STM32 MCUs Security

I am currently working on an STM32 TrustZone project and trying to implement the following flow:NonSecure world running↓Calls Secure_add()↓Secure world executes↓Returns value 8↓UART prints the result in NonSecure worldHowever, I am facing an issue while jumping from the NonSecure world to the Secure world. The expected secure function execution is not happening properly.If anyone has faced a similar issue or has suggestions regarding NSC gateway configuration, linker settings, or TrustZone function calls, please share your insights.  this much i am getting the outCMSE_NS_ENTRY uint32_t Secure_add(uint32_t a, uint32_t b){return a + b;}    ------------------------ My Nsc.c entry logic  for(int i = 0; i < 5; i++){printf("NONSECURE WORLD RUNNING\r\n");printf("I am amritha\r\n"); //for(volatile int d=0; d<500000; d++);}uint32_t result;printf("Before Secure_add\r\n");result = Secure_add(5,3);printf("Before Secure_add\r\n");printf("Secure result = %lu\r\n",

Hello STM32 Community,I am stuck in a critical situation with my STM32H533RE custom board and need help recovering it. I have exhausted all methods I know.- Hardware Setup:    - MCU: STM32H533RE (custom PCB, not Nucleo)    - ST-LINK: External ST-LINK V2 (Firmware V2J46S7)    - BOOT0: carry out the cia test point    - USB: DP/DM routed to test points (wires soldered for access)    - SWD: SWCLK , SWDIO , NRST (Pin 2) connected to programming header- TrustZone Configuration    - Configured Secure and Non-Secure world using STM32CubeMX    - Secure peripherals: SPI1, SPI3, UART4, ICache, DCache    - Flash watermarks configured for secure/non-secure regions- What Happened (Step by Step)    1. Device was originally in **Open state (0xED)** — everything worked fine    2. I could connect via SWD in Normal mode and read all memory including secure regions    3. I attempted to transition

According to the manual, I cannot determine under what conditions the INFIFO will assert the interrupt. The interrupt-related registers only provide two status flags: empty and not full. The IN FIFO has a depth of 8 words (8×32 bits). However, the later description states that the interrupt will be asserted when there are fewer than 4 words in the IN FIFO. How is this interrupt actually generated?

Hello,I have managed to lock a couple of Nucleo H503 boards and, while they are not very expensive, I would like to try and understand the problem so we can avoid it on production boards.Although I have been experimenting with setting security options (to provisioning and closed, with a password), I don't think the problem is with security as the programmer Discovery mode is unable to even detect the device.My code checks the security setting and changes it if not closed, so would normally only run on the first pass.First, it checks if the password data is in the OTP memory and if not, writes it and locks the block. Since reading unwritten OTP memory causes a bus fault, I use the block lock bit setting as an indication that the OTP has been written.I then compare the OTP data with the expected values and, if correct, set the state to Provisioning then Closed.I have stumbled across a few things that seem to help or cause problems during this process:The password data is 32 bytes but I p

Hello,I am interested in the optional decryption sequence part of secure boot on STM32N6 mcu. As described in UM3234 (How to proceed with boot ROM on STM32N6 MCUs) a key derivation function is used to produce an encryption key. However I am not sure how the Enc/Dec Master Key is produced, as in the OTP mapping table (RM0486: STM32N6 Reference Manual) only an EDMK derivation constant is present. Am I correct to assume that this OTP168 word is used to derive the EDMK out of OEM secret (OTP 364-367)? If so, what's the algorithm? Additionally, what's the derivation constant used in ROM that's mentioned in the diagram? Is it publicly available?Thanks,kradzphsys

Hi,I'm using two STM32WLE5 LoRa as TX and RX and added AES-ECB Encryption with Hardware Accelerator in the TX side and receive and decrypt it in RX side with the same Key. Now I want to change the TX module and want to implement same logic of AES Encryption in the TX side. Is there any documentation on how that can be implemented in the C/Python code for sending the same data with different module? I have used PyCryptodome Python library for sending the data with encryption but it didn't work as expected. So, Is there any other library or documentation for implementing Encryption by which Receiver can be able to decrypt as before?Configuration of AES in Both TX and RX sidesAny insights or guidance would be greatly appreciated.Thanks in Advance. 

