Merge branch 'feature/c2_support_flash_encryption' into 'master'

esp32c2: Support Flash Encryption

Closes IDF-3899

See merge request espressif/esp-idf!17993

components/bootloader/Kconfig.projbuild

@@ -476,6 +476,11 @@ menu "Security features"
         bool
         default y if SECURE_BOOT_V2_ENABLED && SECURE_BOOT_V2_RSA_SUPPORTED
 
+    config SECURE_BOOT_FLASH_ENC_KEYS_BURN_TOGETHER
+        bool
+        default y if SOC_EFUSE_CONSISTS_OF_ONE_KEY_BLOCK && SECURE_BOOT && SECURE_FLASH_ENC_ENABLED
+        # ESP32-C2 has one key block for SB and FE keys. These keys must be burned at the same time.
+
     config SECURE_SIGNED_APPS_NO_SECURE_BOOT
         bool "Require signed app images"
         depends on !SECURE_BOOT
@@ -769,21 +774,29 @@ menu "Security features"
     choice SECURE_FLASH_ENCRYPTION_KEYSIZE
         bool "Size of generated AES-XTS key"
         default SECURE_FLASH_ENCRYPTION_AES128
-        depends on SOC_FLASH_ENCRYPTION_XTS_AES_256 && SECURE_FLASH_ENC_ENABLED
+        depends on SOC_FLASH_ENCRYPTION_XTS_AES_OPTIONS && SECURE_FLASH_ENC_ENABLED
         help
             Size of generated AES-XTS key.
 
-            AES-128 uses a 256-bit key (32 bytes) which occupies one Efuse key block.
-            AES-256 uses a 512-bit key (64 bytes) which occupies two Efuse key blocks.
+            - AES-128 uses a 256-bit key (32 bytes) derived from 128 bits (16 bytes) burned in half Efuse key block.
+              Internally, it calculates SHA256(128 bits)
+            - AES-128 uses a 256-bit key (32 bytes) which occupies one Efuse key block.
+            - AES-256 uses a 512-bit key (64 bytes) which occupies two Efuse key blocks.
 
             This setting is ignored if either type of key is already burned to Efuse before the first boot.
             In this case, the pre-burned key is used and no new key is generated.
 
+        config SECURE_FLASH_ENCRYPTION_AES128_DERIVED
+            bool "AES-128 key derived from 128 bits (SHA256(128 bits))"
+            depends on SOC_FLASH_ENCRYPTION_XTS_AES_128_DERIVED
+
         config SECURE_FLASH_ENCRYPTION_AES128
             bool "AES-128 (256-bit key)"
+            depends on SOC_FLASH_ENCRYPTION_XTS_AES_128 && !(IDF_TARGET_ESP32C2 && SECURE_BOOT)
 
         config SECURE_FLASH_ENCRYPTION_AES256
             bool "AES-256 (512-bit key)"
+            depends on SOC_FLASH_ENCRYPTION_XTS_AES_256
     endchoice
 
     choice SECURE_FLASH_ENCRYPTION_MODE

components/bootloader_support/include/esp_flash_encrypt.h

@@ -85,6 +85,49 @@ bool esp_flash_encryption_enabled(void);
  */
 esp_err_t esp_flash_encrypt_check_and_update(void);
 
+/** @brief Returns the Flash Encryption state and prints it
+ *
+ * @return True  - Flash Encryption is enabled
+ *         False - Flash Encryption is not enabled
+ */
+bool esp_flash_encrypt_state(void);
+
+/** @brief Checks if the first initialization was done
+ *
+ * If the first initialization was done then FLASH_CRYPT_CNT != 0
+ *
+ * @return true - the first initialization was done
+ *         false - the first initialization was NOT done
+ */
+bool esp_flash_encrypt_initialized_once(void);
+
+/** @brief The first initialization of Flash Encryption key and related eFuses
+ *
+ * @return ESP_OK if all operations succeeded
+ */
+esp_err_t esp_flash_encrypt_init(void);
+
+/** @brief Encrypts flash content
+ *
+ * @return ESP_OK if all operations succeeded
+ */
+esp_err_t esp_flash_encrypt_contents(void);
+
+/** @brief Activates Flash encryption on the chip
+ *
+ * It burns FLASH_CRYPT_CNT eFuse based on the CONFIG_SECURE_FLASH_ENCRYPTION_MODE_RELEASE option.
+ *
+ * @return ESP_OK if all operations succeeded
+ */
+esp_err_t esp_flash_encrypt_enable(void);
+
+/** @brief Returns True if the write protection of FLASH_CRYPT_CNT is set
+ *
+ * @param print_error Print error if it is write protected
+ *
+ * @return true - if FLASH_CRYPT_CNT is write protected
+ */
+bool esp_flash_encrypt_is_write_protected(bool print_error);
 
 /** @brief Encrypt-in-place a block of flash sectors
  *

components/bootloader_support/src/bootloader_utility.c

@@ -577,6 +577,17 @@ static void load_image(const esp_image_metadata_t *image_data)
     esp_err_t err;
 #endif
 
+#ifdef CONFIG_SECURE_BOOT_FLASH_ENC_KEYS_BURN_TOGETHER
+    if (esp_secure_boot_enabled() ^ esp_flash_encrypt_initialized_once()) {
+        ESP_LOGE(TAG, "Secure Boot and Flash Encryption cannot be enabled separately, only together (their keys go into one eFuse key block)");
+        return;
+    }
+
+    if (!esp_secure_boot_enabled() || !esp_flash_encryption_enabled()) {
+        esp_efuse_batch_write_begin();
+    }
+#endif // CONFIG_SECURE_BOOT_FLASH_ENC_KEYS_BURN_TOGETHER
+
 #ifdef CONFIG_SECURE_BOOT_V2_ENABLED
     err = esp_secure_boot_v2_permanently_enable(image_data);
     if (err != ESP_OK) {
@@ -604,13 +615,50 @@ static void load_image(const esp_image_metadata_t *image_data)
      *   5) Burn EFUSE to enable flash encryption
      */
     ESP_LOGI(TAG, "Checking flash encryption...");
-    bool flash_encryption_enabled = esp_flash_encryption_enabled();
-    err = esp_flash_encrypt_check_and_update();
-    if (err != ESP_OK) {
-        ESP_LOGE(TAG, "Flash encryption check failed (%d).", err);
+    bool flash_encryption_enabled = esp_flash_encrypt_state();
+    if (!flash_encryption_enabled) {
+#ifdef CONFIG_SECURE_FLASH_REQUIRE_ALREADY_ENABLED
+        ESP_LOGE(TAG, "flash encryption is not enabled, and SECURE_FLASH_REQUIRE_ALREADY_ENABLED is set, refusing to boot.");
         return;
+#endif // CONFIG_SECURE_FLASH_REQUIRE_ALREADY_ENABLED
+
+        if (esp_flash_encrypt_is_write_protected(true)) {
+            return;
+        }
+
+        err = esp_flash_encrypt_init();
+        if (err != ESP_OK) {
+            ESP_LOGE(TAG, "Initialization of Flash Encryption key failed (%d)", err);
+            return;
+        }
     }
-#endif
+
+#ifdef CONFIG_SECURE_BOOT_FLASH_ENC_KEYS_BURN_TOGETHER
+    if (!esp_secure_boot_enabled() || !flash_encryption_enabled) {
+        err = esp_efuse_batch_write_commit();
+        if (err != ESP_OK) {
+            ESP_LOGE(TAG, "Error programming eFuses (err=0x%x).", err);
+            return;
+        }
+        assert(esp_secure_boot_enabled());
+        ESP_LOGI(TAG, "Secure boot permanently enabled");
+    }
+#endif // CONFIG_SECURE_BOOT_FLASH_ENC_KEYS_BURN_TOGETHER
+
+    if (!flash_encryption_enabled) {
+        err = esp_flash_encrypt_contents();
+        if (err != ESP_OK) {
+            ESP_LOGE(TAG, "Encryption flash contents failed (%d)", err);
+            return;
+        }
+
+        err = esp_flash_encrypt_enable();
+        if (err != ESP_OK) {
+            ESP_LOGE(TAG, "Enabling of Flash encryption failed (%d)", err);
+            return;
+        }
+    }
+#endif // CONFIG_SECURE_FLASH_ENC_ENABLED
 
 #ifdef CONFIG_SECURE_BOOT_V1_ENABLED
     /* Step 6 (see above for full description):

components/bootloader_support/src/esp32c2/flash_encryption_secure_features.c

@@ -23,7 +23,12 @@ esp_err_t esp_flash_encryption_enable_secure_features(void)
     ESP_LOGW(TAG, "Not disabling UART bootloader encryption");
 #endif
 
+#ifndef CONFIG_SECURE_FLASH_UART_BOOTLOADER_ALLOW_CACHE
     ESP_LOGI(TAG, "Disable UART bootloader cache...");
+    esp_efuse_write_field_bit(ESP_EFUSE_DIS_DOWNLOAD_ICACHE);
+#else
+    ESP_LOGW(TAG, "Not disabling UART bootloader cache - SECURITY COMPROMISED");
+#endif
 
 #ifndef CONFIG_SECURE_BOOT_ALLOW_JTAG
     ESP_LOGI(TAG, "Disable JTAG...");

components/bootloader_support/src/flash_encrypt.c

@@ -47,10 +47,10 @@ void esp_flash_encryption_init_checks()
             if (flash_crypt_cnt == (1<<(CRYPT_CNT[0]->bit_count))-1) {
                 // If encryption counter is already max, no need to write protect it
                 // (this distinction is important on ESP32 ECO3 where write-procted FLASH_CRYPT_CNT also write-protects UART_DL_DIS)
-                return;
+            } else {
+                ESP_LOGE(TAG, "Flash encryption & Secure Boot together requires FLASH_CRYPT_CNT efuse to be write protected. Fixing now...");
+                esp_flash_write_protect_crypt_cnt();
             }
-            ESP_LOGE(TAG, "Flash encryption & Secure Boot together requires FLASH_CRYPT_CNT efuse to be write protected. Fixing now...");
-            esp_flash_write_protect_crypt_cnt();
         }
     }
 #endif // CONFIG_SECURE_BOOT
@@ -110,17 +110,6 @@ void esp_flash_write_protect_crypt_cnt(void)
 esp_flash_enc_mode_t esp_get_flash_encryption_mode(void)
 {
     bool flash_crypt_cnt_wr_dis = false;
-#if CONFIG_IDF_TARGET_ESP32
-    uint8_t dis_dl_enc = 0, dis_dl_dec = 0, dis_dl_cache = 0;
-#elif CONFIG_IDF_TARGET_ESP32S2 || CONFIG_IDF_TARGET_ESP32S3
-    uint8_t dis_dl_enc = 0;
-    uint8_t dis_dl_icache = 0;
-    uint8_t dis_dl_dcache = 0;
-#elif CONFIG_IDF_TARGET_ESP32C3 || CONFIG_IDF_TARGET_ESP32H2
-    uint8_t dis_dl_enc = 0;
-    uint8_t dis_dl_icache = 0;
-#endif
-
     esp_flash_enc_mode_t mode = ESP_FLASH_ENC_MODE_DEVELOPMENT;
 
     if (esp_flash_encryption_enabled()) {
@@ -138,27 +127,32 @@ esp_flash_enc_mode_t esp_get_flash_encryption_mode(void)
         if (flash_crypt_cnt_wr_dis) {
 
