STM32 MCUs Security

Hi,We’ve been trying to implement secure-boot on our STM32H573-based device and the new code boots fine when the product state is OPEN. From what I understood, the PROVISIONING state does not boot the user code, and we thus need to put the device in iRoT-Provisioned to see if our boot chain works as expected.More info about our setup: Part: STM32H573AIIxQ DBGMCU_IDCODE (0x44024000): 0x10076484 Boot: STiRoT (BOOT_UBE=0xC3), TZEN=0xB4 Layout: secure app at 0x0C000400 (24 KB), non-secure app at 0x08006400 Software: STM32CubeMX-generated project, STM32Cube H5 HAL Debug: ST-LINK + OpenOCD, debug authentication (certificate chain), session reports Secure stateBack to the topic, I can see that te PKA register interface is fully alive, but the PKA compute engine never starts once thedevice is in iRoT-Provisioned product state. HAL_PKA_Init() spins in PKA_WaitOnFlagUntilTimeout() waiting for PKA_SR.INITOK, times out after 5 s, and the application lands in Error_Handler().The exact same binary a

Hi Community,I’m provisioning an STM32H573 (installed on a NUCLEO-H563ZI board; I replaced H563 with H573). I followed the ST example STiRoT_OEMuROT from STM32Cube FW H5 v1.6.0. During provisioning the script aborts with:Error when trying to Set SECBOOT_LOCK option byte to 0xC3 (unlock secure boot address)  Provisioning aborted.Environment: - MCU: STM32H573 (2 MB flash)- Host tools: STM32_Programmer_CLI v2.19.0- Product state chosen in provisioning script: OPEN.after i read the option bytes using STM32_Programmer_CLI -c port=SWD -ob displ i found that,   Product state: PRODUCT_STATE: 0xED (Open) BOR Level: BOR_LEV : 0x0 (BOR Level 1, the threshold level is low (around 2.1 V)) BORH_EN : 0x0 (0x0) User Configuration: IO_VDD_HSLV : 0x0 (0x0) IO_VDDIO2_HSLV: 0x0 (0x0) IWDG_STOP : 0x1 (0x1) IWDG_STDBY : 0x1 (0x1) BOOT_UBE : 0xC3 (ST-iRoT (system flash) selected) SWAP_BANK : 0x0 (0x0) IWDG_SW : 0x1 (0x1

Hello, I’m working on STM32H533 project with trust zone and secure and non-secure firmware.The project has an OCTOSPI external flash w25q64jvssiq memory, configuring the OCTOSPI in the non-secure side. I have configured the SAU unit for memory mapped mode, gice access to the OCTOSPI from the secure side with HAL function: HAL_GTZC_TZSC_ConfigPeriphAttributes(GTZC_PERIPH_OCTOSPI1,GTZC_TZSC_PERIPH_NSEC | GTZC_TZSC_PERIPH_NPRIV); At the non-secure side I can write/read the memory using QSPI instruction. Also I can change to memory mapped mode and have access with debugging tool (uVision).When I change to memory mapped mode and use any instruction to acces directly to memory an interruption occurs and give back to secure side on SecureFault_Handler showing AUVIOL violation.  Attached you can find the SAU configuration file, made by myself because STM32CubeMX does not make any change in the file, like this post:  So, obviously I missed something or I’m doing some mistake, I need help ASAP t

Hi everyone,I am working with an STM32U5 device and have enabled TrustZone (TZEN = 1)  using STM32PROGRAMMERI created both the Secure and Non-Secure projects, and they compile and program successfully.ProblemAfter downloading the firmware from STM32CubeIDE:Programming completes successfully. The application does not start automatically. My LED does not blink.However:If I press the hardware RESET button, the LED immediately starts blinking. If I start a Debug session, the LED also starts blinking.So the firmware itself appears to be correct because it works after a reset.What I have verifiedTrustZone (TZEN) is enabled. Secure and Non-Secure projects are generated by CubeMX. Secure project jumps to the Non-Secure application. Programming finishes without any errors. The issue only occurs immediately after programming. Without TrustZone, the application starts automatically after programming.My questionIs this expected behaviour with STM32U5 TrustZone?Has anyone experienced the same issue

