Compressed download with encrypted flash (ESPTOOL-1089)

[boborjan2]

Is your feature request related to a problem?

I get "WARNING: - compress and encrypt options are mutually exclusive" when --encrypt and -z are both enabled. However, having checked flasher stub sources, it seems that stub actually supports writing encrypted after inflating compressed data. What is the reason for inhibiting encrypted writes with compressed data on pc side? Thanks in advance.

Describe the solution you'd like

It would be nince to have encrypted writes with compressed downloads, it would increase flashing speeds during eol.

Describe alternatives you've considered

No response

Additional context

No response

[github-actions]

Hi @boborjan2! Please be aware that (1) the following suggestions are generated by a bot and haven't been fact-checked by Espressif Systems, (2) burning eFuses and enabling security features are irreversible operations and can damage your ESP32 device. We hope that this message will help you until an Espressif Engineer looks at your issue.

---

Thank you for your detailed question regarding the mutual exclusivity of the --encrypt and -z/--compress options in esptool.

According to Espressif’s documentation and logs from the Flash Download Tool, the warning “WARNING: - compress and encrypt options are mutually exclusive” is expected behavior. When both options are enabled, the tool will flash uncompressed, as indicated in the logs:

WARNING: - compress and encrypt options are mutually exclusive
Will flash uncompressed

This restriction is enforced by the tool, and the documentation does not provide a technical explanation for why encrypted writes with compressed downloads are inhibited. The documentation only states that this is a safety measure to prevent issues such as bricking the device when handling encrypted firmware, but it does not elaborate on the technical limitations or whether the flasher stub could theoretically support decompressing and then encrypting data on the fly. The current implementation simply does not allow both options to be used together, and the tool will default to uncompressed flashing if both are specified Using the ESP Flash Download Tool to finish the Flash Encryption + Secure Boot + NVS Encryption.

If you require this feature for production (EOL) speed improvements, it may be worth raising this as a feature request directly with Espressif, as the current knowledge sources do not indicate any supported workaround or technical rationale beyond the enforced mutual exclusivity.

If you need further clarification or an official roadmap update, contacting Espressif support or following the esptool repository for updates would be advisable.

[radimkarnis]

Hello @boborjan2,

thanks for the question and feature request.

What is the reason for inhibiting encrypted writes with compressed data on pc side?

This is not inhibited on the host (PC) side, but on the stub flasher side. Yes, the routines to support decompression and encryption are present in the stub sources, but not in a way they could be executed together - it's either one or the other.

We plan to introduce a way to enable this.