STM32 MCUs Security

Hello everyone,I am trying to use TLS 1.3 with Mbed TLS on an STM32H573 through the Secure Manager’s Global PSA API.At the moment, I am seeing the following errors: psa_sign_hash() / psa_sign_message()→ PSA_ERROR_NOT_PERMITTEDpsa_generate_key() / psa_import_key()→ PSA_ERROR_GENERIC_ERRORThe persistent ECC keys are provisioned with the required signing permissions, and both the Secure Manager and the non-secure application start correctly.Some TLS 1.3 HKDF operations had to be implemented locally because the PSA Crypto API version in use is 1.0 and does not provide separate HKDF-Extract and HKDF-Expand algorithms.My questions are:Are persistent ECC keys supported with psa_sign_hash() through the Global PSA API? Does the Secure Manager support volatile keys with psa_generate_key() and psa_import_key()? Are additional permissions or a Secure Module required? Is there a support matrix or an official TLS 1.3 example for this setup? Does anyone have experience with Secure Manager and MbedTLS

Hello ST Community,I am facing a critical issue while configuring OEMiRoT on an STM32H523 device. I used the official provisioning project from the NUCLEO-H533RE example in STM32Cube_FW_H5_V1.7.0 (since there is no dedicated H523 example). I need help recovering the device.Background: I‘ve modified the <DoEncryption> value to 0 according to ‘How to create ROT examples for STM32H5’. I ran the provisioning project (from the NUCLEO-H533RE example) to configure OEMiRoT on the target STM32H523 device. During provisioning, the configuration failed and the product state became Provisioned. After that, the device could no longer be connected via ST-LINK SWD. DA also failed. Then I regenerated a new Key file to confirm if there was any problem during the configuration process. I still have the private key file key_1_root.pem . But the public key file key_1_root_pub.pem and certificate file cert_root.cert have been overwritten. So I tried the method provided by the AI assistant to

Hello,I am using an STM32H573 with Secure Manager and Mbed TLS / PSA Crypto for a TLS 1.3 implementation.Persistent private keys provisioned into the Secure Manager work correctly. For example, I have a persistent P-256 private key provisioned through the ITS Factory Blob and can successfully use it for ECDSA signing.The problem occurs when Mbed TLS tries to dynamically generate temporary keys during the TLS 1.3 handshake.For example, a call similar to: psa_key_attributes_t attributes = PSA_KEY_ATTRIBUTES_INIT;psa_key_id_t keyId;psa_set_key_type( &attributes, PSA_KEY_TYPE_ECC_KEY_PAIR(PSA_ECC_FAMILY_SECP_R1));psa_set_key_bits(&attributes, 256U);psa_set_key_usage_flags( &attributes, PSA_KEY_USAGE_DERIVE);psa_set_key_algorithm( &attributes, PSA_ALG_ECDH);status = psa_generate_key( &attributes, &keyId);returns: PSA_ERROR_NOT_PERMITTED-129The same behavior can also be reproduced with dynamically generated AES keys, so it does not seem to be s

The following repository contains examples for creating 'normal' type of external loaders, i.e., to be used with the "-el" argument of the STM32CubeProgrammer (e.g., with output "STM32CubeProgrammer/bin/ExternalLoader/MX66UW1G45G_STM32H7S78-DK.stldr"):https://github.com/STMicroelectronics/stm32-external-loader Where can the source code examples be found for the 'SFIx' type of external loaders, i.e., to be used with the "-elbl" argument of the STM32CubeProgrammer (e.g., with output "STM32CubeProgrammer/bin/ExternalLoader/MX66UW1G45G_STM32H7S78-DK-SFIx.stldr")?

