STM32 MCUs Security

Hello,the cryptolib offers the function ECDSAsign. In the ecc.h it is declared as int32_t ECDSAsign(const uint8_t *P_pDigest, int32_t P_digestSize, const ECDSAsignature_stt *P_pSignature, const ECDSAsignCtx_stt *P_pSignCtx, membuf_stt *P_pMemBuf);Testing shows that P_pSignature gets changed when ECDSAsign is invoked. That is compliant with the documentation (UM1924, Rev 7, page 138, table 138). I thought const parameters may not be changed by a function. Why is the parameter set as const?Best regards

Hi all,I've downloaded the package 'STM32CubeExpansion_SBSFU_V2.4.0' and I've opened, using STM32CubeIDE (Version: 1.6.1), the project STM32WB55RG_Nucleo_2_Images_SECoreBin. I'm not able to compile the project because I've the following error:arm-none-eabi-gcc -mcpu=cortex-m4 -c -x assembler-with-cpp -MMD -MP -MF"Application/SW4STM32/se_key.d" -MT"Application/SW4STM32/se_key.o" --specs=nano.specs -mfpu=fpv4-sp-d16 -mfloat-abi=softfp -mthumb -o "Application/SW4STM32/se_key.o" "C:/progetti/INFOBOX_3.0/Micro/download/en.x-cube-sbsfu/STM32CubeExpansion_SBSFU_V2.4.0/Projects/P-NUCLEO-WB55.Nucleo/Applications/2_Images/2_Images_SECoreBin/SW4STM32/se_key.s"arm-none-eabi-gcc -mcpu=cortex-m4 -c -x assembler-with-cpp -MMD -MP -MF"Application/SW4STM32/startup_stm32wb55xx_cm4.d" -MT"Application/SW4STM32/startup_stm32wb55xx_cm4.o" --specs=nano.specs -mfpu=fpv4-sp-d16 -mfloat-abi=softfp -mthumb -o "Application/SW4STM32/startup_stm32wb55xx_cm4.o" "C:/progetti/INFOBOX_3.0/Micro/download/en.x-cube-sbsfu

Hello, I am interested in learning how to sign an app that we created. could it be automated or what files would have to be changed? A second thing is if i want to switch to a different authentication algorithm (replace RSA for example), how would I go about that?Thanks

HelloI am doing a project where I investigate the increased energy consumption when implementing TLS on an MQTT protocol.At the moment, I am doing tests where I measure the current via the IDD pins. But I was surprised at how little impact the implementation of TLS had. I am running with a specific Cipher suite DHE-RSA-AES128-GCM-SHA256. I did expect a longer working time where the MCU consumes more energy. But from what I can see in the pictures, it's just a small spike that always and only appears when I run with TLS.So I wonder if it is so that Eg. RNG (random number generator) and other safety features power consumption does not go through the IDD pins.I am using the STM32L476RG, connected via UART to an ESP8266 (Wifi-MCU). The pictures show the current in Cyan, and the blue line is the TX signal that I used to trigger on the oscilloscope.  I would be incredibly grateful if anyone have the knowledge of this and can help me with the case.Thanks in advance./ Victor

Hello,I am working on a SBSFU for a H753ZI board. To help me with this, I am using the example projects provided with the SBSFU package and the MOOC.I was able to successfully download the SBSFU on the board and make the example UserApp run on it. I now want to do the same with my own app instead of UserApp.For this, I adapted the postbuild.sh script to correctly encrypt and sign my image such that it is successfully accepted by the SBSFU when making a firmware update. I replaced the original ld file and the system_stm32h7xx.c file of my custom app with the ones of the example UserApp. After that, I checked that my application still worked in standalone encrypted it and signed it. The image is successfully accepted by the SBSFU and executed. However, instead of behaving as expected, the LED1 on the board blinks at relatively high frequency.The only reason I could find for this behavior is that the SBSFU is supposed to make the LED1 blink at 4Hz if there is an error in the option bytes

Please guide me how to add SLOT_ACTIVE_2 to firewall protection.