Hi, I’m working with the STM32H7S7L86H and using the SAES peripheral to encrypt and decrypt data stored in an SPI flash .I currently have the peripheral working correctly using HAL functions in polling mode. I also managed to get it working with interrupt mode, including proper input/output callbacks.However, I would like to use DMA to offload the CPU, but I haven’t been able to find any HAL-based examples for SAES with DMA. When I try to use DMA, the transfer does not seem to complete and no callback is triggered.Could you help me understand how to properly configure SAES with DMA using HAL, or point me to a working example?void HAL_CRYP_MspInit(CRYP_HandleTypeDef* hcryp){ if(hcryp->Instance==SAES) { /* USER CODE BEGIN SAES_MspInit 0 */ /* USER CODE END SAES_MspInit 0 */ /* Peripheral clock enable */ __HAL_RCC_SAES_CLK_ENABLE(); /* SAES DMA Init */ /* GPDMA1_REQUEST_SAES_OUT Init */ handle_GPDMA1_Channel13.Instance = GPDMA1_Channel13; handle_GPDMA1_Channel13.Init.Request = GPDMA1_R

Hi, I have an STM32H7S78-DK board and am working on encryption. I’ve looked at the example files for STiROT_OEMuROT: https://github.com/STMicroelectronics/STM32CubeH7RS/tree/main/Projects/STM32H7S78 -DK/ROT_Provisioning/STiROT_OEMuROTI’ve tried that out, and now I’d like to generate my own keys, but what I’m missing are the OEMuROT_Data.obk and STiROT_Data. obk files. I can generate the OEMuROT_Config.obk and STiROT_Config.obk files with their corresponding XML files using STM32TrustedPackageCreator_CLI, but how do I generate the _Data. obk files? They don’t have any config files, and I can’t find anything online either. The batch script uses them, though, as you can see here: https://github.com/STMicroelectronics/STM32CubeH7RS/blob/main/Projects/STM32H7S78-DK/ROT_Provisioning/STiROT_OEMuROT/obkey_provisioning.batPlease help – do I need them? If so, how are they generated and where can I find the corresponding .xml file?

I am implementing a secure boot process on the STM32H723. My application has three firmware components with the following memory layout:1. BOOT: Located in internal Flash.2. OS: Located in internal Flash.3. USER: Located in external SDRAM.The required boot and runtime behavior is:1. Upon power-on, the BOOT code must read and perform a full verification (e.g., checksum, hash) of the entire OS image from internal Flash.2. After verification, the BOOT jumps to the OS.3. The OS provides a runtime environment for the USER application. The OS and USER application need to interact bidirectionally (e.g., call each other's functions).Core Security Requirement:The USER application (running in SDRAM) must be prevented from reading the code of both the BOOT and the OS from internal Flash. The OS code should be executable but not readable.Question / Request for Clarification:The PCROP (Proprietary Code Read Protection) feature seems designed for "execute-only" protection. However, a conflict exists

In STM32Cube_FW_H7RS_V1.3.0, file Projects\STM32H7S78-DK\Applications\ROT\OEMiROT_Boot\Inc\stm32_extmem_conf.h:The configuration for the external RAM (presumably for an APS256XXN-OBR-BG, since that's what on the DK) is incorrect. In particular, it doesn't set the latency values to be able to run at 200 MHz.(I think that the dummy cycle values may also be wrong - but I suspect they're ignored anyway.)Here's my code (I also changed the drive strength, but that may not be necessary). Without these changes, the RAM could be read, but not written: .PsramObject = { .psram_public = { .MemorySize = HAL_XSPI_SIZE_256MB, /* memory size is 256Mbit */ .FreqMax = 200000000u, /* 200Mhz */ .NumberOfConfig = 3, /* Config */ { #define EXTRAM_MR0_READ_LATENCY_MASK (0x7 << 2) #define EXTRAM_MR0_DRIVE_STRENGTH_HALF (0x1 << 0) #define EXTRAM_MR0_READ_LATENCY_200_MHz (0x4 << 2) #define EXTRAM_MR0_DRIVE_STRENGTH_MASK (0x3 << 0) #define EXTRAM_MR4_WRITE_LATENCY_MASK (0

