STM32 MCUs Security

Hello, I am using STM32F103c6 cortex-m3. I am using 100 micro controllers in various boards. In some around 10 micro controllers, I have seen a issue of option bytes getting corrupted. Even though I am writing 0xA5 to RDP to remove read protection while flashing, sometimes it makes memory read protected and few times it work properly. The remaining 90 MCUs works fine! Even the WRP also gets corrupted in those 10 MCUs. No where I am making Read protected in code, only write protection ! (Write protection is also removed at flashing by setting 0xA5 on RDP)Could it be because of power fluctuation? As we are doing few auto power interrupt tests!!What could be issue?I flashed the MCU multiple time which are misbehaving without running the code( just flashing with RDP 0xA5, sometimes it flashes, sometimes it gets read protected and doesnot Flash)!!Did the MCUs gone bad??

I am trying to run ECDH p384 operation on STM32H753.Using the STM32 Cryptolib 4.5.0, I get the CMOX_ECC_ERR_MEMORY_FAIL error during the operationI increased the stack size to the maximumI was able to run this using mbedTLS + hardware blocks like RNG, CRYP, CRC enabled. And it runs but the time for ECDH P384 is about 200ms (with 480mhs clock). I was hoping to achieve times in the order of tens of milliseconds as described here.What am I missing?https://wiki.st.com/stm32mcu/wiki/Security:STM32H7_Series:_Cryptographic_Library_Performance#tab=STM32H753 

Hi, I managed to enable TrustZone by setting the TZEN-bit to 1 like soSTM32_Programmer_CLI -c port=SWD -ob TZEN=1But I can't seem to manage to turn it off the same way. I've tried doing it from the graphical interface as well, with the same results. Do I have to do anything special on this board to set TZEN to 0?Here are my complete set of option bytes. I've only changed TZEN=1 myself.STM32_Programmer_CLI -c port=SWD -ob displ ------------------------------------------------------------------- STM32CubeProgrammer v2.20.0 ------------------------------------------------------------------- ST-LINK SN : 066BFF505048878667122712 ST-LINK FW : V2J45M31 Board : NUCLEO-L552ZE-Q Voltage : 3,26V SWD freq : 4000 KHz Connect mode: Normal Reset mode : Software reset Device ID : 0x472 Revision ID : Rev Z Device name : STM32L5xx Flash size : 512 KBytes (default) Device type : MCU Device CPU : Cortex-M33 BL Version : -- UPLOADING OPTION BYTES DATA ... Bank : 0x00 Address : 0x50022040 Size :

Hello!Using h563zi I am trying to update the second bank firmware using an application that has a Secure Part (sectors 0-9) and a Non Secure part with Trust Zone enabled. For easier maintenance the update is done from the Non-Secure part.Settings:SECWM1_STRT = 0x0SECWM1_END = 0x9SECWM2_STRT = 0x0SECWM2_END = 0x9What we do:1) Disable the secure watermark from the second bank (can also be done in STM32CubeProgrammer)ob_program.OptionType = OPTIONBYTE_WMSEC; ob_program.Banks = FLASH_BANK2; // Using 1 for start and 0 for end practically unlocks ob_program.WMSecStartSector = 0x1; ob_program.WMSecEndSector = 0x0; HAL_FLASHEx_OBProgram(&ob_program) HAL_FLASH_OB_Launch(); HAL_NVIC_SystemReset();2) Write the sectors from bank 2 from 0x0 to 0x9 from the Non-Secure application (since the watermark protection is off)3) Do a checksum on the written data (read back from sectors 0x0 to 0x9) and check it4) Check in STM32CubeProgrammer the data manually 5) Enable the secure watermark for th

From the manual UM3254:4.1.4 PSA firmware update service4.1.4.1 DescriptionThis service provides an implementation of the PSA firmware update API defined in [PSAfwuAPI]. It provides a standard and platform-agnostic interface for firmware updates.The firmware update scheme is based on a dual slot: one active slot and one download slot. The active slot is used to execute the firmware and the download slot is used to download the new image to be installed.The following images can be updated:• Nonsecure application• SMuRoT• Secure Manager• Secure modules (each can be updated independently)The installation flow is as follows:1. The nonsecure application (update agent) gets information about the installed images (such as name, installation status, version, and others).2. It downloads the image to the secure download slot.3. It requests the image installation. It resets the device to execute the secure boot stages (SMiRoT and SMuRoT) that perform the installation in the active slot and jumps

