STM32 MCUs Security

Posted on June 15, 2016 at 19:16I just discovered the hard way that if you initiate a full flash erase cycle (in my case, by going from RDP level 1 to level 0) and reset the chip before that process is complete then the chip is essentially (AFAICT) bricked.  DFU mode will no longer allow you to download new code.  When I try (using dfu-util) it says ''ERASE_PAGE not correctly executed''.So my question is: how can you know when a full flash erase is done?  You can't provide feedback from software (again, AFAICT) because both the flash and the user RAM get erased, so there's no more code to execute.  And I can't find any documentation that says how long a full flash erase takes.  So how can you know how long to wait before resetting without bricking the chip? #rdp-full-flash-erase

Posted on April 10, 2016 at 09:13Hi allI'm setting the read out protection to level 1 , in the beginning of my main() fxnAfter setting RDP I generate system reset using HAL_NVIC_SystemReset() fxnAfter the reset I'd expect the RDP to be set to level 1 but it's notonly a hard reset enables the RDP.FLASH_OBProgramInitTypeDef pOBInit;HAL_FLASH_OB_Unlock();HAL_FLASHEx_OBGetConfig(&pOBInit);if (pOBInit.RDPLevel != OB_RDP_LEVEL_1){     pOBInit.RDPLevel = OB_RDP_LEVEL_1;     HAL_FLASHEx_OBProgram(&pOBInit);     HAL_FLASH_OB_Lock();     Delay1ms(10000);     HAL_NVIC_SystemReset();}  #stm32l0 #rdp

Posted on March 26, 2016 at 08:11Good afternoon. Calculate checksum CRC32 of ROM in embedded program is very simple. But how to calculate and write it in image of ROM on stage building? It possible in Ac6 System Workbench without external tools? Thanks in advance. #crc

Posted on March 18, 2016 at 10:54There is a crypto library offered for download from ST official site here: http://www.st.com/web/catalog/tools/FM147/CL1794/SC961/SS1743/LN1920/PF262570However when I try to get the library the link just drops me to a product selection catalogue where I cannot find the software any more.Do you know how I can get this library to use crypto extensions in my STM32 devices?Thanks,Balas #stm32-crypto-lib #!stm32-!cubemx #!stm32

Posted on March 14, 2016 at 18:01I'm using the CRC unit on the STM32L486. In the reference manual it states that:''CRC computation is done on the whole 32-bit dataword or byte by byte depending on the format of the data being written.''However, later in the documentation it states that:''The data size can be dynamically adjusted to minimize the number of write accesses for a given number of bytes. For instance, a CRC for 5 bytes can be computed with a word write followed by a byte write.''From my use of the CRC unit, it seems that I can only achieve the latter statement, which does a byte by byte calculation. Even if I write a whole word to the Data Register (DR), it will process the word a byte at a time.From the first statement, it appears that the CRC should also do word-wise calculations, but I have not been able to accomplish that. Can I do word-wise calculations with this CRC or only byte-wise?Any guidance or clarification on the capabilities of this MCU's CRC per

Posted on March 01, 2016 at 13:39Hi, My problem is this, i have a product that have in the pages 0-3 a bootloader, and the RDP is state ON to protect my code, then the application code (120KB). All works fine and with this bootloader i can change the applicacion code without problems. But now i need to change the bootloader with the only code that i can, this is from the application code, but i read a PDF that when RDP is ON the page 0-3 is protected to write and if a try to change the RDP to unprotect the pages this generate a mass erase and need to reset to take effect the RDP OFF to program the pages 0-3 but i dont have code to execute when return from the reset and the equipment will be lost. The equipments are on the customers because of that they have to be send to my to program again all, the bootloader and the application code. Any suggestion about that. thanks Diego #stm32-rdp-read-protection

Posted on February 16, 2016 at 16:01 Hi! I'm using the X-CUBE-CRYPTOLIB (AES-256-ECB) on the STM3220 devboard using System Workbench (GCC) with no luck. I set the config.h file (tried every permutation nearly), my project compiles successfully, and I am able to run my test program in which I want to encrypt an array then decrypt it immediately. Upon doing so I don't get the original plaintext back (some mumbo-jumbo only). I think I might be missing something small but significant (I used the non X- version in Keil before, and it had a Crypto_Deinit() function which this X- version doesn't have). I pasted my sample code below, can anyone help me? uint8_t key_enc_256[CRL_AES256_KEY]= AES256_KEY; uint8_t iv[CRL_AES_BLOCK]= AES256_IV; AESECBctx_stt AESctx_enc; /* The AES context */ AESECBctx_stt AESctx_dec; /* The AES context */ uint8_t test_plain[256]; uint8_t test_cypher[256]; /** * \brief Initializes AES encrypt/decrypt contexts * \param None * \retval None */ void A

