STM32 MCUs Security

Hi.I am trying to compile the SBSFU project for STM32L, more exact i am using b-l475e-iot01a.I have put together the following makefile, trying to compile SECoreBin, but i cannot work out how to link it together without getting /usr/lib/gcc/arm-none-eabi/8.2.0/../../../../arm-none-eabi/bin/ld: /usr/lib/gcc/arm-none-eabi/8.2.0/../../../../arm-none-eabi/lib/thumb/v7e-m+fp/softfp/crt0.o: in function `_start': (.text+0x44): undefined reference to `main'Makefile.###################################### # Makefile by CubeMX2Makefile.py ######################################   ###################################### # target ###################################### TARGET = SECoreBin   ###################################### # building variables ###################################### # debug build? DEBUG = 0 # optimization OPT = -O0   ####################################### # pathes ####################################### # Build path BUILD_DIR = build   ########################

Hi,Before I try this out is it possible to use this library to Decrypt AES-GCM 256 on a WB series mcu?

Hi, I was wondering if there is a way to integrate the SBSFU package (as compared to other packages) into the IDE, or more specifically, the CUBE MX, so I get easy configurability inside the Toolchain either than manually changing all my HAL c-files and librarys and so on?My understanding of the whole SBSFU and how to adjust the Framework is still not completely clear because the whole tool lacks significantly in documentation or at least, clear instructions how to use it with different Toolchains/IDEs.

If the SPI_InitStruct.SPI_CRCPolynomial = 0x1021; I would like to set the SPI CRC initial value to 0xFFFF; I can NOT find the register, can someone tell me the details?

Hi,I am trying to implement readout protection on my stm32f427VG. I want to apply Read protection Level 2 from the user application or bootloader code in the flash. My custom bootloader resides in flash at address 0x00000000.

I found from this question, on May 2017,https://community.st.com/s/question/0D50X00009XkXqzSAF/why-mbedtls-which-is-part-of-stcube-116-release-does-not-contain-hw-acceleration-codethat hardware crypto support was in development for mbedTLS.When we will get an update with this implemented?

I've tried to find an example code of use of crypto harware accelerator in LORAWAN but i haven't been able to find any . Does someone have an example expecially concerning the use of AES CMAC?Regards

I working with the STM32F446-microcontroller and I need to upgrade firmware and change the option bytes on it using the built-in bootloader (en.CD00167594.pdf, AN2606) using SPI-bus (en.DM00081379.pdf, AN4286). I am able to successfully modify all option bytes, except the read protection level (from 1 to 0). In the reference manual (en.DM00135183.pdf) it says that when changing the read protection level from 1 to 0, then the flash will be mass-erased and I would imagine this takes some time. However, I can't find any special instructions in AN2606 on how to do this through the bootloader and whenever I try to change the read protection level, I end up receiving a NAK in the get-ACK-procedure inside the write-memory-command-sequence. Does anybody know the proper sequence for changing read protection level from 1 to 0?

I am working on STM32L151QD MCU. I want to implement CRC feature in my application using STM hardware CRC block.i am trying below steps to configure HW CRC:uint32_t crc; uint32_t t_buffer[4] = {1,2,3,4};  RCC_AHBPeriphClockCmd(RCC_AHBPeriph_CRC, ENABLE);    //Reset HW CRC    CRC_ResetDR();  crc = CRC_CalcBlockCRC(t_buffer, sizeof(t_buffer));  printf("hw crc = %d\n", crc);  if ( CRC_GetCRC() != crc)  {   printf("error in HW CRC\n");  }  RCC_AHBPeriphClockCmd(RCC_AHBPeriph_CRC, DISABLE); /* Turn OFF CRC */  return crc;But every time HW computed CRC is different even if the input buffer is same all the time.am i missing anything?anything else to be configured to get correct CRC ?

..

I'm aware that the STM3240G-EVAL doesn't have a hardware crypto processor, but is it possible to create a software algorithm to do the encryption? Possibly using the X-CUBE-CRYPTOLIB library?

Hello. AllI'm using STM32L151 MCU, stm32 crypto library v.3.0.0.I implemented CMAC according to the sample code but it returned "AES_ERR_BAD_CONTEXT". I could not find any reason.. please let me know to solve this problem.!!Here is my code for CMAC encryption. static AESCMACctx_stt AEScmacCtx = { 0 };// Static function declarations -----------------------// Static function definitions ------------------------static int32_t AesCmacInit( uint8_t * key ){ int32_t result = AES_SUCCESS; AEScmacCtx.mFlags = E_SK_DEFAULT; // 0x00000000 AEScmacCtx.mKeySize = CRL_AES128_KEY; // 16 AEScmacCtx.pmKey = key; AEScmacCtx.mTagSize = CRL_AES_BLOCK; // 16 result = AES_CMAC_Encrypt_Init(&AEScmacCtx); return result;}// Module interface function definitions --------------int32_t AesCmacEncrypt( uint8_t * plainData, int32_t plainSize, uint8_t * key, uint8_t * cmacData, int32_t * cmacSize ){ int32_t result = AES_SUCCESS; result = AesCmacInit( key ); if( result != AES_SUCCESS ) { return

