Flash Encryption (FLASH_CRYPT_CNT)

[Buffalchill]

Hardware:

Board: ESP32 Dev Module
Core Installation/update date: 11/jul/2017
IDE name: Arduino IDE 1.8.3.
Flash Frequency: 40Mhz
Upload Speed: 115200

Hi,
I'm trying to enable Flash Encryption.
The ESP IDF documentation says (http://esp-idf.readthedocs.io/en/latest/security/flash-encryption.html)

"Flash Encryption Initialisation
The bootloader must be compiled with flash encryption support enabled. In make menuconfig, navigate to “Security Features” and select “Yes” for “Enable flash encryption on boot”.

how is this possible in Arduino IDE ?

[lbernstone]

See my instructions in #1142

[Buffalchill]

Is it possible to set the fuses for the flash encryption in arduino or maybe with the espefuse.py script, and then compile and upload my sketch with arduino ?

[Buffalchill]

OK i have now changed the sdkconfig in the "make menuconfig".
I changed the Security features and did Enable flash encryption on boot.

this new sdkconfig i copied into: C:\Users\Documents\Arduino\hardware\espressiv\esp32\tools\sdk
also I copied build/esp32/libesp32.a into arduino-esp32/tools/sdk/lib/ .
Then i started ardino, built and uploaded it. Then i checked if the FLASH_CRYPT_CNT got increased after upload. but it wasn't, it was still 0.
So does this now mean enable_flash_encryption didn't work in Arduino IDE even with the changed SDKconfig...

[Buffalchill]

i just tried to enable flash encryption it in the ESP-IDF with the blink example, and this worked so far.
now i would like to have this in arduino-esp32 :-/
I checked it with the espefuse.py

[Buffalchill]

Next Try:
Now I used Arduino-esp32 as an ESP-IDF component.
I used "make menuconfig" to change the secutity options -> "enable flash encryption on boot"
Then it compiled with ESP-IDF with msys32.
But flash encryption didn't happen, the FLASH_CRYPT_CNT was still 0.

Can you help me please to get the "flash encryption on boot" running ?

[lbernstone]

You enable encryption by running espefuse.py burn_efuse FLASH_CRYPT_CNT. Did you read the documentation thoroughly?

[Buffalchill]

yes i read the documentation veeeery often :)
If I just do espefuse.py burn_efuse FLASH_CRYPT_CNT the flash and the firmware does not get encrypted. But the bootloader trys to decrypt a unencrypted firmware. That simply ends up with Error message 1000.
It currently seems for me that Flash encryption on boot seems not to work with the arduino-esp32 not even as an ESP-IDF-component. I would be glad to hear if it is somehow it would be possible to copy some files into the Arduino-esp32 to make it work.

[lbernstone]

Getting error 1000 seems like some progress. Follow the serial reflashing procedure from that point and see if it will encrypt on its own.

[Buffalchill]

Ok I tried it like you said but, it seems just like i broke another esp32 board ⚡️

#1 "make menuconfig" -> "sercurity options" -> "enable flash encryption on boot"

#2 "make flash" (at this point, a normal ESP-IDF example got encrypted, but not the "arduino-esp32" as an esp-idf component )

#3 burned the efuse manually by using script espefuse.py

#4 I got the error 1000...

#5 Burn the FLASH_CRYPT_CNT efuse again with the python script

#6 this time i put some code inside my arduino sketch which will figure out if hardware encyption is enabled or not...

the answer is, it is not enabled. It is disabled.

#7 Now, I reset the device, and the documentation says, it will re-encrypt plaintext partitions.
Then I burn the FLASH_CRYPT_CNT efuse again to re-enable encryption.

#8 The flash is not encrypted, but the esp32 board trys to decrypt it, ending up with "Err 100" again.
and another Board is broken 🗡

[Buffalchill]

The point is, i think if arduino-esp32 is used as an ESP-IDF component, flash encryption seems not to work.

In normal ESP-IDF example, i was able to enable flash encryption. 🌵

[Buffalchill]

Next try:

I took a new ESP32 board and tried the Pre-generated-Key Encryption.

#1 flashed my sketch in plain text.

#2 generated the key and burned it to the esp32

#3 Followed the instructions....

#4 Strange things happend: Read_disable and write_disable became set, but the flash "encryption on boot" did not work again, even with the pregenerated key. Flash encryption is still disabled.
Arduino-esp32 as an ESP-IDF Component

Next, I will try the "reflash pregenrated key procedure"...

[lbernstone]

Um, Ok. Then don't do that. Just flash the esp-idf OTA example with the encryption turned on. Then you can put whatever you want on there. There may very well be something in the arduino-esp32 code that overrides the sdkconfig setting, and that is probably a reasonable security feature to keep people that don't understand the consequences from bricking their devices.

[Buffalchill]

Success !
Today I found a way to use flash encryption with Arduino-esp32 👍 👍 👍

#1 Generated the flash Encryption Key and burned it to the ESP32 board

#2 check if the RD_Dis and WR_Dis have changed after BURN the key (before burn they are 0, after burn they must look like on this picture :

3# Use a NORMAL "ESP-IDF" example like Hello World... make menuconfig -> security options -> enable encryption on boot
save that and make the project and flash it to the esp32 board.

#4 after openning serial monitor I had "Err 1000", so I flashed it again. Then the error was gone and my the Hello_world example was running on the board

#5 Then check the FLASH_CRYPT_CNT counter it must be 1 now because the "flash encryption on boot" must have increased it after encrytion of the flash.

in my example i added some code to make the firmware check if the encryption is working:

serial monitor shows, encryption is working:

So far so good, esp-idf flash encryption worked out with our own flash encryption key, which we stored on our PC.

Now lets make the Arduino-ESP32 project as a ESP-IDF component.

#6 this time in this project I DISABLED "encryption on boot"
make menuconfig -> security options -> enable encryption on boot <<- DISABLE that!

#7 make the project. Now the will be a .bin file in the project folder like this : /build/my-app.bin

#8 encrypt this .bin file of the project with our own generated encryption-key by using the espsecure.py script :

#9 Flash the encrypted .bin File to the ESP-32 Board by using the esptool.py script.

#10 Check out the FLASH_CRYPT_CNT with espefuse.py --port "COM3" summary
it should still have the value: 1

#11 The Arduino-esp32 as an ESP-IDF component Firmware should now run... encrypted !!!

🥇 🍦 ⚡️

[Buffalchill]

If i use Arduino-IDE to compile and upload my arduino-esp32 sketch, in which directory can i find the .bin file after compiling, which is used to get uploaded to the esp32 board?

I am asking, because I wanna try to encrypt that file directly without using the arduino as an idf component.

[lbernstone]

If you turn on verbose output during compilation in the preferences, you will see the location in a few places. I really think flashing a basic OTA + CONFIG_FLASH_ENCRYPTION_ENABLED firmware and then having the devices connect to a rpi/esp set up as an AP/webserver will be easier and mass repeatable. You could also get a list of mac addresses that way.