STM32 MCUs Security

Hello, I am re-posting this.My original post on the old forums seems to have disappeared !?!I have prepared an SFI (with firmware, debug authentication key and option bytes)After SFI I want to boot to address 0x0C000000To achieve this I have programmed Option Bytes:BOOT_UBE = 0xB4 (OEM-iROT)TZEN = 0xB4PRODUCT_STATE = 0x72 (closed)(and some other bytes) After (successful ??) SFI, the Option Bytes are not programmed correctlyIt seems that SFI terminated early. PRODUCT_STATE is 0x17, UBE = 0xC3 Programming log is attached Am I being stupid? Am I missing something…? Note : I cannot attach the programming log because the attach feature does not work anymore. But it’s not really a useful feature anyway right? Who needs it. So I have made a copy-paste instead. 14:18:32 : Requesting Chip Certificate from device ...14:18:32 : Reading chip Certificate finished14:18:32 : Get Certificate done successfully14:18:32 : requesting license for the current STM32 device14:18:32 : Init Communication ... 14

this thread is split from this thread hello Last question, I just saw the example but it's not for the STM32H755ZI-Q series, are the examples still compatible with this STM32H755 series? Thanks

Hello Team,Good Day !After Cloneed our two version of Hardware ( STM32F3 Series based ) by compititor , we are now more focused on Hardware Security aspects.Can you Pls Suggest which STM32 MCU is the MOST Secure among all available MCU ? Considering Firmware Protection / physical  Attacks ? I would appriciate , if Higher Level Architecture with Device name is Provided.We are also open for Paid Consultancy if any 3rd party ready to help... Regards ,Bhupendra

I'm looking for a working example of how to program the OTP memory on the STM32H573.I am looking to program with TrustZone enabled, from secure mode.  I'm using STM32Cube_FW_H5_v1.4.0, and am not in a good position to move to v1.5.0.  Any working example would do, using HAL, LL or direct register access.Thanks in advance.-Rob

Hello everyone,I am currently working with the Aliro software expansion for STM32Cube using the new STEVAL-ALOCKCB board (Aliro access control reference design based on STM32WBA65RI, ST25R300, and STSAFE-A120).Both the hardware and software are in their original, unmodified state from ST. The nfc12ble project builds successfully without any issues.However, I am encountering a consistent problem:the function CryptoInit() always returns false.From debugging, I can see that the failure originates from the CheckReaderPubK() function, which internally calls isValidProvisioning(). This function also returns false, causing the entire initialization to fail.It seems that the provisioning structure is not considered valid. In particular:The check prov->isValid == DEVICE_PROVISIONING_STRUCT_IS_VALID fails.DEVICE_PROVISIONING_STRUCT_IS_VALID is defined as 0xA5A55A5A (decimal: 2779077210).However, the actual value read from flash appears to be different (e.g., 0xFFFFFFFF), which suggests that t

Hello, In order to comply in advance with the incoming CRA regulation, we would like to have RDP1 enabled on our U575. In order to do this the fw, in the early stages of the initialization procedure, will have to check if it's in RDP0 by reading the related OBs and, if so, it will set RDP1 using HAL_FLASHEx_OBProgram:   HAL_FLASH_Unlock(); HAL_FLASH_OB_Unlock(); HAL_FLASHEx_OBGetConfig(&OptionsBytesStruct); if(OB_RDP_LEVEL_0 == OptionsBytesStruct.RDPLevel) { OptionsBytesStruct.OptionType = OPTIONBYTE_RDP; OptionsBytesStruct.RDPLevel = OB_RDP_LEVEL_1; if(HAL_OK == HAL_FLASHEx_OBProgram(&OptionsBytesStruct)) { HAL_PWR_EnterSTANDBYMode(); //HAL_FLASH_OB_Launch(); } } So far so good, but now it's time to make this changes effective. As far as I understand from other tickets and by practically testing on my board,  calling HAL_FLASH_OB_Launch (commented in my code) will enable RDP1 only after a power cycle of the board. I tried to issue a hard reset usi

Hi folks,I am working on integrating SBSFU with my application. I've got one internal slot and one external slot. The update file is received fine, the header is written to the swap area to be installed after the reset. The reset occurs, SBSFU finds the header, decrypts the update file and swaps the file.However.. it gets stuck at SFU_IMG_Validation, writing the `pTestHeader` to `SLOT_ACTIVE_1_HEADER` address and triggers `SFU_IMG_FLASH_WRITE_FAILED` in `sfu_fwimg_common.c`.I assume that this part of flash is write protected? But I cannot find any mention of this in the SBSFU guides or files. It would be great if someone can help me figure out how to finalize this.09:35:13.652 > = [SBOOT] RuntimeProtections: 0 09:35:46.801 > 74640 bytes of ciphertext decrypted. 09:35:54.301 > Image preparation done. 09:35:54.301 > Swapping the firmware images.................................. 09:35:54.397 > Address = 0801D000, FwSize = 74640, len = 192 <-- added debug info 09:35:54.39

