STM32 MCUs Security

Hi ST team,I am using X-CUBE-SBSFU V2.8.0, project: Device: STM32H753Base example: NUCLEO-H753ZI 2_ImagesI ported UART pins/port for my H753 EVAL board.ProblemBuild fails in SECoreBin with GNU14.3 toolchain:C:/.../2_Images_SECoreBin/Src/se_crypto_bootloader.c:222:(.text.SE_CRYPTO_Decrypt_Init+0x16): dangerous relocation: unsupported relocation However , Then i shifted to 13.3 tool chain , then everything works fine for me.  Please confirm whether this is a known GCC 14.3 compatibility issue for SBSFU v2.8.0 key generation. If yes, could you share an official patch for prebuild.sh / key assembly generation so generated key symbols are fully compatible with newer GNU/binutils?

Hi everyone,We’ve been using the XCUBE-SBSFU bootloader in our industrial-grade project and recently noticed that SBSFU is now labeled as a legacy bootloader. It seems the new recommended bootloader is based on MCUBoot. Additionally, I’ve come across information on STiRoT, which implements a root of trust similar to what SBSFU legacy already offers.This has left us with a few questions, and we’d greatly appreciate any clarification:Why has SBSFU been marked as legacy and replaced? Were there specific limitations or issues with SBSFU that led to this change?How do we transition to MCUBoot? The MCUBoot website mentions it doesn’t currently support STM32 controllers, and the ST wiki says support is “coming soon.”What role does STiRoT play? It seems similar to SBSFU legacy but is relatively new. Is it a better option? Should we consider switching to it, and if so, why?Any insights or guidance would be greatly appreciated.Thanks.@Jocelyn RICARD I’ve noticed your valuable input on SBSFU

Hi Everyone,I'm following the: How to enable RDP-like product state flash protection in STM32H5 microcontrollersexample using an STM32H573xx devkit and an ST‑Link. I ended up bricking my devkit while attempting the regression step. My ST provisioning integrity status:0xf5f5f5f5I have another dev kit available for testing, but I haven't been able to find an H573xx example that uses the HAL code base. If anyone can point me to a HAL-based example for the STM32H573 series implementing JTAG protection. Many Thanks! 

Hi everyone,I am working on a custom board based on the STM32U575RGT6 (TrustZone enabled, FreeRTOS). I have successfully ported the SBSFU example originally provided for the B-U585I-IOT02A.My configuration is:MCUBOOT_APP_IMAGE_NUMBER = 1 (Single combined S and NS image)No external loader.To meet my application needs, I added a custom FLASH_STORAGE area at the end of the flash for EEPROM emulation. To do this cleanly, I modified flash_layout.h to dynamically compute the available FLASH_NS_PARTITION_SIZE based on the remaining space.The Problem: When I use MCUBOOT_OVERWRITE_ONLY, the OTA update (via Y-Modem) works perfectly. However, when I try to use the Swap mode (by commenting out #define MCUBOOT_OVERWRITE_ONLY), the firmware download succeeds, the board reboots, the bootloader validates the signature, starts the swap process, but then crashes with a status write fail:FWUPDATE --- Démarrage de la mi

Hi ST team,I am trying to develop a secure bootloader and firmware update solution for STM32H735 MCU. I was looking at ST's implementations, SBSFU legacy and SBSFU by MCUboot. Could you give me some guidance, which would be the better choice to start from and port to my chip? I saw that SBSFU by MCUboot is targeted only to STM32H7S, and not STM32H7, so I assume if I want to go with MCUBoot, most of the code built on top of MCUBoot by ST is not going to be usable for me, is that correct?I need these features for the bootloader:immutable bootloader implementationapplication authentication (using signature verification)secure application updateanti-rollback protectionA/B update scheme to provide a fallback optionPreferably support for TCP communication for image download (or allowing easy integration for it)Thank you for your help.

