STM32 MCUs Security

We are right now using this MCU STM32L051C8T6 in a mass production up to 32.000 setsRight now we have met a problem,afer all 32000 pcs have been programmed with an hex file.I was found mcu have been locked and we cannot upload new files into them. 1. Can anyone help to figure out why the MCU was locked after the programming? 2. Is there any solutions to unlock the MCU which has already been soldered on the PCB boards?Thanks!!

..

Hello,We have an STM32 project with SBSFU bootloader used for firmware updates. We have a pipeline that is triggered from GitLab that will compile and sign the firmware and update pakcage. Before taking production private keys into use, we are considering strategies for secure storage of the keys while still trying to keep things as simple and automated as possible.One option would be to add a manual step to the pipeline where update packages are signed and encrypted in an offline computer. Other option would be to store private keys only in RAM of the machine running the pipeline which would minimize risk of leaking the keys. This would have the benefit of keeping everything automated. The problem is that I haven't figured out a way of supplying the key to the prepareimage.py script from a variable stored in RAM, it seems to require a file. Is there any way of achieving this?Is there a way of integrating a HSM (hardware security model) to the SBSFU process?Thanks!

I have followed a tutorial (https://www.youtube.com/watch?v=i10X4Blr8ns&ab_channel=STMicroelectronics) to try and get a simple BLE application running and view this application using ST's BLE Toolbox on my Android phone. However, I do not see my device advertising. Is there a missing step to configure BLE on the WB15. The linked tutorial is for the WB55. I have only configured the BLE from within cube MX (only using auto-generated code). I have not written my own code yet. Is there some additional user code that needs to be written in order to allow the Bluetooth to begin advertising?

Hello everyone,I must start a production of PCBA which use the MCU STM32G474QET6 and I need to protect my firmware, I want to set the read protection at Level 1. Is it possible to set that option byte in the firmware when I flash the firmware?Thanks.Best regards,Andrea Alessi

Hello Support Team,Good day,we are working on the Code Isolation activities on the STM32U585ZIT6Q controllerWhile creating sample code with enabled trust zone, It is divided into the two-part, a. Secure code, It has own while loop but before that, control is transferred to the Non-Secure code through "NonSecure_Init()" b. Non-Secure code, It will run after the secure control is transferred to the non-secure code through the "NonSecure_Init()" call in secure We have some of the queries as per below, As per the sample code, Secure fw does not performing any operation inside the while() loop and all operations take care of in the non-secure while() loop, 1. Can we write a code in a while () loop in the Secure firmware?  2. Can we change the state of the control of the operation access like secure and nonsecure code execution at any point of time? ex. Non-secure code performing in data collection operation and after some time we have to perform the separate code execution which

..

is there any hardware ways so that I can make it much more faster ?

I have been using HAL library of cipher acceleration hardware before on the same mcu (first 100 units) without any problems, but in my last order, all mcu goes to hardfault error when i used exactly the same code on it (same binary file). By debugging, I realized that this library doesn't execute well the read/write operations from the cipher hardware, and then crash on hardfault. This error ONLY happens on my last order of 100 mcu chips. I really don't understand what's happening. Any ideas? Are there more recents upgrades on the HAL library encryptation module?I am using stm32cube version 1.10.1 IDE, and stm32cubeMX version 6.6.1.202207061420. I didn't change to more recently versions, because they change the way ETH drivers is configured.

Flash writing procedure has just finished. The next step, anyone can assume, is verification, that code has been written correctly, which involves reading the flashed memory. At this stage, if I trace the API calls, which Cube tool does to perform flash reading. Does this mean I can copy the firmware without having vendor keys? Please point me at which step I'm wrong.

