Hello Espressif forum,
Here is my situation. I am doing some test around security on my esp32-s3 eval-board.
I would like to understand where I did a mistake in my flash encryption process. There is operation I did :
generating encryption_key with : python components\esptool_py\esptool\espsecure.py generate_flash_encryption_key .\esp32_pregenerated_encryption_key.bin
burn key it in BLOCK_KEY0 fuse : python components\esptool_py\esptool\espefuse.py --port COM10 burn_key --no-write-protect --no-read-protect BLOCK_KEY0 .\esp32_pregenerated_encryption_key.bin XTS_AES_128_KEY
Then, I started encryption on esp32 by turning it on :
burn spi_boot_cnt : python components\esptool_py\esptool\espefuse.py --port COM10 burn_efuse SPI_BOOT_CRYPT_CNT
Then, I used the encrypted_flash argument of esptool.py for program my plaintext firmware (idf.py -p COM10 encrypted_flash)
=> At this time, I was happy, the bootloader and app starts correctly.
In order to verify the encryption, I did a read_flash operation for retrieve my bootloader and apps ( python components\esptool_py\esptool\esptool.py -p COM10 read_flash 0x0 0x9000 redBtl.bin )
I did a decrypt_data with my initial encryption key but the result doesnt match with my bootloader bin file (python components\esptool_py\esptool\espsecure.py decrypt_flash_data --keyfile pregenerated_key_file.bin --address 0x0 -o decrypted.bin redBtl.bin)
For be sur, I tried to encrypt manualy my bootloader with the key, and attempt a esptool.py flash (without encrypted_flash argument).
(python components\esptool_py\esptool\espsecure.py encrypt_flash_data --keyfile pregenerated_key_file.bin --address 0x0 -o encrypted.bin plaintext.bin)
I would like to be able to program pre-encrypt binary/make things write-protect/... but as long I am not sur about which key is effective ... I dont want to brick my device
.Here is my fuse containts, what I have missed ?
Calibration fuses:
TEMP_SENSOR_CAL (BLOCK2) ??? Temperature calibration = -16.5 R/W (0b110100101)
ADC1_MODE0_D2 (BLOCK2) ??? ADC1 calibration 1 = 428 R/W (0x6b)
ADC1_MODE1_D2 (BLOCK2) ??? ADC1 calibration 2 = 72 R/W (0x12)
ADC1_MODE2_D2 (BLOCK2) ??? ADC1 calibration 3 = -240 R/W (0xbc)
ADC1_MODE3_D2 (BLOCK2) ??? ADC1 calibration 4 = 240 R/W (0x3c)
ADC2_MODE0_D2 (BLOCK2) ??? ADC2 calibration 5 = -336 R/W (0xd4)
ADC2_MODE1_D2 (BLOCK2) ??? ADC2 calibration 6 = 452 R/W (0x71)
ADC2_MODE2_D2 (BLOCK2) ??? ADC2 calibration 7 = -292 R/W (0xc9)
ADC2_MODE3_D2 (BLOCK2) ??? ADC2 calibration 8 = -456 R/W (0xf2)
ADC1_MODE0_D1 (BLOCK2) ??? ADC1 calibration 9 = 80 R/W (0b010100)
ADC1_MODE1_D1 (BLOCK2) ??? ADC1 calibration 10 = -80 R/W (0b110100)
ADC1_MODE2_D1 (BLOCK2) ??? ADC1 calibration 11 = -52 R/W (0b101101)
ADC1_MODE3_D1 (BLOCK2) ??? ADC1 calibration 12 = 20 R/W (0b000101)
ADC2_MODE0_D1 (BLOCK2) ??? ADC2 calibration 13 = -100 R/W (0b111001)
ADC2_MODE1_D1 (BLOCK2) ??? ADC2 calibration 14 = 8 R/W (0b000010)
ADC2_MODE2_D1 (BLOCK2) ??? ADC2 calibration 15 = -88 R/W (0b110110)
ADC2_MODE3_D1 (BLOCK2) ??? ADC2 calibration 16 = 48 R/W (0b001100)
Config fuses:
DIS_ICACHE (BLOCK0) Disables ICache = False R/W (0b0)
DIS_DCACHE (BLOCK0) Disables DCache = False R/W (0b0)
DIS_DOWNLOAD_ICACHE (BLOCK0) Disables Icache when SoC is in Download mode = False R/W (0b0)
DIS_DOWNLOAD_DCACHE (BLOCK0) Disables Dcache when SoC is in Download mode = False R/W (0b0)
DIS_FORCE_DOWNLOAD (BLOCK0) Disables forcing chip into Download mode = False R/W (0b0)
DIS_CAN (BLOCK0) Disables the TWAI Controller hardware = False R/W (0b0)
DIS_APP_CPU (BLOCK0) Disables APP CPU = False R/W (0b0)
FLASH_TPUW (BLOCK0) Configures flash startup delay after SoC power-up, = 0 R/- (0x0)
unit is (ms/2). When the value is 15, delay is 7.
