STM32 MCUs Security

Hi Team,I am working on a project involving the STM32H5 microcontroller and I am in need of information on how to manage the keys securely for encryption and decryption. I have been unable to find a document that covers this topic specifically for the STM32H5.Could you please provide me with information on how to manage the keys securely using STMCube Programmer, Trusted Package Creator (TPC), or any other methods available for the STM32H5?Thank you for your assistance.P.Hitesh

I am trying to use TrustZone on STM32U5A9:I am setting up the following regions in SAU:0xc1fe000-0xc1fffff non-secure callable0x8200000-0x83fffff non-secure0x200c0000-0x20273fff non-secure0x60000000-0x6fffffff non-secureAs soon as I flip the enable flag in the SAU control register, the non-secure marked regions become invisible to secure code and start to read as zero. This contradicts the ARM documentation, which says that secure code can read non-secure memory.So what am I missing?

Hello,I am working on Secure Boot for one of the project having the following list of information,Board : B-U585I-IOT02ADevice name : STM32U575/STM32U585Device type : MCUDevice CPU : Cortex-M33 I am trying to boot the device using generated keys with help of this reference document. I have made changes in tfm.mk and project_defs.mk , also TFM_DUMMY_PROVISIONING is kept OFF to avoid provisioning using Dummy Keys already present in the Project. I am not able to understand on how I can put the relevant information for the generated key in the following structure in provisioning.c file,=====================================================================================__PACKED_STRUCT bl2_assembly_and_test_provisioning_data_t {uint32_t magic;uint8_t bl2_rotpk_0[32];uint8_t bl2_rotpk_1[32];uint8_t bl2_rotpk_2[32];#ifdef BL1uint8_t bl1_rotpk_0[32];#endif /* BL1 */};=====================================================================================I am getting the f

I'm trying to create ECDSA keys on a STM32WL55 using the X-Cube/HAL Crypto library. I can generate NIST keys no problem, however when I try using the Brainpool curves, it mostly returns the following error: CMOX_ECC_ERR_WRONG_RANDOM ((cmox_ecc_retval_t)0x0006000B) /*!< Random not compliant with the API (Recall with other random material) */I've tried the following curves: CMOX_ECC_CURVE_BPP256R1 and CMOX_ECC_CURVE_BPP384R1. Sometimes BPP256R1 works, but BPP384R1 seems to always fail. That's very strange so it almost seems the library is validating the randomness in some way? I'm using the RNG to create a buffer of randoms the same size as the public key in bytes.Here is the jist of the code: // inputs: size_t pubLen, ecc_key_t* keypair uint16_t randSize = pubLen; uint8_t randBuff[randSize]; // ... set randoms via HAL_RNG_GenerateRandomNumber if ((result = cmox_ecdsa_keyGen(&eccHandle, CMOX_ECC_CURVE_BPP256R1, randBuff, randSize, keypair->private, &keypair->p

Hello,I have created my own program using TrustZone and I want to add the SBSFU_BOOT project to it. How can I do this?

Hello, I am writing code for changing the RDP Level, but I am facing a hard fault trigger in the code:this is the line after unlocking the FLASH_CR_LOCK, and FLASH_CR_OPTLOCK. After unlocking able to change the RDP level to 1 or 2 but as soon the debugger goes to line 2 (below), the hard fault is triggered.  while((FLASH->SR & FLASH_SR_BSY1) != 0x00); FLASH->CR = FLASH->CR | FLASH_CR_OPTSTRT; // this line triggers the hard fault Can anybody suggest any solution?

Hello,I am developing an application on STM32H7 MCU which uses SBSFU bootloader for secure firmware updates. I am trying to combine the SFB update package with some additional data in a single binary file that is sent for the firmware. To make this work, I need to determine where the SFB update package ends and the additional data starts in the binary. To this end, I check the firmware header of the update package. I noticed that the actual size of the SFB update package is 1024 bytes larger than the update size reported in the header. I expected SFB size to be larger than the firmware itself since the SFB package contains the header in addition to the update, but the header size is only 320 bytes.So I am wondering what does the SFB update package contain and can I be sure that its size is awlays the firmware size in the header + 1024 bytes?Thanks!

