Encrypt custom OBKey data provisioned with the HUK on the STM32H573

[Vishal58]

I am looking on how to encrypt my OBKey data using HUK during provisioning.

HUK is device specific then how can we give this HUK Key to Trusted package creator to download the OBKey data?

[STea]

Hello @Vishal58 ,

You can check this knowledge article How to enable RDP-like product state flash protect... - STMicroelectronics Community which will help you with OBkey provisioning steps if you want to use HUK, you could not access HUK directly but Derived key from RHUK can be used to encrypt keys and data see this wiki page which can help you understand this more clearly :Security:Secure Storage for STM32H5 - stm32mcu.
Regards

[Vishal58]

 Hi @STea ,

I have below queries regarding usage of OBK/secure storage area and how we  can use this feature in our product.

1) When you say DHUK can be used to encrypt keys, is this encryption done through software running on the controller ? If that is the case I am not checking encryption using software running on the controller.

I wanted to encrypt my secure data using HUK/DHUK/RHUK and program into the controller during production.

Is it possible and how ?

2) Also If a hacker wants to read the secure data in OBK Area If he can mimic as secure application then he can read the secure data decrypt and read the secure data as he is running the application in secure zone and the same hardware. How can we avoid this situation? 

3) In the wiki page Security:Secure Storage for STM32H5 - stm32mcu. it is given that DHUK's are different for every HDPL level and is based on RHUK. I guess using DHUK to encrypt the secure data is also through software running on the controller not during production or provisioning (writing secure data in OBK area by encrypting using HUK/DHUK/RHUK). Please confirm.

 

[Vishal58]

Hi ,

I was going through the UM2238 User manual for STM32 Trusted Package Creator tool software description and found that the xml file used to config the obk has doencryption parameter based on which DHUK key will be used for encrypting and decrypting the secure data by RSS Lib present in the controller RSS-system boot. Please confirm if my understanding is correct ?

Also using the attached example xml file we can download the authentication secure, non-secure and encryption keys in OBK area.

So if user wants he can edit the xml files to provide data inputs to create his own obk file ?