STM32 MCUs Security

Whether this feature is applicable for only stm32g series listed below. Highlighted registers are not available in stm32f401

Hi community, I am working on CRC generation with polynomial 0x8005 and initial value 0x0000, so I configured it as belowI am using the data as shown below and the CRC should be 0x43B8 but the value got from the API is different. So I am missing something.uint32_t bufer[] = { 0x23, 0x41, 0x54, 0x4F, 0x4E, 0xFF, 0x53, 0x4C, 0x30, 0x43, 0x55, 0x52, 0xFF, 0x0A, 0x30, 0x31, 0x32, 0x33, 0x34, 0x35, 0x36, 0x37, 0x38, 0x39 }; uint32_t crc = HAL_CRC_Calculate(&hcrc, bufer, sizeof(bufer));I appreciate your input.

I am using STM32L5, In our project, we want to create one script which will lock the bootloader option and enable RDP to 0xCC to disable JTAG.We are using the SBSFU example as a base and developed our application on it.In script Regration.bat, 0xAA RDP is set. whereas in the bootloader 0xBB is set. I have commented Expected RDP error handler, to set the RDP level to 0xCC after bootup,What is the best practice and sequence to do it?I am performing the following sequence1) Flash application using regration.bat SBSFU_Update.bat.2) I have changed the following option byte valueEnable BOOTLOCKBoot0 = 03) Change RDP level to 0xCCAfter It, my bootloader is not able to boot up board. I have lost 2 chips during this process. Before losing further chips, I want to have a clear and proper sequence of setting following option byte1) BOOLOCK should be set2) Boot0 should be lock3) Disable JTAG..@Diane POMABIA​  Can you please help me to achieve it?

We are right now using this MCU STM32L051C8T6 in a mass production up to 32.000 setsRight now we have met a problem,afer all 32000 pcs have been programmed with an hex file.I was found mcu have been locked and we cannot upload new files into them. 1. Can anyone help to figure out why the MCU was locked after the programming? 2. Is there any solutions to unlock the MCU which has already been soldered on the PCB boards?Thanks!!

..

Hello,We have an STM32 project with SBSFU bootloader used for firmware updates. We have a pipeline that is triggered from GitLab that will compile and sign the firmware and update pakcage. Before taking production private keys into use, we are considering strategies for secure storage of the keys while still trying to keep things as simple and automated as possible.One option would be to add a manual step to the pipeline where update packages are signed and encrypted in an offline computer. Other option would be to store private keys only in RAM of the machine running the pipeline which would minimize risk of leaking the keys. This would have the benefit of keeping everything automated. The problem is that I haven't figured out a way of supplying the key to the prepareimage.py script from a variable stored in RAM, it seems to require a file. Is there any way of achieving this?Is there a way of integrating a HSM (hardware security model) to the SBSFU process?Thanks!

I have followed a tutorial (https://www.youtube.com/watch?v=i10X4Blr8ns&ab_channel=STMicroelectronics) to try and get a simple BLE application running and view this application using ST's BLE Toolbox on my Android phone. However, I do not see my device advertising. Is there a missing step to configure BLE on the WB15. The linked tutorial is for the WB55. I have only configured the BLE from within cube MX (only using auto-generated code). I have not written my own code yet. Is there some additional user code that needs to be written in order to allow the Bluetooth to begin advertising?

Hello everyone,I must start a production of PCBA which use the MCU STM32G474QET6 and I need to protect my firmware, I want to set the read protection at Level 1. Is it possible to set that option byte in the firmware when I flash the firmware?Thanks.Best regards,Andrea Alessi

Hello Support Team,Good day,we are working on the Code Isolation activities on the STM32U585ZIT6Q controllerWhile creating sample code with enabled trust zone, It is divided into the two-part, a. Secure code, It has own while loop but before that, control is transferred to the Non-Secure code through "NonSecure_Init()" b. Non-Secure code, It will run after the secure control is transferred to the non-secure code through the "NonSecure_Init()" call in secure We have some of the queries as per below, As per the sample code, Secure fw does not performing any operation inside the while() loop and all operations take care of in the non-secure while() loop, 1. Can we write a code in a while () loop in the Secure firmware?  2. Can we change the state of the control of the operation access like secure and nonsecure code execution at any point of time? ex. Non-secure code performing in data collection operation and after some time we have to perform the separate code execution which

..

is there any hardware ways so that I can make it much more faster ?

