From a69737787152fa101d433b00a83b8f1db19481c1 Mon Sep 17 00:00:00 2001 From: Jakob Hasse Date: Mon, 1 Feb 2021 11:35:19 +0800 Subject: [PATCH] [doc]: elaborated nvs encryption comments in nvs --- components/nvs_flash/src/nvs_api.cpp | 12 ++++++++---- 1 file changed, 8 insertions(+), 4 deletions(-) diff --git a/components/nvs_flash/src/nvs_api.cpp b/components/nvs_flash/src/nvs_api.cpp index 1d53948ca8..3a2a3495b6 100644 --- a/components/nvs_flash/src/nvs_api.cpp +++ b/components/nvs_flash/src/nvs_api.cpp @@ -580,14 +580,18 @@ extern "C" esp_err_t nvs_flash_generate_keys(const esp_partition_t* partition, n cfg->tky[cnt] = 0x88; } } - - /* Write without encryption */ + + /** + * Write key configuration without encryption engine (using raw partition write APIs). + * But the read is decrypted through flash encryption engine. This allows unique NVS encryption configuration, + * as flash encryption key is randomly generated per device. + */ err = esp_partition_write_raw(partition, 0, cfg->eky, NVS_KEY_SIZE); if(err != ESP_OK) { return err; } - - /* Write without encryption */ + + /* Write without encryption, see note above */ err = esp_partition_write_raw(partition, NVS_KEY_SIZE, cfg->tky, NVS_KEY_SIZE); if(err != ESP_OK) { return err;