STM32 MCUs Security

Hi,I am trying to send encrypted data between a C# application and STM32 in AES GCM mode.Currently, I am only doing encryption of a known test vector.Key and IV are both all zeros.AAD length is 0.My testvector is: 00 00 00 00 00 01 00 00 00 00 00 00 00 00 42 49Using the code below, I get the same ciphertext in both applications:03 88 DA CE 60 B7 A3 92 F3 28 C2 B9 71 B2 BC 31 But the tag never matches.I suspect there is something wrong in the final stage, where the tag is calculated.void AesTest() { uint8 iv[12]; uint8 plainText[] = { 0x00, 0x00, 0x00, 0x00, 0x00, 0x01, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x42, 0x49 }; uint8 header[0]; uint8 cipherText[sizeof(plainText)]; uint8 authTag[16]; memset(iv, 0, sizeof(iv)); uart_printf("ENCRYPT\r\n"); if (!AesEncryptGcm(iv, header, sizeof(header), plainText, sizeof(plainText), cipherText, authTag)) return; } bool AesEncryptGcm(const uint8 *iv, const uint8 *header, uint8 headerLen, const uint8 *plainText, uint16

Dear,For a given HDPL, how many 256-bit AHKs (Application Hardware Keys) can be stored in the option byte keys?And how many of those are:only usable by SAES?usable by software?The reference manual states the following:5.2 FLASH main features:"Up to 1 Kbyte of protected non-volatile option byte keys, readable either by software orusable as a secret AES key through SAES peripheral (as AHK keys)"It is unclear whether this is for just one HDPL, or whether this is a grand total comprising all three HDPLs that support option byte key storage (HDPL0, HDPL1, HDPL2).Suppose it is for just one HDPL, then this would be able to store 32 (= 1 K byte * (8 bit / byte) / 256 bit) 256-bit AHKs. This seems to be a reasonable assumption since if it were for all three HDPLs, this number would have to be divisible by 3, which it is not (32/3 = ~10.667).5.9.18 FLASH option byte key control register (FLASH_OBKCR):"OBKSIZE[1:0]: Option byte key sizeApplication must use this bitfield to specify

How can the debug interface on the STM32H573 be permanently locked via nonvolatile configuration or fuse?The SBS chapter of the manual saysThe debug configuration can be locked thanks to DBGCFG_LOCK in SBS_DBGLOCKR.SBS_DBGCR is then no longer writable.When DBGCFG_LOCK is set to 1, it can be reset only by system or power-on reset.So SBS_DBGLOCKR is not what I want, as it is not permanent.The manual refers to PRODUCT_STATE in several places. The "SBS Signals" table in the manual says that the sbs_product_state signal comes from Flash memory:Signal based on PRODUCT_STATE option byte to activate the different securitymechanisms depending on the product use. Expected values are described inSection 7: Embedded flash memory (FLASH).However, there is no mention of this signal in Section 7. What is the Flash programming procedure to change sbs_product_state?

Hello,We are working on an STM32F469/79-based device that uses SBSFU, which we are seeking to modify to use the STSAFE-A120 to perform the authentication and decryption algorithms.Section 2.7 of the STSAFE-A120 datasheet includes that the STSAFE-A120 supports the following symmetric ciphers for encryption and decryption.AES in CCM*/CTR modeAES in CBC modeAES in ECB modeAES in GCM/GMAC modeSection 4.7 of the STSAFE-A120 datasheet includes that the STSAFE-A120 supports symmetric decryption by chunks via the "Start decrypt", "Process decrypt", and "Finish decrypt" commands.We planned to use X-CUBE-STSE01 (v1.0.0) to interface with the STSAFE-A120. However, we were surprised to see that AES-CBC decryption does not seem to supported. This prevents us from using the STSAFE-A120 with SBSFU crypto scheme "SECBOOT_ECCDSA_WITH_AES128_CBC_SHA256". X-CUBE-STSE01 seems to also lack support for AES-GCM decryption by chunks. This prevents us from using the STSAFE-A120 with SBSFU crypto

If, like me, you are attempting to use this device and believe there are gaps in the information available, you are correct. However, the information you seek, plus additional advice and assistance is available from ST, you simply have to ask via a ticket on ST.COM. I will update this post when I have completed my project.

