STM32 MCUs Security

I am trying to understand SMiRoT and SMuRoT for product development based on the STM32H573 and Secure Manager, but from the public documentation they both look mostly like black boxes.Since they seem to be built on top of STiRoT / STuRoT, I am currently trying to understand STuRoT first.For STiRoT, AN6007 Appendix A / Figure 11 is very useful because it provides a clear high-level startup sequence.It helps explain the logic of reset, runtime protection activation, secure firmware update handling, uRoT image verification, bootloader fallback, and jump to uRoT.But for STuRoT, I cannot find any equivalent public document that shows its internal startup sequence or high-level state flow.At the moment I can only infer that after STiRoT verification, STuRoT runs in HDPL2 secure mode, reconfigures its secure context/MPU, verifies the user application, and then executes it. But I have not found an official flowchart or sequence description.So I would lik

Hello, I am working with the STM32H745 using a Lauterbach TRACE32 debugger and i am evaluating ways to control Readout Protection (RDP). I am able to configure RDP levels using STM32CubeProgrammer, however I would like to achieve the same using a TRACE32 (.cmm) script, without relying on the ST programmer. Is there any recommended or reference TRACE32 PRACTICE (.cmm) script for setting and reverting RDP levels (Level‑0 to Level‑1) and (Level‑1 to Level‑0) on STM32H7 devices? I could not find any official examples demonstrating direct RDP control using .cmm script. Is it supported or recommended to control RDP level changes from firmware on STM32H745? While setting RDP from Level‑0 to Level‑1 is possible, reverting from Level‑1 to Level‑0 results in a mass erase. When reverting RDP from Level‑1 to Level‑0, is the mass erase automatically triggered by the hardware as part of the RDP regression, or is there an additional register or command that must be explicitly programmed t

Hi,I am trying to create a trustzone application for my board, but suddenly I could no longer flash to non-secure memory. Secure memory flashing still works fine. What am I doing incorrectly?Thank you in advance,Michalthe failing flash (fails even if I flash template trustzone project from CubeIDE)PS C:\Users\test> STM32_Programmer_CLI.exe -c port=SWD mode=HotPlug -d test16.bin 0x08020000 -v ------------------------------------------------------------------- STM32CubeProgrammer v2.22.0 ------------------------------------------------------------------- ST-LINK SN : " ST-LINK FW : V2J47S7 Board : -- Voltage : 3.28V SWD freq : 4000 KHz Connect mode: Hot Plug Reset mode : Software reset Device ID : 0x455 Revision ID : Rev Y Device name : STM32U535/STM32U545 NVM size : 256 KBytes Device type : MCU Device CPU : Cortex-M33 BL Version : -- Debug in Low Power mode enabled ------------------------------------------------------------------- Choose flashing speed for Cortex M33 series.(

Hello. I am trying to encrypt/decrypt data in secure area of stm32h563 (Trustzone application), using code from one of the examples (using  cmox_cipher_encrypt function). Running the function in non-secure area, everything works fine. Trying to run that in secure area immediatly hardfaults. It seems like problem might be that the library tries to access something in the non secure area. Initial thought was CRC engine, but in cubemx i specificly initialized that to secure area because it will be used in there. Is there some known workaround or updated libraries to use cmox_cipher_encrypt in secure area?

Hello everyone.I'm novice in cryptografic,I'm developing a project with STM32H7.I have a file on uSD and I can read it using FatFs.I have to crypto this file using CRYP_AES_GCM.I setup IOC in this wayThe IOC build this file for meMy file has 98MByte of size but I cannot fit the whole size in a Heap Buffer because free space in Heap is 60KByte but I can prefer to reserve at least 32KByte to have some space available for other c++ objects.So I develop a code that reads 32KByte-chunks from the source file and crypto this chunk before to write in the crypted file.But I have a dubt: to crypt this chunk of file I call HAL_CRYP_Encrypt(&hcryp, (uint32_t*)ptr, (byteRead+3)/4, (uint32_t*)ptr, 1000UL);But if I inspect this API I notice that it resets some sort o f counter So I think that I'm wrong because probably I have to not reset this counter and, instead, put the next chunk to the crypt. Is my doubt a certainty ? And there is a way to check, once the file i

