Secure Boot; Encrypted Flash & ESP-IDF Version.

[monkey]

Hi forum,

I have a working project using ESP-IDF v3.3-202-gefdddbb25-dirty. It's all working nicely but I now want to activate all the security features: secure boot V2 & encrypted flash & signed binaries.

My questions are:

Q1) should I attempt to complete this with the version I'm currently using, or update to V4 (any particular release, what's the most stable / recent)? The V3.3 documentation is very different. And the project configuration options have clearly been updated quite a bit too. And which documentation would you advice? The longer I've looked at it, the more uncertain I've gotten!

It all looks like it's been beautifully designed so it can be achieved with a few button clicks and adding 20 lines to my build scripts. So the last thing I want to do is use the wrong version / approach and tie myself in knots by doing it wrong.

Q2) Is it possible to apply all of the security down the line using OTA??? Or are there any limitations in achieving that? If that was possible, it would get me out of the immediate hole.

Thanks all! ESP rules!