encrypt and store wifi credentials received at run time

[GilbertW]

Hi,

Espressif have a "Provisioning" example that lets users supply wifi-credentials to a (running) ESP32 from their mobile phone.

But how do I securely store a user's wifi-credentials once the ESP32 receives them?

I understand it's possible to encrypt the contents of the ESP32 flash at the compile/programming stage, but once the ESP32 is up-and-running how can I receive some data (a wifi password) and securely store it?

Can I (for example) encrypt the flash at programming time, then access/re-use the flash-encryption-key later at run-time to encrypt a received wifi password?

Can anyone point me to any examples or docs?

Many thanks

Gilbert

[ESP_jakob]

You can enable flash encryption and NVS encryption, then use NVS to store WiFi credentials. NVS encryption works with a separate encryption key that is encrypted using flash encryption. I.e., you don't need to store any key outside the device.

Once you enable flash encryption, any partition marked as "encrypted", will be encrypted automatically. So even if you use a raw partition as storage, everything there is encrypted, as long as it's marked "encrypted". See https://docs.espressif.com/projects/esp ... ption.html for more details.