STM32 MCUs Security

I tried to step-by-step execution based on UM2262. But I could not get SBSFU welcome screen display (Fig24). My SBSFU display below.[SBOOT] Flash Configuration KO: Dual bank mode activated. STOP![SBOOT] Security issue: execution stopped!My step-by-step execution configuration are below.- STM32CubeIDE v1.3.0, 2020/02/26- X-CUBE-SBSFU v2.3.0, 2020/01/17- NUCLEO-G474RE, RDP level 0, PCROP, DBANK are all default MCU setting (Fig 18 – 21)- ST-LINK firmware version V3J5M2Attached is STM32CubeIDE projects.I also tried SW4STM32 but results are same.Please advise or help me to get SBSFU display Welcome screen. ​Thank you in advance.

Hello, does anyone know how to programmatically calculate a CRC with a polynomial length of 8 and 16 bits? The algorithm described in AN4187 only works with a 32-bit polynomial. Here are the results:IN_REVERSE_NONE, OUT_REVERSE_NONE, POLY_32B - 0xe8bccd9aIN_REVERSE_NONE, OUT_REVERSE_NONE, POLY_16B - 0x3852IN_REVERSE_NONE, OUT_REVERSE_NONE, POLY_8B - 0x26IN_REVERSE_NONE, OUT_REVERSE_NONE, POLY_7B - 0x60IN_REVERSE_NONE, OUT_REVERSE_BIT, POLY_32B - 0xaa45c417IN_REVERSE_NONE, OUT_REVERSE_BIT, POLY_16B - 0x6e52IN_REVERSE_NONE, OUT_REVERSE_BIT, POLY_8B - 0xfdIN_REVERSE_NONE, OUT_REVERSE_BIT, POLY_7B - 0x5dIN_REVERSE_BYTE, OUT_REVERSE_NONE, POLY_32B - 0x790ac5f0IN_REVERSE_BYTE, OUT_REVERSE_NONE, POLY_16B - 0x1ae2IN_REVERSE_BYTE, OUT_REVERSE_NONE, POLY_8B - 0x69IN_REVERSE_BYTE, OUT_REVERSE_NONE, POLY_7B - 0x7IN_REVERSE_BYTE, OUT_REVERSE_BIT, POLY_32B - 0x8794adc5IN_REVERSE_BYTE, OUT_REVERSE_BIT, POLY_16B - 0x752aIN_REVERSE_BYTE, OUT_REVERSE_BIT, POLY_8B - 0x70IN_REVERSE_BYTE, OUT_REVERSE_

here's my code for RDPprotection:void Flash_SetRDPLevel(uint8_t ReadProtectLevel) //level 1 (0xBB){ uint32_t tmp_reg; Unlock(); OB_unlock();  /* Read RDP level bits */  tmp_reg = (FLASH->OBR & (FLASH_OBR_RDPRT1 | FLASH_OBR_RDPRT2));  //if (tmp_reg == 0U)  {  /* proceed to erase the option bytes */  FLASH->CR |= FLASH_CR_OPTER;  FLASH->CR |= FLASH_CR_STRT;  /* If the erase operation is completed, disable the OPTER Bit */  FLASH->CR &= ~FLASH_CR_OPTER;  /* Enable the Option Bytes Programming operation */  FLASH->CR |= FLASH_CR_OPTPG;   OB->RDP = ReadProtectLevel;  /* if the program operation is completed, disable the OPTPG Bit */   FLASH->CR &= ~FLASH_CR_OPTPG;  }  Flash_OB_launch();  OB_lock();  Lock();}at the mom

I am trying to connect with an Intel Cyclone IV FPGA. I have looked in the reference manual for the STM, however, there is no information about the calculation of CRC 15-bit frame.

Hello,I need to know how to calculate CRC-8 of input data.I have a binary stream like (12586966 Dec or 0XC00FD6) and CRC-8(22 DEC, 0x16). Based on 0x97 polynomial how I can calculate my input binary stream CRC-8?Thanks

I have a project based on an Stm32F767. If I load the hex file and then manually enable readout protection to level 1 with the STLinkV2 utility, the board fails to begin to execute code after reset. Why? What is the correct way to use this feature?