I have an application that uses the OCTOSPI1 interface to read from and write to an external NOR flash memory into an SRAM1 buffer. The read and write operations are performed in the NS section of the application. If I perform a transfer without using DMA, it works. However, if I try to use GPDMA1, I get a buffer with all data set to 0, with no error.Additional information: the application works very well with GPDMA1 if I disable the MCU’s TrustZone mode.I conclude that GPDMA is not fully initialized to work with TrustZone enabled, but I can’t figure out what’s missing despite my searches on this forum.Any help would be greatly appreciated.

Hello,After spending several days investigating this topic and reviewing all the documentation I could find, I am still completely stuck on how to proceed with implementing STiROT + OEMuROT on my STM32H7S3.An important point is that I am trying to add this security architecture to a project that is already at a fairly advanced stage of development. The project was originally built on top of the XIP template provided by ST:https://github.com/STMicroelectronics/STM32CubeH7RS/tree/main/Projects/NUCLEO-H7S3L8/Templates/Template_XIP The difficulty comes from the fact that, in the XIP context, the project only includes these layers:AppliBootExtMemLoaderAs a first step, I imported ROT_Provisioning into the project in a separate folder. However, I still do not see how I should properly integrate or adapt the following components into my current project structure:OEMiROT_AppliOEMiROT_BootSTiROT_AppliSTiROT_BootShould I try to merge the `*_Appli` projects into my existing Appli context, and

Hi!My application requires NIST-compliant random number generation, and I see some unclear/contradicting info on the Reference Manual, the AN4230 application note, and the public NIST certificate. My MCU is STM32H563ZI.- Reference Manual: https://www.st.com/resource/en/reference_manual/rm0481-stm32h52333xx-stm32h56263xx-and-stm32h573xx-armbased-32bit-mcus-stmicroelectronics.pdf- AN4230: https://www.st.com/resource/en/application_note/an4230-introduction-to-random-number-generation-validation-using-the-nist-statistical-test-suite-for-stm32-mcus-and-mpus-stmicroelectronics.pdf- Public NIST certificate E163: https://csrc.nist.gov/CSRC/media/projects/cryptographic-module-validation-program/documents/entropy/E163_PublicUse.pdf Confusing/contradicting info:- E163 gives a RNG_CR of 0x08F01EXX, but AN4230 says value should be 0x00F01E00 (note difference in bit 27). Also, manual says bit 27 "must be kept at reset value.".- Reset values on the manual do not match my

HiI have STM32H563 Nucleo board which is in closed state with DA_Config.obk not programmed, And the trust zone disabled. This was done by mistake, Is there a way to do regression on it.Operations Done on the device.1.Done the regression2.Set the product state to provisioning3.Programmed OEMiRoT_Config.obk4.Set the device to closed state.Logs from ST32Cube programmer on DA Discovery10:40:20 : STM32CubeProgrammer API v2.19.0 | Windows-64Bits10:44:38 : Start Debug Authentication Sequence10:44:38 : SDMOpen : 624 : open : SDM API v1.010:44:38 : SDMOpen : 625 : open : SDM Library version v1.2.010:44:38 : open_comms : 513 : open : Asserting target reset10:44:38 : open_comms : 517 : open : Writing magic number10:44:38 : open_comms : 537 : open : De-asserting target reset10:44:38 : open_comms : 584 : open : Communication with the target established successfully10:44:38 : discovery: target ID.......................:0x48410:44:38 : discovery: SoC ID..........................:0x0000

 Now that that the CRA dates are near, why is there isn't a forum for regulatory compliance and CRA specific questions ?For example, which products STM offers now will not be CRA compliant ? This is important as those products would have to be revised or removed from the market.For example an STM32F072 would still meet requirement 1. as the main controller of the product with our without an RF/network connection (via UART/I2C etc..)  or 2. as a peripheral  connected to the main MPU (indirect) which connects with LAN or WIFI to outside world     