5 ms
DIS_DIRECT_BOOT (BLOCK0) Disables direct boot mode = False R/- (0b0)
DIS_USB_SERIAL_JTAG_ROM_PRINT (BLOCK0) Disables USB-Serial-JTAG ROM printing = False R/- (0b0)
FLASH_ECC_MODE (BLOCK0) Configures the ECC mode for SPI flash
= 16-byte to 18-byte mode R/- (0b0)
DIS_USB_SERIAL_JTAG_DOWNLOAD_MODE (BLOCK0) Disables USB-Serial-JTAG download feature in UART = False R/- (0b0)
download boot mode
UART_PRINT_CONTROL (BLOCK0) Sets the default UART boot message output mode = Enabled R/- (0b00)
FLASH_TYPE (BLOCK0) Selects SPI flash type = 8 data lines R/- (0b1)
FLASH_PAGE_SIZE (BLOCK0) Sets the size of flash page = 0 R/- (0b00)
FLASH_ECC_EN (BLOCK0) Enables ECC in Flash boot mode = False R/- (0b0)
FORCE_SEND_RESUME (BLOCK0) Forces ROM code to send an SPI flash resume comman = False R/- (0b0)
d during SPI boot
DIS_USB_OTG_DOWNLOAD_MODE (BLOCK0) Disables USB-OTG download feature in UART download = True R/W (0b1)
boot mode
DISABLE_WAFER_VERSION_MAJOR (BLOCK0) Disables check of wafer version major = False R/W (0b0)
DISABLE_BLK_VERSION_MAJOR (BLOCK0) Disables check of blk version major = False R/W (0b0)
BLOCK_USR_DATA (BLOCK3) User data
= 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 R/W
Efuse fuses:
WR_DIS (BLOCK0) Disables programming of individual eFuses = 262400 R/W (0x00040100)
RD_DIS (BLOCK0) Disables software reading from BLOCK4-10 = 0 R/W (0b0000000)
Identity fuses:
SECURE_VERSION (BLOCK0) Secure version (used by ESP-IDF anti-rollback feat = 0 R/- (0x0000)
ure)
MAC (BLOCK1) Factory MAC Address
= 7c:df:a1:e1:20:44 (OK) R/W
WAFER_VERSION_MINOR_LO (BLOCK1) WAFER_VERSION_MINOR least significant bits = 1 R/W (0b001)
PKG_VERSION (BLOCK1) Package version = 0 R/W (0b000)
BLK_VERSION_MINOR (BLOCK1) BLOCK version minor = 2 R/W (0b010)
WAFER_VERSION_MINOR_HI (BLOCK1) WAFER_VERSION_MINOR most significant bits = 0 R/W (0b0)
WAFER_VERSION_MAJOR (BLOCK1) WAFER_VERSION_MAJOR = 0 R/W (0b00)
OPTIONAL_UNIQUE_ID (BLOCK2) Optional unique 128-bit ID
= 40 33 8b 5a c4 8e 8f 1d 6d 8e 6d de 10 ec 9b b1 R/W
BLK_VERSION_MAJOR (BLOCK2) BLOCK version major = With calibration R/W (0b01)
CUSTOM_MAC (BLOCK3) Custom MAC Address
= 00:00:00:00:00:00 (OK) R/W
WAFER_VERSION_MINOR (BLOCK0) calc WAFER VERSION MINOR = WAFER_VERSION_MINOR_HI = 1 R/W (0x1)
<< 3 + WAFER_VERSION_MINOR_LO (read only)
Security fuses:
SOFT_DIS_JTAG (BLOCK0) Software disables JTAG by programming odd number o = 0 R/W (0b000)
f 1 bit(s). JTAG can be re-enabled via HMAC periph
eral
HARD_DIS_JTAG (BLOCK0) Hardware disables JTAG permanently = False R/W (0b0)
DIS_DOWNLOAD_MANUAL_ENCRYPT (BLOCK0) Disables flash encryption when in download boot mo = False R/W (0b0)
des
SPI_BOOT_CRYPT_CNT (BLOCK0) Enables encryption and decryption, when an SPI boo = Enable R/W (0b111)
t mode is set. Enabled when 1 or 3 bits are set,di
sabled otherwise
SECURE_BOOT_KEY_REVOKE0 (BLOCK0) Revokes use of secure boot key digest 0 = False R/W (0b0)
SECURE_BOOT_KEY_REVOKE1 (BLOCK0) Revokes use of secure boot key digest 1 = False R/W (0b0)
SECURE_BOOT_KEY_REVOKE2 (BLOCK0) Revokes use of secure boot key digest 2 = False R/W (0b0)
KEY_PURPOSE_0 (BLOCK0) KEY0 purpose = XTS_AES_128_KEY R/- (0x4)
KEY_PURPOSE_1 (BLOCK0) KEY1 purpose = USER R/W (0x0)
KEY_PURPOSE_2 (BLOCK0) KEY2 purpose = USER R/W (0x0)