I have a strange issue with my Stm32F767 project. We've seen with some boards randomly RDP will be enable to level 1, and BOOT0/1 are set to 0xffff. ESD seems like a potentially likely cause, but is there really enough energy in an ESD event to cause a flash erase to occur (given that the option byte bits are getting SET, not cleared, which implies a flash erase must have occurred). When this happens, the boards are recoverable with the removal of RDP back to level 0, and a reflash of the code. We have two separate boards with this exact same chip and general layout, and we've only ever seen it with one of the two.One other thing of note, when the board boots up, I check that the option byte word containing the RDP/brownout setting is correctly set. If it is not, I set the brownout protection to maximally restrictive with the following code. Is there any obvious issue with this code? The board is released from reset after programming and allowed to change its option bytes with this fun

With STM32CubeProgrammer, I download a .hex file to my target, and it runs.Then I go to the "OB" Tab, select "BB" (Level 1) and press "Apply". After this the target does no longer run, also not after a power cycle. To make it working again, I first select "AA" (Level 0) and reprogram the target.What am I doing wrong? Or can't I protect the chip for read-out at all?The Target is an STM32H753.

Hello,I'm new to stm32 ecosystem and I'm trying to make in place secure boot and secure firmware update on stm32l5 discovery kit. After these two things, I would like to call secure services from non secure application via PSA API. I first get the stm32cubel5 package expansion and after compilation, the secure boot seems to be OK. I still facing on how can I call a secure service (like hash, cipher functions, ...) from the non secure application ? I have read some documents on the PSA specification but I have not find any answer to my question. I will be happy if someone have some documents or anything else that can help me to establish communication between non secure and secure application ! Regards.

Hi all,I generated code in STM32CubeMX for STM32L081CBTx controller with AES enabled.I built the generated code (without modification) in STM32CubeIDE, but it failed with warning:../Core/Src/stm32l0xx_hal_msp.c: In function 'HAL_CRYP_MspInit': ../Core/Src/stm32l0xx_hal_msp.c:94:5: warning: implicit declaration of function '__HAL_RCC_AES_CLK_ENABLE'; did you mean '__HAL_RCC_ADC1_CLK_ENABLE'? [-Wimplicit-function-declaration]and error:../Core/Src/stm32l0xx_hal_msp.c:94: undefined reference to `__HAL_RCC_AES_CLK_ENABLE'because in stm32l0xx_hal_rcc_ex.h __HAL_RCC_AES_CLK_ENABLE is not defined for STM32L081xx controllers.Here is the relevant code:#if defined(STM32L062xx) || defined(STM32L063xx)|| defined(STM32L082xx) || defined(STM32L083xx) || defined(STM32L041xx) || defined(STM32L021xx) #define __HAL_RCC_AES_CLK_ENABLE() do { \ __IO uint32_t tmpreg; \ SET_BIT(RCC->AHBENR, RCC_AHBENR_CRYPEN);\ /* Delay after an RCC peripheral clock enabling */ \ tmpreg = READ_BIT(RCC->AHBENR, RCC_

Hi ST community,I have a fully functional application on my STM32L072. The problem is when I tried to enable RDP, nothing works anymore.After flashing the application I tried to connect with ST-Link, the option bytes are set correctly and it is not possible to read the FLASH memory, but the code no longer seems to enter the main.c. WHAT IS HAPPENING?Below my code to enable RDP. I call this function immediately after the MX_***_Init modules. Edit: the main FW is loaded in-app by a bootloader, therefore without using the debugger (through SWD).static void Enable_RDP(void) { FLASH_OBProgramInitTypeDef obConfig; // Read opt bytes HAL_FLASHEx_OBGetConfig(&obConfig);   if (obConfig.RDPLevel == OB_RDP_LEVEL_0 || obConfig.BORLevel == OB_BOR_OFF) { obConfig.OptionType = OPTIONBYTE_RDP | OPTIONBYTE_BOR; obConfig.RDPLevel = OB_RDP_LEVEL_1; obConfig.BORLevel = OB_BOR_LEVEL4;   // Flash optbyte HAL_FLASH_Unlock(); HAL_FLASH_OB_Unlock(); HAL_FLASHEx_OBProgram(&obConf

the HSM description in manual UM2238(Page 13)