So have an STM32H563 that I was trying to get to work with DFU. I read through the Docs and saw that for that to work I needed PRODUCT_STATE in Open with Boot Pin high or PRODUCT_STATE in Providing. I tested the first option and couldn’t get that working and so figured to test if the Boot Pin was the issue I set the PRODUCT_STATE to Providing. It still didn’t work, however the more important issue now is when I was trying to set it back to Open it wouldn’t let me do that. I then flailed a little and think I may have set the PRODUCT_STATE to Closed or Off or something and saved that. Now, I can’t get back into the chip at all. I get either this error:  Or if I try it in Under Reset mode I get this error: So Im wondering, did I completely brick this chip, is there a way to check that, and if I didn’t, what can I do to get this to let me back in

Hi,We’ve been trying to implement secure-boot on our STM32H573-based device and the new code boots fine when the product state is OPEN. From what I understood, the PROVISIONING state does not boot the user code, and we thus need to put the device in iRoT-Provisioned to see if our boot chain works as expected.More info about our setup: Part: STM32H573AIIxQ DBGMCU_IDCODE (0x44024000): 0x10076484 Boot: STiRoT (BOOT_UBE=0xC3), TZEN=0xB4 Layout: secure app at 0x0C000400 (24 KB), non-secure app at 0x08006400 Software: STM32CubeMX-generated project, STM32Cube H5 HAL Debug: ST-LINK + OpenOCD, debug authentication (certificate chain), session reports Secure stateBack to the topic, I can see that te PKA register interface is fully alive, but the PKA compute engine never starts once thedevice is in iRoT-Provisioned product state. HAL_PKA_Init() spins in PKA_WaitOnFlagUntilTimeout() waiting for PKA_SR.INITOK, times out after 5 s, and the application lands in Error_Handler().The exact same binary a

I am working with the official X-CUBE-SBSFU package and I need to port the example that is provided for NUCLEO-H753ZI (STM32H753ZI) to my custom board based on STM32H733ZGTX.This is the closest official example available for my MCU. There is no .ioc file and the whole project structure (SECoreBin + SBSFU + UserApp) is built specifically for the H753ZI.I have already read AN5056 (Integration guide for the X-CUBE-SBSFU). It explains the hardware adaptations and especially the memory mapping changes (mapping_sbsfu / mapping_fwimg), but it does not give a clear step-by-step procedure for changing the target MCU itself (startup files, linker scripts, CMSIS device headers, project settings, etc.).Could someone from ST or the community please advise on the recommended and proper way to perform this port?Specifically I would like to know:The correct sequence of steps to change the target device from STM32H753ZI to STM32H733ZGTX in the three projects (SECoreBin, SBSFU, UserApp). How to properly

On an STM32L552ZE with TZEN=1, RDP=0xAA (Level 0) and BOOT_LOCK=1, the STM32CubeProgrammer command -rdu reported success while explicitly stating that no option byte was modified. From that command onward the device is permanently inaccessible: DAUTHSTATUS shows secure invasive and non-invasive debug disabled, every FLASH register (secure and non-secure alias) fails even on read, and the documented RDP regression path (RDP=0xBB → RDP=0xAA TZEN=0x0) can no longer be executed because option byte programming requires those registers.We would like to understand whether this is expected behaviour, and whether any recovery path exists.Hardware and toolsItem Value Device STM32L552ZE-Q on NUCLEO-L552ZE-Q Device ID 0x472, Revision ID Rev Z (DBGMCU_IDCODE = 0x20016472) ST-LINK onboard, firmware V2J48M35 (also reproduced with V2J47M34) STM32CubeProgrammer 2.23.0 (also reproduced with 2.22.0) Supply 3.26–3.27 V, separate USB port BOOT0 (PH3) tied to VCC during all operations de

