STM32 MCUs Security

Hi, Trying to turn on RDP just before I get a product out to market. Can unlock and erase Option RDP bits to 0xFFFF but cannot seem to write the option bit to set RDP byte to 0x00FF. This leaves the devices bricked on the next reboot. Can't erase debug or program with SWD.I have looked at app notes on website and followed the instructions on the RDP programming but not sure where to go from here, I can't afford to brick any more as we are all aware that I cannot source anymore processors until Q1 2022. See code below. The last lines doesn't work? if((FLASH->OBR & FLASH_OBR_RDPRT_Msk) == 0) //Flash RDP not set { FLASH->KEYR = FLASH_OPTKEY1; FLASH->KEYR = FLASH_OPTKEY2; FLASH->OPTKEYR = FLASH_OPTKEY1; FLASH->OPTKEYR = FLASH_OPTKEY2; if(FLASH->CR & FLASH_CR_OPTWRE_Msk) //Check to see if option write protect off { FLASH->CR |= FLASH_CR_OPTER; FLASH->CR |= FLASH_CR_STRT; while(FLASH->SR & FLASH_SR_BSY) {;} FLASH->CR &= ~FLASH_CR_OPTER; FLASH-&g

Hello everybody,we're currently discussing product tampering and intellectual property (IP-) protection for a new product.I read a lot about SBSFU, the STSAFE processors and KMS memory in some STM32 µCs, but some things I may have not 100% understood correctly, some things I could not find informations about at all.Our basic question is at the moment: Is it possible to flash a encrypted firmware file to new STM32 processor?Perhaps using a pre-provisioned STSAFE-A100?Background of this question: We're selling electronic modules worldwide, which are assembled the specific regions by the manufacturers in place, where, using a unique EEPROM and a USB-Dongle/PC-Software solution, a specific amount of boards can be activated.Problem is, the potential unworthy EMS hasThe plain hex-file and could disassemble it or manipulate itWe've seen clones of the EEPROM IC with unique serial no, hence, this concept is proven to be vulnerableWe're searching for a solution to flash encrypted firmware files

Hi,I am migrating some code from an STM32F745 to an STM32H743.I came into some trouble while using the crypto library and the hardware CRC at the same time.The STM32H743 crypto library resets the CRC DR register every time AES_CBC_Decrypt_Append is called.This was not the case when using the STM32F745.The workaround is to save restore the CRC.DR register as shown below:// Save CRC_DR register uint32_t CRC_DR = hcrc.Instance->DR;   // Call crypto function   // Restore CRC_DR register __HAL_CRC_INITIALCRCVALUE_CONFIG(&hcrc, CRC_DR); __HAL_CRC_DR_RESET(&hcrc);Crypto library used:AES256CBC.hSTM32F745: STM32CryptographicV3.1.2_CM7_GCC_FPU.aSTM32H743: libSTM32CryptographicV3.1.1_STM32H7_GCC.aI hope it can help others.

Hi all, Is there any method available for program RDP 0xBB to RDP 0xAA using CLI only through the uart or spi using USB ( without SWD or JTAG)Thanks

I went through the MOOC part 6 and I thought of creating a new project for Nucleo -L476RG (from the scratch), I Created a new code using CubeMX (Use same pins ands USART) and followed the same steps as video 2,4 as describes. but once I use FLASH_SBSFU.xxxxxxx .bat it will end less than 1s and .sfb file is not generating. All the paths also created in the .bat file. Please can anyone help me

Currently working on a Bitcoin hardware wallet on the STM32F7 Discovery platform. I wanted to use the cryptographic library to secure information stored in the EEPROM as well as perform hashing functions. VFP is not supported in libSTM32CryptographicV3.0.0_CM7_GCC_ot.a Is there anybody that works at STM that would compile an object file with GCC and DM me with a copy. Where:Floating-point unit = 'FPv5-SP-D16'Floating-point ABI = 'Hardware implementation (-mfloat-abi=hard)' Mcu = 'STM32F746NGHx'Board = 'STM32F746G-DISCO' I have seen this done before here...https://community.st.com/s/question/0D50X00009Xke2s/xcubecrypto-library-cubemx-helpby STOne-32 Thanks Russeree

Hi all, I am porting the SBSFU to the custom STM board which is running in the Stm32L476JGYx. Normally user button is connected to the PC13 in the Nucleo board and in my custom PCB I made the user button for the Boot0 (PD7) I use this only for the bootable purpose, I am having a problem changing the BOOT0 pin, I changed the default pin PC13 to PD7 using the Stm32l4xx_nucleo.h in the BSP folder but I am not getting the bootable update window (to update using the Ymodem protocol) if I do the same as in the Nucleo board. Are there any other facts should I consider when changing the User Button. ThanksRoshan

I'm trying to use the STM32F439ZI HASH accelerator with the following code:#define INPUT_SIZE 16 static uint8_t hash_test_buffer[224] = {0};   static uint8_t hash_test_output[224];   HASH_Start_DMA(&hhash, hash_test_buffer, INPUT_SIZE, HASH_ALGOSELECTION_SHA256);   HASH_Finish(&hhash, hash_test_output, 1000);This works fine when INPUT_SIZE is 16 but if I try to increase it then the HASH is not computed and the output is 0.There is any reason why the size should be at most 16?Is this the right way to use the HASH functionality with DMA?

