STM32 MCUs Security

HiWhat is the maximum Stack and Heap size of a STM32G474VE with the SBSFU Bootloader 2 Image version?In the icf file the settings are at 0x400 and 0x200 which is really low./*-Sizes-*/ define symbol __ICFEDIT_size_cstack__ = 0x400; define symbol __ICFEDIT_size_heap__ = 0x200;

Hi,In static HAL_StatusTypeDef CRYP_TDES_Process(CRYP_HandleTypeDef *hcryp, uint32_t Timeout){ uint32_t temp; /* Temporary CrypOutBuff */ uint16_t incount; /* Temporary CrypInCount Value */  uint16_t outcount; /* Temporary CrypOutCount Value */ /* Enable CRYP */ __HAL_CRYP_ENABLE(hcryp); /*Temporary CrypOutCount Value*/ outcount = hcryp->CrypOutCount; /*Start processing*/ while((hcryp->CrypInCount < (hcryp->Size/4U)) && (outcount < (hcryp->Size/4U))) {    /* Temporary CrypInCount Value */   incount = hcryp->CrypInCount;    /* Write plain data and get cipher data */  if(((hcryp->Instance->SR & CRYP_FLAG_IFNF ) != 0x0U) && (incount < (hcryp->Size/4U)))&n

The STM32H733VGH6 datasheet specifically mentions "Bootloader with security services support (SFI and SB-SFU)," while the STM32H723VGH6 does not. Does that mean that I can't use encrypted firmware on the STM32H723VGH6?I tried to do some research, but it is hard to decipher what are hardware versus firmware requirements.

HelloIn chapter 22.4.9 of RM0434 Rev6 is stated:Counter: a 32-bit big-endian integer that is incremented each time a blockprocessing is completed. The initial value of the counter must be set to 1.Why can be the initial value of the counter not be set to 0 (as far as I know it is possible in standard)? Is this a bug?Best regardsPaul

Hi All,I am using SBSFU to load my firmware which is running from external flash. The firmware works but seem to be experiencing speed issues on the I2C communications.In an attempt to solve this issue, I am would like to, at start-up copy the code that is placed at 0x90000000 to RAM and run but not sure how to do this.Regardsooni

Hi,I find the new chip STM32G0B1 from STM32CubeMX.And I want use this chip with SBSFU 2_Images.But I can not find the STM32G0B1 project from the X-CUBE-SBSFU v2.4.0.Is STM32G0B1 compatible with X-CUBE-SBSFU v2.4.0 ?How do I use STM32G0B1 with SBSFU 2_Images?Could you help me?Thank you.

During the workshop itself, I had some problems with some of the example files not having correct access rights to allow the workshop changes to be made.We worked around that during the workshop.Now I have just come back to the STM32Cube IDE; it started up with the last 2 workshop projects still open (as would be expected). But when I tried to close these projects, I got the following errors:

HelloThe crypto HAL driver ( function CRYP_SetKey in file stm32wbxx_hal_cryp.c ) of the STM32WB accesses the key as "array of uint32_t" (lines 2919 etc):       hcryp->Instance->KEYR3 = *(uint32_t *)(hcryp->Init.pKey);       hcryp->Instance->KEYR2 = *(uint32_t *)(hcryp->Init.pKey + 1U);       hcryp->Instance->KEYR1 = *(uint32_t *)(hcryp->Init.pKey + 2U);       hcryp->Instance->KEYR0 = *(uint32_t *)(hcryp->Init.pKey + 3U);thus the key and nonce must be swapped by customer software. This is not compatible with openssl generated key nor STM32 crypto library usage on other STM32 mcus (could be declared as bug). The "CRYP_DATATYPE_8B" byte swapping only applies to cipher and plain buffer.Better would be:       hcryp->Instan

I converted code from one of the example from sbsfu for stwinkt1 board.This converted example is for 2 image and working fine on serial port.As far as i get for 2 image example configuration will like,SBSFU s;ot+1 active slot + 1 DWL slot + swap area.When i download new firmware,Encrypted image is downloaded in DWL slot and on next reset it decrypted and swapped with active slot image so after installing new firmware result will be like,before swapping,Active slot-image(decrypted) 1.0.0DWL slot  -image(encrypted) 1.0.1after swapping,Active slot-image(decrypted) 1.0.1DWL slot  -image(decrypted) 1.0.0is this understanding correct?can i roll back to older version once new one is installed(like from 1.0.1 to 1.0.0)? can i choose any slot as active firmware image?