Hello everyone!I’ve been struggling for a while with TrustZone projects on the NUCLEO-U575ZI-Q. I’ve tried both the STM32CubeU5 example projects (Templates/TrustZoneEnabled/ and Examples/GPIO/GPIO_IOToggle_TrustZone/) and my own CubeMX-generated project, but I can’t get any of them to run successfully. I'm using STM32CubeIDE.I've tried running the example projects, this is the error I get when building:make: *** No rule to make target '/home/Drivers/STM32U5xx_HAL_Driver/Src/stm32u5xx_hal.c', needed by 'Drivers/STM32U5xx_HAL_Driver/stm32u5xx_hal.o'. Stop.I've set the Option bytes correctly, Secure Area 2 is set to NonSecure and TZEN bit is set to 1.I've also generated a project with CubeMX:Enabled TrustZone, applied Application Regions Settings to Linker files/Peripherals.When the non-secure world calls NonSecure_ResetHandler(), I get a HardFault at address 0x08100d81.Questions:How can I fix the Makefile error in the GitHub examples?Why would calling NonSecure_ResetHandler() from a Cube

I'm recently working on benchmarking a various implementations and configurations of cryptographic algorithms such AES-GCM on STM32. Two of these tested function are the following :void test_aes_hardware(void) { uint32_t plaintext[DATA_SIZE/4]; uint32_t ciphertext[DATA_SIZE/4]; uint32_t decrypted[DATA_SIZE/4]; uint8_t key_bytes[32]; uint8_t iv_bytes[16]; uint32_t key[8]; uint32_t iv[4]; uint8_t ikm[4]; uint8_t salt[4]; uint8_t info1[] = "HW_AES_KEY"; uint8_t info2[] = "HW_AES_IV"; uint32_t rnd; /* RNG */ HAL_RNG_GenerateRandomNumber(&hrng, &rnd); memcpy(ikm, &rnd, 4); HAL_RNG_GenerateRandomNumber(&hrng, &rnd); memcpy(salt, &rnd, 4); /* KDF */ xkdfBlake(key_bytes, 32, ikm, 4, salt, 4, info1, sizeof(info1)); xkdfBlake(iv_bytes, 16, ikm, 4, salt, 4, info2, sizeof(info2)); memcpy(key, key_bytes, 32); memcpy(iv, iv_bytes, 16); for (int i = 0; i < DATA_SIZE / 4; i++) { uint32_t w = (i*4 + 1) |((i*4 + 2) << 8) |((i*4 +

I am currently working on an STM32 TrustZone project and trying to implement the following flow:NonSecure world running↓Calls Secure_add()↓Secure world executes↓Returns value 8↓UART prints the result in NonSecure worldHowever, I am facing an issue while jumping from the NonSecure world to the Secure world. The expected secure function execution is not happening properly.If anyone has faced a similar issue or has suggestions regarding NSC gateway configuration, linker settings, or TrustZone function calls, please share your insights.  this much i am getting the outCMSE_NS_ENTRY uint32_t Secure_add(uint32_t a, uint32_t b){return a + b;}    ------------------------ My Nsc.c entry logic  for(int i = 0; i < 5; i++){printf("NONSECURE WORLD RUNNING\r\n");printf("I am amritha\r\n"); //for(volatile int d=0; d<500000; d++);}uint32_t result;printf("Before Secure_add\r\n");result = Secure_add(5,3);printf("Before Secure_add\r\n");printf("Secure result = %lu\r\n",

Hello STM32 Community,I am stuck in a critical situation with my STM32H533RE custom board and need help recovering it. I have exhausted all methods I know.- Hardware Setup:    - MCU: STM32H533RE (custom PCB, not Nucleo)    - ST-LINK: External ST-LINK V2 (Firmware V2J46S7)    - BOOT0: carry out the cia test point    - USB: DP/DM routed to test points (wires soldered for access)    - SWD: SWCLK , SWDIO , NRST (Pin 2) connected to programming header- TrustZone Configuration    - Configured Secure and Non-Secure world using STM32CubeMX    - Secure peripherals: SPI1, SPI3, UART4, ICache, DCache    - Flash watermarks configured for secure/non-secure regions- What Happened (Step by Step)    1. Device was originally in **Open state (0xED)** — everything worked fine    2. I could connect via SWD in Normal mode and read all memory including secure regions    3. I attempted to transition

According to the manual, I cannot determine under what conditions the INFIFO will assert the interrupt. The interrupt-related registers only provide two status flags: empty and not full. The IN FIFO has a depth of 8 words (8×32 bits). However, the later description states that the interrupt will be asserted when there are fewer than 4 words in the IN FIFO. How is this interrupt actually generated?

