hello again @jk.1
indeed RSS provides runtime services and it is immutable .
for more information about this topic and the SFI and secure boot refer to RM0456 sections 3.1,3.3,3.5 and AN4992 . the RSS services are described in the section 6.6 of RM0438 .
the key generation can be done by various tools like openSSL or python scripts using the cryptographic library .If you are basing your project on the TFM package or an other project in the STM32CubeL5 package. You can modify the keys by following this instructions:
-The default asymmetric key (RSA or ECDSA) is taken from Middlewares/Third_Party/trustedfirmware/bl2/ext/mcuboot/keys.c and is embedded in the provisioned data area in the secure boot and secure firmware update binary.
- The AES-CTR key is encrypted (RSA-OAEP or ECIES-P256) and provided in the firmware image itself. The default asymmetric key (RSA or ECDSA) used to encrypt the AES-CTR key is distinct from the signature key, but also taken from Middlewares/Third_Party/trustedfirmware/bl2/ext/mcuboot/keys.c.
After generating the keys by one of the tools mentioned above you can modify them in the keys.c file.
A full guide for the implementation of TFM can be found in the UM2671 sections 9 and 10.
I hope this answers your requests .
Hichem.
