STM32 MCUs Security

Hi,I am trying to implement readout protection on my stm32f427VG. I want to apply Read protection Level 2 from the user application or bootloader code in the flash. My custom bootloader resides in flash at address 0x00000000.

I found from this question, on May 2017,https://community.st.com/s/question/0D50X00009XkXqzSAF/why-mbedtls-which-is-part-of-stcube-116-release-does-not-contain-hw-acceleration-codethat hardware crypto support was in development for mbedTLS.When we will get an update with this implemented?

I've tried to find an example code of use of crypto harware accelerator in LORAWAN but i haven't been able to find any . Does someone have an example expecially concerning the use of AES CMAC?Regards

I working with the STM32F446-microcontroller and I need to upgrade firmware and change the option bytes on it using the built-in bootloader (en.CD00167594.pdf, AN2606) using SPI-bus (en.DM00081379.pdf, AN4286). I am able to successfully modify all option bytes, except the read protection level (from 1 to 0). In the reference manual (en.DM00135183.pdf) it says that when changing the read protection level from 1 to 0, then the flash will be mass-erased and I would imagine this takes some time. However, I can't find any special instructions in AN2606 on how to do this through the bootloader and whenever I try to change the read protection level, I end up receiving a NAK in the get-ACK-procedure inside the write-memory-command-sequence. Does anybody know the proper sequence for changing read protection level from 1 to 0?

I am working on STM32L151QD MCU. I want to implement CRC feature in my application using STM hardware CRC block.i am trying below steps to configure HW CRC:uint32_t crc; uint32_t t_buffer[4] = {1,2,3,4};  RCC_AHBPeriphClockCmd(RCC_AHBPeriph_CRC, ENABLE);    //Reset HW CRC    CRC_ResetDR();  crc = CRC_CalcBlockCRC(t_buffer, sizeof(t_buffer));  printf("hw crc = %d\n", crc);  if ( CRC_GetCRC() != crc)  {   printf("error in HW CRC\n");  }  RCC_AHBPeriphClockCmd(RCC_AHBPeriph_CRC, DISABLE); /* Turn OFF CRC */  return crc;But every time HW computed CRC is different even if the input buffer is same all the time.am i missing anything?anything else to be configured to get correct CRC ?

..

I'm aware that the STM3240G-EVAL doesn't have a hardware crypto processor, but is it possible to create a software algorithm to do the encryption? Possibly using the X-CUBE-CRYPTOLIB library?

Hello. AllI'm using STM32L151 MCU, stm32 crypto library v.3.0.0.I implemented CMAC according to the sample code but it returned "AES_ERR_BAD_CONTEXT". I could not find any reason.. please let me know to solve this problem.!!Here is my code for CMAC encryption. static AESCMACctx_stt AEScmacCtx = { 0 };// Static function declarations -----------------------// Static function definitions ------------------------static int32_t AesCmacInit( uint8_t * key ){ int32_t result = AES_SUCCESS; AEScmacCtx.mFlags = E_SK_DEFAULT; // 0x00000000 AEScmacCtx.mKeySize = CRL_AES128_KEY; // 16 AEScmacCtx.pmKey = key; AEScmacCtx.mTagSize = CRL_AES_BLOCK; // 16 result = AES_CMAC_Encrypt_Init(&AEScmacCtx); return result;}// Module interface function definitions --------------int32_t AesCmacEncrypt( uint8_t * plainData, int32_t plainSize, uint8_t * key, uint8_t * cmacData, int32_t * cmacSize ){ int32_t result = AES_SUCCESS; result = AesCmacInit( key ); if( result != AES_SUCCESS ) { return

I am trying to use the hardware CRC built into the embedded flash module. When I use the start and end addresses and kick off the CRC, the processor halts and I have to do a full flash erase to get it back. Are the start and end addresses relative to the base of the flash bank? Here is my code:  // Unlock FLASH_CR1/2 register FLASH->KEYR1 = 0x45670123; FLASH->KEYR1 = 0xcdef89AB;   // Enable the CRC feature by setting CRC_EN in FLASH_CR1/2 FLASH->CR1 |= FLASH_CR_CRC_EN;   // Lock the CR1/2 register FLASH->CR1 |= FLASH_CR_LOCK;   // Set crc burst length to 01: 64 flash words (64 * 32 bytes/word = 2048 bytes) // In the link script, the binary must end on a 2048 byte boundary in this case FLASH->CRCCR1 &= ~FLASH_CRCCR_CRC_BURST_Msk; FLASH->CRCCR1 |= FLASH_CRCCR_CRC_BURST_0;   // Check CRC between defined addresses, not by sector FLASH->CRCCR1 &= ~FLASH_CRCCR_CRC_BY_SECT; // FLASH->CRCCR1 |= FLASH_CRCCR_CRC_BY_SECT;   // Set star

I have been using the STM32 serial bootloader, instead of coding my own bootloader, for a while now. But lately I wanted to protect my code, so I tried to enable readout protection (RDP) level 1. This is meant to prevent the user to read the flash. However, after a few attempts, it seems that it is not possible to use this sytem memory bootloader to enable RDP, then start running the code that I put in the flash.From what I understand, running the flash is considered "debugging" access, and is prevented when RDP is active. Is there a way to get around this ? I would like to protect my code from "basic" read access (like JTAG) without coding my own bootloaderThanks

..