What is the meaning of the FLASH_OBKCR.NEXTKL field while executing within HDPL_0 (e.g., during execution of ST RSS)?This question might seem irrelevant to me as I'm a user and user code will never execute within HDPL_0, but it might be important from a threat modeling point of view: does ST (by means of its RSS code) have access to HDPL_x user-provisioned AHKs (Application Hardware Keys) where x >= 1?The reference manual states the following:5.9.18 FLASH option byte key control register (FLASH_OBKCR)"NEXTKL[1:0]: Next key level00: OBKINDEX represents the index of the option byte key stored for the hide protection levelindicated in SBS_HDPLSR.01: OBKINDEX represents the index of the option byte key stored for the hide protection levelindicated in SBS_HDPLSR plus one (e.g. if HDPL=1 in SBS_HDPLR the key of level 2 isselected).10 or 11: reserved"Does this mean ST RSS (HDPL_0) can access:HDPL_0 AHKs (when NEXTKL=00)HDPL_1 AHKs (when NEXTKL=01)but not:HDPL_2 AHKs (no applicable NEXTKL v

Post edited by ST moderator to be inline with the community rules especially with the code sharing. In next time please use </> button to paste your code. Please read this post: How to insert source code Hello, I need to calculate SHA-256 on STM32L562 MCU. I need a final single Hash output digest for an input of 8192 keys where each key is of 32 bytes. I am accumulating each key using: HAL_HASHEx_SHA256_Accmlt(&hhash, data, 32); upto 8191 keys. The final key i.e. 8192th key is fed to Hash engine using: HAL_HASHEx_SHA256_Accmlt_End(&hhash, last_data, 32, out_digest, 0xFF);  Using this above approach I understood that a final "out_digest" will result a final 32-byte Hash value but I am not obtaining the correct Hash. I tried to reduce keys from 8192 to 2048 thinking that a small data may be processed correctly by Hash processor but still got the wrong Hash value. Instead of accumulating keys one by one, if I take a buffer of size (2048 * 32) bytes and accumul

Hi,I'm working on STM32L496 for some security application, as per L4 series documents I see that L4 series controllers has AES hardware, but in my IOC settings under security option I don't see the AES. Why is this? does it mean STM32L496 doesn't have AES hardware inbuilt? if yes is there any software approach?Thanks

Hi Team,  I am trying to add a Secondary/custom bootloader in SBSFU. But not able to figure it out how to do it. I changed memory for active slot area and used the same area for custom bootloader in both linker file of both SBSFU and custom bootloader application. But does not work as expected. Can you please guide me through this?  I need to add a Custom bootloader and trigger user application from it. What are the modification that I need to do for this. I am using STM32H753 board. @Jocelyn RICARD 

I'm currently working on a final project titled "Design and Communication Security Mechanisms in an Embedded Gateway Module for Electric Vehicle Networks." I'll be creating a security mechanism using AES-128 and a hash function, and securing data from Ethernet communication protocols. I'd like to ask:1. How can I integrate Ethernet communication and security using the STM32F767ZIT6? 2. How can I create an encryption and decryption mechanism using AES-128 cryptography on the STM32F767ZIT6?

Hi, I've been working on porting the SBSFU onto a STM32H7A series with my custom gcc-arm build environment.The example project I am referring to is: x-cube-sbsfu-v2-7-0\STM32CubeExpansion_SBSFU_V2.7.0\Projects\STM32H7B3I-DK\Applications\2_Images.Everything seems to be working fine, but I have one issue that I am struggling with. So, the main SBSFU is supposed to call SE_CallGate() being the entry to the core secure engine, and it gets rebooted constantly. And, what I found is that the reboot doesn't happen if I get "IS_CALLER_SE_IF()" commented out.  // se_callgate.c SE_ErrorStatus SE_CallGate(SE_FunctionIDTypeDef eID, SE_StatusTypeDef *const peSE_Status, uint32_t PrimaskParam, ...) { SE_ErrorStatus e_ret_status; va_list arguments; volatile uint32_t LR; #if defined(__CC_ARM) || defined(__ICCARM__) LR = get_LR(); #elif defined(__ARMCC_VERSION) __asm volatile("MOV %0, LR\n" : "=r"(LR)); #elif defined(__GNUC__) register unsigned lr asm("lr"); LR = lr; #endif /*

