STM32 MCUs Security

I try to enable the PCROP Feature on a STM32H753I am using the STM32CubeProgrammer and connect via ST-Link V2After connecting, I go to the "OB" page and set the PROT_AREA_END1 value to 0xFFF and activate the DMEP1Then I press the "Apply" button and this happens in the log:Option byte command : -ob PROT_AREA_END1=0xFFF PROGRAMMING OPTION BYTES AREA ... Bank : 0x00 Address : 0x5200201c Size : 308 Bytes UPLOADING OPTION BYTES DATA ... Bank : 0x00 Address : 0x5200201c Size : 308 Bytes OPTION BYTE PROGRAMMING VERIFICATION: Error: Expected value for Option Byte "PROT_AREA_END1": 0xFFF, found: 0x0 Error: Option Byte Programming failedAnd then, I always get the error Message "Option Byte Programming failed"The RDP has level 0, but the same error occures, if I try to set RDP to level 1 at the same time.In the documentation I found no hint, that there is any other prerequisite must be met to set the PCROP.Has anyone an idea what the problem could be?(In generally the chip works, I can eras

Hello ST team,I am studying the flash security mechanisms (RDP, WRP, PCROP) on STM32L476RG and I understand how to configure Option Bytes using STM32CubeProgrammer or firmware.What I am trying to understand is the hardware-level enforcement flow of Option Bytes:• During reset / power-up, which hardware blocks read the Option Bytes?• How are these values propagated to the Flash controller and debug access logic?• At what point relative to CPU reset release are these protections enforced?I understand that enforcement happens before user firmware execution, but the reference manual does not describe the internal sequence in detail.Could you please clarify (at a high level) how Option Bytes are latched and enforced by hardware during the boot/reset sequence on STM32L4 devices?Thank you.

Hello,starting from the example application of the OEMiRot boot project, I noticed that the NS application size is limited to 640kB in the flash_layout.h  (#define FLASH_NS_PARTITION_SIZE (0xA0000) /* 640 KB for NS partition */)Since there is 1MB avalaible in the slot, I would like to increase this size from 640kB to 896kB. A first naive change is just to change the define from 0xA0000 to 0xE0000 which leads to the state that the bootloader doesn't find a bootable image anymore.How do I set a larger non-secure application size to have a benefit of the 1MB flash slot? Best regards,Stefan

Hi!I'm working on a Trustzone enabled application in STM32U5A5 nucleo board and have some questions in my mind. I have used the configurations of the example project for the Trustzone, which you can find below: - TZEN=1 - SECWM1_PSTRT=0x0 SECWM1_PEND=0xFF meaning all 128 pages of Bank1 set as secure - SECWM2_PSTRT=0xFF SECWM2_PEND=0x0 meaning no page of Bank2 set as secure, hence Bank2 non-secure I have enabled SAU and left it with the default configuration. I've also enabled the GTZC_S. In my application, I'm using TAMP mechanism of the RTC to create an interrupt when the output signal doesn't match the input signal. First question:My application can boot from the secure app and jump to non-secure app without any problems. But in the MX generated NonSecure_Init() function, after the line SCB_NS->VTOR = VTOR_TABLE_NS_START_ADDRThe SCB->VTOR_NS register doesn't change, remains as 0x0 (according to the SFR in the debug interface). After the boot to non-secure

I am trying to use the DA function of the STM32H573. I can successfully write the OBK file (with TrustZone disabled) and regression via STM32_Programmer_CLI.exe. However, I encountered an issue when trying to read the plaintext of the OBK payload in my code. I am unable to obtain the correct plaintext through SAES and DHUK.Here is part of my code:int32_t OBK_Flash_ReadEncrypted( void *pData) { uint32_t Offset =0x0100; uint32_t Length = 0x60; uint32_t i = 0U; CRYP_HandleTypeDef hcryp = { 0U }; uint32_t SaesTimeout = 100U; uint8_t DataEncrypted[MAX_SIZE] = {0U}; uint8_t *p_source = (uint8_t *) (FLASH_OBK_BASE_S + Offset); uint8_t *p_destination = (uint8_t *) DataEncrypted; uint32_t a_aes_iv[4] = {0x8001D1CEU, 0xD1CED1CEU, 0xD1CE8001U, 0xCED1CED1U}; for (i = 0U; (i < Length); i++, p_destination++, p_source++) { *p_destination = *p_source; } __HAL_RCC_SBS_CLK_ENABLE(); __HAL_RCC_SAES_CLK_ENABLE(); /* Force use of EPOCH_S value for DHUK */ //WRITE_REG(SBS_S->EPOCH

