STM32 MCUs Security

Hi,I need to generate option byte file(.s19) which is enabled Read out Protection for STM32F4. The reason is to program this .s19 file using non ST programmer in production environment. May i which ST Tool should i used to generate option byte file(.s19) ?

In the v2.6.2 NUCLEO-G474RE SBSFU examples 1_Image and 2_Image the linker file n_Image\Linker_Common\STM32CubeIDE\mapping_sbsfu.ld has the following line: __ICFEDIT_SE_region_RAM_start__    = 0x20018000;But the RAM actually starts at 0x20000000. Examples for other dev kits start at 0x20000000. Once I replace the example app with my real app, I have a linker error because I have run out of RAM. Is this an error in the example or is there something special about the STM32G474 RAM above 0x20018000 that makes the SBSFU example want to use only that region?

AN5185 specifies that encrypted keys should use AES-128 GCM, but the format of data sent to FUS isn't very well specified:Byte0: key type:• 0x00: None• 0x01: Simple key• 0x02: Master key• 0x03: Encrypted keyByte1: key size N in bytesByte2 to ByteN-1: key data (key value + IV if any)In particular, two things are not clear to me from this description:What format should the key data take, i.e., specifically how should the key value, tag, and IV be arranged in the data sent to FUS?What value should the key size take? The application note says Byte 2 to Byte N-1 are key data, but doesn't seem right at all, since it suggests a 16-byte key would have N = 18 (i.e., it would occupy bytes 2 through 17).Specifically, for an AES-256 encrypted key (with 32 byte cyphertext, 16 byte IV, and 16 byte tag), what value should be in byte 1, and how should data be arranged in bytes 2 and up?Thank you!

The question - is it fixed on STM32G and C series?

I build SBSFU using X-CUBE extension for STM32F769I-DISCO. Flashed the "SBSFU_UserApp.bin" file using STM32CubeProgrammer. Now I need to send UserApp.sfb file via YMODEM without using Tera TermI used,stty -F /dev/ttyACM0 115200 sb UserApp.sfb >/dev/ttyACM0 </dev/ttyACM0Is there any extra parameters to be mentioned or is there any other way without using tera term?

..

Hello Support Team.Good Day.We have chosen the STM32U585ZIT6Q (-40C to 85C, LQFP -144 pins, with trust zone core) controller for our product.According to the firmware architecture, we intend to create two separate partitions, one for safety-critical (non-upgradable area) and the other for non-safety-critical (Upgradable area)So We enable Trust Zone mode and seprate safety-critical and non- safety-criticalI have a question about Trust zone mode, which I will address below.1. Can I utilise RTOS for both safety-critical and non-safety-critical applications?2. Can I use RTOS on safety-critical sections and Bear Metal on non-critical sections?3. How to transmit data in an RTOS-based platform across safety-critical and non-safety-critical areas I used STM32CubeIDE (Version: 1.12.0) for development. I've seen RTOS-based selection, but I haven't seen the RTOS configuration parameter (safety-critical parts). I've provided a screenshot to this thread.If you have any examples, please share t

Hello all, I am working on a project with STM32H753 microcontroller which requires usage of SSL/TLS library functions along with Cryptographic functionalities. I see online and most of the examples I find are either using Mbed TLS or WolfSSL or similar completely. I am looking for a case where I could use the X-CUBE-CRYPTOLIB - STM32 Crypto Library for all the cryptographic functionalities and use the SSL/TLS functionalities from Mbed TLS/WolfSSL, since the STM32 Cryptolib does not provide the same. Is that possible? Can anyone point to some examples or sample projects in this regard?Thanks a lot in advance,Sreedhar.

I have an application where I need to use ECDSA to check a signature using the secp192r1 curve. However, I don't see a clear define for this in cmox_ecc.h. Is this supported under a different name?

Hi there, I'm new to the STM32 MCU and simulating RSA encryption-decryption on Proteus 8 now. Currently I am using the x-cube-crypto and STM32F401RE-Nucleo to do simulation. The source code is from:nickfox-taterliIn the Proteus 8 I chose a board of STM32F401RE connected with an LED light to debug. However, after checking step by step during the simulation, the encryption for RSA could return a SUCCESS, but the decryption part always returns a FAIL. This thing also happened when I using the lib downloaded from st.com, using the keys and sample ciphertext in the lib's sample project file, configuring a STM32F401VE board and running rsa_pkcs1v22. I have enabled the CRC. What I observed here is that:cmox_initialize SUCCESScmox_rsa_consturct SUCCESSencryption returns SUCCESS, output length 256, but content is NOT the same with the given one. decryption returns FAILEDBoth public key and private could be used in the encryption part, with a SUCCESS return.The decryption part is not the case th

hi St team, thank you for your support.My objective is secure boot for my independent project. i am using stm32L562vet i am able enable trust zone with RDP level =1 and able to disable the trust zone using RDP regression. now i want to implement second stage of bootloader using [MCU boot] i don't know how to implement and how to generate binary for that. Then i have another one question, in stm32l5 package middleware's are 1.trusted firmware2.mcu boot3.mbed cryptobut in my project only displays (mbed tls) .How can i integrate that middleware to my project?