Hi all,I’m working on STM32U385 with OEMiRoT and following this ST wiki page:https://wiki.st.com/stm32mcu/wiki/Security:How_to_adapt_a_user_application_to_ROT_for_STM32U3However, I cannot see any of the images/diagrams in the page (they appear blank or missing).I tried different browsers (Chrome, Edge, Firefox) and different PCs, but the issue remains.Can someone confirm if the images are visible on their side, or if this is a known issue with the wiki page?The diagrams are quite important to understand the ROT/OEMiRoT flow and flash layout.Thanks in advance.Marco Giacomin    

Hi,I am currently testing OEMiROT and I performed the following 3 tests.Test 1: Default example(Overwrite mode enabled + separate Secure and Non-Secure applications)How to start with OEMiRoT on STM32U3 - stm32mcuProject:OEMiROT_Appli_TrustZoneOEMiROT_BootConfiguration:#define MCUBOOT_OVERWRITE_ONLY /* Defined: FW installation uses overwrite method. Undefined: FW installation uses swap mode. */ #define MCUBOOT_APP_IMAGE_NUMBER 2 /* 1: S application only if FLASH_NS_PARTITION_SIZE = 0, otherwise S and NS binaries assembled in one single image. 2: Two separated images for S and NS applications. */ #define MCUBOOT_S_DATA_IMAGE_NUMBER 0 #define MCUBOOT_NS_DATA_IMAGE_NUMBER 0This test works correctly.Test 2:(Swap mode enabled + separate Secure and Non-Secure applications)Project:OEMiROT_Appli_TrustZoneOEMiROT_Boot/* #define MCUBOOT_OVERWRITE_ONLY */ /* Undefined: FW installation uses swap mode. */ #define MCUBOOT_APP_IMAGE_NUMBER 2 #define MCUBOOT_S_DATA_IMAGE_NUMBER 0 #define MCUBOOT

hello ST Community,I'm trying to protect sector 0 of the flash drive from mass erasure using the PCCOP Protection option on the NUCLEO-H755ZI-Q.After tinkering around a bit to understand its functions, I can no longer reset its protection to its default state. Currently, it looks like the one in the photo:When I try to set these valuesPROT_AREA_START1 = 0x0801FF00PROT_AREA_END1 = 0x080100FFwhich i believe are their default values, both in the RDP=0xAA and RDP=0xBB states, I get this error.How can I fix this? Is there a way to reset PCROP Protection to its default mode?Thanks for the support.

Hello, I've recently managed to modify the SBSFU example for the STM32F413H-Discovery board and adapt it for my STM32F419 mcu, building it and executing it successfully.Now the issue is, i need to modify the loading mode from serial ymodem to downloading the firmware image from a file inside of an USB stick To do this, im using the ST driver that is present already in other projects, which requires interrupts (specifically  OTG_HS_IRQn and possibly others) but when the code tries to setup the interrupt and its priority with HAL_NVIC_SetPriority(OTG_HS_IRQn, NVIC_PRIORITYGROUP_4, 0); HAL_NVIC_EnableIRQ(OTG_HS_IRQn); There's a reset of the MCU, so how do i make it so that the SBSFU project can use interrupts?I stumbled upon the AN5056 document where at page 38 talks about interrupt support in the SBSFU, but for the STM32L496 which has a Firewall feature i do not have. Is that still the correct way of proceeding? If so, how?Best regards

Hi everyone,I’m currently experimenting with the GPIO_IOToggle_TrustZone example using STM32 TrustZone.When I build and flash both the Secure and NonSecure firmware, everything works correctly: the LED toggles as expected, so the interaction between Secure and NonSecure worlds seems fine.However, I’m running into an issue with debugging:I can successfully debug the Secure projectbut I cannot seem to debug the NonSecure projectI am using STM32CubeIDE and I would like to understand how to properly configure the environment to be able to debug the NonSecure application as well.Specifically:Do I need a separate debug configuration for the NonSecure project?Is it required to start debugging the Secure project first and then attach to NonSecure?Or is there a specific STM32CubeIDE / ST-LINK / TrustZone debug configuration that I am missing?Any guidance on the correct way to set up STM32CubeIDE for debugging the NonSecure project would be really appreciated.Thanks in advance!

