STM32 MCUs Security

I tried the SBSFU examples (did not change any code) on a NUCLEO-L476RG board and it worked fine. Now I can not use STM32CubeProgrammer to connect the board. Is there any way to download a new firmware ( I mean, a firmware to replace the SBSFU firmware) to the board again? So that I can use this board for other projects.The configuration of the SBSFU is:/*#define SECBOOT_DISABLE_SECURITY_IPS*//*#define SFU_FINAL_SECURE_LOCK_ENABLE */#define SFU_DEBUG_MODE/*#define SFU_FWIMG_BLOCK_ON_ABNORMAL_ERRORS_MODE*/#define SECBOOT_OB_DEV_MODEThanks!

Hello!I want to use Asymmetric Crypto algorithms like ECC or RSA for my FreeRTOS project running on STM32F051K8. The controller has 64 KB of flash. Since X-CUBE-CRYPTOLIB occupies quite large memory footprint, my FLASH is getting overflowed by the .text area, on linking the X-CUBE-CRYPTOLIB library. I have made following changes to optimize the memory required for X-CUBE-CRYPTOLIB:Disabled everything else (unnecessary #defines) apart from INCLUDE_ECC in crypto.h file Optimization settings in Project properties: -Os optimization for sizeDebug level "none"But still my flash is getting overflowed by around 7000 bytes. Please tell me what else can I do for memory optimization? Otherwise, I might have to change the microcontroller with big FLASH memory. I also have attached error screenshot for the reference.

I am trying to set up the CRC in an STM32L072 to process data from a 1-wire device.In the CubeIDE (editing the .ioc file), if I leave the default values, it will generate an appropriate MX_CRC_Init(void) function.But if I want to set my own polynomial via the UI, I cannot get the UI to accept any input for "CRC Generating Polynomial" and the generated MX_CRC_Init() function is empty.Seems to be broken - or is there some format to the field that I am not following?The 1-Wire polynomial is X^8+X^5+X^4+1. I think the input should be "X8+X5+X4+X0" but this is not being accepted.Default Polynomial State: DisableCRC Length: 8-bitCRC Generating Polynomial: X8+X5+X4+X0What is the correct input? Or is the tool broken?

Hi,I was testing with the Nucleo STM32L476RG board, BSP example project FLASH_DualBoot.I made small changes in the example code (LED blink stuff) and programmed bank 1 and 2 several times. I also manually checked/toggled the option bytes BFB2 bit a few times.When I tried to program the MCU flash bank 2 again with STM32 ST-LINK Utility it said that it's not possible because of read/write protection. I didn't configure it any time before, only using the BFB2 bit in the example code. In the option bytes window I discovered that "Read/Write Protection Bank B" was activated. I couldn't uncheck it, because it says:"To disable Read/Write protection of BANK B, you must set PCROP_RDP bit, and switch RDP from Level 1 to Level 0".Well, both we're in desired state. Power cycle doesn't help. So I tried to trick the MCU by switching from Level 0 to Level 1 to be able to revert from 1 to 0.But it doesn't let me revert from 1 to 0:"ERROR: Could not set Option bytes! Please reset the target and retry."

..

I have the zip file for X-CUBE-SBSFU. But I don't know how to add it to STM32CubeMX. I tried install from local on embedded software packages manager. But it did not work.Thanks!

We are developing an application where the host controller will drive two radio modules.But Host controller software should have MISRA 2012 compliant SDK with RTOS support and should support FIPS-certified crypto library.Do anyone can help us to find appropriate MCU that meet our requirements ?