Hi @Jocelyn RICARD,im trying to enable the secure user memory on my custom bootloader for  STM32H755 and STM32H7B3 MCUs.The bootloader is on the first bank and the app on the second bank. The secure user memory is enabled successfully on bank 1 but jumping on Bank 2 with the follwing instruction works. But the debug port is not reopened before jumping to the application. I can see that the app is running (through a blinky led) but i cannot attach using cube programmer in hotplug mode:RSS_API->exitSecureArea(userAppAddress, RSS_ENABLE_JTAG_AT_EXIT);My question is, what is the value of RSS_ENABLE_JTAG_AT_EXIT ? Is it mcu dependent?The reference Manual does not give any info about the value of the macro:Could you help?Thank you!@VPanc.1 , @gpeh, @Fred , @Tesla DeLorean 

In current, I am using the NUCLEO-H753ZI of STM32CubeExpansion_SBSFU_V2.7.0 demo project.Hardfault error happens in SFU_SE_STACK_Clean api in case SFU_ISOLATE_SE_WITH_MPU is not used like "#undef SFU_ISOLATE_SE_WITH_MPU"the value of sp is 0.Please let me know how to resolve this issue.static void SFU_SE_STACK_Clean(void){  uint32_t sp_base = SE_REGION_RAM_START;  uint32_t sp_top = SE_REGION_RAM_STACK_TOP;  uint32_t sp = __get_MSP();TRACE("\r\n= [SBOOT-MWU] SFU_SE_STACK_Clean[0x%08x]",sp);   if ((sp > sp_base) && (sp <= sp_top))  {    while (sp_base < sp)    {      *(__IO uint32_t *)sp_base = 0U;      sp_base += 4U;    }  }  else  {    /*  error trigger a reset */    HAL_NVIC_SystemReset();  }}

Hello,I try to implement a tamper detection for my project. In general, it works. When the device is only powered by a coin cell and a tamper is detected, the backup registers are erased and unfortunately also the backup RAM. When the device is powered and a tamper is detected while the firmware is accessing the backup RAM, an imprecise memfault is generated.Because of performance reasons, I didn't try to guard every byte written into the backup RAM. Instead, I only guard a std::copy, and this (obviously) is not enough. Because of that, I tried to enable the tamper interrupt to catch the tamper event and solve it, before I continue with the copy. The data copied into the backup RAM will be corrupted, but that is okay and can easily corrected. But unfortunately, this does also not work. I still get a memfault before I get the tamper interrupt.What I want to archive is to delete only the RTC backup registers during a tamper event. That is the place where I keep my secret keys. The backup

I would like to increase the code readout protection level from 0 to 1 programmatically in an STM32G030.  I must be doing something silly and if anyone sees it, I'd be grateful.  I've stepped through it with the debugger and the flash and option byte locks are indeed removed. The write to the option register doesn't show up in the debugger (still shows 0xAA), There are no errors in the FLASH SR or CR registers after the OPTSTART bit is set.  The debugger loses connection when OBL_LAUNCH is set (presumably due to the reset).  After the reset, the RDP byte in the flash OPTR is still set to 0xAA. It is still 0xAA after the device is power cycled. The code is:    // Set code readout protection __disable_irq(); // unlock flash memory (LOCK bit in FLASH_CR) FLASH->KEYR = 0x45670123; FLASH->KEYR = 0xCDEF89AB; // wait for flash unlocked while (FLASH->CR & FLASH_CR_LOCK); // clear option lock (OPTLOCK bit in FLASH_CR) FLASH->OPTKEYR = 0

Hello,It seems to me that the wiki page: https://wiki.stmicroelectronics.cn/stm32mcu/wiki/Security:Secure_storage-SAES_key_wrapping_for_STM32N6 is unavailable as I get the message: "Page not found".I tried searching for it, to no avail. Is the related information present somewhere else?Thank you for your time,kradzphsys

Hi,I'm currently developing on the STM32H743ZI microcontroller and have successfully implemented secure boot using the X-CUBE-SBSFU package. Now, I want to update the ECC public key at runtime on the device.While reviewing the Getting Started with the X-CUBE-SBSFU user manual, I came across a section mentioning that an updatable key with a static ID can be securely updated using the KMS (Key Management Services) and a specific encrypted format. However, I'm having trouble locating the KMS example project and the tool required to generate the encrypted key blob for this process—especially for devices running at RDP Level 1. Additionally, I would like to understand the debug access limitations:Can I still access the device via JTAG when SBSFU is enabled, and the device is set to RDP Level 1 or Level 2?Regards,Manoj