 #if CONFIG_IDF_TARGET_ESP32
-            dis_dl_cache = esp_efuse_read_field_bit(ESP_EFUSE_DISABLE_DL_CACHE);
-            dis_dl_enc = esp_efuse_read_field_bit(ESP_EFUSE_DISABLE_DL_ENCRYPT);
-            dis_dl_dec = esp_efuse_read_field_bit(ESP_EFUSE_DISABLE_DL_DECRYPT);
+            bool dis_dl_cache = esp_efuse_read_field_bit(ESP_EFUSE_DISABLE_DL_CACHE);
+            bool dis_dl_enc = esp_efuse_read_field_bit(ESP_EFUSE_DISABLE_DL_ENCRYPT);
+            bool dis_dl_dec = esp_efuse_read_field_bit(ESP_EFUSE_DISABLE_DL_DECRYPT);
             /* Check if DISABLE_DL_DECRYPT, DISABLE_DL_ENCRYPT & DISABLE_DL_CACHE are set */
             if ( dis_dl_cache && dis_dl_enc && dis_dl_dec ) {
                 mode = ESP_FLASH_ENC_MODE_RELEASE;
             }
 #elif CONFIG_IDF_TARGET_ESP32S2 || CONFIG_IDF_TARGET_ESP32S3
-            dis_dl_enc = esp_efuse_read_field_bit(ESP_EFUSE_DIS_DOWNLOAD_MANUAL_ENCRYPT);
-            dis_dl_icache = esp_efuse_read_field_bit(ESP_EFUSE_DIS_DOWNLOAD_ICACHE);
-            dis_dl_dcache = esp_efuse_read_field_bit(ESP_EFUSE_DIS_DOWNLOAD_DCACHE);
+            bool dis_dl_enc = esp_efuse_read_field_bit(ESP_EFUSE_DIS_DOWNLOAD_MANUAL_ENCRYPT);
+            bool dis_dl_icache = esp_efuse_read_field_bit(ESP_EFUSE_DIS_DOWNLOAD_ICACHE);
+            bool dis_dl_dcache = esp_efuse_read_field_bit(ESP_EFUSE_DIS_DOWNLOAD_DCACHE);
 
             if (dis_dl_enc && dis_dl_icache && dis_dl_dcache) {
                 mode = ESP_FLASH_ENC_MODE_RELEASE;
             }
-#elif CONFIG_IDF_TARGET_ESP32C3 || CONFIG_IDF_TARGET_ESP32H2
-            dis_dl_enc = esp_efuse_read_field_bit(ESP_EFUSE_DIS_DOWNLOAD_MANUAL_ENCRYPT);
-            dis_dl_icache = esp_efuse_read_field_bit(ESP_EFUSE_DIS_DOWNLOAD_ICACHE);
-
+#elif CONFIG_IDF_TARGET_ESP32C2 || CONFIG_IDF_TARGET_ESP32C3 || CONFIG_IDF_TARGET_ESP32H2
+            bool dis_dl_enc = esp_efuse_read_field_bit(ESP_EFUSE_DIS_DOWNLOAD_MANUAL_ENCRYPT);
+            bool dis_dl_icache = esp_efuse_read_field_bit(ESP_EFUSE_DIS_DOWNLOAD_ICACHE);
             if (dis_dl_enc && dis_dl_icache) {
                 mode = ESP_FLASH_ENC_MODE_RELEASE;
+#ifdef CONFIG_SOC_FLASH_ENCRYPTION_XTS_AES_128_DERIVED
+                // This chip supports two types of key: AES128_DERIVED and AES128.
+                // To be in RELEASE mode, it is important for the AES128_DERIVED key that XTS_KEY_LENGTH_256 be write-protected.
+                bool xts_key_len_256_wr_dis = esp_efuse_read_field_bit(WR_DIS_CRYPT_CNT);
+                mode = (xts_key_len_256_wr_dis) ? ESP_FLASH_ENC_MODE_RELEASE : ESP_FLASH_ENC_MODE_DEVELOPMENT;
+#endif // CONFIG_SOC_FLASH_ENCRYPTION_XTS_AES_128_DERIVED
             }
 #endif
         }
@@ -197,9 +191,15 @@ void esp_flash_encryption_set_release_mode(void)
     esp_efuse_write_field_bit(ESP_EFUSE_DIS_DOWNLOAD_MANUAL_ENCRYPT);
     esp_efuse_write_field_bit(ESP_EFUSE_DIS_DOWNLOAD_ICACHE);
     esp_efuse_write_field_bit(ESP_EFUSE_DIS_DOWNLOAD_DCACHE);
-#elif CONFIG_IDF_TARGET_ESP32C3 || CONFIG_IDF_TARGET_ESP32H2
+#elif CONFIG_IDF_TARGET_ESP32C2 || CONFIG_IDF_TARGET_ESP32C3 || CONFIG_IDF_TARGET_ESP32H2
     esp_efuse_write_field_bit(ESP_EFUSE_DIS_DOWNLOAD_MANUAL_ENCRYPT);
     esp_efuse_write_field_bit(ESP_EFUSE_DIS_DOWNLOAD_ICACHE);
+#ifdef CONFIG_SOC_FLASH_ENCRYPTION_XTS_AES_128_DERIVED
+    // For AES128_DERIVED, FE key is 16 bytes and XTS_KEY_LENGTH_256 is 0.
+    // It is important to protect XTS_KEY_LENGTH_256 from further changing it to 1. Set write protection for this bit.
+    // Burning WR_DIS_CRYPT_CNT, blocks further changing of eFuses: DIS_DOWNLOAD_MANUAL_ENCRYPT, SPI_BOOT_CRYPT_CNT, [XTS_KEY_LENGTH_256], SECURE_BOOT_EN.
+    esp_efuse_write_field_bit(WR_DIS_CRYPT_CNT);
+#endif // CONFIG_SOC_FLASH_ENCRYPTION_XTS_AES_128_DERIVED
 #else
     ESP_LOGE(TAG, "Flash Encryption support not added, abort..");
     abort();

components/bootloader_support/src/flash_encryption/flash_encrypt.c

@@ -15,9 +15,8 @@
 #include "esp_efuse_table.h"
 #include "esp_log.h"
 #include "hal/wdt_hal.h"
-#ifdef CONFIG_IDF_TARGET_ESP32C2
-// IDF-3899
-#warning "Not support flash encryption on esp32c2 yet."
+#ifdef CONFIG_SOC_EFUSE_CONSISTS_OF_ONE_KEY_BLOCK
+#include "soc/sensitive_reg.h"
 #endif
 
 #ifdef CONFIG_SECURE_FLASH_ENC_ENABLED
@@ -30,6 +29,8 @@
 #define WR_DIS_CRYPT_CNT ESP_EFUSE_WR_DIS_SPI_BOOT_CRYPT_CNT
 #endif
 
+#define FLASH_ENC_CNT_MAX (CRYPT_CNT[0]->bit_count)
+
 /* This file implements FLASH ENCRYPTION related APIs to perform
  * various operations such as programming necessary flash encryption
  * eFuses, detect whether flash encryption is enabled (by reading eFuse)
@@ -39,38 +40,86 @@
 static const char *TAG = "flash_encrypt";
 
 /* Static functions for stages of flash encryption */
-static esp_err_t initialise_flash_encryption(void);
-static esp_err_t encrypt_flash_contents(size_t flash_crypt_cnt, bool flash_crypt_wr_dis) __attribute__((unused));
 static esp_err_t encrypt_bootloader(void);
 static esp_err_t encrypt_and_load_partition_table(esp_partition_info_t *partition_table, int *num_partitions);
 static esp_err_t encrypt_partition(int index, const esp_partition_info_t *partition);
+static size_t get_flash_encrypt_cnt_value(void);
 
-esp_err_t esp_flash_encrypt_check_and_update(void)
+static size_t get_flash_encrypt_cnt_value(void)
 {
     size_t flash_crypt_cnt = 0;
     esp_efuse_read_field_cnt(CRYPT_CNT, &flash_crypt_cnt);
-    bool flash_crypt_wr_dis = esp_efuse_read_field_bit(WR_DIS_CRYPT_CNT);
+    return flash_crypt_cnt;
+}
+
+bool esp_flash_encrypt_initialized_once(void)
+{
+    return get_flash_encrypt_cnt_value() != 0;
+}
+
+bool esp_flash_encrypt_is_write_protected(bool print_error)
+{
+    if (esp_efuse_read_field_bit(WR_DIS_CRYPT_CNT)) {
+        if (print_error) {
+            ESP_LOGE(TAG, "Flash Encryption cannot be enabled (CRYPT_CNT (%d) is write protected)", get_flash_encrypt_cnt_value());
+        }
+        return true;
+    }
+    return false;
+}
+
+bool esp_flash_encrypt_state(void)
+{
+    size_t flash_crypt_cnt = get_flash_encrypt_cnt_value();
+    bool flash_crypt_wr_dis = esp_flash_encrypt_is_write_protected(false);
 
     ESP_LOGV(TAG, "CRYPT_CNT %d, write protection %d", flash_crypt_cnt, flash_crypt_wr_dis);
 
     if (flash_crypt_cnt % 2 == 1) {
         /* Flash is already encrypted */
-        int left = (CRYPT_CNT[0]->bit_count - flash_crypt_cnt) / 2;
+        int left = (FLASH_ENC_CNT_MAX - flash_crypt_cnt) / 2;
         if (flash_crypt_wr_dis) {
             left = 0; /* can't update FLASH_CRYPT_CNT, no more flashes */
         }
         ESP_LOGI(TAG, "flash encryption is enabled (%d plaintext flashes left)", left);
-        return ESP_OK;
-    } else {
+        return true;
+    }
+    return false;
+}
+
+esp_err_t esp_flash_encrypt_check_and_update(void)
+{
+    bool flash_encryption_enabled = esp_flash_encrypt_state();
+    if (!flash_encryption_enabled) {
 #ifndef CONFIG_SECURE_FLASH_REQUIRE_ALREADY_ENABLED
-        /* Flash is not encrypted, so encrypt it! */
-        return encrypt_flash_contents(flash_crypt_cnt, flash_crypt_wr_dis);
+        if (esp_flash_encrypt_is_write_protected(true)) {
+            return ESP_FAIL;
+        }
+
+        esp_err_t err = esp_flash_encrypt_init();
+        if (err != ESP_OK) {
+            ESP_LOGE(TAG, "Initialization of Flash encryption key failed (%d)", err);
+            return err;
+        }
+
+        err = esp_flash_encrypt_contents();
+        if (err != ESP_OK) {
+            ESP_LOGE(TAG, "Encryption flash contents failed (%d)", err);
+            return err;
+        }
+
+        err = esp_flash_encrypt_enable();
+        if (err != ESP_OK) {
+            ESP_LOGE(TAG, "Enabling of Flash encryption failed (%d)", err);
+            return err;
+        }
 #else
         ESP_LOGE(TAG, "flash encryption is not enabled, and SECURE_FLASH_REQUIRE_ALREADY_ENABLED "
                       "is set, refusing to boot.");
         return ESP_ERR_INVALID_STATE;
 #endif // CONFIG_SECURE_FLASH_REQUIRE_ALREADY_ENABLED
     }
+    return ESP_OK;
 }
 
 static esp_err_t check_and_generate_encryption_keys(void)
@@ -101,10 +150,10 @@ static esp_err_t check_and_generate_encryption_keys(void)
         return ESP_ERR_INVALID_STATE;
     }
 #else
-#ifdef CONFIG_SECURE_FLASH_ENCRYPTION_AES64
+#ifdef CONFIG_SECURE_FLASH_ENCRYPTION_AES128_DERIVED
     enum { BLOCKS_NEEDED = 1 };
     esp_efuse_purpose_t purposes[BLOCKS_NEEDED] = {
-        ESP_EFUSE_KEY_PURPOSE_XTS_AES_64_KEY,
+        ESP_EFUSE_KEY_PURPOSE_XTS_AES_128_KEY_DERIVED_FROM_128_EFUSE_BITS,
     };
     key_size = 16;
 #else
@@ -112,7 +161,7 @@ static esp_err_t check_and_generate_encryption_keys(void)
     esp_efuse_purpose_t purposes[BLOCKS_NEEDED] = {
         ESP_EFUSE_KEY_PURPOSE_XTS_AES_128_KEY,
     };
-#endif // CONFIG_SECURE_FLASH_ENCRYPTION_AES64
+#endif // CONFIG_SECURE_FLASH_ENCRYPTION_AES128_DERIVED
 #endif // CONFIG_SECURE_FLASH_ENCRYPTION_AES256
 #endif // CONFIG_IDF_TARGET_ESP32
 
@@ -163,8 +212,14 @@ static esp_err_t check_and_generate_encryption_keys(void)
     return ESP_OK;
 }
 
