Secure Key-Value Store for Raspberry Pi Pico

Stop Hardcoding Secrets: How to Secure Configuration on Raspberry Pi Pico. When developing IoT applications using the Raspberry Pi Pico W or Pico 2 W, you often need to handle configuration data such as Wi-Fi SSIDs, passwords, and API tokens. During early development, it’s tempting to hardcode these values into the source code to get things running quickly. But in many cases, this practice carries over into production devices deployed in the field. However, are those values truly secure? Demo: How "picotool" + "strings" Exposes Your Secrets It’s common to embed Wi-Fi settings directly in your code like this: const char wifi_ssid[] = "MyHomeWiFi"; const char wifi_password[] = "SuperSecretWiFi123"; After flashing the firmware to your Raspberry Pi Pico, you can extract and inspect it using the following commands: $ picotool save -a firmware.bin # extract firmware from device $ strings firmware.bin | grep -i wifi # find wifi string MyHomeWiFi SuperSecretWiFi123 As you can see, any sensitive data embedded in the firmware can be read as plaintext. Why This Happens In embedded systems, constant strings and configuration values are typically placed in the read only data section during compilation, and then written directly to flash memory. On the Raspberry Pi Pico, this means anyone with physical access and standard tools like picotool can easily retrieve them. In short, unless you take precautions, all embedded data is accessible to anyone. The Solution: Secure Configuration with pico-kvstore Using pico-kvstore, you can securely store configuration data in encrypted form. The setup is straightforward and consists of the following steps: Step 1. Reading Configuration in Firmware pico-kvstore is a key-value storage library with a minimal API consisting of only four operations: set, get, find, and delete. Retrieving Wi-Fi configuration values in firmware looks like this: char ssid[64]; char password[64]; kvs_init(); kvs_get_str("wifi_ssid", ssid, sizeof(ssid)); kvs_get_str("wifi_password", password, sizeof(password)); This code retrieves encrypted values from storage and automatically decrypts them at runtime. Step 2. Enabling Encrypted Storage in pico-kvstore pico-kvstore allows flexible storage configuration via the kvs_init() function. To enable encrypted storage, simply initialize the components as shown below: bool kvs_init(void) { blockdevice_t bd = blockdevice_flash_create(KVSTORE_BANK_OFFSET, KVSTORE_BANK_DEFAULT_SIZE); kvs_t underlying_kvs = kvs_logkvs_create(bd); kvs_t *kvs = kvs_securekvs_create(underlying_kvs, NULL); kvs_assign(kvs); return true; } Reference implementation: examples/fs_init_secure.c Step 3. Encrypting and Writing Configuration from Host pico-kvstore comes bundled with a command-line tool called kvstore-util, which allows you to create and edit configuration disk images on the development host. You can specify the key-value pairs and the directly from the command line to prepare a secure image for deployment. $ kvstore-util create -f setting.bin $ kvstore-util set -f setting.bin -k wifi_ssid -v MyHomeWiFi -e $ kvstore-util set -f setting.bin -k wifi_password -v SuperSecretWiFi123 -e

Apr 17, 2025 - 09:58

Secure Key-Value Store for Raspberry Pi Pico

Stop Hardcoding Secrets: How to Secure Configuration on Raspberry Pi Pico.

When developing IoT applications using the Raspberry Pi Pico W or Pico 2 W, you often need to handle configuration data such as Wi-Fi SSIDs, passwords, and API tokens.
During early development, it’s tempting to hardcode these values into the source code to get things running quickly. But in many cases, this practice carries over into production devices deployed in the field.
However, are those values truly secure?

Demo: How "picotool" + "strings" Exposes Your Secrets

It’s common to embed Wi-Fi settings directly in your code like this:

const char wifi_ssid[] = "MyHomeWiFi";
const char wifi_password[] = "SuperSecretWiFi123";

After flashing the firmware to your Raspberry Pi Pico, you can extract and inspect it using the following commands:

$ picotool save -a firmware.bin  # extract firmware from device
$ strings firmware.bin | grep -i wifi  # find wifi string
MyHomeWiFi
SuperSecretWiFi123

As you can see, any sensitive data embedded in the firmware can be read as plaintext.

Why This Happens

In embedded systems, constant strings and configuration values are typically placed in the read only data section during compilation, and then written directly to flash memory.
On the Raspberry Pi Pico, this means anyone with physical access and standard tools like picotool can easily retrieve them. In short, unless you take precautions, all embedded data is accessible to anyone.

The Solution: Secure Configuration with pico-kvstore

Using pico-kvstore, you can securely store configuration data in encrypted form. The setup is straightforward and consists of the following steps:

Step 1. Reading Configuration in Firmware

pico-kvstore is a key-value storage library with a minimal API consisting of only four operations: set, get, find, and delete. Retrieving Wi-Fi configuration values in firmware looks like this:

char ssid[64];
char password[64];

kvs_init();
kvs_get_str("wifi_ssid", ssid, sizeof(ssid));
kvs_get_str("wifi_password", password, sizeof(password));

This code retrieves encrypted values from storage and automatically decrypts them at runtime.

Step 2. Enabling Encrypted Storage in pico-kvstore

pico-kvstore allows flexible storage configuration via the kvs_init() function. To enable encrypted storage, simply initialize the components as shown below:

bool kvs_init(void) {
    blockdevice_t *bd = blockdevice_flash_create(KVSTORE_BANK_OFFSET,
                                                 KVSTORE_BANK_DEFAULT_SIZE);
    kvs_t *underlying_kvs = kvs_logkvs_create(bd);
    kvs_t *kvs = kvs_securekvs_create(underlying_kvs, NULL);
    kvs_assign(kvs);
    return true;
}

Reference implementation: examples/fs_init_secure.c

Step 3. Encrypting and Writing Configuration from Host

pico-kvstore comes bundled with a command-line tool called kvstore-util, which allows you to create and edit configuration disk images on the development host. You can specify the key-value pairs and the directly from the command line to prepare a secure image for deployment.

$ kvstore-util create -f setting.bin
$ kvstore-util set -f setting.bin -k wifi_ssid -v MyHomeWiFi -e 
$ kvstore-util set -f setting.bin -k wifi_password -v SuperSecretWiFi123 -e