STM32 MCUs Security

Hi,for my application I need to set RDP regression from my application code :1) Is it possible in RDP2 to provide OEM Key (for regression) from application code in order to restore JTAG access (and perform a regression whith a user intervention)2) Is it possible to do RDP 2 => RDP 1 from application code (using DBGMCU_DBG_AUTH_DEVICE or other way) ? if yes what is the correct process3) is it possible to go from RDP 1 to RDP 0 or RDP 0_5?for this part I try the following code without success (no error but no RDP Regression)  FLASH_OBProgramInitTypeDef obConfig = {0};  HAL_FLASH_Unlock();  HAL_FLASH_OB_Unlock();  obConfig.RDPKey1 = 0x11111111;  obConfig.RDPKey2 = 0x11111111;  obConfig.RDPKeyType = OB_RDP_KEY_OEM1;  obConfig.OptionType = OPTIONBYTE_RDPKEY;  HAL_FLASHEx_OBProgram(&obConfig);  obConfig.RDPLevel= OB_RDP_LEVEL_0_5;  obConfig.OptionType = OPTIONBYTE_RDP;  HAL_FLASHEx_OBProgram(&obConfig);  obConfig.RDPLeve

I need to debug the SBSFU project on the Keil IDE. I know there are some data about IAR and Cube but I couldn't find anything about Keil.After that, I also want to debug my main project while it is located in slot 1.So How is it possible?

What are the major differences between "Proprietary License vs BSD Clause 3 details ??"BSD Clause 3 says followRedistribution and use in source and binary forms, with or without modification, are permitted provided that the following conditions are met:1. Re-distributions of source code must retain the above copyright notice, this list of conditions and the following disclaimer.2. Re-distributions in binary form must reproduce the above copyright notice, this list of conditions and the following disclaimer in the documentation and/or other materials provided with the distribution.3. Neither the name of the copyright holder nor the names of its contributors may be used to endorse or promote products derived from this software without specific prior written permission.But, i didn't get details about "Proprietary License"

I am currently working on a STM32F767ZI-Nucleo board and a little security chip (microchip atecc508a), that is connected via i2c connection. For this chip is a library available CryptoAuthLib (https://github.com/MicrochipTech/cryptoauthlib), that I want to use in my project. I'm also using STM32CubeMX to generate my C-Files and Atollic TrueStudio to write my implementations.C programming language is relatively new to me, so I have no idea how to include my library folder to my project (either in cubemx or in trustudio?) to get it work.I think the include statement "#include "cryptoauthlib.h"should be in the main.cinclude section, but in a certain way I have to tell the IDE to use this library.I appreciate any help, thank you very much.

Hi,I am using the X-CUBE-AZURE example with the B-U585I-IOT02A development board equipped with STM32U5 microcontroller.Reading the tfm_mbedcrypto_config.h file of the TF-m it says that AES GCM is available with protection against DPA attaccks but in the datasheet of the microntroller it is indicated that SAES does not support GCM; how was this implemented at the hardware level? Is DPA protection for cryptographic algorithms also implemented at the software level?Thank you

I need to use hal_flash/hal_flash_ex/hal_flash_ramfunc but all of my normal peripherals are LL so the base hal drivers are not loaded into my project when I GENERATE CODE.  My workaround is to include something like CRC/HAL to load a bunch of hal drivers then I deinit the CRC in main.Likewise, is there a way to load HAL AND LL drivers? In CubeMX we can only choose one or the other.

Hello,I am trying to add a new crypto scheme in the SBSFU application for STM32H7B3-DK.I have implemented RSA_PKCS1v15_Verify() function using STCrypto lib in the SE_CRYPTO_Authenticate_Metadata() for RSA verification. As per my understanding the RSA_PKCS1v15_Verify() need modulus and public exponent component for verification using RSA key. Here public exponent is fixed and modulus is translate using KeysAndImages tool.My question is quit specific to the KeysAndImages tools translate_key scripts. Is translate_key scripts tools specific to the ECDSA only or it is generic to the all crypto scheme?I have already changed the signing method for RSA in place of ECDSA in the postbuild script.Thanks and Regards,Ikbal