Hello!I a new in this.I have two sets of DA files: for password access and for access via certificate.I've tried to flash a NS-firmware, provision a password.obk, then change Product state to Provisioned/closed. Thas was successful. I can perform a regression from this state.But i also tried to open a debug session. Without success. CubeProgrammer says, that I am able to make full regression only, while Cube IDE asks for certificate DA.I know, that certificate auth method is valid with TZEN=1 only, but I tried to provision that obk with TZEN=0.As a result, I Have this:The default ST password from CubeProgrammer's folder is not working,I tried to provide all-zeros and all-FF password without success.But maybe I need to change something in the header. Or change a password length.So, 3 questions:1. Is this device totally bricked, or I can some-how calculate a password.bin2. How to perform debug in closed product state on STM32H563 if TZEN=0 ?3. How to perform debug of the the secured

Hi ST,I’ve run into a whole lot of issues adding interrupt-based UART to your OEMiRoT w/ Trustzone example on a NUCLEO-U385RG-Q.As you may know this example is not compatible with CubeMX, and it’s not clear which steps are needed to manually incorporate UART4 so that it activates an interrupt on receipt of input when running in the Non-Secure region of code. The idea is to only access the Secure region when needing to utilise certain sensitive variables, called from within a Non-Secure function.Let’s take this opportunity to establish a step-by-step guide for someone who isn’t (yet) an embedded professional, please excuse my ignorance if this already exists, I’d be just as happy to be directed there. My settings so far are:1. Secure/Inc/partition_stm32u385xx.h: Initialise UART4_IRQn as Non-Secure#define NVIC_INIT_ITNS2    1#define NVIC_INIT_ITNS2_VAL      0x000000012. Secure/Src/main.c: Define UART4 pins (CN7 1 & 2, or PC10 & 11) as NonSecureHAL_GPIO_ConfigPinAttributes(GPIOC,

Hello, I am currently performing an ISO 13849-1 assessment and creating a SISTEMA model for a chemical dosing system.The safety-related control architecture includes a STM32F767BI. I have reviewed:- STM32F767 datasheet- STM32F7 Safety Manual (UM2318)- STM32F7 self-test library documentation The Safety Manual references:- AN5132 (FMEDA results)- AN5137 (FMEA results) However, these documents do not appear to be publicly available. I am looking for guidance on the following: 1. Is there an official FIT value, failure rate, PFHd or MTTFd available for the STM32F767 family?2. Are AN5132 and AN5137 available through ST support or under NDA? Thank you.

Our team is looking to implement an application based on the upstream Trusted Firmware M (TF-M) framework (https://git.trustedfirmware.org/TF-M/trusted-firmware-m.git/) to take advantage of the latest security capabilities provided by the framework.    But we’ve found that with the latest TF-M LTS release, 2.3.x, support for the HW cryptographic acceleration peripherals of the STM32U5 has been removed, due to the migration from mbedTLS to TF-PSA-crypto library.Are there any plans for STM to implement support for crypto HW acceleration for STM32U5 in TF-PSA-crypto and TF-M 2.3.x?

Hi!SetupMCU: STM32H573 (Cortex-M33, TrustZone enabled) Secure world: STM32 Secure Manager via SMAK, product state CLOSED Non-secure app: CycloneTCP / CycloneSSL / CycloneCRYPTO (Oryx Embedded) Use case: HTTPS server on a networked device with a long-lived device identity key that must never leave the secure world, plus automated certificate renewal (EST/ACME)What I understand so far!!!mbedTLS consumes the PSA Crypto API natively (MBEDTLS_USE_PSA_CRYPTO plus mbedtls_pk_setup_opaque()), and wolfSSL has partial PSA support via WOLFSSL_HAVE_PSA. Both therefore let the private key stay inside Secure Manager while the non-secure application holds only a psa_key_id_t handle.CycloneCRYPTO has no PSA backend as far as I can tell. Instead it ships register-level STM32H5 ports (stm32h5xx_crypto_pkc.c, stm32h5xx_crypto_cipher.c, stm32h5xx_crypto_hash.c, stm32h5xx_crypto_trng.c) that drive PKA, AES/SAES, HASH and RNG directly. That looks like a direct conflict with Secure Manager, which claims seve

