Microcontroller Firmware Extraction & PCB Clone
Professional MCU firmware extraction, IC reverse engineering, PCB duplication, schematic recovery and PCB manufacturing services for clients worldwide since 1998.
Professional MCU firmware extraction, IC reverse engineering, PCB duplication, schematic recovery and PCB manufacturing services for clients worldwide since 1998.
The Espressif ESP32 has become one of the most popular Wi-Fi and Bluetooth-enabled system-on-chips in the IoT ecosystem, powering millions of smart home devices, industrial sensors, and consumer products worldwide. To address growing security concerns, Espressif introduced hardware-accelerated AES encryption and flash encryption features in the ESP32, allowing developers to protect firmware and sensitive data stored in external flash memory. However, at Black Hat USA 2022, security researchers demonstrated that the hardware AES core in the ESP32 chip revision v3.0 is vulnerable to side-channel attacks that can extract encryption keys by analyzing the chip's power consumption during cryptographic operations. This attack, presented under the title "Unlimited Results: Breaking Firmware Encryption of ESP32-V3," showed that even with Secure Boot and Flash Encryption enabled in their most secure configurations, the ESP32's protection could be completely defeated through physical side-channel analysis. The vulnerability is particularly significant because it affects all ESP32 chip revisions, including the v3.0 silicon that was specifically hardened against fault injection attacks. This case study examines the side-channel attack methodology, the weaknesses in the ESP32's AES implementation, and the implications for IoT device security.
The ESP32 is a dual-core system-on-chip based on the Xtensa LX6 processor architecture, integrating 2.4 GHz Wi-Fi, Bluetooth, and Bluetooth Low Energy radios alongside a rich set of digital peripherals. For security, the chip provides several hardware-backed features including Secure Boot, which verifies the integrity and authenticity of firmware before execution, and Flash Encryption, which encrypts the contents of external SPI flash memory so that physical extraction of the flash chip yields only ciphertext. The encryption is performed by a dedicated hardware AES engine that operates transparently, decrypting firmware on the fly as it is read from flash by the CPU. The AES key used for flash encryption is generated during device manufacturing or first boot and is stored in the chip's eFuse memory, a one-time programmable region that cannot be read back through software or debug interfaces. The hardware AES accelerator supports AES-128, AES-192, and AES-256 in ECB, CBC, and other modes, and is designed to offload cryptographic operations from the CPU for both performance and security reasons. By performing encryption in dedicated hardware rather than software, the chip aims to reduce the attack surface for key extraction through memory inspection or code reverse engineering. However, the hardware AES implementation, like all physical cryptographic systems, is susceptible to side-channel attacks that exploit physical manifestations of the computation, such as power consumption, electromagnetic radiation, or execution timing, to extract secret key material. The ESP32 v3.0 revision included specific hardening against fault injection attacks, but Espressif did not implement countermeasures against differential power analysis on the AES core, leaving it vulnerable to the attack demonstrated at Black Hat.
Side-channel attacks are a class of cryptographic attacks that exploit physical characteristics of a computing device as it performs cryptographic operations, rather than attacking the mathematical properties of the cipher itself. The most common side-channel is power consumption, which varies depending on the data being processed and the operations being performed by the hardware. In a differential power analysis (DPA) attack, an attacker collects many power consumption traces while the device performs encryption with different plaintexts but the same secret key. By statistically analyzing the correlation between specific bits of the intermediate computation and the measured power consumption, the attacker can deduce the secret key one byte at a time. The ESP32's hardware AES accelerator is particularly susceptible to this type of attack because it processes the AES state in a way that produces measurable power consumption differences correlated with the key bytes. The attack requires physical access to the device, a high-bandwidth oscilloscope or dedicated power analysis platform such as the ChipWhisperer, and the ability to trigger encryption operations with known plaintexts. Unlike fault injection attacks, which require precise timing and often damage the target device, side-channel attacks are entirely non-invasive and do not alter the chip's operation in any way, making them extremely difficult to detect. The researchers used a combination of simple power analysis (SPA) to identify the timing of AES rounds and differential power analysis to extract individual key bytes, ultimately recovering the complete AES-256 flash encryption key in a matter of hours.
