STM32 MCUs Security

Hello,I’m working on STM32U5 flash with tfm application using script “regression.sh” and “TFM_UPDATE.sh” of MB1551 example project in SBSFU. I lost the connection with the chip when I unchecked nSWBOOT0 in option bytes.Trust Zone : activatednBoot0 : checkednSWBOOT0 : uncheckedRDP : 0 So when we try a JTAG connection, we have this error.STM32CubeProgrammer Error connection Do you know a solution to regain connection with the STM32U5 ?Thanks for your attention,Kind regards,

I would like to implement a  secure firmware update solution that will work in both an STM32G4A1 and an STM32U0 83.  Different applications, but I would like to use the same basic bootloader and PC update application.  Both would updated over USB.  They have basically the same security features and both have the AES-GCM accelerators.I've been watching the MOOC - Security series to learn how to do this.  I got to the end of  "Security Part4 - STM32 security in practice - 15 Secure firmware update" and had some questions since there isn't any lab video for this module like there are for the modules that came before it. I've also looked at the Silicon Labs AN0060: Bootloader with AES Encryption app note, which is similar in implementation to what I am thinking of doing. The link for the slides for the MOOK module is at the bottom of this page:https://www.st.com/content/st_com/en/support/learning/stm32-education/stm32-moocs/STM32_secur

Hello,I have programmed the OTP word 31 to 0xBBBBBBBB as follows, but when I want to write another value such as 0x12345678 or 0x00000000 to word 31, it reported the following errors， can you help to analyze this ? Thanks a lot!  

Hello, I am working and trying to boot Nucleo - STM32H533RE board. I could successfully boot board using one stage bootloader OEMiROT, but I want to board to boot board with two stage boot path that to to without using STiROT.Looking at wiki page, I could see this can be achieved on Nucleo board I have, but there is no working example in the latest STM32Cube_FW_H5_V1.6.0 package I have.I could see boot path example for STiROT + OEMuROT example but no example for OEMiROT + OEMuROT.I need to know whether I can achieve booting of Nucleo STM32H533 board with desired boot path i.e. OEMiROT + OEMuROT (as encircled with blue color) and if yes is there any support with relevant data available?Regards,Satish 

Dear ST Team,              I am currently porting an SBSFU/Trust Zone -based application from the STM32U585 to the STM32U5A5. The migration is almost complete, and the bootloader is functioning as expected.    The following operations complete successfully:BL2/SBSFU boots correctly. Image authentication and verification succeed. The application vector table is read correctly. The application jump is initiated using:boot_jump_to_next_image((uint32_t)&boot_jump_to_next_image, vt->reset);     Both addresses appear to be valid:MSP points to Secure SRAM. Reset vector points to Secure Flash with the Thumb bit set.The application successfully reaches the Reset_Handler, so the jump from SBSFU to the application appears to be successful.However, during the startup code, execution gets stuck while clearing the .bss section.The relevant startup code is shown below:ldr r2, =_sbssb   LoopFillZerobss FillZerobss:    movs r3, #0    str  r3, [r2], #4 LoopFillZerobss:    ldr r3, =_ebss    cmp r

We are interested in incorporating the STSAFE-A120 authentication chip (part number: STSAFA120S8SPL05) into our current design. However, the available datasheet lacks the necessary details for firmware development. We would highly appreciate your help and guidance on this matter. 

Hi everyone,I am trying to generate a professional SBOM for my project.I have a few questions regarding the best workflow:Tooling & Detection: What the best tool to generate the SBOM.I tried using ScanCode, but it didn't find any component in my project (e.g., FreeRTOS). I had to manually add .about files to the folder to get results. Is there a better tool that can generate the SBOM with minimal manual intervention?ST Cube SBOM : The Cube MCU packages contain dozens of libraries (FatFS, FreeRTOS, USB_Host, etc.). If my project only uses FatFS, the package JSON still lists everything. Do I have to manually extract the components I use from the ST JSON? how to get use of the ST SBOM?I’d love to hear if anyone has a script or a specific toolchain that automates this without the manual "copy-paste" from the ST manifests Thank you!Yahya  

Hi ST,I’ve run into a whole lot of issues adding interrupt-based UART to your OEMiRoT w/ Trustzone example on a NUCLEO-U385RG-Q.As you may know this example is not compatible with CubeMX, and it’s not clear which steps are needed to manually incorporate UART4 so that it activates an interrupt on receipt of input when running in the Non-Secure region of code. The idea is to only access the Secure region when needing to utilise certain sensitive variables, called from within a Non-Secure function.Let’s take this opportunity to establish a step-by-step guide for someone who isn’t (yet) an embedded professional, please excuse my ignorance if this already exists, I’d be just as happy to be directed there. My settings so far are:1. Secure/Inc/partition_stm32u385xx.h: Initialise UART4_IRQn as Non-Secure#define NVIC_INIT_ITNS2    1#define NVIC_INIT_ITNS2_VAL      0x000000012. Secure/Src/main.c: Define UART4 pins (CN7 1 & 2, or PC10 & 11) as NonSecureHAL_GPIO_ConfigPinAttributes(GPIOC,