I am using TFM-SBSFU example provided in STM32L5.Secure Area 1 which is already configured as below.When I am trying to read 0x8012000 from non-secure application, I am getting secure fault. I want to add one Partition 0x807d000 of 4KB into secure after the non-secure partition.I am able to add it by modifying the option byte by following the bootloader code start = 0x3D000/PAGE_SIZE; //0; end = (0x3D000+ PUBLIC_KEY_SECTOR_SIZE -1) / PAGE_SIZE;//(S_IMAGE_PRIMARY_PARTITION_OFFSET + FLASH_S_PARTITION_SIZE - 1) / PAGE_SIZE; printf("\r\n Start = %02x, End = %02x",start,end); if(end < PAGE_MAX_NUMBER_IN_BANK) {  if ((start != flash_option_bytes_bank2.WMSecStartPage)    || (end != flash_option_bytes_bank2.WMSecEndPage))  {  BOOT_LOG_INF("BANK 2 secure flash [%d, %d] : OB [%d, %d]", start, end, flash_option_bytes_bank2.WMSecStartPage,          flash_option_

Using STM32L452CC and STM32CubeProgrammer API v2.12.0 Windows 64-bits.Firstly, I'm setting the readout protection to its middle level (RDP = BB in the programmer) and then program the chip successfully. Then, letting the chip power cycle. Now reading the option bytes from CubeProgrammer but getting AA, Any idea?Another related question: My understanding is that if the protection level is set to BB (protection level 1) then Cube programmer will still be able to program a new firmware to the chip and have the protection level being downgraded to AA (no protection).However, this is denied by CubeProgrammer Command-interface. It just let the new firmware to be programmed, but not downgrading the protection level to be 'no protection. Any idea?

Hi,I am currently trying to change RDP level via firmware without a power reset (POR) on a NUCLEO-WB55RG (STM32WB55). I am facing the problem that after changing the RDP level a power reset is necessary. Without a power reset the device seems to get stuck/frozen. I tried to upgrade the RDP level 0->1 and downgrade 1->0 but both did not work without a power reset.I found a youtube guide how RDP level can be changed without POR but it was addressed to STML4 family:https://www.youtube.com/watch?v=f7vs0NwZPFo&ab_channel=STMicroelectronicsI tried to adapt the code for STM32WB55 but without success:void ChangeRDPLevel(){  FLASH_OBProgramInitTypeDef tFLASH_OB = { 0x00 };  // Check if flash is unprotected  if ((FLASH->OPTR & FLASH_OPTR_RDP) == OB_RDP_LEVEL_0)  {    // Unlock the FLASH control register access    HAL_FLASH_Unlock();    // Unlock the option bytes block access&

Error: file not found: ../../../2_Images_SECoreBin/STM32CubeIDE/B-L4S5I-IOT01_2_Images_SECoreBin/Debug/SECoreBin.bin

I complie STM32F769I-Discovery 2_Images demo (SBSFU\Projects\STM32F769I-Discovery\Applications\2_Images\2_Images_UserApp\MDK-ARM) with MDK KEIL 3.37.If I link project using default UserApp.sct, the packed image is right, and output.txt show below:block size =16 Magic: b'SFU1'!! Magic: b'SFU1'!! number of segment :2 0x8084cb8 number of segment :3 0x80001f8 0x80062e0 Merging SBSFU Base = 0x8000000 Writing header = 0x8080000 APPLI Base = 0x8080400 Writing to .\\..\\Binary\\\\SBSFU_UserApp.bin 543952But if I modify UserApp.sct to let fw_update_app execute in ITCM#! armclang --target=arm-arm-none-eabi -mcpu=cortex-m7 -E -xc ; ************************************************************* ; *** Scatter-Loading Description File generated by uVision *** ; ************************************************************* #include "..\..\Linker_Common\MDK-ARM\mapping_sbsfu.h" #include "..\..\Linker_Common\MDK-ARM\mapping_fwimg.h"     LR_ROM (SLOT_ACTIVE_1_START + 0x400) { ; Cortex-M7: align

Hello,We have a software project with STM32H7B3 MCU using SBSFU for bootloader and installing updates. We are using one download slot and one active slot and have been very tight on flash size and have often had to reduce binary size. Normally, this is not a problem since we get a compilation error from the linker script when binary size becomes too big. In the linker script we have:ISR_VECTOR_START = __ICFEDIT_SLOT_Active_1_start__ + 0x400; /* Cortex-M7: align the init vectors on 0x400 */ APP_ROM_START = ISR_VECTOR_START + VECTOR_SIZE; APP_ROM_END = __ICFEDIT_SLOT_Active_1_end__; APP_ROM_LENGTH = APP_ROM_END - APP_ROM_START + 1;   /* Specify the memory areas */ MEMORY { DTCMRAM (xrw) : ORIGIN = 0x20000000, LENGTH = 128K RAM (xrw) : ORIGIN = 0x24000000, LENGTH = 1024K ITCMRAM (xrw) : ORIGIN = 0x00000000, LENGTH = 64K ISR_VECTOR (Rw) : ORIGIN = ISR_VECTOR_START, LENGTH = VECTOR_SIZE APP_ROM (rx) : ORIGIN = APP_ROM_START, LENGTH = APP_ROM_LENGTH }This makes APP_ROM_END equal to 0x08

