problem with uploading pc encrypted firmware to the esp32-c3

[krzysztof.kuczek]

Hi,

I have a problem uploading PC‑encrypted firmware to the ESP32‑C3 equipped with a flash‑encryption‑capable bootloader.

So what I did:

• I generated a key and burned it:

  Code: Select all

  espefuse.py --port COM6 burn_key BLOCK_KEY0 flash_key.bin XTS_AES_128_KEY

• I built the bootloader with Flash Encryption = ON, flashed it, and then stored it as

  Code: Select all

  bootloader_custom.bin

  .
• Then I did:

  Code: Select all

  espefuse.py --port COM6 burn_efuse SPI_BOOT_CRYPT_CNT 0x1
  espefuse.py -p COM6 burn_bit BLOCK0 0
  espefuse.py -p COM6 burn_bit BLOCK0 4
  espefuse.py -p COM6 burn_bit BLOCK0 1 2 
  

• I built the Arduino project using PlatformIO and made copies of

  Code: Select all

  partitions.bin

  and

  Code: Select all

  firmware.bin

  .

Then I uploaded everything using the --encrypt flag and it works fine:

Code: Select all

esptool.py --chip esp32c3 --port COM6 --baud 921600 --before default_reset --after hard_reset write_flash --flash_size detect --encrypt 0x0      bootloader_custom.bin
esptool.py --chip esp32c3 --port COM6 --baud 921600 --before default_reset --after hard_reset write_flash --flash_size detect --encrypt 0x8000   partitions.bin
esptool.py --chip esp32c3 --port COM6 --baud 921600 --before default_reset --after hard_reset write_flash --flash_size detect --encrypt 0x10000  firmware.bin

But I want to encrypt the firmware on my PC like this:

Code: Select all

espsecure.py encrypt_flash_data --key flash_key.bin --address 0x10000 --output firmware_enc.bin firmware.bin

and then try to upload without the --encrypt flag:

Code: Select all

esptool.py --chip esp32c3 --port COM6 --baud 921600 --before default_reset --after hard_reset write_flash --flash_size detect 0x10000 firmware_enc.bin

but it ends with

Code: Select all

Invalid header: 0x0dca6d99

Any hints?

Thank you in advance.
Kris

[dmitrij999]

I had the similar problem with ecryption on PC
Could you please try to encrypt with adding the —aes-xts flag?

[yangolan]

this problem only occurred because of the encryption? it didn't happen before?