STM32 MCUs Security

Hello, I'm posting a new message because the previous one was not answered with successful connection. The problem is that when MCU is populated on my board with Read-Our Protection enabled, it is not possible to connect STM32CubeProgrammer v.2.21.0 to that MCU, it becomes a brick.This option was available in the version 2.0.0. that doesn't work on Windows 11.How can be done two step connection: 1) full erase and 2) connection ? Thanks,Alex

Hello,I'm looking for some clarification over how the PCROP area can be used.  The user manual for STM32L471 states that code in this area can be executed but that data at flash in this area cannot be read.   Does this mean if I put a decryption algorithm in this area that I cannot also put the key in this area also? As is would be unreadble?  Nick. 

Good morning everyone,I need to apply the "Closed" product state to my device using the STM32H573VI.I don't need TrustZone enabled and want to use a password for debug authentication.I wanted to perform the operation via "code" using the HALs, but once I set the state to "Provisioning(0x17)" from "Open(0xED)," my firmware won't boot, and I can't even provision the *.obk file using the STM32CubeProgrammer.bool ProductState::set(states newState) { FLASH_OBProgramInitTypeDef flashOptionBytes= {0}; HAL_StatusTypeDef ret {HAL_ERROR}; if(newState == states::Unknown) { Log::msg("Invalid product state\n"); return false; } Log::msg("Setting product state to %s ...\n", toString(newState).c_str()); HAL_FLASH_Unlock(); HAL_FLASH_OB_Unlock(); flashOptionBytes.OptionType = OPTIONBYTE_PROD_STATE; flashOptionBytes.ProductState = (static_cast<uint32_t>(newState) << FLASH_OPTSR_PRODUCT_STATE_Pos); Log::msg("Program state ...\n"); ret = HAL_FLASHEx_OBProgram(&flashOpt

 I have exported X509 certificate from STM32H573I-DK board, and checked how it is organised.The certificate was issued by "ST CA 01 for STM32 Initial Attestation".I would like to verify whether it is truely signed by ST's upper-level certificate.Where can I find the upper-level certificate? 

Hi ST team,I am using STM32U5G9 in my project. It would need simple firmware update feature and the image would be received by UART from a zigbee module.I have read UM2851 and AN5447 application notes and check the SBSFU example in STM32CubeU5 package (v1.8.0) in github. I believe this is what my project needs:1. MCUBOOT (Secure area)2. NS Application (non-secure primary slot)3. Nonsecure image secondary slot (for firmware update)4. Authentication and integrity check5. SWAP mode with scratch region I want to maximize the flash usage, so it doesn't need:1. Secure application2. Secure data3. Non-secure data4. Loader5. Encryption The bootloader would verify the signature in primary slot and execute the NS application. NS application would write the new image into Nonsecure image secondary slot when firmware update is needed.I would like to ask:1. How to modify the SBSFU example to meet above requirement? How should I modify below config file?- mcubo

We need to develop an offline programmer to program the STM32H562VIT. The product state need to be changed to Closed with an OBK file programmed. The OBK data only in HDPL1.We can't simply use the RSS to program the OBK like STM32Cubeprogrammer. We could only write and read the flash registers by SWD.When in OPEN state, we could program the OBK files successfully, then we change the state to provisioning and closed. But if we first change the state to Provisioning, then try to program the OBK data , the programming of OBK is always failed.So our questions is how to program the OBK file  data when in Provisioning state for a third programmer?

STM32 H573 TrustZone Enabled question. I'm executing the STM32 H573 example for TrustZone Enabled (OEMiROT, Secure, and Non Secure Apps).  I know the OEMiROT and Non Secure App prints out and logs info, but I want to be able to do that in the Secure App for logging purposes - errors and debugging.  I tried to use Gemini to create code that does that, but there appears to be many security hoops to jump through to do that, and I have been unsuccessful.  Do you have an example of what I can do to do this?   Gemini creates the following functions and instructs me to place it under the Non Secure App and call it from a Secure App function, but I keep running into the problem of where I'm getting multiple definition of `NS_putc_utility'  error. /*** @brief Non-Secure Call-able (NSC) function that returns the pointer* to the Non-Secure World's _write (UART) function.** The __attribute__ flag ensures the compiler generates the securit

