STM32 MCUs Security

How do I calculate the SPI CRC-16 in C? I have an STM32F429 sending me SPI data. These are the SPI settings:How do I implement a CRC-16 check implemented in C (not using STM32)?It is 16-bit data with LSB first. Polynomial X1+X3

How can I manually calculate the SPI CRC in C? I can't seem to find any information about this.

Do we have any mechanism to know about Software validation check status ??in case of reset, SBSFU will check for validity of application, before jumps to it. And in case of fail, it won't launch application, The failure status, how can we know ??Do we have any recovery mechanism, if signing verification failed and we don't have application running to download new firmware ??

Hello Gentelman,In my algorithm, I need to calculate 2 types of CRC with different polynomials. Is there any way to avoid keep deInit and Init CRC, and change the value of polynomial dynamically?

Hey guys,I need to replace Uart for USB on my SBSFU local loader. I manage to create the USB comm in SBSFU quite easily, using UART structure provided in the SBSFU examples. My problem is when i receive firmware header, my code get stuck on the following part in the Secure Engine:int32_t status; PKA_ECDSAVerifInTypeDef ECDSA_verif = {0}; const uint8_t *pSign_r; const uint8_t *pSign_s; /* Firmware metadata to be authenticated and reference MAC */ const uint8_t *pPayload; /* Metadata payload */ int32_t payloadSize; /* Metadata length to be considered for hash */ uint8_t *pSign; /* Reference MAC (ECCDSA signed SHA256 of the FW metadata) */ const uint8_t *pPub_x; const uint8_t *pPub_y; /* buffer for sha256 computing */ uint8_t MessageDigest[CRL_SHA256_SIZE]; int32_t MessageDigestLength = 0;   /* the key to be used for crypto operations (as this is a pointer to m_aSE_FirmwareKey or m_aSE_PubKey it can be a local variable, the pointed data is protected) */ uint8_t *pKey;T

Greetings. I am developing a LoRaWAN application running on the STM32WL5, the application does work and makes use of the flash memory to store the application eui/network key (so that it is not necessary to recompile the firmware each time), the keys are fetched from flash memory by using a custom loader script and a few calls to memcpy to store them in a couple of temporary arrays used for validation and then, should the keys be correct, in the LoRaWAN related structures normally populated via macro by se-identity.hI decided to give the PCROP option byte a shot and, after flashing the program, i used STM32CubeProgrammer to, in this order:-write the keys to the flash area-enable RDP (level 1) and PCROP on the flash area not used by the keys (ie: as the key area uses the last 2kb page of memory, PCROP1A_START and END are respectively 0x00 and 0xFB)However this, for some reason, caused the program to no longer run. Intrigued by this i brought the option bytes to their default settings (R

=======================================================================       (C) COPYRIGHT 2017 STMicroelectronics         ==                                  ==       Secure Boot and Secure Firmware Update        ======================================================================== [SBOOT] SECURE ENGINE INITIALIZATION SUCCESSFUL= [SBOOT] STATE: CHECK STATUS ON RESET  INFO: A Reboot has been triggered by a Software reset!  INFO: Last execution status before Reboot was:Executing Fw Image.  INFO: Last execution detected error was: No error. Success.= [SBOOT] STATE: CHECK NEW FIRMWARE TO DOWNLOAD= [SBOOT] STATE: CHECK USER FW STATUS  New Fw to be

I'm trying to piece together the post-build process for flash integrity check using CRC. I'm running on an STM32F777.So far I've been following:https://community.st.com/s/question/0D50X0000B9vdDC/how-can-i-calculate-crc-of-image-in-post-buildand https://www.eevblog.com/forum/microcontrollers/stm32-hex-file-signing-with-crc/andhttps://github.com/ethanhuanginst/STM32CubeIDE-Workshop-2019/tree/master/hands-on/06_F746-DISCO-CRCBut I'm seeing an error (warning?) that these guides don't mention and I haven't been able to find an explanation elsewhere:warning: The STM32 filter uses 4-byte alignment,  but unaligned data is present. Use a "--fill 0xNN --within <input>  --range-padding 4" filter *before* the STM32 filter to fix this problem. See  srec_info(1) for how to see the data ranges.I've tried adding the changes suggested by the error message, but they throw additional errors and it feels like a rabbit hole.What's causing this unaligned data? Can I/shou

I would like to store two keys in the KMS as dynamic objects to use them in my UserApp project: One public ECDSA key One private ECDSA key For the public key, I have as example the SBSFU_ECDSA_1_Verify key so this should be fine. However, I don't know how to add a ECDSA private key. Is that explained somewhere? I find very little information about the KMS. Thanks in advance,Benjamin

Hello, I am currently working on a project on a STM32G483 microcontroller. My project contains the xCubeCryptolib library. But also I use the CRC device for the integrity of my variables that I save in the internal flash. During the development, I saw that the CRC device is reset by the ST library. Is this a normal behavior? Are there any other devices used by the cryptography library?

We want to store up to 4 Public Keys as backup, in case of any exploit in one KEY, we can switch to another.So, Can you provide any solution to store more than one Public KEY in SBSFU solution??