-static esp_err_t initialise_flash_encryption(void)
+esp_err_t esp_flash_encrypt_init(void)
 {
+    if (esp_flash_encryption_enabled() || esp_flash_encrypt_initialized_once()) {
+        return ESP_OK;
+    }
+
+    /* Very first flash encryption pass: generate keys, etc. */
+
     esp_efuse_batch_write_begin(); /* Batch all efuse writes at the end of this function */
 
     /* Before first flash encryption pass, need to initialise key & crypto config */
@@ -190,26 +245,15 @@ static esp_err_t initialise_flash_encryption(void)
 }
 
 /* Encrypt all flash data that should be encrypted */
-static esp_err_t encrypt_flash_contents(size_t flash_crypt_cnt, bool flash_crypt_wr_dis)
+esp_err_t esp_flash_encrypt_contents(void)
 {
     esp_err_t err;
     esp_partition_info_t partition_table[ESP_PARTITION_TABLE_MAX_ENTRIES];
     int num_partitions;
 
-    /* If all flash_crypt_cnt bits are burned or write-disabled, the
-       device can't re-encrypt itself. */
-    if (flash_crypt_wr_dis || flash_crypt_cnt == CRYPT_CNT[0]->bit_count) {
-        ESP_LOGE(TAG, "Cannot re-encrypt data CRYPT_CNT %d write disabled %d", flash_crypt_cnt, flash_crypt_wr_dis);
-        return ESP_FAIL;
-    }
-
-    if (flash_crypt_cnt == 0) {
-        /* Very first flash of encrypted data: generate keys, etc. */
-        err = initialise_flash_encryption();
-        if (err != ESP_OK) {
-            return err;
-        }
-    }
+#ifdef CONFIG_SOC_EFUSE_CONSISTS_OF_ONE_KEY_BLOCK
+    REG_WRITE(SENSITIVE_XTS_AES_KEY_UPDATE_REG, 1);
+#endif
 
     err = encrypt_bootloader();
     if (err != ESP_OK) {
@@ -234,16 +278,38 @@ static esp_err_t encrypt_flash_contents(size_t flash_crypt_cnt, bool flash_crypt
 
     ESP_LOGD(TAG, "All flash regions checked for encryption pass");
 
+    return ESP_OK;
+}
+
+esp_err_t esp_flash_encrypt_enable(void)
+{
+    esp_err_t err = ESP_OK;
+    if (!esp_flash_encryption_enabled()) {
+
+        if (esp_flash_encrypt_is_write_protected(true)) {
+            return ESP_FAIL;
+        }
+
+        size_t flash_crypt_cnt = get_flash_encrypt_cnt_value();
+
 #ifdef CONFIG_SECURE_FLASH_ENCRYPTION_MODE_RELEASE
-    // Go straight to max, permanently enabled
-    ESP_LOGI(TAG, "Setting CRYPT_CNT for permanent encryption");
-    size_t new_flash_crypt_cnt = CRYPT_CNT[0]->bit_count - flash_crypt_cnt;
+        // Go straight to max, permanently enabled
+        ESP_LOGI(TAG, "Setting CRYPT_CNT for permanent encryption");
+        size_t new_flash_crypt_cnt = FLASH_ENC_CNT_MAX - flash_crypt_cnt;
 #else
-    /* Set least significant 0-bit in flash_crypt_cnt */
-    size_t new_flash_crypt_cnt = 1;
+        /* Set least significant 0-bit in flash_crypt_cnt */
+        size_t new_flash_crypt_cnt = 1;
 #endif
-    ESP_LOGD(TAG, "CRYPT_CNT %d -> %d", flash_crypt_cnt, new_flash_crypt_cnt);
-    err = esp_efuse_write_field_cnt(CRYPT_CNT, new_flash_crypt_cnt);
+        ESP_LOGD(TAG, "CRYPT_CNT %d -> %d", flash_crypt_cnt, new_flash_crypt_cnt);
+        err = esp_efuse_write_field_cnt(CRYPT_CNT, new_flash_crypt_cnt);
+
+#if defined(CONFIG_SECURE_FLASH_ENCRYPTION_MODE_RELEASE) && defined(CONFIG_SOC_FLASH_ENCRYPTION_XTS_AES_128_DERIVED)
+        // For AES128_DERIVED, FE key is 16 bytes and XTS_KEY_LENGTH_256 is 0.
+        // It is important to protect XTS_KEY_LENGTH_256 from further changing it to 1. Set write protection for this bit.
+        // Burning WR_DIS_CRYPT_CNT, blocks further changing of eFuses: DOWNLOAD_DIS_MANUAL_ENCRYPT, SPI_BOOT_CRYPT_CNT, [XTS_KEY_LENGTH_256], SECURE_BOOT_EN.
+        esp_efuse_write_field_bit(WR_DIS_CRYPT_CNT);
+#endif
+    }
 
     ESP_LOGI(TAG, "Flash encryption completed");
 

components/bootloader_support/src/secure_boot.c

@@ -64,12 +64,14 @@ static esp_err_t secure_boot_v2_check(bool *need_fix)
 {
     esp_err_t err = ESP_OK;
     esp_efuse_block_t block = EFUSE_BLK_SECURE_BOOT;
+#ifndef CONFIG_SOC_EFUSE_CONSISTS_OF_ONE_KEY_BLOCK
     if (esp_efuse_get_key_dis_read(block)) {
         ESP_LOGE(TAG, "eFuse BLOCK%d should be readable", block);
         abort();
         // This code is not achievable because the bootloader will not boot an app in this state.
         // But we keep it here just in case (any unexpected behavior).
     }
+#endif
     if (esp_efuse_block_is_empty(block)) {
         ESP_LOGE(TAG, "eFuse BLOCK%d should not be empty", block);
         abort();

components/bootloader_support/src/secure_boot_v2/secure_boot.c

@@ -218,17 +218,24 @@ static esp_err_t check_and_generate_secure_boot_keys(const esp_image_metadata_t
                 continue;
             }
 #endif
+#ifndef CONFIG_SOC_EFUSE_CONSISTS_OF_ONE_KEY_BLOCK
             if (esp_efuse_get_key_dis_read(blocks[i])) {
                 ESP_LOGE(TAG, "Key digest (BLK%d) read protected, aborting...", blocks[i]);
                 return ESP_FAIL;
             }
+#endif
             if (esp_efuse_block_is_empty(blocks[i])) {
                 ESP_LOGE(TAG, "%d eFuse block is empty, aborting...", blocks[i]);
                 return ESP_FAIL;
             }
             esp_efuse_set_key_dis_write(blocks[i]);
-            ret = esp_efuse_read_block(blocks[i], boot_key_digests.key_digests[boot_key_digests.num_digests], 0,
-                                            sizeof(boot_key_digests.key_digests[0]) * 8);
+#ifdef CONFIG_SOC_EFUSE_CONSISTS_OF_ONE_KEY_BLOCK
+            size_t offset = 128;
+#else
+            size_t offset = 0;
+#endif
+             ret = esp_efuse_read_block(blocks[i], boot_key_digests.key_digests[boot_key_digests.num_digests], offset,
+                                            ESP_SECURE_BOOT_KEY_DIGEST_LEN * 8);
             if (ret) {
                 ESP_LOGE(TAG, "Error during reading %d eFuse block (err=0x%x)", blocks[i], ret);
                 return ret;
@@ -271,7 +278,7 @@ static esp_err_t check_and_generate_secure_boot_keys(const esp_image_metadata_t
         }
 #endif // SOC_EFUSE_REVOKE_BOOT_KEY_DIGESTS
         for (unsigned j = 0; j < app_key_digests.num_digests; j++) {
-            if (!memcmp(boot_key_digests.key_digests[i], app_key_digests.key_digests[j], ESP_SECURE_BOOT_DIGEST_LEN)) {
+            if (!memcmp(boot_key_digests.key_digests[i], app_key_digests.key_digests[j], ESP_SECURE_BOOT_KEY_DIGEST_LEN)) {
                 ESP_LOGI(TAG, "Application key(%d) matches with bootloader key(%d).", j, i);
                 match = true;
             }
@@ -331,8 +338,10 @@ esp_err_t esp_secure_boot_v2_permanently_enable(const esp_image_metadata_t *imag
     assert(esp_efuse_read_field_bit(ESP_EFUSE_SECURE_BOOT_AGGRESSIVE_REVOKE));
 #endif
 
+#ifndef CONFIG_SECURE_BOOT_FLASH_ENC_KEYS_BURN_TOGETHER
     assert(esp_secure_boot_enabled());
     ESP_LOGI(TAG, "Secure boot permanently enabled");
+#endif
 
     return ESP_OK;
 }

components/efuse/esp32c2/include/esp_efuse.h

@@ -44,7 +44,7 @@ typedef enum {
 typedef enum {
     ESP_EFUSE_KEY_PURPOSE_USER              = 0,    /**< whole BLOCK3 */
     ESP_EFUSE_KEY_PURPOSE_XTS_AES_128_KEY   = 1,    /**< FE uses the whole BLOCK3 (key is 256-bits) */
-    ESP_EFUSE_KEY_PURPOSE_XTS_AES_64_KEY    = 2,    /**< FE uses lower 128-bits of BLOCK3 (key is 128-bits) */
+    ESP_EFUSE_KEY_PURPOSE_XTS_AES_128_KEY_DERIVED_FROM_128_EFUSE_BITS    = 2,    /**< FE uses lower 128-bits of BLOCK3 (key is 128-bits) */
     ESP_EFUSE_KEY_PURPOSE_SECURE_BOOT_V2    = 3,    /**< SB uses higher 128-bits of BLOCK3 (key is 128-bits) */
     ESP_EFUSE_KEY_PURPOSE_MAX,                      /**< MAX PURPOSE */
 } esp_efuse_purpose_t;

components/efuse/src/efuse_controller/keys/without_key_purposes/one_key_block/esp_efuse_api_key.c

@@ -153,7 +153,7 @@ esp_efuse_purpose_t esp_efuse_get_key_purpose(esp_efuse_block_t block)
     if (esp_efuse_read_field_bit(ESP_EFUSE_XTS_KEY_LENGTH_256)) {
         return ESP_EFUSE_KEY_PURPOSE_XTS_AES_128_KEY;
     }
-    return ESP_EFUSE_KEY_PURPOSE_XTS_AES_64_KEY;
+    return ESP_EFUSE_KEY_PURPOSE_XTS_AES_128_KEY_DERIVED_FROM_128_EFUSE_BITS;
 }
 
 
@@ -189,7 +189,7 @@ esp_err_t esp_efuse_write_key(esp_efuse_block_t block, esp_efuse_purpose_t purpo
     if (block < EFUSE_BLK_KEY0 || block >= EFUSE_BLK_KEY_MAX || key_size_bytes > 32 || purpose >= ESP_EFUSE_KEY_PURPOSE_MAX) {
         return ESP_ERR_INVALID_ARG;
     }
-    if ((purpose == ESP_EFUSE_KEY_PURPOSE_SECURE_BOOT_V2 || purpose == ESP_EFUSE_KEY_PURPOSE_XTS_AES_64_KEY) && (key_size_bytes != 16)) {
+    if ((purpose == ESP_EFUSE_KEY_PURPOSE_SECURE_BOOT_V2 || purpose == ESP_EFUSE_KEY_PURPOSE_XTS_AES_128_KEY_DERIVED_FROM_128_EFUSE_BITS) && (key_size_bytes != 16)) {
         return ESP_ERR_INVALID_ARG;
     }
 