Hi all,We have been testing our 2 images configuration SBSFU firmware update with our NUCLEO-L476RG. We have encountered 2 scenario's during which the different steps taken by the bootloader was not entirely clear to us. We could use your help to clarify this.So in both scenario's we started by normally flashing our firmware to the STM32. Nothing special.Subsequently, in the first scenario, we do a hardware reset to do a YMODEM transfer to transfer new firmware to the STM. When this update is completed, we again do a hardware reset and transfer new firmware again over YMODEM, before the previous firmware was validated (this was intentional for testing this scenario). You can find the output log of this scenario in the attached file output-log-scenario-1.txt.We have 2 questions about this scenario and its output:Are we correct to assume that the following happens?So in the first update, the new FW is downloaded in the DWL slot and successfully swapped with the ACTIVE slot. After the ins

Hello,I am trying to mimic the STM32 Example code, UART_Trace_TrustZone, to have my nonsecure world use a secure callback to print to the serial port after being initialized. However, only my secure world prints to the serial port. Ideally, I would also see the non secure world print to the serial port as well after the Nonsecure_init() function is called. I have tried copying the same strategy as the example, writing the same SECURE_TraceMessage function as them, however I am still out of luck. I followed this video when setting up TrustZone (https://www.youtube.com/watch?v=0mSsKxzYj3s)I attached my secure and non secure worlds as well as my IOC file. I will eventually be using X-Cube-AI for my other tasks but currently have those functions commented out to try and just get the TrustZone features working. Any help would be appreciated.Also not sure if this is a common issue, but when generating the code if you run into build errors in the secure world regarding the libraries,Right cli

need to add CRC to my binary. i.e. srec_catCan I add path to IDE to look for srec_cat, alternative what path are searched

I had a problem while uploading firmware into my custom board.​I used ST-Link attached at NUCLEO-F091RC board, and I could read Option Bytes and Memory at 0x00000000 using ST-Link Utility and STM32CubeProgrammer.​​But I can't read or erase flash memory. It notifies "Can not read memory! Disable Read Out Protection and retry."​and when I try to change Option bytes, notifies "Could not set Option bytes! Please reset the target and retry."​and this is the log when I tried to download and debug with STM32CubeIDE.​​​STMicroelectronics ST-LINK GDB server. Version 5.2.3Copyright (c) 2019, STMicroelectronics. All rights reserved.​Starting server with the following options:    Persistent Mode      : Disabled    Logging Level       : 1    Listen Port Number     : 61234    Status Refresh Delay    : 15s &n

cant find and examples on how to use GenerateSignature

Hello,I need help setting the secure memory area for the STM32H753XI mcu. I am running it on STM32H753I-EVAL kit.I have read the dedicated part on the reference manual (chapter 5 on document RM0433), the "Introduction to STM32 microcontrollers security" (document AN5156) and I also read an implementation made for the STM32H7B3 mcus (documents AN5601).My problem is that I cannot set the secure area successfully both programmatically and manually using STM32Programmer.Using STM32Programmer I can set the security option bit, the PCROP area and the readout protection without a problem. The only thing STM32Programmer won't ever let me set is the secure area. If I change for example the values of SEC_AREA_START1 and SEC_AREA_END1 with something that isn't the stock value and try to write these values to the MCU registers, STM32Programmer returns an error by saying that the values that I set are not the ones that were already on the registers.I tried setting the secure area using STM32Program

hi there I cannot figure out the true meaning of htcr reg and config1~config3 field in rng_cr reg。 I was wondering about the relationship between health test register and health test parameter （repetition counter test the “40�? consecutive bits or adaptive proportion test the "691" times)asking for help!!! any reply will be welcome ​