Hello,I have managed to lock a couple of Nucleo H503 boards and, while they are not very expensive, I would like to try and understand the problem so we can avoid it on production boards.Although I have been experimenting with setting security options (to provisioning and closed, with a password), I don't think the problem is with security as the programmer Discovery mode is unable to even detect the device.My code checks the security setting and changes it if not closed, so would normally only run on the first pass.First, it checks if the password data is in the OTP memory and if not, writes it and locks the block. Since reading unwritten OTP memory causes a bus fault, I use the block lock bit setting as an indication that the OTP has been written.I then compare the OTP data with the expected values and, if correct, set the state to Provisioning then Closed.I have stumbled across a few things that seem to help or cause problems during this process:The password data is 32 bytes but I p

Hello,I am interested in the optional decryption sequence part of secure boot on STM32N6 mcu. As described in UM3234 (How to proceed with boot ROM on STM32N6 MCUs) a key derivation function is used to produce an encryption key. However I am not sure how the Enc/Dec Master Key is produced, as in the OTP mapping table (RM0486: STM32N6 Reference Manual) only an EDMK derivation constant is present. Am I correct to assume that this OTP168 word is used to derive the EDMK out of OEM secret (OTP 364-367)? If so, what's the algorithm? Additionally, what's the derivation constant used in ROM that's mentioned in the diagram? Is it publicly available?Thanks,kradzphsys

Hi,I'm using two STM32WLE5 LoRa as TX and RX and added AES-ECB Encryption with Hardware Accelerator in the TX side and receive and decrypt it in RX side with the same Key. Now I want to change the TX module and want to implement same logic of AES Encryption in the TX side. Is there any documentation on how that can be implemented in the C/Python code for sending the same data with different module? I have used PyCryptodome Python library for sending the data with encryption but it didn't work as expected. So, Is there any other library or documentation for implementing Encryption by which Receiver can be able to decrypt as before?Configuration of AES in Both TX and RX sidesAny insights or guidance would be greatly appreciated.Thanks in Advance. 

Hi, I’m working with the STM32H7S7L86H and using the SAES peripheral to encrypt and decrypt data stored in an SPI flash .I currently have the peripheral working correctly using HAL functions in polling mode. I also managed to get it working with interrupt mode, including proper input/output callbacks.However, I would like to use DMA to offload the CPU, but I haven’t been able to find any HAL-based examples for SAES with DMA. When I try to use DMA, the transfer does not seem to complete and no callback is triggered.Could you help me understand how to properly configure SAES with DMA using HAL, or point me to a working example?void HAL_CRYP_MspInit(CRYP_HandleTypeDef* hcryp){ if(hcryp->Instance==SAES) { /* USER CODE BEGIN SAES_MspInit 0 */ /* USER CODE END SAES_MspInit 0 */ /* Peripheral clock enable */ __HAL_RCC_SAES_CLK_ENABLE(); /* SAES DMA Init */ /* GPDMA1_REQUEST_SAES_OUT Init */ handle_GPDMA1_Channel13.Instance = GPDMA1_Channel13; handle_GPDMA1_Channel13.Init.Request = GPDMA1_R

Hi, I have an STM32H7S78-DK board and am working on encryption. I’ve looked at the example files for STiROT_OEMuROT: https://github.com/STMicroelectronics/STM32CubeH7RS/tree/main/Projects/STM32H7S78 -DK/ROT_Provisioning/STiROT_OEMuROTI’ve tried that out, and now I’d like to generate my own keys, but what I’m missing are the OEMuROT_Data.obk and STiROT_Data. obk files. I can generate the OEMuROT_Config.obk and STiROT_Config.obk files with their corresponding XML files using STM32TrustedPackageCreator_CLI, but how do I generate the _Data. obk files? They don’t have any config files, and I can’t find anything online either. The batch script uses them, though, as you can see here: https://github.com/STMicroelectronics/STM32CubeH7RS/blob/main/Projects/STM32H7S78-DK/ROT_Provisioning/STiROT_OEMuROT/obkey_provisioning.batPlease help – do I need them? If so, how are they generated and where can I find the corresponding .xml file?