Hello,I am integrating Mbed TLS with TLS 1.3 on an STM32H573 using the STM32 Secure Manager PSA interface.The TLS 1.3 handshake fails at: psa_key_derivation_setup( &operation, PSA_ALG_HKDF_EXTRACT(PSA_ALG_SHA_256));The returned status is: PSA_ERROR_NOT_SUPPORTED /* -134 */I tested the relevant algorithms separately: PSA_ALG_HKDF(PSA_ALG_SHA_256)→ PSA_SUCCESSPSA_ALG_HKDF_EXTRACT(PSA_ALG_SHA_256)→ PSA_ERROR_NOT_SUPPORTEDPSA_ALG_HKDF_EXPAND(PSA_ALG_SHA_256)→ PSA_ERROR_NOT_SUPPORTEDThe generated algorithm ID is correct: PSA_ALG_HKDF_EXTRACT(PSA_ALG_SHA_256) == 0x08000409UI also traced the call through the Non-Secure PSA client. The request reaches the Secure Manager via nscall(), and PSA_ERROR_NOT_SUPPORTED is returned in psa_reply->status.My questions are:Does STM32 Secure Manager support PSA_ALG_HKDF_EXTRACT and PSA_ALG_HKDF_EXPAND? Is support dependent on the Secure Manager or SMAK version? Is TLS 1.3 with Mbed TLS officially supported with Secure Manager as PSA backend? Is

Hello,I have taked a look at this post:  I’m trying to do same at a H533 project: a non secure App (without trust zone), I have the same issue, the example works well, but when I try to use without secure image the example doesn’t work. Will be great to have support from ST.Kind regards

Using on a STM32H563RI with trustzone for a secure bootloader and non-secure application. Both the secure and non-secure side were correctly working in OPEN state, and I did a test of going to a CLOSED state and regression back to OPEN with authenticated debug. After the regression, RTC_EnterInitMode(), times out trying to enter init mode and HAL_RTC_Init() fails. I tried the solution from this form post of calling HAL_PWR_EnableBkUpAccess() and that did not work.Notes:- Trustzone and the secure watermarks for the bootloader were reprogrammed in the option bytes after regression.- RTC is LSI as its clock source.- The call to HAL_RCCEx_PeriphCLKConfig() in HAL_RTC_MspInit() returns HAL_OK.- The RTC pheripheral is marked non-secure.- The code has not been changed since preforming the regression and was working previously. The RTC Init Code and Clock configs are included below.void MX_RTC_Init(void) { /* USER CODE BEGIN RTC_Init 0 */ /* USER CODE END RTC_Init 0 */

I am working on a project on a STM32H563 with trustzone enabled. Our firmware update strategy relies on using the dual bank flash and swapping when needed. I was wondering if you can set the SWAP_BANK option byte and trigger a bank swap from non-secure code with SECBOOT_LOCK not set?. I am asking because do not I want a hacked non-secure application to be able to trigger a bank swap to potentially untrusted code on the other bank. I could not find a clear answer in the reference manual.

Hello ST Community,I have an STM32H563 (Rev X) that appears to be stuck in the Provisioning state and I am trying to recover it.Hardware / ToolsMCU : STM32H563Device ID : 0x484Revision : Rev XSTM32CubeProgrammer : v2.23.0Probe : ST-LINK V3SETST-LINK FW : V3J16M9B5S1 NRST is connected to the ST-LINK and Debug Authentication discovery is working.Current Option BytesPRODUCT_STATE = 0x1TZEN = 0xB4 (TrustZone enabled)BOOT_UBE = 0xB4 (OEM-iRoT selected)SECWM1_STRT = 0x0SECWM1_END = 0x7FSECWM2_STRT = 0x0SECWM2_END = 0x7FWRPSGn1 = 0xFFFFFFFFWRPSGn2 = 0xFFFFFFFFLOCKBL = 0x0HDP1_STRT = 0x1HDP1_END = 0x0HDP2_STRT = 0x1HDP2_END = 0x0 SymptomsI can: - connect through ST-LINK V3- read option bytes- read flash- erase sectorsI cannot:- perform Mass Erase- change PRODUCT_STATE back to 0xED Attempting: PRODUCT_STATE = 0xED results in:Expected value for Option Byte "PRODUCT_STATE": 0xEDfound: 0x17Option Byte Programming failedOr modified by application after OB_LAUNCH Debug Authentication DiscoveryUsing:

We are interested in incorporating the STSAFE-A120 authentication chip (part number: STSAFA120S8SPL05) into our current design. However, the available datasheet lacks the necessary details for firmware development. We would highly appreciate your help and guidance on this matter. 

