STM32 MCUs Security

Hello ST Community,I have an STM32H563 (Rev X) that appears to be stuck in the Provisioning state and I am trying to recover it.Hardware / ToolsMCU : STM32H563Device ID : 0x484Revision : Rev XSTM32CubeProgrammer : v2.23.0Probe : ST-LINK V3SETST-LINK FW : V3J16M9B5S1 NRST is connected to the ST-LINK and Debug Authentication discovery is working.Current Option BytesPRODUCT_STATE = 0x1TZEN = 0xB4 (TrustZone enabled)BOOT_UBE = 0xB4 (OEM-iRoT selected)SECWM1_STRT = 0x0SECWM1_END = 0x7FSECWM2_STRT = 0x0SECWM2_END = 0x7FWRPSGn1 = 0xFFFFFFFFWRPSGn2 = 0xFFFFFFFFLOCKBL = 0x0HDP1_STRT = 0x1HDP1_END = 0x0HDP2_STRT = 0x1HDP2_END = 0x0 SymptomsI can: - connect through ST-LINK V3- read option bytes- read flash- erase sectorsI cannot:- perform Mass Erase- change PRODUCT_STATE back to 0xED Attempting: PRODUCT_STATE = 0xED results in:Expected value for Option Byte "PRODUCT_STATE": 0xEDfound: 0x17Option Byte Programming failedOr modified by application after OB_LAUNCH Debug Authentication DiscoveryUsing:

Hello,I have created a framework for OEMiROT + OEMuROT boot path wherein I have tried implementing a two-boot stage. This boot path isn’t included in the ST template examples unlike that for OEMiROT or STiROT_OEMuROT. I was able to run both existing examples on my board correctly.For OEMiROT + OEMuROT boot path, I have made changes in the scripts specific to boot paths and UBE. The memory layout is also defined depending on the image sizes where I am using the flash memory divided for OEMiROT, OEMuROT , secure application and nonsecure application referring the below boot path when TZ is enabled. Post reset the control jumps to OEMiROT in this case.I could write the OEMiROT binary at base address 0x8000000 and OEMuROT at 0x800E000 using the scripts.I am able to verify if they are flashed by reading the respective memory addresses using ST programmer. I could see the non-zero or non-FF values at both memory addresses. I have shown one for base address 0x8000000 Besides the images gettin

 Hello,We use MB1551 TFM example project on our industrial board. For technical reason, we have modified the card entry point from USART1 to USART3.(TFM\TFM_SBSFU_Boot\Src\low_level_com.c, “COM_INSTANCE”)(TFM\TFM_Appli\Secure\Src\low_level_com.c, “COM_INSTANCE”)The log of SBSFU doesn’t appear on UART target.So next, we are trying to debug TFM SBSFU of a STM32U585 project as shown in this tutorial : We use the SBSFU script “regression.sh” and flash SBSFU, loader, secure and unsecure application with “TFM_UPDATE.sh”.The JTAG connection works correctly to open CubeProgrammer and read option byte for example.Finally, we set the tutorial debug configuration and launch the debug without error. Debug launch but stop with this message :After, we can only stop the simulation or terminate it.  We have couple of questions.First of all, can we come to the conclusion that our MCU is booting ?Secondly, Is it possible to change USART1 to USART3 as we did ?Why do we have break point before the debug s

Hello, I am working and trying to boot Nucleo - STM32H533RE board. I could successfully boot board using one stage bootloader OEMiROT, but I want to board to boot board with two stage boot path that to to without using STiROT.Looking at wiki page, I could see this can be achieved on Nucleo board I have, but there is no working example in the latest STM32Cube_FW_H5_V1.6.0 package I have.I could see boot path example for STiROT + OEMuROT example but no example for OEMiROT + OEMuROT.I need to know whether I can achieve booting of Nucleo STM32H533 board with desired boot path i.e. OEMiROT + OEMuROT (as encircled with blue color) and if yes is there any support with relevant data available?Regards,Satish 

