Introduction to the ESP32-S31: Security

Welcome to the Introduction to the ESP32-S31: Security workshop!

About this workshop

#

This workshop introduces the ESP32-S31 and its security capabilities through a series of focused, hands-on topics. You will examine firmware authenticity, data confidentiality, secure storage, and protected communications. The labs use CLion with ESP-IDF to build, configure, and debug the firmware, so you also get a practical introduction to an IDE-based ESP-IDF workflow.

The workshop also relates these capabilities to the technical requirements of the European Union Cyber Resilience Act (CRA). An SoC, by itself, cannot be evaluated for CRA compliance. Compliance applies to a product with digital elements and includes responsibilities beyond silicon, such as secure product design, vulnerability handling, documentation, and lifecycle support. The ESP32-S31 features covered here can help manufacturers build products that meet relevant CRA requirements.

Using this workshop with other SoCs

#

How to read the table:

• TLS (Assignment 1): SoCs without Wi-Fi need another network interface for Assignment 1, such as Ethernet or an SPI Ethernet module.
• HMAC NVS (Assignment 2): SoCs without an HMAC peripheral cannot follow Assignment 2. They can still encrypt NVS with the flash encryption-based scheme (an nvs_keys partition), which Assignment 4 uses.
• Secure Boot V2 RSA (Assignment 3): In Assignment 3 images are signed with RSA-3072. On SoCs marked ECDSA only, use the ECDSA signing scheme instead; the rest of the flow is the same.

Assignments 2 to 5 run in the ESP32 emulator. For another SoC, check that the emulator supports it, or run those labs on a board you are ready to provision permanently.

Board-specific steps (ports, Ethernet, partition sizes) and the eFuse key block plan need adapting to your board. Check the ESP-IDF documentation for your SoC and release before running the labs.

Overview of assignments

#

Assignment 1 runs on your ESP32-S31-Function-CoreBoard-1. Assignments 2 to 4 build firmware with production settings, with no development or test options, and run it in the ESP32 emulator in your browser. The emulator runs the real ESP32-S31 ROM and bootloader, so Secure Boot V2, flash encryption, and NVS encryption burn their eFuses exactly as on silicon, but your board is never permanently provisioned. Signed OTA updates with app rollback are covered in the optional Assignment 5, and provisioning a real board with the same firmware is covered in the optional real-board appendix.

By the end of the workshop, you will be able to:

• Navigate the main ESP32-S31 features and hardware security features
• Understand the CRA requirements relevant to embedded connected products
• Enable Secure Boot V2 and flash encryption in Release mode with production settings, and read the evidence in the boot log
• Protect data at rest with NVS encryption, using an HMAC key or keys protected by flash encryption
• Understand why the order of eFuse burns matters when you provision a device
• Protect data in transit with TLS
• Follow the TLS power consumption demo with Qoitech Otii led by the workshop instructor (Power consumption measurement)
• Map technical controls to product-level CRA compliance activities
• Build, configure, and run ESP-IDF security projects in CLion

Prerequisites

#

To follow this workshop, you will need the following hardware and software.

Required hardware

#

• ESP32-S31-Function-CoreBoard-1 (one board per participant is sufficient for the default lab track)
• USB cable supporting power and data
• Computer running Linux, macOS, or Windows

Instructor-only (Otii TLS demo): Qoitech Otii Ace Pro or equivalent, probes, and validated supply wiring. Students observe during the power consumption measurement; participant kits do not require Otii hardware.

Lab safety

#

• The workshop burns no eFuses on participant boards. Assignments 2 to 5 run in the emulator.
• Read Lab safety and the ESP32 emulator before the first assignment.
• Optional: one instructor demo board, provisioned for real for a short live demo (students observe only). See the real-board appendix.

Required software

#

• ESP-IDF v6.1
• Git
• Recent release of a desktop web browser for the ESP32 emulator (Assignments 2 to 4)
• For the optional Assignment 5: the native esp-emu tool from the esp-emulator repository, and Python 3 to run the test OTA server
• CLion, configured for ESP-IDF (see documentation)

Agenda

#

• Introduction
• Overview of the ESP32-S31 features
• Overview of the security features on the ESP32-S31
• Overview of the EU Cyber Resilience Act
• Lecture 1: TLS for secure communication
• Assignment 1: Establish and verify a TLS connection
• Power consumption measurement
• Lecture 2: Secure storage with HMAC-based NVS encryption
• Assignment 2: Protect data with HMAC-based NVS encryption
• Lecture 3: Secure Boot V2, firmware authenticity
• Assignment 3: Enable and verify Secure Boot V2
• Lecture 4: Flash encryption, confidentiality
• Assignment 4: Enable and verify flash encryption
• Assignment 5: Add secure OTA updates (optional)
• Conclusion
• Appendix: Provision a real board (permanent) (optional)

Time requirements

#

Navigation

#

Next: Introduction

Feedback

#

If you have feedback about this workshop, start a new discussion on GitHub.