STM32 MCUs Security

Hello,I am trying yo implement the HW encryption acceleration on a STM32F423CH for AED CCM Mode. I tried to implement on the first place the CTR encryption mode but it seems to me that the example provided in the NIST Special Publication 800-38A cannot be implemented since the STM32 Inicitialization Vector only accept 96 bits and not the 128bits from the NIST example:F.5.5 CTR-AES256.EncryptKey 603deb1015ca71be2b73aef0857d77811f352c073b6108d72d9810a30914dff4Init. Counter f0f1f2f3f4f5f6f7f8f9fafbfcfdfeffBlock #1Input Block f0f1f2f3f4f5f6f7f8f9fafbfcfdfeffOutput Block 0bdf7df1591716335e9a8b15c860c502Plaintext 6bc1bee22e409f96e93d7e117393172aCiphertext 601ec313775789a5b7a7f504bbf3d228Is that right?Second question, jumping the CCM implementation in the RM0430 Reference Manual of the STM32F423 there is a description on how to implement the CBC-MAC (CCM) encryption.My principal problem is how to configure the AES_IVR registers for this configuration to reproduce the examples on NIST Special

Hello,I am trying to flashing SBSFU application on the STM32H7B3I-DK board using STM32Cube Programmer. I am using STM32H7B3I-DK 1_Image example project from SRM32CubeExpansion_SBSFU_V2.6.1. The board is working fine in the first boot and all the jumpers are in default settings. After checking the demo application I am trying to flashing the SBSFU application. For the flashing, I am taking guidance from section 8: Step-by-step execution of "UM2262-Getting started with the X-CUBE-SBSFU STM32Cube Expansion Package" document.The above documents used NUCLEOL476RG board as a reference to flash the application, but I am using STM32H7B3I-DK. Due to different board I have not change the option bytes settings. The board read out protection is set at Leve 0. After completing the above steps and flashing the SBSFU_UserApp.bin, the application is work find and I can see the SBSFU application menu at the tera term screen.After the restart the board I am not able to see anything's at tera term. I am

Hi,I have a chip marked as STM32F437 but my software fails on running the SHA256 algorithm on the hardware crypto module.The only difference to the STM32F427 is the additional presence of a hardware crypto accelerator in the STM32F437.How can I check that the crypto module is present and enabled?When I check the DBGMCU_IDCODE register I read 20016419h on both.That means -DEV_ID: 2001h STM32F42/STM32F43 Rev 3,4,5, and B.-REV_ID: 419h STM32F42 STM32F43So I can not differentiate between STM32F42 and STM32F43.How can I do that?Is there any known criminal chip cloning known for STM32F437?I attach pictures of the chip that works as expected and a chip that dos not work.Thanks in advance, Adib.--

I shall just write a function in software but I would be interested to know if it is supported or not by the CRC peripheral hardware.STM32 cube MX configurator does not allow you to choose X7 for the 7bit (8 term) polynomial described on page 21 of this datasheet?It is also prevented by a length check on line 111 of stm32l4xx_hal_crc_ex.c(case CRC_POLYLENGTH_7B)"https://www.sciosense.com/wp-content/uploads/documents/SC-000897-DS-7-ENS210-Datasheet.pdf"Thank You

I have decided to try out the X-Cube-SbSfu, i have downloaded the SW from the ST website,according to the documents available this is an expansion pack that can be added to the CubeMX.is this correct?where can I find information about the process that helps me accomplish this?

I have worked with the HAL software implementation of the CRC using HAL_CRC_Calculate() and HAL_CRC_Accumulate(). Works great. How do I utilize the hardware CRC feature? Can you direct me to an example or more information?

..

..

Hello,I am trying to port SBSFU example project on STM32L433RC board. I followed getting started and integration guide to integrate STM32L432KC SBSFU 1 image example project(after modification) on STM32L433RC board. Below is the image where it gets stuck and waits for New user firmware. I ran scripts from MOOC workshop. It just uses UserApp.bin to download on board. Not sure why the code is trying to ask to download new user firmware. Can anyone help in pointing out if I am doing something wrong?Thanks!