Hi,I am using the Nucleo H563ZI for OEMiROT. I was able to build the example provided in STM32CubeH5 package and it works without issue. I wanted to know if it is possible to use the swap method instead of overwrite method for the application installation. If so, is there any example available? I understand that HW crypto isnt available on the STM32H563ZI, I was planning to use the ST Cryptolib library for software crypto.Thanks!Rajas

Hello,I’m working on STM32U5 flash with tfm application using script “regression.sh” and “TFM_UPDATE.sh” of MB1551 example project in SBSFU. I lost the connection with the chip when I unchecked nSWBOOT0 in option bytes.Trust Zone : activatednBoot0 : checkednSWBOOT0 : uncheckedRDP : 0 So when we try a JTAG connection, we have this error.STM32CubeProgrammer Error connection Do you know a solution to regain connection with the STM32U5 ?Thanks for your attention,Kind regards,

I would like to implement a  secure firmware update solution that will work in both an STM32G4A1 and an STM32U0 83.  Different applications, but I would like to use the same basic bootloader and PC update application.  Both would updated over USB.  They have basically the same security features and both have the AES-GCM accelerators.I've been watching the MOOC - Security series to learn how to do this.  I got to the end of  "Security Part4 - STM32 security in practice - 15 Secure firmware update" and had some questions since there isn't any lab video for this module like there are for the modules that came before it. I've also looked at the Silicon Labs AN0060: Bootloader with AES Encryption app note, which is similar in implementation to what I am thinking of doing. The link for the slides for the MOOK module is at the bottom of this page:https://www.st.com/content/st_com/en/support/learning/stm32-education/stm32-moocs/STM32_secur

Hello,I have programmed the OTP word 31 to 0xBBBBBBBB as follows, but when I want to write another value such as 0x12345678 or 0x00000000 to word 31, it reported the following errors， can you help to analyze this ? Thanks a lot!  

Dear ST Team,              I am currently porting an SBSFU/Trust Zone -based application from the STM32U585 to the STM32U5A5. The migration is almost complete, and the bootloader is functioning as expected.    The following operations complete successfully:BL2/SBSFU boots correctly. Image authentication and verification succeed. The application vector table is read correctly. The application jump is initiated using:boot_jump_to_next_image((uint32_t)&boot_jump_to_next_image, vt->reset);     Both addresses appear to be valid:MSP points to Secure SRAM. Reset vector points to Secure Flash with the Thumb bit set.The application successfully reaches the Reset_Handler, so the jump from SBSFU to the application appears to be successful.However, during the startup code, execution gets stuck while clearing the .bss section.The relevant startup code is shown below:ldr r2, =_sbssb   LoopFillZerobss FillZerobss:    movs r3, #0    str  r3, [r2], #4 LoopFillZerobss:    ldr r3, =_ebss    cmp r

Hi everyone,I am trying to generate a professional SBOM for my project.I have a few questions regarding the best workflow:Tooling & Detection: What the best tool to generate the SBOM.I tried using ScanCode, but it didn't find any component in my project (e.g., FreeRTOS). I had to manually add .about files to the folder to get results. Is there a better tool that can generate the SBOM with minimal manual intervention?ST Cube SBOM : The Cube MCU packages contain dozens of libraries (FatFS, FreeRTOS, USB_Host, etc.). If my project only uses FatFS, the package JSON still lists everything. Do I have to manually extract the components I use from the ST JSON? how to get use of the ST SBOM?I’d love to hear if anyone has a script or a specific toolchain that automates this without the manual "copy-paste" from the ST manifests Thank you!Yahya  

Dear,Is it possible for execution within HDPL_x to use SAES (Secure AES) with a DHUK (Derived Hardware Unique Key) from HDPL_y where x > y?For example:Execution within HDPL2 makes use of SAES to encrypt plaintext p using its DHUK, this results in ciphertext cAfterwards, upon reset, execution within HDPL1 needs to be able to read plaintext p (e.g., by decrypting the stored ciphertext c using HDPL2's DHUK) without changing the HDPL.Is this possible with SAES, and if yes, how?Thanks a lot!

