{"action":"opened","issue":{"url":"https://api.github.com/repos/espressif/esp-idf/issues/1641","repository_url":"https://api.github.com/repos/espressif/esp-idf","labels_url":"https://api.github.com/repos/espressif/esp-idf/issues/1641/labels{/name}","comments_url":"https://api.github.com/repos/espressif/esp-idf/issues/1641/comments","events_url":"https://api.github.com/repos/espressif/esp-idf/issues/1641/events","html_url":"https://github.com/espressif/esp-idf/issues/1641","id":298263209,"number":1641,"title":"Secure Boot enabled before checking valid app image ","user":{"login":"catalinio","id":6727290,"avatar_url":"https://avatars3.githubusercontent.com/u/6727290?v=4","gravatar_id":"","url":"https://api.github.com/users/catalinio","html_url":"https://github.com/catalinio","followers_url":"https://api.github.com/users/catalinio/followers","following_url":"https://api.github.com/users/catalinio/following{/other_user}","gists_url":"https://api.github.com/users/catalinio/gists{/gist_id}","starred_url":"https://api.github.com/users/catalinio/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/catalinio/subscriptions","organizations_url":"https://api.github.com/users/catalinio/orgs","repos_url":"https://api.github.com/users/catalinio/repos","events_url":"https://api.github.com/users/catalinio/events{/privacy}","received_events_url":"https://api.github.com/users/catalinio/received_events","type":"User","site_admin":false},"labels":[],"state":"open","locked":false,"assignee":null,"assignees":[],"milestone":null,"comments":0,"created_at":"2018-02-19T12:45:25Z","updated_at":"2018-02-19T12:45:25Z","closed_at":null,"author_association":"NONE","body":"Hi,\r\nIn the [SecureBoot description](http://esp-idf.readthedocs.io/en/latest/security/secure-boot.html#secure-boot-howto) there is this paragraph: \r\n> NOTE Secure boot won’t be enabled until after a valid partition table and app image have been flashed. This is to prevent accidents before the system is fully configured. \r\n\r\nAfter I've checked the code from [bootloader_start.c](https://github.com/espressif/esp-idf/blob/master/components/bootloader/subproject/main/bootloader_start.c), it seems that if I flash: bootloader(with Secure Boot enabled), partitions.bin and application.bin; then the SecureBoot efuse (ABS_DONE_0) is set, even if partitions and application are not signed (or wrong SHA digest).\r\n\r\nBasically, what happens:\r\n1. Bootloader started, Secure Boot efuse is not written (yet) so partition and application are not checked\r\n2. Secure Boot is enabled (Flash Encryption is enabled), and application is loaded successful \r\n3. after first reset, the partition and application are checked, and fail, so bootloader is stuck\r\n\r\nSolution here, would be to re-sign partition and application and re-flash them on serial.\r\n\r\nMore tragic, is that if Flash Encryption is enabled, all the partitions (bootloader, parition table, factory app) are encrypted (with the secret efuse key). I guess, the esp32 chip is bricked;  can't even use OTA for updating."}}
{"actor":{"display_login":"catalinio"}}