STM32 MCUs Security

..

Hello,I am trying to flashing customized SBSFU_UserApp.bin of 1_Image application from BSFU example project on STM32H7B3I-DK. I am getting error when the application is booting. The error is:= [SBOOT] SECURE ENGINE INITIALIZATION SUCCESSFUL= [SBOOT] STATE: CHECK STATUS ON RESET   INFO: A Reboot has been triggered by a Hardware reset!= [SBOOT] STATE: CHECK NEW FIRMWARE TO DOWNLOAD= [SBOOT] STATE: CHECK USER FW STATUS   No valid FW found in the active slots nor new FW to be installed   Waiting for the local download to start...= [SBOOT] STATE: DOWNLOAD NEW USER FIRMWARE   File> Transfer> YMODEM> Send ...............The reference 1_Image of STM32H7B3I-DK is working fine. I am adding a new crypto scheme in this application. I have not change any address in the Linker_Common files. I am setting the application in development mode through app_sfu.h fie. The compilation of 3 applications, prebuild and postbuild scr

STSAFE-A110 series are come in Reel packaging, it's SO-8 package ,I need to know the orientation for IC pin 1 in tape reel. could you hlep to inform us for this question?

..

the function MX_RNG_Init failsHAL_RNG_Init returns t.o.: while (HAL_IS_BIT_SET(hrng->Instance->CR, RNG_CR_CONDRST)) {  if ((HAL_GetTick() - tickstart) > RNG_TIMEOUT_VALUE)  {   /* New check to avoid false timeout detection in case of preemption */   if (HAL_IS_BIT_SET(hrng->Instance->CR, RNG_CR_CONDRST))   {    hrng->State = HAL_RNG_STATE_READY;    hrng->ErrorCode = HAL_RNG_ERROR_TIMEOUT;    return HAL_ERROR;   }  } }

..

I am using an STM32H757. I understand how, using the TrustedPackageCreator and an HSM, I can supply our manufactures with an encrypted version of the firmware and limit the number of product instances they can produce. My question is, when the product firmware is being updated in the field does the person doing the updating (service engineer) need an HSM card as well. If so, is there a way to give our service people a card that allows for unlimited firmware updates? If not, what is the best approach to provide our service people with the ability to update the firmware in the field? We would like to avoid the situation were the service engineer cannot update the firmware because the HSM card has no more instances remaining.

Hello,I am trying yo implement the HW encryption acceleration on a STM32F423CH for AED CCM Mode. I tried to implement on the first place the CTR encryption mode but it seems to me that the example provided in the NIST Special Publication 800-38A cannot be implemented since the STM32 Inicitialization Vector only accept 96 bits and not the 128bits from the NIST example:F.5.5 CTR-AES256.EncryptKey 603deb1015ca71be2b73aef0857d77811f352c073b6108d72d9810a30914dff4Init. Counter f0f1f2f3f4f5f6f7f8f9fafbfcfdfeffBlock #1Input Block f0f1f2f3f4f5f6f7f8f9fafbfcfdfeffOutput Block 0bdf7df1591716335e9a8b15c860c502Plaintext 6bc1bee22e409f96e93d7e117393172aCiphertext 601ec313775789a5b7a7f504bbf3d228Is that right?Second question, jumping the CCM implementation in the RM0430 Reference Manual of the STM32F423 there is a description on how to implement the CBC-MAC (CCM) encryption.My principal problem is how to configure the AES_IVR registers for this configuration to reproduce the examples on NIST Special

Hello,I am trying to flashing SBSFU application on the STM32H7B3I-DK board using STM32Cube Programmer. I am using STM32H7B3I-DK 1_Image example project from SRM32CubeExpansion_SBSFU_V2.6.1. The board is working fine in the first boot and all the jumpers are in default settings. After checking the demo application I am trying to flashing the SBSFU application. For the flashing, I am taking guidance from section 8: Step-by-step execution of "UM2262-Getting started with the X-CUBE-SBSFU STM32Cube Expansion Package" document.The above documents used NUCLEOL476RG board as a reference to flash the application, but I am using STM32H7B3I-DK. Due to different board I have not change the option bytes settings. The board read out protection is set at Leve 0. After completing the above steps and flashing the SBSFU_UserApp.bin, the application is work find and I can see the SBSFU application menu at the tera term screen.After the restart the board I am not able to see anything's at tera term. I am

Hi,I have a chip marked as STM32F437 but my software fails on running the SHA256 algorithm on the hardware crypto module.The only difference to the STM32F427 is the additional presence of a hardware crypto accelerator in the STM32F437.How can I check that the crypto module is present and enabled?When I check the DBGMCU_IDCODE register I read 20016419h on both.That means -DEV_ID: 2001h STM32F42/STM32F43 Rev 3,4,5, and B.-REV_ID: 419h STM32F42 STM32F43So I can not differentiate between STM32F42 and STM32F43.How can I do that?Is there any known criminal chip cloning known for STM32F437?I attach pictures of the chip that works as expected and a chip that dos not work.Thanks in advance, Adib.--

I shall just write a function in software but I would be interested to know if it is supported or not by the CRC peripheral hardware.STM32 cube MX configurator does not allow you to choose X7 for the 7bit (8 term) polynomial described on page 21 of this datasheet?It is also prevented by a length check on line 111 of stm32l4xx_hal_crc_ex.c(case CRC_POLYLENGTH_7B)"https://www.sciosense.com/wp-content/uploads/documents/SC-000897-DS-7-ENS210-Datasheet.pdf"Thank You

I have decided to try out the X-Cube-SbSfu, i have downloaded the SW from the ST website,according to the documents available this is an expansion pack that can be added to the CubeMX.is this correct?where can I find information about the process that helps me accomplish this?