Posted on January 05, 2016 at 08:15Just noticed this library called X-Cube-Cryptolib. Quick question is , if i use the HW accelerated version of the lib, is it safe to make calls to the library from different RTOS threads considering they will be calling the crypto or hash functions that use the same peripheral, or should locking be implemented on thread level? #crypto #stm32 #cube #cubemx

Posted on November 11, 2015 at 18:11I'm trying to install the STM32Cube Cryptographic Library v3.0.0 on a fresh STM32CubMX install, version 4.11.0, under Windows 7. Installation fails with a message that ''This Package version is not managed on this version of STM32CubeMX.'' What's up with that? The most recent versions of these two items should logically be compatible... The release notes in the zip file make no reference to any version limitation, nor do the online docs, and I've already tried it on an earlier STM32CubeMX installation with no success. One possibly-relevant fact is that when I unzip the downloaded .zip archive into my documents directory, I get a path-too-long error on some HTML files; however, when I unzip into C:/ the operation succeeds. Has anyone succeeded in installing this library, or does someone know what's missing here?

Posted on October 30, 2015 at 20:08Hi. I want to make SSI protocol with SPI peripheral on STM32F3 series. Also want to use DMA for Tx. There is a hardware CRC calculation unit, which calculate CRC above all data and is attached as last byte (in my case).  I have to send out 2 bytes of important data and 8 less important bytes. Now, I know that it is possible to calculate CRC above all 10 bytes and CRC will become 11th byte.Is there any possibilities to have CRC as third byte, which should be calculated only above first two important bytes. Other, less important data doesn't need to have CRC and customer could also avoid it - do not read it at all. He would wait only for first 2 bytes of important data and CRC as third byte. If he want to read other data too, then he should wait for it.Any suggestions? #crc #ssi

Posted on October 06, 2015 at 12:24Hi all, Anyone knows why the following code is not disabling the flash memory readout protection? It is being executed on a STM32F103 microcontroller.FLASH_Unlock();  FLASH_ReadOutProtection(DISABLE);  FLASH_UserOptionByteConfig(OB_IWDG_SW, OB_STOP_NoRST, OB_STDBY_NoRST);  FLASH_Lock();  __disable_irq();  NVIC_SystemReset(); Thanks #read-protection

Posted on November 09, 2013 at 13:03Hello Everyone,Does anybody know, how exactly to use STs crypto library (V2.0.6 for STM32F427) such that it behaves / is compatible with openssl?i.e. generating an encrypted file via:openssl enc $encryption -p -e -in $inputFile -out $outputFile -K $key -iv $ivI'm using AES-128-CBC as encryption modewith e.g.:key=80880964C96E0420BD76097325E90C72iv =1695FB863212FE678E315A313AACAB38and then trying to decrypt it with the ST library does not seem to work, i.e. the 'clear text' is not clear at all...What I did so far:key and iv have been put into a uint8_t array in the order of bytes, as they appear in the hex-strings above, i.e. aKey[] = { 0x80, 0x88, etc. }Same with IV.This should work like this, shouldn't it?Or do I have to swap certain byte / word order?Your help is very much appreciated.RegardsHanspeter #stm32f4 #crypto

Posted on June 14, 2015 at 15:15Hi,I'm developing on the stm32f207 with the M3_CryptoFW_RngHW_2_0_6.libI would like to use the sha-1 from lib but from some reason I do not get the correct result.Here is my test...My input buffer is 8 bytes: 1,2,3,4,5,6,7,8============================================The result I receive (abySHA_result) from SHA-1 crypto lib is:AC A7 3F C9 71 45 CB BE 5C 41 4B 76 9E DF FD 50 6E EB 28 A9============================================The expected result is:DD 57 83 BC F1 E9 00 2B C0 0A D5 B8 3A 95 ED 6E 4E BB 4A D5============================================What am I missing???Thanks,AriHere is my code:=======================================SHA1ctx_stt SHA1ctx_st;uint8_t MyData[8] = {1,2,3,4,5,6,7,8};int DataLengthOut = 0;uint8_t abySHA_result[20];int Test_Hash(void){ int32_t status = HASH_SUCCESS; bool result; /* DeInitialize STM32 Cryptographic Library */ Crypto_DeInit(); /* Initialize context */ memset (&SHA1ctx_st, 0, sizeof(SHA1ctx_st