Hello,I have an unexpected behavior with a H753ZI board. After a very few steps, I ended up in a situation where PCROP seems to be enabled and RDP level is set to 0. For some reasons, this causes the board to freeze indefinitely, moreover after disconnecting it, it became unresponsive to any action using STM32CubeProgrammer or ST Link Utility.The symptoms:The board can not be connected to in a mode other than "hot plug" mode. Trying to connect in "normal" mode yields the error DEV_TARGET_NOT_HALTED. Trying to connect to the board using the "under reset" mode while holding the reset button down does not work either. This has been tried using STM32CubeProgrammer, ST Link Utility and STM32 Programmer CLI.Once connected in "hot plug" mode, full chip erase is impossible. An error is given saying "Error: Mass erase operation failed.Please verify flash protection".In "hot plug" mode, I am also unable to modify any of the option bytes. For example, if I try to set the RDP level from 0 to 1, I

This may be a dumb question, but how can I correctly reboot a programmed board after setting the read out protection?Hardware: ST Link-V2Software : STM32 ST-LINK CLI v3.5.0.0Connect via SWD freq 4000Test programs BOR_LEV=3 and nDBANK=0 > everything is OK..bin Firmware is flashed onto the STM32F777 > everything is OK and the board boots as intended.Read out protection level 1 is set (RDP=1), but the board does not reset \ boot up again.Please note, that I do not have access to the FW code, I only use the .bin file.The only "solution" I found is to do 2 x power cycles to the whole board, which seems very ineffective and takes a lot of time.How is the boot process halted and how could I set the tester to reboot the board without time consuming power cycles?As an off topic question, how could I enable the log feature from the ST-LINK CLI?I tried the "-Log location\file.txt" but it doesn't work. From the STM32 ST-LINK Utility the log feature works as intended.Best regards,John

In the video, "Security Part6 - STM32 security ecosystem - 02 Building the SBSFU" there are some scripts under the folder "STM32SecuWS" which are unavailable in the SBSFU download software. Where can I get these scripts? I am also struggling while following the U2262 manual in step 8. The welcome screen does not display after I configure TeraTerm. I am not sure if I did the flashing thing wrong- it is a bit unclear. Would appreciate any help thanks.

Hi,I followed document "readme.txt" in "STM32Cube_FW_L5_V1.4.0\Projects\STM32L562E-DK\Applications\TFM" to family with TFM, it work fine.My question:1: "press reset button or restart the board power" will lock the board. Please tell me what code in the "STM32Cube_FW_L5_V1.4.0\Projects\STM32L562E-DK\Applications\TFM" cause the board locked, and list the code for me.2:"Remove JP2 jumper on STM32L562E-DK board, then put it back in place" can unlock the board, but I can't unlock the board via restarting the board power. please explain more detailly for me, or show me what code is used to unlock the board in "STM32Cube_FW_L5_V1.4.0\Projects\STM32L562E-DK\Applications\TFM".Thanks,QiZhang

Using a STM32F407VGT6 (1MB Flash)For the starting address of 0x08000000 (base address), HAL_CRC_Accumulate only accepts a buffer length of up to 0x40000.For 0x080F0000, only buffer length up to 0x4000.For 0x080FF000, only buffer length up to 0x400.For 0x080FFF00, only buffer length up to 0x40.For 0x080FFFF0, only buffer length up to 0x4.For 0x080FFFFC, only buffer length up to 0x1.I understand that it is related to the fact that it is 32 bits, which means 4 bytes. But how would it be possible to CRC all Flash?Ref.: https://github.com/ethanhuanginst/STM32CubeIDE-Workshop-2019/blob/master/hands-on/06_F746-DISCO-CRC/README.md

I am using STM32CubeIDE and am slightly confused on the rebuilding project steps of the UM2262 manual. Should I be going into each individual folder in the "Projects" folder and rebuilding all of them (such as NUCLEO76RG --> Applications --> 2_Images) or is there a specific one. If so, in the step that says "download the SBSFU target software to the target without starting a debug session" how does one do that? I'm relatively new to this so would appreciate any help. Thanks! I'm not sure if there is a video about this because the manual can be confusing for a beginner.