I have worked with the HAL software implementation of the CRC using HAL_CRC_Calculate() and HAL_CRC_Accumulate(). Works great. How do I utilize the hardware CRC feature? Can you direct me to an example or more information?

..

..

Hello,I am trying to port SBSFU example project on STM32L433RC board. I followed getting started and integration guide to integrate STM32L432KC SBSFU 1 image example project(after modification) on STM32L433RC board. Below is the image where it gets stuck and waits for New user firmware. I ran scripts from MOOC workshop. It just uses UserApp.bin to download on board. Not sure why the code is trying to ask to download new user firmware. Can anyone help in pointing out if I am doing something wrong?Thanks!

The reason that I'm doing this is because I want to sign the mcuboot bootloader used by TF-M. (https://git.trustedfirmware.org/TF-M/trusted-firmware-m.git/tree/platform/ext/target/stm/b_u585i_iot02a/include/flash_layout.h).The flash layout looks like this:/* Flash layout for b_u585i_iot02a with BL2 (multiple image boot): * * 0x0000_0000 SCRATCH (64KB) * 0x0001_0000 BL2 - counters(16 KB) * 0x0001_4000 BL2 - MCUBoot (84 KB) * 0x0002_7000 OTP Write Protect (4KB) * 0x0002_8000 NV counters area (16 KB) * 0x0002_c000 Secure Storage Area (16 KB) * 0x0003_0000 Internal Trusted Storage Area (16 KB) * 0x0003_4000 Secure image primary slot (256 KB) * 0x0007_4000 Non-secure image primary slot (512 KB) * 0x000f_4000 Secure image secondary slot (256 KB) * 0x0013_4000 Non-secure image secondary slot (512 KB) * * Bl2 binary is written at 0x1_2000: * it contains bl2_counter init value, OTP write protect, NV counters area init. */I added space for the header before "BL2 - counters" - the

Hello,I am exploring the example application of X-CUBE-SBSFU for STM32H7B3I-DK board. I have successfully compile the given example application for 1_Image. I have tried to understand the 1_Image_SEcoreBin application for cryptography and key generation. The example application is used ECC cryptographic schemes for firmware authentication. I have checked the se_crypto_config.h for changing the scheme but there is only ECC defined.My question is I need to change the ECC cryptographic schemes to RSA schemes. How can I change or add the support for RSA cryptographic schemes for the STM32H7B31-DK board? Looking forward for your support.Thanks,Ikbal

..

Hello, I've been trying to build an application with Trusted Firmware and using Zephyr RTOS for the non-secure application i'm using b_u585i_iot02a board. After i build my application, the OSPI is not working anymore from my non-secure application. I can see from AN5247 and RM0456 that the default security state of the OSPI banks when building with trusted firmware is secure, which then makes sense. So my question is: Is it true that the OSPI is non acccessible from non-secure application when building with trusted firmware pr. default? And if yes, how can i disable this so i'm able to use it from my non-secure application as before?

..

I wish to try the TFM application on my B-U585I-IOT02A demo board. But the support for STM32CubeIDE has disappeared in FW_v1.1.0. Is there any reason for that, or can I copy the project from patch_cube5_v.1.0..2, though the source files have significantly changed since then ?Regards

i have a problem, when flash the SBSFU UserApp with the scipt and reset the Board. i get this:= [SBOOT] SECURE ENGINE INITIALIZATION SUCCESSFUL= [SBOOT] STATE: CHECK STATUS ON RESETWARNING: A Reboot has been triggered by an Option Byte reload!= [SBOOT] STATE: CHECK NEW FIRMWARE TO DOWNLOAD = [SBOOT] STATE: CHECK USER FW STATUS A FW is detected in the slot SLOT_ACTIVE_1 = [SBOOT] STATE: VERIFY USER FW SIGNATURE = [SBOOT] STATE: EXECUTE USER FIRMWARE = [SBOOT] System Security Check successfully passed. Starting...i get this in an endless loop and i don't get to the Main Menu. i use stm32 wb55.Please help me !!

From SBSFU examples, with default SECUSER memory setting except reading from OB registers, it is only protecting SBSFU area alone.Are we need to protect SBSFU + ACT_SLOT HEADER (1024 Bytes for H7) area as well right ??So what is your recommendation on protection of HEADER ??

Hi ,For a GIVIEN Binary File . We Want to Implement STM32CUBEIDE Post Build CRC calculated Value to Match with the STM32 HW CRC value .For IAR WorkBench IDE the IDE Proviedes POST BUILD configuration to generate the required CRC and place in BINARY . But for STM32CUBEIDE we do not have such implementation . as shown in following image . Is there any documentation for implementing the same .Thanks and Warm Regards,