STM32 MCUs Security

Hello,I have programmed the OTP word 31 to 0xBBBBBBBB as follows, but when I want to write another value such as 0x12345678 or 0x00000000 to word 31, it reported the following errors， can you help to analyze this ? Thanks a lot!  

Dear ST Team,              I am currently porting an SBSFU/Trust Zone -based application from the STM32U585 to the STM32U5A5. The migration is almost complete, and the bootloader is functioning as expected.    The following operations complete successfully:BL2/SBSFU boots correctly. Image authentication and verification succeed. The application vector table is read correctly. The application jump is initiated using:boot_jump_to_next_image((uint32_t)&boot_jump_to_next_image, vt->reset);     Both addresses appear to be valid:MSP points to Secure SRAM. Reset vector points to Secure Flash with the Thumb bit set.The application successfully reaches the Reset_Handler, so the jump from SBSFU to the application appears to be successful.However, during the startup code, execution gets stuck while clearing the .bss section.The relevant startup code is shown below:ldr r2, =_sbssb   LoopFillZerobss FillZerobss:    movs r3, #0    str  r3, [r2], #4 LoopFillZerobss:    ldr r3, =_ebss    cmp r

Hi everyone,I am trying to generate a professional SBOM for my project.I have a few questions regarding the best workflow:Tooling & Detection: What the best tool to generate the SBOM.I tried using ScanCode, but it didn't find any component in my project (e.g., FreeRTOS). I had to manually add .about files to the folder to get results. Is there a better tool that can generate the SBOM with minimal manual intervention?ST Cube SBOM : The Cube MCU packages contain dozens of libraries (FatFS, FreeRTOS, USB_Host, etc.). If my project only uses FatFS, the package JSON still lists everything. Do I have to manually extract the components I use from the ST JSON? how to get use of the ST SBOM?I’d love to hear if anyone has a script or a specific toolchain that automates this without the manual "copy-paste" from the ST manifests Thank you!Yahya  

Dear,Is it possible for execution within HDPL_x to use SAES (Secure AES) with a DHUK (Derived Hardware Unique Key) from HDPL_y where x > y?For example:Execution within HDPL2 makes use of SAES to encrypt plaintext p using its DHUK, this results in ciphertext cAfterwards, upon reset, execution within HDPL1 needs to be able to read plaintext p (e.g., by decrypting the stored ciphertext c using HDPL2's DHUK) without changing the HDPL.Is this possible with SAES, and if yes, how?Thanks a lot!

Hi Everybody,I posted a comment here https://community.st.com/t5/stm32-online-courses/stm32h5-secure-manager-course/bc-p/824487/highlight/true#M27 yesterday because I am trying following the online course and what is written in the wiki to start developing an application on the STM32H573VI using the secure manager.At the moment I am starting the development by using the nucleo board for H573 however, by following the wiki, the only project that could be used for deploying the solution is an handswritten example that does not use the CubeMx.If I try to follow the old documentation on the youtube videos, as explained in the link provided, I am unable to set the boot path correctly.At the moment I am a bit lost, should I build my project without the use of CubeMx in case of secure manager? Will it be added in the future? I am missing something straightforward? thank you in advanceAndrea

Hello, I have an STM32H573 project with TrustZone enabled. After the CPU goes into non-secure mode and during execution of the HAL_Init() function (more specifics below) a hard fault occurs. There is only a hard fault during the execution from a non-secure state. In the secure state (at boot) the HAL_Init() function successfully runs. Is there a configuration for the RCC not enabled by default that I a missing, allowing it to be accessed by both Secure and Non-Secure CPU states?Within GTZC_S TZSC - Privilegeable peripherals I cannot enable it. I see no relevant settings (I have tested a few that might be loosely related but no solved) in RCC. In the code below I have used an arrow (<--) to denote exactly where the hard fault occurs (Verified with debugger)Non-Secure Entry Code (CubeMX Generated):int main(void){ /* USER CODE BEGIN 1 */ /* USER CODE END 1 */ /* MCU Configuration--------------------------------------------------------*/ /* MPU Configuration-------------------------