On the STM32C542RC, this is my current FLASH layout:-- OEMiRoT flash layout:-- Bootloader : 0x08000000 .. +0x10000-- Keys : +0x10000 (0x2000)-- NV counters : +0x12000 (0x2000)-- Primary app slot : 0x8014000 size=0x16000-- App code (post-hdr) : 0x8014400 size=0x15c00-- Secondary app slot : 0x802a000 size=0x16000-- OEMiRoT option bytes to program:-- HDP1_END = 0x9 WRPSGn1 = 0xfe00Everything is working well (update of user application, boot, etc...) (MCUBOOT_USE_HASH_REF is not defined).But I have an issue:I want to use the external User Data Flash at the address FLASH_EXT_USER_BASE 0x08400000UL, requiring the option byte EDATA_EN = 0. When I read from that address in the User Application, I only read zeroes (RAZ) -- simple as `*(const int *)FLASH_EXT_USER_BASE == 0`, so this feels like the cause is some sort of HDP. By the way, the writes do work (at least when the MCU is reset, as STM32CubeProgramm

Hi everyone,I am working with an STM32U5 device and have enabled TrustZone (TZEN = 1)  using STM32PROGRAMMERI created both the Secure and Non-Secure projects, and they compile and program successfully.ProblemAfter downloading the firmware from STM32CubeIDE:Programming completes successfully. The application does not start automatically. My LED does not blink.However:If I press the hardware RESET button, the LED immediately starts blinking. If I start a Debug session, the LED also starts blinking.So the firmware itself appears to be correct because it works after a reset.What I have verifiedTrustZone (TZEN) is enabled. Secure and Non-Secure projects are generated by CubeMX. Secure project jumps to the Non-Secure application. Programming finishes without any errors. The issue only occurs immediately after programming. Without TrustZone, the application starts automatically after programming.My questionIs this expected behaviour with STM32U5 TrustZone?Has anyone experienced the same issue

Hello,I have created a framework for OEMiROT + OEMuROT boot path wherein I have tried implementing a two-boot stage. This boot path isn’t included in the ST template examples unlike that for OEMiROT or STiROT_OEMuROT. I was able to run both existing examples on my board correctly.For OEMiROT + OEMuROT boot path, I have made changes in the scripts specific to boot paths and UBE. The memory layout is also defined depending on the image sizes where I am using the flash memory divided for OEMiROT, OEMuROT , secure application and nonsecure application referring the below boot path when TZ is enabled. Post reset the control jumps to OEMiROT in this case.I could write the OEMiROT binary at base address 0x8000000 and OEMuROT at 0x800E000 using the scripts.I am able to verify if they are flashed by reading the respective memory addresses using ST programmer. I could see the non-zero or non-FF values at both memory addresses. I have shown one for base address 0x8000000 Besides the images gettin

In STM32Cube_FW_H7RS_V1.3.0, file Projects/STM32H7S78-DK/Applications/ROT/OEMiROT_Boot/Inc/flash_layout.h:The macro OEMIROT_LOAD_AND_RUN has 3 possible settings, and we're using the NO_LOAD_AND_RUN to execute code (in external flash) in place.However, we're also using external RAM in our application, and this must be enabled in the bootloader, as the app attempts to initialise values in external RAM at startup.Unfortunately, the external RAM is only initialised if you select LOAD_AND_RUN_EXT_RAM.There is a workaround: in boot_hal.c and low_level_ext_ram.c, replace every instance (3 in each file) of:#if (OEMIROT_LOAD_AND_RUN == LOAD_AND_RUN_EXT_RAM)...with something like:#if 1// (OEMIROT_LOAD_AND_RUN == LOAD_AND_RUN_EXT_RAM)For the future, would you consider having an option to run in place and enable external RAM?Thank you.  

