Decrypting custom OBKey data provisioned with the HUK on the STM32H533

[MichaelWaites]

Hi,

I'm currently experimenting with the decryption of custom data provisioned into the OBKeys storage with hardware encryption enabled.

I've successfully provisioned the data without encryption and read it back intact.  With encryption enabled, I see that the data that I read back is different after every new provisioning/code change attempt which is as I expect, but I have not successfully decrypted it.  My code is based on code in low_level_obkeys.c from one of the Nucleo H533RE OEMiROT_Boot application examples.  Here's my code with error checking removed for compactness (no errors are returned, the code runs fine, just the output is not correct).  Note: temp_data contains the encrypted data exactly as read from the OBKeys region.  Once I get this working, I guess I'll just try decrypt directly from the OBKeys region.

CRYP_HandleTypeDef hcryp = { 0U };
uint32_t a_aes_iv[4] = {0x8001D1CEU, 0xD1CED1CEU, 0xD1CE8001U, 0xCED1CED1U};

__HAL_RCC_SBS_CLK_ENABLE();
__HAL_RCC_SAES_CLK_ENABLE();
WRITE_REG(SBS_S->EPOCHSELCR, SBS_EPOCHSELCR_EPOCH_SEL_0);

hcryp.Instance = SAES_S;
HAL_CRYP_DeInit(&hcryp);
hcryp.Init.DataType  = CRYP_NO_SWAP;
hcryp.Init.KeySelect = CRYP_KEYSEL_HW;  /* Hardware unique key (256-bits) */
hcryp.Init.Algorithm = CRYP_AES_CBC;
hcryp.Init.KeyMode = CRYP_KEYMODE_NORMAL;
hcryp.Init.KeySize = CRYP_KEYSIZE_256B; /* 256 bits AES Key*/
hcryp.Init.pInitVect = a_aes_iv;

HAL_CRYP_Init(&hcryp);
HAL_CRYP_Decrypt(&hcryp, (uint32_t*)temp_data, (uint16_t)(sizeof(temp_data) / 4U), (uint32_t*)obkey_data, 100);
HAL_CRYP_DeInit(&hcryp);

I've tried different options for the Algorithm (ECB and CTR), I've tried DataType as BYTE_SWAP and I've tried leaving the InitVect as null (I don't know what the magic numbers in a_aes_iv represent, I suspect they are memory addresses and figure this could be the root of my problem.

My data is stored in OBKeys Level 1 at 0x0ffd0160, right after the DA certificate data.  As mentioned before, I can read it back and see the same values as I get in the CubeProgrammer Device memory tab after debug authentication.  My process for running the code is to write the application to the device when it is 'Open', activate TrustZone, change the Product State to Provisioning and accept the offer for the default DA certificate, provision my custom data, change the Product state to iRoT-provisioned.  All performed using CubeProgrammer GUI.

What am I doing wrong here?  How do I decrypt custom data using the HUK?

Best regards,

Michael Waites

[Jocelyn RICARD]

Hello @MichaelWaites ,

could you please make sure that SAES device is allocated to secure ?

By default all peripherals are non secure.

Basically you should have something like:

__HAL_RCC_GTZC1_CLK_ENABLE();
HAL_GTZC_TZSC_ConfigPeriphAttributes(GTZC_PERIPH_SAES, GTZC_TZSC_PERIPH_SEC|GTZC_TZSC_PERIPH_PRIV);

Best regards

Jocelyn

[MichaelWaites]

Hi @Jocelyn RICARD ,

I did not have those settings you suggested, so to try ensure all settings are correct, I've started a new project in CubeIDE with TrustZone enabled and configured the minimum settings that I believe I need to make the test work.

CubeIDE generated the ConfigPeriphAttributes calls (for SAES and RNG) but did not seem to generate a call for GTZC1_CLK_ENABLE, so I added that myself.

All my previously posted code and process are the same, but I still do not manage to decrypt the OBKey data correctly.

Does anything look wrong in the code I posted above, or my process?

Thanks,

Michael