Clarification on Secure Manager External Flash Support

[RJJ]

Hello ST Team,

We are evaluating STM32TRUSTEE-SM (Secure Manager) on STM32H5F4 devices and would like clarification regarding the external flash support architecture.

From the STM32TRUSTEE-SM documentation and wiki pages, we understand that:

Secure Manager provides an External Flash Profile.
An External Flash Driver is referenced as part of the Secure Manager configuration flow.
External firmware and data confidentiality can be enabled through OTFDEC.
OTFDEC-based secure external memory access is described together with the OCTOSPI peripheral.
Secure Manager supports firmware download slots located in external flash memory.

However, we need clarification on the supported external memory architecture and driver model.

Questions

1. External Flash Interface Support restricted to memories connected through the OCTOSPI peripheral, or are other                  external memory interfaces also supported? Specifically, does the External Flash Profile support:

     Octal SPI NOR Flash, Quad SPI NOR Flash, Standard SPI NOR Flash

2. Driver Framework

    The Secure Manager documentation refers to an External Flash Driver.

    Could you please clarify:

    Is source code for the external flash driver provided as part of the Secure Manager package?
    Is there a documented API/interface specification that custom flash drivers must implement?
    Are OEMs expected to develop their own external flash driver when using a flash memory different from the one used in ST      reference projects?
    Are there example drivers available for supported flash devices?

3. Encryption Capabilities

In the documentation related to external flash protection and OTFDEC, we can see references to AES-128 encryption.

Could you please clarify:

Is external firmware/data protection through OTFDEC limited to AES-128 only?
Is AES-256 supported for external flash encryption/decryption?
If AES-256 is not currently supported, are there any planned enhancements or recommended approaches for customers requiring AES-256 protection of external firmware?

4. Documentation Reference
If Secure Manager external flash support is limited to OCTOSPI-managed memories, could you please point us to the relevant documentation section describing this requirement?

Our Use Case We are currently evaluating Secure Manager for a custom STM32H5-based product and need to understand the flexibility of the External Flash Profile before finalizing the hardware architecture and flash memory selection.

Thank you for your support.

RJ

[Jocelyn RICARD]

Hello ​@RJJ ,

as stated in another post, the external flash profile will not be supported on STM32H5F5

By the way the external flash profile related documentation for STM32H573 can be found in the Secure Manager User manual UM3254.

Best regards

Jocelyn

[RJJ]

Hi ​@Jocelyn RICARD,

Thank you for the clarification. 

We are currently in the evaluation stage for our product and are assessing different STM32H5 device options. Although our initial evaluation was focused on the STM32H5F4, we are also considering STM32H573 also.

Since the documentation and references to the External Flash Profile are available for STM32H573 in UM3254 Secure Manager User Manual, we would like to better understand the supported external memory architecture. 

Could you please confirm whether the Secure Manager External Flash Profile is limited to memories connected through the OCTOSPI peripheral only, or if other external memory interfaces are also supported?

The reason for asking is that the current Secure Manager documentation presents the External Flash Profile specifically in the context of STM32H573. Since we are evaluating STM32H5F4 devices and may also consider STM32H573, we would like to understand whether the same architecture and limitations apply across the STM32H5 family. Specifically, we would like to know if the External Flash Profile is restricted to OCTOSPI-connected memories, as this may influence our hardware design choices

Thank you for your support.

Best Regards,

RJ

[Jocelyn RICARD]

Hello ​@RJJ ,

In fact you have more details on this topic in the wiki page “How to use Secure Manager with External Flash profile”

There is actually no restriction on the interface used as the flash driver is your code.

I hope this answers your question

Best regards

Jocelyn

[RJJ]

Hi @Jocelyn RICARD,

Thank you for the clarification

that there is no restriction on the external flash interface since the flash driver is application-specific code.

 

While reviewing the STM32H573 documentation and External Flash Profile material, I noticed that secure firmware installation appears to rely on OTFDEC WITH OCTOSPI.

Based on this, I would like to better understand 

1.If a standard SPI flash is used instead of OCTOSPI, how is encrypted firmware will be decrypt on the fly?

I am attaching the relevant excerpts from the STM32H573 documentation that led to this question.

 

 

Best Regards,

RJ