Dear,Is it possible for execution within HDPL_x to use SAES (Secure AES) with a DHUK (Derived Hardware Unique Key) from HDPL_y where x > y?For example:Execution within HDPL2 makes use of SAES to encrypt plaintext p using its DHUK, this results in ciphertext cAfterwards, upon reset, execution within HDPL1 needs to be able to read plaintext p (e.g., by decrypting the stored ciphertext c using HDPL2's DHUK) without changing the HDPL.Is this possible with SAES, and if yes, how?Thanks a lot!

Hi Everybody,I posted a comment here https://community.st.com/t5/stm32-online-courses/stm32h5-secure-manager-course/bc-p/824487/highlight/true#M27 yesterday because I am trying following the online course and what is written in the wiki to start developing an application on the STM32H573VI using the secure manager.At the moment I am starting the development by using the nucleo board for H573 however, by following the wiki, the only project that could be used for deploying the solution is an handswritten example that does not use the CubeMx.If I try to follow the old documentation on the youtube videos, as explained in the link provided, I am unable to set the boot path correctly.At the moment I am a bit lost, should I build my project without the use of CubeMx in case of secure manager? Will it be added in the future? I am missing something straightforward? thank you in advanceAndrea

Hello, I have an STM32H573 project with TrustZone enabled. After the CPU goes into non-secure mode and during execution of the HAL_Init() function (more specifics below) a hard fault occurs. There is only a hard fault during the execution from a non-secure state. In the secure state (at boot) the HAL_Init() function successfully runs. Is there a configuration for the RCC not enabled by default that I a missing, allowing it to be accessed by both Secure and Non-Secure CPU states?Within GTZC_S TZSC - Privilegeable peripherals I cannot enable it. I see no relevant settings (I have tested a few that might be loosely related but no solved) in RCC. In the code below I have used an arrow (<--) to denote exactly where the hard fault occurs (Verified with debugger)Non-Secure Entry Code (CubeMX Generated):int main(void){ /* USER CODE BEGIN 1 */ /* USER CODE END 1 */ /* MCU Configuration--------------------------------------------------------*/ /* MPU Configuration-------------------------

Hi,we have a question regarding the Secure Manager Internal Trusted Storage size on the STM32H73 series.We have configured the following options:external flash profile 0 secure modules (=SMAK_0 ?)According to UM3254 it is our understanding the ITS size can now be up to 56 Kbyte:Our application project.py prebuild seems to extract value “9”, which means 9 * 8 Kbyte (Flash sector size) = 72 Kbyte? Jul  8 13:27:10 2026 : [INF] Searching the parameter with <Name>ITS size</Name> element2026-07-08 13:27:10,542 - DEBUG - Wed Jul  8 13:27:10 2026 : [INF] Parameter found. Verifying information of '<Value>0x9</Value>'2026-07-08 13:27:10,543 - DEBUG - Wed Jul  8 13:27:10 2026 : [INF] The modification is not necessary2026-07-08 13:27:10,543 - DEBUG - Wed Jul  8 13:27:10 2026 : [INF] The tag <Value> has already the correct content (0x9) Is there a misunderstanding on our end about the profile, memory configuration, UM3254 table, the prebuild proccess or the conversion

Firmware Package: STM32Cube_FW_H5_V1.6.0 Product ProblemDA regression fails with timeout. I cannot recover the board. I was trying to run the STiROT Template example (STiROT_Appli) on the STM32H573I-DK board. 1. I ran a custom provisioning script (based on ob_flash_programming.sh + obkey_provisioning.sh)2. During image flashing step, I accidentally flashed an unsigned binary (appli.bin) instead of the signed image (appli_init_sign.hex)3. OBKey provisioning (DA_Config.obk, STiRoT_Config.obk, STiRoT_Data.obk) may have failed due to the MCU being in an unstable state4. I then set Product State to PROVISIONED (0x2E) Discovery output Discovery succeeds and shows- PSA lifecycle: ST_LIFECYCLE_IROT_PROVISIONED - ST provisioning integrity status: 0xf5f5f5f5 - ST HDPL1 status: 0x1 - Permission: Full Regression is listed as available Regression attempt Using default keys from the firmware package (not regenerated): - Key: DA/Keys/key_3_leaf.pem - Certificate: DA/Certifica

