data to ﬂash

Since data is encrypted in blocks, the minimum write size for encrypted data is 16 bytes and the alignment is also 16

bytes.

Espressif Systems 1353

Submit Document Feedback

Release v4.4

Brand	Espressif
Model	ESP32-S2
Category	Single board computers
Language	English

Espressif ESP32-S2 User Manual

Table of Contents

Questions and Answers:

Espressif ESP32-S2 Specifications