-
Notifications
You must be signed in to change notification settings - Fork 7.2k
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
esp_ota + encrypted firmware example (IDFGH-4334) #6172
Comments
Default OTA examples shipped with ESP-IDF (ref: https://github.com/espressif/esp-idf/tree/master/examples/system/ota) should work with flash encryption enabled case as well. If you are facing any specific problem please feel to post detailed report per github issue template. |
@mahavirj Thank you for your reply. Problem with |
@kshyshkin Can you please explain more details about your use-case? Do you have flash encryption enabled on device? If yes, any specific reason to flash pre-encrypted firmware during OTA update? |
@mahavirj Yes all secure features on controller on flash encryption (RELEASE), secure boot reflashable, all needed fuses on. But i have OTA (not through webserver), with intermediate device. When i need update by OTA, i make project, sighn fw with pem key, encrypt fw by digest from pem key, and send to intermediate device. Intermediate device send pre-encrypted fw to esp32 by custom interface and protocol dividing the firmware by chunks. I need that from my host computer to esp32 fw goes pre-encrypted. Thats why i need store pre-encrypted fw by chunks to OTA partition. |
At this moment, pre-encrypted firmware write is not supported in
This API is part of latest esp-idf/components/spi_flash/partition.c Line 423 in 178b122
Probably we can add configuration option to write pre-encrypted firmware image in OTA component, will keep you posted on this. |
@mahavirj Thank you for your work. I will be wait this option. It will be awesome, because i see that many issues by this feature. |
Hi @mahavirj |
Hi @AxelLin, We are checking possible issues with this feature in esp_https_ota. I'll keep you posted with the updates. Thanks, |
A common use case is the customer's device cannot connect to internet so it cannot reach OTA server. |
Hi @shubhamkulkarni97 BTW, do you have patch to test updating encrypted firmware even without checking image magic? |
Could you take a look what could be wrong in my changes? The changes including replace esp_partition_write with esp_partition_write_raw, |
Hi @shubhamkulkarni97 @mahavirj I figure out the problem now. This is an annoying issue because user needs to know what's current partition to decide which image to download. |
@shubhamkulkarni97
|
You are right about dependency of flash offset address in flash encryption scheme, it comes due to "key tweaking" as highlighted here. We have been discussing internally on enabling "pre-encrypted firmware distribution" scheme and so far we are considering this to be entirely different than "platform flash encryption" feature.
We are still at early discussion stage but probably approach will be to create "pre-encrypted" OTA image format, define encryption scheme, credential storage (use of "DS" peripheral or other approach) etc. This will be format of image for "on-the fly" decryption before writing to device flash, if flash encryption is enabled then device may "re-encrypt" image with platform key before writing to flash. If you have any feedback on this, please feel free to share. |
Note ESP32 does not has "DS" peripheral. |
Hi @mahavirj For firmware image, it can check the ESP_IMAGE_HEADER_MAGIC to recognize it's a vaild image. |
Sorry, I missed your comment.
I was unable to find anything obvious in quick glance through SPIFFS format, looks like successful mount would be required to check integrity of image. @igrr Do you have any other way round this? |
I don't think there is an easy way to determine if something is a SPIFFS image just from the header. SPIFFS has a |
@kshyshkin @AxelLin I have created a example which uses encrypted image. |
So, is there any good news for developer that developed whole project with OTA update (with public supply firmware scenario) and than added secure boot v.2 and encryption and hangs on one month before releasing to production? Update: I'm not very familiar with GitHub, but i see that IDFGH-5583 was rejected right? What was the reason? |
Hello @jacek12345, |
@hmalpani I Just try this code I see following error while OTA. E (20130) esp_encrypted_img: Unable to decipher GCM key Let me know if you need more info. Any help will be appreciated Thanks |
It seems like you are using the wrong RSA private key. Please make sure you are using the correct RSA private key. You can find info about how to generate RSA key in README.md |
Thanks for the response. I tried the same steps. I am generating certificate on windows machine. Let me try it again. Let me know if there is any version dependency on Python version. |
This feature is now supported in official ESP-IDF and corresponding example is available at https://github.com/espressif/esp-idf/tree/master/examples/system/ota/pre_encrypted_ota As a first step, I would recommend that you skip the step of "RSA key generation" and use the test key supplied in the example itself. Once we confirm that this setup works on your side, we can chase on key generation problem separately. Please let us know update on this. |
@mahavirj ../main/pre_encrypted_ota.c:44:30: error: unknown type name 'decrypt_cb_arg_t'; did you mean 'esp_decrypt_cfg_t'? Note: I didn't change anything in this examples |
Hello @saidsnanou1, |
@hmalpani thank you very much, but when I work on Arduino as an ESP-IDF component I got this error main.cpp:80:42: error: invalid conversion from 'esp_decrypt_handle_t' {aka 'void*'} to 'void**' [-fpermissive] |
@saidsnanou1 This must be resolved by espressif/idf-extra-components#17 |
Can we set the FLASH_CRYPT_CONFIG to 0x0, then any address offset of pre-encrypt binaries should be ok to read and write. |
Can you please elaborate? Just to note that, pre-encrypted OTA is entirely different scheme and has no co-relation to platform flash encryption feature as such. |
Hello, I am also interested in that feature but I would like to stay on the latest stable release (V4.4.X). Is there any luck to see that feature in stable branch v4.4.X in the near future? Best regards |
@cl-cr We are not planning to backport this feature to IDF v4.x. It will be part of v5.0 release. However, I had created a branch on top of v4.4.2 release with this feature, please see discussion here https://esp32.com/viewtopic.php?f=13&t=29917#p103742 |
Perfect, that is what I was looking for. I am going to test that. Thanks for the link! |
@mdmodi , Any luck with resolving error -0x3d00 ? I'm getting the exact same error and i've tried the key gen process multiple times.
Edit: Issue was due to #4831 Note the 5.0 links in a different flavor of mbedtls ... not sure that issue is applicable in the updated lib given the sample code. |
@mahavirj Is there any update on how to update intermediate device with encrypted firmware? The intermediate device will receive OTA chunks with UART communication protocol.
|
Hello. Have anybody example how make ota update with encrypted firmware using esp_ota_begin(), esp_ota_write(); esp_ota_end in release/v4.2 esp-idf ?
The text was updated successfully, but these errors were encountered: