STM32 MCUs Security

We were running tests originally with the g474re eval board to test/integrate SBSFU functionality. We needed to disable dual-bank mode with the STM32CubeProgrammer before being able to transfer via Ymodem. We are now trying on the g491 and are failing this check: if (SFU_LL_SECU_CheckFlashConfiguration(psFlashOptionBytes) == SFU_SUCCESS)The STM32CubeProgrammer doesn't have the dual bank option for the g491. I'm probably missing something obvious but how can we change dual-bank mode outside of the option bytes page in the programmer? Or is it that it should be enabled and the problem lies in another configuration?I do have the BFB2 unchecked.

Hi ST,I am working with the NUCLEO-WB55 and we are adding some char in service but we don't know where we can find information for these fields * @param Security_Permissions Security permission flags. *    Flags: *    - 0x00: None *    - 0x01: AUTHEN_READ (Need authentication to read) *    - 0x02: AUTHOR_READ (Need authorization to read) *    - 0x04: ENCRY_READ (Need encryption to read) *    - 0x08: AUTHEN_WRITE (need authentication to write) *    - 0x10: AUTHOR_WRITE (need authorization to write) *    - 0x20: ENCRY_WRITE (need encryption to write)We do not understand if we need to use it or not, could you share with us some information to understand the different options and what is the purpose of them.Thanks.Marcos

Hello,I am developing a SBSFU for a custom application on a NUCLEO-H753ZI board. The application works well on its own. However, when I switch its linker script for the one of the example UserApp delivered with the SBSFU archive, I encounter some unexpected behavior.Namely, the code still works, and I am actually able to correctly encrypt it and download it on the board. However, it does not work for large inputs. Specifically, my code was initially able to deal with inputs as large as at least 21k bytes. But with the new memory configuration, it only works for inputs up to 13k bytes. Any input larger than that causes what seems to be a segmentation fault on the board.I believe the problem is that my application does not have enough memory anymore since the SBSFU split the memory in several parts. I should also mention that my application carries heavy cryptographic operations, therefore my assumption seems to make sense. I tried to increase the sizes of various areas in the linker fil

I am working with STM32H750VBT6 rev. V. I divided the internal flash into protected and unprotected areas. I set option bytes for the protected area. It worked fine. After that I needed to deactivate PCROP protection. I could not do it. I use STM32CubeProgrammer ver: 2.7.0 and STM32 ST-Link Utility v4.5. I expect that if I set DMEP and reduce level from level 1 to level 0 PCROP protection deactivates, but it does not work. I tried different variants with RDP levels and PCROP settings but all of them do not work. How can I deactivate PCROP protection? 

I download X-CUBE-AWS 1.4.0 to compile and install on my STM32F769IDISCOVERY board, everything running ok, but when I configure it to update new app version from OTA, after reboot is shows:= [SBOOT] SECURE ENGINE INITIALIZATION SUCCESSFUL= [SBOOT] STATE: CHECK STATUS ON RESET     INFO: A Reboot has been triggered by a Software reset!     Consecutive Boot on error counter reset      Consecutive Boot on error counter = 0      Consecutive Boot on error counter updated      INFO: Last execution status before Reboot was:Executing Fw Image.     INFO: Last execution detected error was:No error. Success.= [SBOOT] STATE: CHECK NEW FIRMWARE TO DOWNLOAD= [SBOOT] STATE: CHECK USER FW STATUS     New Fw Encrypted, to be decrypted= [SBOOT] STATE: INSTALL NEW USER FIRMWARE      262080

Hello,The reference manual for the STM32F207 states that the F20x and F21x family has a cryptographic processor: Ref Manual - Page 508. The datasheet for the F207 doesn't state any support for that though. Is this a mistake in the reference manual?Thanks

Hi, actually I 'm planning to write some C code for cryptographic functions for e-signature, encrypt data or decrypt data in IOT devices.There are lots of products here. So I don't know which one is efficient for encrypt or decrypt operations or signing a data operations. But I know, I should save private keys securely in device.What about STM32F410?For now I don't know how much kbytes I need for code and data. Any information is welcome, Thanks

Hello.I'm trying to program the main flash memory of STM32F103RCT6 using J-Link while RDP is enabled.I followed main flash memory programming procedure in PM0075 manual.the procedure is in below picture.When only RDP is enabled, I unlocked Flash_CR_LOCK bit and then Write FLASH_CR_PG to 1.After this procedure, I tried to write half-word data to 0x080069f0.However, J-Link reports the error like this.****** Error: Timeout while calculating CRC, RAMCode did not respond in time. (PC = 0x00000000, CPSR = 0x00000000, LR = 0x01000000)!Failed to erase sectors 14 @ address 0x08006800 ((erase error))Failed to erase sectors.Is it impossible to program main flash memory when RDP is enabled?If not, how can I do it?Here is my J-Link Commander log.Device "STM32F103RC (ALLOW OPT. BYTES)" selected.Connecting to target via JTAGInitTarget() startActive read protection detected.Skipping unsecure.InitTarget() endTotalIRLen = 9, IRPrint = 0x0011JTAG chain detection found 2 devices: #0 Id: 0x3BA00477, I

I've been able to compile previous versions of SBSFU (P-NUCLEO-WB55.Nucleo/Applications/1_Image) without issues, but with this one I've run into two issues:First, SE code did not fit in SE_ROM_region. I was able to fix this by adjusting the linker map and MPU region definitions.Second, I get this error when compiling the UserApp project:c:\st\stm32cubeide_1.1.0\stm32cubeide\plugins\com.st.stm32cube.ide.mcu.externaltools.gnu-tools-for-stm32.9-2020-q2-update.win32_1.5.0.202011040924\tools\arm-none-eabi\bin\ld.exe: ../../../../1_Image_SBSFU/SW4STM32/STM32WB55RG_Nucleo_1_Image_SBSFU/Debug\se_interface_app.o: in function `SE_APP_GetActiveFwInfo': (.SE_IF_Code+0x0): multiple definition of `SE_APP_GetActiveFwInfo'; ../../../../1_Image_SBSFU/SW4STM32/STM32WB55RG_Nucleo_1_Image_SBSFU/Debug\se_interface_app.o:(.SE_IF_Code+0x0): first defined hereIf I search the SBSFU projects for "SE_APP_GetActiveFwInfo", I find the definition in se_interface_application.c (in the SBSFU project), the declaration

(.SE_IF_Code+0x0): multiple definition of `SE_APP_GetActiveFwInfo'STM32L476 Demo

I programmed stm32F103RCT6 firmware using STM32CubeIDE.When Read Out Protection (RDP) is disabled, the firmware works well.But RDP is enabled, the firmware doesn't work.My firmware is transmitting data by UART.when RDP is disabled, Firmware sends data like the pic belowHowever, RDP is enabled. I cannot see anything.How can the firmware work when RDP is enabled?I'm using QFP 64pin socket & connected Jtag by ST-Link v2.

I'm starting two new projects which initially would make use of STM32F1 and STM32F4 MCUs but after reading some articles detailing how easy would be to disable RDP1 and even downgrade RDP2 to RDP1 I become very concerned. Please, anyone with more experience could explain to me if these methods affects every STM32 MCUs? If so, how could I protect my firmware? Apparently there is no way to permanently disable debug/jtag... What if I use a custom bootloader? I'm lost here.

Hi there,I currently use STM32L073 for evaluation and found some issue with CRC module.L073 has a CRC peripheral whose polynomial is programmable. And when I programm the peripheral as below, the checksum returns from the module doesn't match the one from a 3-party calculator -- it has an extra XOR with 0xFF.The peripheral configuration is as below. In this case, both the 3-party calculator and my software code get a result of 0x5A but the CRC peripheral in the L073 gives a result of 0xA5 (which is 0x5A XOR 0xFF). Same happens for other data input.CRC->CR = 0x01; // reset CRC module CRC->CR = 0x10; // 8-bit polynomial CRC->POL = 0xFE; // set polynomial CRC->INIT = 0xFF; // set initial value *(__IO unsigned char *)(CRC_BASE) = 0x5A; // 8-bit write to CRC->DR register result = CRC->DR; // readout CRC checksumCould anyone please help me with this?Thanks a lot.Regards,Harry

