STM32 MCUs Security

Hello ST team,We are working with the STM32WL5MOC6HTR module for a LoRaWAN end-device design.We understand that the STM32WL5MOC6HS variant includes an STSAFE-A110 secure element, but our custom module (MOC6HTR) does not include STSAFE.Our question is about securely storing LoRaWAN keys such as:AppKeyNwkSKeyAppSKey We are exploring options like:Using the LoRaWAN Crypto middleware (Middlewares/Third_Party/LoRaWAN/Crypto) with the internal AES peripheral,Leveraging SBSFU (Secure Boot and Secure Firmware Update) for Flash protection (RDP/PCROP),Or possibly using KMS-MW (Key Management Services Middleware). Could you please confirm:What is the recommended approach for securely storing LoRaWAN keys in the STM32WL5MOC6HTR, where STSAFE is not present?Can KMS-MW or SBSFU be used on this device to provide a secure key storage area or API abstraction similar to a secure element?Are there reference examples or application notes for integrating LoRaWAN key storage with SBSFU or KMS on ST

Hello! I want to implement secure boot / secure firmware install on my STM32u5A9 custom board. I am starting by trying to modify the SBSFU example code from B-U585I-IOT02A example project to run on my board. I followed the instructions in the README to tailor the project for STM32U5A9. I also made the following changes:My debug terminal is connected to UART5 so I modified the com.h file (attached snippet below)I also changed TFM_TAMPER_ENABLE in boot_hal_cfg.h to NO_TAMPER as I was initially having trouble with that engaging during my testing.I uncommented the MCUBOOT_EXT_LOADER in Linker/flash_layout.h as our custom board has an external flash chip but its pinout is different than the standard dev boards and I have not gotten any of my attempts at a custom loader to work. I’m trying to get secure boot working without an external loader first.Running SBSFU_Update.sh (as is from the B-U585I-IOT02A project)  results in successful programming and verification of sbsfu_app_init.b

We have an application running on an STM32WB55M. This user application makes use of standby mode, and the device is able to exit it when the configured pin changes state.However, once the SBSFU is integrated with the BLE_ota application, the user application works correctly, we can perform OTA updates, but when entering standby mode, the device does not wake up/resets.In another different product, where standby mode is not used, everything operates correctly.What could be causing the system not to exit standby mode when the SBSFU is integrated? I know the system restarts upon exiting standby mode, do I need to configure something before entering standby mode? (Restarting the application with the 'NVIC_SystemReset' function, as I do when entering OTA mode, works correctly).Thank you in advance.

Hello,STSELib development is under progressToday (version 1.1.4), STSELib uses some services from STM32_Cryptographic library instead of interfacing STSAFE-A120 component (for example HKDF)Is there any development planning for STSELib giving availability of next versions and their content ?Thx

hello, I'm run a STM32H573DK in OEMiROT example.but following errors occured.[INF] TAMPER Activated[INF] BANK 1 secure flash [0, 15] : OB [0, 14][ERR] Unexpected value for secure flash protection so, I find why occurred this error.  In the ob_flash_programming.bat file, sec1_end was set to 0x0E. but In the code end value is set to 0x0F end = (S_IMAGE_PRIMARY_PARTITION_OFFSET + FLASH_S_PARTITION_SIZE - 1) / PAGE_SIZE;( end = 0x1E000 / 0x2000 = 0x0F ) what is correct? what do i fix?  ps. I'm using STM32Cube_FW_H5_V1.1.1 

Hello @Jocelyn RICARD ,I’m integrating SBSFU v2.7.0 on an STM32WB55 to enable secure OTA firmware updates. I’m hitting a problem where the runtime hash verification fails: the hash computed by SBSFU at boot does not match the hash in the image header, so the image is erased.I dump the decrypted bytes in RAM (before programming) over LPUART and convert them to a binary for comparison with the build output. Assuming the dump/conversion are correct, the streams match up to ~60 KiB, then diverge consistently until the end of the file. This suggests the symmetric key is correct and the early pipeline is fine, but later bytes are corrupted before or during the decrypt-in-place / program sequence.Here is how printing every decrypted chunk within DecryptImageInPlace function:For context, I'm using:Internal MCU flashSingle-bank (no swap/rollback)OTA via ST BLE Sensor appProtections temporarily disabled for debugging; verbose logs enabledWhat worksRan 1_Image example on NUCLEO-WB55RG succes

