STM32 MCUs Security

Hi,I've some problem in understanding why it's not possible to use the single image download on Dual Bank MCU, as "reported" in the following picture (ref. UM2262 pg.54 par. C.2 Mapping Definition).Could someone give me more details about this limitation ? Many thanks,Stefano

I would like to build the SBSFU demo application for the B-L475E-IOT01A on a linux platform, but i can't find any instructions in the documentation or Makefile to do this.

If the Read Protection is set to RDP Level 1 in the Option Bytes, does the above claimed vulnerabilities affect STM32F7xx or STM32H7xx MCUs?

FLASH memory protection is different between STM32G070 and STM32G071.But there is no stm32g070 in the sample project of x-cube-sbsfu package, only stm32g071.Based on project NUCLEO-G071RB, I commented out two protections and compiled them. I wonder if there is any hidden danger in doing so, or if there are any other protections that need to be added?

Hi,We are using STM32F769BIT6 based system for our product. We like to enhance the system with security.Is it possible to add secure boot and encrypted boot to the system without any hardware modification?

Hi everyone,I am using STM32L4A6 with FreeRTOS running on it. I integrate SBSFU according to UM2262 and AN5056. After jumping to application, the firmware triggered Firewall reset when calling osKernelStart() .I already turned SysTick off before jumping to my application. I used one LED to indicate the current code running and firmware was good before calling osKernelStart().I also tried to use non-os application integrated SBSFU and it ran without problem.Any suggestion is welcome. Thanks.Sean

I'm going to play with "Secure User Memory" and RSS feature (explained here) on STM32H753 ,and wonder if it is possible to reset the secure mode using debugger.Of course, unless RDP level 2 is active.Is there a window of time after power-up for a debugger to break in and do full erase of the MCU, or the secure mode will disable debugger interface immediately?-- pa

Hello, I've adapted SBSFU (X-CUBE-SBSFU) example projects for a STM32L4R9 ​in single bank (flash) mode. I get a firewall reset when accessing SRAM1 that's outside of the defined protected area. Only a small section of SRAM1 is protected by the SBSFU (the secure engine itself, about 4k), so I'm losing quite alot of usable SRAM. According to the STM32L4R errata (en.DM00371862) there are 2 Firewall related limitations: Only 128kB of the 192kB can be protected by the firewall.A 'Spurious' Firewall reset can occur when using FMC or OctoSPI.I'm not using FMC or OctoSPI; I am using LTDC, SDMMC and UARTs.Even when accesing SRAM1 above 128kB (which can't be protected) I get Firewall resets.Using SRAM2 and SRAM3 is ok; no problems there...So following questions:Is the 'spurious' firewall reset possible on SRAM1 above 128kB?Can it be caused by peripherals other dan OctoSPI and FMC?Am I missing something? Any other suggestions?Thank you,rvan

I am trying out the sample projectSTM32CubeExpansion_SBSFU_V2.2.0/Projects/NUCLEO-H753ZI/Applications/1_Image.I have completed the following build steps:prebuild.pyBuild SECoreBinBuild SBSFUBuild UserAppThe last step postbuild.py (which is SECBOOT_ECCDSA_WITH_AES128_CBC_SHA256.sh) has an assert:Exception: AES CBC encryption requires the Firmware Image size (22232 bytes) to be a multiple of the AES block size (16 bytes)I don't know how to get around the problem.

Hi,I am new the the development and I have been testing the hardware aes module.I have tested against a known vector and the results differ from what is expected, I have checked the test vectors using AES provider in .NET and I get the results I expect, so am wondering what is wrong with the code I have.I am running it on a nucleo with the STM32WB55RGV6 MCUThe code is #include "main.h"   #define AES_TEXT_SIZE 4   /*TEST VECTORS FROM *https://github.com/ircmaxell/quality-checker/blob/master/tmp/gh_18/PHP-PasswordLib-master/test/Data/Vectors/aes-cbc.test-vectors *Set 3 vector 3 **/ CRYP_HandleTypeDef hcryp1;   DMA_HandleTypeDef hdma_aes1_in; DMA_HandleTypeDef hdma_aes1_out;   uint32_t aAES256key[8] = {283852128,3195128341,4037964587,2172091781,120337695,3607650619,2735773741,4108260361};   /* Initialization vector */ uint32_t AESIV[4] = {2521758876,2374032254,2071437159, 2100064454};   uint32_t aPlaintextCBC[AES_TEXT_SIZE] = { 1176291376,3001

