ESP32 Forum

I am developing a product that will utilize the ESP32-C6.

The ESP32-C6 will be the core MCU of the product and it will interface with an interchangeable/removable external flash memory chip.
The product will access the data contents of the external flash memory chip when one is connected to the ESP32-C6 in the main device.

The data on the flash memory chip must be written and stored prior to its connection with the main device. This data is required to be encrypted for protection and preservation of intellectual property. I would like to know if the ESP32 Flash Encryption feature could be adapted to support this architecture. The main device is to interact with various flash memory chips that contain unique data storage contents to be accessed and read by the ESP32-C6.

The internal flash has transparent en/decryption, but if you use external flash you'd need to use e.g. MbedTLS to encrypt/decrypt the data manually. (This is not necessarily a bad thing btw; it means you can encrypt the internal flash using a per-device key while the external key is global in order to be able to exchange that flash between devices, presuming that is what you want.)

From my understanding and please correct me if I am wrong, I would be able to encrypt/decrypt data on an external flash memory device using MbedTLS. Having a global key will allow me to interface with any other external flash memory chip and decrypt the data that is being accessed by my core device.

I see that MbedTLS is a transport layer protocol so my question is how would MbedTLS be applied to communications initiated between hardware devices (ESP32-C6 -> Flash memory chip)? Are there any examples available that I could refer too? What other protocols (other than MbedTLS) would be suitable for this application assuming that MbedTLS is not the best solution?

MbedTLS mainly provides for TLS-level security, but because of the nature of that it also provides a bunch of crypto primitives. For instance, here is an example that uses AES-CBC. (Note that AES-CBC may not be the best encryption for your use case, the link is simply an illustration.)

Possible starting point: https://mbed-tls.readthedocs.io/en/late ... lications/