STM32 MCUs Security

The code from the 1.16 example builds fine in the EWARM. It writes the source blocks to the terminal, but as I see in the debugger, it fails to encrypt the input block. That times out as it fails to return a HAL_OK status. /* Start decrypting aCyphertext, the decrypted data is available in aDecryptedtext */  if (HAL_CRYPEx_AES(&CrypHandle, aCyphertext, AES_TEXT_SIZE, aDecryptedtext, TIMEOUT_VALUE) == HAL_OK)  {   /* Display decrypted Data */   Display_DecryptedData(CBC, 128, AES_TEXT_SIZE);  }  else    {   /* Processing Error */   Error_Handler();  }I have read all the how-to info in the examples. Has anyone else run into this issue and found a solution?

I have the nucleo l152RE board and am trying to use this for following the mooc on sbsfu. It is possible for me to build (in cube IDE) both SECoreBin and SBSFU images. however, when building the UserApp it fails on the postbuild script. During build, I can see the UserApp.elf being created and showing up in my file explorer, but when the post-build script fails, the .elf file is also removed from my system.According to the build output, the file "OEM_KEY_COMPANY1_key_AES_CBC.bin" can not be found, but I can see it in my directory structure. I have the following build output:11:19:33 **** Incremental Build of configuration Debug for project NUCLEO-L152RE_2_Images_UserApp **** make all arm-none-eabi-gcc -z max-page-size=1 -o "UserApp.elf" @"objects.list" -l:se_interface_app.o -mcpu=cortex-m3 -T"../STM32L152RETx.ld" --specs=nosys.specs -Wl,-Map="NUCLEO-L152RE_2_Images_UserApp.map" -Wl,--gc-sections -static -L../../../../2_Images_SBSFU/SW4STM32/NUCLEO-L152RE_2_Images_SBSFU/Debug -Xlinker

..

I am using x-cube-sbsfu version 2.4.0 on a custom designed board using the STM32F722. I have ported the single slot code (1_Image) for the STM32F769I-Discovery board to the custom board. I have come across what looks like an error in the sfu_low_level_security.h file. The MPU configuration for the UserApp execution has the access set to bufferable but not cacheable. I believe this will disable the cache, and it also causes memory faults for unaligned memory accesses. Can anybody confirm that this is a mistake in the code?Here is a snippet for reference (I have changed the region size from 2 MB to 512 kB from the original code):/** * MPU configuration for UserApp execution * ======================================= * Reconfiguration of existing regions (useless during UserApp execution) * MPU constraint = Region base address should be aligned on Region size */   /** * @brief Region 3 - Enable the execution for active slots in unprivileged mode. * Read only capability configur

I know this was cracked before, but required high skills and expensive equipment, but nowthis method makes it really easy, basically anyone can do it.Any official statement concerning this from ST?Like the list of devices which are affected, possible mitigation solutions.This seems to be a pretty big oops, basically makes stm32 unusable for other than hobby projectsSee page for details:https://blog.zapb.de/stm32f1-exceptional-failure/

The ECDSA implementation in cryptolib does not provide means of implementing ECDSA without a random number. RFC6979 is a secure way of doing ECDSA without a random number, it is used in the blockchain implementations (bitcoin, ethereum)

Hello community,I have a few of questions regarding SFI:1) Does STM32H753AI support SFI (Secure Firmware Install)?2) Can I use SWD for the SFI?3) Is there any recommended HSM smart card reader for the SFI?Thank you :)

Hi all,I have two different batches of Revision V STM32H750VBT6. All units in one of the batches (Date Code 045) has issue with the hash peripheral while the one (Date Code 928) is working completely fine.I created a new basic project for testing this issue and the code is as shown. However, HAL_HASHEx_SHA256_Start() always ended up returning HAL_TIMEOUT. Based on the SFR register view in Atollic TrueSTUDIO, all the registers for hash peripheral remains at value 0x0.*Note : The same project is working fine for Revision V STM32H750VBT6 (Date Code 928) and Revision Y STM32H750VBT6 (Date Code 002) *Things I have done/triedDirectly editing the registers values in SFR register view shows illegal input while bit editing has no effect. (*There isn't any issue editing other peripheral registers for example SysTick SYST_CSR*)Checked RCC_AHB2ENR HASHEN bit is enabled indicating the clock to hash peripheral is enabled.Used different firmware packages STM32CubeH7 v1.5.0, v1.7.0 and v1.8.0Used code