Hi,we have a question regarding the Secure Manager Internal Trusted Storage size on the STM32H73 series.We have configured the following options:external flash profile 0 secure modules (=SMAK_0 ?)According to UM3254 it is our understanding the ITS size can now be up to 56 Kbyte:Our application project.py prebuild seems to extract value “9”, which means 9 * 8 Kbyte (Flash sector size) = 72 Kbyte? Jul  8 13:27:10 2026 : [INF] Searching the parameter with <Name>ITS size</Name> element2026-07-08 13:27:10,542 - DEBUG - Wed Jul  8 13:27:10 2026 : [INF] Parameter found. Verifying information of '<Value>0x9</Value>'2026-07-08 13:27:10,543 - DEBUG - Wed Jul  8 13:27:10 2026 : [INF] The modification is not necessary2026-07-08 13:27:10,543 - DEBUG - Wed Jul  8 13:27:10 2026 : [INF] The tag <Value> has already the correct content (0x9) Is there a misunderstanding on our end about the profile, memory configuration, UM3254 table, the prebuild proccess or the conversion

Firmware Package: STM32Cube_FW_H5_V1.6.0 Product ProblemDA regression fails with timeout. I cannot recover the board. I was trying to run the STiROT Template example (STiROT_Appli) on the STM32H573I-DK board. 1. I ran a custom provisioning script (based on ob_flash_programming.sh + obkey_provisioning.sh)2. During image flashing step, I accidentally flashed an unsigned binary (appli.bin) instead of the signed image (appli_init_sign.hex)3. OBKey provisioning (DA_Config.obk, STiRoT_Config.obk, STiRoT_Data.obk) may have failed due to the MCU being in an unstable state4. I then set Product State to PROVISIONED (0x2E) Discovery output Discovery succeeds and shows- PSA lifecycle: ST_LIFECYCLE_IROT_PROVISIONED - ST provisioning integrity status: 0xf5f5f5f5 - ST HDPL1 status: 0x1 - Permission: Full Regression is listed as available Regression attempt Using default keys from the firmware package (not regenerated): - Key: DA/Keys/key_3_leaf.pem - Certificate: DA/Certifica

In RM0481 rev 4 April 2025 I find the following text:7.6.8 Write protectionA write-protected group of sectors cannot be erased nor programmed. As a result, a bankerase cannot be performed if one group of sectors is write-protected, unless a NVSTATEtransition to OPEN is triggered (erasing the whole user flash memory). It is not clear what NVSTATE is in this context. Is this a left-over from documentation of a different MCU? I don’t think it is PRODUCT_STATE. Because to my understanding you can have a PRODUCT_STATE > OPEN and not enable TrustZone and then write to FLASH_WRP1R_PRG to turn off write protection - you should be able to do a bank erase on bank 1. You can set initial values with an OB but I can’t see any documentation that this also makes changing FLASH_WRP1R_PRG illegal and the relevant OBs are not protected by PRODUCT_STATE the same way as e.g. SECWM and HDP.Same reasoning for flash bank 2.And if you enable TrustZone, it is stated that FLASH_WRP[1, 2]R_PRG is non-secure.

Hello ST Community,I am evaluating the security features of the STM32H733 (Cortex-M7) for a project that uses:A custom bootloader stored in internal flash The main application stored and executed from external QSPI/Octo-SPI flashI have the following questions regarding Secure Firmware Install (SFI):Is SFI for internal flash officially supported on the STM32H733? (I saw it was added in AN4992 Rev 8, but I would like official confirmation.) Is SFI for external flash (SFIx) supported on the STM32H733? Specifically, can the secure bootloader (RSS) decrypt and program the external application image securely during manufacturing, or is only the "host-side encryption + internal firmware configures OTFDEC" method available? If external SFIx is not supported, what is the recommended secure manufacturing flow for a design with main code in external flash?