 Hello everyone,I am working with the STM32H7B3-DK and evaluating the SBSFU package with a dual image slot configuration using SECBOOT_ECCDSA_WITH_AES128_CBC_SHA256. I have a few questions and kindly request your guidance:Please confirm if we can load sbsfu.bin or sbsfu.out via USART with BOOT0 = 1 and then program UserApp.sfb via the secure bootloader (BOOT0 = 0). Do we need a header bin? If yes, how can we merge only sbsfu.bin and the header bin while excluding UserApp.bin?With RDP Level 2 set, is it still possible to update UserApp.sfb via USART when BOOT0 = 0?Can SFU_SECURE_USER_PROTECT_ENABLE be enabled or disabled during development, and can reprogramming still be done via USART or SWD outside development mode?During development, can we disable all security IPs, load sbsfu_userapp.bin, and later enable protections over USART followed by a power cycle? Is this workflow possible?If RDP Level 1 is configured, can option bytes and protections (PCROP, secure user area) be reset v

Hello,I’m working on STM32H7 firmware using the STM32 Cryptographic Library (CryptoLib) for firmware decryption.I have the following scenario:Firmware is encrypted with AES128-GCM.Integrity and authenticity are verified separately using ECDSA + SHA-256.I want to decrypt firmware using AES-GCM in counter mode (CTR) without relying on the GCM authentication tag.My questions are:Does AES-GCM in STM32 CryptoLib support CTR-only operation, bypassing the Galois-field authentication step?If not, is there a recommended way to perform AES-CTR decryption using CryptoLib on STM32H7 without tag verification?Are there any known limitations or caveats when skipping GCM tag verification in STM32H7 CryptoLib?Thanks in advance for guidance.@Jocelyn RICARD @Fred 

To secure USB against unauthorized usage while maintaining regular operation, implement authentication and encryption for all USB communication, ensuring only authorized devices or users can access the interface for parameter and log management, open-source information, and updates.1. how to enable and disable the stm32 for booting using a debug probe / stm32 flasher from unauthorized access2. How to enable and disable the USB access from Unauthorized access3. Even after locking also authorized user can read and write in the stm32we can do it manually by setting the RDB for read access and WRP for write access but we want it to do it at runtime in software.    

Hi All,  Does anyone know how to enable the MCO2(PC9) output after secure manager enabled? its work in project without secure manager and it could be enabled in systemClock config function as below:  ,but it's not work any more after secure manager on,and we could not call system clock config any more(the demo in repository v1.5.0 are calling).Summarize:1.How to enable MCO2 output in non-secure application;2. It seems after trustzone enabled, rcc would not work in non-secure side, is the demo on repository right or not(call system clock config)? Thanks!  

Hi,I am trying to send encrypted data between a C# application and STM32 in AES GCM mode.Currently, I am only doing encryption of a known test vector.Key and IV are both all zeros.AAD length is 0.My testvector is: 00 00 00 00 00 01 00 00 00 00 00 00 00 00 42 49Using the code below, I get the same ciphertext in both applications:03 88 DA CE 60 B7 A3 92 F3 28 C2 B9 71 B2 BC 31 But the tag never matches.I suspect there is something wrong in the final stage, where the tag is calculated.void AesTest() { uint8 iv[12]; uint8 plainText[] = { 0x00, 0x00, 0x00, 0x00, 0x00, 0x01, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x42, 0x49 }; uint8 header[0]; uint8 cipherText[sizeof(plainText)]; uint8 authTag[16]; memset(iv, 0, sizeof(iv)); uart_printf("ENCRYPT\r\n"); if (!AesEncryptGcm(iv, header, sizeof(header), plainText, sizeof(plainText), cipherText, authTag)) return; } bool AesEncryptGcm(const uint8 *iv, const uint8 *header, uint8 headerLen, const uint8 *plainText, uint16

Dear,For a given HDPL, how many 256-bit AHKs (Application Hardware Keys) can be stored in the option byte keys?And how many of those are:only usable by SAES?usable by software?The reference manual states the following:5.2 FLASH main features:"Up to 1 Kbyte of protected non-volatile option byte keys, readable either by software orusable as a secret AES key through SAES peripheral (as AHK keys)"It is unclear whether this is for just one HDPL, or whether this is a grand total comprising all three HDPLs that support option byte key storage (HDPL0, HDPL1, HDPL2).Suppose it is for just one HDPL, then this would be able to store 32 (= 1 K byte * (8 bit / byte) / 256 bit) 256-bit AHKs. This seems to be a reasonable assumption since if it were for all three HDPLs, this number would have to be divisible by 3, which it is not (32/3 = ~10.667).5.9.18 FLASH option byte key control register (FLASH_OBKCR):"OBKSIZE[1:0]: Option byte key sizeApplication must use this bitfield to specify