The side-channel attack on the ESP32 v3.0 proceeds through several methodical stages. First, the attacker prepares the target device by removing any external power supply decoupling capacitors near the ESP32 chip to increase the amplitude of power consumption variations measured at the power pin. A small shunt resistor is inserted in series with the chip's power supply, and an oscilloscope or ChipWhisperer capture device is connected across the shunt to measure voltage fluctuations that correspond to instantaneous power consumption. The attacker then develops a method to trigger AES encryption operations with known plaintext values. On the ESP32, this can be achieved by sending specially crafted network packets that cause the firmware to perform AES operations, or by using the chip's ROM download mode to execute small code snippets that invoke the hardware AES accelerator directly. With the capture setup in place, the attacker collects thousands of power consumption traces, each corresponding to an AES encryption operation with a different known plaintext. The traces are aligned in time using a known reference point, such as the start of the first AES round, and then processed using correlation power analysis (CPA) algorithms. For each possible key byte value (0 through 255), the algorithm computes the hypothetical intermediate value that would result from the AES SubBytes operation, calculates the predicted power consumption based on a Hamming weight or Hamming distance power model, and correlates this prediction with the actual measured traces. The key byte candidate that produces the highest correlation is identified as the correct value. This process is repeated for each of the 16 (or 32 for AES-256) key bytes until the complete key is recovered. The researchers found that the ESP32's AES core exhibits particularly strong side-channel leakage during the first round of encryption, where the key is XORed with the plaintext and processed through the SubBytes transformation, allowing reliable key extraction with as few as five thousand traces per key byte.
The vulnerability of the ESP32's hardware AES accelerator to side-channel analysis stems from several design choices that prioritize performance and cost over side-channel resistance. First, the AES state registers and S-box lookup tables are implemented in standard CMOS logic without any masking or hiding countermeasures. In a masked AES implementation, intermediate values are split into multiple shares that are individually uncorrelated with the actual data, making it significantly harder for an attacker to find correlations in power consumption. The ESP32's unmasked implementation means that the power consumption of the S-box lookup operation is directly proportional to the Hamming weight of the data being processed, creating a strong signal for CPA attacks. Second, the AES core operates on the full 128-bit state in parallel during each round, rather than using a serialized 8-bit or 32-bit datapath that would reduce the amplitude of side-channel leakage. While this parallel design provides high throughput, it also produces larger power consumption variations that are easier to measure and analyze. Third, the ESP32 does not include any active tamper detection or power analysis countermeasures, such as random delay insertion, clock frequency modulation, or internal power supply filtering, that could disrupt the attacker's ability to collect clean, aligned traces. The v3.0 silicon revision specifically hardened the boot ROM against fault injection attacks by adding redundant checks and glitch detection circuits, but these measures do not address side-channel leakage, which is an entirely different class of vulnerability. The researchers also discovered that the AES key is loaded into the hardware accelerator's internal key registers at the start of each encryption operation, and that the key loading process itself produces a distinctive power signature that can be used to identify the exact timing of AES operations, further simplifying the attack.
Once the AES flash encryption key is extracted through the side-channel attack, the consequences are severe and far-reaching. With the key in hand, an attacker can read the contents of the external SPI flash chip using a standard flash programmer and decrypt the entire firmware image offline, revealing all source code logic, hardcoded credentials, encryption keys, API tokens, and proprietary algorithms contained within. This completely negates the protection offered by Flash Encryption, which is the primary mechanism preventing firmware extraction from ESP32-based devices. Furthermore, if Secure Boot is also enabled, the attacker can use the decrypted firmware to analyze the Secure Boot verification process, extract the public verification key, and potentially develop forged firmware images that will pass Secure Boot validation on other devices. The attack affects not only the ESP32 v3.0 but all earlier chip revisions as well, since the side-channel vulnerability exists in the AES hardware accelerator itself and was present from the initial silicon release. This means that millions of already-deployed ESP32 devices remain vulnerable, as the flaw cannot be patched through firmware updates. The low cost of the required equipment, with ChipWhisperer platforms available for under a few hundred dollars and open-source analysis tools freely available, means that this attack is accessible to a wide range of adversaries including competitors seeking to reverse engineer products, criminals looking to extract credentials for further attacks, and security researchers. For IoT device manufacturers, the vulnerability means that any security-sensitive functionality implemented on the ESP32, including device authentication, secure communication, and access control, must be considered potentially compromised if an attacker gains physical access to the device.