@@ -202,9 +202,10 @@ esp_err_t esp_efuse_write_key(esp_efuse_block_t block, esp_efuse_purpose_t purpo
         ESP_EFUSE_CHK(esp_efuse_write_block(block, key, offset_in_bits, key_size_bytes * 8));
         if (purpose == ESP_EFUSE_KEY_PURPOSE_XTS_AES_128_KEY) {
             ESP_EFUSE_CHK(esp_efuse_set_key_purpose(block, purpose));
-        }
-        if (purpose == ESP_EFUSE_KEY_PURPOSE_XTS_AES_128_KEY || purpose == ESP_EFUSE_KEY_PURPOSE_XTS_AES_64_KEY) {
-            ESP_EFUSE_CHK(esp_efuse_set_key_dis_read(block));
+            ESP_EFUSE_CHK(esp_efuse_write_field_bit(ESP_EFUSE_RD_DIS_KEY0_LOW));
+            ESP_EFUSE_CHK(esp_efuse_write_field_bit(ESP_EFUSE_RD_DIS_KEY0_HI));
+        } else if (purpose == ESP_EFUSE_KEY_PURPOSE_XTS_AES_128_KEY_DERIVED_FROM_128_EFUSE_BITS) {
+            ESP_EFUSE_CHK(esp_efuse_write_field_bit(ESP_EFUSE_RD_DIS_KEY0_LOW));
         }
         ESP_EFUSE_CHK(esp_efuse_set_key_dis_write(block));
         return esp_efuse_batch_write_commit();
@@ -227,7 +228,7 @@ esp_err_t esp_efuse_write_keys(const esp_efuse_purpose_t purposes[], uint8_t key
     for (unsigned i_key = 0; i_key < number_of_keys; i_key++) {
         purpose = purposes[i_key];
         ESP_LOGI(TAG, "Writing EFUSE_BLK_KEY0 with purpose %d", purpose);
-        size_t key_size = (purpose == ESP_EFUSE_KEY_PURPOSE_SECURE_BOOT_V2 || purpose == ESP_EFUSE_KEY_PURPOSE_XTS_AES_64_KEY) ? 16 : 32;
+        size_t key_size = (purpose == ESP_EFUSE_KEY_PURPOSE_SECURE_BOOT_V2 || purpose == ESP_EFUSE_KEY_PURPOSE_XTS_AES_128_KEY_DERIVED_FROM_128_EFUSE_BITS) ? 16 : 32;
         ESP_EFUSE_CHK(esp_efuse_write_key(EFUSE_BLK_KEY0, purpose, keys[i_key], key_size));
     }
     return esp_efuse_batch_write_commit();

components/efuse/test/one_key_block/test_efuse_keys.c

@@ -34,7 +34,7 @@ TEST_CASE("Test keys and purposes, rd, wr, wr_key_purposes are in the initial st
         TEST_ASSERT_EACH_EQUAL_HEX8(0, key, sizeof(key));
         TEST_ASSERT_FALSE(esp_efuse_get_key_dis_read(num_key));
         TEST_ASSERT_FALSE(esp_efuse_get_key_dis_write(num_key));
-        TEST_ASSERT_EQUAL(ESP_EFUSE_KEY_PURPOSE_XTS_AES_64_KEY, esp_efuse_get_key_purpose(num_key));
+        TEST_ASSERT_EQUAL(ESP_EFUSE_KEY_PURPOSE_XTS_AES_128_KEY_DERIVED_FROM_128_EFUSE_BITS, esp_efuse_get_key_purpose(num_key));
 
         esp_efuse_block_t key_block = EFUSE_BLK_MAX;
         TEST_ASSERT_TRUE(esp_efuse_find_purpose(ESP_EFUSE_KEY_PURPOSE_USER, NULL));
@@ -53,7 +53,7 @@ static esp_err_t s_check_key(esp_efuse_block_t num_key, void* wr_key, esp_efuse_
 {
     size_t offset_in_bits = 0;
     uint8_t key_size = 32;
-    if (purpose == ESP_EFUSE_KEY_PURPOSE_XTS_AES_64_KEY || purpose == ESP_EFUSE_KEY_PURPOSE_SECURE_BOOT_V2) {
+    if (purpose == ESP_EFUSE_KEY_PURPOSE_XTS_AES_128_KEY_DERIVED_FROM_128_EFUSE_BITS || purpose == ESP_EFUSE_KEY_PURPOSE_SECURE_BOOT_V2) {
         key_size = 16;
     }
 
@@ -69,7 +69,7 @@ static esp_err_t s_check_key(esp_efuse_block_t num_key, void* wr_key, esp_efuse_
 #endif // not CONFIG_IDF_ENV_FPGA
 
     TEST_ASSERT_TRUE(esp_efuse_get_key_dis_write(num_key));
-    if (purpose == ESP_EFUSE_KEY_PURPOSE_XTS_AES_128_KEY || purpose == ESP_EFUSE_KEY_PURPOSE_XTS_AES_64_KEY) {
+    if (purpose == ESP_EFUSE_KEY_PURPOSE_XTS_AES_128_KEY || purpose == ESP_EFUSE_KEY_PURPOSE_XTS_AES_128_KEY_DERIVED_FROM_128_EFUSE_BITS) {
         TEST_ASSERT_TRUE(esp_efuse_get_key_dis_read(num_key));
 #if CONFIG_IDF_ENV_FPGA && !CONFIG_EFUSE_VIRTUAL
         TEST_ASSERT_EACH_EQUAL_HEX8(0, rd_key, key_size);
@@ -91,7 +91,7 @@ void test_write_key(esp_efuse_block_t num_key, esp_efuse_purpose_t purpose) {
     }
 
     uint8_t key_size = sizeof(wr_key);
-    if (purpose == ESP_EFUSE_KEY_PURPOSE_XTS_AES_64_KEY || purpose == ESP_EFUSE_KEY_PURPOSE_SECURE_BOOT_V2) {
+    if (purpose == ESP_EFUSE_KEY_PURPOSE_XTS_AES_128_KEY_DERIVED_FROM_128_EFUSE_BITS || purpose == ESP_EFUSE_KEY_PURPOSE_SECURE_BOOT_V2) {
         key_size = 16;
     }
 
@@ -117,7 +117,7 @@ TEST_CASE("Test esp_efuse_write_key for virt mode", "[efuse]")
     TEST_ESP_ERR(ESP_ERR_INVALID_ARG, esp_efuse_write_key(EFUSE_BLK_KEY0, ESP_EFUSE_KEY_PURPOSE_USER, &rd_key, 33));
     TEST_ESP_ERR(ESP_ERR_INVALID_ARG, esp_efuse_write_key(EFUSE_BLK3, ESP_EFUSE_KEY_PURPOSE_USER, NULL, sizeof(rd_key)));
     TEST_ESP_ERR(ESP_ERR_INVALID_ARG, esp_efuse_write_key(EFUSE_BLK0, ESP_EFUSE_KEY_PURPOSE_USER, &rd_key, sizeof(rd_key)));
-    TEST_ESP_ERR(ESP_ERR_INVALID_ARG, esp_efuse_write_key(EFUSE_BLK0, ESP_EFUSE_KEY_PURPOSE_XTS_AES_64_KEY, &rd_key, sizeof(rd_key)));
+    TEST_ESP_ERR(ESP_ERR_INVALID_ARG, esp_efuse_write_key(EFUSE_BLK0, ESP_EFUSE_KEY_PURPOSE_XTS_AES_128_KEY_DERIVED_FROM_128_EFUSE_BITS, &rd_key, sizeof(rd_key)));
     TEST_ESP_ERR(ESP_ERR_INVALID_ARG, esp_efuse_write_key(EFUSE_BLK0, ESP_EFUSE_KEY_PURPOSE_SECURE_BOOT_V2, &rd_key, sizeof(rd_key)));
 
     for (esp_efuse_purpose_t purpose = ESP_EFUSE_KEY_PURPOSE_USER; purpose < ESP_EFUSE_KEY_PURPOSE_MAX; ++purpose) {
@@ -145,9 +145,9 @@ TEST_CASE("Test 1 esp_efuse_write_key for FPGA", "[efuse]")
     esp_efuse_utility_debug_dump_blocks();
     TEST_ASSERT_TRUE(esp_efuse_key_block_unused(EFUSE_BLK_KEY0));
     TEST_ASSERT_TRUE(esp_efuse_block_is_empty(EFUSE_BLK_KEY0));
-    TEST_ASSERT_TRUE(esp_efuse_find_purpose(ESP_EFUSE_KEY_PURPOSE_XTS_AES_64_KEY, NULL));
+    TEST_ASSERT_TRUE(esp_efuse_find_purpose(ESP_EFUSE_KEY_PURPOSE_XTS_AES_128_KEY_DERIVED_FROM_128_EFUSE_BITS, NULL));
 
-    test_write_key(EFUSE_BLK_KEY0, ESP_EFUSE_KEY_PURPOSE_XTS_AES_64_KEY);
+    test_write_key(EFUSE_BLK_KEY0, ESP_EFUSE_KEY_PURPOSE_XTS_AES_128_KEY_DERIVED_FROM_128_EFUSE_BITS);
 
     esp_efuse_utility_debug_dump_blocks();
 
@@ -168,7 +168,7 @@ TEST_CASE("Test 2 esp_efuse_write_key for FPGA", "[efuse]")
     esp_efuse_utility_debug_dump_blocks();
     TEST_ASSERT_TRUE(esp_efuse_key_block_unused(EFUSE_BLK_KEY0));
     TEST_ASSERT_TRUE(esp_efuse_block_is_empty(EFUSE_BLK_KEY0));
-    TEST_ASSERT_TRUE(esp_efuse_find_purpose(ESP_EFUSE_KEY_PURPOSE_XTS_AES_64_KEY, NULL));
+    TEST_ASSERT_TRUE(esp_efuse_find_purpose(ESP_EFUSE_KEY_PURPOSE_XTS_AES_128_KEY_DERIVED_FROM_128_EFUSE_BITS, NULL));
 
     test_write_key(EFUSE_BLK_KEY0, ESP_EFUSE_KEY_PURPOSE_SECURE_BOOT_V2);
 
@@ -212,12 +212,12 @@ TEST_CASE("Test esp_efuse_write_keys", "[efuse]")
     esp_efuse_utility_debug_dump_blocks();
     TEST_ASSERT_TRUE(esp_efuse_key_block_unused(EFUSE_BLK_KEY0));
     TEST_ASSERT_TRUE(esp_efuse_block_is_empty(EFUSE_BLK_KEY0));
-    TEST_ASSERT_TRUE(esp_efuse_find_purpose(ESP_EFUSE_KEY_PURPOSE_XTS_AES_64_KEY, NULL));
+    TEST_ASSERT_TRUE(esp_efuse_find_purpose(ESP_EFUSE_KEY_PURPOSE_XTS_AES_128_KEY_DERIVED_FROM_128_EFUSE_BITS, NULL));
     esp_efuse_block_t key_block = EFUSE_BLK_MAX;
 
     enum { BLOCKS_NEEDED1 = 2 };
     esp_efuse_purpose_t purpose1[BLOCKS_NEEDED1] = {
-        ESP_EFUSE_KEY_PURPOSE_XTS_AES_64_KEY,
+        ESP_EFUSE_KEY_PURPOSE_XTS_AES_128_KEY_DERIVED_FROM_128_EFUSE_BITS,
         ESP_EFUSE_KEY_PURPOSE_SECURE_BOOT_V2,
     };
     uint8_t keys1[BLOCKS_NEEDED1][32] = {{0xEE}};
@@ -233,7 +233,7 @@ TEST_CASE("Test esp_efuse_write_keys", "[efuse]")
     TEST_ASSERT_TRUE(esp_efuse_find_purpose(purpose1[0], &key_block));
     TEST_ASSERT_EQUAL(EFUSE_BLK_KEY0, key_block);
 
-    TEST_ESP_OK(s_check_key(EFUSE_BLK_KEY0, keys1[0], ESP_EFUSE_KEY_PURPOSE_XTS_AES_64_KEY));
+    TEST_ESP_OK(s_check_key(EFUSE_BLK_KEY0, keys1[0], ESP_EFUSE_KEY_PURPOSE_XTS_AES_128_KEY_DERIVED_FROM_128_EFUSE_BITS));
     TEST_ESP_OK(s_check_key(EFUSE_BLK_KEY0, keys1[1], ESP_EFUSE_KEY_PURPOSE_SECURE_BOOT_V2));
 
     esp_efuse_utility_debug_dump_blocks();
@@ -260,7 +260,7 @@ TEST_CASE("Test esp_efuse_write_keys for returned errors", "[efuse]")
 
     enum { BLOCKS_NEEDED = 2 };
     esp_efuse_purpose_t purpose[BLOCKS_NEEDED] = {
-        ESP_EFUSE_KEY_PURPOSE_XTS_AES_64_KEY,
+        ESP_EFUSE_KEY_PURPOSE_XTS_AES_128_KEY_DERIVED_FROM_128_EFUSE_BITS,
         ESP_EFUSE_KEY_PURPOSE_MAX,                 // it leads  ESP_ERR_INVALID_ARG in esp_efuse_write_keys
     };
     uint8_t keys[BLOCKS_NEEDED][32];

components/hal/esp32c2/include/hal/spi_flash_encrypted_ll.h

@@ -35,7 +35,9 @@ typedef enum
  */
 static inline void spi_flash_encrypt_ll_enable(void)
 {
-    abort();
+    REG_SET_BIT(SYSTEM_EXTERNAL_DEVICE_ENCRYPT_DECRYPT_CONTROL_REG,
+                SYSTEM_ENABLE_DOWNLOAD_MANUAL_ENCRYPT |
+                SYSTEM_ENABLE_SPI_MANUAL_ENCRYPT);
 }
 