I am implementing a secure boot process on the STM32H723. My application has three firmware components with the following memory layout:1. BOOT: Located in internal Flash.2. OS: Located in internal Flash.3. USER: Located in external SDRAM.The required boot and runtime behavior is:1. Upon power-on, the BOOT code must read and perform a full verification (e.g., checksum, hash) of the entire OS image from internal Flash.2. After verification, the BOOT jumps to the OS.3. The OS provides a runtime environment for the USER application. The OS and USER application need to interact bidirectionally (e.g., call each other's functions).Core Security Requirement:The USER application (running in SDRAM) must be prevented from reading the code of both the BOOT and the OS from internal Flash. The OS code should be executable but not readable.Question / Request for Clarification:The PCROP (Proprietary Code Read Protection) feature seems designed for "execute-only" protection. However, a conflict exists

In STM32Cube_FW_H7RS_V1.3.0, file Projects\STM32H7S78-DK\Applications\ROT\OEMiROT_Boot\Inc\stm32_extmem_conf.h:The configuration for the external RAM (presumably for an APS256XXN-OBR-BG, since that's what on the DK) is incorrect. In particular, it doesn't set the latency values to be able to run at 200 MHz.(I think that the dummy cycle values may also be wrong - but I suspect they're ignored anyway.)Here's my code (I also changed the drive strength, but that may not be necessary). Without these changes, the RAM could be read, but not written: .PsramObject = { .psram_public = { .MemorySize = HAL_XSPI_SIZE_256MB, /* memory size is 256Mbit */ .FreqMax = 200000000u, /* 200Mhz */ .NumberOfConfig = 3, /* Config */ { #define EXTRAM_MR0_READ_LATENCY_MASK (0x7 << 2) #define EXTRAM_MR0_DRIVE_STRENGTH_HALF (0x1 << 0) #define EXTRAM_MR0_READ_LATENCY_200_MHz (0x4 << 2) #define EXTRAM_MR0_DRIVE_STRENGTH_MASK (0x3 << 0) #define EXTRAM_MR4_WRITE_LATENCY_MASK (0

I have an application that uses the OCTOSPI1 interface to read from and write to an external NOR flash memory into an SRAM1 buffer. The read and write operations are performed in the NS section of the application. If I perform a transfer without using DMA, it works. However, if I try to use GPDMA1, I get a buffer with all data set to 0, with no error.Additional information: the application works very well with GPDMA1 if I disable the MCU’s TrustZone mode.I conclude that GPDMA is not fully initialized to work with TrustZone enabled, but I can’t figure out what’s missing despite my searches on this forum.Any help would be greatly appreciated.

Hello,After spending several days investigating this topic and reviewing all the documentation I could find, I am still completely stuck on how to proceed with implementing STiROT + OEMuROT on my STM32H7S3.An important point is that I am trying to add this security architecture to a project that is already at a fairly advanced stage of development. The project was originally built on top of the XIP template provided by ST:https://github.com/STMicroelectronics/STM32CubeH7RS/tree/main/Projects/NUCLEO-H7S3L8/Templates/Template_XIP The difficulty comes from the fact that, in the XIP context, the project only includes these layers:AppliBootExtMemLoaderAs a first step, I imported ROT_Provisioning into the project in a separate folder. However, I still do not see how I should properly integrate or adapt the following components into my current project structure:OEMiROT_AppliOEMiROT_BootSTiROT_AppliSTiROT_BootShould I try to merge the `*_Appli` projects into my existing Appli context, and

Hi!My application requires NIST-compliant random number generation, and I see some unclear/contradicting info on the Reference Manual, the AN4230 application note, and the public NIST certificate. My MCU is STM32H563ZI.- Reference Manual: https://www.st.com/resource/en/reference_manual/rm0481-stm32h52333xx-stm32h56263xx-and-stm32h573xx-armbased-32bit-mcus-stmicroelectronics.pdf- AN4230: https://www.st.com/resource/en/application_note/an4230-introduction-to-random-number-generation-validation-using-the-nist-statistical-test-suite-for-stm32-mcus-and-mpus-stmicroelectronics.pdf- Public NIST certificate E163: https://csrc.nist.gov/CSRC/media/projects/cryptographic-module-validation-program/documents/entropy/E163_PublicUse.pdf Confusing/contradicting info:- E163 gives a RNG_CR of 0x08F01EXX, but AN4230 says value should be 0x00F01E00 (note difference in bit 27). Also, manual says bit 27 "must be kept at reset value.".- Reset values on the manual do not match my

