The S3 holds the root secret, generates it from hardware entropy at first boot and shows a 24-word seed over serial. Files encrypted with it (.crin) open only while the board is plugged in. Encryption runs on the chip, so the file key never crosses USB.
Hardware notes:
- Not every S3 board works. You need native USB, ≥8 MB flash running QIO at 80 MHz, and a way to reach serial: two USB-C ports, or a UART header plus an adapter. On a single-port board you’d never see the seed. Reference board: ESP32-S3-WROOM-1 DevKitC-1 (N16R8).
- With two ports, HID shows up only on the native OTG port (VID_303A&PID_8123); the CH343 port is plain serial, used for flashing.
- The beta firmware is the -dev track: Secure Boot v2 and Flash Encryption are off and eFuses stay unburned, so the board stays fully reversible.
- There’s a separate extraction challenge on a chip with Flash Encryption burned in RELEASE mode. Lab attacks are allowed. Flash the challenge image (GitHub - jaffa2970/cryptin-challenge: Crypt-in extraction challenge — signed firmware image, no source. Flashing it burns the chip for good. · GitHub), never the beta one, which bricks a burned chip. The first boot burns the chip for good, so use a spare board.
The beta is free until 31 March 2027. Limits up front: the beta package is Windows 11 (64-bit) only. A Linux CLI exists, but it’s part of the SDK, not this download. No bounty: valid findings get your name in the April 2027 public security report.
Flash guide and release hashes: Developer Beta — Crypt-in
Question for XIAO users: the XIAO ESP32S3 has a single USB-C port, so the seed would have to come out over the UART pins. Has anyone here tried something similar on it? I haven’t tested it on a XIAO.
I’m the dev, ask me anything about the HID protocol or the flash layout.
Hi there,
So, A
BIG Warning to anyone, messing about here, DON’T
I can appreciate the Enthusiasm, but your real close to the door here… bordering on a scam, or at minimum a spam.
I don’t see the need to throw away a board. I don’t , These types of destructive tech are IMO not helpful to anyone but you (maybe seeed) btw 3’ e’s…
This is WAY over board for what folks on here do with Xiao, sure you’ll have the peanut gallery comments. But for makers and users ? what is the point. LOL 
Looks like a thing needing a purpose AFAIK.
It’s a very odd niche’ I wouldn’t be entertaining any testing of it. NO point!
Here is what is actually going on behind the post:
-
What it actually is: It’s a crowd-sourced hardware security challenge/beta for a proprietary file-encryption device concept (.crin files tied to physical token state). It relies on burning ESP32-S3 eFuses in RELEASE mode to test physical side-channel and extraction resistance.
-
Why it feels off for a Seeed forum: Most people use Seeed XIAO and DevKit boards for prototyping IoT sensors, e-paper dashboards, wearables, or home automation. Asking makers to intentionally brick hardware by burning security fuses for a zero-bounty beta WTF ? (where the only prize is your name in a PDF report) is a tough sell. 
-
Who it’s actually aimed at: It’s targeted at firmware security researchers, hardware hackers, and folks into physical key fob cryptanalysis—definitely not standard hobbyists or makers just trying to build a weekend project.
Take this somewhere else…
HTH
GL 
PJ 
BTW, Seeed will NOT refund your purchase if you do this non-sense. 
Fair points PJ, thanks for taking the time. One correction though, because it matters for anyone reading: the beta doesn’t burn anything. It’s the -dev firmware, Secure Boot and Flash Encryption off, eFuses untouched, and you can reflash the board back to whatever you had. Nothing gets bricked.
The fuse burning is only the separate extraction challenge, which is opt-in and meant for a spare board. It’s in the post, but I can see how the two blur together.
You’re right about the audience: it’s for people who like poking at firmware security, not the usual XIAO weekend project. And yes, no bounty, I put that up front on purpose. Nothing is for sale either, the beta is free.
If the mods think it fits better somewhere else on the forum, happy to have it moved.