SFI Process

Hitesh_Aratek · ‎2024-08-16

Hi Team,

Am using STM32H573I-DK board
Can i get any document or explanation that how SFI is processing and what are the keys involved in encryption and authentication.
I already referred AN4992 and wiki pages but the process is not so clear.

CMYL · ‎2024-08-16

Hi @Hitesh_Aratek

Question 1: SFI Process

2. HSM Card Provisioning

Tools Required: STM32 Trusted Package Creator (STPC)
Files Needed: HSMv2 smartcard

Provision the HSM card via the STPC tool. This step ensures that the HSM card is ready for secure firmware installation (AN5054).

Perform SFI Process

Tools Required: STM32CubeProgrammer
Files Needed:
- Encrypted firmware
- HSM card (if required)
- STMicroelectronics global license file

Use the STM32CubeProgrammer to perform the SFI process. This involves programming the encrypted firmware onto the STM32H573I-DK board.

Question 2: The Keys Involved in Encryption and Authentication are as follows:

128-bit AES Encryption Key

Used to encrypt the OEM firmware.
Ensures that the firmware is securely encrypted before installation.

96-bit Nonce

A unique number used once to ensure the encryption process is secure.
Prevents replay attacks by ensuring that each encryption operation is unique.

Random Key Area File (Optional)

Provides additional randomness to the encryption process.
Enhances the security of the encrypted firmware.

OBKey Files (Optional)

Used for device configuration.
Ensures that the device is configured correctly for secure firmware installation.

STMicroelectronics Global License File

Required for the SFI process.
Ensures that the firmware installation is authorized and secure.

Hope this is helpfull

Best Regards,

Hitesh_Aratek · ‎2024-08-17

@CMYL
Thanks for the info. Can we have any document/ presentation material for the communication between RSS and RSSe Lib protocol for secure SFI communication.