I have been using HAL library of cipher acceleration hardware before on the same mcu (first 100 units) without any problems, but in my last order, all mcu goes to hardfault error when i used exactly the same code on it (same binary file). By debugging, I realized that this library doesn't execute well the read/write operations from the cipher hardware, and then crash on hardfault. This error ONLY happens on my last order of 100 mcu chips. I really don't understand what's happening. Any ideas? Are there more recents upgrades on the HAL library encryptation module?I am using stm32cube version 1.10.1 IDE, and stm32cubeMX version 6.6.1.202207061420. I didn't change to more recently versions, because they change the way ETH drivers is configured.

Flash writing procedure has just finished. The next step, anyone can assume, is verification, that code has been written correctly, which involves reading the flashed memory. At this stage, if I trace the API calls, which Cube tool does to perform flash reading. Does this mean I can copy the firmware without having vendor keys? Please point me at which step I'm wrong.

..

if (SE_Startup() == SE_SUCCESS) {......SE_Startup() --> __IS_SFU_RESERVED();__get_LR() = 0x80055d7 SB_REGION_ROM_START) = 0x8005d00 SB_REGION_ROM_END = 0x801 ffff

Hi all--I am working on a project using the STM32WB55. I would like to distribute an "official" firmware, but also allow third-party firmware to be installed. The intent is that the official firmware will be open source, so users can make changes to the official firmware and upload their own firmware to the device.The catch is that the official firmware will include private keys (not part of the open source distribution, obviously) used for signing its output, so that users can verify that the output was produced by the official firmware, as opposed to a third-party firmware. This means:The official firmware should be encrypted, and X-CUBE-SBSFU will need to have the ability to decrypt that firmware.Users should not have access (either through JTAG or through third-party firmware) to the keys required to decrypt the official firmware, or to the decrypted official firmware itself.I think X-CUBE-SBSFU will allow me to do this with a little modification, but I wanted to get a second opini

Nuttx operating system with stm32l562 board, compile the bin file of the board, and then according to the board directory, readme.txt in the operation through the TFM load the bin run, will give the following secure fault problem：[Sec Thread] Secure image initializing! ABCDF [Sec Handler] Oops... Secure fault!!! You're not going anywhere! [INF] Starting bootloader [INF] Checking BL2 NV area[INF] Checking BL2 NV area header [INF] Checking BL2 NV Counter consistency[INF] Consistent BL2 NV Counter 3 = 0x1000000 [INF] Consistent BL2 NV Counter 4 = 0x1000000 [INF] Swap type: none [INF] Swap type: none [INF] verify counter 0 1000000 1000000 [INF] counter 0 : ok [INF] verify sig key id 0 [INF] signature OK [INF] verify counter 1 1000000 1000000 [INF] counter 1 : ok [INF] verify sig key id 1 [INF] signature OK [INF] Bootloader chainload address offset: 0x17000 [INF] Jumping to the first image slot set to BL2 SHARED DATA2XX_HUKCUSTOMIZATION [INF] Code c002900 c011bfe [INF] hash TFM_SBSFU_Boot 1

Dear Sirs,I have downloaded and installed thepackage. I am able to build the example projects with CubeIDE flawlessly butthe batch scripts (.bat) are not working. running the scripts(e.g.02_01_Postbuild_SimpleAppV1.bat) I get the error "The specified pathcannot be found." (actually the message is in the system language, that inmy case is Italian, so I am not 100 % sure of the translation in Englishlanguage).Trying to look into the batch script, itis truing to access this folder:set "prepareimage=%basedir%\win\prepareimage\prepareimage.exe"But after installing the MOOC package(with the installer "STM32SecuWS-material.exe"), I can not find any"win" directory in any location.Am I missing g something?Thankyou. Kindregards,Claudio

