🔐 ESP32 Secure OTA with Cryptographic Boot Chain

Production-grade OTA firmware update system with ECDSA signing, anti-rollback, and hardware-anchored verification

---

What This Project Actually Does

This repository implements a real secure firmware pipeline used in:

• Automotive ECUs
• Industrial controllers
• Medical devices
• Aerospace embedded systems

It protects the device from:

Threat	Defense
Firmware tampering	ECDSA digital signatures
Malware injection	Secure boot public-key verification
Downgrade attacks	eFuse anti-rollback versioning
Broken OTA	Dual-slot with rollback
Rogue updates	Signed-image enforcement

---

🧠 System Architecture

---

🔒 Secure Boot Trust Chain

This is the cryptographic chain of trust:

ROM Bootloader (hardware root) ↓ Secure Bootloader (contains public key) ↓ Signed Application Image ↓ eFuse Secure Version Check ↓ Application allowed to execute

---

🔑 Cryptographic Key Architecture

Component	Purpose
ota_signing_key.pem	Private key (never leaves PC)
signature_verification_key.bin	Public key stored in bootloader
espsecure	Signs firmware
bootloader	Verifies signature before boot
eFuse	Blocks downgrades

The device cannot be reprogrammed with unsigned or older firmware.

---

🧪 Proof: Secure Key Injection

Private ECDSA signing key is configured in ESP-IDF.

---

🧪 Proof: Public Key Embedded in Bootloader

ESP-IDF extracted the public key and embedded it into the secure bootloader.

---

🧪 Proof: Firmware Cryptographically Signed

The ESP-IDF ran espsecure and signed the firmware using ECDSA.

---

🧪 Proof: Signed Firmware Artifacts

Files generated:

• esp32_secure_ota.bin → signed firmware
• signature_verification_key.bin → bootloader public key

---

🧪 Proof: Secure Bootloader Built

This proves:

• Bootloader contains verification logic
• Signature checks are enforced

---

🧪 Proof: Signed Images Ready for Flash

This confirms:

• Only signed firmware can be flashed
• Bootloader + OTA data + app images are all aligned

---

🔄 OTA Update Flow (Runtime)

👨‍💻 Author