Following the disclosure of the side-channel attack, Espressif issued a security advisory (AR2022-003) acknowledging the vulnerability and providing guidance to customers. The advisory confirmed that the hardware AES core and Flash Encryption feature are susceptible to side-channel attacks requiring physical access, and recommended that customers who require protection against such attacks implement additional security measures at the application level. Espressif suggested that sensitive data should not be stored in flash memory even with encryption enabled, and that application-level encryption using a key derived from a hardware unique key stored in eFuse should be used for additional protection. The company also noted that the ESP32-C3 and ESP32-S3, newer chips in the ESP32 family, include improved security features and that future silicon revisions would incorporate side-channel countermeasures. For developers working with the ESP32, several mitigation strategies can reduce the risk of successful side-channel attacks. These include minimizing the number of AES operations performed with the flash encryption key by using session keys for routine encryption, implementing application-level encryption with keys that are never stored in flash, and adding physical tamper detection mechanisms that erase sensitive data when the device enclosure is opened. At the hardware level, adding additional power supply decoupling and filtering can reduce the amplitude of side-channel signals, though this does not provide complete protection. For high-security applications, designers should consider using a dedicated secure element or cryptographic co-processor with certified side-channel resistance, such as those certified to Common Criteria EAL5+ or higher, to handle sensitive cryptographic operations rather than relying on the ESP32's built-in AES accelerator.
The ESP32 side-channel attack underscores a fundamental challenge in IoT security: the gap between the security guarantees provided by chip vendors and the actual security achievable in practice when physical access is possible. Many IoT device manufacturers rely on hardware security features like flash encryption and secure boot as a complete solution for firmware protection, without fully understanding the physical attack vectors that can bypass these features. The ESP32 case demonstrates that even well-designed security features can be undermined by implementation-level vulnerabilities in the underlying hardware. As IoT devices become increasingly prevalent in security-sensitive applications such as smart locks, medical devices, industrial control systems, and connected vehicles, the importance of physical security cannot be overstated. The attack also highlights the need for standardized security certification and testing for IoT chips, including side-channel resistance evaluation as part of the certification process. Currently, there is no widely adopted requirement for IoT microcontrollers to undergo side-channel analysis testing, and many chips are deployed with unmasked cryptographic implementations that would be considered unacceptable in higher-security domains such as banking or government. The open-source nature of the ChipWhisperer platform and the growing body of published side-channel attack research mean that these attacks are no longer limited to well-funded nation-state actors, and IoT manufacturers must adjust their threat models accordingly. Ultimately, the ESP32 side-channel attack serves as a wake-up call for the IoT industry, emphasizing that security must be considered at every layer of the stack, from the physical silicon through the application software, and that no single protection mechanism can provide complete security against a determined adversary with physical access.