Hi, I am working on NUCLEO-H743ZI EVK to test the secure boot using X-CUBE-SBSFU-v2.7.0 package. I have successfully uploaded the boot image at the location 0x8000000 address and i have uploaded the userapp.sbf file using tera-term tool. I have followed the user manual of Getting started with the X-CUBE-SBSFU STM32Cube Expansion Package - User manual for all my set up. And now i just want to erase the flash memory using stm32cubeprogrammer tool but am unable to flash the normal led application after erasing. Please look into the images mentioned below for your reference. 1. The below error is coming when uploading the basic led example. Error: Failed to read memory at address 0x08000000 during verification Error: Download verification failed 2. Settings of RDP and Boot Option Bytes 3.  Settings of write protection 4. Settings of ST-LINK connection 4. The below image is my first uploaded userapp A. Please guide me on how to erase the flash memory fully using programme

I am currently facing a critical issue with reading and programming two OBK sectors (current and alternate) from within firmware while using the iCache on the STM32H562. Despite my efforts to disable iCache access to the OBK address range using the MPU, similar to the procedure for the OTP and RO regions, I have not been successful. The use of iCache has resulted in the microcontroller stalling when attempting to read from the OBK address range.I understand that the Reference Manual does not specify the actual physical address range for the two OBK sectors, each of which is 8k in size. Instead, it indicates that both sectors share the same virtual address range, with a base of 0x0BFD0000 (non-secure) or 0x0FFD0000 (secure).Could you please provide the actual physical address range for the two OBK sectors? This information is necessary to adjust the MPU settings for disabling iCache access.

Dear ST,For the implementation of many security mechanisms (e.g., the MARCH C algorithm), the use of a RAM backup buffer is proposed. However, I can't find a RAM backup buffer in the STM32G0 family datasheet. I also can't find the SRAM Backup option in the STM32F4 family.Could you help me?Thank you.

Hello,I am using X-CUBE SBSFU for an application running on STM32H750 mcu.The user application is running from QSPI, and I want to encrypt/decrypt some data that will be stored into an external EEPROM.To do this I would like to use an AES algorithm and I would like to store the crypto key in a secure area.In this regard it is not clear to me whether it is possible to store selected data/code in secure flash that can be accessed through the call gate feature by the user application.I will use encrypted firmware update, so it would also be fine to access the firmware encryption AES private key or encryption functions using that key.Thanks to anyone who could help me to put some light on this topic,Ivan

When using TrustZone, the memory address changes from 0x0800 0000 to 0x0c00 0000. Is thr actual physical address the same? Or are the memory regions separated into a 0x0800 0000 region and a 0x0c00 0000 region? Using MCU stm32l562 freeRTOS

Hi all,I am looking into secure bootloader options for the STM32U5G9J-DK2 that support application updates using TF-M,please give me guide lines to achieve secure bootloader.

Hi,I have generated a CubeMX project with trustzone. So, I have a secure and a nonsecure project. The secure project runs, jumps to the nonsecure project and the nonsecure project tries to blink the red. I am using CMakeLists and have included my_app.c file, in the nonsecure project, where my main() function is located.  My my_app.c file:#include <stdbool.h> // Auto-generated main from STM32 project #include "main.h" #include "stm32wbaxx_hal_gpio.h" int main(void) { HAL_Init(); SystemClock_Config(); MX_GPIO_Init(); main2(); while (true) { HAL_GPIO_WritePin(RED_GPIO_Port, RED_Pin, GPIO_PIN_SET); HAL_Delay(250U); HAL_GPIO_WritePin(RED_GPIO_Port, RED_Pin, GPIO_PIN_RESET); HAL_Delay(250U); } } The main2() is the original main generated by CubeMX, but I have renamed it and removed everything else from there, and now it only has the blinking LED code. My main2() function in the nonsecure project main.c file: int main2(void) { HAL_GPIO_WritePin(RED_GPIO_Por

We appreciate the example in the STM32Cube repository, located at STM32Cube_FW_H5_V1.1.1\Projects\NUCLEO\H563ZI\Examples\FLASH\FLASH_OBK_EraseProgram. We are looking to modify the product state and write the .obk file directly from the firmware, and we believe your example is a great starting point.STM has detailed a procedure for writing to the alternate OBK sector using the non-secure FLASH_NSOBKCFGR register. The addressing for the OBK sector is set to the base address 0x0BFD0000 (non-secure) rather than 0x0FFD0000 (secure).However, we noticed that the STM32CubeProgrammer employs secure base addressing for the OBK sector, while your example uses non-secure addressing. This difference is essential for our understanding. Could you please explain the reason for using non-secure addressing in your example?According to Figure 32, "Swap Workflow", of the Reference Manual, the role of the current OBK sector and the alternate OBK sector is interchanged after the Swap operation. Thus, w