How can the debug interface on the STM32H573 be permanently locked via nonvolatile configuration or fuse?The SBS chapter of the manual saysThe debug configuration can be locked thanks to DBGCFG_LOCK in SBS_DBGLOCKR.SBS_DBGCR is then no longer writable.When DBGCFG_LOCK is set to 1, it can be reset only by system or power-on reset.So SBS_DBGLOCKR is not what I want, as it is not permanent.The manual refers to PRODUCT_STATE in several places. The "SBS Signals" table in the manual says that the sbs_product_state signal comes from Flash memory:Signal based on PRODUCT_STATE option byte to activate the different securitymechanisms depending on the product use. Expected values are described inSection 7: Embedded flash memory (FLASH).However, there is no mention of this signal in Section 7. What is the Flash programming procedure to change sbs_product_state?

Hello,We are working on an STM32F469/79-based device that uses SBSFU, which we are seeking to modify to use the STSAFE-A120 to perform the authentication and decryption algorithms.Section 2.7 of the STSAFE-A120 datasheet includes that the STSAFE-A120 supports the following symmetric ciphers for encryption and decryption.AES in CCM*/CTR modeAES in CBC modeAES in ECB modeAES in GCM/GMAC modeSection 4.7 of the STSAFE-A120 datasheet includes that the STSAFE-A120 supports symmetric decryption by chunks via the "Start decrypt", "Process decrypt", and "Finish decrypt" commands.We planned to use X-CUBE-STSE01 (v1.0.0) to interface with the STSAFE-A120. However, we were surprised to see that AES-CBC decryption does not seem to supported. This prevents us from using the STSAFE-A120 with SBSFU crypto scheme "SECBOOT_ECCDSA_WITH_AES128_CBC_SHA256". X-CUBE-STSE01 seems to also lack support for AES-GCM decryption by chunks. This prevents us from using the STSAFE-A120 with SBSFU crypto

If, like me, you are attempting to use this device and believe there are gaps in the information available, you are correct. However, the information you seek, plus additional advice and assistance is available from ST, you simply have to ask via a ticket on ST.COM. I will update this post when I have completed my project.

What is the meaning of the FLASH_OBKCR.NEXTKL field while executing within HDPL_0 (e.g., during execution of ST RSS)?This question might seem irrelevant to me as I'm a user and user code will never execute within HDPL_0, but it might be important from a threat modeling point of view: does ST (by means of its RSS code) have access to HDPL_x user-provisioned AHKs (Application Hardware Keys) where x >= 1?The reference manual states the following:5.9.18 FLASH option byte key control register (FLASH_OBKCR)"NEXTKL[1:0]: Next key level00: OBKINDEX represents the index of the option byte key stored for the hide protection levelindicated in SBS_HDPLSR.01: OBKINDEX represents the index of the option byte key stored for the hide protection levelindicated in SBS_HDPLSR plus one (e.g. if HDPL=1 in SBS_HDPLR the key of level 2 isselected).10 or 11: reserved"Does this mean ST RSS (HDPL_0) can access:HDPL_0 AHKs (when NEXTKL=00)HDPL_1 AHKs (when NEXTKL=01)but not:HDPL_2 AHKs (no applicable NEXTKL v

Post edited by ST moderator to be inline with the community rules especially with the code sharing. In next time please use </> button to paste your code. Please read this post: How to insert source code Hello, I need to calculate SHA-256 on STM32L562 MCU. I need a final single Hash output digest for an input of 8192 keys where each key is of 32 bytes. I am accumulating each key using: HAL_HASHEx_SHA256_Accmlt(&hhash, data, 32); upto 8191 keys. The final key i.e. 8192th key is fed to Hash engine using: HAL_HASHEx_SHA256_Accmlt_End(&hhash, last_data, 32, out_digest, 0xFF);  Using this above approach I understood that a final "out_digest" will result a final 32-byte Hash value but I am not obtaining the correct Hash. I tried to reduce keys from 8192 to 2048 thinking that a small data may be processed correctly by Hash processor but still got the wrong Hash value. Instead of accumulating keys one by one, if I take a buffer of size (2048 * 32) bytes and accumul

Hi,I'm working on STM32L496 for some security application, as per L4 series documents I see that L4 series controllers has AES hardware, but in my IOC settings under security option I don't see the AES. Why is this? does it mean STM32L496 doesn't have AES hardware inbuilt? if yes is there any software approach?Thanks

Hi Team,  I am trying to add a Secondary/custom bootloader in SBSFU. But not able to figure it out how to do it. I changed memory for active slot area and used the same area for custom bootloader in both linker file of both SBSFU and custom bootloader application. But does not work as expected. Can you please guide me through this?  I need to add a Custom bootloader and trigger user application from it. What are the modification that I need to do for this. I am using STM32H753 board. @Jocelyn RICARD 