For STM32U575/U585, the STM32U5 Customer Webinar says that the 256-bit BHK is “Generated by the secure boot code”. Is the intended implementation to generate 256 bits from the STM32 RNG when the BHK backup registers are uninitialized, or should secure boot restore/derive BHK from a persistent OEM-provisioned secret? Is there ST reference source code implementing the generation, TAMP_BKP[7:0]R write, and BHKLOCK sequence?

H I am a firmware engineer working on industrial power supply products. Our device needs to comply with IEC 62443 industrial cybersecurity standards (target SL2/SL3). We plan to adopt a dual-MCU architecture for this project: STM32G4: Responsible for real-time power control, protection logic and analog front-end processing. This series fully meets our requirements for power-related functions, but lacks sufficient native security features to satisfy IEC 62443 independently. STM32U5 or STM32H5: Dedicated to network communication, secure boot, TLS/IPSec encryption, secure data storage, firmware encryption and remote update, undertaking all cybersecurity functions required by IEC 62443. Both STM32U5 and STM32H5 are based on Cortex-M33 core. There are clear positioning differences between them. I would appreciate your advice on the following questions: For industrial power supply applications with network access and long-term firmware maintenance, whi

Hi,I'm using a STM32H743II.The product will communicate to server using the LwIP (TCP Layer) + MbedTLS (SSL/TLS Layer), running over FreeRTOS environment.We want to use the latest TLS protocol standard (TLS Version 1.3).We are currently using MbedTLS version 3.6.1 which supports TLS1.3, but we can only get TLS 1.2 to work.Are there any example projects where TLS 1.3 is used that we can use?BRJonas

We are interested in incorporating the STSAFE-A120 authentication chip (part number: STSAFA120S8SPL05) into our current design. However, the available datasheet lacks the necessary details for firmware development. We would highly appreciate your help and guidance on this matter. 

I am working on a project on a STM32H563 with trustzone enabled. Our firmware update strategy relies on using the dual bank flash and swapping when needed. I was wondering if you can set the SWAP_BANK option byte and trigger a bank swap from non-secure code with SECBOOT_LOCK not set?. I am asking because do not I want a hacked non-secure application to be able to trigger a bank swap to potentially untrusted code on the other bank. I could not find a clear answer in the reference manual.

I am working with the official X-CUBE-SBSFU package and I need to port the example that is provided for NUCLEO-H753ZI (STM32H753ZI) to my custom board based on STM32H733ZGTX.This is the closest official example available for my MCU. There is no .ioc file and the whole project structure (SECoreBin + SBSFU + UserApp) is built specifically for the H753ZI.I have already read AN5056 (Integration guide for the X-CUBE-SBSFU). It explains the hardware adaptations and especially the memory mapping changes (mapping_sbsfu / mapping_fwimg), but it does not give a clear step-by-step procedure for changing the target MCU itself (startup files, linker scripts, CMSIS device headers, project settings, etc.).Could someone from ST or the community please advise on the recommended and proper way to perform this port?Specifically I would like to know:The correct sequence of steps to change the target device from STM32H753ZI to STM32H733ZGTX in the three projects (SECoreBin, SBSFU, UserApp). How to properly

I am using Azure RTOS NetX Secure / NetX Duo on an STM32U585 for TLS client communication and would like clarification regarding certificate chain verification.I have the following scenario:The TLS server sends a valid server certificate. The server also sends an expired intermediate CA certificate as part of the certificate chain. The client has a valid copy of the same intermediate CA certificate stored locally and added using nx_secure_tls_local_certificate_add(). The trusted root CA is also configured in the TLS trusted certificate store.During debugging, I observed the following:_nx_secure_tls_process_remote_certificate() correctly parses the certificates received from the server. Wireshark also confirms that the server is sending the expired intermediate certificate. _nx_secure_x509_remote_endpoint_certificate_get() correctly identifies the remote endpoint certificate. During _nx_secure_x509_certificate_chain_verify(), NetX calls:_nx_secure_x509_store_certificate_find() to locate