Hi, I've created a project in STM32CubeIDE 1.14.1 for the Discovery board B-U585I-IOT02A with TrustZone enabled. Unfortunately, I'm unable to select any of the TIM timers as the SYS_NS and SYS time source. They are disabled with the following message: "TIM6 disabled: This IP instance is already used or no context is selected."However, I activated the TIM6 timer with a Non-secure context enabled.Thanks in advance for your help!@STea 

Hi,I have a STM32HSM-V2AE and I tried to follow de "SFI Step-by-step on STM32 boards". In the part of "HSM programming" I connect the STM32HSM-V2AE to the computer with the smart card reader HID OMNIKEY 3121 but I have the following error:Error: HSM initialization error 0x88000002 What I have to do to continue from this step onwards?Greetings and thanks in advance.

Dear Support Team,I am currently working on a project involving the STM32H5 microcontroller and I am in need of a document that details the process of firmware encryption, decryption, and update for this device. I have previously used the UM2262 document for a similar purpose, but I am unable to find a similar document for the STM32H5.Could you please provide me with a link or reference to a document that covers this topic for the STM32H5 microcontroller?Thank you for your assistance.P.Hitesh 

Hello,I have NUCLEO-U575ZI-Q board and I have followed the steps to generate an SFI file from the video "STM32Trust Video Series: X-Cube-SFI Part 3-Out-of-the-box". I managed to generate the SFI file correctly but when I tried to install the firmware, I got an error (when running the script FlashSFI_SWD_OEM_Dev.bat script at minute 16:00 in the video).Now, when I try to connect the board to the STM32CubeProgrammer, I get the following error:Error: ST_LINK error (DEV_TARGET_NOT_HALTED)Now I can't connect the board to the STM32CubeProgrammer. What should I do now?

Hello folks,i am exploring the x-cube-sbsfu project and have 2 questions:Question 1:why is the SeCoreBin built separately and then later integrated to SBSFU? What is the motivation behind that?I was thinking about putting SeCoreBin and SBSFU in one project and building it once.Question 2:When using MPU protection instead of the firewall protection why do we need a single entry call gate?if i understand it right, the call gate is only used to prevent calling secure engine functions directly. But when protecting secure engine funtions using the mpu what would be the security issue if an unprivileged code part first acquires privileges and then calls secure engine functions directly without passing by the single entry call gate@Jocelyn RICARD, @Fred 

I've implemented on my own board (MCU STM32WLE5CCU6) bootloader SBSFU from example 'STM32Cube_FW_WL_V1.3.0\NUCLEO-WL55JC\BFU_1_Slot'. Everything works ok.In my own aplication i must change download channel from usart to by radio FSK. Because of handling radio i must change linker scripts in bootloader apping_fwimg.ld, mapping_sbsfu.ld). I must resize section SBSFU Code Region to bigger. I've changed 'SB_region_ROM_end' from value 0x0800CFFF to 0x08013FFF. Also i must changed following regions: KMS_DataStorage_start = 0x08014000;KMS_DataStorage_end = 0x08015FFF;SLOT_Blob_Dwl_1_start = 0x08016000;  SLOT_Blob_Dwl_1_end  = 0x080167FF;SLOT_Active_1_start = 0x08016800; SLOT_Active_1_end  = 0x0803FFFF. After compiled and runned code i have always the same problem. When the Secure Engine Call (inside SE_Init() function) is called in this line:e_ret_status = (*SE_CallGatePtr)(SE_INIT_ID, peSE_Status, primask_bit, uSystemCoreClock); (which is bet

Hello,I am working on a large project on a custom board based on STM32 L5 series. I've already set up, implemented, and tested my code using STM32CubeIDE. Now, I'm trying to integrate the project into SBSFU. For that reason, I am using the SBSFU example for NUCLEO-L552ZE-Q, however, it is confusing which files I have to copy to the SBSFU Application project. Besides, instead of copying/pasting files I'd like to automate the process.Are there any guides with examples?  