I am trying to use the cryptographic library on a STM32F103, but I cannot find any documentation that is in line with the library and functions.In UM1924 rev.8 we still speak of version 3, but I cannot find the mnual consideration of rev. 4.0.1 (there is no user manual on the cdocumentation page).Where can I find the documentation for the correct management of the library functions?Thank you all for your support

Hi, I was testing the different levels of read protection and when I activated RDP 2, I lost full access to my board. I would like to know if there is any way to regain access (do a downgrade), despite losing all the content I had installed, something like a hard reset, ...

I am trying to write a user key to CKS on a P-NUCLEO-WB55 using either STM32CubeProgrammer or STM32_Programmer_CLI and the SWD interface. I am able to start the FUS no problem, as shown here:C:\Program Files\STMicroelectronics\STM32Cube\STM32CubeProgrammer\bin>STM32_Programmer_CLI.exe -c port=swd -startfus ------------------------------------------------------------------- STM32CubeProgrammer v2.10.0 -------------------------------------------------------------------   ST-LINK SN : 0661FF3837334D4E43124615 ST-LINK FW : V2J40M27 Board : P-NUCLEO-WB55 Voltage : 3.27V SWD freq : 4000 KHz Connect mode: Normal Reset mode : Software reset Device ID : 0x495 Revision ID : Rev Y Device name : STM32WB5x Flash size : 1 MBytes Device type : MCU Device CPU : Cortex-M4 BL Version : 0xd5 Debug in Low Power mode enabled   Warning: Option Byte: nSWboot0, value: 0x0, was not modified. Warning: Option Byte: nboot0, value: 0x1, was not modified. Warning: Option Byte: nboot1, value: 0x1, wa

Decryption(AES-256) error after encryption(AES-256) signal network transmissionThe progress is as follows--------------------------------------------------------------------------------------------------------------​AES SettingsKeyEncrypt(board 1)Decrypt(board 2)

STM32H7B3I-DK 1_Image demo project.Please let me know, what is the debug mechanism for SECoreBin application? How can I enable debug mode of SBSFU Secure Engine application?

Hello, I'm working for an MNC and we use stm32l431cc. And I have to implement firmware updates over the air.physical connection:TARGET DEVICE <---UART----> External IOT DEVICE (GSM MODULE) which can be plugged in and out <----> Cloud service.For the security part, I need advice or suggestions. I'm new to this topic, so I found confidentiality, integrity, and Authentication are important criteria for this situation. What I understood confidentiality: No one can decrypt my firmware even if they got this through (physical wire etc.) or through cloud.Integrity: Know if the firmware is changed or corrupted, intentionally or not. Like a crc check.Authenticity: A math formula that "I know that this firmware is 100% from this person and decide what to do now".Question:integrity and authenticity are quite important. But why confidentiality?? Should I encrypt my software? Because a binary image is just bits right? either 0 or 1? Can you suggest/advice what is important and what is no

Hi,My custom SBSFU_UserApp.bin failed the header signature verification in slot SLOT_ACTIVE_1 when I tried to execute it on the STM32H7B3I-DK board.To replace ECDSA with RSA signing verification, I have changed se_crypto_bootloader.c.SECoreBin project's se_crypto_bootloader.c file needs to be debugged.I am using STM32Cube IDE and compiling the applications as per the order mention in the readme file of the STM32H7B3I-DK 1_Image demo project.Please let me know, what is the debug mechanism for SECoreBin application? How can I enable debug mode of SBSFU Secure Engine application?Thanks,

Referring to "mapping_sbsfu.h" file of the example "2_Images_OSC" of STM32f769I-Discovery, seems the DTCM and SRAM2 are not used in the project.So does it have a reason?