 /*
@@ -43,7 +45,8 @@ static inline void spi_flash_encrypt_ll_enable(void)
  */
 static inline void spi_flash_encrypt_ll_disable(void)
 {
-    abort();
+    REG_CLR_BIT(SYSTEM_EXTERNAL_DEVICE_ENCRYPT_DECRYPT_CONTROL_REG,
+                SYSTEM_ENABLE_SPI_MANUAL_ENCRYPT);
 }
 
 /**
@@ -55,7 +58,9 @@ static inline void spi_flash_encrypt_ll_disable(void)
  */
 static inline void spi_flash_encrypt_ll_type(flash_encrypt_ll_type_t type)
 {
-    abort();
+    // Our hardware only support flash encryption
+    HAL_ASSERT(type == FLASH_ENCRYPTION_MANU);
+    REG_WRITE(AES_XTS_DESTINATION_REG, type);
 }
 
 /**
@@ -65,7 +70,8 @@ static inline void spi_flash_encrypt_ll_type(flash_encrypt_ll_type_t type)
  */
 static inline void spi_flash_encrypt_ll_buffer_length(uint32_t size)
 {
-    abort();
+    // Desired block should not be larger than the block size.
+    REG_WRITE(AES_XTS_SIZE_REG, size >> 5);
 }
 
 /**
@@ -78,7 +84,8 @@ static inline void spi_flash_encrypt_ll_buffer_length(uint32_t size)
  */
 static inline void spi_flash_encrypt_ll_plaintext_save(uint32_t address, const uint32_t* buffer, uint32_t size)
 {
-    abort();
+    uint32_t plaintext_offs = (address % 64);
+    memcpy((void *)(AES_XTS_PLAIN_BASE + plaintext_offs), buffer, size);
 }
 
 /**
@@ -88,7 +95,7 @@ static inline void spi_flash_encrypt_ll_plaintext_save(uint32_t address, const u
  */
 static inline void spi_flash_encrypt_ll_address_save(uint32_t flash_addr)
 {
-    abort();
+    REG_WRITE(AES_XTS_PHYSICAL_ADDR_REG, flash_addr);
 }
 
 /**
@@ -96,7 +103,7 @@ static inline void spi_flash_encrypt_ll_address_save(uint32_t flash_addr)
  */
 static inline void spi_flash_encrypt_ll_calculate_start(void)
 {
-    abort();
+    REG_WRITE(AES_XTS_TRIGGER_REG, 1);
 }
 
 /**
@@ -104,7 +111,8 @@ static inline void spi_flash_encrypt_ll_calculate_start(void)
  */
 static inline void spi_flash_encrypt_ll_calculate_wait_idle(void)
 {
-    abort();
+    while(REG_READ(AES_XTS_STATE_REG) == 0x1) {
+    }
 }
 
 /**
@@ -112,7 +120,9 @@ static inline void spi_flash_encrypt_ll_calculate_wait_idle(void)
  */
 static inline void spi_flash_encrypt_ll_done(void)
 {
-    abort();
+    REG_WRITE(AES_XTS_RELEASE_REG, 1);
+    while(REG_READ(AES_XTS_STATE_REG) != 0x3) {
+    }
 }
 
 /**
@@ -120,7 +130,7 @@ static inline void spi_flash_encrypt_ll_done(void)
  */
 static inline void spi_flash_encrypt_ll_destroy(void)
 {
-    abort();
+    REG_WRITE(AES_XTS_DESTROY_REG, 1);
 }
 
 /**
@@ -131,7 +141,7 @@ static inline void spi_flash_encrypt_ll_destroy(void)
  */
 static inline bool spi_flash_encrypt_ll_check(uint32_t address, uint32_t length)
 {
-    abort();
+    return ((address % length) == 0) ? true : false;
 }
 
 #ifdef __cplusplus

components/soc/esp32c2/include/soc/Kconfig.soc_caps.in

@@ -467,9 +467,17 @@ config SOC_FLASH_ENCRYPTION_XTS_AES
     bool
     default y
 
+config SOC_FLASH_ENCRYPTION_XTS_AES_OPTIONS
+    bool
+    default y
+
 config SOC_FLASH_ENCRYPTION_XTS_AES_128
     bool
-    default n
+    default y
+
+config SOC_FLASH_ENCRYPTION_XTS_AES_128_DERIVED
+    bool
+    default y
 
 config SOC_UART_NUM
     int

components/soc/esp32c2/include/soc/hwcrypto_reg.h

@@ -27,4 +27,15 @@
 #define SHA_H_BASE                    ((DR_REG_SHA_BASE) + 0x40)
 #define SHA_TEXT_BASE                 ((DR_REG_SHA_BASE) + 0x80)
 
+/* AES-XTS registers */
+#define AES_XTS_PLAIN_BASE        ((DR_REG_AES_XTS_BASE) + 0x00)
+#define AES_XTS_SIZE_REG          ((DR_REG_AES_XTS_BASE) + 0x40)
+#define AES_XTS_DESTINATION_REG   ((DR_REG_AES_XTS_BASE) + 0x44)
+#define AES_XTS_PHYSICAL_ADDR_REG ((DR_REG_AES_XTS_BASE) + 0x48)
+
+#define AES_XTS_TRIGGER_REG       ((DR_REG_AES_XTS_BASE) + 0x4C)
+#define AES_XTS_RELEASE_REG       ((DR_REG_AES_XTS_BASE) + 0x50)
+#define AES_XTS_DESTROY_REG       ((DR_REG_AES_XTS_BASE) + 0x54)
+#define AES_XTS_STATE_REG         ((DR_REG_AES_XTS_BASE) + 0x58)
+
 #endif

components/soc/esp32c2/include/soc/reg_base.h

@@ -41,3 +41,4 @@
 #define DR_REG_BLE_SEC_BASE                     0x6004C000
 #define DR_REG_COEX_BIT_BASE                    0x6004C400
 #define DR_REG_I2C_MST_BASE                     0x6004E800
+#define DR_REG_AES_XTS_BASE                     0x600CC000

components/soc/esp32c2/include/soc/soc_caps.h

@@ -236,8 +236,10 @@
 
 /*-------------------------- Flash Encryption CAPS----------------------------*/
 #define SOC_FLASH_ENCRYPTED_XTS_AES_BLOCK_MAX   (32)
-#define SOC_FLASH_ENCRYPTION_XTS_AES            1
-#define SOC_FLASH_ENCRYPTION_XTS_AES_128        0        // This will be enabled with IDF-3899
+#define SOC_FLASH_ENCRYPTION_XTS_AES             1
+#define SOC_FLASH_ENCRYPTION_XTS_AES_OPTIONS     1
+#define SOC_FLASH_ENCRYPTION_XTS_AES_128         1
+#define SOC_FLASH_ENCRYPTION_XTS_AES_128_DERIVED 1
 
 /*-------------------------- UART CAPS ---------------------------------------*/
 // ESP32-C2 has 2 UARTs

components/soc/esp32s2/include/soc/Kconfig.soc_caps.in

@@ -759,6 +759,10 @@ config SOC_FLASH_ENCRYPTION_XTS_AES
     bool
     default y
 
+config SOC_FLASH_ENCRYPTION_XTS_AES_OPTIONS
+    bool
+    default y
+
 config SOC_FLASH_ENCRYPTION_XTS_AES_128
     bool
     default y

components/soc/esp32s2/include/soc/soc_caps.h

@@ -349,6 +349,7 @@
 /*-------------------------- Flash Encryption CAPS----------------------------*/
 #define SOC_FLASH_ENCRYPTED_XTS_AES_BLOCK_MAX   (64)
 #define SOC_FLASH_ENCRYPTION_XTS_AES        1
+#define SOC_FLASH_ENCRYPTION_XTS_AES_OPTIONS 1
 #define SOC_FLASH_ENCRYPTION_XTS_AES_128    1
 #define SOC_FLASH_ENCRYPTION_XTS_AES_256    1
 

components/soc/esp32s3/include/soc/Kconfig.soc_caps.in

@@ -899,6 +899,10 @@ config SOC_FLASH_ENCRYPTION_XTS_AES
     bool
     default y
 
+config SOC_FLASH_ENCRYPTION_XTS_AES_OPTIONS
+    bool
+    default y
+
 config SOC_FLASH_ENCRYPTION_XTS_AES_128
     bool
     default y

components/soc/esp32s3/include/soc/soc_caps.h

@@ -383,6 +383,7 @@
 /*-------------------------- Flash Encryption CAPS----------------------------*/
 #define SOC_FLASH_ENCRYPTED_XTS_AES_BLOCK_MAX   (64)
 #define SOC_FLASH_ENCRYPTION_XTS_AES        1
+#define SOC_FLASH_ENCRYPTION_XTS_AES_OPTIONS 1
 #define SOC_FLASH_ENCRYPTION_XTS_AES_128    1
 #define SOC_FLASH_ENCRYPTION_XTS_AES_256    1
 

docs/docs_not_updated/esp32c2.txt

@@ -170,4 +170,15 @@ api-reference/protocols/esp_tls
 api-reference/protocols/mdns
 api-reference/protocols/index
 api-reference/protocols/asio
-security/flash-encryption
+get-started/establish-serial-connection
+get-started/macos-setup-scratch
+get-started/vscode-setup
+get-started/linux-setup-scratch
+get-started/eclipse-setup
+get-started/windows-setup
+get-started/toolchain-setup-scratch
+get-started/windows-setup-scratch
+get-started/linux-setup
+get-started/index
+get-started/windows-setup-update
+get-started/macos-setup