Hello, I am looking for guidance regarding the STM32H533 MCU, specifically in the area of secure and non-secure memory management.Could you please let me know if there is a dedicated application note that explains how to store and manage encrypted keys on the STM32H533?Additionally, is there an application note or reference that provides a step-by-step example demonstrating the use of secure flash, secure memory, or secure storage on this MCU? Thank you for your support.Best regards,Aymen

Hi,I am using STM32H563 with OEMiROT_Boot example project, I got a problem to read the FLASH_SIZE register (0x08FFF80C).I found two issues,(1) the value of this register is 0 at begining of OEMiROT_Boot main() function.(2) the register become not accessable after sau_init_cfg(). Snaku

Hi,I am using STM32H56x with OEMiROT_Boot example project, and I use MCUBOOT_SWAP_USING_SCRATCH to install application images, is there an API like boot_set_confirmed( ) can used by secure applicaiton code, or a confirmation flag in SRAM like STM32H7?Thank you,Snaku

Hello, I have an STM32H755 nucleo board and I want to use the secure memory area features but I need to clarify my understanding of the reference manual "rm0399" and some follow up questions.My understanding is that:From my normal code (non-secure) in standard mode you enable secure access mode.Then an MCU reset is triggered.Then from my normal code in secure access mode I call RSS_resetAndInitializeSecureAreas that is mentioned in page 258 in the reference manual with the memory area I need to setup to be my secure code and this request triggers a reset.After reset the MCU enters the RSS ROM instead of my normal boot code and then it jumps to my secure code that won't exit it until the API RSS_exitSecureArea.Q1: If I don't call the RSS_exitSecureArea can I keep the secure code running on CM7, Can I run a normal non-secure application on CM4?Q2: Does the RSS have a feature to authenticate a bootloader code and if the answer is yes, where is that documented?

All the provided examples are using USART YMODEM to transfer data. I know, that it really doesn't matter what kind of protocol you use as long as image is placed in a correct place in the memory, but I wonder if I can use DFU feature to update firmware and still use SBSFU. Additionaly is there any reference or resource that supports we only have to upload .sfb file and we can't use .bin file? If we have to use .sfb file only then what is the correct method of downloading it because we can't download .sfb file through cli as it doesnot support .sfb extension and same I am not able to upload it through STM32 CUBE Programmer.

Hi Team,Firmware file are just signed not encrypted through STM32 SigningTool - stm32mcu (STM32_SigningTool_CLI.exe) after generating public and private keys through STM32_KeyGen_CLI.exe.Public key in raw 64 bytes is provided to bootloader_main.c as constant and hash is calculated from firmware data file after placing it at known location.Able to verify magic number as after signing a firmware file a header of 256 bytes is placed at top but failing to verify ECDSA signature. Using API ECDSAverify from legacy_v3 cryptographic library to verify signature.Please anyone help me with example as a reference to know where it is getting wrong.

HelloDo I unterstand correctly that the recommended secure boot option for STM32L4 is SBSFU?It seems that the only resource on how to get started with examples is the playlist on YouTube where a non signed exe from google drive has to be installed.Is there another way to get started with an example that doesn't involve having to install an exe from google drive?Are the scripts shown on the video available without installing the exe?I would really appreciate some guidance.Thank you very much in advance.

Hi everyone,Hi @Jocelyn RICARD, @D.Botelho @Jocelyn RICARDyou made this small bootloader example for testing H7 security features, e.g. RDP:https://community.st.com/ysqtg83639/attachments/ysqtg83639/mcu-security-forum/6051/1/STM32H753_SecureMem_ExampleV1.1.7zIs it possible to provision H5 MCUs and activate the closed product state using UART like the H7 example above?What i want is to implement a custom app that can get commands via UART and provision the device.I would like to have methods like: void setProductState(State state); void provisionDevice(const uin8_t* obkey,size_t obkey_size); // provisionDevice would then provision the device using the obkey send via UART. I see in the reference manual that the RSS offers functions that i can use for the provisioning.But i read somewhere that in PROVISIONING State the flashed application won't run and the device waits to be provisioned via debugger. If that is the case my idea described above won't work because a

