flash encryption

Flash contents stored AES-XTS-encrypted under a per-chip key in a read-protected eFuse block, decrypted transparently by hardware.

Flash encryption stores the contents of external flash encrypted (AES-XTS on ESP32) under a per-device key held in a read-protected eFuse block, decrypted transparently by the cache on read.

Examples

With flash encryption on, a USB dump of an ESP32-C6's flash yields only XTS-AES-128 ciphertext, decryptable only by that chip.
The bootloader generates the key on first boot and burns it into a read-protected eFuse key block, so not even the firmware can read it.