The BHK mystery on the U5 - who generates it?

[CJone.1]

For STM32U575/U585, the STM32U5 Customer Webinar says that the 256-bit BHK is “Generated by the secure boot code”. Is the intended implementation to generate 256 bits from the STM32 RNG when the BHK backup registers are uninitialized, or should secure boot restore/derive BHK from a persistent OEM-provisioned secret? Is there ST reference source code implementing the generation, TAMP_BKP[7:0]R write, and BHKLOCK sequence?

[Jocelyn RICARD]

Hello ​@CJone.1 ,

The purpose of the BHK is to have a key that can be erased automatically upon Tamper detection.

This means that if device on the field is attacked, and this attack is detected through tamper, then anything that was encrypted using this key will be safe.

The usual way is to provision BHK at very first boot of application after production. The application detects that BHK was not provisioned yet, so generates a random number, writes the 256bits and lock it. The key will stay during the life time of the device as long as RTC is powered.

Another usage of this BHK is to store securely a known key shared among several devices. To provision this known key you need to implement a secure mechanism to transfer this secret key to the device and lock it.

I join an example if BHK provisioning and usage.

In this example I use BHK to wrap a known key. Then I use this wrapped key to encrypt and decrypt known buffers to show how things work.

I hope this will help

Best regards

Jocelyn