KEY_PURPOSE_3 (BLOCK0) KEY3 purpose = USER R/W (0x0)
KEY_PURPOSE_4 (BLOCK0) KEY4 purpose = USER R/W (0x0)
KEY_PURPOSE_5 (BLOCK0) KEY5 purpose = USER R/W (0x0)
SECURE_BOOT_EN (BLOCK0) Enables secure boot = False R/W (0b0)
SECURE_BOOT_AGGRESSIVE_REVOKE (BLOCK0) Enables aggressive secure boot key revocation mode = False R/W (0b0)
STRAP_JTAG_SEL (BLOCK0) Enable selection between usb_to_jtagor pad_to_jtag = False R/W (0b0)
through GPIO3
DIS_DOWNLOAD_MODE (BLOCK0) Disables all Download boot modes = False R/- (0b0)
ENABLE_SECURITY_DOWNLOAD (BLOCK0) Enables secure UART download mode (read/write flas = False R/- (0b0)
h only)
BLOCK_KEY0 (BLOCK4)
Purpose: XTS_AES_128_KEY
Encryption key0 or user data
= e7 2b 8a f2 e5 4c 96 8a 5d 98 92 49 d1 a5 d0 cf c0 7f 39 c1 4e b8 32 07 9e be 3c 3b e4 44 78 48 R/W
BLOCK_KEY1 (BLOCK5)
Purpose: USER
Encryption key1 or user data
= 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 R/W
BLOCK_KEY2 (BLOCK6)
Purpose: USER
Encryption key2 or user data
= 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 R/W
BLOCK_KEY3 (BLOCK7)
Purpose: USER
Encryption key3 or user data
= 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 R/W
BLOCK_KEY4 (BLOCK8)
Purpose: USER
Encryption key4 or user data
= 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 R/W
BLOCK_KEY5 (BLOCK9)
Purpose: USER
Encryption key5 or user data
= 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 R/W
BLOCK_SYS_DATA2 (BLOCK10) System data (part 2)
= 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 R/W
Spi_Pad_Config fuses:
SPI_PAD_CONFIG_CLK (BLOCK1) SPI CLK pad = 0 R/W (0b000000)
SPI_PAD_CONFIG_Q (BLOCK1) SPI Q (D1) pad = 0 R/W (0b000000)
SPI_PAD_CONFIG_D (BLOCK1) SPI D (D0) pad = 0 R/W (0b000000)
SPI_PAD_CONFIG_CS (BLOCK1) SPI CS pad = 0 R/W (0b000000)
SPI_PAD_CONFIG_HD (BLOCK1) SPI HD (D3) pad = 0 R/W (0b000000)
SPI_PAD_CONFIG_WP (BLOCK1) SPI WP (D2) pad = 0 R/W (0b000000)
SPI_PAD_CONFIG_DQS (BLOCK1) SPI DQS pad = 0 R/W (0b000000)
SPI_PAD_CONFIG_D4 (BLOCK1) SPI D4 pad = 0 R/W (0b000000)
SPI_PAD_CONFIG_D5 (BLOCK1) SPI D5 pad = 0 R/W (0b000000)
SPI_PAD_CONFIG_D6 (BLOCK1) SPI D6 pad = 0 R/W (0b000000)
SPI_PAD_CONFIG_D7 (BLOCK1) SPI D7 pad = 0 R/W (0b000000)
Usb Config fuses:
DIS_USB (BLOCK0) Disables the USB OTG hardware = False R/W (0b0)
USB_EXCHG_PINS (BLOCK0) Exchanges USB D+ and D- pins = False R/W (0b0)
EXT_PHY_ENABLE (BLOCK0) Enables external USB PHY = False R/W (0b0)
BTLC_GPIO_ENABLE (BLOCK0) Enables BTLC GPIO = 0 R/W (0b00)
DIS_USB_JTAG (BLOCK0) Disable usb_serial_jtag-to-jtag function = False R/W (0b0)
DIS_USB_SERIAL_JTAG (BLOCK0) Disable usb_serial_jtag module = False R/W (0b0)
USB_PHY_SEL (BLOCK0) Select internal/external PHY for USB OTGand usb_se = False R/W (0b0)
rial_jtag
Vdd_Spi Config fuses:
VDD_SPI_XPD (BLOCK0) The VDD_SPI regulator is powered on = True R/W (0b1)
VDD_SPI_TIEH (BLOCK0) The VDD_SPI power supply voltage at reset = Connect to 1.8V LDO R/W (0b0)
VDD_SPI_FORCE (BLOCK0) Force using VDD_SPI_XPD and VDD_SPI_TIEH to config = True R/W (0b1)
ure VDD_SPI LDO
PIN_POWER_SELECTION (BLOCK0) Sets default power supply for GPIO33..37 = VDD_SPI R/- (0b1)
Wdt Config fuses:
WDT_DELAY_SEL (BLOCK0) Selects RTC WDT timeout threshold at startup = 0 R/W (0b00)
Flash voltage (VDD_SPI) set to 1.8V by efuse.
Thanks in advance
Mickael