STM32 MCUs Security

Does X-CUBE-SBSFU support the external flash on the SPI for the secure boot and secure firmware updates ? If yes could you please provide more details if there is any reference boards which has this support. Thanks in Advance,Best Regards,Gowda

I have a problem with ECC signature verifiacation using STM32 crypto library example projects.I'm using ECC based on P-256.What I do:Start a firmware crypto example project - ECC/KeyGen_Sign_Verif - generate public and private keys, sign simple messageCopy public key and signature and paste it into ECC/Sign_Verif example project and try to verify public key and signature. Public key is verified but ignature verification fails.I've checked byte-to-byte of MessageDigest, Message,Signature and Public key to avoid errors on coping. Also __CRC_CLK_ENABLE() - is done.What I'm doing wrong - why can signature verification can fail on same curve, public key, message digest?And in general - is it possible to export public key and signature to use them into with openssl on other platforms?

srec_cat.exe has a flag -STM32_Little_Endian described in the srec_cat manual as "These filters many be use to generate the CRC used by the hardware CRC unit on the STM32 series of ARM MPUs.". I can successfully append a CRC to my firmware file using this flag but am unable to get the hardware CRC to match the result. The Micro I am using is a STM32F765, with the default CubeMX initialisations as below: hcrc.Instance = CRC; hcrc.Init.DefaultPolynomialUse = DEFAULT_POLYNOMIAL_ENABLE; hcrc.Init.DefaultInitValueUse = DEFAULT_INIT_VALUE_ENABLE; hcrc.Init.InputDataInversionMode = CRC_INPUTDATA_INVERSION_NONE; hcrc.Init.OutputDataInversionMode = CRC_OUTPUTDATA_INVERSION_DISABLE; hcrc.InputDataFormat = CRC_INPUTDATA_FORMAT_BYTES; Has anyone else out there managed to get this working?

We are using a STM32H7 microcontroller for our project ans would like to use the HW CRC embedded in the Flash module.We are designing a custom bootloader that will calculate the CRC and then write it in a reserved section of the flash. Since the device operates in a noisy environment, a lot of error can be introduced on the communication line and we need to make sure that the data written is valid before writing the CRC.This means that we need to calculate the CRC ahead of time at build time. I have tried multiple variations of the algorithm and have not been able to figure out which algorithm or initial values are used to calculate the CRC.I have tried using the HW CRC to try to determine which settings and initial values the CRC algorithm uses, however, I had no success;As a starting point I have tried calculating the CRC on 4 bytes, however, the burst size is larger than this size. Is it okay to compute the CRC on a data sample smaller than the smalled burst size?Is there any way I

Hi,I have a general question regarding CRC32 for data read from flash. For example I am reading 2048 bytes of data total 512 bytes chunk each time. My question isdoes it make any difference if I check CRC32 for every 512 bytes read or after read of 2048 bytes?Thanks,****

Posted on January 08, 2018 at 10:21 Am I correct that readout protection has a major issue and is not working at all? Are all STM32s affected? Any comments on this from ST? See here: https://www.aisec.fraunhofer.de/en/FirmwareProtection.html #stm32-rdp-read-protection Note: this post was migrated and contained many threaded conversations, some content may be missing.

Hello,I am trying to decrypt some data on the L5. The data below can be fed directly into a python crypto library and get a valid result. I am trying to understand the 32-bit alignment requirements of the L5 as well as any possible byte swapping needed. Also, the lengths of the data and the header -- do they get specified in words or bytes? My header is 3 bytes in length and my data is 20 bytes.How do I set this up to make it work? Apologies for the state of the code -- it's a "work in progress" . :)Thank you in advance!D i c k uint8_t iv8[16] = {0x04, 0xbc, 0xca, 0xab, 0x01, 0x00, 0x00, 0x00, 0x01, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x02}; uint8_t key8[32]= {32 bytes}; //uint8_t iv8[12] = {0x04, 0xbc, 0xca, 0xab, 0x01, 0x00, 0x00, 0x00, 0x01, 0x00, 0x00, 0x00}; uint8_t aad8[3] = {0x42, 0x24, 0x02}; uint8_t dc8[20] = {0x66, 0x9b, 0xaa, 0xd4, 0xbc, 0x87, 0xed, 0x03, 0xfa, 0xbf, 0x66, 0xfc, 0x0e, 0x6b, 0x36, 0x85, 0xb7, 0x3a, 0xd7, 0x45}; uint8_t plaintext8[20]; uint8_t outtag8[16

We need a powerful M7 core running at high speed + GPU support for TouchGFX. It seems that STM32F750 is a perfect match, apart from the fact that it is missing support for on-the-fly decryption (OTFD). As we would like to use external flash memory and encrypt it, we will need OTFD support. I know that the new STM32 models that are launched have it on board. Is there a launch planned for a model similar to F750 but with OTFD support?