I am a user of the NUCLEO-N657X0-Q board.I would like to use Keil MDK RTX5 RTOS together with Root of Trust.My development environment is as follows:1> Development tool: Keil uVision V5.422> Example source: STM32Cube\Repository\STM32Cube_FW_N6_V1.2.0\Projects\NUCLEO-N657X0-Q\Applications\ROT\OEMuROT_Appli3> Development board: NUCLEO-N657X0-Q4> Manage Run-Time Environment Setting I have added the osKernelInitialize() function to the main function as shown below.int main(void) { #ifdef PRINT_BOOT_TIME /* Get boot cycles */ end = DWT->CYCCNT; #endif /* Reset of all peripherals, Initializes the Flash interface and the systick. */ HAL_Init(); #ifdef PRINT_BOOT_TIME /* Get Boot Time */ time = ((uint64_t)(end) * 1000U / SystemCoreClock); #endif /* Register SecureFault callback defined in non-secure and to be called by secure handler */ SECURE_RegisterCallback(SECURE_FAULT_CB_ID, (void *)SecureFault_Callback); /* Register SecureError callback defined in non-sec

Hello ST Community, I am working with an STM32U585 custom board and I would like to clarify the supported and recommended workflow for flashing TrustZone‑enabled firmware with SBSFU using USB DFU via STM32CubeProgrammer. Hardware / Software Setup MCU: STM32U585 Custom hardware board Tool: STM32CubeProgrammer v2.19.0 Interface tested: ST‑LINK (SWD) USB DFU Security configuration: TrustZone enabled (TZEN = 1) SBSFU (Secure Boot & Secure Firmware Update) used What works (via ST‑LINK / SWD) Using STM32CubeProgrammer CLI with ST‑LINK, I am able to successfully flash all components: SBSFU bootloader File: SBSFU.bin  Address: 0x0C004000 Initial SBSFU application image File: sbsfu_app_init.bin Size: ~1.80 MB (0x1c000) Address: 0x0C030000  The script erases the correct flash sectors, programs the binaries, verifies them successfully, and the board boots correctly. So SWD flashing works as expected for: TrustZone‑enabled device SBSFU bootloader SBSFU appli

Hi,On a custom board I get the following message: Unable to detect DBGMCU Mailbox STwhen i run regression.bat.I did several test (provisionning, regression) before and i didn't notice any issuesDA with password and TZ disabledA program is running on my custom board but i cannot come back to OPEN state with the regression script.I tried with HRST wired to my STLINK with no success ...Any ideas ?Regards

and how will the information be made available for non-EU residents ? 

Hello Team,Believing STM32H5 series is most secure Devices , just doing comparision between H563 and H573 security aspects.Just to know PSA Certified Level 3 and SESIP will also applied to H563 device as well ( being into same Family ) ? We are more concern about firmware protection against Physical and side channel attacks.    

Dear community,I am looking for help to have TFM ported for nucleo_u385rg_q so that I can build the tfm secure and non secure images and do a secure boot on this board. The closest board is b_u585i_iot02a which is a stm32u5 variant. But there are many low level code required for this in trusted-firmware-m repo. Is there a work done by someone that I can use for my work? Any pointers as to how to accomplish this. Thanks in advance for your support.

Hello ST Community,I am working on the NUCLEO-N657X0-Q board with a TrustZone project configured in STM32CubeMX with three contexts: FSBL, AppSecure (AppS), and AppNonSecure (AppNS). The FSBL is working correctly and jumping to AppS successfully.I was having an issue with the SAU Configuration. As per the wiki article, "How to start with RIF on STM32N6 MCUs"  https://wiki.st.com/stm32mcu/wiki/Security:How_to_start_with_RIF_on_STM32N6_MCUsI configured the SAU region. I configured the FLEXRAM, AXISRAM1 and AXISRAM 2 in STM32Cube IDE. But it stays disabled when I tried to generate code. My partition_stm32n657xx.h file looks like :How to resolve this issue?

 After porting the application "STM32Cube_FW_U5_V1.8.0\Projects\B-U585I-IOT02A\Applications\SBSFU" to our own board we have everything operational apart from the ability to invoke the local loader in production mode (RDP2).I have reverted to the original B-U585I-IOT02A board and project and have a similar issue so I am wondering if this is broken or we have misunderstood something. The loader can be invoked in TFM_DEV_MODE with RDP0 but not in production mode with RDP2. The SBSFU application runs fine.Changes from the default STM SBSFU project settings we used to test this on B-U585I-IOT02A1) In SBSFU_Boot project remove the TFM_DEV_MODE pre-processor symbol definition2) In boot_hal_cfg.h >> #define TFM_TAMPER_ENABLE NO_TAMPER3) In boot_hal_cfg.h >> #define #define TFM_OB_BOOT_LOCK 04) In flash_layout.h >> //#define MCUBOOT_PRIMARY_ONLY (definition commented out)5) In flash_layout.h >> #define MCUBOOT_APP_IMAGE_NUMBER 26) In hardening.sh

hello ST Community, Is it possible to change the RDP "Read Out Protection" level from level 1 to level 0 without erasing the flash data? I've currently been able to change the level from RDP level 1 to level 0 for Nucleo-H755ZI-Q, but changing the level causes a mass erase of the flash drive. Is it possible to avoid this? If so, is there a code example? Thanks for your support.