Hello everyone,I am trying to use TLS 1.3 with Mbed TLS on an STM32H573 through the Secure Manager’s Global PSA API.At the moment, I am seeing the following errors: psa_sign_hash() / psa_sign_message()→ PSA_ERROR_NOT_PERMITTEDpsa_generate_key() / psa_import_key()→ PSA_ERROR_GENERIC_ERRORThe persistent ECC keys are provisioned with the required signing permissions, and both the Secure Manager and the non-secure application start correctly.Some TLS 1.3 HKDF operations had to be implemented locally because the PSA Crypto API version in use is 1.0 and does not provide separate HKDF-Extract and HKDF-Expand algorithms.My questions are:Are persistent ECC keys supported with psa_sign_hash() through the Global PSA API? Does the Secure Manager support volatile keys with psa_generate_key() and psa_import_key()? Are additional permissions or a Secure Module required? Is there a support matrix or an official TLS 1.3 example for this setup? Does anyone have experience with Secure Manager and MbedTLS

Hello ST Community,I am facing a critical issue while configuring OEMiRoT on an STM32H523 device. I used the official provisioning project from the NUCLEO-H533RE example in STM32Cube_FW_H5_V1.7.0 (since there is no dedicated H523 example). I need help recovering the device.Background: I‘ve modified the <DoEncryption> value to 0 according to ‘How to create ROT examples for STM32H5’. I ran the provisioning project (from the NUCLEO-H533RE example) to configure OEMiRoT on the target STM32H523 device. During provisioning, the configuration failed and the product state became Provisioned. After that, the device could no longer be connected via ST-LINK SWD. DA also failed. Then I regenerated a new Key file to confirm if there was any problem during the configuration process. I still have the private key file key_1_root.pem . But the public key file key_1_root_pub.pem and certificate file cert_root.cert have been overwritten. So I tried the method provided by the AI assistant to

Hello,I am using an STM32H573 with Secure Manager and Mbed TLS / PSA Crypto for a TLS 1.3 implementation.Persistent private keys provisioned into the Secure Manager work correctly. For example, I have a persistent P-256 private key provisioned through the ITS Factory Blob and can successfully use it for ECDSA signing.The problem occurs when Mbed TLS tries to dynamically generate temporary keys during the TLS 1.3 handshake.For example, a call similar to: psa_key_attributes_t attributes = PSA_KEY_ATTRIBUTES_INIT;psa_key_id_t keyId;psa_set_key_type( &attributes, PSA_KEY_TYPE_ECC_KEY_PAIR(PSA_ECC_FAMILY_SECP_R1));psa_set_key_bits(&attributes, 256U);psa_set_key_usage_flags( &attributes, PSA_KEY_USAGE_DERIVE);psa_set_key_algorithm( &attributes, PSA_ALG_ECDH);status = psa_generate_key( &attributes, &keyId);returns: PSA_ERROR_NOT_PERMITTED-129The same behavior can also be reproduced with dynamically generated AES keys, so it does not seem to be s

The following repository contains examples for creating 'normal' type of external loaders, i.e., to be used with the "-el" argument of the STM32CubeProgrammer (e.g., with output "STM32CubeProgrammer/bin/ExternalLoader/MX66UW1G45G_STM32H7S78-DK.stldr"):https://github.com/STMicroelectronics/stm32-external-loader Where can the source code examples be found for the 'SFIx' type of external loaders, i.e., to be used with the "-elbl" argument of the STM32CubeProgrammer (e.g., with output "STM32CubeProgrammer/bin/ExternalLoader/MX66UW1G45G_STM32H7S78-DK-SFIx.stldr")?