I've got an STM32U385 on a custom board that is unresponsive.The software is based on the OEMiROT trustzone example.The sequence of events that lead to this, as nearly as I can remember were:1.) Set up the device with provision.bat, with RDP level 2. This worked fine. The device ran as it should.2.) Regress the device using regression.bat, this process failed, but left the device in an accessible state for the debugger.3.) I connected the boot0 pin to VDD, connected with the programmer in hot plug mode, set RDP to 1.4.) I set RDP to 0 and TZ enabled to 0, which worked.5.) I disconnected the boot0 jumper, and tried loading code normally, it then failed at address 0x80004000. Reading out that address with the programmer revealed that it was not programmed, but instead remained all 0xff's. I tried several times to program, always with the same result, the first part of memory, up to address 0x80003fff programmed correctly, and the rest failed.6.) I tried running the regression script agai

Hello everyone,I am trying to implement SBSFU (Secure Boot Secure Firmware Update) on NUCLEO-G474RE using STM32CubeExpansion_SBSFU_V2.7.0.Initially, everything was working fine and I was able to program the board normally.What I didI followed the SBSFU documentation and examples.While configuring SBSFU, I modified Option Bytes, specifically Write Protection (WRP) addresses to match the SBSFU memory layout.After applying the option bytes, the problem started.Current problemNow I cannot program or erase the MCU anymore.I get the following errors:1.In STM32CubeIDE'Launching SBSFU (1)' has encountered a problem.Failed to execute MI command:load ...\SBSFU.elfError finishing flash operation2. In STM32CubeProgrammerFull chip erase failsMass erase fails with error:Error: Mass erase operation failed. Please verify flash protection3.I also tried:Full chip eraseErase selected sectorsHardware reset / power cycle“Under reset” connection modeFactory reset via STM32CubeProgrammer→ All fail with

Hi,based on the ST example where the 640kB RAM is splitted into 2 * 320kB for secure/non-secure application, I want to change this to 32kB/608kB for secure/non-secure app. After modification of the linker files for the secure/non-secure app, the non-secure app runs into an hardfault right at the start. The error is that some ns access is done in secure area in SRAM1 (at address 0x2001f840).I first started the project on the STM32H563 eval board and simply copied the settings of MPU and GTZC over to the STM32H562. These settings are working on the STM32H563, so I can properly jump there into the non-secure app.Are there any difference in setting the memory areas for secure/non-secure/priviledged feature?Here are the settings.linkerfile non-secure:define symbol __ICFEDIT_region_RAM_start__ = 0x20008000;define symbol __ICFEDIT_region_RAM_end__ = 0x2009FFFF;linkerfile secure:define symbol __ICFEDIT_region_RAM_start__ = 0x30000000;define symbol __ICFEDIT_region_RAM_end__ = 0x30007FFF;v

I'm trying to understand how the HDPL1 is calculated based on an OBK file.I have dumped the contents of HDPL1 / 0x0BDF0100 and can see that for a 16 length password, I have 96 bytes written, as follows0x0BFD0100 to 0x0BFD0120, unknown calc, how is this calculated?0x0BFD0120 to 0x0BFD0140 SHA-256 of password0x0BFD0140 to 0x0BFD0160 zeros

We have a query regarding STM32U375 PKA peripheral.As per datasheet, the peripheral is available for this variant. Under the "STM32Cube/Repository/STM32Cube_FW_U3_V1.2.1/Drivers/STM32U3xx_HAL_Driver/" we can also see that stm32u3xx_hal_pka.c and stm32u3xx_hal_pka.h driver files are available. However, the ST official product page - does not seem to mention this peripheral as a part of STM32U375 series.    Also, we cannot see this peripheral in graphical configuration .ioc. Please let us know if this is available as part of STM32U375 series and how to use it.We also need STM32U375.svd for debugging support, please share this file.