HiI have STM32H563 Nucleo board which is in closed state with DA_Config.obk not programmed, And the trust zone disabled. This was done by mistake, Is there a way to do regression on it.Operations Done on the device.1.Done the regression2.Set the product state to provisioning3.Programmed OEMiRoT_Config.obk4.Set the device to closed state.Logs from ST32Cube programmer on DA Discovery10:40:20 : STM32CubeProgrammer API v2.19.0 | Windows-64Bits10:44:38 : Start Debug Authentication Sequence10:44:38 : SDMOpen : 624 : open : SDM API v1.010:44:38 : SDMOpen : 625 : open : SDM Library version v1.2.010:44:38 : open_comms : 513 : open : Asserting target reset10:44:38 : open_comms : 517 : open : Writing magic number10:44:38 : open_comms : 537 : open : De-asserting target reset10:44:38 : open_comms : 584 : open : Communication with the target established successfully10:44:38 : discovery: target ID.......................:0x48410:44:38 : discovery: SoC ID..........................:0x0000

 Now that that the CRA dates are near, why is there isn't a forum for regulatory compliance and CRA specific questions ?For example, which products STM offers now will not be CRA compliant ? This is important as those products would have to be revised or removed from the market.For example an STM32F072 would still meet requirement 1. as the main controller of the product with our without an RF/network connection (via UART/I2C etc..)  or 2. as a peripheral  connected to the main MPU (indirect) which connects with LAN or WIFI to outside world     

On an STM32H563, I am trying to write the OBkey1 data.I have successfully set the product state to provisioning (0x17) with: FLASH_OBProgramInitTypeDef optionBytes; HAL_FLASHEx_OBGetConfig(&optionBytes); HAL_FLASH_Unlock(); HAL_FLASH_OB_Unlock(); optionBytes.OptionType = OPTIONBYTE_PROD_STATE; optionBytes.ProductState = OB_PROD_STATE_PROVISIONING; HAL_FLASHEx_OBProgram(&optionBytes); HAL_FLASH_OB_Launch(); HAL_FLASH_OB_Lock();Now, when I try to write too OBKey1 with: uint32_t dataAddr = 0x20050000; memcpy ((void*)dataAddr, source, 0x60); RSSLIB_DataProvisioningConf_t * pConfig = (RSSLIB_DataProvisioningConf_t *)0x20050100; pConfig->pSource = (uint32_t*)dataAddr; pConfig->pDestination = (uint32_t*)0xffd0100; pConfig->Size = 0x60; pConfig->DoEncryption = 0xCACA0AA0U; pConfig->Crc = 0; HAL_FLASHEx_OBK_Unlock(); provisioningResult = RSSLIB_PFUNC->NSC.DataProvisioning(pConfig); HAL_FLASHEx_OBK_Lock();The call to DataProvisioning() causes

Hi everyone,I’m using the B‑U585I‑IOT02A development board for an IoT project. The onboard STSAFE‑A110 secure element comes pre‑provisioned with a default key and certificate, but for my application I need to:Provision my own keypair and certificate, andOptionally add additional keys or certificates into unused STSAFE slots (for testing or multi‑cloud use).I couldn’t find a clear step‑by‑step guide for:Generating and injecting a custom keypairUploading a custom certificate chainAdding extra keys/certificates to new STSAFE slotsWhether CubeProgrammer or Secure Manager scripts support provisioning user keysIs there any official documentation, example project, or provisioning tool that explains how to do this on the B‑U585I‑IOT02A?Any guidance or links would be greatly appreciated.Thank you!

Hello together,I search for a solution to put calibration data in a NS area.Background Information:we are using STM35H573 with STM secure manager.we use an ethernet Rest API to update Application including request install and so onNow I want to use the same Rest API to update configuration data. The BIN file shall be signed like a normal application. The behavior should be more or less the same: Restart µC, SM checks validity; app will be started,...I have read um3254 but I do not understand the section with large profile.I have read something about ITS, but I think this is not the solution I need. The calibration data must not be stored in the trusted area. They shall only validated bei the SM during update or startup. Thanks for joining this topic. Br Sebastian