Is this still a security bug? "Pwn the ESP32 Forever: Flash Encryption and Sec. Boot Keys Extraction"

[Munque]

This post from limitedresults.com points out a vulnerability in ESP32 security.

Has the issue been addressed?

[ESP_igrr]

Hi Munque,

Yes, please check the article about the fault injection vulnerabilities on Espressif website: https://www.espressif.com/en/news/ESP32_FIA_Analysis, the original security advisory: https://www.espressif.com/en/news/Secur ... rotections, and the information about the new chip revision of ESP32: https://www.espressif.com/sites/default ... de__EN.pdf

[Munque]

Thanks ESP_igrr

So it looks like the current resolution to the issue involves the either the ESP32-ECO3 (aka "ESP32v3" according to this link) or the ESP32S2 (according to this link)

Trying to figure out whether to buy, where to buy, at what price points... ended up raising more questions:

1 - Is the ESP32v3 the next version following the ESP32S2 or a different version?

2 - Are either the ESP32v3 or the ESP32s2 available for purchase? Searching those as key words turns up items like a "Nodemcu V3 V2 ESP32" -- kind of ambiguous. Most search results don't indicate anything.

3 - If you have existing ESP32s, how do you determine whether you've got a V3, V2 or V1? (e.g. Running esptool.py reac_mac (or flash_id, etc) one MCU reveals Chip is ESP32D0WDQ6 (revision 1) Is that seems like it's neither v2 nor v3 (aka ECO3), but it would seem "revision 1" has nothing to do with that.)

4 - This comparison sheet shows a few tradeoffs between the ESP32 and the ESP32-S2. (Numerous upsides of the S2, as well as some downsides: smaller SRAM & ROM, no bluetooth, no ethernet (what does ethernet on an ESP32, anyway?), half the number of soft PWMs, no SDMMC, no hall sensor.) Is there a comparison sheet available that includes the V3?

[ESP_Angus]

Hi Munque,

1 - Is the ESP32v3 the next version following the ESP32S2 or a different version?

This is a good question, can appreciate that the naming is a little bit confusing:

ESP32 V3 is a silicon revision of ESP32. (There have been ESP32 revisions 0, 1 and now 3. Version 2 was never made widely available.)

ESP32-S2 is a new design, not a revision of ESP32.

(The fact one of these has S2 in the name and the other has a V3 is coincidence, the two numbers don't relate to each other.)

2 - Are either the ESP32v3 or the ESP32s2 available for purchase? Searching those as key words turns up items like a "Nodemcu V3 V2 ESP32" -- kind of ambiguous. Most search results don't indicate anything.

Both chips are available. If you're looking to purchase commercial quantities for a product, then you can contact sales for a quote.

If you're looking at random listings on retail websites then I'd assume anything that says it's an ESP32 is not revision 3 yet (the V3 V2 thing for NodeMCU probably refers to the board version). But you'd need to ask the seller to be sure.

3 - If you have existing ESP32s, how do you determine whether you've got a V3, V2 or V1? (e.g. Running esptool.py reac_mac (or flash_id, etc) one MCU reveals Chip is ESP32D0WDQ6 (revision 1) Is that seems like it's neither v2 nor v3 (aka ECO3), but it would seem "revision 1" has nothing to do with that.)

"revision 1" here is silicon V1, aka ECO1.

For ESP32 V3 or ESP32-S2 the markings on the chip itself will be different, and the markings on Espressif-produced modules will also be different. (For third party modules you'll have to ask the manufacturer of the module, but I would expect they'd also change the markings.)

esptool.py will print the revision information when it connects, so running the read_mac or flash_id command is a great idea. Note that you need esptool v2.8 or newer to detect ESP32 V3, older versions predate V3 and will incorrectly print "revision 1" instead of "revision 3". (esptool.py will also print its version number when it runs.)

Similar to the previous question, generic ESP32 development boards bought on the open market are likely to be "revision 1" at the moment.

4 - This comparison sheet shows a few tradeoffs between the ESP32 and the ESP32-S2. (Numerous upsides of the S2, as well as some downsides: smaller SRAM & ROM, no bluetooth, no ethernet (what does ethernet on an ESP32, anyway?), half the number of soft PWMs, no SDMMC, no hall sensor.) Is there a comparison sheet available that includes the V3?

The feature set of ESP32 V3 is almost exactly the same as earlier ESP32 revisions. There is a document "ESP32 ECO V3 User Guide" which lists the differences:
https://www.espressif.com/sites/default ... de__EN.pdf

Note that if you're not using any of the external PSRAM, Flash Encryption or Secure Boot features then in my opinion there is not a compelling reason to hold out for ESP32 V3. (The security bug linked above only relates to physical security which uses these two security features.)

(what does ethernet on an ESP32, anyway?)

There's an integrated Ethernet MAC controller. You can connect an Ethernet PHY to the chip and bring up an ethernet interface in your app.

[Munque]

ESP_Angus, thank you for the detailed response. Much appreciated.

RE esp v2.8 -- good to know.
RE Ethernet. Very cool Did not know about that.

So far we've been working with ESP8266 & ESP32 WROOM on projects where security is of no concern. There's an upcoming project, however, that would involve about 100 - 500 units per year beginning this or next year. For that security would matter -- including the voltage-related hack. It's still early for that project, but wanted to plan in advance:

- Per your note "there is not [necessarily] a compelling reason to hold out for ESP32 V3" -- Does that suggest the V3 is not widely available at this point in time? For now we're only interested in a few sample units for development. Are they available for purchase in small quantities? If they are not currently available, what's the timeline on V3 availability both for smaller quantities and in batches of 100-500 units? (Are those quantities below the threshold for your sales dept?)

- The built-in hall effect sensor is something we're interested in. Per the "ESP32 ECO V3 User Guide" I I wasn't able to immediately determine if the built-in Hall Effect would be included. The S2 Comparison sheet I'd mentioned above showed the S2 as not having one, so I wanted to double check whether the V3 includes it.

Thanks again.

[ESP_Angus]

Hi Munque,

- Per your note "there is not [necessarily] a compelling reason to hold out for ESP32 V3" -- Does that suggest the V3 is not widely available at this point in time? For now we're only interested in a few sample units for development. Are they available for purchase in small quantities? If they are not currently available, what's the timeline on V3 availability both for smaller quantities and in batches of 100-500 units? (Are those quantities below the threshold for your sales dept?)

Yes, at the moment you should be able to purchase both samples and production quantities of ESP32 V3. Please contact sales for pricing.

I meant "holding out" in the context of buying random development boards from Aliexpress, Amazon, etc. ESP32 V3 is a new SKU, and both ESP32 V1 and ESP32 V3 are available for order, so it's not clear if/when third party development board manufacturers will switch to the new chip version. (Ultimately this is a question you would need to ask them, if they see demand for V3 then they will probably make plans to offer it.)

- The built-in hall effect sensor is something we're interested in. Per the "ESP32 ECO V3 User Guide" I I wasn't able to immediately determine if the built-in Hall Effect would be included. The S2 Comparison sheet I'd mentioned above showed the S2 as not having one, so I wanted to double check whether the V3 includes it.

Unfortunately the hall effect sensor hasn't been listed in the Espressif ESP32 datasheet or official marketing materials for years now. There is legacy support for it in ESP-IDF but it's not officially supported even when using ESP32 V1. That said, I think it's still possible to take a hall effect reading with ESP32 V3 - but there are no specifications for the sensor or guarantees about the usability of this reading.

[Munque]

Thanks for all the detailed responses.