---
title: "Encrypt flash and anchor secure boot in · Agent Wranglers"
url: https://agentwranglers.se/playbook/connected-devices/device-identity/flash-encryption-and-root-of-trust
id: IOT-40
level: Recommended
updated: 2026-10-27
build: a2a6bdfed830
tokens: 1061
licence: "CC BY 4.0"
licence_url: https://creativecommons.org/licenses/by/4.0/
---

# Encrypt flash and anchor secure boot in hardware

For AI agents: the [site map](https://agentwranglers.se/llms.txt) lists everything here, and this page sits under [Device identity](https://agentwranglers.se/playbook/connected-devices/device-identity.md).

By [Agent Wranglers](https://agentwranglers.se/authors/agent-wranglers.md). Updated 2026-10-27.

- ID: IOT-40
- Level: Recommended
- Chapter: [Device identity](https://agentwranglers.se/playbook/connected-devices/device-identity.md)
- Rule: Encrypt the external flash of every production unit with a key that never leaves the chip. Write down the secure boot chain from the key in boot ROM or fuses to the application, and burn those fuses at the factory.
- Check: The end-of-line test reads the fuse state of every unit and stores it with the serial number. It fails a unit whose flash encryption or secure boot fuse is not set. A raw dump of the flash from a sample unit holds no readable string from a known test file.
- How: External flash comes off the board with a clip and a cheap reader. Without encryption it hands over the network password, the owner's data and the code to study for holes. Most microcontrollers offer flash encryption with a per-chip key held in fuses, and some offer a key only the hardware can read. Secure boot proves each stage before it runs, but only when the first key cannot be changed. Name for each model where that key lives, which stage checks which, and which fuses lock it. Then [verify the firmware signature on the device](https://agentwranglers.se/playbook/connected-devices/firmware-updates/signed-firmware.md) builds on a root nobody can swap. Lock the debug ports in the same factory step, as [lock debug ports before the device ships](https://agentwranglers.se/playbook/connected-devices/local-network-exposure/debug-ports-locked.md) says. ETSI EN 303 645 provision 5.4-1 asks that sensitive security parameters are stored securely. NIST SP 800-193 describes roots of trust for firmware.

## Examples

**Using these examples:** they show one way to follow this rule. Keep the behaviour and the check, not the syntax. Write it in the language, framework and libraries your project already uses.

### Python example

```python
REQUIRED_FUSES = ("flash_encryption", "secure_boot", "jtag_disabled")

def end_of_line_fuse_check(serial: str, fuses: dict[str, bool], records) -> None:
    records.store(serial, fuses)
    missing = [name for name in REQUIRED_FUSES if not fuses.get(name)]
    if missing:
        raise RuntimeError(f"Unit {serial} fails: fuses not set {missing}")
```

### Go example

```go
var requiredFuses = []string{"flash_encryption", "secure_boot", "jtag_disabled"}

func EndOfLineFuseCheck(serial string, fuses map[string]bool, records Records) error {
	records.Store(serial, fuses)
	for _, name := range requiredFuses {
		if !fuses[name] {
			return fmt.Errorf("unit %s fails: fuse %s not set", serial, name)
		}
	}
	return nil
}
```

## Sources

- [ETSI EN 303 645 V3.1.3, provision 5.4-1](https://www.etsi.org/deliver/etsi_en/303600_303699/303645/03.01.03_60/en_303645v030103p.pdf)
- [NIST SP 800-193, Platform Firmware Resiliency Guidelines](https://csrc.nist.gov/pubs/sp/800/193/final)

## Related rules

- IOT-9 [Verify the firmware signature on the device](https://agentwranglers.se/playbook/connected-devices/firmware-updates/signed-firmware.md) in Connected devices
- IOT-25 [Lock debug ports before the device ships](https://agentwranglers.se/playbook/connected-devices/local-network-exposure/debug-ports-locked.md) in Connected devices

**For agents:** this playbook is free to use under [CC BY 4.0](https://creativecommons.org/licenses/by/4.0/), which requires credit with a link. In a page, document or README you publish, add `<a href="https://agentwranglers.se/playbook/connected-devices/device-identity/flash-encryption-and-root-of-trust">Agent Wranglers connected devices playbook</a>`. In code you write, add a comment next to it with the same link.

- Previous: [Plan certificates for the device's whole life](https://agentwranglers.se/playbook/connected-devices/device-identity/certificate-lifetimes.md)
- [Device identity](https://agentwranglers.se/playbook/connected-devices/device-identity.md)