The reason that I'm doing this is because I want to sign the mcuboot bootloader used by TF-M. (https://git.trustedfirmware.org/TF-M/trusted-firmware-m.git/tree/platform/ext/target/stm/b_u585i_iot02a/include/flash_layout.h).The flash layout looks like this:/* Flash layout for b_u585i_iot02a with BL2 (multiple image boot): * * 0x0000_0000 SCRATCH (64KB) * 0x0001_0000 BL2 - counters(16 KB) * 0x0001_4000 BL2 - MCUBoot (84 KB) * 0x0002_7000 OTP Write Protect (4KB) * 0x0002_8000 NV counters area (16 KB) * 0x0002_c000 Secure Storage Area (16 KB) * 0x0003_0000 Internal Trusted Storage Area (16 KB) * 0x0003_4000 Secure image primary slot (256 KB) * 0x0007_4000 Non-secure image primary slot (512 KB) * 0x000f_4000 Secure image secondary slot (256 KB) * 0x0013_4000 Non-secure image secondary slot (512 KB) * * Bl2 binary is written at 0x1_2000: * it contains bl2_counter init value, OTP write protect, NV counters area init. */I added space for the header before "BL2 - counters" - the

Hello,I am exploring the example application of X-CUBE-SBSFU for STM32H7B3I-DK board. I have successfully compile the given example application for 1_Image. I have tried to understand the 1_Image_SEcoreBin application for cryptography and key generation. The example application is used ECC cryptographic schemes for firmware authentication. I have checked the se_crypto_config.h for changing the scheme but there is only ECC defined.My question is I need to change the ECC cryptographic schemes to RSA schemes. How can I change or add the support for RSA cryptographic schemes for the STM32H7B31-DK board? Looking forward for your support.Thanks,Ikbal

..

Hello, I've been trying to build an application with Trusted Firmware and using Zephyr RTOS for the non-secure application i'm using b_u585i_iot02a board. After i build my application, the OSPI is not working anymore from my non-secure application. I can see from AN5247 and RM0456 that the default security state of the OSPI banks when building with trusted firmware is secure, which then makes sense. So my question is: Is it true that the OSPI is non acccessible from non-secure application when building with trusted firmware pr. default? And if yes, how can i disable this so i'm able to use it from my non-secure application as before?

..

I wish to try the TFM application on my B-U585I-IOT02A demo board. But the support for STM32CubeIDE has disappeared in FW_v1.1.0. Is there any reason for that, or can I copy the project from patch_cube5_v.1.0..2, though the source files have significantly changed since then ?Regards

i have a problem, when flash the SBSFU UserApp with the scipt and reset the Board. i get this:= [SBOOT] SECURE ENGINE INITIALIZATION SUCCESSFUL= [SBOOT] STATE: CHECK STATUS ON RESETWARNING: A Reboot has been triggered by an Option Byte reload!= [SBOOT] STATE: CHECK NEW FIRMWARE TO DOWNLOAD = [SBOOT] STATE: CHECK USER FW STATUS A FW is detected in the slot SLOT_ACTIVE_1 = [SBOOT] STATE: VERIFY USER FW SIGNATURE = [SBOOT] STATE: EXECUTE USER FIRMWARE = [SBOOT] System Security Check successfully passed. Starting...i get this in an endless loop and i don't get to the Main Menu. i use stm32 wb55.Please help me !!

From SBSFU examples, with default SECUSER memory setting except reading from OB registers, it is only protecting SBSFU area alone.Are we need to protect SBSFU + ACT_SLOT HEADER (1024 Bytes for H7) area as well right ??So what is your recommendation on protection of HEADER ??

Hi ,For a GIVIEN Binary File . We Want to Implement STM32CUBEIDE Post Build CRC calculated Value to Match with the STM32 HW CRC value .For IAR WorkBench IDE the IDE Proviedes POST BUILD configuration to generate the required CRC and place in BINARY . But for STM32CUBEIDE we do not have such implementation . as shown in following image . Is there any documentation for implementing the same .Thanks and Warm Regards,

Hello,I'm currently using an STM32F777 MCU with the Keil MDK. I want to run an HTTPS serer on this system, and I set up mbedTLS with Keil's network component (using the TLS_ECDHE_ECDSA_AESGCM128 cipher suite). By default, it takes around 6 seconds for a resource to load, so I tried adding in hardware acceleration using the CRYP coprocessor in the STM32F7. However, I ran into some issues with it. AES GCM did not work, and when debugging my code it looked as though the AES key registers (CRYP_Kx{L/R}R) were not being set. Any time I would try to set them, the registers would report back that they were 0x00. Should I be able to see these registers set to the key that I am using, or are these blind registers? If they are blind registers, is there another way to verify that the AES key is being properly set in the CRYP processor?Any help would be appreciated.Thanks,Brandon