Hello, I'm looking for some advice on how to progress, beginning from a fairly novice position, with a secure bootloader.  I'm beginning a project where at least a secure update process (where the existing application does the update) is desired.  Ideally I'd have an encrypted and signed application updates being delivered to my target application and put that away in flash, then reset the MCU and have a bootloader validate / process the update. I've found Zephyr and had a small play with the MCUBoot -- its seem pretty cool,  though I also found that some combinations of options created interesting build failures that were confusing.  I've just stumbled across the SBSFU project - which appears to utilise some of MCUBoot, but I'm having a slow time making sense of it, with its half a dozens projects and plethora of source files.  If there is not a STM project that can be configured and directly used on the U575 -- I'm hoping there is at least an overview / walk

I see only one other answer to this question, here: Solved: TrustZone Enable afterwards - STMicroelectronics CommunityHowever, others are not answered. Can you confirm that there is a solid reason why the TrustZone cannot be enabled after the project has been created? Does it scramble to ioc file? Was this an issue with previous versions of CubeMX and perhaps no longer an issue? Core: M33

Our own non-secure application is based on "SMAK_Appli" in the STM32TRUSTEE-SM example and in principle, it works, but debugging is giving me issues. This is with STM32CubeIDE latest version and all tools software and firmware updated to their latest versions, too.Issue 1: Using STLINK-V3 to start debugging, whenever there has been a code change, the first attempt results in a verification error (see log below) and the second attempt then works. This is 100% consistent and terribly annoying since starting the non-secure debugging session is very slow to begin with.Issue 2: Using J-Link to start debugging, it claims flash was programmed (very fast) and debugging seems to work at first, but I found that flash programming was not effective. The flash content is always what it was programmed with using STLINK. So if I want to use J-Link, I have to program with STLINK (twice), then switch to J-Link but I cannot successfully program changed flash content with J-Link.Are these issues know and

Suppose I want to implement firmware for STM32U3 without TZ enabled and without the use of GTZC, then I could mostly use the MPU_NS and the TZ-Aware peripheral protection (EXTI, FLASH, RCC, PWR, GPDMA, SYSCFG, RTC & TAMP).   My goal is to limit unprivileged code execution to main FLASH, no SRAM, no OCTOSPI NOR/PSRAM.   The problem is now the ICACHE. Is there a way to force it to be privileged only ?   If not, assuming that I am allowing only unprivileged execution access via MPU_NS to the main FLASH (0x08000000 - (0x08000000 + size of flash)), could the remapping feature of the ICACHE be used to map say SRAM into this region and somehow unprivileged execution access this way ?   The docs are unclear there. The remap mechanism is described as a generic mechanism, not limited to any subset of the 0x00000000 - 0x1fffffff address space. Which means that in theory one could replace the mapping at 0x08000000 to say the SRAM1 base address.   - Thomas  

I read UM3451 (STM32N6xx security guidance for SESIP level 3 certification) chapter 3.2.2 Secure installation and I wonder why aren't the FSBL signature public keys not written into OTP fuses? Only the 8 words (32 bytes) of hashes of all 8 public keys are written by the instructions.Chapter 2.1. Secure boot here in wiki explains that one of 8 active public key hashes in FSBL binary header is compared to the one in OTP and if they match, then "that" public key is trusted. But it doesn't explicitly say where does "that" public key come from.From UM3234 concept drawings (Figure 12-13.) I begin to understand that public key (in some changed form) is provided with the FSBL authentication extension header. So does it mean the MCU does not know the public key and it trusts the provided public key based on the hash table match only?Am I missing something here, but it appears to me that uniqueness of public keys have been heavily reduced. Since each public key hash is individuall

We've been using STiROT + OEMuROT for STM32H7S on our system, with our own application.The secure bootloader handles most of its functionality very well, and the security aspects in particular. The scripts provided by ST were very helpful, as was the documentation on the ST wiki. We are grateful to ST for providing these.However, it proved extremely challenging to get the secure bootloader working with our application, mainly because the secure bootloader makes a number of important assumptions about the user application which are not documented.These unstated assumptions initially prevented our application from running, and it took a considerable amount of time and effort to solve all the problems associated with them.AssumptionsThe main assumptions are:OEMuROT assumes that the application will use the same clock setup as itself (especially PLL1 and PLL2): as documented in a separate post, we needed to change the clock settings in our application compared to OEMuROT, and thi