HiI've been trying to understand what level of support is available for the H573 security features in Zephyr RTOS with mcuboot but either can't find any information or no one replies to my comments.I have a Zephyr sysbuild build working where mcuboot starts, validates the singed application in slot0 and proceeds tp boot from slot0.What I can't find or confirm is if that security features of the STM32H573 are being used or not. There doesn't seem to be any configuration relating to enabling or disabling the features.Are the security features enabled in Zephyr for the H573?I'm using the latest 4.2 version of Zephyr.CheersDave

I'm currently working on a final project titled "Design and Communication Security Mechanisms in an Embedded Gateway Module for Electric Vehicle Networks." I'll be creating a security mechanism using AES-128 and a hash function, and securing data from Ethernet communication protocols. I'd like to ask:1. How can I integrate Ethernet communication and security using the STM32F767ZIT6? 2. How can I create an encryption and decryption mechanism using AES-128 cryptography on the STM32F767ZIT6?

Hi, I've been working on porting the SBSFU onto a STM32H7A series with my custom gcc-arm build environment.The example project I am referring to is: x-cube-sbsfu-v2-7-0\STM32CubeExpansion_SBSFU_V2.7.0\Projects\STM32H7B3I-DK\Applications\2_Images.Everything seems to be working fine, but I have one issue that I am struggling with. So, the main SBSFU is supposed to call SE_CallGate() being the entry to the core secure engine, and it gets rebooted constantly. And, what I found is that the reboot doesn't happen if I get "IS_CALLER_SE_IF()" commented out.  // se_callgate.c SE_ErrorStatus SE_CallGate(SE_FunctionIDTypeDef eID, SE_StatusTypeDef *const peSE_Status, uint32_t PrimaskParam, ...) { SE_ErrorStatus e_ret_status; va_list arguments; volatile uint32_t LR; #if defined(__CC_ARM) || defined(__ICCARM__) LR = get_LR(); #elif defined(__ARMCC_VERSION) __asm volatile("MOV %0, LR\n" : "=r"(LR)); #elif defined(__GNUC__) register unsigned lr asm("lr"); LR = lr; #endif /*

This works fine in an app without SM but when I run this from a non-secure app together with SM, the last step fails. This is the code: // Enable access to RTC and backup domain HAL_PWR_EnableBkUpAccess(); if (__HAL_RCC_GET_FLAG(RCC_FLAG_LSERDY) == RESET) { // Reset the backup domain (equivalent to LL_RCC_ForceBackupDomainReset) __HAL_RCC_BACKUPRESET_FORCE(); __HAL_RCC_BACKUPRESET_RELEASE(); // Ensure LSE is OFF and NOT in bypass mode CLEAR_BIT(RCC->BDCR, RCC_BDCR_LSEON | RCC_BDCR_LSEBYP); // Set drive strength for startup (must be done while LSE is OFF) __HAL_RCC_LSEDRIVE_CONFIG(RCC_LSEDRIVE_MEDIUMHIGH); // Enable LSE __HAL_RCC_LSE_CONFIG(RCC_LSE_ON); // Wait until LSE is ready, with timeout if (SYSTIMER_WaitFlag(&RCC->BDCR, RCC_BDCR_LSERDY, true, 20000000)) { } else { // Disable LSE __HAL_RCC_LSE_CONFIG(RCC_LSE_OFF); // LSE activation error, handle as appropriate status = HAL_TIMEOUT; } // Select LSE as RTC clock source __HAL_RCC_RTC_CONFIG(RC

Hi, I'm using 3 channels of ADC4 with GPDMA1 (channel 4) in secure world of a TrustZone-project and the DMA-buffer stays always 0. The same ADC/DMA-configuration with the same application code (all mnus the security aspects) are working fine without TrustZone on the same hardware. I set the DMA-channel and the ADC-channel to secure and privileged, also the SAU-configuration for these peripherals is secure, the DMA-interrupt (circular) is triggered and calling HAL_ADC_ConvCpltCallback but there's nothing inside the DMA-buffer (which is defined as volatile inside a secure and privileged SRAM-area). I've tried different ADC conversion rates, clock rates and clock sources, checked for errors (especially overruns) and secure faults (with GTZC), there's absolutely nothing. I guess it must have something to do with secure/privileged areas or peripherals but since all the parts are secure and privileged I don't know what it could be. I'd be thankful for any suggestions; here is my ADC DMA-init

HelloWe are considering STM32 based processor for our next generation of products and would like to talk to a security expert with ST to discuss achieving CRA compliance.The "contact" page on the website down not provide a way to contact ST in the UK.