Hi,I'm integrating an STSAFE-A110 with stsafe-a-openssl-engine V2.0.0 on a Linux/aarch64 host (Jetson AGX Orin, Ubuntu 22.04, OpenSSL 3.0.2), communicating over I2C. I've resolved a number of earlier issues (wrong I2C bus, OpenSSL 3.0 API migration, host key pairing) and now have Host Key programming, Local Envelope key generation, Product Data query, Life Cycle State query, and Command Authorization Configuration query all succeeding against the physical chip.Current issue: StSafeA_WrapLocalEnvelope and StSafeA_UnwrapLocalEnvelope behave asymmetrically.My chip's Command Authorization Configuration reports:Command 0x0E (Wrap Local Envelope): CommandAC = 0x03 (MAC), HostEncryptionFlags = 0x02 (command encryption) Command 0x0F (Unwrap Local Envelope): CommandAC = 0x03 (MAC), HostEncryptionFlags = 0x01 (response encryption)Calling Wrap with STSAFEA_MAC_HOST_CMAC, STSAFEA_ENCRYPTION_COMMAND succeeds and returns a plausible 488-byte wrapped envelope.Calling Unwrap on that same output with S

Hello,I am using the Nucleo STM32H533RE board for booting with the two stage boot path for which I am using the ST template code and referring the following   https://wiki.st.com/stm32mcu/wiki/Security:OEMiRoT_OEMuRoT_for_STM32H7S . I am able to run the provisioning script successfully but when I am connecting the serial terminal to verify the serial data sent out by the board, I am getting an error saying “[ERR] read:Wrong OBK HDPL2 cfg” as seen in below image:I tried with the following things:Regenerating the OEMuROT OBK files manually using stm32 trusted package creator Running the regression script to erase the flash and again running the provisioning script Verified if the key file names matches the script referencesCan someone help me with this issue.Let me know if any other details are required. Thanks,Amruta

 Hi,I am working with the OEMiRoT reference project (STM32U385) and I need to configure a single Secure application image without TrustZone isolation (S-only application), while still keeping the Secure Data Image enabled.From flash_layout.h, I see the following:  #define MCUBOOT_APP_IMAGE_NUMBER 1#define FLASH_NS_PARTITION_SIZE (0x32000) /* default case */and also this condition: #if (MCUBOOT_APP_IMAGE_NUMBER == 1) && (FLASH_NS_PARTITION_SIZE == 0) which seems to define the “FULL SECURE” case.QuestionTo correctly implement an S-only application (no S/NS split) in OEMiRoT:Should I explicitly set both:MCUBOOT_APP_IMAGE_NUMBER = 1FLASH_NS_PARTITION_SIZE = 0ORIs FLASH_NS_PARTITION_SIZE automatically set to 0 by the OEMiRoT provisioning/build system when selecting the S-only configuration, meaning it should NOT be manually modified in flash_layout.h?ConcernThe header comment suggests that some Flash layout values are automatically generated by the ROT provi

Hello,long time lurker, now with an issue that I would like to solve. I developed a firmware that runs standalone without issue. I would like to use the secure manager on my STM32H573VI microcontroller.I followed the procedures at this link: https://wiki.st.com/stm32mcu/wiki/Security:How_to_make_your_application_compatible_with_Secure_Manager  and I am able to run the python provisioning.py --sfi-flash command. Then from the cube ide I can debug my program that is written with cmake and the cubemx template.Since I am using threadx I set TIM6 as a time base for the HAL.What I observe is the following...- if I run the application straight away, I do not see the tick increment. - I set an __enable_interrupt() before HAL_Init() and I see that the tim6 interrupt is fired.Then in the ISR, I see that with the first line of HAL_TIM_IRQHandler, when reading htim->Instance->DIER then I land in a BusFault_Handler.  I run out of ideas. No clue about how to deal

Does STM32 provide an mbedTLS integration library for the STM32H573 crypto hardware accelerators? If so, could you please share the details? I found a library at the link below, but it does not cover all the hardware accelerators supported by the STM32H573. Could you share a more complete mbedTLS integration library if you have one?  