I'm working on a custom STM32U5 board and I'm trying to harden the system.I followed the AN5347 (https://www.st.com/resource/en/application_note/an5347-arm-trustzone-features-for-stm32l5-and-stm32u5-series-stmicroelectronics.pdf) in particular I followed the chapter 10 with success as I was able to raise up to RDP=2 with OEM password and back to RDP=0.Then I tried for the second time using the STM32CubeProgrammer instead of the command line as described in the application note, but I got some issues at step 5: Set RDP level 2. The STM32CubeProgrammer did not end the process and got stuck writing RDP=0xCC in the option byte and after ten minutes I forced the termination of the GUI.After that I was not able to recover to RDP=0.Every time I try to send a command to the board I get some error.If I try to follow chapter 10.6 Unlock RDP level 2 with OEM2Key with the command line:STM32_Programmer_CLI.exe -c port=swd mode=UR -unlockrdp2 0xMYKEYLOW 0xMYKEYHIthe result i

When creating a new project (for STM32H573) using CubeMX, it generates defaults keys under ROT_Provisioning\SM\Keys:06/19/2025 03:20 PM 232 ITS_key1.pem02/17/2026 09:34 PM 16 SFI_Encryption_Key.bin02/17/2026 09:34 PM 12 SFI_Encryption_Nonce.bin02/18/2026 12:06 PM 136 SFI_Global_License.bin06/19/2025 03:20 PM 246 SM_Authentication.pem06/19/2025 03:20 PM 182 SM_Authentication_pub.pem06/19/2025 03:20 PM 246 SM_Encryption.pem06/19/2025 03:20 PM 182 SM_Encryption_pub.pemUsing TPC, those keys (including the SFI_global_license) can be regenerated, but when provisioning, got the following error:2026-02-18 12:19:23,911 - DEBUG - Processing license...2026-02-18 12:19:24,072 - DEBUG - Error: Execution of RSS CMD failed, returned value = 0xF6F6F6F62026-02-18 12:19:24,072 - DEBUG - Error: Failed to Process License!2026-02-18 12:19:24,073 - DEBUG - Error: .....ROT_Provisioning\SM\Binary\SecureManagerPackage.sfi SFI file Install Operation Failure! Please, try again.2026-02-18 12:19:24,073 - DEBU

I created a sample project using the STM32N657-DK, but when I try to debug using ST-LINK, each project does not work and results in a HardFault or similar error.I also tried loading them simultaneously from the debug configuration, but it was not successful.How can I properly debug both AppliSecure and AppliNonSecure? Also, is this the correct way to create a sample using the TrustZone feature of the STM32N6570-DK?I would appreciate your guidance.I am using STM32CubeIDE version 1.19.0.For the sample project I created, I made "FSBL", "AppliNonSecure", and "AppliSecure". 

We need the secure boot and secure firmware update solution for both the execution models to meet the EU-CRA standard:• Execute in place support (XiP support) - direct execute from external QSPI flash• BootROM support - copy from QSPI flash to SDRAM, and execute from SDRAM https://www.st.com/resource/en/application_note/an5188-external-memory-code-execution-on-stm32f7x0-value-line-stm32h750-value-line-stm32h7b0-value-line-and-stm32h730-value-line-mcus-stmicroelectronics.pdf