..

if (SE_Startup() == SE_SUCCESS) {......SE_Startup() --> __IS_SFU_RESERVED();__get_LR() = 0x80055d7 SB_REGION_ROM_START) = 0x8005d00 SB_REGION_ROM_END = 0x801 ffff

Hi all--I am working on a project using the STM32WB55. I would like to distribute an "official" firmware, but also allow third-party firmware to be installed. The intent is that the official firmware will be open source, so users can make changes to the official firmware and upload their own firmware to the device.The catch is that the official firmware will include private keys (not part of the open source distribution, obviously) used for signing its output, so that users can verify that the output was produced by the official firmware, as opposed to a third-party firmware. This means:The official firmware should be encrypted, and X-CUBE-SBSFU will need to have the ability to decrypt that firmware.Users should not have access (either through JTAG or through third-party firmware) to the keys required to decrypt the official firmware, or to the decrypted official firmware itself.I think X-CUBE-SBSFU will allow me to do this with a little modification, but I wanted to get a second opini

Nuttx operating system with stm32l562 board, compile the bin file of the board, and then according to the board directory, readme.txt in the operation through the TFM load the bin run, will give the following secure fault problem：[Sec Thread] Secure image initializing! ABCDF [Sec Handler] Oops... Secure fault!!! You're not going anywhere! [INF] Starting bootloader [INF] Checking BL2 NV area[INF] Checking BL2 NV area header [INF] Checking BL2 NV Counter consistency[INF] Consistent BL2 NV Counter 3 = 0x1000000 [INF] Consistent BL2 NV Counter 4 = 0x1000000 [INF] Swap type: none [INF] Swap type: none [INF] verify counter 0 1000000 1000000 [INF] counter 0 : ok [INF] verify sig key id 0 [INF] signature OK [INF] verify counter 1 1000000 1000000 [INF] counter 1 : ok [INF] verify sig key id 1 [INF] signature OK [INF] Bootloader chainload address offset: 0x17000 [INF] Jumping to the first image slot set to BL2 SHARED DATA2XX_HUKCUSTOMIZATION [INF] Code c002900 c011bfe [INF] hash TFM_SBSFU_Boot 1

Dear Sirs,I have downloaded and installed thepackage. I am able to build the example projects with CubeIDE flawlessly butthe batch scripts (.bat) are not working. running the scripts(e.g.02_01_Postbuild_SimpleAppV1.bat) I get the error "The specified pathcannot be found." (actually the message is in the system language, that inmy case is Italian, so I am not 100 % sure of the translation in Englishlanguage).Trying to look into the batch script, itis truing to access this folder:set "prepareimage=%basedir%\win\prepareimage\prepareimage.exe"But after installing the MOOC package(with the installer "STM32SecuWS-material.exe"), I can not find any"win" directory in any location.Am I missing g something?Thankyou. Kindregards,Claudio

[EDIT: Question below is about STM32U5 PKA, but I see the STM32L5 Cube S/W has an example "PKA_ECCscalarMultiplication" that is probably similar to what I'm trying to do. Not sure how similar PKAs are on these MCUs but I bet they are either identical or very similar. I will look at the example and post back...][EDIT 2: OK, it's clear that the L5 and U5 PKA share DNA, but that they are not at all identical or even "very similar". 32 bit vs. 64 bit, no error codes on output from many L5 operations (including scalar point multiplication), PKA RAM addresses, operation parameter lists, etc.]I'm using the STM32U585's PKA to do an ECC scalar multiplication. For sure I might be configuring it wrong, although I've got a lot of stuff working with the PKA (not the best documented peripheral). I want to multiply the base point for curve P256 by 19 (this is for a test vector). I may or may not have the PKA RAM configured properly. Regardless, upon completion, PKA RAM @ 0x680 holds the dreaded "0xC

Using an STM32H735G-DK (MB1520-H735I-C02), I was using the HDP_Boot/HDP_Appli examples and I think I fat-fingered the SEC_AREA_START and SEC_AREA_END addresses, setting both to the same value which effectively secures all of internal flash. Neither the on-board STLINK nor an external J-Link can connect, but the board seems to be executing the Dhrystone test out of external Flash a few moments after a reset, which seems to be impossible.I see that the external flash is connected to OCTOSPI1 and that the OCTOSPIx peripherals can be mapped into memory where they are treated as if they are internal memories, but between 0x08000000 (internal flash) and 0x90000000 (OCTOSPI1) there are reserved regions, SRAM regions, the bootrom itself and of course ALL of the memory-mapped peripherals. AN5601 says that reading the protected memory areas will return 0x00000000 which is just two ARM THUMB LSL R0, R0, 0 instructions, but with all those other regions in the way (and many of them exeception-induc