I am using STM32L4A6VG with 1 MB flash and my application is about 600+KB. I want to update the user app from an external flash and need some guide to modify SBSFU.​After reading these 2 examples (STM32CubeExpansion_SBSFU_V2.4.0\Projects\B-L475E-IOT01A\Applications\2_Images_ExtFlash and STM32CubeExpansion_SBSFU_V2.4.0\Projects\32L496GDISCOVERY\Applications\2_Images), I can update user image from my external flash with RDP and WRP on. Here is my configuration of memory mapping. I know this configuration violates FWALL and MPU settings (like active image header should be in FWALL NVDATA) so I comment the sanity check of FWALL and turn off FWALL protection./* Header does not start at the beginning of the sector to ensure the overlap constraint between firewall NVDATA section and firewall CODE section. This constraint is relevant only for products with dual bank and firewall isolation */ __ICFEDIT_SLOT_Active_1_start__ = 0x08012000; __ICFEDIT_SLOT_Active_1_end__ = 0x080F1FFF; __ICFEDIT

I am trying to use AES-GCM with the crypto hardware accelerator the normal Testvectors are working, but when I connect it to openssl the authentication Tag is wrong. Do you have any idea how to fix this? The normal Encryption in ECB is working. If I use the software Version of the authentication Tag the program is working. Is there any problem with the crypto hardware accelerator and TLS. Please help me.

Hi,I am facing some issues with debugging SBSFU project.When I flash the application in debug mode, I can not jump to breakpoints set in SBSFU projects.Is there any way to perfrom this.Best Regards,Ankush Nagaraju

HiI'm using the dual image function on a 512kB STM32G474. I like to adjust the bootloader size to 32kb because my user App is too big.In the AN5056 there is a note how to adjust it, but I'm not sure if this lines in the file low_level_security.h are correct? Can anybody help me please?#define SFU_PROTECT_MPU_EXEC_SE_RGNV MPU_REGION_NUMBER7 #define SFU_PROTECT_MPU_EXEC_SE_START FLASH_BASE /*!< Flash memory area */ #define SFU_PROTECT_MPU_EXEC_SE_SIZE MPU_REGION_SIZE_16KB //eud MPU_REGION_SIZE_32KB #if defined (__GNUC__) #define SFU_PROTECT_MPU_EXEC_SE_SREG 0xE0U /*!< 32 Kbytes / 8 * 5 ==> 20 Kbytes */ #elif defined(__CC_ARM) #define SFU_PROTECT_MPU_EXEC_SE_SREG 0x80U /*!< 32 Kbytes / 8 * 7 ==> 28 Kbytes */ #else #define SFU_PROTECT_MPU_EXEC_SE_SREG 0xC0U /*!< 32 Kbytes / 8 * 6 ==> 24 Kbytes */ #endif /* (__GNUC__) */ #define SFU_PROTECT_MPU_EXEC_SE_PERM MPU_REGION_PRIV_RO #define SFU_PROTECT_MPU_EXEC_SE_EXECV MPU_INSTRUCTION_ACCESS_ENABLE #define SFU_PROTECT_MPU_EXE