I am use this code for write page with disabling WRP:FLASH_Unlock(); if( FLASH->WRPR != 0xFFFFFFFF ) //WRP is active for any pages { FLASH_EraseOptionBytes(); NVIC_SystemReset(); //according to the manual } if( FLASH_ErasePage( address ) != FLASH_COMPLETE ) { printf( "FAIL" ); } FLASH_ProgramWord( address, value ); FLASH_EnableWriteProtection( FLASH_WRProt_Pages0to1 ); FLASH_Lock();If RDP is not active or WRP is not active, it work successfull,but if RDP and WRP is active, printf( "FAIL" ) is called, and write is impossible

HelloSince the STM32f42xx series has no intial value for the CRC I'm wondering if there is a way to stop a crc calculation (store the DR value) and resume it by writing the DR register with the stored value and some calculation??Something like this:crcvalue1 = HAL_CRC_Calculate(&CRCType, &byte_array_hex[0], 37000); __HAL_CRC_DR_RESET(&CRCType); CRCType.Instance->DR = crcvalue1; crcvalue2 = HAL_CRC_Accumulate(&CRCType, &byte_array_hex[37000], 13000);The goal is to interrupt a ongoing CRC calculaton with a higher prioritized calculation and afterwards resume to the lower priority again.Kind regardsMathias

..

I'm currently porting an existing project so it can be updated using the sbsfu bootloader project from ST. My userproject is using the MPU to protect the ethernet tx and rx descriptors from ending up in the d cache. However, if i enable the MPU the FPU stops working. Upon the first floating point operation the processor goes into the hardfault handler. Then the MM Fault stat register contains a 0x20. Which corresponds to the MLSPERR bit : A MemManage fault occurred during floating-point lazy state preservation.I'm using the following code to enable the MPU:void MPU_Config(void) { MPU_Region_InitTypeDef MPU_InitStruct = {0};   /* Disables the MPU */ HAL_MPU_Disable(); /** Initializes and configures the Region and the memory to be protected */ MPU_InitStruct.Enable = MPU_REGION_ENABLE; MPU_InitStruct.Number = MPU_REGION_NUMBER0; MPU_InitStruct.BaseAddress = 0x30040000; MPU_InitStruct.Size = MPU_REGION_SIZE_256B; MPU_InitStruct.SubRegionDisable = 0x0; MPU_InitStruct.TypeE

I noticed that in STM32FLASH programming utility, there is support for a CRC bootloader command. From what I can tell in the source code and commit history, this command is 0xA1 and was introduced around June of 2014. But from the ST documentation, I can't find any STM32 factory bootloader that enumerates a CRC command. If such a command exists, could someone point me to the app note?

I need to implement some BigNumber math on an STM32F4 (bn.h, conv.h, modular.h). I would like to use functions such as W8_to_Big(), StAllocBig(), and InitBig(). Unfortunately I cannot find any information on how to use these functions. Are there any examples or documentation that I could use to get a better understanding of these functions? Any help is appreciated!

The user manual (UM1924) says in section 15 RSA Algorithm:There are two structures that pass keys to the functions:•RSAprivKey_stt for the private key•RSApubKey_stt for the public keyAll members of the above functions should be filled by the user before calls to the RSA functions.So I need the keys before using the library. In the STM32_Cryptographic_example, in the RSA subfolder there's an example code that already comes with a pre-generated array for modulus, public and private exponents, message and signature, but how do you generate those arrays?How do you generate the keys?I know that modulus n=p*q and private exponent d=(e^-1)mod(Phi)... and all that, but I would think those formulas come already in the libraries and if not, how should one generate large p's and q's then?

Hi, I just went over the X-Cube-SBSFU material and tried to compile the example projects to get an overall picture of this function.The MCU I used is STM32F730I8 and I am using the STM32F7308-DISCO board.As only 64kB flash is available in STM32F730 series, the external memory execution(XiP) is needed in my application.​I would like to understand the feasibility to port the SBSFU package to a F7 MCU when running in XiP mode.The example package did provide the example for STM32F769I, but it only uses the internal flash.My rough idea is to put the SECoreBin and SBSFU in the internal flash and the slot 0 and 1 user app in the external NOR flash.Could anyone help to validate the feasibility?​Thanks,Jay

I am trying to use the hardware peripheral on the STM32F030 to calculate a 16-bit CRC for a modbus RTU application. But I don't know how to do it.

