STM32 MCUs Security

STM32Cube Programmer v2.4 (also tried v2.3)Windows 10 Pro (build 18363) and Mac (Catalina 10.15.4)STM32F405 custom board, STM32F407 on DISCOVERY boardI cannot unset the read protection of the MCU via the Cube programmer when interfacing to the factory boot loader over the serial port. It recognizes that the MCU is present and that it is under RDP. It then tries to unset RDP, but fails with a timeout.I can successfully unset RDP using the factory boot loader over the UART using the stm32flash program. The fact that the Cube programmer fails with both my own PCB and the standard DISCOVERY development PCB suggests to me it is not a hardware issue.The Cube programmer can set RDP over serial port, and it can set / clear it using ST-Link. I've tried it on Windows and Mac, same results.I've been working on and off on my firmware for 9 months, but since I normally use the ST-Link or a secondary UART bootloader, I am not sure whether this behavior is new, or has always existed but I didn't catc

Hello,This question is the follow-up of this one:https://community.st.com/s/global-search/Setting%20of%20GPIO%20PUPDR%20and%20OTYPER%20for%20SPI%20pinsI thought I had fixed it thanks to the GPIO setting but it was just bad luck.My setup is:two Nucleo STM32H743the master is using on SPI1the slave is using SPI2 (with SPI1 I have no issue)clock setup is: for master VOS1, Sysclk 400MHz, HCLK 200, PCLK 100, spi_ker_clk 200 and SPI baudrate prescaler at 8. For master every clock divided by 2 (parameter M to setup ref1_ck of PLL1 was changed)GPIO: high freq / push-pull / no pull down (tried with pull down, no difference)slave receives correctly all the timemaster never receives answer from the slaveSPI setup at master side to receive the answer from slave: simplex receive only, CRC enabled, datawidth 8 bits, 5 bytes to receiveI completely unplugged the MISO wire. On master side I of course still gets the EOT event (as expected) but I expect to get a CRC error since I should receive crappy dat

I'm trying port the SBSFU example STM32L476 board to our MCU which is STM32L475. Fortunately they are very similar. I'm going through the code and it makes sense but I could not find a single reference about porting it. ST has documents that explain what is going on but not how to port it. Which files should I be modified? I am going over all the source codes (.c, .h). Not sure what parts of the linker file (or any other files I'm not aware of) should be modified. A practical guide would have been useful. A little rant: I wish this feature was implemented in the CubeMX, that would have made life a lot easier for people who don't have a long background in fw development.

I've been just bitten by https://community.st.com/s/feed/0D50X00009XkW6NSAV . [reconstructed] In an already proven working piece of code, I first check if an array's first word is equal to a constant (signature), then I reset the CRC and then feed it in a for loop by that array (including its first word, i.e. the signature). A newer version of gcc optimized this more aggressively than previous gcc version, and as from the signature test it "knew" that the first word of array is equal to a constant (which it already held in a register), it generated a write from that register immediately after the write to CRC reset, and only after that fed the remainder of the array in the loop. I've checked RM0090 which is currently in version 18, and there's still no mention that I'd have to wait until the reset bit gets autocleared, or any specified time after writing the reset. ST, can this please be specified. Also, isn't the same problem present in other STM32 models? JW&

..

Hi,I am working on p-nucleo-wb55 and run SBSFU example successfully. now i want replace default user application with my application as a secure application (.sfb). I refer AN5056(Integration guide for the X-CUBE-SBSFU) section 8.1 How to make an application SBSFU compatible. but i am woking on AC6 IDE and example steps are for the IAR IDE.So can you please tell me what linker script (.ld) changes require to make application SBSFU compatible and as specially how to make bin file length multiple of 16 byte which required during aes encryption.Thanks,Arjun

..

Hi,I am testing SBSFU in p-nucleo-wb55. when i am flashing user_app.sfb it flash successfully at slot1 (Download Area) but can not decrypt and hang at below STATE can you please help me how to resolve this issue and also tell me how to enable debug log in 2_Images_SECoreBin.= [SBOOT] System Security Check successfully passed. Starting... = [FWIMG] Slot #0 @: 8012000 / Slot #1 @: 8047000 / Swap @: 807e000     ====================================================================== = (C) COPYRIGHT 2017 STMicroelectronics = = = = Secure Boot and Secure Firmware Update = ======================================================================     = [SBOOT] SECURE ENGINE INITIALIZATION SUCCESSFUL = [SBOOT] STATE: CHECK STATUS ON RESET INFO: A Reboot has been triggered by a Software reset! Consecutive Boot on error counter = 0 INFO: Last execution detected error was:No error. Success. = [SBOOT] STATE: CHECK NEW FIRMWARE TO DOWNLOAD = [SBOOT] STATE: CHECK USER FW STATUS N