I am trying to run a debug session with the built application which is built upon the secure bootloader. Note: All security mechanisms are disabled for debugging purposes.The issue seems to be the combined elf file. Loading this using a debugger, the target boots up into the bootloader. The bootloader does not find a valid application in the master slot and erases the flash, since it is not empty and asks for an sfb-file via YMODEM.Flashing the target with the resulting binary file, using cube programmer, works as expected.But i want to be able to debug my application. Have anyone else had this issue ?regards,Martin

I worked on POC for X-CUBE-SBSFU in windows environment. It is all working fine without any issues.Now the challenge is, we need to migrate SBSFU source to be compiled in Ubuntu Linux environment. I am struggling to do this, and getting lot of errors.Can you please guide us to migrate SBSFU in ubuntu environment ??@Fred​ Can you help on this ??Logs"../prebuild.sh" "../"prepareimage with python scriptpython /home/nppdev/repos/SecureBoot/Middlewares/STM32_Secure_Engine/Utilities/KeysAndImages/prepareimage.py conf ..//../Inc/se_crypto_config.hselectedcreate symbolic link postbuild.sh to .sharm-none-eabi-gcc -o "SECoreBin.elf" @"objects.list" -l:libSTM32CryptographicV3.1.1_STM32H7_GCC.a -mcpu=cortex-m7 -T"../STM32H753ZITx.ld" --specs=nosys.specs -Wl,-Map="SECoreBin.map" -Wl,--gc-sections -static -L../../../../../../../Middlewares/ST/STM32_Cryptographic/Fw_Crypto/STM32H7/Lib -Xlinker -L ../../../Linker_Common/STM32CubeIDE --specs=nano.specs -mfpu=fpv5-d16 -mfloat-abi=hard -mthumb

As per my understanding Secure Mode of STM32H7 as follows:RESET => Enter System Boot loader => Program OB register content => If (SECURITY) => RSS Boot => Configure Secure User Memory => Jump to Secure User memory on User Flash.I have two open questions hereis the above understanding correct ?? OB registers programmed by System Bootrom or some different mechanism ??Once Jump to application, Secure User Memory is disabled, as per concept. And if application trying to access Secure User memory from application context, the Flash access exception will come. Who is checking this access ?? who will control this access ? how it is implemented ??

https://stackoverflow.com/questions/24150030/storing-crc-into-an-axf-elf-file—CHECKSUM=0-FF@100,offset=0xFFFF,algorithm=5,width=-2,polynomial=0x1021arm-none-eabi-size "${BuildArtifactFileName}"arm-none-eabi-objcopy -O binary "${BuildArtifactFileName}" "${BuildArtifactFileBaseName}.bin"checksum -p ${TargetChip} -d "${BuildArtifactFileBaseName}.bin"../util/srec_cat "${BuildArtifactFileBaseName}.bin" -binary -crop 0 0x3FFFC -fill 0xFF 0x00000 0x3FFFC -crc32-b-e 0x3FFFC -o "${BuildArtifactFileBaseName}.crc.bin" -binaryecho ""echo "CRC32:"../util/srec_cat "${BuildArtifactFileBaseName}.crc.bin" -binary -crop 0x3FFFC 0x40000 -o - -hex-dumpsimilar to above mentioned I required to embed CRC32 into the .bin file or .hex file generated during compilation process . does the GCC compiler or the IDE system workbench based on eclipse has any inbuilt compiler libraries that generate CRC during compilation and embed it in the .hex or .bin file .

Self Generation script is like this :def generate():       return ECDSA256P1(SigningKey.generate(curve=NIST256p))KEY EXTRACTIONkey = SigningKey.from_pem(pem)       if key.curve.name == 'NIST256p':           return ECDSA256P1(key)       else:           raise Exception("Unsupported")is this mean, only NIST256p generated keys ..??Second question is about Firmware encryption support on STM32H753:As mentioned in example, default crypto scheme SECBOOT_ECCDSA_WITH_AES128_CBC_SHA256, is supported on STM32H753 ..??But as i see SECBOOT_ECCDSA_WITH_AES128_CTR_SHA256 scheme is applicable on STM32H7 series with OTFDEC support feature only right ??So can you please tell us on STM32H753VIT6 MCU, what kind of CRYPTO schemes are supported ??

Hi,I want to port "SPI_FullDuplex_ComDMA_Slave" to "TFM_SBSFU_Boot".My MCU is STM32U585.I can port "SPI_FullDuplex_ComDMA_Slave" to "TFM_Appli NonSecure" success, but fail to port it to "TFM_SBSFU_Boot".Do you have any suggestion for it?Please advise.Thanks,QiZhang