On an STM32H563, I am trying to write the OBkey1 data.I have successfully set the product state to provisioning (0x17) with: FLASH_OBProgramInitTypeDef optionBytes; HAL_FLASHEx_OBGetConfig(&optionBytes); HAL_FLASH_Unlock(); HAL_FLASH_OB_Unlock(); optionBytes.OptionType = OPTIONBYTE_PROD_STATE; optionBytes.ProductState = OB_PROD_STATE_PROVISIONING; HAL_FLASHEx_OBProgram(&optionBytes); HAL_FLASH_OB_Launch(); HAL_FLASH_OB_Lock();Now, when I try to write too OBKey1 with: uint32_t dataAddr = 0x20050000; memcpy ((void*)dataAddr, source, 0x60); RSSLIB_DataProvisioningConf_t * pConfig = (RSSLIB_DataProvisioningConf_t *)0x20050100; pConfig->pSource = (uint32_t*)dataAddr; pConfig->pDestination = (uint32_t*)0xffd0100; pConfig->Size = 0x60; pConfig->DoEncryption = 0xCACA0AA0U; pConfig->Crc = 0; HAL_FLASHEx_OBK_Unlock(); provisioningResult = RSSLIB_PFUNC->NSC.DataProvisioning(pConfig); HAL_FLASHEx_OBK_Lock();The call to DataProvisioning() causes

Hi everyone,I’m using the B‑U585I‑IOT02A development board for an IoT project. The onboard STSAFE‑A110 secure element comes pre‑provisioned with a default key and certificate, but for my application I need to:Provision my own keypair and certificate, andOptionally add additional keys or certificates into unused STSAFE slots (for testing or multi‑cloud use).I couldn’t find a clear step‑by‑step guide for:Generating and injecting a custom keypairUploading a custom certificate chainAdding extra keys/certificates to new STSAFE slotsWhether CubeProgrammer or Secure Manager scripts support provisioning user keysIs there any official documentation, example project, or provisioning tool that explains how to do this on the B‑U585I‑IOT02A?Any guidance or links would be greatly appreciated.Thank you!

Hello together,I search for a solution to put calibration data in a NS area.Background Information:we are using STM35H573 with STM secure manager.we use an ethernet Rest API to update Application including request install and so onNow I want to use the same Rest API to update configuration data. The BIN file shall be signed like a normal application. The behavior should be more or less the same: Restart µC, SM checks validity; app will be started,...I have read um3254 but I do not understand the section with large profile.I have read something about ITS, but I think this is not the solution I need. The calibration data must not be stored in the trusted area. They shall only validated bei the SM during update or startup. Thanks for joining this topic. Br Sebastian 

Hi,I added some follow-up questions to a message but I'm not sure if anyone will notice as I had already clicked "Accepted Solution" :-https://community.st.com/t5/stm32-mcus-security/stm32h5-simple-security-settings/m-p/885235/thread-id/9530#M9531Copying the questions regarding setting H5 security to be more like G4 RDP setting.1) Since the regression to open performs a full chips erase, am I right in thinking that we can use a common and not secure password? i.e. Revealing the password does not allow access to the firmware.2) Can I perform all of the steps listed, from my bootloader firmware? As far as I can see, the changes to product state just require a write to write to an option byte. I have yet to find the part of the reference manual that describes how to write the password file but looking through the scripts in the git repo mentioned seems to suggest that something is written to "address_password=0x8FFF000". (Just noticed - that address looks like H503 only, and for the H563

Hi,I have a question about choosing some fairly basic security settings for an STM32H5.We are developing a system that uses both G4 and H5 micros. We have developed a largely common bootloader that receives a signed encrypted application over variously USB, UART, or CAN, and flashes it to internal memory. This is working on the G4 and H5.For the G4, we understand that if we select "Level 1" read protection, the bootloader will still be able to erase and re-flash a new application but a user will not be able to gain access to the code (bootloader, application, or data in CC RAM). Further, the G4 can be reverted to Level 0 if required, but this will erase the proprietary code.Ideally, we would like the same security behaviour on the H5. I have been reading about the bewildering selection of security settings with privileged and secure settings for individual peripherals but I feel this is more complicated than we require. Our bootloader already prevents someone installing malicious code