I have a module that uses the STM32F091RC MCU and trying to connect it with software using C# language.At the first the connection has worked properly, then I've used the CRC32 to verify the sent data but it didn't work.Ive read the "Application note AN4187" and implemented it, I've tried many combinations of CRC32 settings including input data / output data reversion and bit flipping the resulting CRC and nothing matched the results of CRC32 standards when I compared the results using online calculators.Is there any resources that explains the work flow of the hardware CRC32 or how to make it works as standards CRC32?

Hi,I have (for example) a byte array with the size of 6. Now I want to calculate its crc32 value. The first 4 bytes are no problem - I put them in as word, but what about the last 2 bytes?Thanks for the Help in advance.BRNico

Hello,I now understand that I should have asked the question differently.Let's say we have 2 applications: secured and non-secured application.The secured is placed in inetrnal flash, just as done in the demo of SBSFU,But the non secured should be placed in external flash.And we don't need it to be encrypted.Is it that the root bootloader os SB will try to decrypt or authenticate it before jumping to that non secured application in external flash ?The bootloader should decide if jumping to the secured or non-secured according to GPIO (by the way, is it secured ?)Thanksranran

I have a file from ST, not sure where it comes from but the header has:sha1_alt.c for SHA1 HASHCopyright (c) 2017, STMicroelectronicsI am getting issues with the function that call HAL_HASH_SHA1_Accumulate function.They are no checking for size/len if it is 0.For some reason I am getting this issue but not sure if its this file or the application issue.Shall it checks if size is >0 ?Do you have an updated version of this file?

Hi,According to application note for STM32F4xx protection features ,the reverse from RDP L2 to RDP L1 is not possible due to a JTAG fuse, does this mean also that the MCU can check the fuses before checking the RDP? Is it possible to change the Level using UV attack or similar even though the JTAG fuse is blown?Is there any detailed documentation describing how it works to secure FW inside MCU using this feature ?

I'm using the hardware hash processor of an STM32F756 to calculate the MD5 of string "user:realm:password", but the result is wrong. I'm using the HAL library, this is my code.static void AuthRespCalc(char * username, char *realm, char * password) { uint8_t hash[16];   /* HA1 -> HA1=MD5(username:realm:password) */ HASH_Init(); HAL_HASH_MD5_Accumulate(&hhash, (uint8_t *) username, strlen(username)); HAL_HASH_MD5_Accumulate(&hhash, (uint8_t *) ":", 1); HAL_HASH_MD5_Accumulate(&hhash, (uint8_t *) realm, strlen(realm)); HAL_HASH_MD5_Accumulate(&hhash, (uint8_t *) ":", 1); HAL_HASH_MD5_Start(&hhash, (uint8_t *) password, strlen(password), hash, 0xFF);   HAL_HASH_DeInit(&hhash); }I'm doing something wrong? Has anyone faced the same problem?Thanks for any help.

..

Dear experts,I'd like to try the Secure Access mode of H753, but overwhelmed by the SBSFU and SFI documentation.I'm thinking about a minimal test for the "secure user memory" - without SFI, Secure Package Creator etc., or as little as possible:Burn a small "blinky"-like test at the start of flash, 0x08000000, in normal unprotected mode, and another small test at the next flash page.Then set the option bytes so that my code at 0x08000000 becomes the secure area, and activate secure mode.After reset, the MCU jumps to my test, in secure mode.My test then jumps to the code in another flash page, exiting the secure mode.All this without any other ST functionality in the system bootloader, and no any crypto stuff yet. The question: can this be done without fiddling with the "Root secure services"? is such a demo available? Thanks in advance, -- pa

Hi all,I am writing an application on STMCubeIDE and i need to append the its CRC at the end of the generated hex/bin file. Is there any shortcut or functionality in order to do that on STMCubeIDE? And if not, how would you suggest me to do that? Thanks

