STM32 MCUs Security

Hi, I'm trying to adapt the SBSFU-Cube repository example for the B-U585I-IOT02A (STM32CubeU5\Projects\B-U585I-IOT02A\Applications\SBSFU, repository V1.7.0) to a custom PCB with STM32U585CITx. Since I don't have access to UART1 I changed it in com.h (both headers) and low_level_com.c to UART2. Also I'm using a J-Link, so I changed the connection configurations in the scripts accordingly. Since I don't have access to the BOOT0-pin I set the option bytes nSWBOOT0=0 and nBOOT0=1. Building the FW and running the scripts works flawless, also an investigation with STM32CubeProgrammer shows, that the binaries (Appli, Boot and Loader) are correct and at the flash-addresses where they are supposed to be. But when I reset the MCU after running SBSFU_UPDATE.sh there is absolute radio silence. Nothing shows on the Tera Term-terminal and also adding logs for Segger RTT viewer doesn't change anything, there's no feedback at all. I re-checked the option bytes, boot addresses, compared the flash

Hello,(previous post was marked as spam - I don't know why, so I'm posting again...)I've been working on Provisioning my STM32H563 and after 3 weeks of not touching it, I am unable to perform Full Regression or Debug Authentication on my password-provisioned Nucleo Board. I tried using the generated bash scripts from CubeIDE/MX (which are using STM32_Programmer_CLI) and also STM32CubeProgrammer GUI.I remember before the vacation, I could open and close the Board at will. I always used the same password.bin.Provisioning always happened using the generated provisioning.sh script.Here is the Output of STM32CubeProgrammer (I found it has more info than dbg_auth.sh), after trying Discovery and Full Regression:  17:21:34 : Start Debug Authentication Sequence 17:21:34 : SDMOpen : 609 : open : SDM API v1.0 17:21:34 : SDMOpen : 610 : open : SDM Library version v1.1.0 17:21:34 : open_comms : 501 : open : Asserting target reset 17:21:34 : open_comms : 505 : open : Writing magic number 1

Hi everybody!We have to implement firmware update feature via CAN interface. Our challenge involves implementing a secure and safe firmware update feature via the CAN bus, driven by regulatory requirements in the medical field. Unfortunately, the exact specifications are currently unknown.I found X-CUBE-SBSFU and it seems like a great solution. However, I can't find any reference or example where X-CUBE-SBSFU is can be or used with CAN interface.Is it possible to use the X-CUBE-SBSFU solution with CAN interface (by implementing "CAN loader" for example)?Thank you in advance!

Hi All,I am new to SBSFU. I have gone through x-cube-sbfu getting started document in that document provide for UART- based example. can it be implemented with FD/CAN Protocol.Regards,Devank_J

I am looking on how to encrypt my OBKey data using HUK during provisioning.HUK is device specific then how can we give this HUK Key to Trusted package creator to download the OBKey data?

Hello,I am developing with an L4 series MCU.If there is a program in the MCU and the read protection flag is not active (Level 0), when I load a program that activates the read protection flag (Level 1), there is no problem if I cut the power from the USB port or the programming pins.But if the MCU's read protection flag is active (Level 1) and I set it Level 1 and load a code that activates the read protection flag (Level 1) in the program again, when I power down by removing the programmer pins and give it again. In that case, the program doesn't start and when I connect with cubeprogrammer, RDP is active and its value is 0xFF instead of 0xBB.When I examined it a little more, I saw that the PCROP values ​​​​changed when the code did not start. Probably the reason why the code did not start is that PCROP_RDP is active.But the question is why do I experience this if I power down by removing the programmer pins?    

Hello,I want to use the security features included in the TFM in my application, I have followed UM2851, now,I have a better understanding for TFM and I succeed to implement it in STM32U585, to go further I want ot implement my own non-secure application and to interact and use secure services via PSA APIs, I have searched all the web for that, but I didn't find a hint.Any explanation or a hint, please ! Thank you.Regards,ZK.

Hi,I am evaluating/learning the SBSFU application example on STM32WBA55CG and having issues getting it up and running. Below is the screenshot of the example log:To begin with, I want to be able to do the following.1. Flash the bootloader and flash the application.2. Reset and bootloader validates the image, all verification pass.3. Bootloader now allows the application to launch.I have made a few changes to the project to disable security features for simplification. All changes are contained to the below files (attached) and disabled FLOW_CONTROL(via flags).  And I have removed the static protection check calls from boot_platform_init( ), inserting the code snippet below as unable to attach the file.int32_t boot_platform_init(void) { #ifdef MCUBOOT_EXT_LOADER GPIO_InitTypeDef GPIO_Init; #endif /* MCUBOOT_EXT_LOADER */ /* STM32WBAxx HAL library initialization: - Systick timer is configured by default as source of time base, but user can eventually implement his proper ti