Posted on May 19, 2015 at 12:47I am trying out some examples of the crypto library from ST, but its not working the way it should.If I try the AES-CBC192 examples on a STM32F107 (STM3210C eval board),I can verify that the encrypted cipher text is correct, but after decryptingit does not entirely match the plain text (13 bytes in the middle, are wrong).I have tested using IAR V6.70 and V7.10.As the STM32F107 does not have any crypto hw, the computation is all done in sw, so I am also surprised that running the code in the simulator yields a totally different result (where even the encrypted result does not match the expected values) ?Has anyone here been able to verify the examples ?I know, this library is free from ST, but do they give support on it ?Thanks.Brian #stm32-crypto-lib

Posted on March 04, 2015 at 18:29Hi all, I'm using the STM32F205VBT on some boards I developed. Software development is done under Win7/x64 using Eclipse (4.4.1) with CDT (8.5.0), Toolchain is gcc 4.8.4. (arm-none-eabi). My Software Project is created with STM32CubeMX 4.6.0. and utilizes the HAL. Works fine so far, but the CRC peripheral is missing from the configuration tree in CubeMX, when building a configuration for the STM32F2xx family. CRC peripheral is supported for every other MCU family I tested, but is just missing for the one I'm using in this project. Is there anything I could do to include the HAL driver for the CRC peripheral into my STM32F205 project? Best regards, Thorsten #stm32f2xx #crc32 #gzip

Posted on April 08, 2015 at 13:09I'm trying to use the CRC peripheral on STM32F3 to calculate the CRC at byte-level but I can not get the same result as indicated in application note AN4187. The following snippet of code should return a CRC equal to 0x4C (according to AN4187) instead I get 0x80. Where is the error?             CRC->INIT = 0xFF;             CRC->CR = CRC_CR_POLYSIZE_1;             CRC->POL = 0xCB;                     CRC->CR |= CRC_CR_RESET;             CRC->DR = 0xC1; p.s. The peripheral clock has been enabled. Many thanks in advance for your help. #stm32f3-crc

Posted on March 19, 2015 at 17:16I am wondering if this was expected. I use the DFU-USB image to jump to an app on 0x800c000, but before jumping it sets the RDP/CRP level to 1 within it's main(). Then I use the Dfuse demo app to flash a new image on 0x800c000. Jumping from the DFU-USB works as expected. Question 1. In the DFU-USB mode, the Dfuse Demo app seems to be able to read the exposed internal flash. Is that normal even though CRP=1? 2. I am guessing that i can flash as many times a new image at 0x800c000 without having to reflash the DFU-USB bootloader until i change CRP level from 1 to 0 and back to 1. When i read  http://www.st.com/web/en/resource/technical/document/application_note/CD00264379.pdf, pg 11/26 there is a table which says then Read Protection is enabled DFU_DNLOAD should not be allowed. Am i reading something else? thanks for reading #rdp #stm32 #dfu #crp

Posted on October 16, 2014 at 17:32Hi all,I have a very strange issue with STM32F407ZG; sometimesthe RDP level 1 is automatically set and then using STLink Utilities I can goback to RDP level 0.BUT, Now I get RDP level 1 SET and I can't go toRDP level 0 : Seems to be Irreversible (like RDP level2).I can connect with STLink utilities, to read theoption bytes and I see RDP Level1 and I'm not able to modify it to go to RDPlevel 0.Canany one help please ? it is urgent!Thx,Franco #stm32f4 #rdp-level-1