In RM0481 rev 4 April 2025 I find the following text:7.6.8 Write protectionA write-protected group of sectors cannot be erased nor programmed. As a result, a bankerase cannot be performed if one group of sectors is write-protected, unless a NVSTATEtransition to OPEN is triggered (erasing the whole user flash memory). It is not clear what NVSTATE is in this context. Is this a left-over from documentation of a different MCU? I don’t think it is PRODUCT_STATE. Because to my understanding you can have a PRODUCT_STATE > OPEN and not enable TrustZone and then write to FLASH_WRP1R_PRG to turn off write protection - you should be able to do a bank erase on bank 1. You can set initial values with an OB but I can’t see any documentation that this also makes changing FLASH_WRP1R_PRG illegal and the relevant OBs are not protected by PRODUCT_STATE the same way as e.g. SECWM and HDP.Same reasoning for flash bank 2.And if you enable TrustZone, it is stated that FLASH_WRP[1, 2]R_PRG is non-secure.

Hello ST Community,I am evaluating the security features of the STM32H733 (Cortex-M7) for a project that uses:A custom bootloader stored in internal flash The main application stored and executed from external QSPI/Octo-SPI flashI have the following questions regarding Secure Firmware Install (SFI):Is SFI for internal flash officially supported on the STM32H733? (I saw it was added in AN4992 Rev 8, but I would like official confirmation.) Is SFI for external flash (SFIx) supported on the STM32H733? Specifically, can the secure bootloader (RSS) decrypt and program the external application image securely during manufacturing, or is only the "host-side encryption + internal firmware configures OTFDEC" method available? If external SFIx is not supported, what is the recommended secure manufacturing flow for a design with main code in external flash?

Hi,I'm integrating an STSAFE-A110 with stsafe-a-openssl-engine V2.0.0 on a Linux/aarch64 host (Jetson AGX Orin, Ubuntu 22.04, OpenSSL 3.0.2), communicating over I2C. I've resolved a number of earlier issues (wrong I2C bus, OpenSSL 3.0 API migration, host key pairing) and now have Host Key programming, Local Envelope key generation, Product Data query, Life Cycle State query, and Command Authorization Configuration query all succeeding against the physical chip.Current issue: StSafeA_WrapLocalEnvelope and StSafeA_UnwrapLocalEnvelope behave asymmetrically.My chip's Command Authorization Configuration reports:Command 0x0E (Wrap Local Envelope): CommandAC = 0x03 (MAC), HostEncryptionFlags = 0x02 (command encryption) Command 0x0F (Unwrap Local Envelope): CommandAC = 0x03 (MAC), HostEncryptionFlags = 0x01 (response encryption)Calling Wrap with STSAFEA_MAC_HOST_CMAC, STSAFEA_ENCRYPTION_COMMAND succeeds and returns a plausible 488-byte wrapped envelope.Calling Unwrap on that same output with S

Hello,I am using the Nucleo STM32H533RE board for booting with the two stage boot path for which I am using the ST template code and referring the following   https://wiki.st.com/stm32mcu/wiki/Security:OEMiRoT_OEMuRoT_for_STM32H7S . I am able to run the provisioning script successfully but when I am connecting the serial terminal to verify the serial data sent out by the board, I am getting an error saying “[ERR] read:Wrong OBK HDPL2 cfg” as seen in below image:I tried with the following things:Regenerating the OEMuROT OBK files manually using stm32 trusted package creator Running the regression script to erase the flash and again running the provisioning script Verified if the key file names matches the script referencesCan someone help me with this issue.Let me know if any other details are required. Thanks,Amruta

 Hi,I am working with the OEMiRoT reference project (STM32U385) and I need to configure a single Secure application image without TrustZone isolation (S-only application), while still keeping the Secure Data Image enabled.From flash_layout.h, I see the following:  #define MCUBOOT_APP_IMAGE_NUMBER 1#define FLASH_NS_PARTITION_SIZE (0x32000) /* default case */and also this condition: #if (MCUBOOT_APP_IMAGE_NUMBER == 1) && (FLASH_NS_PARTITION_SIZE == 0) which seems to define the “FULL SECURE” case.QuestionTo correctly implement an S-only application (no S/NS split) in OEMiRoT:Should I explicitly set both:MCUBOOT_APP_IMAGE_NUMBER = 1FLASH_NS_PARTITION_SIZE = 0ORIs FLASH_NS_PARTITION_SIZE automatically set to 0 by the OEMiRoT provisioning/build system when selecting the S-only configuration, meaning it should NOT be manually modified in flash_layout.h?ConcernThe header comment suggests that some Flash layout values are automatically generated by the ROT provi