 Dear all. How secure is STM32 MCUs to prevent hackers from dumping the firmware from the flash memory? I've searched on the internet and on Taobao (like ebay) China and I found there are plenty of companies that claim they can crack and dump the flash code for almost any STM32 MCUs. Below is an example link :https://item.taobao.com/item.htm?spm=a230r.1.14.15.1275936aMaVbKE&id=556508470444&ns=1&abbucket=10#detailI believe they have tools the decap a MCU and connecting the wires by FIB or some technologies to the silicon die to dump the code in the flash memory. This is a very big threat to people like us who works on STM32 MCUs. I would like to know STMicroelectronic's opinion regarding this issue. Is setting RDP level to 2 (disconnect debugging port permanently) a more secure way to protect the firmware from being dumped? Anything we can do to prevent piracy? I've read from some Chinese forum that the UID of a STM32 MCU can also be changed easily. Chris

For example, Im looking at the STM32L073RZT6 This documentation from ST states there is "128‑bit AES hardware encryption".https://www.st.com/content/ccc/resource/sales_and_marketing/promotional_material/brochure/6c/48/c0/f1/bb/35/4a/b4/brstm32ulp.pdf/files/brstm32ulp.pdf/jcr:content/translations/en.brstm32ulp.pdfBut I can't find any reference on the datasheethttps://www.st.com/en/microcontrollers-microprocessors/stm32l073rz.html#resourceIs the first document to be trusted? whats going on??Thanks

Is there a list of STM32 based Mbed supported MCUs that have hardware encryption?I'm looking for the cheapest options.Many thanks

The reference manual gives a brief description but how do you actually implement it?I'm using an STM32F437 which includes a cryptographic accelerator so I'm not looking to use the Cryptographic Library.Any documentation, tutorial, example code or any kind of guidance would be appreciated.

Hi,In my company we are currenlty looking at integrate the crypto lib.I have created a small STM32 IDE project to test the crypto lib provided by ST. I am using the Nucleo STM32413. The whole project compiles and I can succesfully call AccHw_AES_CFB_Encrypt_Init() that returns AES_SUCCESS but when I call AccHw_AES_CFB_Encrypt_Append() it returns error_status = 2002 (HW Timeout).Did someone has the same issue?Is the STM32413 compatible with this library?Can I get some help from ST?Thanks in advance.Regards,Anthony

Hello,When the RDP level 1 protection option bytes is set and the boot adress is set in the user flash memory, what are the debugger protections ? Which parts of the microcontroller still remain available via the JTAG debug port or the SWD debug port ?are the debugger protections the same with a boot adress in system memory (ST embedded bootloader ) ?ThanksYves

According to following white paper, some STM32 MCUs has security issues.https://www.usenix.org/system/files/conference/woot17/woot17-paper-obermaier.pdfThe question is Which STM32 components are affected?We are considering to use STM32H750vb and STM32F103c8T6. Can we store safely the private keys?Thanks in advanceMirtcho

Hi all,I am generating a CRC using the hardware CRC module in my STM32L0 of which I fetch only the bottom byte.I want corresponding C code to generate the same result as the hardware calculator, I have tried many different settings and Polynomials, bit reversal etc, but I cannot get a match between the two.Here are my STM32L0 CRC settings:hcrc.Instance = CRC; hcrc.Init.DefaultPolynomialUse = DEFAULT_POLYNOMIAL_DISABLE; hcrc.Init.DefaultInitValueUse = DEFAULT_INIT_VALUE_ENABLE; hcrc.Init.InputDataInversionMode = CRC_INPUTDATA_INVERSION_NONE;//CRC_INPUTDATA_INVERSION_BYTE; hcrc.Init.OutputDataInversionMode = CRC_OUTPUTDATA_INVERSION_DISABLE;//CRC_OUTPUTDATA_INVERSION_ENABLE; hcrc.Init.GeneratingPolynomial = 0x4C11DB7; hcrc.Init.CRCLength= CRC_POLYLENGTH_32B; hcrc.InputDataFormat = CRC_INPUTDATA_FORMAT_BYTES; __HAL_RCC_CRC_CLK_ENABLE(); HAL_CRC_Init(&hcrc); __HAL_RCC_CRC_CLK_DISABLE();and here is how I call the function to generate the CRC for me, flashbuff is a char buffer:

..