Lock It Down

Enable Maximum Security For PolyCast5 | Lock It Down

Locking It Down

If you're security-conscious and want to store important information on your PolyCast5, that's great! PolyCast5 is awesome for this since it's open-source (you can verify the code for yourself and rebuild locally), offline, customizable, and encrypted. All while allowing quick and convenient access to your passwords and other data via the password manager, on-device portals, and other customizable scripts.


There's only one problem: physical access.

This doc will walk you through how to enable release mode flash encryption and secure boot v2, to solve the physical access problem and secure your device.


The reason this isn't enabled by default is that there are some trade-offs. All devices have development mode flash encryption enabled by default for passive protection, but it will not stop a sophisticated attack since people can upload their own malicious firmware to extract your data. The trade-offs for switching to release mode flash encryption (and secure boot) are outlined below:

Basically, you lose the ability to flash code manually to your PolyCast5.


The only way you will be able to update your device will be to:

  1. Clone PolyCast5-OTA (wireless updates repository).
  2. Rebuild the code with your own private signing key (more on that later).
  3. Upload your locally-built binaries to your cloned OTA repository.
  4. Repoint OTA updates to that cloned repository in the source code.
  5. Then finally, update your device wirelessly via 'Settings' > 'Check for Updates'.

This is also permanent, so you can't change your mind afterward. Additionally, you lose the ability to recover your device online. So don't forget your PIN! With that, let's dive in to how you can enable it.


Enabling Full Protection

Fair warning - this is quite manual. However, this is required as it needs to be done locally in order to be completely secure. Wouldn't want me to secretly copy your signing key! (Not that I ever would.)


First, clone the official PolyCast5 repository. Ideally this would be the latest stable release. However, at the time of writing this there is only one (the repository will be made public around mid-August 2026):

git clone https://github.com/RoboticWorx/PolyCast5.git

Note: You will need Git installed as well as your IDE of choice.


After cloning, open it up in VS Code, or whichever IDE you're using. If you're on VS Code, you can install the ESP-IDF extension then download ESP-IDF through the EIM.

You'll want to make sure the ESP-IDF version you install matches the ESP-IDF version PolyCast5 is using, as said in the README under 'Development'.


When prompted, select ESP32-C5 as the chip that PolyCast5 uses.

This is subject to change - check the actual readme.

You may also need to change your VS Code project settings to match the installation path you chose. This can be found in the PolyCast5 project root under .vscode/settings.json.

e.g: "idf.currentSetup": "C:\\Espressif\\.espressif\\v6.0.1\\esp-idf"

The same goes for the tools path and everything else in settings.json.


After that, you can open up an ESP-IDF terminal inside VS Code.

To confirm your environment is up and running, in the terminal run the following:

idf.py build

If you get something like this after a couple minutes of building, you're good to go!

Now open up that same terminal and run the following to generate your private signing key.

idf.py secure-generate-signing-key --version 2 --scheme ecdsa256 secure_boot_signing_key.pem

Next, navigate to the CMakeLists.txt located in the project root (PolyCast5/CMakeLists.txt), and switch:

set(POLYCAST5_SECURE_RELEASE 0)

to

set(POLYCAST5_SECURE_RELEASE 1)

Then hop back into the terminal and run the following:

idf.py fullclean build

After some time you should get the same 'build success' message as before. Something like this:

You have two paths now that you can pick:

  1. Back up your signing key (secure_boot_signing_key.pem), clone the PolyCast5-OTA repository to your own GitHub, update its manifest.json to your new location, point the current source code to your new self-hosted repository by changing the variable passed to wifi_ota_update_check_start(), then finally rebuild the code using your private signing key and upload it to the new OTA repository endpoint. This allows you to update the device wirelessly in the future. Also note that the hardcoded URL in wifi_ota_update_check_start() must be exactly right, pointing to the raw file. It is highly recommended to test this for yourself in development mode first to make sure you can update your device. After confirming it's good, run idf.py build then python lock_it_down.py in the terminal.
  2. Just run python lock_it_down.py in the terminal, then discard your private key afterward so it can never leak. Though, you won't be able to update your firmware anymore.

A good balance might be getting two PolyCast5s, one for your secure stuff that is completely locked down, then another that can always run the latest firmware. ;)


Either way, pick one and you'll be good to go! 

Of course, also make sure you have a PIN set, since this all does nothing if you leave your PolyCast5 unlocked. You can set it by going to 'Settings' > 'Set Unlock PIN'. Don't forget it! Additionally, your device will be locked forever after eight failed PIN entries, so don't worry about being brute-forced.


Happy casting!

*Please note that RoboticWorx is not responsible for compromised data. While there is no reason this wouldn't be completely secure, RoboticWorx as a company cannot guarantee the complete safety of your data. Be secure in your data management and always follow best security practices.*

Back to blog