I'm trying to find out the exact steps to regress an STM32U083 to an erased state after programming it with the OEMiRoT example project and and locking it to RDP2 by the accompanying provisioning.bat script.Will be using STM32CubeProgrammerCLI (or the GUI version at first just to test the steps) for the regression.Something like chapter 10 of the STM32U5 AN5347 would be nice (https://www.st.com/resource/en/application_note/dm00625692-stm32l5-series-trustzone-features-stmicroelectronics.pdf)or like this forum post on U5: https://community.st.com/t5/stm32-mcus/how-to-regress-from-rdp-level-2-to-rdp-level-0-on-the-stm32u5/ta-p/568476Especially the "Disable RDP regression with a password" action in the programmer GUI seems very counter-intuitive to do for an RDP2 level locked chip, as if you would deliberately brick it by disabling the regression (no password in level 2 = bricked). Is this always a safe step? Because as long as the level is 2, the password will be necessary to regress

Good day.I use in my project transfer of information between devices, for encryption and authentication I use the CCM mode (self-written library) as the encryption base I use AES-ECB.A device from the G0 series was added to my project, STM Cryptographic Library V4 used there and everything is fine, except for one thing, with the same input data, the encrypted data is absolutely the same as in my library, but the MIC is different and I can't understand what the reason is. my library is built entirely on the standard NIST SP 800‑38C.accordingly, according to a similar scheme:     If anyone understands CCM, can you direct me to what might be wrong in my implementation (I am ready to provide the code)  in addition, I noticed some oddities in the STM Cryptographic Library , when SINGLE CALL USAGE, can specify ADD of 8 or 16 bytes, and when MULTIPLE CALLS USAGE, then if specify a length of 8 bytes, then the MIC is not output at all, and if specify 16 bytes,

Hi. How can i connect a debug session to a device with product-state: closed and non secure software (no TZ active) without full regression.   I have create the password.bin file and two certificate files with TrustZone Package Creator: - DA with password - DA with certificate But i can't get a connetion to the device, neither with the password nor with the certificate file. The message is: Wrong key file path.But the key-file exist's and the path exists.   Does anyone know, how to connect?         ------------------------------------------------------------------- STM32CubeProgrammer v2.18.0 ------------------------------------------------------------------- Permission request submitted : 2 Warning: Wrong key file path: D:\Projekte\ST\Product_State_Protection\password.bin Certificate file path submitted : D:\Projekte\ST\Product_State_Protection\DAH5_ConfigWithPassword.obk Start Debug Authentication Sequence Open SDM Lib SDMOpen : 624 :

Hello,I am using the Nucleo-STM32F411RE development board and require support for cryptographic functions, particularly ECC NIST P-256, MAC, etc, for my development use cases.To achieve this, I downloaded the X-CUBE-CRYPTOLIB v4.3.0 package as it was mentioned in the product brief. However, I could not find any example projects specifically for the STM32F4 series.I also attempted to modify examples from other STM32 series, but I encountered faults and was unable to successfully run the code.Could anyone provide a working example for the STM32F4 series, or share a step-by-step user guide? As I am new to STM32 MCU boards, this has been quite time-consuming, and any guidance would be greatly appreciated.Thank you for your help!Best regards,Akash M

Hello, I am trying to adapt the H753xx SBSFU implementation to the H745xx dual core board.I have so far configured a second slot by creating a second MPU region of 1KB to protect the header of the second slot, as well as changing the security checks in the function SFU_IMG_InitImageHandling of the sfu_fwimg_common.c file. You can find code snippets below: if (!((SlotHeaderAdd[SLOT_ACTIVE_1] >= SFU_PROTECT_MPU_HEADER_START) && ((SlotHeaderAdd[SLOT_ACTIVE_1] + SE_FW_HEADER_TOT_LEN) <= (SFU_PROTECT_MPU_HEADER_START + mpu_size)))) { TRACE("\r\n= [FWIMG] Header of SLOT_ACTIVE_%d is not under the MPU protection\r\n", i + 1U); e_ret_status = SFU_IMG_INIT_FLASH_CONSTRAINTS_ERROR; }   // Check second header if (!((SlotHeaderAdd[SLOT_ACTIVE_2] >= SFU_PROTECT_MPU_HEADER_2_START) && ((SlotHeaderAdd[SLOT_ACTIVE_2] + SE_FW_HEADER_TOT_LEN) <= (SFU_PROTECT_MPU_HEADER_2_START + mpu_size)))) { TRACE("\r\n= [FWIMG] Header of SLOT_ACTIVE_%d is not under the MPU