Hi Everybody,I posted a comment here https://community.st.com/t5/stm32-online-courses/stm32h5-secure-manager-course/bc-p/824487/highlight/true#M27 yesterday because I am trying following the online course and what is written in the wiki to start developing an application on the STM32H573VI using the secure manager.At the moment I am starting the development by using the nucleo board for H573 however, by following the wiki, the only project that could be used for deploying the solution is an handswritten example that does not use the CubeMx.If I try to follow the old documentation on the youtube videos, as explained in the link provided, I am unable to set the boot path correctly.At the moment I am a bit lost, should I build my project without the use of CubeMx in case of secure manager? Will it be added in the future? I am missing something straightforward? thank you in advanceAndrea

Hello, I have an STM32H573 project with TrustZone enabled. After the CPU goes into non-secure mode and during execution of the HAL_Init() function (more specifics below) a hard fault occurs. There is only a hard fault during the execution from a non-secure state. In the secure state (at boot) the HAL_Init() function successfully runs. Is there a configuration for the RCC not enabled by default that I a missing, allowing it to be accessed by both Secure and Non-Secure CPU states?Within GTZC_S TZSC - Privilegeable peripherals I cannot enable it. I see no relevant settings (I have tested a few that might be loosely related but no solved) in RCC. In the code below I have used an arrow (<--) to denote exactly where the hard fault occurs (Verified with debugger)Non-Secure Entry Code (CubeMX Generated):int main(void){ /* USER CODE BEGIN 1 */ /* USER CODE END 1 */ /* MCU Configuration--------------------------------------------------------*/ /* MPU Configuration-------------------------

Hi,we have a question regarding the Secure Manager Internal Trusted Storage size on the STM32H73 series.We have configured the following options:external flash profile 0 secure modules (=SMAK_0 ?)According to UM3254 it is our understanding the ITS size can now be up to 56 Kbyte:Our application project.py prebuild seems to extract value “9”, which means 9 * 8 Kbyte (Flash sector size) = 72 Kbyte? Jul  8 13:27:10 2026 : [INF] Searching the parameter with <Name>ITS size</Name> element2026-07-08 13:27:10,542 - DEBUG - Wed Jul  8 13:27:10 2026 : [INF] Parameter found. Verifying information of '<Value>0x9</Value>'2026-07-08 13:27:10,543 - DEBUG - Wed Jul  8 13:27:10 2026 : [INF] The modification is not necessary2026-07-08 13:27:10,543 - DEBUG - Wed Jul  8 13:27:10 2026 : [INF] The tag <Value> has already the correct content (0x9) Is there a misunderstanding on our end about the profile, memory configuration, UM3254 table, the prebuild proccess or the conversion

Firmware Package: STM32Cube_FW_H5_V1.6.0 Product ProblemDA regression fails with timeout. I cannot recover the board. I was trying to run the STiROT Template example (STiROT_Appli) on the STM32H573I-DK board. 1. I ran a custom provisioning script (based on ob_flash_programming.sh + obkey_provisioning.sh)2. During image flashing step, I accidentally flashed an unsigned binary (appli.bin) instead of the signed image (appli_init_sign.hex)3. OBKey provisioning (DA_Config.obk, STiRoT_Config.obk, STiRoT_Data.obk) may have failed due to the MCU being in an unstable state4. I then set Product State to PROVISIONED (0x2E) Discovery output Discovery succeeds and shows- PSA lifecycle: ST_LIFECYCLE_IROT_PROVISIONED - ST provisioning integrity status: 0xf5f5f5f5 - ST HDPL1 status: 0x1 - Permission: Full Regression is listed as available Regression attempt Using default keys from the firmware package (not regenerated): - Key: DA/Keys/key_3_leaf.pem - Certificate: DA/Certifica