Currently, i working on the nucleo-L552zeq and i run the SBSFU exemple propose by the cubeL5. i use the script regression.sh and the script the SBSFU_UPDATE.sh to initialize the board and download the firmware. this example can work normally on the board. Then i reset the board to some Trustzone project without SBSFU. The Trustzone project still work but then i can't use those 2 script to run the SBSFU-TrustZone project because the HDP2EN no egal to 0. I try to modify this option byte directly with STM32cubeProgrammer, it dosen't work. then i search the user manul and know that i need to modify the registe FLASH_SECWM2R2 and FLASH_SECHDPCR to reset the HDP2EN.I add this 2 line into my TrustZone project and place it in the main.c(GPIO_IOToggle_TrustZone_Secure/Application/User/main.c) but after i lauch the program, the HDP2EN is still egal to 1.So how can i reset the HDP2EN by setting these 2 registes?Thanks in advance.

I have updated the startup scripts from the MOOC to work with the stm32l152re. However, when I build the user app and flash it onto the MCU I only get the text from the SBSFU in the terminal. It automatically wants to receive a new user firmware:= [SBOOT] System Security Check successfully passed. Starting...     ====================================================================== = (C) COPYRIGHT 2017 STMicroelectronics = = = = Secure Boot and Secure Firmware Update = ======================================================================     = [SBOOT] SECURE ENGINE INITIALIZATION SUCCESSFUL = [SBOOT] STATE: CHECK STATUS ON RESET INFO: A Reboot has been triggered by a Hardware reset! INFO: Last execution detected error was: No error. Success. = [SBOOT] STATE: CHECK NEW FIRMWARE TO DOWNLOAD = [SBOOT] STATE: DOWNLOAD NEW USER FIRMWARE File> Transfer> YMODEM> Send ........................................I've built the application in the order that was sugg

[9568] Failed to execute script prepareimageTraceback (most recent call last): File "prepareimage.py", line 861, in <module> File "prepareimage.py", line 858, in args File "prepareimage.py", line 124, in do_encrypt File "keys.py", line 262, in loadFileNotFoundError: [Errno 2] No such file or directory: '../../../../2_Images_SECoreBin/SW4STM32/../Binary/OEM_KEY_COMPANY1_key_AES_CBC.bin'../../../../2_Images_SECoreBin/SW4STM32/postbuild.sh: line 70: prepareimage.exe: No errorprepareimage.exe enc -k ../../../../2_Images_SECoreBin/SW4STM32/../Binary/OEM_KEY_COMPANY1_key_AES_CBC.bin -i ../../../../2_Images_SECoreBin/SW4STM32/../Binary/iv.bin ../../UserApp.bin ../../../Binary/UserApp.sfu : failedmake[1]: *** [makefile:97: post-build] Error 1make: *** [makefile:63: all] Error 2"make -j8 all" terminated with exit code 2. Build might be incomplete.Im not sure what the issue is- I haven't modified any of the code- just tried to rebuild the project using STM32CubeIDE

Hi all, I am trying to make an own private key on the SBSFU, if anyone has succeeded in this could you pass me the steps which I have to proceed with. I went through An5056, then I tried to change ECCkey1 but in some cases. it works and it is upgrading with the previous key generated firmware without any issues. in general, this cannot happen. it should reject while installing since it has 2 different keys. So can anyone tell me where I have gone wrong?

Hello,I want to integrate a secure boot and secure software update (SBSFU) on a nucleo H753ZI board.I downloaded the software from https://www.st.com/en/embedded-software/x-cube-sbsfu.html and followed the steps to compile the three programs (SECore, SBSFU and UserApp) proposed in the "projects" folder using the 1-image version of the SBSFU.The next step was to program the SBSFU application on the board which I tried to do using STM32CubeProgrammer. However, the program has not been completely installed. The first image below shows the device memory after the introduction of the application and the second image shows what should have been programmed. You can observe that the code abruptly stops after the address 0x08000100 while it should continue. I suspect that something went wrong when I prepared the board and that the region after 0x08000100 has been mistakenly let as an area protected against writing.My problem is that since this incomplete code has been inserted inside the b

..