Hi,I am struggling to get `HAL_PKA_ECCCompleteAddition` implemented correctly, that is, if I'm comparing the projective coordinates with a reference implementation, the results don't match. Same goes for converting the projective coordinates back to affine coordinates using `HAL_PKA_ECCProjective2Affine`. I am using a STM32u585vi microprocessor, and was able to use `HAL_PKA_ECCMul` properly already. See below the function that shows incorrect results. Could you please provide help to proceed here?ps. In its current form, the projective X coordinate produces equal results as a C# BountyCastle reference implementation.   bool ecc_secp256r1_add_points_projective(const generator_point_t* p1, const generator_point_t* p2, generator_point_t* pOut) { const uint8_t Z_projective_input[prime256v1_Prime_len] = {[0] = 0, [31] = 1}; uint8_t X[prime256v1_Prime_len]; uint8_t Y[prime256v1_Prime_len]; uint8_t Z[prime256v1_Prime_len]; PKA_ECCCompleteAdditionInTypeDef eccAd

Hi,I try to use PKA for some ECDSA computation. For this purpose I needed to use PKA block. However, in SR register, I never get INITOK bit set. I am working with TrustZone enabled. So, STiRoT is executed before my program.After investigation, I've seen that bit SEIS in  RNG_SR is set. (while CEIS=0)Despite reference manual stating in this case, it means some thing went wrong and RNG was able to auto-reset and recover, I think this is what is preventing PKA INITOK to be set."INITOK: PKA initialization OKThis bit is asserted when PKA initialization is complete. When RNG is not able to output properrandom numbers INITOK stays at 0."With same program and with TrustZone disabled(Hence, STiRoT is not executed), RNG is correctly configured without any SEIS error and PKA INITOK bit is set. I am using RNG in A configuration.RNG = { CR = 0xf00e04, SR = 0x41, DR = 0x31b4c84e, NSCR = 0x3af66, HTCR = 0x6a91 }HCLK(AHB2) is 250 Mhz and HSI48 is used for RNG sampling.Could someone

Title edited to be more descriptive than just "USB"HI,I Need help, My application Requires  Firmware updates using USB DFU Mode, and planning to make a custom Pc software that updates code using USB. How can I Make sure that only my Pc software should have access to connect the STM 32 using USB and update the code , How i can implement this security feature in My application? Does the USB library provide any authentication techniques So that I can integrate it for My custom application?Thanks and Regards JIJO 

Hi,I'm currently experimenting with the decryption of custom data provisioned into the OBKeys storage with hardware encryption enabled.I've successfully provisioned the data without encryption and read it back intact.  With encryption enabled, I see that the data that I read back is different after every new provisioning/code change attempt which is as I expect, but I have not successfully decrypted it.  My code is based on code in low_level_obkeys.c from one of the Nucleo H533RE OEMiROT_Boot application examples.  Here's my code with error checking removed for compactness (no errors are returned, the code runs fine, just the output is not correct).  Note: temp_data contains the encrypted data exactly as read from the OBKeys region.  Once I get this working, I guess I'll just try decrypt directly from the OBKeys region. CRYP_HandleTypeDef hcryp = { 0U }; uint32_t a_aes_iv[4] = {0x8001D1CEU, 0xD1CED1CEU, 0xD1CE8001U, 0xCED1CED1U}; __HAL_RCC_SBS_CLK_ENABLE(

How can we map HDPL levels to ST boot/ User Boot / User secure app/ user unsecure app in STM32H573 controller ? In user flash if I want to place my OEM ROT , OEM uROT, Secure App and Unsecure App, How do I map each HDPL level to corresponding boot or user application ?

I tried to provision Secure Manager 1.2 to my DK board, and got the following error messages in the provisioning.log:2024-11-10 15:49:30,796 - root - DEBUG - Error: SFI command is not supported for the current device configuration using STLINK interfaces !2024-11-10 15:49:30,796 - root - DEBUG - Error: Cannot launch RSSe...2024-11-10 15:49:30,796 - root - DEBUG -2024-11-10 15:49:30,796 - root - DEBUG - Error: C:\Users\cbens\STM32Cube\Repository\STM32Cube_FW_H5_V1.3.0\Projects\STM32H573I-DK\ROT_Provisioning\SM\Binary\SecureManagerPackage.sfi SFI file Install Operation Failure! Please, try again.2024-11-10 15:49:30,796 - root - DEBUG -Then I booted the DK board in DFU mode, and used the programmer 2.17 to program the sfi, but still failed either "could not connect to the device" if SW1=0, or the following errors if SW1 = 1 (I know according to the instructions it should not be 1.)17:23:44 : Erasing memory corresponding to segment 0:17:23:44 : Not flash Memory : No erase done17:23:44