Hello guys I hope you can help me with my problem regarding my adaptation of sbsfu.I'm currently adapting the stm32f413h-discovery example project on a stm32429zi. Everything works fine with one mayor exeption. I have difficulty downloading a new firmware version via Y-Modem. Everytime I want to downlaod a newer version (e.g. changed version nr. in postbuild.bat and in userapp.c) the download crashes and I get the following output via terminal. (all securities where off during testing)I can however download the firmware successfully when holding the userbutton on a reset like it is mentioned in um2262 chapter 8.4.I have tested this with multiple version numbers, all have worked.I also tried activating securities and then using the user button, but in this case a button bush is considered a "Tampering fault".I have also figured out that both methods (download in sbsfu and download in userapp) use completly different functions. I'm not familiar enougth with how Y-Modem works to find any

..

Hello, I am working with the STM32U585 and am looking for a HAL function to generate RSA key pairs? And AES keys if possible? I see that wolfssl has these functions available but they do not support the STM32U575 / 585 yet. I've seen other posts suggesting to use OpenSSL but I'm worried about how large the library is. I would like to generate a new set of keys upon every power on to ensure better security as apposed to just using OpenSSL to external generate keys and then input them into the system. Is there any build it functions using the AES or PKA that can generate keys? Thanks

Salve gente. Come consulente ho ricevuto l'incarico di riutilizzare una certa quantità di una scheda giochi che contiene come processore ausiliario il STM32F215ZET6 che sovrintende gli I/O della scheda per il Soc che contiene un ARM e la gestione grafica del display. La mia necessità è scoprire dove e come sono allocati gli I/O e come sono trasmessi all'altra CPU, e lo posso fare se riesco a leggere il soft interno.

On running the SBSFU project on STM32F769I-DISCO board, will the boot ROM evaluate the integrity and authenticity of Secure boot. So that, the user will be sure that his/her Secure boot not replaced by others.

Hi,I need to generate option byte file(.s19) which is enabled Read out Protection for STM32F4. The reason is to program this .s19 file using non ST programmer in production environment. May i which ST Tool should i used to generate option byte file(.s19) ?

In the v2.6.2 NUCLEO-G474RE SBSFU examples 1_Image and 2_Image the linker file n_Image\Linker_Common\STM32CubeIDE\mapping_sbsfu.ld has the following line: __ICFEDIT_SE_region_RAM_start__    = 0x20018000;But the RAM actually starts at 0x20000000. Examples for other dev kits start at 0x20000000. Once I replace the example app with my real app, I have a linker error because I have run out of RAM. Is this an error in the example or is there something special about the STM32G474 RAM above 0x20018000 that makes the SBSFU example want to use only that region?

AN5185 specifies that encrypted keys should use AES-128 GCM, but the format of data sent to FUS isn't very well specified:Byte0: key type:• 0x00: None• 0x01: Simple key• 0x02: Master key• 0x03: Encrypted keyByte1: key size N in bytesByte2 to ByteN-1: key data (key value + IV if any)In particular, two things are not clear to me from this description:What format should the key data take, i.e., specifically how should the key value, tag, and IV be arranged in the data sent to FUS?What value should the key size take? The application note says Byte 2 to Byte N-1 are key data, but doesn't seem right at all, since it suggests a 16-byte key would have N = 18 (i.e., it would occupy bytes 2 through 17).Specifically, for an AES-256 encrypted key (with 32 byte cyphertext, 16 byte IV, and 16 byte tag), what value should be in byte 1, and how should data be arranged in bytes 2 and up?Thank you!