In RM0481 rev 4 April 2025 I find the following text:7.6.8 Write protectionA write-protected group of sectors cannot be erased nor programmed. As a result, a bankerase cannot be performed if one group of sectors is write-protected, unless a NVSTATEtransition to OPEN is triggered (erasing the whole user flash memory). It is not clear what NVSTATE is in this context. Is this a left-over from documentation of a different MCU? I don’t think it is PRODUCT_STATE. Because to my understanding you can have a PRODUCT_STATE > OPEN and not enable TrustZone and then write to FLASH_WRP1R_PRG to turn off write protection - you should be able to do a bank erase on bank 1. You can set initial values with an OB but I can’t see any documentation that this also makes changing FLASH_WRP1R_PRG illegal and the relevant OBs are not protected by PRODUCT_STATE the same way as e.g. SECWM and HDP.Same reasoning for flash bank 2.And if you enable TrustZone, it is stated that FLASH_WRP[1, 2]R_PRG is non-secure.

Hello ST Community,I am evaluating the security features of the STM32H733 (Cortex-M7) for a project that uses:A custom bootloader stored in internal flash The main application stored and executed from external QSPI/Octo-SPI flashI have the following questions regarding Secure Firmware Install (SFI):Is SFI for internal flash officially supported on the STM32H733? (I saw it was added in AN4992 Rev 8, but I would like official confirmation.) Is SFI for external flash (SFIx) supported on the STM32H733? Specifically, can the secure bootloader (RSS) decrypt and program the external application image securely during manufacturing, or is only the "host-side encryption + internal firmware configures OTFDEC" method available? If external SFIx is not supported, what is the recommended secure manufacturing flow for a design with main code in external flash?

Hi,I'm integrating an STSAFE-A110 with stsafe-a-openssl-engine V2.0.0 on a Linux/aarch64 host (Jetson AGX Orin, Ubuntu 22.04, OpenSSL 3.0.2), communicating over I2C. I've resolved a number of earlier issues (wrong I2C bus, OpenSSL 3.0 API migration, host key pairing) and now have Host Key programming, Local Envelope key generation, Product Data query, Life Cycle State query, and Command Authorization Configuration query all succeeding against the physical chip.Current issue: StSafeA_WrapLocalEnvelope and StSafeA_UnwrapLocalEnvelope behave asymmetrically.My chip's Command Authorization Configuration reports:Command 0x0E (Wrap Local Envelope): CommandAC = 0x03 (MAC), HostEncryptionFlags = 0x02 (command encryption) Command 0x0F (Unwrap Local Envelope): CommandAC = 0x03 (MAC), HostEncryptionFlags = 0x01 (response encryption)Calling Wrap with STSAFEA_MAC_HOST_CMAC, STSAFEA_ENCRYPTION_COMMAND succeeds and returns a plausible 488-byte wrapped envelope.Calling Unwrap on that same output with S

Hello,I am using the Nucleo STM32H533RE board for booting with the two stage boot path for which I am using the ST template code and referring the following   https://wiki.st.com/stm32mcu/wiki/Security:OEMiRoT_OEMuRoT_for_STM32H7S . I am able to run the provisioning script successfully but when I am connecting the serial terminal to verify the serial data sent out by the board, I am getting an error saying “[ERR] read:Wrong OBK HDPL2 cfg” as seen in below image:I tried with the following things:Regenerating the OEMuROT OBK files manually using stm32 trusted package creator Running the regression script to erase the flash and again running the provisioning script Verified if the key file names matches the script referencesCan someone help me with this issue.Let me know if any other details are required. Thanks,Amruta