Hi ST Team,I am using an STM32U585AII6Q on a custom hardware board. My firmware is based on SBSFU with TrustZone enabled.For production manufacturing, I would like to provision blank devices using STM Secure Firmware Install (SFI) over the ROM USB DFU interface.I would appreciate clarification on the following points:What is the recommended procedure to create and use an SFI package that contains both my custom firmware and the required production option bytes? Can the SFI package program both the firmware and the option bytes in a single operation through the USB DFU interface? My intended production option byte configuration is: TrustZone (TZEN) enabled BOOT0 pin tied High on the hardware BOOT_LOCK enabled RDP Level 2 enabled No OEM password provisioning (OEM2 not provisioned) Is this configuration supported through the SFI provisioning flow? After the SFI package has been programmed with the above option bytes, can anyone confirm that the ROM USB DFU bootloader will no longer

I am using stm32h563zi microcontroller (Nucleo-H563zi) in this i have created project  using trust zone. In this aim was to use UART4 to transmit message. But i am unable to transmit, i have uploaded main.c of secure and nonsecure. what is the possible error in not transmitting the message usign UART4 in nonsecure.

I'm exploring Secure Firmware Install of our product firmware, programming it to a Nucleo H563ZI development board straight out of the box, never previously used. I'm programming it with firmware binaries (including a bespoke OEM iRoT), option bytes and a couple of OBkeys files (one for certificate-based Debug Authentication, another for my iRoT’s keys). For these current experiments, I'm using a global license for installation.I'm using STM32CubeProgrammer and STM32 Trusted Package Creator version 2.22.0, with X-CUBE-RSSE package version 2.0.0 installed.Running the installation process within the GUI STM32CubeProgrammer, the following message boxes are displayed as it proceeds:* (Info) File download complete* (Info) MCU Reset* (Error) Error: Execution of RSS CMD failed, returned value = 0xFFEADE2A* (Error) Error: Failed to Process Area Number 1 of type HThe installation process stops after the last of these errors. After failure, the MCU's option bytes are in this state:OPTION BYTES B

Security:Introduction to STM32H5 security - stm32mcu “Approved version. Approved on: 10:25, 18 May 2026”The following links are broken:In the intro section, the text “For general STM32 security see this article and AN5156.”: The link “this article” is https://wiki.st.com/stm32mcu/wiki/Security:Security_overview which shows a “Page not found” error page. In section 2, in the bullet point about PCROP, the text “Obviously this feature is redundant with the availability of TrustZone® and HDP.”: The link “TrustZone” goes to Security:How to disable TrustZone in STM32L5xx devices during development phase - stm32mcu which is for a different MCU and not very relevant for STM32H5. In section 3, the text “For introduction on these features, refer to this guide.”: The link “this guide” is https://wiki.st.com/stm32mcu/index.php?title=Security:Guide_to_use_specific_security_feature&action=edit&redlink=1 - which does not exist. section 3.2, the text “For broader context follow here.”: The lin

Hi team,we have custom project based on STM32U558 controller with TrustZone, and I am only involved in small part of the project.but i would like to learn about this trust zone is enabled and how both secure and non secure zone are talking.how i will identify which peripheral and which pins are intialised as secure and non secure part.also will appreciate if provided with reading section for trustzone.(prefer small blogs, not big one just because i am a new to trust zone).