This works fine in an app without SM but when I run this from a non-secure app together with SM, the last step fails. This is the code: // Enable access to RTC and backup domain HAL_PWR_EnableBkUpAccess(); if (__HAL_RCC_GET_FLAG(RCC_FLAG_LSERDY) == RESET) { // Reset the backup domain (equivalent to LL_RCC_ForceBackupDomainReset) __HAL_RCC_BACKUPRESET_FORCE(); __HAL_RCC_BACKUPRESET_RELEASE(); // Ensure LSE is OFF and NOT in bypass mode CLEAR_BIT(RCC->BDCR, RCC_BDCR_LSEON | RCC_BDCR_LSEBYP); // Set drive strength for startup (must be done while LSE is OFF) __HAL_RCC_LSEDRIVE_CONFIG(RCC_LSEDRIVE_MEDIUMHIGH); // Enable LSE __HAL_RCC_LSE_CONFIG(RCC_LSE_ON); // Wait until LSE is ready, with timeout if (SYSTIMER_WaitFlag(&RCC->BDCR, RCC_BDCR_LSERDY, true, 20000000)) { } else { // Disable LSE __HAL_RCC_LSE_CONFIG(RCC_LSE_OFF); // LSE activation error, handle as appropriate status = HAL_TIMEOUT; } // Select LSE as RTC clock source __HAL_RCC_RTC_CONFIG(RC

Hi, I'm using 3 channels of ADC4 with GPDMA1 (channel 4) in secure world of a TrustZone-project and the DMA-buffer stays always 0. The same ADC/DMA-configuration with the same application code (all mnus the security aspects) are working fine without TrustZone on the same hardware. I set the DMA-channel and the ADC-channel to secure and privileged, also the SAU-configuration for these peripherals is secure, the DMA-interrupt (circular) is triggered and calling HAL_ADC_ConvCpltCallback but there's nothing inside the DMA-buffer (which is defined as volatile inside a secure and privileged SRAM-area). I've tried different ADC conversion rates, clock rates and clock sources, checked for errors (especially overruns) and secure faults (with GTZC), there's absolutely nothing. I guess it must have something to do with secure/privileged areas or peripherals but since all the parts are secure and privileged I don't know what it could be. I'd be thankful for any suggestions; here is my ADC DMA-init

HelloWe are considering STM32 based processor for our next generation of products and would like to talk to a security expert with ST to discuss achieving CRA compliance.The "contact" page on the website down not provide a way to contact ST in the UK.

 TL;DR:On STM32G0B1 with SBSFU + SECoreBin, I want to design a secure crypto/key enclave for the user APP.Enclave should be WRP/PCROP/MPU protected.Only accessible via SVC/gateway from the unprivileged APP.Should remain updateable through SBSFU (included in .sfb). Is this approach feasible, and what is the recommended way to implement it?Hello,I am designing a product based on the STM32G0B1KEU6 MCU. I have integrated my project into SBSFU to harden security as much as possible.Currently, secure boot and secure update are protected by design (RDP, WRP and PCROP for flash, MPU for RAM). I tried to access SECoreBin crypto services from the user application but that results in a HardFault (SBSFU is configured to forbid this, by design).My question: what is the most secure approach to provide crypto operations and key storage to the user application itself?Can I mimic a kind of “custom SECoreBin” dedicated to AES/ECC operations and key management for the APP?Conceptually, my idea

The reference manual mentions that data swapping can be used when e.g. processing ASCII, but I'm not clear on exactly what it does. If I set it to byte mode, does that mean I can write single byte values padded to 32 bits with zeros into the FIFO? And with the bit mode, can I write single bits padded to 32 with zeros? What if I don't pad with zeros and just write 31 random bits plus the 1 bit I care about?Obviously I can gather the bits together into a 32 bit word and write it in one go, but that will involve the CPU. If I can write bits, or even just bytes, with DMA, it will improve performance considerably.