So have an STM32H563 that I was trying to get to work with DFU. I read through the Docs and saw that for that to work I needed PRODUCT_STATE in Open with Boot Pin high or PRODUCT_STATE in Providing. I tested the first option and couldn’t get that working and so figured to test if the Boot Pin was the issue I set the PRODUCT_STATE to Providing. It still didn’t work, however the more important issue now is when I was trying to set it back to Open it wouldn’t let me do that. I then flailed a little and think I may have set the PRODUCT_STATE to Closed or Off or something and saved that. Now, I can’t get back into the chip at all. I get either this error:  Or if I try it in Under Reset mode I get this error: So Im wondering, did I completely brick this chip, is there a way to check that, and if I didn’t, what can I do to get this to let me back in

On an STM32L552ZE with TZEN=1, RDP=0xAA (Level 0) and BOOT_LOCK=1, the STM32CubeProgrammer command -rdu reported success while explicitly stating that no option byte was modified. From that command onward the device is permanently inaccessible: DAUTHSTATUS shows secure invasive and non-invasive debug disabled, every FLASH register (secure and non-secure alias) fails even on read, and the documented RDP regression path (RDP=0xBB → RDP=0xAA TZEN=0x0) can no longer be executed because option byte programming requires those registers.We would like to understand whether this is expected behaviour, and whether any recovery path exists.Hardware and toolsItem Value Device STM32L552ZE-Q on NUCLEO-L552ZE-Q Device ID 0x472, Revision ID Rev Z (DBGMCU_IDCODE = 0x20016472) ST-LINK onboard, firmware V2J48M35 (also reproduced with V2J47M34) STM32CubeProgrammer 2.23.0 (also reproduced with 2.22.0) Supply 3.26–3.27 V, separate USB port BOOT0 (PH3) tied to VCC during all operations de

Hello,I am integrating Mbed TLS with TLS 1.3 on an STM32H573 using the STM32 Secure Manager PSA interface.The TLS 1.3 handshake fails at: psa_key_derivation_setup( &operation, PSA_ALG_HKDF_EXTRACT(PSA_ALG_SHA_256));The returned status is: PSA_ERROR_NOT_SUPPORTED /* -134 */I tested the relevant algorithms separately: PSA_ALG_HKDF(PSA_ALG_SHA_256)→ PSA_SUCCESSPSA_ALG_HKDF_EXTRACT(PSA_ALG_SHA_256)→ PSA_ERROR_NOT_SUPPORTEDPSA_ALG_HKDF_EXPAND(PSA_ALG_SHA_256)→ PSA_ERROR_NOT_SUPPORTEDThe generated algorithm ID is correct: PSA_ALG_HKDF_EXTRACT(PSA_ALG_SHA_256) == 0x08000409UI also traced the call through the Non-Secure PSA client. The request reaches the Secure Manager via nscall(), and PSA_ERROR_NOT_SUPPORTED is returned in psa_reply->status.My questions are:Does STM32 Secure Manager support PSA_ALG_HKDF_EXTRACT and PSA_ALG_HKDF_EXPAND? Is support dependent on the Secure Manager or SMAK version? Is TLS 1.3 with Mbed TLS officially supported with Secure Manager as PSA backend? Is

Hello,I have taked a look at this post:  I’m trying to do same at a H533 project: a non secure App (without trust zone), I have the same issue, the example works well, but when I try to use without secure image the example doesn’t work. Will be great to have support from ST.Kind regards

Using on a STM32H563RI with trustzone for a secure bootloader and non-secure application. Both the secure and non-secure side were correctly working in OPEN state, and I did a test of going to a CLOSED state and regression back to OPEN with authenticated debug. After the regression, RTC_EnterInitMode(), times out trying to enter init mode and HAL_RTC_Init() fails. I tried the solution from this form post of calling HAL_PWR_EnableBkUpAccess() and that did not work.Notes:- Trustzone and the secure watermarks for the bootloader were reprogrammed in the option bytes after regression.- RTC is LSI as its clock source.- The call to HAL_RCCEx_PeriphCLKConfig() in HAL_RTC_MspInit() returns HAL_OK.- The RTC pheripheral is marked non-secure.- The code has not been changed since preforming the regression and was working previously. The RTC Init Code and Clock configs are included below.void MX_RTC_Init(void) { /* USER CODE BEGIN RTC_Init 0 */ /* USER CODE END RTC_Init 0 */