Managing Flash Encryption for devices already in the field

[flaz83]

Hi everyone,
thanks in advance for your help!

I’m facing a situation where I need to enable Flash Encryption on an ESP32 project, specifically to protect the partition that contains keys and passwords. Everything works fine when Flash Encryption is active from the beginning.

However, the problem is that I already have many devices deployed in the field — connected and running — that don’t have Flash Encryption enabled (efuses are not set and bootloader is not compatible).

If I compile the firmware with CONFIG_SECURE_FLASH_ENC_ENABLED=y, it crashes on those devices at boot because the encryption efuse is not set.
I can’t maintain two separate firmware builds (one for new devices, one for legacy ones), because OTA management would become too complex and error-prone — a single mistake could permanently brick a device.

Do you have any suggestions on how to handle this cleanly?

Would it be safe to:

Compile the firmware with CONFIG_SECURE_FLASH_ENC_ENABLED=n, and

On new devices, enable flash encryption manually by writing the efuses during initial flashing?

That way, the firmware could check at runtime using esp_flash_encryption_enabled() and decide whether to access encrypted data or not.

Any best practices or alternative strategies are very welcome.

Thanks again and have a great day!