Hi everyone,we have a bootloader that writes new application code to the flash bank 2 in an STM32H7 and afterwards swaps the banks to execute the new code. The procedure for swapping is something like this:   unlock OPTLOCK   set SWAP_BANK_OPT   set OPTSTART   lock OPTLOCK   system resetThis works fine with a Level 0 readout protection (RDP). However it is not working with a RDP level 2. The reference manual states that only the SWAP_BANK_OPT bit is adjustable when RDP2 is set. It also states that you have to unlock OPTLOCK before changing SWAP_BANK_OPT.Does this mean if OPTLOCK is set (locked) when RDP2 is active you can not change SWAP_BANK_OPT since you can not modfiy OPTLOCK?So the solution to use SWAP_BANK_OPT would be to unlock OPTLOCK before activating RDP2?Is there any other reason that would prevent IAP when RDP2 is set?

..

Hi, I am wondering if the build-in TRNG modules in the STM32L series (0, 1,2 ,4, 4+ and 5) are compliant with the NIST 800 90A/B/C standards. If so, where I can find information on ST stating such TRNG complies with this standards? We are developing a product for a specific client who is requesting that all TRNG's are compliant with the aforementioned standards.Regards

Hello, what wouldd be the best library to create private/public keys (RSA) and sign some messages ? I did not find a free library able to create and sign messages even in the smt32 crypto lib. Any clues ? Thank you in advance

Could someone elaborate on the tradeoffs of cryptographic scheme selection, especially between Asymmetric with AES encryption and Symmetric (AES GCM) ?While it is the default choice, it is not clear to me why SECBOOT_ECCDSA_WITH_AES128_CBC_SHA256 would be preferable over SECBOOT_AES128_GCM_AES128_GCM_AES128_GCM since according to Table 3 of UM2262 (getting started), storing a private AES key is required in both cases. What are the benefits of the default approach?

I'm taking STM32Cube and the CRYP example for NUCLEO-L496ZG as the basis for a new HW AES encryption Arduino library. I'm currently developing for the STM32L476 MCU and here I found the first problem since stm32l476xx.h does not seem to include the necessary AES register definitions. Anyway, I took these definitions from stm32l486xx.h which does include them.Finally, I was able to compile this example (taken from the STM32Cube distribution) from the Arduino IDE: CRYP_HandleTypeDef CrypHandle; /*##- Configure the CRYP peripheral ######################################*/ /* Set the common CRYP parameters */ CrypHandle.Instance = AES;   /******************************************************************************/ /* AES mode CTR */ /******************************************************************************/   /*===================================================== Encryption CTR mode ======================================================*/ if (HAL_CRYP_DeInit(&

I have the secure boot expansion package and I can't find any documentation at all that details how it integrates into CubeMX and how to install it. This is the expansion package:https://www.st.com/en/embedded-software/x-cube-sbsfu.htmlThanks in advance for any help!

Hi,We were able to successfully port STM secure bootloader(SBSFU) on our custom boards. We could demo the firmware update using Teraterm(also extraputty) on windows machine as recommended by STM. But I was not able to update firmware using any of the terminal on linux(tried minicom, cutecom) or MAC(serial). Do you have any recommendation or a possible solution to this problem?Thanks in advance,Arjun

Hello,In secured boot getting started it is said:"Download the SB SFU project software to the target without starting a debug session(Security protections managed by SBSFU forbid JTAG connection as it is interpreted as anexternal attack)"Does it mean it should be done using IAR: Project->Download->Downloading File ?Isn't it still using JTAG even if it is not yet debug ?Thanks,ranran

Hello everyone,I'm tring to implement a calculation of firmware CRC in run time mode.Is there inker command method to acquire last address where code is written?I'm quite confident there is a specific command like __text_end__, for example.Best regrds

Hi everybody,I wonder if it is possible to configure the X-CUBE-SBSFU expansion to use external serial flash chip instead of internal memory. Any ideas, application note?regardsMikhail

Hello,Can X-CUBE-SBSFU source code work with STM32H7 (STM32H743) too ?In the getting started it is said:"It comes with an example implementation running on the NUCLEO-L476RG, NUCLEO-L432KC, B-L475E-IOT01A, 32L496GDISCOVERY, NUCLEO-G071RB, 32F413HDISCOVERY, and 32F769IDISCOVERY platforms.".Thank,ranran

Hello.I downloaded and tried your "Secure boot & secure firmware update software expansion for STM32Cube" solution.https://www.st.com/en/embedded-software/x-cube-sbsfu.htmlIt works great on my Nucleo-64 board, and the next step what I wanted to do is port it to my own MCU (STM32F2xx).Here comes my question: Do you have any guide that shows step-by-step what to do exactly?I started with SECoreBin. I created a project for my own MCU. Changed the HAL, but got errors. I realized that, my MCU had sectors, instead of pages, okay, I changed that to fit my needs. Then I still got errors regarding the CRC, okay I changed that also. etc. etc. etc. Now I can compile everything (in the SECoreBin project), but I get linker errors. I probably have to change something in the linker script.So the bottom line is: whatever I do, I face a new problem. I am kinda lost in this work. This is why I need some kind of step-by-step guide. If such thing exists.Or an alternative question: Can I request an off

Hi guys,I am testing the CRC hardware of the STM32F722ZE in the NUCLEO board, but doesn't get a right result.The CRC keys are: Poly=0x1021 and INIT value=0x1D0FMy two data input of 16-bit wide is: [0]=0x0031 [1]=0x0032.Some CRC calculators gives 0xEA94, but STM32 gives 0x5197My code: // config   CRC->INIT=0x1D0F;            // init value   CRC->POL=0x1021;            // Poly   CRC->CR=0x0008;               // No reverses. 16-bit poly// calculating function:   uint16_t val;   CRC->CR|=CRC_CR_RESET;      // Reset   while (length>0)   {      val=*data;      CRC->DR=val;   &