Hi ST Team, I am using STM32H7S78-DK development board.I have read and tested following article:https://wiki.st.com/stm32mcu/wiki/Security:STiRoT_for_STM32H7Shttps://wiki.st.com/stm32mcu/wiki/Security:OEMiRoT_OEMuRoT_for_STM32H7Shttps://wiki.st.com/stm32mcu/wiki/Security:How_to_start_with_STiRoT_OEMuRoT_on_STM32H7SI need some help on my project.In How_to_start_with_STiRoT_OEMuRoT_on_STM32H7S wiki page, I got the correct result following "1.5 Full regression" section. But for the "3.1 Debug Opening procedure" section, I got error message after clicking "Execute".  The life cycle after clicking discover is "ST_LIFECYCLE_CLOSED (Debug opened)".  Any method to fix this error?10:31:36 : STM32CubeProgrammer API v2.20.0 | Windows-64Bits 10:37:49 : Start Debug Authentication Sequence 10:37:49 : SDMOpen : 624 : open : SDM API v1.0 10:37:49 : SDMOpen : 625 : open : SDM Library version v1.2.0 10:37:49 : open_comms : 513 : open : Asserting target reset 10:37:49 : open_com

On a secured STM32H7Sx device (in CLOSED or LOCKED product state), what is the recommended way of passing volatile data to lower HDPL levels?According to the reference manual, the SBS_RSSCMDR register can be used to pass volatile data from HDPL 1, 2 or 3 to HDPL 0 (RSS), so that part of the answer is covered:Bits 15:0 RSSCMD[15:0]: RSS commandThe application can use this bitfield to pass on a command to the RSS, executed at thenext reset.But what if you want to pass volatile data from HDPL 2 or 3 to HDPL 1?(E.g., HDPL 2 wants to call into HDPL 1 so HDPL 2 first needs to write some volatile command somewhere, then execute a reset, then HDPL 0 (RSS) boots, then HDPL 1 boots and picks up the volatile command from somewhere.)SBS_RSSCMDR cannot be used because RSS will interpret this value as well, and RSS might clear this value at the moment it boots HDPL 1.

Hi everyone, I was trying to port TFM + TFM_SB on my STMU575ZI-Q Nucleo following this guide: https://www.st.com/resource/en/user_manual/um2851-getting-started-with-stm32cubeu5-tfm-application-stmicroelectronics.pdf and I've managed to flash secure bootloader and TFM. I've managed to do the regression of the MCU setting the option bytes. When I finally lunched TFM_UPDATE.sh script, logs appeared on tera term as expected, but in the end it got stuck in TFM BOOT log. So I disconnected the board and tried to repeat the process, cleaning and building again the TFM SB image, TFM Appl image etc... But When I tried to mass erase the system flash, an error has occurred: DEV TARGET NOT HALTED. When I reset the board and I observe tera term logs, I can see the following:[INF] Flash operation: Op=0x0, Area=0x0, Address=0x0[INF] Starting bootloader[INF] Checking BL2 NV area[INF] Checking BL2 NV area header[INF] Checking BL2 NV Counter consistency[INF] Consistent BL2 NV Counter 3 = 0x1000000[INF] C

HelloI am developing on the STM32H7B3-DK using X-CUBE-SBSFU v2.7.0 with IAR compiler version 9.70. During the build, I encountered the following critical error:Fatal error[Li004]: file "STM32CryptographicV3.1.3_CM7_IARv8.a" is not an object or archive fileIt appears that the provided static library (STM32CryptographicV3.1.3_CM7_IARv8.a) was built with IAR v8.x and is incompatible with IAR v9.70, preventing successful linking. The static library is present in STM32CubeExpansion_SBSFU_V2.7.0\Middlewares\ST\STM32_Cryptographic\Fw_Crypto\STM32H7A3\LibCould you please advise:Is there an official version of the STM32 Cryptographic static library compatible with IAR v9.x for STM32H7B3?If not, what is the recommended procedure to rebuild or obtain a compatible library for use with IAR v9 ?Thank you for your support. @STackPointer64 @Jocelyn RICARD @Fred 

Hello,I have already read the AN4758 application note and I still have a few questions regarding PCROP.I have a project for end-users where the main application provides functions (API) that users can call to develop their own code. I was originally planning to provide these functions as a static library, but since PCROP is very useful and secure, I would prefer to protect my API using PCROP instead of distributing a library with unnecessary header files.In my application, the region 0x08000000 to 0x0805DFFF contains my API code. I plan to flash this code first and then protect this area with PCROP.Here are my questions:If the end-user creates an empty project and I only provide the header files, can they still debug their own application even though the API code region is PCROP-protected?Since a PCROP-protected area cannot be read or written, is there any way to update my API code later? I have a CAN bootloader, but this region will be protected by PCROP.(I am using STM32G474RET6 with