docs/en/security/esp32c2_log.inc

@@ -3,8 +3,63 @@
 
 .. code-block:: none
 
-    Update with ESP32C2 specific info IDF-4208
-
+    ESP-ROM:esp8684-api1-20211015
+    Build:Oct 15 2021
+    rst:0x1 (POWERON),boot:0xc (SPI_FAST_FLASH_BOOT)
+    SPIWP:0xee
+    mode:DIO, clock div:1
+    load:0x3fcd6190,len:0x2a84
+    load:0x403ae000,len:0x830
+    load:0x403b0000,len:0x42a0
+    entry 0x403ae000
+    I (21) boot: ESP-IDF v5.0-dev-2717-g0d1e015-dirty 2nd stage bootloader
+    I (21) boot: compile time 19:36:15
+    I (21) boot: chip revision: 0
+    I (24) boot.esp32c2: MMU Page Size  : 64K
+    I (29) boot.esp32c2: SPI Speed      : 60MHz
+    I (34) boot.esp32c2: SPI Mode       : DIO
+    I (39) boot.esp32c2: SPI Flash Size : 2MB
+    I (43) boot: Enabling RNG early entropy source...
+    I (49) boot: Partition Table:
+    I (52) boot: ## Label            Usage          Type ST Offset   Length
+    I (60) boot:  0 nvs              WiFi data        01 02 00010000 00006000
+    I (67) boot:  1 phy_init         RF data          01 01 00016000 00001000
+    I (75) boot:  2 factory          factory app      00 00 00020000 00100000
+    I (82) boot: End of partition table
+    I (86) esp_image: segment 0: paddr=00020020 vaddr=3c010020 size=06858h ( 26712) map
+    I (101) esp_image: segment 1: paddr=00026880 vaddr=3fca9a60 size=01430h (  5168) load
+    I (104) esp_image: segment 2: paddr=00027cb8 vaddr=40380000 size=08360h ( 33632) load
+    I (120) esp_image: segment 3: paddr=00030020 vaddr=42000020 size=0f67ch ( 63100) map
+    I (134) esp_image: segment 4: paddr=0003f6a4 vaddr=40388360 size=01700h (  5888) load
+    I (139) boot: Loaded app from partition at offset 0x20000
+    I (139) boot: Checking flash encryption...
+    I (142) efuse: Batch mode of writing fields is enabled
+    I (148) flash_encrypt: Generating new flash encryption key...
+    I (155) efuse: Writing EFUSE_BLK_KEY0 with purpose 1
+    W (161) flash_encrypt: Not disabling UART bootloader encryption
+    I (167) flash_encrypt: Disable UART bootloader cache...
+    I (175) flash_encrypt: Disable JTAG...
+    I (190) efuse: BURN BLOCK3
+    I (195) efuse: BURN BLOCK3 - OK (write block == read block)
+    I (204) efuse: BURN BLOCK0
+    I (208) efuse: BURN BLOCK0 - OK (write block == read block)
+    I (213) efuse: Batch mode. Prepared fields are committed
+    I (219) esp_image: segment 0: paddr=00000020 vaddr=3fcd6190 size=02a84h ( 10884)
+    I (229) esp_image: segment 1: paddr=00002aac vaddr=403ae000 size=00830h (  2096)
+    I (236) esp_image: segment 2: paddr=000032e4 vaddr=403b0000 size=042a0h ( 17056)
+    I (679) flash_encrypt: bootloader encrypted successfully
+    I (731) flash_encrypt: partition table encrypted and loaded successfully
+    I (731) esp_image: segment 0: paddr=00020020 vaddr=3c010020 size=06858h ( 26712) map
+    I (741) esp_image: segment 1: paddr=00026880 vaddr=3fca9a60 size=01430h (  5168)
+    I (745) esp_image: segment 2: paddr=00027cb8 vaddr=40380000 size=08360h ( 33632)
+    I (759) esp_image: segment 3: paddr=00030020 vaddr=42000020 size=0f67ch ( 63100) map
+    I (774) esp_image: segment 4: paddr=0003f6a4 vaddr=40388360 size=01700h (  5888)
+    I (776) flash_encrypt: Encrypting partition 2 at offset 0x20000 (length 0x100000)...
+    I (6429) flash_encrypt: Done encrypting
+    I (6429) efuse: BURN BLOCK0
+    I (6432) efuse: BURN BLOCK0 - OK (all write block bits are set)
+    I (6438) flash_encrypt: Flash encryption completed
+    I (6443) boot: Resetting with flash encryption enabled...
 
 ------
 
@@ -12,7 +67,63 @@
 
 .. code-block:: none
 
-    Update with ESP32C2 specific info IDF-4208
+    ESP-ROM:esp8684-api1-20211015
+    Build:Oct 15 2021
+    rst:0x3 (RTC_SW_SYS_RST),boot:0xc (SPI_FAST_FLASH_BOOT)
+    Saved PC:0x403b0f9e
+    SPIWP:0xee
+    mode:DIO, clock div:1
+    load:0x3fcd6190,len:0x2a84
+    load:0x403ae000,len:0x830
+    load:0x403b0000,len:0x42a0
+    entry 0x403ae000
+    I (23) boot: ESP-IDF v5.0-dev-2717-g0d1e015-dirty 2nd stage bootloader
+    I (23) boot: compile time 19:36:15
+    I (23) boot: chip revision: 0
+    I (27) boot.esp32c2: MMU Page Size  : 64K
+    I (32) boot.esp32c2: SPI Speed      : 60MHz
+    I (36) boot.esp32c2: SPI Mode       : DIO
+    I (41) boot.esp32c2: SPI Flash Size : 2MB
+    I (46) boot: Enabling RNG early entropy source...
+    I (51) boot: Partition Table:
+    I (55) boot: ## Label            Usage          Type ST Offset   Length
+    I (62) boot:  0 nvs              WiFi data        01 02 00010000 00006000
+    I (70) boot:  1 phy_init         RF data          01 01 00016000 00001000
+    I (77) boot:  2 factory          factory app      00 00 00020000 00100000
+    I (85) boot: End of partition table
+    I (89) esp_image: segment 0: paddr=00020020 vaddr=3c010020 size=06858h ( 26712) map
+    I (103) esp_image: segment 1: paddr=00026880 vaddr=3fca9a60 size=01430h (  5168) load
+    I (107) esp_image: segment 2: paddr=00027cb8 vaddr=40380000 size=08360h ( 33632) load
+    I (123) esp_image: segment 3: paddr=00030020 vaddr=42000020 size=0f67ch ( 63100) map
+    I (138) esp_image: segment 4: paddr=0003f6a4 vaddr=40388360 size=01700h (  5888) load
+    I (143) boot: Loaded app from partition at offset 0x20000
+    I (143) boot: Checking flash encryption...
+    I (146) flash_encrypt: flash encryption is enabled (1 plaintext flashes left)
+    I (154) boot: Disabling RNG early entropy source...
+    I (171) cpu_start: Pro cpu up.
+    I (179) cpu_start: Pro cpu start user code
+    I (179) cpu_start: cpu freq: 120000000 Hz
+    I (179) cpu_start: Application information:
+    I (182) cpu_start: Project name:     hello_world
+    I (187) cpu_start: App version:      v5.0-dev-2717-g0d1e015-dirty
+    I (194) cpu_start: Compile time:     May 20 2022 19:35:55
+    I (200) cpu_start: ELF file SHA256:  04592ac3c9304cdc...
+    I (206) cpu_start: ESP-IDF:          v5.0-dev-2717-g0d1e015-dirty
+    I (213) heap_init: Initializing. RAM available for dynamic allocation:
+    I (220) heap_init: At 3FCABCB0 len 0002C350 (176 KiB): D/IRAM
+    I (226) heap_init: At 3FCD8000 len 0000742C (29 KiB): STACK/DRAM
+    I (234) spi_flash: detected chip: generic
+    I (238) spi_flash: flash io: dio
+    W (242) flash_encrypt: Flash encryption mode is DEVELOPMENT (not secure)
+    I (249) sleep: Configure to isolate all GPIO pins in sleep state
+    I (256) sleep: Enable automatic switching of GPIO sleep configuration
+    W (263) INT_WDT: ESP32-C2 only has one timer group
+    I (268) cpu_start: Starting scheduler.
+    Hello world!
+    This is esp32c2 chip with 1 CPU core(s), WiFi/BLE, silicon revision 0, 2MB external flash
+    Minimum free heap size: 195052 bytes
 
+    FLASH_CRYPT_CNT eFuse value is 1
+    Flash encryption feature is enabled in DEVELOPMENT mode
 
 ------

docs/en/security/flash-encryption.rst

@@ -100,7 +100,7 @@ The flash encryption operation is controlled by various eFuses available on {IDF
          - Enables encryption and decryption, when an SPI boot mode is set. Feature is enabled if 1 or 3 bits are set in the eFuse, disabled otherwise.
          - 3
 
-.. only:: SOC_FLASH_ENCRYPTION_XTS_AES and not SOC_FLASH_ENCRYPTION_XTS_AES_256
+.. only:: SOC_FLASH_ENCRYPTION_XTS_AES_128 and not SOC_FLASH_ENCRYPTION_XTS_AES_256 and not SOC_EFUSE_CONSISTS_OF_ONE_KEY_BLOCK
 
     .. list-table:: eFuses Used in Flash Encryption
        :widths: 25 40 10
@@ -122,12 +122,38 @@ The flash encryption operation is controlled by various eFuses available on {IDF
          - Enables encryption and decryption, when an SPI boot mode is set. Feature is enabled if 1 or 3 bits are set in the eFuse, disabled otherwise.
          - 3
 
+.. only:: SOC_FLASH_ENCRYPTION_XTS_AES_128 and SOC_EFUSE_CONSISTS_OF_ONE_KEY_BLOCK
+
+    .. list-table:: eFuses Used in Flash Encryption
+       :widths: 25 40 10
+       :header-rows: 0
+
+       * - **eFuse**
+         - **Description**
+         - **Bit Depth**
+       * - ``XTS_KEY_LENGTH_256``
+         - Controls actual number of eFuse bits used to derive final 256-bit AES key. Possible values: ``0`` use all 256 bits of the eFuse block for the key, ``1`` use the lower 128 bits of the eFuse block for the key (the higher 128 bits are reserved for Secure Boot key). For 128 bits option, the final AES key is derived as SHA256(EFUSE_KEY0_FE_128BIT).
+         - 1
+       * - ``BLOCK_KEY0``
+         - AES key storage.
+         - 256 or 128 key block
+       * - ``DIS_DOWNLOAD_MANUAL_ENCRYPT``
+         - If set, disables flash encryption when in download bootmodes.
+         - 1
+       * - ``{IDF_TARGET_CRYPT_CNT}``
+         - Enables encryption and decryption, when an SPI boot mode is set. Feature is enabled if 1 or 3 bits are set in the eFuse, disabled otherwise.
+         - 3
+
 .. note::
   * R/W access control is available for all the eFuse bits listed in the table above.
   * The default value of these bits is 0 afer manufacturing.
 
 Read and write access to eFuse bits is controlled by appropriate fields in the registers ``WR_DIS`` and ``RD_DIS``. For more information on {IDF_TARGET_NAME} eFuses, see :doc:`eFuse manager <../api-reference/system/efuse>`. To change protection bits of eFuse field using espefuse.py, use these two commands: read_protect_efuse and write_protect_efuse. Example ``espefuse.py write_protect_efuse DISABLE_DL_ENCRYPT``.
 
+.. only:: esp32c2
+
+    .. important::
+       {IDF_TARGET_NAME} has only one eFuse key block for both keys: Secure Boot and Flash Encryption. The eFuse key block can only be burned once. Therefore these keys should be burned together at the same time. Please note that "Secure Boot" and "Flash Encryption" can not be enabled separately as subsequent writes to eFuse key block shall return an error.
 
 Flash Encryption Process
 ------------------------
@@ -170,7 +196,7 @@ Assuming that the eFuse values are in their default states and the firmware boot
 
   8. The device is then rebooted to start executing the encrypted image. The firmware bootloader calls the flash decryption block to decrypt the flash contents and then loads the decrypted contents into IRAM.
 
-.. only:: SOC_FLASH_ENCRYPTION_XTS_AES and not SOC_FLASH_ENCRYPTION_XTS_AES_256
+.. only:: SOC_FLASH_ENCRYPTION_XTS_AES_128 and not SOC_FLASH_ENCRYPTION_XTS_AES_256 and not SOC_EFUSE_CONSISTS_OF_ONE_KEY_BLOCK
 
   1. On the first power-on reset, all data in flash is un-encrypted (plaintext). The ROM bootloader loads the firmware bootloader.
 
@@ -188,6 +214,24 @@ Assuming that the eFuse values are in their default states and the firmware boot
 
   8. The device is then rebooted to start executing the encrypted image. The firmware bootloader calls the flash decryption block to decrypt the flash contents and then loads the decrypted contents into IRAM.
 