Hello everyone,I am currently evaluating SSL with a local server and an STM32 device. I'm unable to figure out why the decryption fails with CCM as the cipher suite.FYI: I am using MbedTLS v2.14.1.Setup:    I'm using x86 local server with STM32 device as a client.Here is what happens-1. Software CCM implementation on the client:    When I use the software implementation of the CCM. Handshake and decryption is  successful. Therefore, I can stream the data from STM32 and read it on the local server.2. Hardware CCM implementation with MBEDTLS_CCM_ALT:   I have used ccm_alt.c provided from STM32Cube v1.9.0. Here, the handshake is successful. But decrypting the message fails.The errors are:ssl_decrypt_buf() returned -29056 (-0x7180)mbedtls_ssl_read_record() returned -29056 (-0x7180)Checks performed:Same certificates are used for SW and HW impl

We have ported SBSFU project for Nucleo L4R5ZI-P dev-board.All debug prints (TRACE) are working when configured USART2 but when configured LPUART1 which is used as virtual com port by ST-LINK usb connector then not getting any prints.

Hello,I installed a SBSFU for a custom application on a Nucleo-H753ZI board. Everything works fine, however with the current settings of the SBSFU, my application is lacking RAM to handle the large inputs I want it to handle.I used the memory mapping of the UserApp example application. After further investigation, I observed that the application RAM was located in the DTCMRAM area (0x20000000 / 128KB). Unfortunately, this area seems to be too small to host my application which RAM used to be in the RAM_D1 area of the board (0x24000000 / 512KB).Therefore, I would like to know how I could move the application RAM area from the DTCMRAM area to the RAM_D1 area.I tried the following:Modify the RAM section of the mapping_sbsfu.ld file as follows:/* RAM section */ /* SE RAM1 region protected by firewall */ /* SE stack is placed 1st in RAM, stack overflow does not write on other RAM area */ __ICFEDIT_SE_region_RAM_start__ = 0x24000000; __ICFEDIT_SE_region_RAM_stack_top__ = 0x24000400; __ICFEDI

For downloading the binary after updating the SBSFU, how does one go about it since the security protections have been updated (8.6 in UM2262). I can't get the Secure Boot to load in Tera Term again even though I press both reset and user. When I try to download the file in STM32CubeIDE it gives me an error. I was able to do it the first time, but it says once you run it you have to erase in a specific way which I did, but now I am not able to download a new file.

Hi :grinning_face:I am working on my project of ensuring the hardware security of the Drone's Flight Controller.I am planning to use ARM PSA to ensure security of Drone System at hardware level.I am developing drone security system by using NUCLEO-L552ZE-Q.For this, I am referring to the SBSFU of STM32CubeL5, and there are two issues currently.If I want to apply Secure Boot for a new binary file (Ex: nuttx.bin), which part of the source code should be changed?How to turn off Secure Boot and return to the original state? Using regression.sh doesn't bring it back. :crying_face:Thank you sincerely :folded_hands:PS) My project Link: https://github.com/korkeep/PX4-Trust

Hi,in https://www.st.com/resource/en/programming_manual/cd00283419-stm32f10xxx-flash-memory-microcontrollers-stmicroelectronics.pdf section 2.4.1 it says that, for connectivity line devices (like the STM32F105RC I'm using), pages 0-1 are automatically write-protected when the read protection is enabled. Since I enable the read protection during initialization, I have tried to use page 3 to store some configuration parameters, but I've found out that this page is also write protected when I enable the read protection, although the documentation says that the automatic write protection is set for pages 0 and 1. As a result, I get an error when I try to erase that page. Is this an errata in the documentation?Are the first four pages write protected in connectivity line devices like they are in low and medium-density devices?Thanks