The ESP32 side-channel attack has catalyzed a broader discussion about the need for side-channel resistant cryptographic implementations in low-cost IoT microcontrollers. Historically, side-channel countermeasures such as masking, hiding, and noise generation were considered too expensive in terms of silicon area and power consumption for cost-optimized chips like the ESP32. However, the increasing value of data processed by IoT devices and the growing availability of side-channel analysis tools have changed this calculus, and chip vendors are now under pressure to include basic side-channel countermeasures even in their lowest-cost products. The ESP32 case has also prompted research into lightweight side-channel countermeasures that can be implemented in software without requiring hardware changes. These include techniques such as random instruction insertion, where dummy operations are inserted into cryptographic code to disrupt the correlation between power consumption and intermediate values, and shuffling, where the order of independent operations is randomized to make alignment of power traces more difficult. While these software countermeasures provide some protection, they are generally less effective than hardware-based masking and can introduce significant performance overhead. The ESP32 attack has also highlighted the importance of key management in IoT devices. Even if the AES hardware accelerator were side-channel resistant, the flash encryption key would still be vulnerable if it is stored in a location that can be read through other attack vectors. This has led to increased adoption of hardware unique keys (HUKs) and physically unclonable functions (PUFs) for key generation and storage in newer IoT chips. These technologies generate keys from the unique physical characteristics of each chip, ensuring that no two chips have the same key and that the key is never stored in a readable form. The ESP32 side-channel attack has also had an impact on the certification landscape for IoT devices, with standards bodies and certification programs beginning to include side-channel resistance testing as part of their security evaluation criteria. The ioXt Alliance, which certifies IoT devices for security, now includes physical security requirements that address side-channel and fault injection attacks, and several national security standards have been updated to include similar requirements. For developers working with the ESP32, the attack has spurred the development of best practices for firmware security, including the use of application-level encryption for sensitive data, the minimization of AES operations with persistent keys, and the implementation of tamper detection that can erase keys when an attack is detected. The open-source community has also responded by developing libraries that implement side-channel resistant cryptographic algorithms for the ESP32, allowing developers to add an additional layer of protection without changing hardware. As the IoT ecosystem continues to mature, the lessons learned from the ESP32 side-channel attack will inform the design of future chips and the security practices of device manufacturers, ultimately leading to more secure connected devices. The attack serves as a reminder that cryptographic security is only as strong as its physical implementation, and that mathematical security must be accompanied by physical security to provide meaningful protection against real-world adversaries.
The ESP32 v3.0 hardware AES core is vulnerable to differential power analysis. The attack extracts the flash encryption key by measuring power consumption during AES operations. It requires physical access and a ChipWhisperer or similar analysis platform. The vulnerability affects all ESP32 revisions including the hardened v3.0 silicon. Side-channel attacks are non-invasive and do not damage the target device. The unmasked AES implementation produces strong correlations with key bytes. As few as five thousand traces are needed per key byte. The extracted key allows complete decryption of external flash contents. Espressif acknowledged the issue in security advisory AR2022-003. Application-level encryption is recommended as an additional layer. Secure elements can offload cryptographic operations from the ESP32. The attack was presented at Black Hat USA 2022. IoT device manufacturers must consider physical attack vectors. Side-channel resistance should be part of chip security certification. The ESP32-C3 and ESP32-S3 include improved security features. Power supply filtering can reduce but not eliminate side-channel leakage. The low cost of analysis equipment makes this attack broadly accessible. Millions of deployed ESP32 devices remain potentially vulnerable. Defense-in-depth is essential for IoT security. This case underscores the importance of physical security in connected devices.
The side-channel attack on the ESP32 v3.0 hardware AES core represents a significant milestone in IoT security research, demonstrating that even hardware-accelerated cryptography with key storage in one-time programmable memory can be defeated through physical analysis. The attack's non-invasive nature, low equipment cost, and applicability to all ESP32 revisions make it a practical threat for any device that may fall into the hands of a determined attacker. While Espressif has acknowledged the issue and recommended additional application-level protections, the fundamental vulnerability in the AES hardware cannot be fixed through software updates. For the broader IoT ecosystem, this case serves as a critical reminder that physical security must be an integral part of the design process, and that defense-in-depth strategies combining multiple layers of protection are essential for devices that may be subject to physical attack. As the IoT continues to expand into every aspect of modern life, the lessons learned from the ESP32 side-channel attack will become increasingly relevant for chip designers, device manufacturers, and security professionals alike.