I have a project which runs fine using CMOX_PQC_ML_DSA_44_DET_SIGN_LOWRAM_ALGO but I would like to see how much faster I can get with CMOX_PQC_ML_DSA_44_DET_SIGN_ALGO. When I use it, cmox_pqc_dsa_sign returns 0x9000c, which apparently means "Not enough memory".I am also wandering what kind of memory we are speaking about because it does not seems to request heap memory and I don't expect it to detect if stack is large enough at runtime.I am going to have exactly the same question for CMOX_PQC_ML_DSA_65_DET_SIGN_ALGO and CMOX_PQC_ML_DSA_87_DET_SIGN_ALGO.Perhaps a more general question: is there a documentation for the cmox_pqc library ?

I accidentally configured PCROP protection on my STM32H755XIH6 that has effectively locked me out of almost the entire flash memory, and I'm unable to recover using standard methods.Current Situation:Device: STM32H755XIH6 (2MB dual-bank flash: Bank1=1MB, Bank2=1MB)PCROP Settings:Bank 1: PROT_AREA_START1=0x2 (0x08000200) to PROT_AREA_END1=0xFFF (0x080FFFFF)Bank 2: PROT_AREA_START2=0x2 (0x08100200) to PROT_AREA_END2=0x81FFFFF)Available Space: Only 512 bytes per bank (0x08000000-0x080001FF, 0x08100000-0x081001FF)Problem: Almost all of flash is PCROP-protectedI tried the below methods following some other discussion on the forum:STM32CubeProgrammer GUI - option byte modifications fail with "changes can't be applied after OB_LAUNCH" (It connects under reset but I still get changes cant be applied after OB_LAUNCH error)CLI commands to modify PROT_AREA_START/END - all fail with same errorRDP level cycling/regression (0xAA → 0xBB → 0xAA) - completes but

Hello,I am working with an STM32H573 and I would like to implement OEMiROT.Is it possible to use OEMiROT without activating TrustZone on this device?If it is possible, is there an official or recommended ST method?Any clarification or pointers to documentation or real-world implementations would be appreciated.Thank you.

Hi all, I'm trying to get some knowledge about the use of OEMiRoT using the NUCLEO-H563ZI board following the ST Tutorial How to start with OEMiRoT on STM32H573 and 563–Arm® TrustZone® enabled - stm32mcu. Once the certificate chain has been created, I'm facing some problems with the Debug Authentication procedure: indeed, after setting the root key and root certificate in the Debug Authentication page of STM32CubeProgrammer, and selecting "Level 3 Intrusive Debug" as stated in section 3.2.1 of the tutorial, I receive both a "Debug Authentication Success" and a "Error: ST-LINK error (DEV_CONNECT_ERR)"; after this, I'm not able to read any of the data stored in the chip flash, neither with STM32CubeProgrammer or STM32CubeIde.This problem adds to those already mentioned in topic STM32H563: CubeProgrammer UART connect fails in PRODUCT_STATE = iROTProvisionedAm I missing something? All other levels of authentication, either secure or non-secure, are returning me the same error wit

At present, as of the last Hal version as far as I know, obk cannot be used in a non trust zone project.FLASH_TYPEPROGRAM_QUADWORD_OBK fails because the NS bits aren't set, among other issues.Is this by design, IE obk can't be used by non TZ, or is this just simply not a completed or fully fixed feature? Here is what I'm doingI've edited HAL_FLASHEx_Erase like#if defined (FLASH_SR_OBKERR) else if ((pEraseInit->TypeErase&~(FLASH_NON_SECURE_MASK)) == FLASH_TYPEERASE_OBK_ALT) { /* OBK erase to be done */ FLASH_OBKErase(); /* Wait for last operation to be completed */ status = FLASH_WaitForLastOperation(FLASH_TIMEOUT_VALUE); } #endif /* FLASH_SR_OBKERR */And my code is:int keyStorageSavePrivate(char* key) { uint32_t status; uint32_t len = strnlen(key, KEY_STORAGE_SIZE - 16); int ret = 0; static uint32_t FlashWord[4]; if (len >= KEY_STORAGE_SIZE - 16) { return 1; } len += 1; // Add string 0 HAL_FLASH_Unlock(); HAL_FLASHEx_OBK_Unlock(); if (len & 0b