I am encountering an issue in the development of the TrustZone application related to the UART in secure non-privileged mode.I want to switch to non-privileged mode when in secure and privileged mode. This transition works correctly. However, I have noticed that the UART does not work in non-privileged mode, even though it functions in privileged mode.When I execute the code, it consistently ends up in the HardFaultHandler(). After debugging, I identified that the error occurs on line 227 of the main file, specifically during the call to the HAL_UART_Receive() function.To configure the peripherals, I used the GTZC.Detailed AnalysisEvent detected in the SFR register:The UUSART1F bit is activated, indicating an illegal access event.Upon verification, the USART is correctly configured in the desired mode: the secure bit is set to 1, and I am in non-privileged mode.Mode Transition:The switch from privileged to non-privileged mode works, as the ARM control bit (in the CONTROL register) is c

I have finally managed to get the SBSFU to work on my STM32F4-Discovery board. I've been working on this over the past month until I figured it out and got it to work. For some reason, I couldn't get the 2_Image version to work on my hardware. I believe the FW header was overlapping with one of the Memory Slots' Regions on flash sectors. Will try to get back to this later, however, the 1_Image version worked fine. Because I wanted to understand the structure of the 3-project based SBSFU lib, I started with new projects from scratch and then added all files, dependencies, IDE configurations, scatter and asm files, and finally modified the .BAT files according to the new location of my projects. The first two projects worked flawlessly, however, I couldn't imitate the same process for the third project, UserApp, where the customer's firmware merges with the SBSFU core. The project compiles successfully, but the postbuild .BAT script fails to complete the process and no binaries are gener

Dear STMicroelectronics,The problem described here: OEMiROT example flash protect sector problem seems to still be present in STM32Cube_FW_H5_V1.4.0. I tested to rebuild Projects/NUCLEO-H563ZI/ROT_Provisioning/OEMiROT from STM32CubeIDE after changing flash_layout.h and indeed onlyNUCLEO-H563ZI/ROT_Provisioning/OEMiROT/img_config.shNUCLEO-H563ZI/ROT_Provisioning/OEMiROT/ob_flash_programming.sh are updated so if you run provisioning.bat, the OBs for SECWM2_END etc. will not be correctly set. Is there an internal ticket tracking a fix for this?    Best regards, Jesper 

Hi,Our product proposal to a client has at the root of its security an STM32H533 running our OEM Bootloader and Secure Application only.  The Product State will be either Closed or Locked (as yet undecided) and we will be storing encryption keys used to verify the integrity of other parts of the whole system in the OBKey area with HUK encryption enabled.The client has a very competent security team who will be attempting to break our security measures to highlight any vulnerabilities.  Before we've delivered any hardware to them, they've already started some research.  They are not familiar/experienced with STM32 micro-controllers.  They discovered an article where the researchers have been able to reliably corrupt the value returned when the RDP level is checked during a debug session on an STM32Lxx micro-controller.  This attack allows requests to read memory from the device with RDP level 1 active.The article contains the rather frustrating conclusion that "

I am using a stm32l451cet6 micro controller chip in my PCB. I want to make the flash memory read protected. For this I use the following code snippet -    while (HAL_FLASH_Unlock() != HAL_OK) { ; } while (HAL_FLASH_OB_Unlock() != HAL_OK) { ; } OptionsBytesStruct.OptionType = OPTIONBYTE_RDP; //Configure the RDP OptionsBytesStruct.RDPLevel = OB_RDP_LEVEL_1; while (HAL_FLASHEx_OBProgram(&OptionsBytesStruct) != HAL_OK) { ; } HAL_FLASH_OB_Launch();    Now this works perfectly and the board goes to level 1 protection. Now after a button press I want to change the read protection  to level 0 from level 1. I use the following code snippet to change the RDP level back to 0.   void __attribute__((__section__(".RamFunc"))) RDP_Regression(void) { __disable_irq(); // Disable interrupts while (HAL_FLASH_Unlock() != HAL_OK) { ; } while (HAL_FLASH_OB_Unlock() != HAL_OK) { ; } OptionsBytesStruct.OptionType = OPTIONBYTE_RDP; //Configure the RDP O

Hello,i'm using stm32h747igt6 microcontroller, it has two cores Arm Cortex-M7 + Cortex-M4, i'm currently working on core m7, and i have integrated STM32 cryptographic firmware library software expansion for STM32Cube for some security features in my project, when i use any encryption or decryption api, whether it's AES or RSA i got hard fault error at calling the library API, like:  retval = cmox_cipher_decrypt(CMOX_AES_CBC_DEC_ALGO,                                            Expected_Ciphertext, sizeof(Expected_Ciphertext),                                Key, sizeof(Key),                                                  IV, si