Hello,long time lurker, now with an issue that I would like to solve. I developed a firmware that runs standalone without issue. I would like to use the secure manager on my STM32H573VI microcontroller.I followed the procedures at this link: https://wiki.st.com/stm32mcu/wiki/Security:How_to_make_your_application_compatible_with_Secure_Manager  and I am able to run the python provisioning.py --sfi-flash command. Then from the cube ide I can debug my program that is written with cmake and the cubemx template.Since I am using threadx I set TIM6 as a time base for the HAL.What I observe is the following...- if I run the application straight away, I do not see the tick increment. - I set an __enable_interrupt() before HAL_Init() and I see that the tim6 interrupt is fired.Then in the ISR, I see that with the first line of HAL_TIM_IRQHandler, when reading htim->Instance->DIER then I land in a BusFault_Handler.  I run out of ideas. No clue about how to deal

Does STM32 provide an mbedTLS integration library for the STM32H573 crypto hardware accelerators? If so, could you please share the details? I found a library at the link below, but it does not cover all the hardware accelerators supported by the STM32H573. Could you share a more complete mbedTLS integration library if you have one?  

Hi ST Team,I am using an STM32U585AII6Q on a custom hardware board. My firmware is based on SBSFU with TrustZone enabled.For production manufacturing, I would like to provision blank devices using STM Secure Firmware Install (SFI) over the ROM USB DFU interface.I would appreciate clarification on the following points:What is the recommended procedure to create and use an SFI package that contains both my custom firmware and the required production option bytes? Can the SFI package program both the firmware and the option bytes in a single operation through the USB DFU interface? My intended production option byte configuration is: TrustZone (TZEN) enabled BOOT0 pin tied High on the hardware BOOT_LOCK enabled RDP Level 2 enabled No OEM password provisioning (OEM2 not provisioned) Is this configuration supported through the SFI provisioning flow? After the SFI package has been programmed with the above option bytes, can anyone confirm that the ROM USB DFU bootloader will no longer

I am using stm32h563zi microcontroller (Nucleo-H563zi) in this i have created project  using trust zone. In this aim was to use UART4 to transmit message. But i am unable to transmit, i have uploaded main.c of secure and nonsecure. what is the possible error in not transmitting the message usign UART4 in nonsecure.

I'm exploring Secure Firmware Install of our product firmware, programming it to a Nucleo H563ZI development board straight out of the box, never previously used. I'm programming it with firmware binaries (including a bespoke OEM iRoT), option bytes and a couple of OBkeys files (one for certificate-based Debug Authentication, another for my iRoT’s keys). For these current experiments, I'm using a global license for installation.I'm using STM32CubeProgrammer and STM32 Trusted Package Creator version 2.22.0, with X-CUBE-RSSE package version 2.0.0 installed.Running the installation process within the GUI STM32CubeProgrammer, the following message boxes are displayed as it proceeds:* (Info) File download complete* (Info) MCU Reset* (Error) Error: Execution of RSS CMD failed, returned value = 0xFFEADE2A* (Error) Error: Failed to Process Area Number 1 of type HThe installation process stops after the last of these errors. After failure, the MCU's option bytes are in this state:OPTION BYTES B

Security:Introduction to STM32H5 security - stm32mcu “Approved version. Approved on: 10:25, 18 May 2026”The following links are broken:In the intro section, the text “For general STM32 security see this article and AN5156.”: The link “this article” is https://wiki.st.com/stm32mcu/wiki/Security:Security_overview which shows a “Page not found” error page. In section 2, in the bullet point about PCROP, the text “Obviously this feature is redundant with the availability of TrustZone® and HDP.”: The link “TrustZone” goes to Security:How to disable TrustZone in STM32L5xx devices during development phase - stm32mcu which is for a different MCU and not very relevant for STM32H5. In section 3, the text “For introduction on these features, refer to this guide.”: The link “this guide” is https://wiki.st.com/stm32mcu/index.php?title=Security:Guide_to_use_specific_security_feature&action=edit&redlink=1 - which does not exist. section 3.2, the text “For broader context follow here.”: The lin

Hi team,we have custom project based on STM32U558 controller with TrustZone, and I am only involved in small part of the project.but i would like to learn about this trust zone is enabled and how both secure and non secure zone are talking.how i will identify which peripheral and which pins are intialised as secure and non secure part.also will appreciate if provided with reading section for trustzone.(prefer small blogs, not big one just because i am a new to trust zone).