Where can I find algorithm to generate license file for SFI upload to STM32U585?

[SBalo.1]

I'd like to use my own server instead of HSM card. I can't find any information how the license file is generated except the fact that it is possible as mentioned in AN5054.

Slawek

[Chloe Meunier]

Hello Slawek,

Did you try the CLI STM32CubeProgrammer commands :

BR

Chloé

[SBalo.1]

Hello Chloe,

thank you for the answer. I understand these CLI commands as getting the license from attached Smart Card Reader with HSM card inserted - or am I wrong? Both have description "...if counter is not null".

[SBalo.1]

My goal is to prepare software/server to create this file by myself - of course getting ID from programmed microcontroller and using my own nonce/AES key which were used to encrypt firmware (SFI).

[Chloe Meunier]

Hello Slawek,

" I understand these CLI commands as getting the license from attached Smart Card Reader with HSM card inserted - or am I wrong?" : In fact you need an HSM to do that.

You can't perform all these operations without any HSM.

Best Regards

Chloé

[SBalo.1 · Accepted solution]

Thank you Chloe.

I guess there is a private key in HSM card provided by ST, which is used to sign generated licence file which is then used to allow secure bootloader to receive SFI. ST wrote in AN5054 "There is no STMicroelectronics secret involved in license generation, so each firmware provider is free to choose their preferred method.", except the must for buying a limited HSM card - am I right?

Best Regards

Slawek

[Chloe Meunier]

Yes your are right.

Best Regards

Chloé

[SBalo.1]

Thank you Chloe, now it's clear.

Best Regards

Slawek