Read Protection has been set in the STM32 chip .In this case, how to judge the chip is in the read protection state through the bootloader program of the chip.I now is to send the erase instruction, if return NACK, judge chip is in the read Protection state, and then send to remove Protection reading instruction . Is there any other way to judge .I also tried to send Get Version&Read Protection Status command, but chip send Enablement and prohibition Read Protection the number of times are 0x00 .

I am confused about the setting of the SPI CRC functionality: it is not clear what CRCSIZE is doing and how to set it. I understand that to get a N bits CRC you have to choose a N+1 bits polynom, but why is the length of the CRC not deduced from the polynom size ? Why is there an additional field CRCSIZE ?In my project I keep the standard 0x107 polynom since I want a 8 bits CRC. Should I set CRCSIZE to 00111 (8 bits) ?

Not able to access some function definition for AES256 . I am using Atolic true studio for cubeMx generated Code. I used STM32L442KC MicrocontrollerI Added crypto library using below steps .open properties of project and in C/C++ general>Paths and Symbols. In the Include tab add the folder that contains the header files. In the Source Location Tab add folder that contains the source code file. Aplly then OK. Clean and Rebuild the project. Then you can include in the main.c.1) Not able to access functionAES_ECB_Encrypt_Init(&AESctx, Key, NULL);definition not found please suggest any 2) It is possible to generate AES256 encryption data without crypto lib. I was downloaded the package In Cube Max, so AES init() function is createdstatic void MX_AES_Init(void){ /* USER CODE BEGIN AES_Init 0 */ /* USER CODE END AES_Init 0 */ /* USER CODE BEGIN AES_Init 1 */ /* USER CODE END AES_Init 1 */ hcryp.Instance = AES; hcryp.Init.DataType = CRYP_DATATYPE_8B;&

Not able to access some function definition for AES256 . I am using Atolic true studio for cubeMx generated Code. I used STM32L442KC Microcontroller I Added crypto library using below steps . open properties of project and in C/C++ general>Paths and Symbols. In the Include tab add the folder that contains the header files. In the Source Location Tab add folder that contains the source code file. Aplly then OK. Clean and Rebuild the project. Then you can include in the main.c. 1) Not able to access function AES_ECB_Encrypt_Init(&AESctx, Key, NULL); 2) It is possible to generate AES256 encryption data without crypto lib. I was downloaded the package In Cube Max, so AES init() function is created static void MX_AES_Init(void){ /* USER CODE BEGIN AES_Init 0 */ /* USER CODE END AES_Init 0 */ /* USER CODE BEGIN AES_Init 1 */ /* USER CODE END AES_Init 1 */  hcryp.Instance = AES; hcryp.Init.DataType = CRYP_DATATYPE_8B; hcryp.Init.KeySize = C

When loading a table (for CRC16-CCITT) in the RAM on the STM32F303, element 204 (value: 0x18c0) is corrupted. The value on load is 0x18c1.To test, I hooked up the openocd debugger, attached a breakpoint to the return statement and read out the content of CRC16_CCITT_TABLE.Note that this problem happens on at least two chips I tested. Changing the table to other values, like all zeros, or all 0xFF00, does not exhit the bug. Setting element 205 to 0xFF00 also results in the bug not showing.The bug is also intermittent and does not always show.Environment: Chip: STM32F303VEHxCompiler: arm-none-eabi-g++ (GNU Tools for Arm Embedded Processors 9-2019-q4-major) 9.2.1 20191025 (release) [ARM/arm-9-branch revision 277599]Memory base address: 0x08018000 (program is loaded with a bootloader that jumps to the application)#include <stdint.h>   static uint16_t CRC16_CCITT_TABLE [256] = { 0x0000, 0x1021, 0x2042, 0x3063, 0x4084, 0x50a5, 0x60c6, 0x70e7, 0x8108, 0x9129, 0xa14a, 0xb16b, 0xc