+.. only:: SOC_FLASH_ENCRYPTION_XTS_AES_128 and SOC_EFUSE_CONSISTS_OF_ONE_KEY_BLOCK
+
+  1. On the first power-on reset, all data in flash is un-encrypted (plaintext). The ROM bootloader loads the firmware bootloader.
+
+  2. Firmware bootloader reads the ``{IDF_TARGET_CRYPT_CNT}`` eFuse value (``0b000``). Since the value is ``0`` (even number of bits set), it configures and enables the flash encryption block. For more information on the flash encryption block, see `{IDF_TARGET_NAME} Technical Reference Manual <{IDF_TARGET_TRM_EN_URL}>`_.
+
+  3. Firmware bootloader uses RNG (random) module to generate an 256 or 128 bit key (depends on :ref:`Size of generated AES-XTS key <CONFIG_SECURE_FLASH_ENCRYPTION_KEYSIZE>`) and then writes it into `BLOCK_KEY0` eFuse. The software also updates the ``XTS_KEY_LENGTH_256`` according to the chosen option. The key cannot be accessed via software as the write and read protection bits for `BLOCK_KEY0` eFuse are set. The flash encryption operations happen entirely by hardware, and the key cannot be accessed via software. If 128-bit flash encryption key is used, then only the lower 128 bits of the eFuse key block are read-protected, the remaining 128 bits are readable, which is required for secure boot. The entire eFuse block is write-protected. If the FE key is 256 bits long, then ``XTS_KEY_LENGTH_256`` is 1, otherwise it is 0. To prevent this eFuse from being accidentally changed in the future (from 0 to 1), we set a write-protect bit for the RELEASE mode.
+
+  4. Flash encryption block encrypts the flash contents - the firmware bootloader, applications and partitions marked as ``encrypted``. Encrypting in-place can take time, up to a minute for large partitions.
+
+  5. Firmware bootloader sets the first available bit in ``{IDF_TARGET_CRYPT_CNT}`` (0b001) to mark the flash contents as encrypted. Odd number of bits is set.
+
+  6. For :ref:`flash-enc-development-mode`, the firmware bootloader allows the UART bootloader to re-flash encrypted binaries. Also, the ``{IDF_TARGET_CRYPT_CNT}`` eFuse bits are NOT write-protected. In addition, the firmware bootloader by default sets the eFuse bits ``DIS_DOWNLOAD_ICACHE``, ``DIS_PAD_JTAG``, and ``DIS_DIRECT_BOOT``.
+
+  7. For :ref:`flash-enc-release-mode`, the firmware bootloader sets all the eFuse bits set under development mode as well as ``DIS_DOWNLOAD_MANUAL_ENCRYPT``. It also write-protects the ``{IDF_TARGET_CRYPT_CNT}`` eFuse bits. To modify this behavior, see :ref:`uart-bootloader-encryption`.
+
+  8. The device is then rebooted to start executing the encrypted image. The firmware bootloader calls the flash decryption block to decrypt the flash contents and then loads the decrypted contents into IRAM.
+
 During the development stage, there is a frequent need to program different plaintext flash images and test the flash encryption process. This requires that Firmware Download mode is able to load new plaintext images as many times as it might be needed. However, during manufacturing or production stages, Firmware Download mode should not be allowed to access flash contents for security reasons.
 
 Hence, two different flash encryption configurations were created: for development and for production. For details on these configurations, see Section `Flash Encryption Configuration`_.
@@ -231,7 +275,7 @@ To test flash encryption process, take the following steps:
     - :ref:`Select encryption mode <CONFIG_SECURE_FLASH_ENCRYPTION_MODE>` (**Development mode** by default)
     :esp32: - :ref:`Select UART ROM download mode <CONFIG_SECURE_UART_ROM_DL_MODE>` (**enabled** by default. Note that for the esp32 target, the choice is only available when :ref:`CONFIG_ESP32_REV_MIN` level is set to 3 (ESP32 V3)).
     :not esp32: - :ref:`Select UART ROM download mode <CONFIG_SECURE_UART_ROM_DL_MODE>` (**enabled** by default.)
-    :esp32s2 or esp32s3: - Set :ref:`Size of generated AES-XTS key <CONFIG_SECURE_FLASH_ENCRYPTION_KEYSIZE>`
+    :esp32s2 or esp32s3 or esp32c2: - Set :ref:`Size of generated AES-XTS key <CONFIG_SECURE_FLASH_ENCRYPTION_KEYSIZE>`
     - :ref:`Select the appropriate bootloader log verbosity <CONFIG_BOOTLOADER_LOG_LEVEL>`
     - Save the configuration and exit.
 
@@ -275,6 +319,11 @@ It is possible to pre-generate a flash encryption key on the host computer and b
 
     This option is not recommended for production, unless a separate key is generated for each individual device.
 
+.. only:: esp32c2
+
+    .. note::
+       Note that {IDF_TARGET_NAME} only has one eFuse key block for both Secure Boot and Flash Encryption keys. Therefore, writing the host-generated Flash Encryption key must be done with Secure Boot key (if used), otherwise Secure Boot cannot be used.
+
 To use a host generated key, take the following steps:
 
 1. Ensure that you have an {IDF_TARGET_NAME} device with default flash encryption eFuse settings as shown in :ref:`flash-encryption-efuse`.
@@ -283,6 +332,12 @@ To use a host generated key, take the following steps:
 
 2. Generate a random key by running:
 
+  .. only:: not SOC_FLASH_ENCRYPTION_XTS_AES
+
+      .. code-block:: bash
+
+          espsecure.py generate_flash_encryption_key my_flash_encryption_key.bin
+
   .. only:: SOC_FLASH_ENCRYPTION_XTS_AES_256
 
       If :ref:`Size of generated AES-XTS key <CONFIG_SECURE_FLASH_ENCRYPTION_KEYSIZE>` is AES-128 (256-bit key):
@@ -298,12 +353,26 @@ To use a host generated key, take the following steps:
           espsecure.py generate_flash_encryption_key --keylen 512 my_flash_encryption_key.bin
 
 
-  .. only:: not SOC_FLASH_ENCRYPTION_XTS_AES_256
+  .. only:: SOC_FLASH_ENCRYPTION_XTS_AES_128 and not SOC_FLASH_ENCRYPTION_XTS_AES_256 and not SOC_EFUSE_CONSISTS_OF_ONE_KEY_BLOCK
 
       .. code-block:: bash
 
           espsecure.py generate_flash_encryption_key my_flash_encryption_key.bin
 
+.. only:: SOC_FLASH_ENCRYPTION_XTS_AES_128 and SOC_EFUSE_CONSISTS_OF_ONE_KEY_BLOCK
+
+      If :ref:`Size of generated AES-XTS key <CONFIG_SECURE_FLASH_ENCRYPTION_KEYSIZE>` is AES-128 (256-bit key):
+
+      .. code-block:: bash
+
+          espsecure.py generate_flash_encryption_key my_flash_encryption_key.bin
+
+      else if :ref:`Size of generated AES-XTS key <CONFIG_SECURE_FLASH_ENCRYPTION_KEYSIZE>` is AES-128 key derived from 128 bits (SHA256(128 bits)):
+
+      .. code-block:: bash
+
+          espsecure.py generate_flash_encryption_key --keylen 128 my_flash_encryption_key.bin
+
 3. **Before the first encrypted boot**, burn the key into your device's eFuse using the command below. This action can be done **only once**.
 
   .. only:: not SOC_FLASH_ENCRYPTION_XTS_AES
@@ -341,7 +410,7 @@ To use a host generated key, take the following steps:
       espefuse.py  --port PORT  burn_key BLOCK+1 my_flash_encryption_key.bin.ab XTS_AES_256_KEY_2
 
 
-  .. only:: SOC_FLASH_ENCRYPTION_XTS_AES and not SOC_FLASH_ENCRYPTION_XTS_AES_256
+  .. only:: SOC_FLASH_ENCRYPTION_XTS_AES_128 and not SOC_FLASH_ENCRYPTION_XTS_AES_256 and not SOC_EFUSE_CONSISTS_OF_ONE_KEY_BLOCK
 
     .. code-block:: bash
 
@@ -349,6 +418,27 @@ To use a host generated key, take the following steps:
 
     where ``BLOCK`` is a free keyblock between ``BLOCK_KEY0`` and ``BLOCK_KEY5``.
 
+  .. only:: SOC_FLASH_ENCRYPTION_XTS_AES_128 and SOC_EFUSE_CONSISTS_OF_ONE_KEY_BLOCK
+
+    For AES-128 (256-bit key) - ``XTS_AES_128_KEY`` (the ``XTS_KEY_LENGTH_256`` eFuse will be burn to 1):
+
+    .. code-block:: bash
+
+        espefuse.py  --port PORT  burn_key BLOCK_KEY0 flash_encryption_key256.bin XTS_AES_128_KEY
+
+    For AES-128 key derived from 128 bits (SHA256(128 bits)) - ``XTS_AES_128_KEY_DERIVED_FROM_128_EFUSE_BITS``. The FE key will be written in the lower part of eFuse BLOCK_KEY0, the upper 128 bits are not used and will remain available for reading by software. Using the special mode of the espefuse tool, shown in the ``For burning both keys together`` section below, the user can write their data to it using any espefuse commands. 
+
+    .. code-block:: bash
+
+        espefuse.py  --port PORT  burn_key BLOCK_KEY0 flash_encryption_key128.bin XTS_AES_128_KEY_DERIVED_FROM_128_EFUSE_BITS
+
+    For burning both keys together (Secure Boot and Flash Encryption):
+
+    .. code-block:: bash
+
+        espefuse.py --port PORT --chip esp32c2  burn_key_digest secure_boot_signing_key.pem \
+                                                burn_key BLOCK_KEY0 flash_encryption_key128.bin XTS_AES_128_KEY_DERIVED_FROM_128_EFUSE_BITS
+
   If the key is not burned and the device is started after enabling flash encryption, the {IDF_TARGET_NAME} will generate a random key that software cannot access or modify.
 
 4. In :ref:`project-configuration-menu`, do the following:
@@ -707,6 +797,8 @@ Key Points About Flash Encryption
 
   :esp32c3: - Flash memory contents is encrypted using XTS-AES-128. The flash encryption key is 256 bits and stored in one ``BLOCK_KEYN`` eFuse internal to the chip and, by default, is protected from software access.
 
+  :esp32c2: - Flash memory contents is encrypted using XTS-AES-128. The flash encryption key is 256 or 128 bits and stored in ``BLOCK_KEY0`` eFuse internal to the chip and, by default, is protected from software access.
+
   - Flash access is transparent via the flash cache mapping feature of {IDF_TARGET_NAME} - any flash regions which are mapped to the address space will be transparently decrypted when read.
 
     Some data partitions might need to remain unencrypted for ease of access or might require the use of flash-friendly update algorithms which are ineffective if the data is encrypted. NVS partitions for non-volatile storage cannot be encrypted since the NVS library is not directly compatible with flash encryption. For details, refer to :ref:`NVS Encryption <nvs_encryption>`.
@@ -804,11 +896,11 @@ On the first boot, the flash encryption process burns by default the following e
 
     - ``DIS_DOWNLOAD_MANUAL_ENCRYPT`` which disables flash encryption operation when running in UART bootloader boot mode.
     :esp32s2 or esp32s3: - ``DIS_DOWNLOAD_ICACHE`` and ``DIS_DOWNLOAD_DCACHE`` which disables the entire MMU flash cache when running in UART bootloader mode.
-    :esp32c3: - ``DIS_DOWNLOAD_ICACHE`` which disables the entire MMU flash cache when running in UART bootloader mode.
+    :esp32c3 or esp32c2: - ``DIS_DOWNLOAD_ICACHE`` which disables the entire MMU flash cache when running in UART bootloader mode.
     :esp32s2: - ``HARD_DIS_JTAG`` which disables JTAG.
     :esp32c3: - ``DIS_PAD_JTAG`` and ``DIS_USB_JTAG`` which disables JTAG.
     :esp32s3: - ``HARD_DIS_JTAG`` and ``DIS_USB_JTAG`` which disables JTAG.
-    - ``DIS_LEGACY_SPI_BOOT``  which disables Legacy SPI boot mode
+    - ``DIS_DIRECT_BOOT`` (old name ``DIS_LEGACY_SPI_BOOT``)  which disables direct boot mode
 
 However, before the first boot you can choose to keep any of these features enabled by burning only selected eFuses and write-protect the rest of eFuses with unset value 0. For example:
 
@@ -965,7 +1057,7 @@ The following sections provide some reference information about the operation of
 
   - To see the full flash encryption algorithm implemented in Python, refer to the `_flash_encryption_operation()` function in the ``espsecure.py`` source code.
 
-.. only:: SOC_FLASH_ENCRYPTION_XTS_AES and not SOC_FLASH_ENCRYPTION_XTS_AES_256
+.. only:: SOC_FLASH_ENCRYPTION_XTS_AES_128 and not SOC_FLASH_ENCRYPTION_XTS_AES_256 and not SOC_EFUSE_CONSISTS_OF_ONE_KEY_BLOCK
 
 
   .. _flash-encryption-algorithm:
@@ -980,3 +1072,18 @@ The following sections provide some reference information about the operation of
   - The flash encryption key is stored in one ``BLOCK_KEYN`` eFuse and, by default, is protected from further writes or software readout.
 
