can not enable secure boot after enabling flash encryption (IDFGH-14288)

[finch71]

Answers checklist.

• I have read the documentation ESP-IDF Programming Guide and the issue is not addressed there.
• I have updated my IDF branch (master or release) to the latest version and checked that the issue is present there.
• I have searched the issue tracker for a similar issue and not found a similar issue.

IDF version.

5.4

Operating System used.

Windows

How did you build your project?

Command line with Make

If you are using Windows, please specify command line type.

None

What is the expected behavior?

enable secure boot after enabling flash encryption

What is the actual behavior?

idf.py encrypted-flash monitor
shows

Signature Check Failed
Sig block 0 signature verification failed
E (244) secure_boot_v2: Secure Boot V2 verification failed.
E (250) esp_image: Secure boot signature verification failed
I (257) esp_image: Calculating simple hash to check for corruption...
W (323) esp_image: image valid, signature bad
E (323) boot: Factory app partition is not bootable
E (323) boot: No bootable app partitions in the partition table

Steps to reproduce.

1. enable flash encryption (development mode) and idf.py flash
2. confirm the boot success
3. enable secure boot and idf.py encrypted-bootloader-flash idf.py encrypted-flash

Build or installation Logs.

No response

More Information.

No response

[AdityaHPatwardhan]

Hi @finch71, it seems that the secure boot verification check has failed in your case.
Can you please make sure that the bootloader.bin and application.bin are correctly signed.

You can do that with the following command

espsecure.py signature_info_v2 bootloader-signed.bin

Make sure that this image is signed with the correct key (whose public key digest is stored in the eFuse of your device)