Hello,
We’re planning to enable secure boot and flash encryption on the RTL8735B (AmebaPro2, SDK release 9.6_r) for a production run of about 10,000 units.
Goal: one shared secure-boot signing key for the whole fleet, but a unique flash-encryption key per device, so that if one device’s key is ever compromised, it doesn’t expose any other unit.
Question: on many chip platforms, this is handled by having the flash-encryption hardware automatically encrypt data as it’s written to flash, using whatever key is burned into that specific chip’s own eFuse/OTP. That means the OTA server only needs to distribute one common, plain (unencrypted) firmware image to the entire fleet — each device encrypts it into its own flash locally, using its own key, without needing a separately pre-encrypted file per device.
We’d like to confirm whether the RTL8735B’s Flash SEC engine works the same way:
- When flash encryption is enabled, does the chip encrypt data automatically on write to flash (and decrypt on read/execute) using its own OTP-burned key — so a single common plaintext OTA image can be sent to every device?
- Or does encryption have to be applied to the firmware image itself before distribution (i.e., a fixed key baked into the file at build time), which would mean each device needs its own separately pre-encrypted image rather than one shared OTA file?
- If option 2 is the case, is there any supported way (key derivation, key wrapping, etc.) to still use one common OTA image across devices that each hold a different encryption key?
Second question, on secure boot: is there an official or recommended procedure/tool for burning the root-of-trust key hash and per-device keys into OTP at production scale? We haven’t found OTP/key-burning support in the standard flashing tool, and the only reference example we found in the SDK ships with its key-burning code disabled by default.
Any documentation, application note, or reference design for mass-production key provisioning on RTL8735B would be very helpful.
Thank you.