In the code it says the following:/** * @brief This function writes a data buffer in flash (data are 32-bit aligned). * @note After writing data buffer, the flash content is checked. * @param pFlashStatus: FLASH_StatusTypeDef * @param pDestination: Start address for target location * @param pSource: pointer on buffer with data to write * @param Length: number of bytes (it has to be 64-bit aligned). * @retval SFU_ErrorStatus SFU_SUCCESS if successful, SFU_ERROR otherwise. */ SFU_ErrorStatus SFU_LL_FLASH_Write(SFU_FLASH_StatusTypeDef *pFlashStatus, void *pDestination, const void *pSource, uint32_t Length) { ... }The brief says 32-bit aligned and the length parameter says 64-bit aligned so which one is it? I thought I read it is either 32 or 64 depending on platform, based on sizeof of SFU_LL_FLASH_write_t.Thanks,Arno

I started a new project, and my security requirement states that user authentication is required when updating firmware.I wonder if there's a feature for this, and if not, can the bootload side be modified to meet this requirement?I searched and found a concept like SFU. The chip used is stm32l0x2.

IAR would fill unused flash and optionally append a crc to aid with the integrity check some of us need to do for regulatory compliance But since IAR's been replaced what provisions are in Atollic to fill unused flash and optionally append a crc? Is there a caonical way to do this?I found https://github.com/nine/stm32_append_crc but it's GPL. I'm not our company's lawyer but I'm still reluctant to drag anything GPL into my project.TIA

I wants to encrypt 8bits of data using AES256 Security with STM32L442KC . And sending Encrypted data through UART. I am confused in code that code is correct or not....please let me know any correction in this code. I am using Atolic true studio.uint8_t plaintext[]={0x01};uint8_t ciphertext[16];uint32_t retval;MX_AES_Init();main(){ uint32_t rerval = HAL_CRYP_AESECB_Encrypt(&hcryp, plaintext, 1, ciphertext, 5);    if(retval == 0)    {     HAL_UART_Transmit(&huart1,(uint8_t *)ciphertext,sizeof(ciphertext),5);    }}Thanks & Regards Ashok

Need to protect data access through j-tag, but need to program flash through inbuilt boot loader

I am using atolic truestudio 9.3 . myplaintext is a[1]={97}; uint8_t ciphertext [32]; my code is below, uint32_t retval=HAL_CRYP_AESECB_Encrypt(&hcryp, plaintext, 8, ciphertext, 5);  if(retval==0)  {  HAL_UART_Transmit(&huart1,(uint8_t *)ciphertext,strlen(ciphertext),5);  }I am confused to read the encrypted data , I want to read Hex format data.My data is only 8 bit and Encryption key is 256 bit . wants the exact flow of AES Encryption in STM32. Thanks & Regards Ashok

Hi,I'm in the process of implementing a HTTP server in SBSFU where I can upload an update file from a webpage. I've based my work on the code in sfu_loader.c, specifically the function SFU_COM_YMODEM_DataPktRxCpltCallback() and I try to follow the same process. So far I got the upload part working and now I try to get it to install but the issue I keep getting is that SE_Decrypt_Append() always fails on the second packet I receive.I followed the function down the rabbit hole and the specific error that seems to occur is AES_ERR_BAD_OPERATION in SE_CRYPTO_Decrypt_Append().Because this comes from a closed-source encryption library there's no way I can find out what is going wrong.For error checking I check both the return value and the SE_StatusTypeDef parameter value. SE_Decrypt_Init returns SE_SUCCESS and SE_OK for both.My TCP_MSS is set to 1072 which is what I use for my decrypted chuck buffers as well.Here are the traces of my SBSFU which can help to give you an idea of the process:[

Need help on the secure programming support for STM32H753V MCU, OTA using hardware secure chip ATECC608A. Any example code or procedure would be a great help. Thank you.