Hello,I’m working with a project with STM32h563 micro which includes the use of the OEMiROT bootloader. I tried different solution to set up the project, and, in order to use CubeMX, I think this is the “normal” way. However, there are some things that look awkward to me.If you want to use the OEMiROT bootloader included in the firmware package mentioned in the tutorial, it seems to be mandatory to strictly respect the folder tree given used inside the package. This means that your application project has to reside in STM32Cube_FW_H5_V1.6.0/Projects/NUCLEO-H563ZI/Applications/ROT/ even if you are not using a NUCLEO board. When, in CubeMX, you set the Boot Path and Debug Authentication options, you can modify the OEM_iROT reference location but not the Config Files Location, which is mandatory to be inside the ROT_Provisioning folder automatically created inside the newly created application (e.g. STM32Cube_FW_H5_V1.6.0/Projects/NUCLEO-H563ZI/Applications/ROT/ROT_Provisioning). However,

Hello everyone,I am looking for some help getting started with the STSAFE-A110 in a new project.My Setup: MCU: Custom board using STM32H503CBT6 Secure Element: X-NUCLEO-SAFEA1B expansion board Software: STM32CubeIDE with the X-CUBE-SAFEA1 middleware added via CubeMX Output: I am using the USB CDC Virtual COM port (Classic Middleware) for my output. I have not enabled and am not using UART. The Problem:I am completely stuck trying to get the initial communication working. I cannot seem to establish communication between the STM32H5 and the STSAFE-A110 through I2C, and I cannot get StSafeA_Init() to initialize the STSAFE properly.I have tried reading the user manual (UM2646 - Getting started with the X-CUBE-SAFEA1), but I find it extremely confusing. It does not clearly outline the necessary steps that I need to take to start the project properly from code generated by CubeMX.What I need help with:Could someone provide a clear, step-by-step guide on how to actually bring up the STS

Hi ST team,we are currently developing a new industrial product embedding the STM32U5A5ZJT6Q MCU.For our system reliability assessment, we would like to request the official reliability data for this specific component.Could you please provide:MTBF (Mean Time Between Failures) FIT rate (Failures In Time)If available, we would prefer values calculated according to:Telcordia SR-332 MIL-HDBK-217 Ground Benign (GB) operating environment assumptionsThank you for your support.Best regards

Processor is  STM32U585CIU6Q. I have a trust zone project (STM32IDE) that runs just fine without the boot loader. At reset the secure project runs, transfers control to the non-secure and I can make calls to functions on the secure side just fine. All is good.This is boot loader development effort. I don’t have code to actually receive images yet. I place the secure and non-secure projects in place with the IDE and run the boot loader. When the boot loader transfers control to the secure application it seems to initially work OK.  I get to the secure application OK, The secure application transfers control to the non-secure project OK. However, as soon as i try to make a call to a secure function the system hangs.To transfer out of the boot loader I save a flag in protected memory and do a SW reset. I have used this technique on other ST parts as a way to get the processor in a known state. When I come out of reset the boot loader immediately (before any initialization except C init) t

Hi, I use OEMiROT_Appli_TrustZone +OEMiROT_Boot to do some change in order to migrate to my project. Version: STM32Cube_FW_H5_V1.5.0 1.i change the secure image and non secure image size in flash_layout.h from OEMiROT_Boot. #define FLASH_S_PARTITION_SIZE (0x20000) /* 128KB for S partition */ #if defined(DEVICE_1M_FLASH_ENABLE) #define FLASH_NS_PARTITION_SIZE (0x30000) /* 192 KB for NS partition */ #else #define FLASH_NS_PARTITION_SIZE (0x60000) /* 384 KB for NS partition */ ​2.then rebuild the OEMiROT_Boot. it will autocratically change the ld file and image.xls size of OEMiROT_Appli_TrustZone. 3.rebuild OEMiROT_Appli_TrustZone secure ap and non secure app 4.execute STM32Cube_FW_H5_V1.5.0\Projects\NUCLEO-H563ZI\ROT_Provisioning\OEMiROT\provisioning.bat OK 5.reconnet the board with UART . it shows the error as follow:. INF] TAMPER Activated [INF] BANK 1 secure flash 0, 27] : OB [0, 14] [ERR] Unexpected value for secure flash protection