MicroPython
Is writing to /flash when flash encryption enabled secure? (3rd party port)
#17474
Replies: 1 comment 11 replies
-
|
The layout of the flash is defined in the partition files. For GPY you find them at esp32/boards/GPY. They are called script_8MB and script_8MB_enc. These tell you, that the file system in the flash memory starts at the 4MB boundary, address 0x400000. |
Beta Was this translation helpful? Give feedback.
-
|
Hi @robert-hh sorry for not replying yet, I was out of office during the weekend. Here is a dump of the first 512 bytes (using the ImHex software): In the hex dump I retrieved, I can almost the very same data at address I executed this command in the REPL after the device had been encrypted. I.e. I encrypted the device with secure boot and flash encryption, hooked it up to my computer, accessed the REPL, and typed in this with open("/flash/datastorage/githubissues.txt", "w") as f:
for i in range(25):
f.write("hello github issues hello robert-hh\n")Then in the flash dump (obtained with the esptool command you suggested) I can see this of course: ...and then the actual file contents, in raw text :( Any ideas? |
Beta Was this translation helpful? Give feedback.
-
|
Looking at that we can cnclude that esptool.py retuns unencrptd content. That is bad.It does not tell whther the flash is unencrypted or if the content is decrypted on read. But that does not matter much unless tere is a way prevent dumping the flash using esptool.py. P.S.: Litlefs has two "Superblocks" which by defaul are the irst two blocks of the file system. That's what you see above. |
Beta Was this translation helpful? Give feedback.
-
|
When reading through the Pycom forum I landed at this link for enabling the encryption. Did you follow it? |
Beta Was this translation helpful? Give feedback.
-
Yes, I followed that guide. I am using those exact commands, just double-checked with the script I use. |
Beta Was this translation helpful? Give feedback.
-
|
Hi @robert-hh, We got around this for now by moving the keys that needs to be stored securely to a Python file. For each device, there is a tiny bash script which places the device-unique certificates inside that file before encryption. We have a Python file like However, I realized afterwards that there is this part in the Micropython implementation, and the RAMDisk might not be necceary:
This is to be confirmed though. |
Beta Was this translation helpful? Give feedback.
Uh oh!
There was an error while loading. Please reload this page.
-
Hi!
I am working with a long-obsolete board (PyCom GPY) which has its own port: https://github.com/pycom/pycom-micropython-sigfox/tree/a37510c092bcec00671c924accb97dcdfa2f4b5d
Its forums have long shut down, so there is nowhere to ask, hoping for a second round of luck here.
This will most likely be a stupid question, but here we go.
I have enabled both secure boot and flash encryption on my GPY device. However, I am trying to figure out if I am writing my certificates to an encrypted flash area (i.e. one that no one can decrypt without knowing the correct encryption keys). (the reason I need to know if this flash area is encrypted or not is because I was asked to provide that detail in a follow-up to an online topic I posted: https://esp32.com/viewtopic.php?t=45800).
Basically, with secure boot and flash encryption enabled, I am writing sensitive keys used for a server connection to the path
/flash/keys, wherekeysis a directory and each key is stored in plain text.I am not sure if
/flashis where the filesystem is typically mounted on MicroPython ports, but on the port I am using (from Pycom),keysand/flash/keys(as os paths) are equivalent, i.e. point to the same location.I've tried to look at PyCom's source code to figure out where
/flashpoints to, to see if it is covered by flash encryption or not. But no luck.Is it possible I could recieve some guidance from here? Thanks!
Beta Was this translation helpful? Give feedback.
All reactions