Typical bootloaders (including some of ST's built-in bootloaders for other processors) typically allow a code image to be loaded into the processor via some kind of serial link (UART, SPI, CAN, etc), without needing an ST-Link or other debug hardware. These make bootloaders ideal for in-field upgrades of products.OEMiROT/OEMuROT has some features of a bootloader, in that a new image can be placed in a special area of flash and (if it passes all the various checks) then be executed.However, there is no way of actually putting that image in flash without an ST-Link or similar, since this is needed to unlock the chip via the DA process. So if you want to do an in-field upgrade of your product's firmware without any debug hardware, OEMiROT in its current form isn't the solution.Our approach is for our application to download the image into a reserved area of RAM and then switch to the bootloader, where our adapted version of OEMiROT copies this image from RAM to the special area of flash.

Hello Team,We have faced the Firmware ( hex file ) theft by Reverse engineering , Our competitor 2 Times. Yes, Two times , while RDP1 is set. We do not have contarct Manufacture in our whole process.Even Reading / Comparing intertlock of 96 bit UID failed.MCU is STM32F303.Can any one suggest a very high Strong Method which ensue complete guarantee for Firmware Protection from any threats. ?It seems STM32 is so famous that , its weak-leak point also Known.Getting Assembly / might be "C" code from Hex file looks Staright forward to crackers.

Hi, I'm building a medical device that will use an STM32 MCU and requires secure boot and secure firmware updates (over USB-C preferably). I have little experience with implementing secure bootloaders, and am looking for a solution that could allow me to get secure boot working out-of-the-box with minimal setup. I've seen that SBSFU offers example projects for secure boot on some MCUs, while MCUboot is also available for some others. It also looks like the STM32U5 series supports their own secure firmware updates based on AN4992. What's the difference between all of these solutions? Out of all the solutions ST offers for secure boot, which ones are the newest/recommended and easiest to get set up with? Because I'm looking for a low-cost MCU, I've identified the STM32L471, STM32L476, and STM32U575 as potential candidates that could support secure boot, but I'm lost as to how to actually set it up or what software solution to use. I'd love to hear anyone else's suggestions for other MCUs

In STM32Cube_FW_H7RS_V1.3.0, file Projects/STM32H7S78-DK/Applications/ROT/OEMiROT_Boot/Inc/flash_layout.h:The macro OEMIROT_LOAD_AND_RUN has 3 possible settings, and we're using the NO_LOAD_AND_RUN to execute code (in external flash) in place.However, we're also using external RAM in our application, and this must be enabled in the bootloader, as the app attempts to initialise values in external RAM at startup.Unfortunately, the external RAM is only initialised if you select LOAD_AND_RUN_EXT_RAM.There is a workaround: in boot_hal.c and low_level_ext_ram.c, replace every instance (3 in each file) of:#if (OEMIROT_LOAD_AND_RUN == LOAD_AND_RUN_EXT_RAM)...with something like:#if 1// (OEMIROT_LOAD_AND_RUN == LOAD_AND_RUN_EXT_RAM)For the future, would you consider having an option to run in place and enable external RAM?Thank you.  

In OEMiROT_Boot/Src/low_level_ext_flash.c, function Ext_Flash_EraseSector(),  a call is made to EXTMEM_MemoryMappedMode() immediately before the sector erase takes place, to temporarily disable memory-mapped mode for the external flash, with the function called again afterwards to re-enable it.As @ken5 reported previously, we found that these flash erases can cause corruption in the external RAM.After a lot of experimentation and head-scratching, we've found that if the external RAM is also removed from the memory map before a flash erase, and re-enabled afterwards, these corruption issues appears to go away (pending further testing).I'm guessing that this wasn't spotted in ST's testing because OEMiROT doesn't use the external RAM until later (if at all), so any corruption doesn't matter. However, our adapted OEMiROT does use the external RAM, and the data corruption was a serious problem.(Incidentally, we saw occasional corruption in the external fla