I tried to make my project SBSFU compatible, by using 'STM32F769I_Discovery_2_Images_UserApp' example. It is based on the STM32F756VGT6 microcontroller and I defined the load region on ITCM interface address range -0x200000 to 0x2FFFFF- instead of AXIM interface -0x8000000 to 0x80FFFFF-.I did what is said in an5056 section 8.1 but unfortunately was not successful.The compilation is O.K and when I look at the generated Hex files of SBSFU and the main project with ST-LINK UTILITY, the ranges are O.K and are as the ranges of the linker file. But it seems when the postbuild wants to create the final binary file it misses the main project section and the SLOT_ACTIVE_1 is almost filled by 0xFF.Here is my project's linker, mapping_fwimg.h, and mapping_sbsfu.h#! armclang --target=arm-arm-none-eabi -mcpu=cortex-m7 -E -xc ; ************************************************************* ; *** Scatter-Loading Description File generated by uVision *** ; *****************************************

Hello,I try to verify data with cmox_ecdsa_verify. It fails with CMOX_ECC_ERR_BAD_PARAMETERS. I think my public key has the wrong format, because the buffer CMOX_ECC_SECP384R1_PUBKEY_LEN is 96. My key has the length of 120 bytes.I have exported my public with openssl. For example:openssl ecparam -name secp384r1 -genkey -noout -out myprivate.key openssl ec -in myprivate.key -pubout -out mypublic.der -outform DERWhat format do I need? And is it possible to convert the OpenSSL key to the right format?Thank you.

   1. I need to implement SBSFU (Secure Boot and Secure Firmware Update) in my Nucleo STM32H743ZI Board, but the SBSFU package is available for STM32H753ZI, STM32H7B3I-DK, STM32H750B-DK board. So Which Package is best for the Nucleo STM32H743ZI board? what changes need for implementing that package in my Nucleo STM32H743ZI board. Please suggest the changes so, I can run SBSFU in the Nucleo STM32H743ZI board. I have STM32CubeExpansion_SBSFU_v2.6.0. 

..

Hello,I am trying to flashing customized SBSFU_UserApp.bin of 1_Image application from BSFU example project on STM32H7B3I-DK. I am getting error when the application is booting. The error is:= [SBOOT] SECURE ENGINE INITIALIZATION SUCCESSFUL= [SBOOT] STATE: CHECK STATUS ON RESET   INFO: A Reboot has been triggered by a Hardware reset!= [SBOOT] STATE: CHECK NEW FIRMWARE TO DOWNLOAD= [SBOOT] STATE: CHECK USER FW STATUS   No valid FW found in the active slots nor new FW to be installed   Waiting for the local download to start...= [SBOOT] STATE: DOWNLOAD NEW USER FIRMWARE   File> Transfer> YMODEM> Send ...............The reference 1_Image of STM32H7B3I-DK is working fine. I am adding a new crypto scheme in this application. I have not change any address in the Linker_Common files. I am setting the application in development mode through app_sfu.h fie. The compilation of 3 applications, prebuild and postbuild scr

STSAFE-A110 series are come in Reel packaging, it's SO-8 package ,I need to know the orientation for IC pin 1 in tape reel. could you hlep to inform us for this question?

..

the function MX_RNG_Init failsHAL_RNG_Init returns t.o.: while (HAL_IS_BIT_SET(hrng->Instance->CR, RNG_CR_CONDRST)) {  if ((HAL_GetTick() - tickstart) > RNG_TIMEOUT_VALUE)  {   /* New check to avoid false timeout detection in case of preemption */   if (HAL_IS_BIT_SET(hrng->Instance->CR, RNG_CR_CONDRST))   {    hrng->State = HAL_RNG_STATE_READY;    hrng->ErrorCode = HAL_RNG_ERROR_TIMEOUT;    return HAL_ERROR;   }  } }

..

I am using an STM32H757. I understand how, using the TrustedPackageCreator and an HSM, I can supply our manufactures with an encrypted version of the firmware and limit the number of product instances they can produce. My question is, when the product firmware is being updated in the field does the person doing the updating (service engineer) need an HSM card as well. If so, is there a way to give our service people a card that allows for unlimited firmware updates? If not, what is the best approach to provide our service people with the ability to update the firmware in the field? We would like to avoid the situation were the service engineer cannot update the firmware because the HSM card has no more instances remaining.