This is sort of hard to do, because you have to store the key to decrypt it somewhere... so if they've dumped the flash, they have the information needed to decrypt it...

Though there is probably some merit to at least a passing attempt to obfuscate it, so it doesn't jump out at someone snooping around in the flash - but if they've got the flash contents, a dedicated adversary will be able to get the sensitive data out of it... I mean, they could just write it to their own board, and see what requests it sends, and get the data that way if they wanted to.

There are AES libraries for Arduino / ESP8266 which can do the job - but they introduce a performance and storage impact. You could use some very basic bit inversion instead:

void xor_crypt(char *buffer, int buf_len, char* key, int key_len)

{  

   int ki = 0;  

   for (int bi = 0; bi < buf_len; bi++)   {    

      buffer[bi] ^= key[ki++];    

      if (ki >= key_len) ki = 0;  

   }

 }

...

char* key = "secret";

char* str = "Say hello to my little friend!";

int str_len = strlen(str);  //Remember this value in order to ensure proper decryption!

      //Encrypt

xor_crypt(str, str_len, key, strlen(key));

    Serial.println(str);

//This will be "garbage" in the serial monitor

//Reverse

xor_crypt(str, str_len, key, strlen(key));

      //Do NO rely on "strlen" for "str" here!

Serial.println(str); //This will be the original string again

Even though this form of encryption may seem crude, it may be just as hard to break as more advanced forms of encryption - but the performance impact is negligible.

EDIT: Bug in code fixed.

vaz83:
The idea would be storing the key in the code itself, but leaving some json files on the flash memory encrypted. I know there is always a way, but at least i am protecting my data at some sort of level. Can you point me in any direction ?

Then on the other hand this is just obfuscation as DrAzzy said. You could store the key on an external EEPROM chip or an sd card which you insert before operation and remove after operation (much like online banking dongles work).

What do you mean by "doesn't allow all the text"? The encrypted buffer is binary and null-characters may therefore occur. Since "strlen" searches for the first null-character, some of the string may be lost. The sollution is to store / remember how long the original string was instead of relying on strlen (which I wrongly did, code in #4 updated).

This is sort of hard to do, because you have to store the key to decrypt it somewhere... so if they've dumped the flash, they have the information needed to decrypt it...

Though there is probably some merit to at least a passing attempt to obfuscate it, so it doesn't jump out at someone snooping around in the flash - but if they've got the flash contents, a dedicated adversary will be able to get the sensitive data out of it... I mean, they could just write it to their own board, and see what requests it sends, and get the data that way if they wanted to.

There are AES libraries for Arduino / ESP8266 which can do the job - but they introduce a performance and storage impact. You could use some very basic bit inversion instead:

Even though this form of encryption may seem crude, it may be just as hard to break as more advanced forms of encryption - but the performance impact is negligible.

EDIT: Bug in code fixed.

vaz83:
The idea would be storing the key in the code itself, but leaving some json files on the flash memory encrypted. I know there is always a way, but at least i am protecting my data at some sort of level. Can you point me in any direction ?

Then on the other hand this is just obfuscation as DrAzzy said. You could store the key on an external EEPROM chip or an sd card which you insert before operation and remove after operation (much like online banking dongles work).

What do you mean by "doesn't allow all the text"? The encrypted buffer is binary and null-characters may therefore occur. Since "strlen" searches for the first null-character, some of the string may be lost. The sollution is to store / remember how long the original string was instead of relying on strlen (which I wrongly did, code in #4 updated).