Hello to all!Using X-Cube-Cryptolib for RSA algorythm on Nucleo-L476RG board, encryption and subsequent decryption of demo message going very slow - 2 seconds, its mostly decription, i using hardware timer2 for time measuring.Is there any ways to reduce decription time? Best regards!

I have one STM32L4 that act as master MCU.This master MCU is set with RDP L0. I have another slave STM32L0 with RDP L1. I tried to read this STM32L0 using this master MCU but did not get any result. It seems like this slave MCU did not run the code correctly. This slave MCU did connect with any debugger. What is possible cause for this situation?

Hello,I am working on a project using STM32Cube_FW_WL_V1.0.0.I cannot compile the 1_Image_SECoreBin project included in the BFU_1_Image sample project.I am using STM32CubeIde on macOS Catalina.I have also read these manuals."Getting started with the SBSFU of STM32CubeWL""Integration guide of SBSFU on STM32CubeWL (including KMS)"Can you guys guide me?

Hi there,I am trying to compile the SBSFU_2_Images_DualCore project.Although I did it in the correct order according to the document "Getting started with the SBSFU of STM32CubeWL (UM2767)". I am getting a compiler error. I'm sure that, compiling the correct order according to Getting started with the SBSFU of STM32CubeWL (UM2767)Compile order is;2_Images_SECoreBin - compile success2_Images_KMS_Blob - compile success2_Images_SBSFU2_Images_SBSFU_CM0PLUS - compile success2_Images_SBSFU_CM4) - compile success2_Images_UserApp_CM4 - compile success2_Images_UserApp_CM0PLUS - compiler errorThe error is multiple definition error .c:\st\stm32cubeide_1.6.0\stm32cubeide\plugins\com.st.stm32cube.ide.mcu.externaltools.gnu-tools-for-stm32.9-2020-q2-update.win32_1.5.0.202011040924\tools\arm-none-eabi\bin\ld.exe: ../../../2_Images_SBSFU/STM32CubeIDE/CM0PLUS/Debug\se_interface_app.o: in function `SE_KMS_CloseSession':(.SE_IF_Code+0xbd8): multiple definition of `SE_KMS_CloseSession'; ../../../2_Ima

..

I am trying to implement a firmware integrity check using the Cryptographic Library (X-CUBE-CRYPTOLIB) for this I have to calculate the SHA256 checksum and then determine the padding and include it in the binary that I will upload to the board.I've been watching STM's mooc Security part 4https://www.youtube.com/watch?v=RahlfYJ1gDs&list=PLnMKNibPkDnF0wt-ZI74SflnsBV4yKzkO&index=7And in the lab they do the verification for a stm32g0. The problem is that I do not know how to determine the size of the firmware, in the laboratory they use the page size but on my board the flash memory has blocks of different sizes: I also have an external memory to which I also want to make the SHA256 calculation. This memory consists of 256 blocks of 64k (These are all the same size).Another difficulty I have is that the hex file covers two sectors (internal and external flash) so I don't know whether to put the internal and external hashes separately (just after the FW zone hit).

Hello all.I'm trying understand SBSFU source code. At this time, I meet very confuse code.Middlewares/ST/STM32_Secure_Engine/Core/se_interface_bootloader.cIn the SE_Startup() function, there is function pointer casting code as below:SE_StartupPtr = (SE_ErrorStatus(*)(void))((uint32_t) SE_STARTUP_REGION_ROM_START + 1U);SE_STARTUP_REGION_ROM_START point to SE_CORE_Startup() function.What I want know is why pointer address is "SE_STARTUP_REGION_ROM_START + 1U" rather than "SE_STARTUP_REGION_ROM_START".Even worse, "SE_STARTUP_REGION_ROM_START + 1U" is not pointer align.What do I miss understood about this code?Thanks.

STM32 has the capability to perform checksum self checking.If no, there is some way to verify that the program have been loaded properly.