I am trying to use the hardware CRC built into the embedded flash module. When I use the start and end addresses and kick off the CRC, the processor halts and I have to do a full flash erase to get it back. Are the start and end addresses relative to the base of the flash bank? Here is my code:  // Unlock FLASH_CR1/2 register FLASH->KEYR1 = 0x45670123; FLASH->KEYR1 = 0xcdef89AB;   // Enable the CRC feature by setting CRC_EN in FLASH_CR1/2 FLASH->CR1 |= FLASH_CR_CRC_EN;   // Lock the CR1/2 register FLASH->CR1 |= FLASH_CR_LOCK;   // Set crc burst length to 01: 64 flash words (64 * 32 bytes/word = 2048 bytes) // In the link script, the binary must end on a 2048 byte boundary in this case FLASH->CRCCR1 &= ~FLASH_CRCCR_CRC_BURST_Msk; FLASH->CRCCR1 |= FLASH_CRCCR_CRC_BURST_0;   // Check CRC between defined addresses, not by sector FLASH->CRCCR1 &= ~FLASH_CRCCR_CRC_BY_SECT; // FLASH->CRCCR1 |= FLASH_CRCCR_CRC_BY_SECT;   // Set star

I have been using the STM32 serial bootloader, instead of coding my own bootloader, for a while now. But lately I wanted to protect my code, so I tried to enable readout protection (RDP) level 1. This is meant to prevent the user to read the flash. However, after a few attempts, it seems that it is not possible to use this sytem memory bootloader to enable RDP, then start running the code that I put in the flash.From what I understand, running the flash is considered "debugging" access, and is prevented when RDP is active. Is there a way to get around this ? I would like to protect my code from "basic" read access (like JTAG) without coding my own bootloaderThanks

..

Hi everyone,we have a bootloader that writes new application code to the flash bank 2 in an STM32H7 and afterwards swaps the banks to execute the new code. The procedure for swapping is something like this:   unlock OPTLOCK   set SWAP_BANK_OPT   set OPTSTART   lock OPTLOCK   system resetThis works fine with a Level 0 readout protection (RDP). However it is not working with a RDP level 2. The reference manual states that only the SWAP_BANK_OPT bit is adjustable when RDP2 is set. It also states that you have to unlock OPTLOCK before changing SWAP_BANK_OPT.Does this mean if OPTLOCK is set (locked) when RDP2 is active you can not change SWAP_BANK_OPT since you can not modfiy OPTLOCK?So the solution to use SWAP_BANK_OPT would be to unlock OPTLOCK before activating RDP2?Is there any other reason that would prevent IAP when RDP2 is set?

..

Hi, I am wondering if the build-in TRNG modules in the STM32L series (0, 1,2 ,4, 4+ and 5) are compliant with the NIST 800 90A/B/C standards. If so, where I can find information on ST stating such TRNG complies with this standards? We are developing a product for a specific client who is requesting that all TRNG's are compliant with the aforementioned standards.Regards

Hello, what wouldd be the best library to create private/public keys (RSA) and sign some messages ? I did not find a free library able to create and sign messages even in the smt32 crypto lib. Any clues ? Thank you in advance

Could someone elaborate on the tradeoffs of cryptographic scheme selection, especially between Asymmetric with AES encryption and Symmetric (AES GCM) ?While it is the default choice, it is not clear to me why SECBOOT_ECCDSA_WITH_AES128_CBC_SHA256 would be preferable over SECBOOT_AES128_GCM_AES128_GCM_AES128_GCM since according to Table 3 of UM2262 (getting started), storing a private AES key is required in both cases. What are the benefits of the default approach?

I'm taking STM32Cube and the CRYP example for NUCLEO-L496ZG as the basis for a new HW AES encryption Arduino library. I'm currently developing for the STM32L476 MCU and here I found the first problem since stm32l476xx.h does not seem to include the necessary AES register definitions. Anyway, I took these definitions from stm32l486xx.h which does include them.Finally, I was able to compile this example (taken from the STM32Cube distribution) from the Arduino IDE: CRYP_HandleTypeDef CrypHandle; /*##- Configure the CRYP peripheral ######################################*/ /* Set the common CRYP parameters */ CrypHandle.Instance = AES;   /******************************************************************************/ /* AES mode CTR */ /******************************************************************************/   /*===================================================== Encryption CTR mode ======================================================*/ if (HAL_CRYP_DeInit(&

I have the secure boot expansion package and I can't find any documentation at all that details how it integrates into CubeMX and how to install it. This is the expansion package:https://www.st.com/en/embedded-software/x-cube-sbsfu.htmlThanks in advance for any help!

Hi,We were able to successfully port STM secure bootloader(SBSFU) on our custom boards. We could demo the firmware update using Teraterm(also extraputty) on windows machine as recommended by STM. But I was not able to update firmware using any of the terminal on linux(tried minicom, cutecom) or MAC(serial). Do you have any recommendation or a possible solution to this problem?Thanks in advance,Arjun

Hello,In secured boot getting started it is said:"Download the SB SFU project software to the target without starting a debug session(Security protections managed by SBSFU forbid JTAG connection as it is interpreted as anexternal attack)"Does it mean it should be done using IAR: Project->Download->Downloading File ?Isn't it still using JTAG even if it is not yet debug ?Thanks,ranran

Hello everyone,I'm tring to implement a calculation of firmware CRC in run time mode.Is there inker command method to acquire last address where code is written?I'm quite confident there is a specific command like __text_end__, for example.Best regrds