 Hello,We use MB1551 TFM example project on our industrial board. For technical reason, we have modified the card entry point from USART1 to USART3.(TFM\TFM_SBSFU_Boot\Src\low_level_com.c, “COM_INSTANCE”)(TFM\TFM_Appli\Secure\Src\low_level_com.c, “COM_INSTANCE”)The log of SBSFU doesn’t appear on UART target.So next, we are trying to debug TFM SBSFU of a STM32U585 project as shown in this tutorial : We use the SBSFU script “regression.sh” and flash SBSFU, loader, secure and unsecure application with “TFM_UPDATE.sh”.The JTAG connection works correctly to open CubeProgrammer and read option byte for example.Finally, we set the tutorial debug configuration and launch the debug without error. Debug launch but stop with this message :After, we can only stop the simulation or terminate it.  We have couple of questions.First of all, can we come to the conclusion that our MCU is booting ?Secondly, Is it possible to change USART1 to USART3 as we did ?Why do we have break point before the debug s

Hello, I am working and trying to boot Nucleo - STM32H533RE board. I could successfully boot board using one stage bootloader OEMiROT, but I want to board to boot board with two stage boot path that to to without using STiROT.Looking at wiki page, I could see this can be achieved on Nucleo board I have, but there is no working example in the latest STM32Cube_FW_H5_V1.6.0 package I have.I could see boot path example for STiROT + OEMuROT example but no example for OEMiROT + OEMuROT.I need to know whether I can achieve booting of Nucleo STM32H533 board with desired boot path i.e. OEMiROT + OEMuROT (as encircled with blue color) and if yes is there any support with relevant data available?Regards,Satish 

Hi,I am using the Nucleo H563ZI for OEMiROT. I was able to build the example provided in STM32CubeH5 package and it works without issue. I wanted to know if it is possible to use the swap method instead of overwrite method for the application installation. If so, is there any example available? I understand that HW crypto isnt available on the STM32H563ZI, I was planning to use the ST Cryptolib library for software crypto.Thanks!Rajas

Hello,I’m working on STM32U5 flash with tfm application using script “regression.sh” and “TFM_UPDATE.sh” of MB1551 example project in SBSFU. I lost the connection with the chip when I unchecked nSWBOOT0 in option bytes.Trust Zone : activatednBoot0 : checkednSWBOOT0 : uncheckedRDP : 0 So when we try a JTAG connection, we have this error.STM32CubeProgrammer Error connection Do you know a solution to regain connection with the STM32U5 ?Thanks for your attention,Kind regards,

I would like to implement a  secure firmware update solution that will work in both an STM32G4A1 and an STM32U0 83.  Different applications, but I would like to use the same basic bootloader and PC update application.  Both would updated over USB.  They have basically the same security features and both have the AES-GCM accelerators.I've been watching the MOOC - Security series to learn how to do this.  I got to the end of  "Security Part4 - STM32 security in practice - 15 Secure firmware update" and had some questions since there isn't any lab video for this module like there are for the modules that came before it. I've also looked at the Silicon Labs AN0060: Bootloader with AES Encryption app note, which is similar in implementation to what I am thinking of doing. The link for the slides for the MOOK module is at the bottom of this page:https://www.st.com/content/st_com/en/support/learning/stm32-education/stm32-moocs/STM32_secur

Hello,I have programmed the OTP word 31 to 0xBBBBBBBB as follows, but when I want to write another value such as 0x12345678 or 0x00000000 to word 31, it reported the following errors， can you help to analyze this ? Thanks a lot!  

Dear ST Team,              I am currently porting an SBSFU/Trust Zone -based application from the STM32U585 to the STM32U5A5. The migration is almost complete, and the bootloader is functioning as expected.    The following operations complete successfully:BL2/SBSFU boots correctly. Image authentication and verification succeed. The application vector table is read correctly. The application jump is initiated using:boot_jump_to_next_image((uint32_t)&boot_jump_to_next_image, vt->reset);     Both addresses appear to be valid:MSP points to Secure SRAM. Reset vector points to Secure Flash with the Thumb bit set.The application successfully reaches the Reset_Handler, so the jump from SBSFU to the application appears to be successful.However, during the startup code, execution gets stuck while clearing the .bss section.The relevant startup code is shown below:ldr r2, =_sbssb   LoopFillZerobss FillZerobss:    movs r3, #0    str  r3, [r2], #4 LoopFillZerobss:    ldr r3, =_ebss    cmp r