Project imported: D:\Vrund\STM32CubeExpansion_SBSFU_V2.4.0\Projects\STM32F413H-Discovery\Applications\1_ImageIssue faced:15:42:35 **** Build of configuration Debug for project STM32F413H_DISCOVERY_1_Image_SECoreBin ****make all Building file: D:/Vrund/STM32CubeExpansion_SBSFU_V2.4.0/Middlewares/ST/STM32_Secure_Engine/Core/se_bootinfo.cInvoking: MCU GCC CompilerD:\Vrund\STM32CubeExpansion_SBSFU_V2.4.0\Projects\STM32F413H-Discovery\Applications\1_Image\1_Image_SECoreBin\SW4STM32\STM32F413H_DISCOVERY_1_Image_SECoreBin\Debugarm-none-eabi-gcc -mcpu=cortex-m4 -mthumb -mfloat-abi=softfp -mfpu=fpv4-sp-d16 -DSTM32F413xx -DUSE_HAL_DRIVER -DUSE_STM32F413H_DISCOVERY -I"D:/Vrund/STM32CubeExpansion_SBSFU_V2.4.0/Projects/STM32F413H-Discovery/Applications/1_Image/1_Image_SECoreBin/Inc" -I"D:/Vrund/STM32CubeExpansion_SBSFU_V2.4.0/Drivers/CMSIS/Device/ST/STM32F4xx/Include" -I"D:/Vrund/STM32CubeExpansion_SBSFU_V2.4.0/Drivers/CMSIS/Include" -I"D:/Vrund/STM32CubeExpansion_SBSFU_V2.4.0/Drivers/STM32F4x

Hello. For my automotive project I need to imitate motorcycle handlebar that uses LINbus for buttons many buttons. Since I can't always take handle off motorcycle I need to make emulator of it.This is Typical frame, and I mapped all bits of this burst. Brak , sync, ID is by my understanding is generated by master ( ECU ) and data is generated by handlebar controller.Is where any example how to use LINbus? My understanding it should be something like CANBus, I get I whould get IRQ then ID is matched and simply send data just like regular UART message as well as calculate message CRC ? Any information would be welcome. Thank you !

Hi,Have a code that modifies the option bytes on G0 micro which seems bricks the IC from further programming attempts aka device locks itself.Did anyone face a similar issue with G070? What are the solutions to make the programming process robust and avoid bricking of G070?Pls help.

I have signature of my user app and user app in .bin format.if i have to use only these two inputs, what modification i need to do in SBSFU? and under what files?i dont want to use post built .bat and prebuilt.bat.i am using Single slot image example for stm32f407.Regards,Vrund

Hello,I am trying to do a proof-of-concept running the Apache NuttX RTOS on the ST32L562E-DK board as the non-secure application with TrustedFirmware-M.I can build, sign and flash NuttX as the non-secure application and TF-M boots into the RTOS initialization code. However, once the RTOS initialization code issues the first SVC instruction (to request an initial context switch to the 'init' task) the corresponding exception handler is not called (I do see systick exception handler calls, so generally the vector table seems to be set up correctly).What could be the reason that an SVC instruction does not trigger the corresponding exception handler (both the SVC and the handler being in non-secure code)?Any help is highly appreciated.Thanks!Michael

Hello,I want to use sbsfu for STM32L562 controller with STM32Cube IDE version 1.5.AS per primary research i am using below package and project .I am using STM32SecuWS package.Under that project I am using is STM32SecuWS\TFM\STM32Cube_FW_L5_V1.3.0\Projects\NUCLEO-L552ZE-Q\Applications\SBSFU.I have gone through the document.overview-of-secure-boot-and-secure-firmware-update-solution-on-arm-trustzone-stm32l5-series-microcontrollers-stmicroelectronics.pdfAnd I want to use STM32CubeL5 SBSFU on page 10.non secure image primary slot(single slot 1 image).1) For single slot do i required SBSFU_Loader project?2) I only want to upload non secure image(my user application) do i need to run SBSFU\SBSFU_Appli\Secure project? 3) Postbuild.bat process remains same as x cube sbsfu right?4) project example is with L552ZE , i have to use STM32L562 what configuration or settings i need to change in cubeIDE?5) Example project already using mbedTLS library right?6) getting-started-with-stm32cubel5-tfm-appli

Hi,I've been trying to port the STM32H753 SBSFU project to the STM32H735G-DK.The bootloader fails in SFU_BOOT_Init due to failing SE_Init().This is the result of __IS_SFU_RESERVED() failing it's test: 0x08008A00 < 0x08008061 < 0x0801FFFF (SB_REGION_ROM_START < __get_LR() < SB_REGION_ROM_END).As you can see the LR register value is outside of the expected range.Does anyone have an idea why this could be the case?Thanks!