The compiler cannot find the function MX_CRC_Init()The reason is that STM32CubeMX 5.3.0 doesn't generate CRC.c for STM32G474 when the CRC module is enabled.The CRC.h header is correct generated.This happens only in the STM32CubeIDE with the integrated STM32CubeMX 5.3.0

Hello,I need to enable CRC on my SPI communications. My STM32H7 is the Master and it will send most of the times 4 bytes commands to the Slave. I have chosen DSIZE = 32 bits to speed up the processing, since the copy of data to the FIFO is done by software in polling mode. As far as I understood in this configuration I have to choose a CRC of 32 bits but this means half of the bandwith is used by CRC. If I want to use smaller CRC size, I understood I have to set a smaller DSIZE but then it will increase the software time (4 copy to FIFO instead of one for example with DSIZE = 8 bits).My question is: did I understand the CRC size constraint correctly ? And what is the explanation to this constraint ?

I tried the SBSFU examples (did not change any code) on a NUCLEO-L476RG board and it worked fine. Now I can not use STM32CubeProgrammer to connect the board. Is there any way to download a new firmware ( I mean, a firmware to replace the SBSFU firmware) to the board again? So that I can use this board for other projects.The configuration of the SBSFU is:/*#define SECBOOT_DISABLE_SECURITY_IPS*//*#define SFU_FINAL_SECURE_LOCK_ENABLE */#define SFU_DEBUG_MODE/*#define SFU_FWIMG_BLOCK_ON_ABNORMAL_ERRORS_MODE*/#define SECBOOT_OB_DEV_MODEThanks!

Hello!I want to use Asymmetric Crypto algorithms like ECC or RSA for my FreeRTOS project running on STM32F051K8. The controller has 64 KB of flash. Since X-CUBE-CRYPTOLIB occupies quite large memory footprint, my FLASH is getting overflowed by the .text area, on linking the X-CUBE-CRYPTOLIB library. I have made following changes to optimize the memory required for X-CUBE-CRYPTOLIB:Disabled everything else (unnecessary #defines) apart from INCLUDE_ECC in crypto.h file Optimization settings in Project properties: -Os optimization for sizeDebug level "none"But still my flash is getting overflowed by around 7000 bytes. Please tell me what else can I do for memory optimization? Otherwise, I might have to change the microcontroller with big FLASH memory. I also have attached error screenshot for the reference.

I am trying to set up the CRC in an STM32L072 to process data from a 1-wire device.In the CubeIDE (editing the .ioc file), if I leave the default values, it will generate an appropriate MX_CRC_Init(void) function.But if I want to set my own polynomial via the UI, I cannot get the UI to accept any input for "CRC Generating Polynomial" and the generated MX_CRC_Init() function is empty.Seems to be broken - or is there some format to the field that I am not following?The 1-Wire polynomial is X^8+X^5+X^4+1. I think the input should be "X8+X5+X4+X0" but this is not being accepted.Default Polynomial State: DisableCRC Length: 8-bitCRC Generating Polynomial: X8+X5+X4+X0What is the correct input? Or is the tool broken?

Hi,I was testing with the Nucleo STM32L476RG board, BSP example project FLASH_DualBoot.I made small changes in the example code (LED blink stuff) and programmed bank 1 and 2 several times. I also manually checked/toggled the option bytes BFB2 bit a few times.When I tried to program the MCU flash bank 2 again with STM32 ST-LINK Utility it said that it's not possible because of read/write protection. I didn't configure it any time before, only using the BFB2 bit in the example code. In the option bytes window I discovered that "Read/Write Protection Bank B" was activated. I couldn't uncheck it, because it says:"To disable Read/Write protection of BANK B, you must set PCROP_RDP bit, and switch RDP from Level 1 to Level 0".Well, both we're in desired state. Power cycle doesn't help. So I tried to trick the MCU by switching from Level 0 to Level 1 to be able to revert from 1 to 0.But it doesn't let me revert from 1 to 0:"ERROR: Could not set Option bytes! Please reset the target and retry."