I have a bootloader that attempts to verify the integrity of an application image before it transfers execution to the application. It does this by performing a CRC (using software) on the image. However, if the internal flash is corrupted somewhere inside the application that results in a double ECC error, then a bus fault exception will be thrown.I've tried several methods of handling the bus fault, but so far none have worked. Does anyone have a suggestion on how to handle ECC errors in internal flash?Things I've Tried that Did not WorkSkip the Offending InstructionIn the bus fault handler, increment the application program counter and return. This unfortunately didn't work because the ECC algorithm compiled itself into a fused instruction that loaded the offending location and incremented the offset at the same time (LDRB.W r2, [r3], #1). As it's a fused instruction, skipping it means that the loop counter doesn't increment and we just end up in an infinite loop. Although I could r

Hi,My setting is "TZEN=1", "RDP=1", "nSWBOOT0=0","nBOOT0=1".I can't use it anymore, please tell me how to regression the TZEN to 0 and RDP to 0.Thanks,QiZhang

Hello,the cryptolib offers the function ECDSAsign. In the ecc.h it is declared as int32_t ECDSAsign(const uint8_t *P_pDigest, int32_t P_digestSize, const ECDSAsignature_stt *P_pSignature, const ECDSAsignCtx_stt *P_pSignCtx, membuf_stt *P_pMemBuf);Testing shows that P_pSignature gets changed when ECDSAsign is invoked. That is compliant with the documentation (UM1924, Rev 7, page 138, table 138). I thought const parameters may not be changed by a function. Why is the parameter set as const?Best regards

Hi all,I've downloaded the package 'STM32CubeExpansion_SBSFU_V2.4.0' and I've opened, using STM32CubeIDE (Version: 1.6.1), the project STM32WB55RG_Nucleo_2_Images_SECoreBin. I'm not able to compile the project because I've the following error:arm-none-eabi-gcc -mcpu=cortex-m4 -c -x assembler-with-cpp -MMD -MP -MF"Application/SW4STM32/se_key.d" -MT"Application/SW4STM32/se_key.o" --specs=nano.specs -mfpu=fpv4-sp-d16 -mfloat-abi=softfp -mthumb -o "Application/SW4STM32/se_key.o" "C:/progetti/INFOBOX_3.0/Micro/download/en.x-cube-sbsfu/STM32CubeExpansion_SBSFU_V2.4.0/Projects/P-NUCLEO-WB55.Nucleo/Applications/2_Images/2_Images_SECoreBin/SW4STM32/se_key.s"arm-none-eabi-gcc -mcpu=cortex-m4 -c -x assembler-with-cpp -MMD -MP -MF"Application/SW4STM32/startup_stm32wb55xx_cm4.d" -MT"Application/SW4STM32/startup_stm32wb55xx_cm4.o" --specs=nano.specs -mfpu=fpv4-sp-d16 -mfloat-abi=softfp -mthumb -o "Application/SW4STM32/startup_stm32wb55xx_cm4.o" "C:/progetti/INFOBOX_3.0/Micro/download/en.x-cube-sbsfu

Hello, I am interested in learning how to sign an app that we created. could it be automated or what files would have to be changed? A second thing is if i want to switch to a different authentication algorithm (replace RSA for example), how would I go about that?Thanks

HelloI am doing a project where I investigate the increased energy consumption when implementing TLS on an MQTT protocol.At the moment, I am doing tests where I measure the current via the IDD pins. But I was surprised at how little impact the implementation of TLS had. I am running with a specific Cipher suite DHE-RSA-AES128-GCM-SHA256. I did expect a longer working time where the MCU consumes more energy. But from what I can see in the pictures, it's just a small spike that always and only appears when I run with TLS.So I wonder if it is so that Eg. RNG (random number generator) and other safety features power consumption does not go through the IDD pins.I am using the STM32L476RG, connected via UART to an ESP8266 (Wifi-MCU). The pictures show the current in Cyan, and the blue line is the TX signal that I used to trigger on the oscilloscope.  I would be incredibly grateful if anyone have the knowledge of this and can help me with the case.Thanks in advance./ Victor