..

I would like to use the RNG of the H743ZI2. The provided example works, but on a new project I can't get it work, The CPU clock is configured to 400MHz just like in the example./* RNG Initialization */   if (HAL_RNG_DeInit(&hrng) != HAL_OK) { /* DeInitialization Error */ Error_Handler(); }   /* Initialize the RNG peripheral */ if (HAL_RNG_Init(&hrng) != HAL_OK) { /* Initialization Error */ Error_Handler(); }uint32_t rnd_number;   void main() { while (1) {   status = HAL_RNG_GenerateRandomNumber(&hrng, &rnd_number); if (status != HAL_OK) { Error_Handler(); } } }  

I want to apply Read Protection to the STM32L552CCT6 .​If you execute HAL_FLASH_OB_Launch(); after setting Read Protection, reboot does not work.​Read Protection is applied only when the power is physically rebooted.I want Read Protection to be applied as ST reboots after executing HAL_FLASH_OB_Launch();.Below is the code I used.----------------------------------------------------------------------------------------------------------------------------​///* Unlock the Flash to enable the flash control register access *************/ HAL_FLASH_Unlock(); ///* Unlock the Options Bytes *************************************************/ HAL_FLASH_OB_Unlock();OptionsBytesStruct.RDPLevel = OB_RDP_LEVEL_1;  OptionsBytesStruct.OptionType = OPTIONBYTE_RDP;​if(HAL_FLASHEx_OBProgram(&OptionsBytesStruct) != HAL_OK) { /* Error occurred while options bytes programming. **********************/ } else {  /* Generate System Reset to load the new o

Background:I am working on a project that uses the STM32H7B0 processor on a custom board. The firmware is loaded by ST SBSFU bootloader STM32CubeExpansion_SBSFU_V2.4.0. I have used 2_Images_ExtFlash example as a template, and our firmware is stored an 8 pin external flash. The external flash part we are using is 4MByte and by EON EN25QH32B.In addition to using SBSFU I am also using Keil MDK RTOS-v2. In one of the tasks, the STM32H7B0 is operating as an I2C slave device communicating with an I2C master controller that does not support clock stretching.If load and run firmware with the debugger and without bootloader everything works fine.Problem:The problem I am having is that when the firmware is loaded by SBSFU the I2C communications between the master controller and the STM32H7B0 does not realiable run at 400KHz but works fine with 100KHz. The STM32H7B0 processor is running at 240MHz.

HiWhat is the maximum Stack and Heap size of a STM32G474VE with the SBSFU Bootloader 2 Image version?In the icf file the settings are at 0x400 and 0x200 which is really low./*-Sizes-*/ define symbol __ICFEDIT_size_cstack__ = 0x400; define symbol __ICFEDIT_size_heap__ = 0x200;

Hi,In static HAL_StatusTypeDef CRYP_TDES_Process(CRYP_HandleTypeDef *hcryp, uint32_t Timeout){ uint32_t temp; /* Temporary CrypOutBuff */ uint16_t incount; /* Temporary CrypInCount Value */  uint16_t outcount; /* Temporary CrypOutCount Value */ /* Enable CRYP */ __HAL_CRYP_ENABLE(hcryp); /*Temporary CrypOutCount Value*/ outcount = hcryp->CrypOutCount; /*Start processing*/ while((hcryp->CrypInCount < (hcryp->Size/4U)) && (outcount < (hcryp->Size/4U))) {    /* Temporary CrypInCount Value */   incount = hcryp->CrypInCount;    /* Write plain data and get cipher data */  if(((hcryp->Instance->SR & CRYP_FLAG_IFNF ) != 0x0U) && (incount < (hcryp->Size/4U)))  {   /* Write the input block in the IN FIFO */   hcryp->Instance->DIN = *(uint32_t *)(hcryp->pCrypInBuf