Hi,For production purpose we designed a control board for the test jig which does unitary and RF testing as well as the programming of onboard SoC and MCU, the STM32 target in this case is an STM32F411CEU6, the test jig control board is also based on an STM32F411CEU6.So far the SWD programming works perfectly well, and it is significantly faster than the STlink, it successfully erase the used page, unlock RDP when needed, and lock RDP to level 1 after flash programming, the issue is, after programming flash and setting RDP to level 1, there is no way to run the firmware, which is a problem because some fonctional tests are depending on the target firmware.Basically once the RDP is set to level 1 the target will not run unless a physical power on reset (: disconnecting and reconnecting VCC and GND) plus a reset with the reset line is issued. I tried various things to avoid this issue, such as issuing multiple/longer reset with the reset line, and also writing :dap_write_word(DEMCR, 0x00

please share with example​

I am using the SBSFU project for OTA.I have linked my UserApp successfully with SBSFU projects and firmware up-gradation is working fine when FIREWALL protection is disabled.I am using the STM32L4 series controller and am aware of L4 series firewall-related issues.So I want to know how I can use firewall protection only for Flash by disabling firewall protection for SRAM1.The datasheet mentioned that if we pass length 0 of Volatile data segment (SRAM1) and VDS = 1 then protection is disabled for SRAM1 but I am still getting firewall reset.How can I bypass SRAM1 firewall protection?

I would like to place some of the functions of ST Crypto library (cmox_crypto) into the ITCM to increase the performance on STM32H750x MCU. I would also like to place some of the associated data (tables) into ITCM or DTCM. However, the functions are provided in the precompiled library (*.a), and code is in .text section. I can place the entire .text into ITCM through linker script, but I'd like to do it selectively and only for some functions. Will attaching the __attribute__((section(".itcm_text"))) to the functions prototypes in *.h files work? Even if it does, there are many nested calls there and modifying all references is difficult. Does anyone know a better way of assigning sections to symbols through some linker directives or a script file?What is the best way to do the same for data?

As per Firmware encryption need, we need to have OTFDEC module and External Flash, where we can store Encrypted firmware on External Flash and on every reset of MCU, we decrypt on the fly with help of OTFDEC module and load it on RAM. From there it can execute.But here in SBSFU examples, for STM32H753ZI, we see SECBOOT_ECCDSA_WITH_AES128_CBC_SHA256 crypto scheme, where it is encrypting the firmware as well. is it available on production mode of STM32H753VI as well ??if it is, then how it is possible without OTFDEC & External Flash ??

Need support to have STM32F769 Hardware 32BIT CRC generation and same value should be generated by STM CUBE IDE POST COMPILATION 32BIT CRC for BINARY file .So a quick background is once the project is compiled and binary is generated we use SREC_CAT post binary build so we get the Binary + 32 BIT CRC . currently we are using 32BIT Sofware CRC generated in Firmware to compare with what IDE generates . Same SREC_CAT generated 32BIT CRC for BINARY should match with STM IN-BUILT HARDWARE 32BIT PHY generated 32 BIT Binary .http://srecord.sourceforge.net/man/man1/srec_cat.html

Hi all,I am not sure if I understood the reference manual right: When I activate Read Out Protection RDP Level 1, I can no longer access RTC Backup registers if I execute in RAM. I did not read that also Backup RAM is inaccessible. But it looks it is the case...My problem is that I use the 128k version of the STM32H7 and I must run the firmware in RAM. But I also need a low power retenion memory. Leaving D3 on to keep SRAM4, uses too much power (few mA). HAL_PWR_EnterSTANDBYMode() from hal_pwr.c works fine for me - except that it clears SRAM4.I tried other STOP modes but the source too much. BTW there is no tamper alarm activated (at least not by me).Is there a way accessing Backup SRAM from code running in AXI/SRAM1,2,3 etc?

..

Hi ,I am working on STM32U575 nucleo board .Flash got locked (code freeze) and i have to power cycle board to run my application in below cases :Switching from RDP0 to RDP2 in firmware on Pushbutton operation . Application freeze . It runs again when i toggle IDD jumper.When in RDP2 if i try to connect via SWD ,Application freeze .It runs again when i toggle IDD jumper .I am using 5V_USC_C to provide power supply to board.Is this behavior acceptable , as going through some reference i have read that in RDP1 access via JTAG is considered as Intrusion and it locks Flash.Does it applies to RDP2 also ?@TDK​  @JHOUD​ 

I'm struggling to get the SPI CRCERR flag and IRQ to work the way I expect.I am using an STM32WB55. The SPI communication in full duplex is working. The master is adding the CRC to the end of the Tx data. On the slave side, the CRC is read in. I can see the RXCRC updating, and I can see it go to 0x00 when the final CRC byte is read, which tells me that the CRC calculation is working. However, I cannot get the CRCERR flag to turn on when I purposefully have a CRC mismatch (using different polynomials on master and slave to trigger a mismatch).I suspect the issue is related to the DMA transfer sizes. I have read the advice about what length of transfer to use (Tx side = data length without CRC; Rx side = data length with CRC), and I have tried various combinations. I suspect that slave SPI does not know the transfer is done, so it does not do the final comparison and set the error bit.So, some actual questions:Should I expect the CRCERR flag to work with SPI + DMA on processors like the

Hello !STM32L4R9I support True Random Number ( 32 bits per 1 time generation)I run an example and then make an program to generate 100.000.000 bits1 st iteration (100M bit) : HW is 0.5 and Passed NIST Test2 nd iteration (100M bit) : HW is 0.5001 and Failed NIST Test ( 3 Non-overlapping )Did TRNG pass All NIST Test ?If yes, how to set up NIST Test ? ( I attached my setup as below) If no, why?P/s: https://nvlpubs.nist.gov/nistpubs/legacy/sp/nistspecialpublication800-22r1a.pdfThanks so much !

I see that those keys are hardcoded in the code. As I understand they are responsible to LTK and CSRK.Should I change ERK and IRK between devices , so they are not the same? Asking for security reasons.