[EDIT: Question below is about STM32U5 PKA, but I see the STM32L5 Cube S/W has an example "PKA_ECCscalarMultiplication" that is probably similar to what I'm trying to do. Not sure how similar PKAs are on these MCUs but I bet they are either identical or very similar. I will look at the example and post back...][EDIT 2: OK, it's clear that the L5 and U5 PKA share DNA, but that they are not at all identical or even "very similar". 32 bit vs. 64 bit, no error codes on output from many L5 operations (including scalar point multiplication), PKA RAM addresses, operation parameter lists, etc.]I'm using the STM32U585's PKA to do an ECC scalar multiplication. For sure I might be configuring it wrong, although I've got a lot of stuff working with the PKA (not the best documented peripheral). I want to multiply the base point for curve P256 by 19 (this is for a test vector). I may or may not have the PKA RAM configured properly. Regardless, upon completion, PKA RAM @ 0x680 holds the dreaded "0xC

Using an STM32H735G-DK (MB1520-H735I-C02), I was using the HDP_Boot/HDP_Appli examples and I think I fat-fingered the SEC_AREA_START and SEC_AREA_END addresses, setting both to the same value which effectively secures all of internal flash. Neither the on-board STLINK nor an external J-Link can connect, but the board seems to be executing the Dhrystone test out of external Flash a few moments after a reset, which seems to be impossible.I see that the external flash is connected to OCTOSPI1 and that the OCTOSPIx peripherals can be mapped into memory where they are treated as if they are internal memories, but between 0x08000000 (internal flash) and 0x90000000 (OCTOSPI1) there are reserved regions, SRAM regions, the bootrom itself and of course ALL of the memory-mapped peripherals. AN5601 says that reading the protected memory areas will return 0x00000000 which is just two ARM THUMB LSL R0, R0, 0 instructions, but with all those other regions in the way (and many of them exeception-induc

Hello guys I hope you can help me with my problem regarding my adaptation of sbsfu.I'm currently adapting the stm32f413h-discovery example project on a stm32429zi. Everything works fine with one mayor exeption. I have difficulty downloading a new firmware version via Y-Modem. Everytime I want to downlaod a newer version (e.g. changed version nr. in postbuild.bat and in userapp.c) the download crashes and I get the following output via terminal. (all securities where off during testing)I can however download the firmware successfully when holding the userbutton on a reset like it is mentioned in um2262 chapter 8.4.I have tested this with multiple version numbers, all have worked.I also tried activating securities and then using the user button, but in this case a button bush is considered a "Tampering fault".I have also figured out that both methods (download in sbsfu and download in userapp) use completly different functions. I'm not familiar enougth with how Y-Modem works to find any

..

Hello, I am working with the STM32U585 and am looking for a HAL function to generate RSA key pairs? And AES keys if possible? I see that wolfssl has these functions available but they do not support the STM32U575 / 585 yet. I've seen other posts suggesting to use OpenSSL but I'm worried about how large the library is. I would like to generate a new set of keys upon every power on to ensure better security as apposed to just using OpenSSL to external generate keys and then input them into the system. Is there any build it functions using the AES or PKA that can generate keys? Thanks

Salve gente. Come consulente ho ricevuto l'incarico di riutilizzare una certa quantità di una scheda giochi che contiene come processore ausiliario il STM32F215ZET6 che sovrintende gli I/O della scheda per il Soc che contiene un ARM e la gestione grafica del display. La mia necessità è scoprire dove e come sono allocati gli I/O e come sono trasmessi all'altra CPU, e lo posso fare se riesco a leggere il soft interno.

On running the SBSFU project on STM32F769I-DISCO board, will the boot ROM evaluate the integrity and authenticity of Secure boot. So that, the user will be sure that his/her Secure boot not replaced by others.