Hello ST Support,I reproduced an ETH TX DMA issue on STM32N6570-DK where the DMA never consumes the TX descriptor.Environment- Board: STM32N6570-DK- Security: TrustZone enabled, Secure-only platform configuration- PHY: ID1=0x001C, ID2=0xC916, link-up confirmed- Interface: RGMII, 1G linkObserved behavior- HAL_ETH_Transmit*() submit succeeds (st=0)- TX descriptor OWN bit remains 1 (never cleared by DMA)- TX complete callback/counter never increments- DMA enters/keeps TBU state- Key symptom: DMACCATXBR remains 0 (buffer base is never loaded)Representative logs- [eth][post-start] dlar=0x3402C1E0 dtpr=0x3402C1E0 rlr=0x00000003 txcr=0x00200001 dmacc=0x00080218 txqomr=0x0007000A- [tx][path] st=0 own=0->1 catxdr=0x3402C1E0->0x3402C1E0 catxbr=0x00000000->0x00000000 csr=0x00000000->0x00000004- [tx][stall] own=1 ... catxdr=0x3402C1E0 catxbr=0x00000000 csr=0x00000004 ... dmad=0x00006400 tps0=0x00006000 axr=0axw=0What we already tried (same result in all cases)1. EDSE on/off (txcr=0x102

Hello,I'm developing an application with OEMiRoT and trustzone for STM32H563.I'm getting a write protection error (WRPERR) when I try to erase a secure flash sector from secure code that is not protected neither by write protection or HDP. I'm using the method HAL_FLASHEx_Erase() and I mapped the region as readable and writable with the memory management tool of CubeMX.If I try to do the same process without the secure boot provisioning, everything works as expected. I would like to know if there are any additional operation in order to write/erase flash at runtime when secure boot is used.Any help is really appreciated!Thank you,Giulio

I am looking for information that compares the security in an STM32U5 or similar with the PUF-based solutions used in competitor's processors.  The problem is that "PUF" has a simple explanation that sounds good and a head-to-head analysis of the advantage of these other processors against what ST provides seems to be lacking in the market place.  Obviously, ST could have selected a PUF-based security and decided not to do so, so the clues might exist in why that decision was reached.  Note:  The primary focus is to find processors that prevent software pirates from extracting the firmware.  Any help that addresses this will no doubt be repaid in future design wins.

Hello everyone,I’m working on a project with Secure Manager on STM32H573IIK3Q using the STM32H573-DK board. I have followed the official tutorial from ST to make my application compatible with Secure Manager:https://wiki.st.com/stm32mcu/wiki/Security:How_to_make_your_application_compatible_with_Secure_ManagerSo far the system works fine — I can blink LEDs and run a basic non-secure application without issues.However, as soon as I integrate FreeRTOS and switch the HAL timebase source from SysTick to TIM7, the program immediately stops and goes into the BusFault_Handler() after TIM7 interrupt. Steps to reproduce:1) Follow the Secure Manager tutorial and set up SM provisioning2) Confirm basic GPIO/LED blinking works3) Add FreeRTOS middleware (no other changes)4) In Clock Configuration → SYS, change Timebase Source to TIM75) Build and flash — program immediately hits BusFault_Handler() Environment / versionsSTM32CubeMX: 6.17.0STM32Cube FW_H5: V1.6.0STM32CubeIDE: 2.1.0 Thank

Hello,I'm currently working on a project using the STM32U5A5VJT6 processor, and I'm exploring the feasibility of implementing WireGuard in a bare-metal environment. I found one mention of WireGuard in this community post [link], however afaik it is an application for an OS based ST product. So I'm looking for more detailed insights.Is STM actively working on any initiatives to bring WireGuard support to processors like the STM32U5A5VJT6, especially for bare-metal implementations?The WireGuard protocol was primarily designed for OS-based systems with kernel support, which makes bare-metal implementation exceptionally challenging. Given the cryptographic and networking demands, has anyone made significant progress or come across alternative approaches that could support WireGuard (or similar VPN functionality) on an STM32?I encountered Mongoose’s library for networking on STM32, which offers some guidance on web server setups. Are there other resources or community-driven efforts that ad

Hello,I am working on the X‑CUBE‑AZURE TFM_Azure_IoT example for the B‑U585I‑IOT02A board and would like to replace the default UART loader with CAN and USB loaders. While the non-secure loader boots and runs correctly, the non-secure interrupts for FDCAN and USB do not trigger. In the application, both peripherals work with interrupts, but in the loader, they do not.To make this change, I modified the loader's non-secure application size to accommodate the FDCAN and USB stacks. However, I am encountering issues with interrupts not firing.I have verified that FDCAN works in polling mode in the non-secure loader application.Environment:Board: B‑U585I‑IOT02A (STM32U585)X‑CUBE‑AZURE: TFM_Azure_IoT (v2.3.0)Toolchain/IDE: STM32CubeIDEWhat I've tried:Adjusted the non-secure application size to fit the CAN and USB stacks.Ensured the peripherals are initialized in the non-secure context.Checked the interrupt enablement for CAN and USB, but no interrupts are firing.Thanks in advance!