HiI'm working on a ST STM32G474RE with the 2 Images and have a application with STM32CubeMX.I was reading the AN5056 but don't understand how I can build my application bin file to download with the Y-modem protocol. Or do I need to modify and add all my code to the "2_Images_UserApp" Application? This application is already using HAL Libs and in this case I need to add all my code to this project? Is there any example code or step by step instruction to do the implementation?Best Reagrds, Dominik

I want to know how much secured the user flash of STM32H743ZI in RDP level 1 from hackers.

In the Reference Manual for the STM32L41xxx/42xxx/43xxx/44xxx/45xxx/46xxx MCUs for the CRC Unit, it casually mentions "Even polynomials are not supported." But what does this exactly mean? Does it mean polynomials which have even parity are not supported (see https://en.wikipedia.org/wiki/Cyclic_redundancy_check#Polynomial_representations_of_cyclic_redundancy_checks)? Or does it mean just polynomials with only even terms are not supported (e.g. x^4 + x^2 + 1) ?

hello,This is an old thread but I hope to get an answer here.I'm using NUCLEO-L496ZG-P, and I have data to decrypt (AES128 CBC).I'm using the STM32CubeIDE to compile.I'm trying to use the Cryptolib but didnt get how to do so. I did download "en.x-cube-cryptolib.zip" I copied the folder en.x-cube-cryptolib/STM32CubeExpansion_Crypto_V3.1.0/AccHw_Crypto/STM32L4/Middlewares/ST to Middleware to compile the library i added the library to the IDE : arm-none-eabi-g++ -mcpu=cortex-m4 -T"/home/youssef/Documents/smarto/projects/gateway_v2/STM32L496ZGTXP_FLASH.ld" -Wl,-Map="gateway_v2.map" -Wl,--gc-sections -static -L"/home/youssef/Documents/smarto/projects/gateway_v2/Middlewares/ST/STM32_Crypto/Lib" --specs=nano.specs -mfpu=fpv4-sp-d16 -mfloat-abi=hard -mthumb -Wl,--start-group -lc -lm -lstdc++ -lsupc++ -Wl,--end-group -o "gateway_v2.elf" @"objects.list" -llibSTM32CryptographicV3.0.0_CM4_GCC_FPU /opt/st/stm32cubeide_1.1.0/plugins/com.st.stm32cube.ide.mcu.externaltools.gnu-tools-for-stm32.7-2018-q

I'm using a STM32F373 microcontroller as SPI slave and can't make it work properly using CubeMX and HAL functions.Master side is OK, confirmed in scope that byte string and calculated CRC for Tx are as expected.Slave side is programmed to transfer via DMA to a buffer. If the number of transfers includes the 2 extra CRC bytes (using 16bit CRC), as instructed in all documentation I could find, SPI_DMA_RxCompleteCallback keeps polling until timeout. (By the way, I consider absurd that this routine polls for the CRC recepction).If the DMA number of transfers is programmed with n-2, the referred polling works fine, but CRC evaluation ALWAYS returns CRC_ERROR, no matter what. I've tried sending a sequence os binary zeroes, that would discard both CRC computation and buffer pointer mistakes, but it simply won't work...Need some help ASAP, Thanks a lot in advance!

Hi, I’m trying to use the cryptographic library on a board based on STM32L152CBT6-A to encrypt data to be sent. I tried to replace the files inside the “Driver�? folder but it did not work. Does anyone know how to use the library and import it correctly on System Workbench?

HiI'm trying to get run the X-CUBE-SBSFU application. I'm working with IAR Embedded workbench. Like in the manual, I built all applications in the following order:2_Images_SECoreBin2_Images_SBSFU2_Images_UserAppI'm working on a Nucleo-G474RE Board. I disabled all security features for debugging.Like I understand, I need to download first the 2_Images_SBSFU. If I do so and connect with the Tera Term I get the message:= [SBOOT] Flash Configuration KO: Dual bank mode activated. STOP!= [SBOOT] Security issue : execution stopped !I can't find the reason for this issue.So I tried to download the project "2_Images_UserApp" with IAR. Then I am able to download a new Firmware with the Y-modem:=======================================================================             (C) COPYRIGHT 2017 STMicroelectronics                ==   &nbsp

..