Hello ST Community,I am working with an STM32U5 based board and facing serious issue related to RDP Level 2 and debug access. I am attempting to recover the device using STM32 Programmer CLI and Cube Programmer  but it is not responding as expected even after a successful RDP2 password unlock.$ STM32_Programmer_CLI.exe -c port=swd mode=UR -unlockrdp2 0x18BBDDEF 0x19CCBBEF-------------------------------------------------------------------STM32CubeProgrammer v2.19.0-------------------------------------------------------------------ST-LINK SN : 003200253133510636303739ST-LINK FW : V3J15M7B5S1Board : STLINK-V3SETVoltage : 3.54VError: Unable to get core IDError: No STM32 target found! If your product embeds Debug Authentication, please perform a discovery using Debug AuthenticationError: Unable to get core IDST-LINK SN : 003200253133510636303739ST-LINK FW : V3J15M7B5S1Board : STLINK-V3SETVoltage : 3.54VUnlock RDP2 password successfully doneError: ST-LINK error (DEV_TARGET_NOT_HALTED)&n

Moved from this thread.Any method to implement X-CUBE-CRYPTOLIB in a project ?

I am working through this course but am stuck because the new 2.0.0 version of SM no longer provides the batch files like provisioning_auto.bat that are referenced in the course and I am unsure how to continue.Also posted this on the course page at https://community.st.com/t5/stm32-online-courses/stm32h5-secure-manager-course/bc-p/817896/highlight/true#M24 but putting it here, too, for better visibility. Any help is appreciated.Thanks,Chris

We attempted to change the product state to "Closed" on STM32H523, and this operation was successful. We can perform a full regression to the "Open" state. However, we are experiencing unexpected behaviour during the provisioning stage. The code in the microcontroller was not executing, and the Keil debugger was unable to connect with an error message "Could not Stop Cortex-M device". A reset did not resolve the issue, indicating that the code could not run. After switching the microcontroller to the "Closed" product state, the code ran properly again.We likely need to modify specific settings in the options byte to enable the code to run during the provisioning state. We would appreciate assistance in resolving this issue, as we would like to change the product state and write the .obk file directly from the firmware.

Hi, I am working on the STM32H533RE microcontroller and implementing AES-CCM encryption using a NIST test vector for validation. While the encrypted output matches the expected result, the authentication tag generated is incorrect. I have shared the relevant code and configuration above for reference.CRYP_HandleTypeDef hcryp; uint32_t pKeyAES[4] = {0x40414243,0x44454647,0x48494A4B,0x4C4D4E4F}; __ALIGN_BEGIN static const uint8_t HeaderAES[16] __ALIGN_END = { 0x00, 0x08, // Length = 8 bytes 0x00, 0x01, 0x02, 0x03, // AAD 0x04, 0x05, 0x06, 0x07, 0x00, 0x00, 0x00, 0x00, // Padding 0x00, 0x00 }; __ALIGN_BEGIN static const uint32_t B0AES[4] __ALIGN_END = { 0x4f101112,0x13141516,0x00000000,0x00000004}; uint8_t sampledata[4] = {0x20, 0x21, 0x22, 0x23}; uint8_t sampleoutputdata[8]; uint32_t sampletagdata[8]; // 4 bytes static void MX_AES_Init(void) { /* USER CODE BEGIN AES_Init 0 */ /* USER CODE END AES_Init 0 */ /* USER CODE BEGIN AES_Init 1 */ /* USER CODE END AES_

Hello! I would have an app that is divided between a secure part and a non secure part. The memory definition is as following in the secure linker script: /* Memories definition */ MEMORY { RAM (xrw) : ORIGIN = 0x30000000, LENGTH = 320K FLASH (rx) : ORIGIN = 0x0C000000, LENGTH = 64K FLASH_NSC (rx) : ORIGIN = 0x0C010000, LENGTH = 8K } The first 9 sectors (0-8) are of the secure part.When attempting to erase sector 9 (the 10th) sector from the Secure application part using:'HAL_FLASHEx_Erase' I get a HAL_FLASH_ERROR_ECCD error. I require this for software update, I am trying to do the following on the INACTIVE bank:1) Delete the secure sectors and update with a new secure app2) Delete the non-secure sectors and update with a new non-secure app From my knowledge the secure part should be able to erase the non-secure part without any problems.