Hello,I am working on the boot process and security of the STM32H757.For my tests, I have placed the two boot addresses for the two cores (ADD0 and ADD1 for CM7 and CM4) in the internal flash memory, with an ISR vector at each boot address :ADD0: standard ISR vector calling the standard Reset_Handler, which in turn calls the main function g_pfnVectors: .word __initial_spTop /* Use internal RAM for stack for calling SystemInit. */ .word Reset_Handler .word NMI_Handler .word HardFault_Handler .word MemManage_Handler .word BusFault_Handler .word UsageFault_Handler ... and ADD1: virtually the same ISR vector but calling BootPin_Handler instead of Reset_Handlerg_bootPinVectors: .word __initial_spTop .word BootPin_Handler .word NMI_Handler .word HardFault_Handler .word MemManage_Handler .word BusFault_Handler .word UsageFault_Handler ... Everything seems to be working properly, at least up until the security test.When RDP is set to level 0 or 1, everything is fine and

Post Edited by ST moderator to apply source code formatting Hello, To need to disable external read/write access to flash in stm32c071 i have changed the RDP from level 0(0xAA) to level 1(0xBB) and was successful in doing so. But when I try to change from level 1 to level 0 i am unable to change it.  code to change from level 1  to level 0. eFLASH_ErrorType_t FlashReadWriteEnable(void) { eFLASH_ErrorType_t err_code = e_SUCCESS; // Check if flash is busy err_code = CheckFlashBusy(); if(err_code == e_SUCCESS) { // Unlock flash err_code = flashUnlock(); if(err_code == e_FLASH_UNLOCKED) { // user options unlock err_code = flashOptUnlock(); if(err_code == e_FLASH_OPT_UNLOCKED) { FLASH->OPTR &= (~FLASH_OPTR_RDP_Msk); FLASH->OPTR |= (0xAA << FLASH_OPTR_RDP_Pos); FLASH->CR |= FLASH_CR_OPTSTRT; // Check if flash is busy err_code = CheckFlashBusy(); if(err_code == e_SUCCESS) { FLASH->CR |= FLASH_CR_OBL_LAUNCH; } } } } return err_code;

Hello ST Community,I am working on the NUCLEO-N657X0-Q board with a TrustZone project configured in STM32CubeMX with three contexts: FSBL, AppSecure (AppS), and AppNonSecure (AppNS). The FSBL is working correctly and jumping to AppS successfully. I followed the wiki article "How to start with RIF on STM32N6 MCUs" as reference. https://wiki.st.com/stm32mcu/wiki/Security:How_to_start_with_RIF_on_STM32N6_MCUs The secure LED (configured as output push-pull, pulled low initially) turns ON but never toggles. I have tried both HAL_Delay() and a pure software loop  for (volatile uint32_t i = 0; i < 800000; i++);  inside the while(1) — neither causes the LED to blink. The GPIO write to set it HIGH works, but the toggle never happens. This suggests the secure while(1) loop itself may not be executing, or the app is hanging somewhere before it. The NS LED does not turn ON or toggle at any point. The NS app appears to not execute at all. I have configured RISAF for

Hello,My STM32H573I-DK board is bricked after a failed provisioning attempt.What happened:Accidentally changed PRODUCT_STATE from Open (0xED) to 0x17 (Provisioning) via programmerThen an AI coding assistant (Copilot) attempted some configuration via DFU mode and enabled TrustZoneI no longer have access to the PC where this was doneCurrent symptoms:SWD: "Unable to get core ID", "Cannot connect to access port 1"DA discovery (debugauth=2): "The target is unable to boot on RSS_DA or is in OPEN mode"DA regression (debugauth=1) with default STM32CubeFW_H5 keys: "Unable to detect DBGMCU Mailbox" or "unable to boot on RSS_DA"DFU (USB0): "Target device not found" (with boot jumper set to SYS/MEM)UART bootloader: timeoutWhat I tried:SWD with HOTPLUG, UR, HWrst, ap=0, freq=100DA regression with default key_3_leaf.pem and cert_leaf_chain.b64regression.bat from ROT_Provisioning\DADFU via User USB (CN17) with JP4 on USB-PD positionUART via ST-Link VCPSetup:Board: STM32H573I-DKSTM32CubeProgrammer: v2