Hello @Jocelyn RICARD , @D.Botelho I am trying to enable debug authentication on a stm32h573 mcu following this example: https://community.st.com/t5/stm32-mcus/how-to-enable-rdp-like-product-state-flash-protection-in-stm32h5/ta-p/708082.I was able to generate the obk file and to transition the device to provisioning state:This my xml file and the current product state: But when trying to provision the obk file, i got this error:Do you know what could be the problem and how to recover from this state and provision the device ?Thank you!

Hello!I am trying to provision a DA certificate on STM32H563 through CANFD Bootloader in system memory.I am calling special function 0x83 as described in AN2606 and AN5405. As I can understand, this is an RSSLIB_PFUNC->DataProvisioning.I am filling the structure and place it to the SRAM3. See the picture/hex.typedef struct { uint32_t *pSource; uint32_t *pDestination; uint32_t Size; uint32_t DoEncryption; uint32_t Crc; } RSSLIB_DataProvisioningConf_t;The structure is placed in 0x2005C000The 0x60 bytes of the obk payload is placed in 0x2005C000.The fuction returns Error code 0xF5F58080 (CRC Error).I've tried several algorythms, byte-reversal, but could not get it worked.I tried to find an example of using this function, but without success.So, I am asking for some code example showing this function.Maybe I need to prepare data somehow. Or add another data in crc calculations.Thanks!  

Hello,I have two applications: one at 0x08000000 and one at 0x08080000. Both run fine individually (when setting the boot config bytes to the fitting offset). Now I want to use the one at 0x08000000 as secure area and escape it by using exitSecureArea. In the debugger, I can observe that the code runs fine until the very call to exitSecureArea. Now my questions are:1. Is there something else I need to to? This seems to suggest that I need to set the VTOR register. I currently (try to) do it before the call to exitSecureArea.2. If I need to setup the VTOR register, is my code below correct? Or do I need to do it differently/at a different place?3. Does exitSecureArea also work when the secure area is not set? I only tried without setting it as not to brick the device.4. Is there a way to debug this nicely?  Spoiler (Highlight to read)typedef struct{uint32_t sizeInBytes; /*!< pass 0 for an empty secure area */uint32_t startAddress; /*!< pass NULL for an empty secure area

When I tried it, got the following error:2025-04-18 14:58:31,172 - DEBUG - Executing command: "C:\Program Files\STMicroelectronics\STM32Cube\STM32CubeProgrammer\bin\STM32_Programmer_CLI.exe" -c port=JLINK debugauth=22025-04-18 14:58:31,674 - DEBUG - -------------------------------------------------------------------2025-04-18 14:58:31,674 - DEBUG - STM32CubeProgrammer v2.19.02025-04-18 14:58:31,674 - DEBUG - -------------------------------------------------------------------2025-04-18 14:58:31,675 - DEBUG -2025-04-18 14:58:31,678 - DEBUG - Connecting to J-Link/Flasher Probe2025-04-18 14:58:32,043 - DEBUG - Device=Cortex-M332025-04-18 14:58:32,133 - DEBUG - Device ID : 0x4842025-04-18 14:58:32,134 - DEBUG - Voltage : 3.32V2025-04-18 14:58:32,135 - DEBUG - Frequency : 4000 KHz2025-04-18 14:58:32,218 - DEBUG - Flash size : 2 MBytes2025-04-18 14:58:32,221 - DEBUG - Error: Debug Authentication is not yet supported by J-Link2025-04-18 14:58:32,250 - ERROR - Command '"C:\Program Files\STMicro