Hi there. I have been using the wolfssl lib for a while on the freescale mcu mk82fn256xxx and the performance have been greate so far. Wc_generateSignature performs a signature within milliseconds. Recently I switched from freescale to STM, SMT32F437VG serie. This mcu has a RNG, CRYPTO and HASH engine. When it comes to the wc_GenerateSignature I can make the difference between two of them. STM MCU takes too long to perform the signature (about 4.5 seconds). Is there any way to improve the signature process? I am not sure but I think that the difference between two MCUs relies on the PKA(Public Key Accelerator). Any help is appreciated.Regards

I have used STM32H750VB as my main controller for a Project and in that i am in need of AES Encryption to be done..With the help from our community friends i am able to integrate the AES part in my main coding..I have used the 192 bit plain text array(Plaintext[16]) with the 192 bit key ( AESKey192[6]) and 128 bit initialization Vector( AESIV_CBC[4] ) and obtained the 192 bit output encrypted array (CiphertextAESCBC192[16]) given in the attached notepad. ..I am a novice so kindly explain or give me the links where i can study about the same. I am having the following doubts1.Is the size of the encrypted data same as that of input data?2.When i try to transfer the encrypted array through UART the 32 bit data cannot be transferred properly i am getting some special characters and i have tried splitting the data as 8 bit and now i am getting a result but i don't know whether it is correct or not? (the image is attached as UART Op)3.When i tried checking the obtained result the link f

I'm trying to use EEPROM emulation API in a project. I have downloaded the expansion package. Based on AN4894 I need core and porting to be included in my project so I copied them under a new directory in Middleware and included the path. Then added the eeprom_emul.h to my project. However stm32l4xx_ll_crc.h is included in the eeprom_emul.h which is not in my project. I activated the crc in cubemx and regenerated the code but this file is missing. Would appreciate any help.

Hi All,I am using X-CUBE-CRYPTOLIB for AES ECB encryption/decryption on STM32H7 micro and using the F7 example code and library(libSTM32CryptographicV3.0.0_CM7_GCC_ot.a), provided in the crypto package. But the comparison of encrypted message fails with expected cipher text. FYI i have enabled CRC clock. Please help me out to resolve it quickly. Herewith i have attached the code for your reference

I have created a simple function to encrypt a message using the AES CBC flow suggested in the documentation (AES_CBC_Encrypt_Init, AES_CBC_Encrypt_Append, AES_CBC_Encrypt_Finish), and then using the same flow to decrypt (AES_CBC_Decrypt_Init, AES_CBC_Decrypt_Append, AES_CBC_Decrypt_Finish). I am using a fixed Key vector (32 bytes) and a fixed InitializationVector (16 bytes) and I'm using these same arrays in decryption as in encryption. But I don't get the original input message back. Here is the code:uint32_t doSimpleEncrypt(){ // AES context, error status and output length. AESCBCctx_stt AESctx; uint32_t   errorStatus  = AES_SUCCESS; int32_t    outputLength = 0; const uint8_t Plaintext[PLAINTEXT_LENGTH] = {0x61, 0x62, 0x63, 0x64, 0x65, 0x66, 0x67, 0x68,                        0x69, 0x6a, 0x6b

I am using bootloader to update my firmware and I am using dual bank to update code. When I working on bank 1, new code sending to bank2 after reset I am starting bank2 successfly, but I want to use Read Out Projection in my MCU.If I use Read Out Protection I have some question about that:1) If the read out protection enable, can I use dual bank?2) If the read out protection enable, can I update firmware with IAP-Tftp ?

We have two microcontroller, one is the STM32H7 and another one without hardware CRC (need to be software CRC through an algorithm).I use SPI communication with this hardware CRC32 and I would like to know the software algorithm able to have the same value as for the hardware CRC calculation. I can see proposal of algorithm up to STM32F4, but for newer version of microcontroller such STM32H7, I just see anything.Of course, I tried the CRC algorithm of the previous version but doesn't work.

I'm trying to enable the OB_RDP_Level_1 for a STM32L151CC but It fails. The MCU becomes bricked. I can't even boot to DFU. I need to first start ST link utility and set read out protection level 0, and then do a chip erase. But I noticed that bit OPTVERR = 1 indicating that the option bytes are faulty. I have tried a fulle chip erase and it does not set the OPTVERR to zero. Is it possible that I have a special STM32 that always start up with OPTVERR = 1? I have tested on some evaluation boards and they have OPTVERR = 0 at start.

We have an STM32F37II device in an older generation of a product that ECCkeygen() works as expected. But in a new version of the product, which uses the same MCU and cyrpto libraries, and which uses nearly identical firmware (it was ported from the older device), the ECCkeygen() function works for the localPublicKey X keys, but not for the Y keys. the pmY->mNumDigits comes out of ECCkeygen as 1 instead of 12 and that causes the Y keys to be mostly 0's. I believe that the arguments going into the function are correct. Our flow follows the ECC Key Generation flow chart (RNG init, ECC curve init, publicKey point init, privateKey point init, ECCkeygen). None of these return failing statuses.Do you know why ECCkeygen would return the Y mNumDigits of 1 instead of 12?Thanks in advance for your help.

