Encrypted Data Vault: ESP32 Version

An encrypted data vault is a device that employs a sophisticated encryption algorithm to encrypt your data and utilizes its built-in memory to store your data in an encrypted form.

• ESP32 x1
• 10µF capacitor x1 *optional

I did my best to make the encryption algorithm as secure as possible. The encryption algorithm takes eight characters (64 bits) as an input (if the input length isn't multiple of eight ASCII characters, padding is applied), generates 64 random bits (eight characters), and passes 128 bits to the AES (Advanced Encryption Standard) cipher. After that, the AES's ciphertext split into two half, 64 bits each. Each half of the AES's ciphertext then passed to the Serpent cipher alongside 64 random bits. Finally, the resulting ciphertext is the concatenation of two ciphertexts from the Serpent cipher. Random bits generated during the encryption process are disregarded during the decryption process. And by the way, if you give the algorithm the same input more than once, the output will be different every time.

If you've never flashed ESP32 before you'll need to configure Arduino IDE and install drivers to upload the firmware to the boards, you can download the CP210x driver here: https://www.silabs.com/developers/usb-to-uart-bridge-vcp-drivers

In case you don't have Arduino IDE, you can download it here: https://www.arduino.cc/en/software/

Configuring IDE isn't a part of this tutorial, you can read about it here: https://randomnerdtutorials.com/installing-the-esp32-board-in-arduino-ide-windows-instructions/

You can download the firmware here: https://github.com/Northstrix/Encrypted_Data_Vault

Location for the firmware for the device: ESP32/Encrypted_Data_Vault/Encrypted_Data_Vault.ino

I've also included some additional materials that might be useful for you. Check the extra folder.

You need to download the Serpent library and extract it into the folder with the sketch. Every other library already comes preinstalled with the ESP32 package.

One of the most reliable means to generate the keys is to throw a dice, but if you trust software more than you trust dice or don't want to throw dice around your house for half an hour - I can suggest this program https://defuse.ca/passgen.htm which seems to produce a random output, but I can't guarantee this.

You can also use a Random Number Generator that I wrote. I can't guarantee that it's secure either.

This device needs two keys:

1) A key for the Serpent cipher that is 64 characters long. This key is in hexadecimal format.

2) A key for the Advanced Encryption Standard that is 16 characters long. This key is in ASCII format.

My keys are:

Serpent's key: 761087A94F7C7FBC955AC330F61A4797A2FE095D6114C7168F7C75954C5281BE

AES's key: e=Alvy+-$kI>#57?

Note that in the firmware, both keys are enclosed in quotation marks, like that: "key"

By the way, never make your keys public! I only did that because it's a tutorial, and I'm not going to encrypt my data using these keys.

Open the file Encrypted_Data_Vault.ino and replace the existing keys with those you've generated.

Some boards will flash without any problems.

Unfortunately, that's not the case for all boards. If you configured IDE correctly, installed drivers, selected the corresponding port, and still keep getting this error: A fatal error occurred: Failed to connect to ESP32: Timed out waiting for packet header, then connect a 10µF capacitor to the board while flashing.

Connect the positive lead of the capacitor to the EN pin of the ESP32;

Connect the negative lead of the capacitor (usually indicated by the gray stripe) to the GND pin of the ESP32.

Let's get to the part where this device finally does something useful.

This device encrypts passwords, notes, phone numbers, and whatever you feed to it.

I was able to encrypt and then decrypt a 704-long plaintext (5632-long ciphertext) without any problems.

To encrypt a record:

1) Open the Serial Monitor;

2) Set the baud rate to 115200;

3) Reboot the board;

4) Enter 1 into the text field, and press send;

5) Enter the plaintext into the text field, and press send;

6) Copy the Ciphertext from the text box.