Hi all,I generated the SBSFU file. now i am getting another issue, I was thinking to program the .bin file using CubePrg (DFU method)so I loaded the .bin file which created using sbsfu, then I set the start address as 0x080000000 or 0x0 and trying to execute, but it says that "Operation exceeds memory limits". Anyone please could you help me with this?File size and other information is given below,Normally .bin file = 70KBAfter creating SBSFU .bin file = 607KB.sfb file is = 71KBL476RG custom PCBThanks

I have just updated a board design, replacing the STM32L433CC with an STM32L4P5RE. I have no problems using the RNG on the L433. However, with the L4P5, I get only one result from the RNG before it give a seed error.RNG: CR = 00800004, DR = 9a4c8249, SR = 00000001...RNG: CR = 00800004, DR = 00000000, SR = 00000044One thing I find odd is that I would expect the RNG to be able to provide 4 32-bit random values from DR if it worked once given that the RNG produces 128 bits of entropy at a time.The clocking of the RNG is slightly different in the two boards. Both are clocked from PLLSAI1Q at 48MHz. The PLL is fed by the MSI on the 433 and from a HSE (TXCO) on the new board. The AHB is clocked at 80MHz on the L433 and 120MHz on the L4P5. PeriphClkInit.UsbClockSelection = RCC_USBCLKSOURCE_PLLSAI1; PeriphClkInit.RngClockSelection = RCC_RNGCLKSOURCE_PLLSAI1; PeriphClkInit.PLLSAI1.PLLSAI1Source = RCC_PLLSOURCE_HSE;I tried changing the RNG clock source to the HSI48 and experienced the same pro

Hi,I'm working on the project which used RTT print as the debug interface and now integrated with SBSFU to enable the firmware upgrade capability, but after that I noticed somehow the internal flash been erased after I launched the RTTViewer and connected to my J-Link, so would like to know if there is the protection there to erase the flash when enable the SWD access?

Hi,I'm testing SBSFU on Nucleo-G474RE, I have no problem to run up the reference code of SBSFU, but somehow secure boot loader didn't jump to my user application after the upgrade via UART Y-Modem after use my application code instead of original user application code in SBSFU.My steps are,Build SecureEngine.Build Secure SBSFU and download to my Nucleo board.SBSFU shows up on Tera Term.Use Y-Modem protocol to download encrypted and signed firmware image via UART.SBSFU starts to run firmware upgrade procedure.I created two user application images, SBSFU reference encrypted and signed firmware image.Custom application used the same way of SBSFU reference user application to encrypt and sign firmware image.Results are,Everything works well and can jump to the application when download reference imageNo response after download, upgrade and jump to my custom user application. Expectation is to see the welcome print on TeraTerm after jump to my application.Is there any suggestion to debug th

I actually have not tried it out yet, but looking at the code, I think the SBSFU in the X-Cube-GCP package is not the same as there are some things that are very different (like the slot names for example)Need some advice from the ST reps hereWould it be easier to edit my current firmware to add in the web update capability or to Edit the sample X-CubeGCP project to "convert" it into my own project? Note the problem I usually have with sample projects is with changing the device family - so many ways to mess up here.

======================================================================                                                                 =             (C) COPYRIGHT 2017 STMicroelectronics                =                                                      &nb

Hi could I find out if anyone has successfully got X-CUBE-SBSFU running on the dual core components? There does not seem to be any examples from ST for these use cases.The dual core components I am aware of are H745/755, and H747/757. However all of them have no examples in the package provided from ST.Has anyone be able to successfully port any examples or get them running on these STM32 chips?Thanks!

Hi,the HW PEC generation of the I2C Interface has two limitations that i have not been able to work around until now. The PEC calculation is reset after a stop, but can not be initialized after start. If you want to program a SMBus Slave that is capable of reacting on a Read with Start/Stop instead of repeated Start between RX/TX (for compatibility reasons) the PEC calculation fails, because it is reset and is only calculated for the second part of the Transaction. The I2C_PECR register is only updated after a HW check or insertion of the PEC. If you don't know the length of a message you can not initialize the HW check for the last Byte, because you only know with the stop that it was the last byte. A software check of the PEC in a Stop ISR fails also, because the I2C_PECR register isn't updated. It still contains the value from the last transaction where HW check or insertion has been used. Is the internal PEC register accessible to initialize it with the previous PEC instead of zero

Hello, in one my project I need to have SBSFU. On first version on my board I had STM32F405 uC and was successfully ported example STM32F413H_Discovery_2_Images_SBSFU. For test the porting I changed startup file in the discovery example for 405 series and make a bit chagings in functions which writing data to FLASH, also made changes for UART pins and the button. Same things I try to do fo STM32429VIT uC (2 Banks Flash) - but it not working, I have next errors in the UART terminal:= [SBOOT] STATE: HANDLE CRITICAL FAILURE= [EXCPT] SIGNATURE CHECK FAILED! Cheking under debug I found the error became from firmware tag verification part in file sfu_fwimg_core.c (see more in the attachment):/* Firmware tag verification */    if (MemoryCompare(fw_tag_output, fw_tag, SE_TAG_LEN) != SFU_SUCCESS)    {     *pSeStatus = SE_SIGNATURE_ERR;     se_ret_status = SE_ERROR;     sfu_ret_sta