Hi everyone,I have a problem about the integration of the SEGGER embOS RTOS with SBSFU.I have already succeeded with FreeRTOS but I would like to use embOS for my project. The "SECoreBin" project compiles well, I added the instruction to deactivate the systick in the SBSFU project just after "SFU_LL_SB_SRAM_Erase ();".When I run my "user app" project my interrupt "systick_handle" does not work.Have you ever used embOS with SBSFU ? Do you have any advice ?I've been struggling with this problem for several days now :(Best regards, Hugo

Hi,i am trying to replace standalone loader(2_Images_Loader) from SBSFU with BLE_OTA provided in STM32Cube_FW_WB_V1.3.0.I have made changes as suggested in AN5056 section 8.4 How to replace the standalone loader with a BLE OTA loader.After doing changes BLE_OTA application can work independently but when i use BLE_OTA binary with SBSFU code it jump into application but after that stuck at below Infinite_loop.Default_Handler: Infinite_Loop: b Infinite_LoopIs there any proper document available or any one perform above scenario with STM32WB55 Please help me to resolve this issue.Thanks,Arjun

Hi,I am trying to replace standalone Loader from sbsfu with BLE_OTA As mention in AN5056 section 8.4.i have change linker script as they mention but show that BLE_OTA generate only elf and hex file,so to generate .bin file i have added below command in post-build steps AC6 IDE.arm-none-eabi-objcopy -O binary "${BuildArtifactFileBaseName}.elf" "${BuildArtifactFileBaseName}.bin"It successfully generate binary but size of binary is too large. please help me how to resolve this issue.Size of binaryProduction.bin 385MProduction.hex 43KProduction.elf 2.0MThanks,Arjun

I am new to this STM family of Controllers & AES Coding. Kindly suggest some links where i can learn about the AES CBC Coding for STM32H750VB .I have generated the code for AES CBC Using STM32CUBE MX and unable to proceed with the coding.

Due to cost constraints, only STM32G431x8 (64K byte flash memory) can be used, but there is no sample source code for G431x8 in the SBSFU library. I tried to port such a project, but I was a little confused.1. The compilation of the 1_Image_SBSFU project of NUCLEO-G474RE is close to 50K bytes, which is not acceptable. But UM2262 didn't teach me how to delete some functions to reduce the size.2. Maybe I can use NUCLEO-G031K8 to port, because its 1_Image_SBSFU project compiles only 36K bytes, but it is m0 core so I ca n’t determine whether it can be ported.Any suggestions are greatly appreciated!

I am genreating a hex file from .elf in post, and adding crc to it. Is there any way to debug using new hex, in cubeide 1.1.0

Hi, I'm new in the forum and I would like to have your technical support. Unfortunately regarding this topic I was not able to found info in internet, and I don't know if I'm trying to do something not allowed by the ST libraries.For my application I need the SHA256 and RS2048 algorithms.The mcu is an ECOM10, while the IDE is IAR v.8.3.Considering that ECOM10 integrate a Cortex M4F, I tried to use the libraries for the STM32F4 family. Is that choice right? In particular I tried to use without success both: 1) STM32_Cryptographic_Library_V2.0.6 2) STM32CubeExpansion_Crypto_V3.1.0For the "STM32_Cryptographic_Library_V2.0.6", I was able to build the project only using the "M4_CryptoHW_2_0_6.a", i.e. with the hw accelleration.While for the "STM32CubeExpansion_Crypto_V3.1.0", I was able to build the project using both "STM32CryptographicV3.1.1_CM4_IARv8" and "STM32CryptographicV3.1.1_CM4_IARv8_otnsc.a".For all cases, I've used as reference the sha256 project example, but unfortuna

I am using STM32F207. The project that im working on will later on will be used by a bootloader. I am, therefore, trying to add crc information in the hex file so that bootloader will be able to validate its correctness.I am using srec_cat to calculate the crc in postbuild using this example with a modification that i use obj_copy to fill the memory gaps rather than srec_cat. (--gap-fill 0xFF)I have added a section in linker file, with the same address as that the one used by srec_cat, /* Sections */ SECTIONS { /* The startup code into "FLASH" Rom type memory */ .isr_vector : { . = ALIGN(4); KEEP(*(.isr_vector)) /* Startup code */ . = ALIGN(4); } >FLASH /*placing section for crc */ .crc32 0x08010000: { KEEP(*(.crc32)) /*keep my variable even if not referenced*/ } >FLASH /* The program code and other data into "FLASH" Rom type memory */ .text : { . = ALIGN(4); *(.text) /* .text sections (code) */   .....andconst uint32_t __attribute__ ((section(".crc32"