Hello, Would it be possible for you to compare any IDF example that is close to your use-case and compare its memory numbers against 4.1.1 and 4.4.4 release? Please share the application and sdk configuration, I will take a look.. Note: Tool `idf_size.py` also supports `--diff` command where it can ...

Hello, Is there a way do something similar for general purpose AES crypto through mbedtls or even direct ROM calls? For example, I'd like to set BLOCK_KEY5 to a USER key, and read and write protect it, then be able to tell the AES ROM to load that key. Read (and write) protection is available only f...

Are there any compilation options or settings that can quickly minimize the use of IRAM ??

We have a guide to optimize on the IRAM usage: https://docs.espressif.com/projects/esp ... iram-usage

What is the rationale behind not signing the partition table? Primary reason was to speed up the bootup time with secure boot enabled case. Additionally, alteration to partition table with flash encryption enabled case is difficult, because the contents (along with integrity check) are encrypted on...

Hello, FLASH_CRYPT_CNT (BLOCK0): Flash encryption mode counter = 0 R/W (0b0000000) It appears like your device has flash encryption key programmed but flash encryption itself not enabled (based on the count value above). Ideally, this situation should not occur, unless the first boot workflow where ...

This could be specific to the download URL embedded in the example, please confirm that URL is direct download link. Please check this issue: https://github.com/espressif/esp-idf/issues/8581

Aha, I understood the problem. Simple solution could be to use `build/<project>-unsigned.bin` file for the manual signing purpose (instead of `project.bin`) Alternatively with docker based approach you could add `sdkconfig.defaults` file to the project with the line `CONFIG_SECURE_BOOT_BUILD_SIGNED_...

I am still not quite clear on what you mean by the resign here? So here is my analysis based on the information you shared so far: 1. Device has secure boot (v2) and flash encryption enabled as per EFuse settings 2. Secure signing is done on the image and then its further pre-encrypted before hostin...

Hi,

Could you please elaborate on what issue you discovered in the signing tool here?

Hello,

- Can you please share the instructions you used to sign and encrypt the firmware binary?
- Can you please share the EFuse summary on the device? `espefuse.py --chip esp32 summary`