Hi,I am using STM32H56x with OEMiROT_Boot example project, currently the swap method of the OEMiROT_Boot  is "MCUBOOT_SWAP_USING_SCRATCH", can I change it to MCUBOOT_SWAP_USING_MOVE?Is there any security concern use MCUBOOT_SWAP_USING_MOVE?Regards,Snaku

I've been playing around with the TrustZone Enabled on the STM32H573 board and using this tutorial:https://wiki.st.com/stm32mcu/wiki/Security:How_to_start_with_OEMiRoT_on_STM32H573_and_563%E2%80%93TrustZone_enabledI had no trouble executing the tutorial, using the Debug Authentication, or changing the permission levels to attach the IAR Debugger to put breakpoints in the main functions of the Non Secure or Secure Applications.However, my group uses the STM32 Cube IDE, and I've been having trouble doing the equivalent using that tool.  I know where to enable and set up the Debug Authentication, but I'm having trouble attaching to the running target, hitting the reset button (as instructed in the above tutorial), and having the program stop at the breakpoint I have enabled in the main function of the Secure Application (before it jumps to Non Secure Init) and displaying the associated source code.  I have built all the projects (OEMiROT Boot, OEMiROT_Appli_TrustZone_Secure, and

I've been struggling with this problem for several hours.Using bare metal, I can invoke a non-secure callable from the non-secure application.When I added FreeRTOS + CMSIS RTOS v2 wrapper, and try to do the same from a thread context, I get a hard fault when I try to invoke the non-secure callable (see below)I would assume this is related to the thread stack. I am using the following:Cube MX 6.16Cube IDE Version: 2.0.0 Build: 26820_20251114_1348 (UTC)In the secure project is secure_nsc.c, I define my API: CMSE_NS_ENTRY void ToggleBackLight(void) { HAL_GPIO_TogglePin(BACKLIGHT_GPIO_Port, BACKLIGHT_Pin); } In the non-secure project, I invoke this from a thread as follows:/* Private application code --------------------------------------------------*/ /* USER CODE BEGIN Application */ typedef void (*SecureFunc_t)(void) __attribute__((cmse_nonsecure_call)); void doBlinkyThread(void *argument) { /* USER CODE BEGIN defaultTask */ SecureFunc_t secure_func = (SecureFu

HiI am using STM32L562 and sampled and flashed the Zephyr OS example for TrustMode. I could not revert back the TrustZone therefore followed the information from the link https://community.st.com/t5/stm32-mcus-security/reverting-option-byte-configuration-after-tf-m-testing-in/m-p/584225/highlight/true#M5879However, after executing the first two commands the board doesn't respond to the command.  Even with the hotplug  mode, I can't set RDP level back to 0 STM32_Programmer_CLI -c port=SWD mode=hotplug reset=SWrst -ob RDP=0xAA UNLOCK_1A=1 UNLOCK_1B=1 UNLOCK_2A=1 UNLOCK_2B=1 ------------------------------------------------------------------- STM32CubeProgrammer v2.20.0 ------------------------------------------------------------------- ST-LINK SN : 0046003F3137510C33333639 ST-LINK FW : V3J16M8 Board : STM32L562E-DK Voltage : 3.27V SWD freq : 8000 KHz Connect mode: Hot Plug Reset mode : Software reset Device ID : 0x472 Revision ID : Rev Z Device name : STM32L5xx Fl

Hi team, I provisioned both OEM1 and OEM2 keys. I locked the device using OEM2 key and then put the device in RDP level 2 with the below commands:STM32_Programmer_CLI.exe -c port=SWD mode=hotplug -lockRDP2 0xFEDCBA98 0x76543210Response: "Lock RDP2 password successfully done"Enable RDP2: STM32_Programmer_CLI.exe -c port=SWD mode=hotplug -ob RDP=0xCCIf you see here I used only <word1> and <word2> for password because I followed the below video for STM32U5:URL: https://www.youtube.com/watch?v=B3l6iuA7U8Q&t=752sBut STM32U3 series uses 128 bits of password rather than 64 bits used by STM32U5 series.Could anyone know/share default value that will be passed if we have missed <word3> and <word4>.