🛠 Secure boot RSA-3072 et chiffrement de la flash

Objectives

Secure an ESP32-S2 production: enable secure boot v2 (RSA-3072 signature, the S2 only accepts this key size) which rejects any unsigned firmware, and flash encryption (AES-XTS) which makes reading the chip useless without the key. Irreversible operations via eFuses: test on a dedicated development board.

Hardware

• Test ESP32-S2 board (irreversible: do not use your only board!)
• Computer with ESP-IDF v4.x/v5.x (espefuse.py and espsecure.py tools) or pip wheels esptool esptool espsecure espefuse
• USB cable, backup of the key in a safe place

Complete code

// Verification a l'execution de l'etat de securite (Arduino-ESP32)
#include <esp_secure_boot.h>
#include <esp_flash_encryption.h>

void setup {
  Serial.begin(115200);
  delay(1000);
  Serial.printf("Secure boot actif      : %s\n",
                esp_secure_boot_enabled ? "OUI" : "NON");
  Serial.printf("Chiffrement flash actif : %s\n",
                esp_flash_encryption_enabled ? "OUI" : "NON");
}

void loop { delay(5000); }

eFuse burning commands (read twice before executing):

# 1. Genere la cle de signature RSA-3072 (secure boot v2)
espsecure.py generate_signing_key --version 2 ma_cle.pem
# 2. Convertit le binaire signe
espsecure.py sign_data --version 2 --keyfile ma_cle.pem --output firmware_signed.bin firmware.bin
# 3. Grave la cle dans les eFuses puis active le secure boot
espefuse.py --port COM3 burn_key secure_boot_v2_0 ma_cle.bin
espefuse.py --port COM3 burn_efuse SECURE_BOOT_ENABLE
# 4. Chiffrement de la flash (AES-XTS)
espefuse.py --port COM3 burn_key flash_encryption cle_flash.bin
espefuse.py --port COM3 burn_efuse FLASH_CRYPT_CONFIG 0xF
espefuse.py --port COM3 burn_efuse FLASH_ENCRYPT

Expected verification

After burning, the status sketch displays "Secure boot active: YES" and "Flash encryption active: YES". An unsigned firmware refuses to start (the serial monitor remains silent or displays a boot failure). An attempt to read the flash with esptool outputs only unreadable encrypted data.

Common errors

• Losing the signing key: without it, no firmware can be signed anymore, the board is permanently locked; archive the key offline.
• Trying secure boot v1 or a smaller key: the S2 only accepts RSA-3072 (secure boot v2).
• Burning on the wrong board or with the wrong port: check espefuse.py summary before each burn_efuse, everything is irreversible.
• Forgetting to sign the bootloader AND the partition table AND the application: all three images must be signed, otherwise the boot fails silently.