Pre encrypted firmware over OTA

[jojojijijojo]

Hi,

Assuming that you have to publish the binary files publicly online, Is it possible to use Pre encrypt the binary file using a pre generated key and use that to update a flash encryption enabled ESP32 using OTA?

[ESP_Sprite]

In theory yes, however it is not advised to do so, as retrieving the encryption key for one device will lead to all devices being compromised. I'm not sure to what extent ESP-IDF supports this.

[jojojijijojo]

Thank you @ESP_Sprite for your reply.

If I understand correctly, if flash encryption is enabled on an ESP32 device, does it expect all future OTA binary files to be in plain text or to be pre-encrypted? And how does it differentiate between the two cases?

[axellin]

https://github.com/espressif/esp-idf/issues/8776

[jojojijijojo]

Thanks, I already went through the new pre_encrypted_ota, but I cannot tell if it works with flash encryption. The way I understand is that pre_encrypted_ota is used to encrypt OTA binaries during transport, and then they are decrypted on device as plaintext, which is the opposite of flash encryption, where we want encrypted OTA binaries during transport, and encrypted flash on device.

[axellin]

It should work.