Pwn the ESP32 Forever: Flash Encryption and Sec. Boot Keys Extraction

[brp80000]

I'm very concerned.
https://limitedresults.com/2019/11/pwn- ... xtraction/

Opening the ESP 32 is performed by resetting the fuse bits stored in the chip at the start, which do not allow further reading of the encryption key. This is done by briefly 'turning off ' the power, after which the keys in eFuse are available for reading.
Errors in the fact that the chip should set the closed state in triggers by default .

Maybe it is possible to completely disable the com port? Then it would be better to resist the attack

[ESP_Angus]

Hi brp,

There is a security advisory and an impact analysis document available about this attack, you may find the information useful:
https://www.espressif.com/en/news/Secur ... rotections
https://www.espressif.com/en/news/ESP32_FIA_Analysis

As well as additional protections against fault injection, the ESP32 ECO V3 revisions mentioned in these documents also include an option to disable the UART download mode entirely.