ESP32-S3 - Combination Secure boot+Flash Encryption Failed on IDF 4.4.8/5.1.4

[dzungpv]

I have a project success enable Secure boot+Flash Encryption for ESP32, but when I change to ESP32-S3 it failed,
After I flash the boot loader and the application image, it show in the log:

Code: Select all

ESP-ROM:esp32s3-20210327
Build:Mar 27 2021
rst:0x15 (USB_UART_CHIP_RESET),boot:0x8 (SPI_FAST_FLASH_BOOT)
Saved PC:0x40048d46
invalid header: 0x20a36bad
invalid header: 0x20a36bad
invalid header: 0x20a36bad
invalid header: 0x20a36bad
invalid header: 0x20a36bad
invalid header: 0x20a36bad
invalid header: 0x20a36bad

Steps I use to enable both Secure boot and Flash encryption at the same time:
1, Flash Encryption, follow the official guide: https://docs.espressif.com/projects/esp ... lease-mode.
2, Secure boot v2, follow the official guide: https://docs.espressif.com/projects/esp ... re-boot-v2
3, Erase the flash and build the boot loader with command: idf.py bootloader and flash follow the output result.
4, Flash the remain part of the project with command: idf.py flash

Below is the screenshot with menuconfig:

secure_b_flash_en.jpg (188.47 KiB) Viewed 2354 times

This is the part of sdkconfig content to enable flash encryption and secure boot

Code: Select all

#
# Security features
#
CONFIG_SECURE_SIGNED_ON_BOOT=y
CONFIG_SECURE_SIGNED_ON_UPDATE=y
CONFIG_SECURE_SIGNED_APPS=y
CONFIG_SECURE_BOOT_SUPPORTS_RSA=y
CONFIG_SECURE_TARGET_HAS_SECURE_ROM_DL_MODE=y
CONFIG_SECURE_SIGNED_APPS_RSA_SCHEME=y
CONFIG_SECURE_BOOT=y
CONFIG_SECURE_BOOT_V2_ENABLED=y
CONFIG_SECURE_BOOT_BUILD_SIGNED_BINARIES=y
CONFIG_SECURE_BOOT_SIGNING_KEY="sbv2_private.pem"
# CONFIG_SECURE_BOOT_ENABLE_AGGRESSIVE_KEY_REVOKE is not set
# CONFIG_SECURE_BOOT_INSECURE is not set
CONFIG_SECURE_FLASH_ENC_ENABLED=y
CONFIG_SECURE_FLASH_ENCRYPTION_AES128=y
# CONFIG_SECURE_FLASH_ENCRYPTION_AES256 is not set
# CONFIG_SECURE_FLASH_ENCRYPTION_MODE_DEVELOPMENT is not set
CONFIG_SECURE_FLASH_ENCRYPTION_MODE_RELEASE=y
CONFIG_SECURE_FLASH_CHECK_ENC_EN_IN_APP=y
# CONFIG_SECURE_DISABLE_ROM_DL_MODE is not set
CONFIG_SECURE_ENABLE_SECURE_ROM_DL_MODE=y
# CONFIG_SECURE_INSECURE_ALLOW_DL_MODE is not set
# end of Security features

The modules I use is official ESP32-S3-WROOM-1 N8R2 and N8, I also try IDF 5.1.4

Output by the command: esptool.py --chip esp32s3 --no-stub get_security_info

Code: Select all

esptool.py --chip esp32s3 --no-stub get_security_info                    
esptool.py v3.3.4-dev
Found 2 serial ports
Serial port /dev/cu.usbmodem101
Connecting...
Chip is ESP32-S3 in Secure Download Mode
Enabling default SPI flash mode...
Flags: 0x000006f5 (0b11011110101)
Flash_Crypt_Cnt: 0x0
Key_Purposes: (9, 4, 0, 0, 0, 0, 12)
Chip_ID: 9
Api_Version: 0
Hard resetting via RTS pin...

Due to the result the flash encryption is not enable, but the secure boot is enabled, but I don't know what is the problem, the code working fine on the chip if secure mode and flash encryption disable.

I does not manual burn any Efuse key, just let it does automatically by the chip. I flash the boot loader first then flash all later. The guide too complex and I have bricked many ESP32 chip before it work, this time occur with the S3 too, QEMU not working with the S3, so I have some esp32s3 to try, but before try the second one, I need some more clear guide.

This also post on the github issue https://github.com/espressif/esp-idf/issues/14172

[lalit.shah]

Hi all,

Have gone through github link and solution provided.

Not getting clear idea from that.

If we have to do all process in development and would like boot loader to take care all, still we need to manually flash all efuse?

As ESP32-S3 hardware is generating key and that key is used internally to encrypt image, why steps are mentioning to generate encrypted image on host machine?

Regards,
Lalit

[lalit.shah]

Hi all,

Any expert advice on Development mode Flash Encryption + Secure boot?

If we have enabled Secure boot first and loaded images with Secure boot and after that doing flash encryption will it work?

As what steps needs to follow is not 100% clear when doing above, if EFUSE got corrupted due to improper steps is there any way to recover those?

Regards,
Lalit