Post edited by ST moderator to be inline with the community rules especially with the code sharing. In next time please use </> button to paste your code. Please read this post: How to insert source code Hello,I am trying to use AES GCM on the STM32U545.When I verify the result, I use the site "AES Encryption Online - Ciphereditor". In the vector, I have to input the value without the counter (0x02); otherwise, the results don't match.Why is this happening? Here are my test vectors: Data: 02 03 04 05 06 07 08 09Key: 59 9e b6 5e 6b 2a 2a 7f cc 40 e5 1c 4f 6e 32 57IV: d4 07 30 1c fa 29 af 85 25 98 1c 17 00 00 00 02AAD: 29 0A 0B 0C Configuration: aesGcmDesc.KeySize = CRYP_KEYSIZE_128B; aesGcmDesc.DataType = CRYP_NO_SWAP; aesGcmDesc.Algorithm = CRYP_AES_GCM_GMAC; aesGcmDesc.pKey = (uint32_t*)v->key; aesGcmDesc.pInitVect = (uint32_t*)v->iv; aesGcmDesc.pAAD = (uint32_t*)v->aad; aesGcmDesc.AADSize = 4; aesGcmDesc.TagSize = 16; aesGcmDesc.Timeout = 0xFF;  

There are several peripherals that have a separate layer of protection based on privileged/unprivileged, here are some examples from the reference manual:MCE:39.2 MCE main features"AHB configuration port, privileged aware"RTC:49.2 RTC main features"Alarm A, alarm B, wake-up Timer and timestamp individual privilege protection"A first question would be: What privilege is being talked about?Is it the CPU's current (un)privileged mode when the CPU has sent the access request?Or is it the CPU's current (un)privileged mode independent of whether the CPU has sent the access request?Or is it any bus master's current (un)privileged mode (assuming every bus master has such concept) when that bus master has sent the access request?It does appear that other bus masters have privilege-based protection:GPDMA:12.2 GPDMA main features"Privileged/unprivileged support:- Support for privileged and unprivileged GPDMA transfers, independently at achannel level- Privileged-aware AHB slave port"HPD

Hi, I’m working on porting TF-M to a custom hardware platform based on the STM32U545 running Zephyr. As a starting point, I copied the existing b_u585_iot02a platform and adjusted it for the STM32U545’s 512 KB Flash. However, I haven’t been able to get it working. Has anyone already tried this port, or is there an existing example for the STM32U545?I add parts of the platform configuration files in attachment.Any guidance or references would be greatly appreciated!Lezhi

Hi everyone!In our project for stm32f446, we are trying to use X-CUBE-CRYPTOLIB to verify the firmware signature on the device using ED25519. Unfortunately, when trying to call the cmox_eddsa_verify method, we get the CMOX_ECC_ERR_MEMORY_FAIL error. The error occurs when memory is allocated. Tell me how to overcome this, or perhaps we are doing something wrong.Below is the codebool FirmwareCrypt::verify(const uint8_t* data, size_t size, const uint8_t* sign, size_t sign_size) { if (!data || !size) return false; cmox_ecc_handle_t handle; uint8_t ecc_buf[ECC_BUF_SIZE// 2048]; uint32_t fault_check = 0; memset((void*)&handle, 0, sizeof(cmox_ecc_handle_t)); cmox_ecc_construct(&handle, CMOX_ECC256_MATH_FUNCS, ecc_buf, ECC_BUF_SIZE); cmox_ecc_retval_t ret = cmox_eddsa_verify(&handle, CMOX_ECC_CURVE_ED25519, public_key, PUBLIC_KEY_SIZE, data, size/*~100Kb*/, sign, sign_size, NULL/*&fault_check*/); if (/*(static_cast<uint32_t>(ret) != fault_check) &&am

Hello Firends,Two Questions...1. Firmware Flash with DFU Bootloader succesfully done along with RDP bit. Can we re-flash the fiirmware once RDP L1 is set before through DFU using USB ? my custom board uses STM32F303Rb device. 2. Each STM32 device has UID of 96 bit, Can we use this UID to Club with Firmware so that each firmware image is specifc to that particular Device ? Pls. suggest any Hardware tool / Software tool avilable for same. I found one is segger Flasher secure device, but very expensive. Regards,Bsuthar