Eventually, I came up with these results:

Plaintext:

Encrypted data vault is a device that employs a sophisticated encryption algorithm. The encryption algorithm takes 8 characters (64 bits) as an input (if the input length isn't multiple of eight ASCII characters, padding is applied), generates 64 random bits (8 characters), and passes 128 bits to the AES (Advanced Encryption Standard) cipher. After that, the AES's ciphertext split into two half, 64 bits each. Each half of the AES's ciphertext then passed to the Serpent cipher alongside 64 random bits. Finally, the resulting ciphertext is the concatenation of two ciphertexts from the Serpent cipher. Random bits generated during the encryption process are disregarded during the decryption process.

Serpent's key:

761087A94F7C7FBC955AC330F61A4797A2FE095D6114C7168F7C75954C5281BE

AES's key:

e=Alvy+-$kI>#57?

Ciphertext:

DD125210C719510EA62B92BB9774E66F269EB9C4F3BD14365AB23C456B7C9DB43E04428A02312600D9C2B72FC0E5BD1DAC2A26619561E4409E05631BF3361F944BEB5948C931AD0EB1D846853894FB378A682571F827BC578A967DDE934340999129A8D24D608734D5C6724FB911EA622A7043944FEDC1013D27110A738A84D2FF05AF884811DEB8359E8F6F05EE9100D531BDDEFB78FDF417C0A2078E24A8EFABA5980D22F2B134FA5D687E6879EE81C8A8A50606E4F75D34971259EC26B8359A42B0F29382499DC164356D16D99FC02ADDEA003B1DF05D66906B8B724BC9D410289B491AB23F1BF3056C782E2AC0FE8CD2AC7209BFED6BD975001341EF58D90D3AE224A71287725787CB52214C3B66E1C8997E2E1FFE46B5648F12F3C030D2BF4B5A700E2F0040812CFD1AD5C19487991CF84CC2E77376CE200183BFB496718828D72CD329D4CEE256ADB639BDAD3F4B478F7C1EC8566281531687FF3B20407A91C45A2E0DAEEC43CF67B2C671DB9E0214813A9F99B7C0042008EC0B691774982ED78D5C843AE244653BEFE8DC81FBD957D2559A325F42DC5D316C95F9C1B8C0B3FE10A9E59009DD41859F4AF7A2A3E595FD317AAE0B17C5E4DD200737E447EA9CF32C4F6243CD8DC8C60BDF68D6A58F2B210B0DF282901661CDDBA84EC7B0F3E1E0373D4EED272A4E73562875272C51E550D82E4A14AAC099A3DA89AF0F4A0DB1EF1A5B7818CC55274C89F059037436B467926D618A2E1D276191A95F2F2F53EC5B29C95E22A56C96A8052ACD0EBD63F8818BCA67B90E58B4F73CEA7A6D9C6F44C8E9416FEA04304602A42B14E87F423B512F5EE419153E6C805D44E97492117772A4BEBD83F1AE7C35D1F392356B9442075A62FBDC41618DF8A24B3CFD4C6353CD567C8FC5EB5182D9EA9DFD0DC006F1C52B307C855D8D8D9F625873B25DCCE82A8C4108D4A94783A99DC03BAAA0E6BE1D9BA553C19DE6C408B38E3C1D505F0123E5F6A4A504926FD5F59640E38848FF8154BA3376E322FBE51A3FB5886316AD45B13D20DD29098352A542CA13781A0AA0715DC221378C96B84CDD1AD8C557C89968895A85E6C38C5CA12DF733DC07178ADF49ADE71A8D9E1055D24513CE6F088463E2D13A17C9FF29C105241F23B52789CB6811B310D43684FDA84F1010D7DBBCF7CA159CF923C94C30D586BDD43EF998CBAB0CF85EF50CCC1371FB0D0E8075B044BE39AB8A880A0795E1730563A676A1350C22918B449279F2D9AE453421E80F684325E2BE4D79194C204D1E9DCE41456AFD48E47961506AD27A15D214D68C82E377A55287529C3AAB6F4492203D24ACED1DDA0D163BDB64F90548BD529CCF1E88607F3CA9C9525C7FFE3D997C2591725E5072EF5F418A0361BFE83FBF0C0767DFF43407025285CEE507DD6B164D39F15F332DCC680FC7D2F480D81312B17B1E7C1CA609E1A47D64036D8D906F41D2781E901DB4EDAF4CC9C1AE075C58086A351D96F3F105EA4E5A9A3FA9E1F6582E6746C9054EC427C72B20FA735F053C08F1207290DC9AC8F89ABC56A89FCB5F939AF3E0124BE7B2A6A44943D381F81575DA76989D3F31535F82678B9FE87568116A67755E51B990FA78C062F9637DB179E383E45BB3F946847C663248FCB46F47C010917587B1E2600FC3DC80507E1AFF28