Hi,I'm looking into introducing STM32 Secure Boot and Secure Firmware Update based on X-CUBE-SBSFU library on my project with app based on CubeMX v6.11.1 (BSP1.28.0).I noted in CubeMX the MPU option is still not available for FreeRTOS - which is used by my application.It looks like the Secure Boot will be using MPU, but the app won't - will this become a showstopper for Secure Boot? Thanks,Torben

Hi, I'm trying to build TFM example applications from the B-U585I-IOT02A directory to work on Nucleo-U545RE board. THe documentation says it's possible. I have updated the project settings, but I'm getting errors from the STSAFE library: C:/Work/OldCourse/SecureBootTesting_ST/Projects/B-U585I-IOT02A/Applications/TFM/TFM_Appli/Secure/Src/stsafea_service_interface.c:92:51: warning: implicit declaration of function '__HAL_RCC_GPIOF_CLK_ENABLE' [-Wimplicit-function-declaration] 92 | #define STSAFEA_VREG_GPIO_PORT_CLK_ENABLE __HAL_RCC_GPIOF_CLK_ENABLE | ^~~~~~~~~~~~~~~~~~~~~~~~~~ C:/Work/OldCourse/SecureBootTesting_ST/Projects/B-U585I-IOT02A/Applications/TFM/TFM_Appli/Secure/Src/stsafea_service_interface.c:301:3: note: in expansion of macro 'STSAFEA_VREG_GPIO_PORT_CLK_ENABLE' 301 | STSAFEA_VREG_GPIO_PORT_CLK_ENABLE(); | ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ C:/Work/OldCourse/SecureBootTesting_ST/Projects/B-U585I-IOT02A/Applications/TFM/TFM_Appli/Secure/Src/stsafea_service_interface.c:9

Hello,I've implemented secure bootloader on STM32H753ZI using SBSFU examples and it's working very well. To secure the board I use WRP + RDP Level 1 + Secure Memory Area for bootloader. I would like to have option to recover from this state and be able to switch board to Level 0 with mass erase. Unfortunately I cannot achive it. After switch from bootloader to main app I can only connect with hot plug moge (which is correct I think as Security OB is checked). I can't change RDP level from 1 to 0 in this mode using STM32 Cube Programmer. I click apply and nothing happens. I also can't set Secure Memory Area from Cube Programmer and it's only possible to set it from code in bootloader.I tried to include code in my bootloader on the beginning which checks GPIO state. When it's low it set RDP level to 0. Without Secure Memory Area it's working fine and memory is erased and RDP is set to 0. However when I add Secure Memory Area and setting GPIO to low level I can't connect to board in any w

Hello,I need to implement AES-CBC 192 bits on micro STM32U5 serie, but hardware only supports 128 or 256 bits If i use XCUBE-SAFEA1, ST_Cryptolib is not available for U5 serie.How can i fix this issue? 

Hello,We are developing a product based on a STM32WB5MMG. We have configured the SBSFU with OTA (Asymmetric with AES encryption scheme). Everything is working great and I have only one question that came to my mind during the last commit...The CBC key for decrypting/encrypting the code is stored in the KMS of the CPU2. The SBSFU is supposed to read from there the key to decrypt new updates. So, why is the key also embedded in the binary of the SBSFU itself, in the se_key.s file? Basically, anyone who has access to the repository can have access to the encryption key (and in our case, being a team with more than one developer and with the potential to collaborate with external parties, this is undesirable). (I'm going to remove the se_key.s from the repo in the meantime). But most of all, what is the point of using the KMS if the SBSFU image itself contains the key?I'm sure I've missed something and would be very grateful if someone could help me understand it.Thank you and best re

