Unlimited Results: Breaking Firmware Encryption of ESP32-V3

## Overview and Background

Presented by Karim Abdellatif (evaluating hardware wallets at Ledger against fault injection and side-channel attacks) alongside co-authors Olivier Hériveaux and Adrian Thillard, this talk examines the security of the ESP32-V3 microcontroller. Espressif’s low-power ESP32 SoC had deployed over 100 million devices by 2018. More recently, the ESP32-V3 chip was adopted as the primary microcontroller in the "Jade" hardware wallet developed by Blockstream. In this architecture, encrypted firmware is stored on an external flash memory, while the secret firmware encryption key is held inside the ESP32-V3.

The security evaluation was motivated by previous work in 2019, where the security researcher "LimitedResults" compromised the ESP32-V1. That earlier attack leveraged voltage glitching (power fault injection) during power-up to perturb the eFuse protection bits, allowing the attacker to extract the eFuse-stored firmware encryption and Secure Boot keys. In response, Espressif released the ESP32-V3 in 2020 (skipping a "V2" release) featuring hardware and software fault-injection countermeasures and an RSA-based Secure Boot mechanism to eliminate the storage of private keys in eFuse memory.

## ESP32 Security Architecture and eFuse Organization

The ESP32 incorporates various security capabilities, including Secure Boot, Flash Encryption, 128 bytes of one-time programmable (OTP) eFuse memory, and hardware cryptographic accelerators for AES, RSA, RNG, and elliptic curves. These features can be enabled using Espressif's open-source `esptool` utility.

The 128-byte eFuse array is partitioned into four distinct slots: - **Block 0 (System Slot):** Stores device configuration settings, such as whether Secure Boot or Flash Encryption modes are enabled. - **Block 1:** Dedicated to storing the Flash Encryption keys. - **Block 2:** Dedicated to storing the Secure Boot keys. - **Block 3:** Designated for user applications.

Software access to Block 1 and Block 2 is prohibited by eFuse protection bits stored in the boot ROM. Only dedicated ESP32 hardware logic can read these keys during power-up to execute cryptographic operations.

## Secure Boot and Flash Encryption Mechanisms

The speaker detailed the operational workflows implemented across the platform:

- **Secure Boot V1:** Uses an AES-256 key stored in eFuse Block 2. During creation, the bootloader and public key are encrypted using AES-256, and the output is hashed using SHA-512 to produce a digest stored in external flash. At boot time, the hardware repeats this cryptographic sequence and compares the resulting digest against the stored digest to decide whether execution can proceed. - **Flash Encryption:** Designed to protect external flash-stored firmware from unauthorized access. The mechanism relies on the cryptographic key located in eFuse Block 1 to perform hardware encryption and decryption of external memory data.

## Research Scope and Presentation Outline

The authors structured their evaluation into several sequential phases: 1. Reviewing the hardware security mechanisms of the ESP32-V3. 2. Developing a custom, homemade fault injection setup to evaluate ESP32-V1 by reproducing the LimitedResults attack using electromagnetic fault injection (EMFI) instead of power glitching. 3. Testing the same EMFI fault injection scenarios against the hardened ESP32-V3. 4. Discovering and evaluating an alternative side-channel attack path to break the firmware encryption. 5. Demonstrating practical key extraction on the commercial Blockstream Jade hardware wallet, concluding with the vendor response.