When I set the RDP Level 1 the Controller stops working.I must unpower the Controller and power it agin, NRST didn't work.I use the code:       HAL_FLASH_Unlock();       HAL_FLASH_OB_Unlock();       OBIni.OptionType = OPTIONBYTE_RDP;       OBIni.RDPLevel = OB_RDP_LEVEL_1;       if ( HAL_FLASHEx_OBProgram(&OBIni) != HAL_OK )       {          HAL_FLASH_OB_Lock();          HAL_FLASH_Lock();          return;       }       HAL_FLASH_OB_Launch();       /* We should not make it past the Launch, so lock     &

I am using the SBSFU example of "NUCLEO-L552ZE-Q" Projects.I have added my application code to the NON-Secure application project.When I see "Region_defs.h", in which nonsecure (NS_TOTAL_RAM_SIZE ) size is 192 KB whereas secure (S_TOTAL_RAM_SIZE)size is 64 KB. Most of my application code is in the non-secure application.If I want to repartition SRAM is it possible? If yes how can I do it? I want to increase the nonsecure ram size to 235 KB, Is it feasible?

I was searching for the security features of STM32F769I - DISCO and came to know that only STM32F77x has CRYP and HASH in the STM32F7xx series.Do STM32F769I - DISCO really have security features? If so, can you provide a relevant document regarding to the security features of STM32F769I - DISCO board?

While programming OptionBytes or FW on STM32WLx5 most of the time is OK.In CubeProg I have noticed, that on some MCUs, when I get reading of RDP 0xFF or 0, the next action to program something write related, it could not be done and it's failed.Statistically it's happening too often, 4 failed of 11devices ....(I had also one device, that MCU was fresh and it was already in this state.. had RDP already 0xFF - no write action possible)I can also assure, that I did not programmed any protection at this stage, it's to early.Is there any workaround to overcome this write lock state?Have checked the topics in the community, for example this.But it seems different flow to the same consequence ?If someone can help me understand this situation?What I already find out:Could it be that MSI clock 48MHz got preserved into bootloader mode? (Erratum System 2.2.2 explains high frequency problem)Could it be difference using the ST-Link v2 or v3?By no means FW is programming any OB bytes or something r

hi all,I would like to experiment with the TFM applications contained in the STM32CubeU5 package on my B-U585I-IOT02A boardunfortunately, it seems that STM32CubeIDE is not supporteddoes anyone have suggestions on how to build the TFM applications, based on free and/or open software, without the need to install trial versions of EWARM?thanks in advanceGianluca

Hey, I went through the manual of the STM Programmer command line interface and implemented a post build CRC calc with the Safety lib command -sl.C:\PROGRA~1\STMicroelectronics\STM32Cube\STM32CubeProgrammer\bin\STM32_Programmer_CLI.exe -sl MESOL_CAN_Gateway.elf 0x08000000 0x08100000 0x4000In software then I ran a CRC calc with the standard settings of my STM32F767ZI, but unfortunately the values don´t agree. Does anybody know which polynomial the CLI uses or what I did wrong?part of header file:/* Public defines -----------------------------------------------------------*/#define FLASH_BANK1_END 0x080FFFFF#define PROG_FLASH_END 0x08007FFF // This might need to be extended if program grows, Remember to update AddCRC.bat#define CRC_LOW_ADDR 0x080FFF00#define CRC_HIGH_ADDR 0x080FFF04#define CRC_SLICE_SIZE 0x4000c file: uint32_t CRCValueLow = 0x00000000;uint32_t CRCValueHigh = 0x00000000;uint32_t ExpectedCRCValueLow = 0x00000000;uint32_t ExpectedCRCValueHigh = 0x00000000;void CRC

I am building a custom loader for SBSFU on the STM32WB5MMG. The loader is similar to the BLE_Ota loader, but instead of using BLE, it loads firmware/wireless stack from an onboard microSD card, as well as being able to write CKS keys.I do need to have FUS or the stack running, so that I can write CKS keys.Ideally, I think I want to run FUS, since I don't need a BLE interface. However, the last thing SBSFU does before it runs the standalone loader is to lock services, which includes running the wireless stack if FUS is running.This means that if I reset into FUS in my loader, SBSFU will always start the wireless stack before launching the loader again--preventing me from using FUS in the loader.I could hack out the bit of code that starts the wireless stack before running the standalone loader, but I've tried to make as few changes to SBSFU as possible, to maintain its integrity, and I'm particularly hesitant to make changes to SECoreBin.I thought I might be able to add STM32_WPAN to th

..