Is it possible to call Secure (S) application code from Non-Secure (NS) application code with TrustZone on STM32H573?  I have not seen any examples of this from ST, so I want to know if it is possible or if there is some fundamental reason why not.The idea is to re-use protected private keys for bi-directional authentication purposes.  For example, an ECDSA private key is stored in the S application.  The NS application could provide a message content in RAM and call the S application to generate the signature.  This would allow the NS application to generate signatures at runtime without direct access to the private key data. The effect would be like using the S application as a sort of software TPM.The use-case would be to allow an external PC tool communicating with the device to determine that the device is genuine and authentic.Further, this could be extended for AES data encryption/decryption.  The AES keys and/or implementation could be stored in the S a

Hi all, first time working with stm32.So far I've managed to make things work, I've even workarround this issue (*), but I can't seem to understand why this is happening in the first place.STM32F429, STMCubeIDE, ST-LINK/V2This is my situation:Execution of code starts at Sector 1.Sector 1 & 2: My_Bootloader (to the effects of this post, not PCROPed)Sector 3: My_SecureSegment (PCROPed, code compiled with -mpure-code option, memory section attribute (x): executable code (**) )Sector 4 and on: My_Application (not PCROPed)I start the debugger, it gets halted at Reset_Handler (as expected). Reset_Handler: nop nop nop movw r0, #:lower16:_estack movt r0, #:upper16:_estack mov sp, r0 (added the nops just to demonstrate the kind on instruction that's being executed)No error flag set (FLASH_SR = 0)Step Into (instruction stepping mode active), one nop executesRDERR flag gets set.From Reference Manual [RM0090 - 3.9.6 Flash status register (FLASH_SR)]:So, who is attempting to ac

When the Secure Engine Call (inside SE_Init() function) is called in this line:e_ret_status = (*SE_CallGatePtr)(SE_INIT_ID, peSE_Status, primask_bit, uSystemCoreClock);(which is between a SE_EnterSecureMode and SE_ExitSecureMode). The MCU resets at this point, the reset happens continuously (reset loop) always at this line. The code executed until after SE_EnterSecureMode(&primask_bit); is called. I have added TRACE calls to check this. Here is the problem area:/* Enter Secure Mode */ TRACE("\r\n= [SE_Init] SE_EnterSecureMode..."); SE_EnterSecureMode(&primask_bit);   /* Secure Engine Call */ TRACE("\r\n= [SE_Init] (*SE_CallGatePtr)..."); //RESET HAPPENS BELOW: e_ret_status = (*SE_CallGatePtr)(SE_INIT_ID, peSE_Status, primask_bit, uSystemCoreClock); TRACE("\r\n= [SE_Init] (*SE_CallGatePtr) done");   /* Exit Secure Mode */ TRACE("\r\n= [SE_Init] SE_ExitSecureMode..."); SE_ExitSecureMode(primask_bit);I have setup all other paramters correctly for STM32L4R9 follo

Am searching for SFI documentation without HSM to demonstrate to a Device certificate authority. Can you please share UserManual or ApplicationNote for STM32H573I-DK.BestRegards,P.Hitesh 

Hi, I'm looking into introducing HMAC SHA-256 on my STM32F429 based project as part of a requirements change. As a first go/no go, I'll need to know what is the worst case required MIPS figure and memory foot print (SRAM/FLASH) for running the algorithm on a data entry of up to 255 bytes stored in internal SRAM? Thanks, Torben

Hi,I'm trying to get access to the UID registers (address 0x0BFA0700UL) of the CPU with the above configuration from the non secure application. The secure fault callback is getting called. I have tried adding an entry in the boot code file low_level_security.c in the sau_init_cfg and region_cfg_init_ns arrays in an attempt to allow the non secure application to access this region.This addition does not seem to help.I would like to get access to these values in order to initialize the USB CDC device stack which uses this data in the device description. Obviously I have access to these registers in the boot code. In a TF-M project on the same hardware I pass this data to the application using the BOOT_TFM_SHARED_DATA_BASE.Is it possible to make this data accessible to the non secure application without adding all the TF-M code? If so, can you, please, provide some pointer to how I should approach this to get the code working?From a security point of view, is this approach addi