On STM32F746, largest sector is 256K and total flash size is 1M. This means that 1/4th of our flash is lost to the swap area. As a result, we do not have enough flash memory left to implement the dual image variant. We are now trying to optimize the memory layout. Is there some aspect of SBSFU or the STM32 memory layout that would make it impossible to work with a smaller swap area?

I am using X-CUBE-CRYPTOLIB V3.1.0 on STM32L0 to perform AES-192 encryption with a 192-bits key and 128-bits IV. Encrypted Data by STM32L0 can be correctly decrypted by STM32L0 using the same library.However, when I copy the encrypted data, key and IV to some common online tools for decryption on PC, none of them can get the correct data.The only way I can get the correct decrypted data from PC is to use OpenSSL with "-nopad" option enable. It looks the problem is related to block padding in encryption. May I know how to configure the AES-192 encryption in  X-CUBE-CRYPTOLIB V3.1.0 so that other online tool is able to decrypt?Thank you for your kind attention.

Hi I am now trying to port the SBSFU project to my STM32F730 discovery board.I would like to use the SBSFU in single image mode to upgrade the firmware in the external Nor flash connected via the QSPI interface.My idea was to replace the flash related operation in sfu_low_level_flash.c with the corresponding flash operations. For example, replace the existing read operation with the read operation of the external flash memory via QSPI bus.However, I got a error message trace:  [EXCPT] MEMORY FAULT when the SFU_BOOT_SM_CheckUserFwStatus function and its sub-functions tried to read the flash.To dig deeper, the HAL_QSPI_Command API triggered this exception.To verify the correctness of my flash memory operation, I tried to use the same implementation in the main.c, and it worked well(line 25 to 33 in the follow sni).The QSPI interface did init successfully and the read operation did read correct data in the external flash.int main(void) { #ifdef SFU_MPU_PROTECT_ENABLE /* Enable

Hello,for some STM32 controllers ST offers for application-update the IAP and SBSFU modules:https://www.st.com/en/embedded-software/x-cube-iap-usart.htmlhttps://www.st.com/content/st_com/en/products/embedded-software/mcu-mpu-embedded-software/stm32-embedded-software/stm32cube-expansion-packages/x-cube-sbsfu.htmlIn both the YMODEM protocol used.In the ST documentation the ymodem protocol is described very short in this way:The Ymodem protocol sends data in 1024-byte blocks. Error detection is applied to datablocks transmitted to the STR91xFA internal RAM. This is done through a comparisonbetween the transmitted and received data. Blocks received unsuccessfully areacknowledged with a NAK (Negative Acknowledgement). For more details about theYmodem protocol, please refer to the existing literature.What exactly does ST mean? What is the exact expected sequence?Do you mean like described in http://www.blunk-electronic.de/train-z/pdf/xymodem.pdfon page 16, Figure 3Is this the expected s

Can anyone help me with this,I have attached the code below.Thanks in Advance

..

Hi,I would like to move my project to STM32 from another MCU.There are some requirements that I have to comply with and I would like to know if STM32 is a good idea or not.I need to be able to flash the firmware using USB without an USB to UART converter and have a secure way of flashing the firmware (like secure bootloader).Also, the MCU should send some data to a PC, but it is binary data and I want the communication to be as fast as possible and reliable. I was using UART to USB before and the highest bit-rate that I could go up to was 115200. Anything more than that had the potential to send wrong bytes. So I would like the data transfer to be done using the same USB as for firmware update.Also, how is the SDK for it? I have never used it before and I am not sure how all the environment works.Regards,Gabriel

Hi everyone,I was trying to protect my code by read out protection. But before uploading program, mistaken changed the read out protection to level 2 using of stm32 utility software. Now, I don't able to connect my board to st-link.After search for this issue, i find that it is irreversible process means i can't program again.Anyone has any idea?

For our application, we require more than 2 bytes to identify the fw version. However, the current SBSFU has only 2 bytes fw version in the header. What is the easiest way to add a few more bytes for fw version? Thanks!