 Hi,I am working with the OEMiRoT reference project (STM32U385) and I need to configure a single Secure application image without TrustZone isolation (S-only application), while still keeping the Secure Data Image enabled.From flash_layout.h, I see the following:  #define MCUBOOT_APP_IMAGE_NUMBER 1#define FLASH_NS_PARTITION_SIZE (0x32000) /* default case */and also this condition: #if (MCUBOOT_APP_IMAGE_NUMBER == 1) && (FLASH_NS_PARTITION_SIZE == 0) which seems to define the “FULL SECURE” case.QuestionTo correctly implement an S-only application (no S/NS split) in OEMiRoT:Should I explicitly set both:MCUBOOT_APP_IMAGE_NUMBER = 1FLASH_NS_PARTITION_SIZE = 0ORIs FLASH_NS_PARTITION_SIZE automatically set to 0 by the OEMiRoT provisioning/build system when selecting the S-only configuration, meaning it should NOT be manually modified in flash_layout.h?ConcernThe header comment suggests that some Flash layout values are automatically generated by the ROT provi

Hello,long time lurker, now with an issue that I would like to solve. I developed a firmware that runs standalone without issue. I would like to use the secure manager on my STM32H573VI microcontroller.I followed the procedures at this link: https://wiki.st.com/stm32mcu/wiki/Security:How_to_make_your_application_compatible_with_Secure_Manager  and I am able to run the python provisioning.py --sfi-flash command. Then from the cube ide I can debug my program that is written with cmake and the cubemx template.Since I am using threadx I set TIM6 as a time base for the HAL.What I observe is the following...- if I run the application straight away, I do not see the tick increment. - I set an __enable_interrupt() before HAL_Init() and I see that the tim6 interrupt is fired.Then in the ISR, I see that with the first line of HAL_TIM_IRQHandler, when reading htim->Instance->DIER then I land in a BusFault_Handler.  I run out of ideas. No clue about how to deal

Does STM32 provide an mbedTLS integration library for the STM32H573 crypto hardware accelerators? If so, could you please share the details? I found a library at the link below, but it does not cover all the hardware accelerators supported by the STM32H573. Could you share a more complete mbedTLS integration library if you have one?  

Hi ST Team,I am using an STM32U585AII6Q on a custom hardware board. My firmware is based on SBSFU with TrustZone enabled.For production manufacturing, I would like to provision blank devices using STM Secure Firmware Install (SFI) over the ROM USB DFU interface.I would appreciate clarification on the following points:What is the recommended procedure to create and use an SFI package that contains both my custom firmware and the required production option bytes? Can the SFI package program both the firmware and the option bytes in a single operation through the USB DFU interface? My intended production option byte configuration is: TrustZone (TZEN) enabled BOOT0 pin tied High on the hardware BOOT_LOCK enabled RDP Level 2 enabled No OEM password provisioning (OEM2 not provisioned) Is this configuration supported through the SFI provisioning flow? After the SFI package has been programmed with the above option bytes, can anyone confirm that the ROM USB DFU bootloader will no longer

I am using stm32h563zi microcontroller (Nucleo-H563zi) in this i have created project  using trust zone. In this aim was to use UART4 to transmit message. But i am unable to transmit, i have uploaded main.c of secure and nonsecure. what is the possible error in not transmitting the message usign UART4 in nonsecure.

I'm exploring Secure Firmware Install of our product firmware, programming it to a Nucleo H563ZI development board straight out of the box, never previously used. I'm programming it with firmware binaries (including a bespoke OEM iRoT), option bytes and a couple of OBkeys files (one for certificate-based Debug Authentication, another for my iRoT’s keys). For these current experiments, I'm using a global license for installation.I'm using STM32CubeProgrammer and STM32 Trusted Package Creator version 2.22.0, with X-CUBE-RSSE package version 2.0.0 installed.Running the installation process within the GUI STM32CubeProgrammer, the following message boxes are displayed as it proceeds:* (Info) File download complete* (Info) MCU Reset* (Error) Error: Execution of RSS CMD failed, returned value = 0xFFEADE2A* (Error) Error: Failed to Process Area Number 1 of type HThe installation process stops after the last of these errors. After failure, the MCU's option bytes are in this state:OPTION BYTES B