A1B2750603C9E3B5E3CFB9ABE6E792DDCBF4FF9E5A8FB324ECD0C83372AFDF59C69B198190A131854F291820A745CC67427EACD25A13B1A7986300C2948B351987FF5A2C670EC9BBC603497863EB6140C30FE05AC9B45EFE82AA2FE054B60466A08A5FE3DCAE0414DA70667AA4998B850EB4220C03F5D80A7E6791A0CC2DCCE54E72451FEDFC7CC5DD1A62B48266B965C0568427C403386D9082006370C38BEC33C64530268FEE06270FE3EDAF1EB6B93F5096DE39F87E3B3D684AA75536455DA5292466E03FB475E317849707801A153B7033D18FA65CBD9D2B0CC9DA6B38CD69F4B2CE884199F730103D4E26CDD3442526F81EE0919B65ABB6994805A4172BDB28E840C7D7A929360CFCFFEC13E9197B1907250E73F789A52C418E101C82409FA20C3324DDD7B871D3BF3C1F316F44A6BAA62A7162290AC173BDA8E11F6B6F45B5427B58B8089B93961712E25991C18CBF47F580670F99F61D8C45714790BB87FB280CBA1EC8C92C1BFEFFC536DE4159029ED2333AEF970E7DA348FFC0BA288303D72DBA105BC366E9C7D1A1847D65B84BB6415C5B8F46FC914C713D689FE1C5737FE85168E1CA9E2ADD27AABB6675EB183665527EAE6F2F16E3EC8F2D110B8312793131857D8D558F3D120629C872BB2C813FB58B01BB1175D870E30EE85AF233EC687B6072385125445F4EC7206DE7BFEAC4D01087196DD00EB2D0977F894933C95C78028CEA688A8FE9725E1318BC9DE922F497C84B0F48F7C0B655D80E0FFD2216532B3AC37C6D90980640A668E59D1683A278D3C2CB69C1EBC598C06DBA23E27FEB29BBD7F224A4CD3426728B02F4794A33DB4B79F65D8C501CA9D8F15A4DF0981B62C6AE2051E6A1E65454E5C81CA168495E4B6C378074FD4320B62319206CAF70BC85904624AB4FFF4D57816F6F94F3F3EB43626FD2C4E3A3BA95E1DB78B45FF0427720692A7394C1CBB85F1E3169CA2F2E1C5C0CAF78EECAADFD3AFF2263622372DBD9B1DD7F7BE9003028B7853BF5049D4C42712E2A97DA03E7FF509AEEFE84B0887CC0BD21FCCCEB85BE45153715720158FDCBFD56E05A23DB68B5B0F693457E42637154B686F50F33F272D5793DDF143DD041B24C5FD9AE4C0BA8217296532C0CA1D2307AFC7CC1007E434E1812DE7E66F6209F60335DECD5E07A0F46E879D6C6C5AE8D49DB0792505CBC84B31A3EBA9812D1F01E11CEBC2F762B65A172AB014E3F5079FDB9AD945A581AD9AE1EC24CEC757C05B5FF2307A096C9CF844DCD74CD61984EDC8E5ADF40F10CFCE7548F7390C2AFDE8076DF0515B59D5BEF1EDC31D60CA15DDE0B1ADA5E1E613D9D33964BA8E1A68E3B24D17D85C90C35243555DF3EF788EA587E7BDE768EE9BC21AFC2202E1FBF750F0F55C83CB2C5CFA52092BABF759CC58BB522C71D525BC14E187CCE4625220186D82B0BCCBD5DC9E941DBAC3A9EA8F6BF3722ABBFEEF1D671A2A7F097AA25A19AF44A111570539F66CC0AC3DE527A2778A7E9744CF29915D5F830E2B4671E2B23263E123DDB4A30FC2E5A571F783977754F953FC38F08B3F28DD06125A09592B228670167FBD78FB7C5494A4C7845AAC92B073895643CC9548D9EF05A74057871F36E7984E74FBBBBD9ACC9BA903733523480813016363E5C8054E6168340F6D47948A58D4B2F22266FFD68AF1B6F278C61997FEB3A152A80921702D49A08895E1E4D362F51747961BB0D262E813261EC37554818F9878BECC96B053DC351A2592CB30E625661C375585D54F6E750FD96FCB4C9BB920EAE194B0934A57C92BA8E8D4C2EFC1E023842C727F0814809652EA2FEE84C2F7E87640DDDCB03E92DE29AE64F0D5F979C6CE75143433C165A2861936852EF75429B400E1883BA76FD835740327559B73C88B4F58E6353DC4F8DC48414A6B16537D7919B9985A2C772E1D0CDDF3E8C75404C9CB0A6449E2266E1FFA17AAEF6A8B169FC7DB011E77ADF9A6DA9A61E1A05282045EEAC70F65F8AC600E8747A786AD0C7F8901057571AF1AF2A629CCE40CDA702E600B3D826D5A03663E522E68EE5CA1D3AE7DDFCFDD7152BBBB837880804173118AECF4A5BD96761BFE578D5B404CDBD93A17F819F22BC615978BA3408C6438856A66089FAECB4626F5DB2B0C89C0D3C50858CF16864F309BDA63DD3F2BD3F78B1533C458A456BDFEC1387AA4AA2DA3806B922D3E242C5C3CEAEF85B907615F8951B6F67B1F47B9B48E4B4B540167173E9A9D584470DE68ED555861EFB540C2CCBD585CB5C1C2496E3F28CE1344A0DA9EB53C04B3ECC4CCA20E40C