Posted on February 23, 2015 at 17:51 I am starting using the crypto library and with a STM32F407 device I don't have the hw hash peripheral and I must use the software library My version: M4_CryptoFW_RngHW_2_0_6.a My code bool Lib_SHA1_hash (uint8_t* hash, uint32_t hash_len, uint8_t* p, uint32_t len) { SHA1ctx_stt SHA1ctx_st; bool result ; /* Initialize context */ memset (&SHA1ctx_st, 0, sizeof(SHA1ctx_st)) ; /* Set the size of the desired hash digest */ /* Set flag field to default value */ SHA1ctx_st.mTagSize = 20; SHA1ctx_st.mFlags = E_HASH_DEFAULT; result = SHA1_Init(&SHA1ctx_st); if (result != HASH_SUCCESS) return false ; result = SHA1_Append(&SHA1ctx_st, p, len) ; if (result != HASH_SUCCESS) return false ; result = SHA1_Finish(&SHA1ctx_st, hash, &hash_len); if (result != HASH_SUCCESS) return false ; return true ; } The library manual say the SHA1_Finish must return the hash value in hash buffer and the length of data written in hash buffer in

Posted on January 04, 2015 at 21:24hi every oneas you know there are many crypto libs with supporting from crypto algouritms like: AES,DES,3DES &...such as wolfssl,cyassl,cyclone ssl,stm crypto lib(for stm devices ) & ...my question is whats differents ? & why there are this plenty of crypto libs ?for encoding/decoding string of characters which is best in mbedded applications ?best wishes

Posted on December 17, 2014 at 02:50In my stm32f405 level 1 is active.I can't updata mcu flash.I need change RDP to level 0 to reprogram. Anyone can help me? thanks. #stm32f4-rdp

Posted on November 21, 2014 at 08:06Hi,I'm experiencing strange issues with a product based on STM32F407. When doing short power outages to the PCB (uses 24VAC), it sometimes erases or corrupts flash page(s) that are used for eeprom emulation. Pages are 1 and 2 from address 0x08004000. When I try to read flash with ST-link I notice that readout protection has been set to level 1 for some reason, so it's impossible to see what has happened to flash. In my application code I never call FLASH_OB_RDPConfig, so it can't go to level 1 from the application. Also the first line after systemInit() in Main locks the flash memory so I can't figure out what causes the erase.The power outage has been tested with longer power outages (couple of seconds) automatically multiple thousand times without the problem. Could anyone have a clue what causes this behaviour with short power outages? #f4xx-readout-flash-rdp

Posted on November 10, 2014 at 15:03Hi, I'm having a problem with the CMSIS peripheral library call to set Readout Protection on STM32F10x: I call FLASH_ReadOutProtection(ENABLE) I have put a flag into this function to verify that it's setting OB->RDP = 0x00 everything seems fine, except... it doesn't set readout protection.  Even after a power cycle, when I call FLASH_GetReadOutProtectionStatus() I get a result 0 This is corroborated using STLink-V2 Any ideas? #rdp #readout-protection

Posted on October 30, 2014 at 14:58I want to implement the IAR example for ST32Fx ''Calculate CRC32 as in STM32 hardware (v.5.50 and later)''  http://supp.iar.com/Support/?note=64424&from=note+11927 The problem I don't use a fix address for end of CRC check (APP change). So I don't use the drop box to fill the request parameters (*as in teh example) but the build option->Post build command line: where  I fill this: ielftool --fill 0xFF;0x08010000-checksum_end+3 --checksum ielftool_checksum:4,crc32,0x20;0x08010000-checksum_end+3 --verbose ''$TARGET_PATH$'' ''$TARGET_PATH$''. I take it from an example which use CRC16 and I think 1 of my parameters is wrong (maybe the Checksum unit size 32bit). Can someone use this methode for CRC and can tell me waht is the meaning of each varible in the command line? Reagrds bar. #crc32-iar-stm3

Posted on October 27, 2014 at 22:47I need to do a CRC calculation. So I want to use the CRC calculation unit in the MCU.It is pretty easy one. Just active the CRC clk and then invoke word into CRC->DR .I want to see if it work O.K. so I reset it to 0xFFFFFFFF and make  CRC->DR = (uint32_t)* FLASH_word_ADD; where the pointer point to a word on the FLASH. I check the result also on the CRC->DR and open an application do the CRC32 with the some polynomial: 0x4C11DB7 (standard). I reset also the unit there to 0xFFFFFFFF and put the some number show by the pointer use before to calculate. I get a different result. I check it in several CRC32 calculators but the some. I also try to enter the number LSB first but didn't help. Where am I wrong?Bar. #crc-iar-stm32f205 #crc-unit-stm32f205