   - To see the full flash encryption algorithm implemented in Python, refer to the `_flash_encryption_operation()` function in the ``espsecure.py`` source code.
+
+.. only:: SOC_FLASH_ENCRYPTION_XTS_AES_128 and SOC_EFUSE_CONSISTS_OF_ONE_KEY_BLOCK
+
+  .. _flash-encryption-algorithm:
+
+  Flash Encryption Algorithm
+  ^^^^^^^^^^^^^^^^^^^^^^^^^^
+
+  - {IDF_TARGET_NAME} use the XTS-AES block chiper mode with 256 bit size for flash encryption. In case the 128-bit key is stored in the eFuse key block, the final 256-bit AES key is obtained as SHA256(EFUSE_KEY0_FE_128BIT).
+
+  - XTS-AES is a block chiper mode specifically designed for disc encryption and addresses the weaknesses other potential modes (e.g. AES-CTR) have for this use case. A detailed description of the XTS-AES algorithm can be found in `IEEE Std 1619-2007 <https://ieeexplore.ieee.org/document/4493450>`_.
+
+  - The flash encryption key is stored in ``BLOCK_KEY0`` eFuse and, by default, is protected from further writes or software readout.
+
+  - To see the full flash encryption algorithm implemented in Python, refer to the `_flash_encryption_operation()` function in the ``espsecure.py`` source code.

docs/en/security/secure-boot-v2.rst

@@ -31,11 +31,11 @@ Background
 
 Secure Boot protects a device from running any unauthorized (i.e., unsigned) code by checking that each piece of software that is being booted is signed. On an {IDF_TARGET_NAME}, these pieces of software include the second stage bootloader and each application binary. Note that the first stage bootloader does not require signing as it is ROM code thus cannot be changed.
 
-.. only:: not esp32c2
+.. only:: SOC_SECURE_BOOT_V2_RSA
 
     A new RSA based Secure Boot verification scheme (Secure Boot V2) has been introduced on the ESP32 (ECO3 onwards), ESP32-S2, ESP32-S3 and ESP32-C3 (ECO3 onwards).
 
-.. only:: esp32c2
+.. only:: SOC_SECURE_BOOT_V2_ECC
 
     A new ECC based Secure Boot verification scheme (Secure Boot V2) has been introduced on the ESP32-C2.
 
@@ -162,7 +162,7 @@ The content of each signature block is shown in the following table:
     .. note::
       R and M' are used for hardware-assisted Montgomery Multiplication.
 
-.. only:: esp32c2
+.. only:: SOC_SECURE_BOOT_V2_ECC
 
     .. list-table:: Content of a Signature Block
         :widths: 10 10 40
@@ -473,6 +473,11 @@ Secure Boot & Flash Encryption
 
 If Secure Boot is used without :doc:`Flash Encryption <flash-encryption>`, it is possible to launch "time-of-check to time-of-use" attack, where flash contents are swapped after the image is verified and running. Therefore, it is recommended to use both the features together.
 
+.. only:: esp32c2
+
+    .. important::
+       {IDF_TARGET_NAME} has only one eFuse key block, which is used for both keys: Secure Boot and Flash Encryption. The eFuse key block can only be burned once. Therefore these keys should be burned together at the same time. Please note that "Secure Boot" and "Flash Encryption" can not be enabled separately as subsequent writes to eFuse key block shall return an error.
+
 .. _signed-app-verify-v2:
 
 Signed App Verification Without Hardware Secure Boot

docs/zh_CN/security/esp32c2_log.inc

@@ -3,8 +3,63 @@
 
 .. code-block:: none
 
-    Update with ESP32C2 specific info IDF-4208
-
+    ESP-ROM:esp8684-api1-20211015
+    Build:Oct 15 2021
+    rst:0x1 (POWERON),boot:0xc (SPI_FAST_FLASH_BOOT)
+    SPIWP:0xee
+    mode:DIO, clock div:1
+    load:0x3fcd6190,len:0x2a84
+    load:0x403ae000,len:0x830
+    load:0x403b0000,len:0x42a0
+    entry 0x403ae000
+    I (21) boot: ESP-IDF v5.0-dev-2717-g0d1e015-dirty 2nd stage bootloader
+    I (21) boot: compile time 19:36:15
+    I (21) boot: chip revision: 0
+    I (24) boot.esp32c2: MMU Page Size  : 64K
+    I (29) boot.esp32c2: SPI Speed      : 60MHz
+    I (34) boot.esp32c2: SPI Mode       : DIO
+    I (39) boot.esp32c2: SPI Flash Size : 2MB
+    I (43) boot: Enabling RNG early entropy source...
+    I (49) boot: Partition Table:
+    I (52) boot: ## Label            Usage          Type ST Offset   Length
+    I (60) boot:  0 nvs              WiFi data        01 02 00010000 00006000
+    I (67) boot:  1 phy_init         RF data          01 01 00016000 00001000
+    I (75) boot:  2 factory          factory app      00 00 00020000 00100000
+    I (82) boot: End of partition table
+    I (86) esp_image: segment 0: paddr=00020020 vaddr=3c010020 size=06858h ( 26712) map
+    I (101) esp_image: segment 1: paddr=00026880 vaddr=3fca9a60 size=01430h (  5168) load
+    I (104) esp_image: segment 2: paddr=00027cb8 vaddr=40380000 size=08360h ( 33632) load
+    I (120) esp_image: segment 3: paddr=00030020 vaddr=42000020 size=0f67ch ( 63100) map
+    I (134) esp_image: segment 4: paddr=0003f6a4 vaddr=40388360 size=01700h (  5888) load
+    I (139) boot: Loaded app from partition at offset 0x20000
+    I (139) boot: Checking flash encryption...
+    I (142) efuse: Batch mode of writing fields is enabled
+    I (148) flash_encrypt: Generating new flash encryption key...
+    I (155) efuse: Writing EFUSE_BLK_KEY0 with purpose 1
+    W (161) flash_encrypt: Not disabling UART bootloader encryption
+    I (167) flash_encrypt: Disable UART bootloader cache...
+    I (175) flash_encrypt: Disable JTAG...
+    I (190) efuse: BURN BLOCK3
+    I (195) efuse: BURN BLOCK3 - OK (write block == read block)
+    I (204) efuse: BURN BLOCK0
+    I (208) efuse: BURN BLOCK0 - OK (write block == read block)
+    I (213) efuse: Batch mode. Prepared fields are committed
+    I (219) esp_image: segment 0: paddr=00000020 vaddr=3fcd6190 size=02a84h ( 10884)
+    I (229) esp_image: segment 1: paddr=00002aac vaddr=403ae000 size=00830h (  2096)
+    I (236) esp_image: segment 2: paddr=000032e4 vaddr=403b0000 size=042a0h ( 17056)
+    I (679) flash_encrypt: bootloader encrypted successfully
+    I (731) flash_encrypt: partition table encrypted and loaded successfully
+    I (731) esp_image: segment 0: paddr=00020020 vaddr=3c010020 size=06858h ( 26712) map
+    I (741) esp_image: segment 1: paddr=00026880 vaddr=3fca9a60 size=01430h (  5168)
+    I (745) esp_image: segment 2: paddr=00027cb8 vaddr=40380000 size=08360h ( 33632)
+    I (759) esp_image: segment 3: paddr=00030020 vaddr=42000020 size=0f67ch ( 63100) map
+    I (774) esp_image: segment 4: paddr=0003f6a4 vaddr=40388360 size=01700h (  5888)
+    I (776) flash_encrypt: Encrypting partition 2 at offset 0x20000 (length 0x100000)...
+    I (6429) flash_encrypt: Done encrypting
+    I (6429) efuse: BURN BLOCK0
+    I (6432) efuse: BURN BLOCK0 - OK (all write block bits are set)
+    I (6438) flash_encrypt: Flash encryption completed
+    I (6443) boot: Resetting with flash encryption enabled...
 
 ------
 
@@ -12,7 +67,63 @@
 
 .. code-block:: none
 
-    Update with ESP32C2 specific info IDF-4208
+    ESP-ROM:esp8684-api1-20211015
+    Build:Oct 15 2021
+    rst:0x3 (RTC_SW_SYS_RST),boot:0xc (SPI_FAST_FLASH_BOOT)
+    Saved PC:0x403b0f9e
+    SPIWP:0xee
+    mode:DIO, clock div:1
+    load:0x3fcd6190,len:0x2a84
+    load:0x403ae000,len:0x830
+    load:0x403b0000,len:0x42a0
+    entry 0x403ae000
+    I (23) boot: ESP-IDF v5.0-dev-2717-g0d1e015-dirty 2nd stage bootloader
+    I (23) boot: compile time 19:36:15
+    I (23) boot: chip revision: 0
+    I (27) boot.esp32c2: MMU Page Size  : 64K
+    I (32) boot.esp32c2: SPI Speed      : 60MHz
+    I (36) boot.esp32c2: SPI Mode       : DIO
+    I (41) boot.esp32c2: SPI Flash Size : 2MB
+    I (46) boot: Enabling RNG early entropy source...
+    I (51) boot: Partition Table:
+    I (55) boot: ## Label            Usage          Type ST Offset   Length
+    I (62) boot:  0 nvs              WiFi data        01 02 00010000 00006000
+    I (70) boot:  1 phy_init         RF data          01 01 00016000 00001000
+    I (77) boot:  2 factory          factory app      00 00 00020000 00100000
+    I (85) boot: End of partition table
+    I (89) esp_image: segment 0: paddr=00020020 vaddr=3c010020 size=06858h ( 26712) map
+    I (103) esp_image: segment 1: paddr=00026880 vaddr=3fca9a60 size=01430h (  5168) load
+    I (107) esp_image: segment 2: paddr=00027cb8 vaddr=40380000 size=08360h ( 33632) load
+    I (123) esp_image: segment 3: paddr=00030020 vaddr=42000020 size=0f67ch ( 63100) map
+    I (138) esp_image: segment 4: paddr=0003f6a4 vaddr=40388360 size=01700h (  5888) load
+    I (143) boot: Loaded app from partition at offset 0x20000
+    I (143) boot: Checking flash encryption...
+    I (146) flash_encrypt: flash encryption is enabled (1 plaintext flashes left)
+    I (154) boot: Disabling RNG early entropy source...
+    I (171) cpu_start: Pro cpu up.
+    I (179) cpu_start: Pro cpu start user code
+    I (179) cpu_start: cpu freq: 120000000 Hz
+    I (179) cpu_start: Application information:
+    I (182) cpu_start: Project name:     hello_world
+    I (187) cpu_start: App version:      v5.0-dev-2717-g0d1e015-dirty
+    I (194) cpu_start: Compile time:     May 20 2022 19:35:55
+    I (200) cpu_start: ELF file SHA256:  04592ac3c9304cdc...
+    I (206) cpu_start: ESP-IDF:          v5.0-dev-2717-g0d1e015-dirty
+    I (213) heap_init: Initializing. RAM available for dynamic allocation:
+    I (220) heap_init: At 3FCABCB0 len 0002C350 (176 KiB): D/IRAM
+    I (226) heap_init: At 3FCD8000 len 0000742C (29 KiB): STACK/DRAM
+    I (234) spi_flash: detected chip: generic
+    I (238) spi_flash: flash io: dio
+    W (242) flash_encrypt: Flash encryption mode is DEVELOPMENT (not secure)
+    I (249) sleep: Configure to isolate all GPIO pins in sleep state
+    I (256) sleep: Enable automatic switching of GPIO sleep configuration
+    W (263) INT_WDT: ESP32-C2 only has one timer group
+    I (268) cpu_start: Starting scheduler.
+    Hello world!
+    This is esp32c2 chip with 1 CPU core(s), WiFi/BLE, silicon revision 0, 2MB external flash
+    Minimum free heap size: 195052 bytes
 
+    FLASH_CRYPT_CNT eFuse value is 1
+    Flash encryption feature is enabled in DEVELOPMENT mode
 
 ------