Hello,I am working on a project using mbedTLS and Keil MDK to make an HTTPS server running on an STM32F777. To speed up encryption/decryption, I am trying to make use of the CRYP coprocessor (mostly focusing on speeding up AES GCM calculations). My implementation is based on the example given here: https://github.com/STMicroelectronics/STM32CubeL5/tree/master/Projects/STM32L562E-DK/Applications/mbedTLS/Crypto_Selftest.However, when I try to run with my alternative AES GCM implementation, the CRYP coprocessor does not calculate the same tag as mbedTLS. This causes the SSL handshake to fail. I've attached my files for the GCM alternative implementation here. Am I missing something with the way I'm presenting my data?

Hi,In paragraph 1.2 “Launch the provisioning script” I read that:Launch one of the provided scripts depending on your IDE:For EWARM or MDK-ARM: launch the provisioning.bat script.For STM32CubeIDE: launch the provisioning.sh script.I have Windows and STM32CubeIDE. Can I run the provisioning.sh script on Windows?Looking into the env.sh script, I found the following code:  echo ${OS} | grep -i -e windows -e mingw >/dev/null if [ $? == 0 ]; then echo "" echo " ==========================================" echo "| For Windows OS, please use .bat scripts. |" echo " ==========================================" echo "" echo " Press any key to continue..." echo read -p "" -n1 -s exit 0 fi  It seems that the script cannot be run on Windows.Could you please advise how to run the provisioning script for STM32CubeIDE on Windows?Thank you very much for your support.Best regards,Marco

Hi,I am doing a feasibility study for SBSFU on an STM32H750, specifically firmware encryption and authenticity check. I am using the XCUBE expansion pack v2.8.0.- Using prepareimage.py & modified keys.py along with default prebuild and postbuild.sh- Using a single download + single active slot in external memory- All protections are disabledModifications to default example:- Adjusted default linker script to increase active + download slot size- Modified keys.py to append 0xFF bytes to binary before encryption to meet 16 byte multiple requirementMethod altered: AES_CBC:encrypt- generating new AES and ECDSA keys as mentioned in readme.txtAs mentioned in AN5056, section 4.2, I modified SECBOOT_CRYPTO_SCHEME to SECBOOT_ECCDSA_WITH_AES128_CBC_SHA256. I can see that prebuild.sh detects this change and adjusts accordingly. Observations:I have tested the firmware installation using ECDSA signature without encryption to get the following errors.1. Error on first boot after f

Hello everyone,My team and I are working with a custom board based on the STM32WB55RG. Due to limited pin availability, we need to use USB as a virtual COM port for serial communication. We successfully configured the USB Virtual COM and were able to print messages on the console without any issues.However, we encountered a problem after integrating SBSFU.The USB Virtual COM works fine within the SBSFU application, but once the SBSFU process completes and our custom application starts, the USB stops functioning. We can no longer see messages in the terminal, even though our application is running as expected by debugging it with the USART / LPUART.We have already checked the USB and clock configurations in both the SBSFU app and our custom application, and everything seems to be set up correctly. Furthermore, we also attempted the following:Forcing a USB re-enumeration by pulling the D+ pin low for a few milliseconds.Playing around with initializing and de-initializing the USB in both

Hi,we are experiencing an issue with the STM32G0B0 when RDP level 1 is enabled, following the steps below:Flash the device using J-LinkStart the device and let the application set RDP = 1Enter the STM32 ROM bootloader (via UART)Disable RDP protection (perform mass erase)Program new firmware with bootloaderReboot the device and set RDP = 1 againAfter this sequence, the device remains locked.Even if we apply multiple resets using the NRST pin, the device does not recover.The only way to unlock the device is to completely power-cycle it (turn the power off and on again).Is it possible to re-enable RDP protection and start the new firmware without removing power from the device?Thank you for your support.

