Provisioning by User Code

[martinhaefner9]

Hi,

is there a possibility to do the complete chain to product state "closed" by non secure user code ?

I have a custom bootloader which usually did a set of the old RDP Level.

Now, with a STM32H57 device we have to use the new product state.

I'm able to set the state to provisioning. But when i use 

RSSLIB_PFUNC->NSC.DataProvisioning i end up in a hard fault.

I tried to set the provisioning data by ST Cube programmer later on which succeeded. But unfortunately i can not regress to open because the password is wrong.

Any hints about that ?

Thanks in advance.

[Jocelyn RICARD]

Hello @martinhaefner9,

I confirm that today, with STM32H573 you cannot provision the Debug Authentication through the firmware when TrustZone is disabled.

The reason behind is that DA is encrypted in secure state when you use the provisioning process through programmer.

As your code runs with TZ disabled in non secure state, the derived key generated by DHUK is not the same.

This issue is fixed on more recent STM32H533. It will also be fixed on STM32H573 but on next cut but it is not planned yet.

Here are the possible solutions I can think of:

1) Use the "standard" provisioning process provided by programmer. This provisioning is now supported by many third party programmers. This would be the less impacting for your firmware but depends on actual support by your programming tool.

2) Enable TrustZone. In this case, you will need to make adaptations to your firmware. Either you leave all your firmware on secure side or Secure + non secure

• In case of one secure application, every peripheral you are using should be allocated to secure
• In case of Secure + non secure you will have to manage the provisioning in the secure application and jump to the non secure application that is your firmware. 

I think the first solution : full secure is the easiest way to go. With such solution, the DA encryption by the firmware will work because it will use same DHUK as the one used when launching regression.

3) Use STM32H563: This chip does not use encryption, so no issue. But I guess you are using STM32H573 for its hardware cryptography capabilities

4) Use STM32H533: Here it depends if your firmware first inside 512 KB flash which I guess again is unlikely.

Best regards

Jocelyn

[martinhaefner9]

Hi @Jocelyn RICARD 

thanks for the clarification.

So I deciced to go for having a secure application which will do the provisioning and then jump to the non secure app.

Unfortunately i struggling enabling TZ in the user option bytes.

Are there any steps to do beside/before ?

Device is in non secure "Open" mode.

Thanks in advance

[martinhaefner9]

Ignore my last question please, that was an failure done by myself

[martinhaefner9]

@Jocelyn RICARD am I right if i have enabled TZ i have to use DA by certificates ?

[Jocelyn RICARD]

Hi @martinhaefner9 ,

Yes you get it right.

TZ Disabled: only password possible, and only regression can be triggered using DA

TZ enabled: only certificates possible: Regression/Partial regression/Debug reopening can be triggered

Best regards

Jocelyn