We are currently in the early planning stages of developing a PCI PTS/SSF-compliant payment terminal and have selected the STM32U5 series as our target MCU due to its advanced security features (TrustZone, PCROP, HUK, etc.).To ensure we start on the right foundation, we would greatly appreciate your guidance on the following:1. Recommended Software Stack:Which version of STM32Cube_FW_U5 and Trusted Firmware-M (TFM) / SBSFU is currently recommended or validated for security-critical applications like payment systems?Are there any known issues or errata in older versions (e.g., V1.7.0) that we should avoid for certification purposes?2. PCI-Specific Resources:Does ST offer any reference designs, evaluation reports, or application notes specifically tailored for PCI PTS/SSF compliance on the STM32U5 platform?Are there pre-validated secure boot, secure firmware update, or key management implementations we can leverage?3. Documentation & Tooling:Could you share the latest Security Refere

Dear community,where can I find the source code for this generated MX66UW1G45G_STM32H7S78-DK_XSPIM1-SFIx.stldr file?I need to load binary files on an sd/emmc flash passing through the OEMiRoT boot that loads the specific external loader I want to implement based on this MX66UW1G45G_STM32H7S78-DK_XSPIM1-SFIx example.  I have already implemented a custom external loader for my sdcard which works fine when loading the binary directly from CubeProgrammer or IAR ide (no mapping mode), however it fails to load the external loader in RAM through OEMiRoT bootloader through a UART serial interface with this command:  .\STM32_Programmer_CLI.exe -c port=COMxx br=xxx -elbl "my_loader.stldr" -w my_encrypted_file.bin "my_custom_address". The same command works fine with the above example when the firmware update new binary is loaded in the macronix flash. Thank you for help 

Hello,I am working with the STM32L476 and would like some clarification regarding the One-Time Programmable (OTP) area.From the reference manual, I understand that STM32L4 devices provide 1 KB of user OTP memory (128 double words). I would like to better understand the following:What exactly is stored in the OTP area? Is the OTP region purely user-programmable, or does ST also store factory calibration or security-related data in this region? Is OTP used internally by the MCU for enforcing Flash security mechanisms such as RDP, WRP, or PCROP, or is it strictly for user data? How is OTP protected ? I am trying to understand the architectural role of OTP in relation to Flash protection and secure boot mechanisms.Thank you.

I have created my secure boot demo project on STM32H563ZI using the link below.https://wiki.st.com/stm32mcu/wiki/Security:How_to_start_with_STM32CubeMX_OEMiRoT_Boot_path_on_STM32H563During provisioning, the secure image is signed by the TPC (STM32TrustedPackageCreator) tool. TPC supports the standard MCUboot signing process: calculating SHA256, generating the firmare image signature TLV (e.g., ECDSA256 0x22) using the specified private key, and adding standard TLVs. All these work just fine with the TPC tool.Now, I need to append a full public key (IMAGE_TLV_PUBKEY 0x02) as an additional TLV into the image. And one more layer of TLV (IMAGE_TLV_ECDSA256 0x22) for the signature of this pub key. Does TPC support custom TLVs by changing its config file (e.g., OEMiROT_S_Code_Image.xml)?I acually couldn't find ways to do that via TPC, so I switched to use imgtool. imgtool sign --key "C:/Work/nucleo_h563zi/Secure/ROT_Provisioning/OEMiROT/Keys/OEMiROT_Authentication_S.pem" --header-s