I have the NUCLEO-H753ZI example running on my board. All works fine without the security features. When I enable both the SFU_MPU_PROTECT_ENABLE and SFU_IWDG_PROTECT_ENABLE. I keep having a watchdog when it tries to execute the firmware. I commented the #define SFU_IWDG_PROTECT_ENABLE and enable the SFU_VERBOSE_DEBUG_MODE. It gets stuck  at verifying the user FW as shown below.= [SBOOT] SECURE ENGINE INITIALIZATION SUCCESSFUL= [SBOOT] STATE: CHECK STATUS ON RESETINFO: A Reboot has been triggered by a Hardware reset!= [SBOOT] STATE: CHECK NEW FIRMWARE TO DOWNLOAD= [SBOOT] STATE: CHECK USER FW STATUSA FW is detected in the slot SLOT_ACTIVE_1= [SBOOT] STATE: VERIFY USER FW SIGNATUREWhen I breakpoint I can see that it is stuck at this as USB stops running after the first SFU_LL_SECU_SetProtectionMPU call which is the SFU_INITIAL_CONFIGURATION.TRACE(" @%d:%x size:%x sub:%x perm:%x exec:%x\r\n",MPU_InitStruct.Number, MPU_InitStruct.BaseAddress, MPU_InitStr

Can you help with new research on secure boot?   I am a cyber security researcher at the University of Bristol in the UK. I would like to your views on Secure boot.   My area of interest is developer-centred security, specifically in the issues that developers face when trying to build secure IoT devices.    If you have ever looked at implementing secure boot, or used it in your current development, or maybe think it to complicated, then I would really like to hear from you. Please take just 8 to 10 minutes to do this short survey on secure boot. https://universityofbristol.eu.qualtrics.com/jfe/form/SV_06xKUNve9ioJ5T8   If you have any questions, you can contact the researchers directly at fe23957@bristol.ac.uk

Hello.  I am experimenting with securing a STM32H503 using password authentication, which will ultimately be an automated process.I created a simple password for testing and created the password hash in board_password.bin and da_password.bin(just for comparison, I also used Segger's advice and tried certutil and the resulting board_password.bin file is identical, so I'm pretty sure the password hash worked).I set the chip to PRODUCT_STATE provisioning and programmed the chip with the password using the following:STM32_Programmer_CLI.exe -c port=SWD speed=fast ap=1 mode=Hotplug  -ob PRODUCT_STATE=0x17STM32_Programmer_CLI.exe -c port=SWD speed=fast ap=1 mode=Hotplug -w board_password.bin 0x8FFF000Both of these commands succeeded with no errorsAs recommended, I locked the OTP so I wouldn't accidentally damage it by overwriting by:STM32_Programmer_CLI.exe -c port=SWD speed=fast ap=1 mode=Hotplug -ob LOCKBL=0x1Again, no errorsFinally I set PRODUCT_STATE to PROVISIONED and aga

I have legacy SBSFU based system running on an stm32f429 for a few years now, based on the STM32F413ZHT6 demo code that was present in the package. I am now interesting to using the KMS feature of SBSFU but after reading um2622 /seeing https://www.youtube.com/watch?v=YjiNaTHQp2s I am a bit at a dead end on how to start as none of the kms files seem to be compiled in my bootloader. I am now getting the impression there is no KMS support at all on an stm32F4, this based on the fact that for example Figure 14 with the project folder structure in um26222 shows images with _KMS but this does not exist for the stm32f4 version I started from. So is KMS a no-go on STM32F4 because it uses features not available on STM32F4 ?Looking at Figure 4 SBSFU security IPs vs. STM32 series of  um2262 this seems to be the case if I understand that correctly (it seems to be needing this Firewall thing) ?If it is not supported, I would suggest adding this information at the very

I am trying to integrate a very simple TouchGFX Application into the SBSFU (I only really need SB right now) application, on STM32U5A9J-DKI've switched out the Nonsecure application for mine, I've modified flash_layout to do primary only, no external loader, 1 image. I modified the template loader script to have a Framebuffer section that spans SRAM3 (minus the secure section) and SRAM5. I'm using the startup_stm32...c that the original nonsecure application uses.Right now. It builds and boots, and shows "Jumping to first Image Slot" and just sits. I think it's getting into the Appli_Secure, because the Users LEDs on my board are lighting up.I found some verbiage elsewhere that indicates that I likely need to unsecure the IOs and SRAMs that the new NonSecure application uses, but when I start doing that, things go haywire.For example, I've got my project setup so that I can switch back to using the original demo Appli_NonSecure with my modifed flash_layout.h and linker script, and so I