Hello,
my goal is only to protect my code against flash reading. Therefore I am thinking the “Secure Boot” is not necessary. In my opinion is what I need is only the flash encryption in development mode. In this case it is possible to flash the chip again with a new sketch, but the sketch is encrypted and the secret key is protected. What do you think about?
I am following this manual: Flash Encryption - ESP32 - — ESP-IDF Programming Guide latest documentation → Using Host Generated Flash Encryption Key:
Summary
-
Burn with espfuse.py the FLASH_CRYPT_CONFIG to 0xF (“espefuse.py burn_efuse FLASH_CRYPT_CONFIG 0xf”)
-
Generate with “espsecure.py generate_flash_encryption_key my_flash_encryption_key.bin” a key
-
Burn with “espefuse.py --port PORT burn_key flash_encryption my_flash_encryption_key.bin” the key in the esp32
- Configure in the “Hello World” example (or another esp-idf exampel) the Bootloader with “idf.py
-
“Enable flash encryption on boot” in Development Mode.
-
Maybe change “Potentially insecure options”: I do not know which configuration I needed in “Potentially insecure options” (maybe all on?)
-
Maybe change Partition Table, to prevent errors because the bigger bootloader? But i am not sure how this work
-
Flash with “idf.py flash monitor” the “Hello World” sketch
-
Generate with PlattformIO the bin-file for flashing of my arduino Sketch (Is this possible???)
-
Encrypt with “espsecure.py encrypt_flash_data” and the key the bin-file
-
Flash with “idf.py encrypted-app-flash monitor” the bin-file (this should be flash only the app, not the bootloader
-
Now should be the a bootloader with “flash encryption on” and my arduino sketsh on the esp-32. Done!
I did not try anything of this! Is only a consideration. What do you think?