To decrypt a record:

1) Open the Serial Monitor;

2) Set the baud rate to 115200;

3) Enter 2 into the text field, and press send;

4) Enter the ciphertext into the text field, and press send.

The primary purpose of the ESP32 Filesystem Uploader is to let you upload files into ESP's filesystem. In this tutorial, the purpose of this tool is to upload an empty SPIFFS image into ESP.

Download the file called ESP32FS-1.0.zip from here: https://github.com/me-no-dev/arduino-esp32fs-plugin/releases/

then extract the content of the archive into the folder: ...\Arduino\Tools\

After that, restart the Arduino IDE.

Click Tools -> ESP32 Sketch Data Upload. Then click Yes in the pop-up window. It's going to upload an empty SPIFFS image into the ESP. I have no rational explanation for that, but after that step, the file system finally begins to work as it's intended to.

To save a record:

1) Open the Serial Monitor;

2) Set the baud rate to 115200;

3) Enter 3 into the text field, and press send;

4) Enter the filename into the text field, and press send;

5) Enter the content of the file into the text field, and press send;

I've chosen desc as a filename and ciphertext from the step 8 as a content.

To load a record:

1) Open the Serial Monitor;

2) Set the baud rate to 115200;

3) Enter 4 into the text field, and press send;

4) Enter the filename into the text field, and press send;

I've entered desc as a filename.

To remove a record:

1) Open the Serial Monitor;

2) Set the baud rate to 115200;

3) Enter 5 into the text field, and press send;

4) Enter the filename into the text field, and press send;

I've entered desc as a filename.

I've created these three files to show you how it works.

old password

new password

whatever it can be

Filenames displayed with the slash / before them. That means that the file is stored in the root directory. When you enter the filename, you don't need to enter a slash indicating the root directory.

To list all stored records:

1) Open the Serial Monitor;

2) Set the baud rate to 115200;

3) Enter 6 into the text field, and press send;

I did my best to make this device as secure, cheap, and useful as possible. Now it's entirely up to you what to do with it.

If you like this tutorial, please share it.

Thank you for reading this tutorial.