I have some code that removes a "secure area" on STM32H75x by so called "regression" from RDP level 1 to level 0, which causes full erase.(Actually this code is based on example very kindly provided by ST support) void EraseAll(void) { uint32_t flashUserOpt; printf("Launching erase all process. Requires RDPL1 already set\n"); __HAL_FLASH_CLEAR_FLAG_BANK1(FLASH_FLAG_ALL_ERRORS_BANK1); HAL_FLASH_OB_Unlock(); FLASH->OPTSR_PRG = 0x13BEAAF0; /* RDP level 0 */ FLASH->PRAR_PRG1 = 0x80000FFF; /* No PCROP */ FLASH->SCAR_PRG1 = 0x80000FFF; /* No secure area */ FLASH->WPSN_PRG1 = 0x000000FF; /* No WRP */ OBLaunchWithCheck(); HAL_FLASH_OB_Lock(); }   void OBLaunchWithCheck(void) { HAL_StatusTypeDef error; if ((error=HAL_FLASH_OB_Launch()) != HAL_OK) { printf("HAL_FLASH_OB_Launch failed. HAL_ERROR: %d Error code : %8.8x ...\r\n", error, pFlash.ErrorCode); printf("Flash->SR1: 0x%8.8x\r\n", FLASH->SR1); } }

I am trying to create a mechanism of verification where I sign a file on the PC save it to a disk on a key device and then verify it by the MCU after saving it to internal flash.The PC is doing the signing process and the MCU should only do the verification process.On the PC side I sign the image with the pkcs1_15.sign() function from the pycryptodome library. On the MCU is the public key is saved as modulus and exponent in the following format:unsigned char RSAKeyModulus[] = { // Offset 0x00000000 to 0x00000158 0x30, 0x81, 0x9F, 0x30, 0x0D, 0x06, 0x09, 0x2A, 0x86, 0x48, 0x86, 0xF7, 0x0D, 0x01, 0x01, 0x01, 0x05, 0x00, 0x03, 0x81, 0x8D, 0x00, 0x30, 0x81, 0x89, 0x02, 0x81, 0x81, 0x00, 0xD6, 0x35, 0x43, 0x7C, 0xC9, 0x22, 0x18, 0x16, 0xF5, 0xE9, 0xB9, 0x29, 0x51, 0x80, 0x3F, 0x1D, 0xC0, 0x94, 0xCF, 0x91, 0x0D, 0x38, 0x6E, 0x83, 0x51, 0x22, 0x52, 0xC0, 0x8D, 0xBD, 0xD3, 0x21, 0x68, 0x52, 0x50, 0x39, 0x79, 0xC6, 0x6D, 0x19, 0x9B, 0x

I'm trying to port the SBSFU to STM32H735. I started from the project for the NUCLEO-H753ZI.I get errors in sfu_fwimg_core.c on FW_INFO_TOT_LEN but where is this defined?A simple grep -r turns up nothing.Thanks!

We are evaluating if we can use the STM32WLE5, to interface to existing devices .A critical factor is the expected endianness of the data. I have seen no reference in the docs if this can be set, so I have provided an example message and would like to know if this can correctly interpreted by the STM.The following sequence defines the values of bits 'in the air' as recorded on an oscilloscope. The most left bit is the first bit transmitted.10101010 10101010 10101010 10101010 These are the 4 preamble bytes. Byte value is 0x55 with LSBof each byte transmitted first00110011 01010101 00110011 01010101 These are the 4 Sync bytes 0xCC 0xAA 0xCC 0xAA in sequenceof transmission, with LSB of each byte transmitted first01000000 10000000 00000000 The first byte is the Variable Length : Value is 0x02, LSBtransmitted first. The data bytes are 0x01, 0x00, LSBtransmitted first01110100 11110110 The CRC is computed on the 3 bytes above.

Hello,one question (or feature request):I try to use the STM32 crypto library (v1.3.1 software implementation) on STM32WB. I activated the RNG and CRC but the calculated results (encryption/decryption, cmac) are not ok. Are there other things to do?Is there an hardware implementation using directly using the AES/PKA peripherals of STM32WB? Or will be there a new version of the library package?As I understood, there are only examples to use directly HAL drivers. It would be great, if the crypto library (executing on AES/PKA hardware) would be optimized using LL drivers...Is there a user manual "how to use crypto lib on STM32WB"?Best regardsPaul

Hello,I want to calculate the CRC (32 bit) of image at post build and insert it in a known location in the image.In order to do it I should perform the following steps:a) Definition of placeholder in linker script fileb) Post build steps: b.1) Calculation of image CRC (32 bit) b.2) Insert it into the placeholderThe reason of 32 bit is to use the STM32 HW CRC calculation for checking the CRC.The post build steps can be performed by IELFTOOL.Can anyone help?Yacob Hassidim.

HiI want to use the Cryptographic peripheral on the above nucleo board, in the following way.Serial message from embedded board-->H745 crypto engine-->wireless transmission-->Decrypt packet on remote x86 laptopAnd the reverse direction tooSo clearly i will need a way to duplicate the AES/DES flavor implemented on the H745 on an X86.Is there a reference C code that would give the same output on x86 (assuming the symmetric keys are exchanged during a binding process)

Hi!I'm triying to set the CRC-16-IBM: X16+X15+X2+1, but CUBEMx does not allow it. In fact, I cannot introduce any polynomial.Is it a CUBE issue? How can I introduce the CRC-16 IBM polynomial ?Thank you

..

HelloIn STM32 Crypto Library, there are function "AES_CMAC_Encrypt_Init", "AES_CMAC_Encrypt_Append" and "AES_CMAC_Encrypt_Finish" to calculate the authentication code of a plain text.How can this be done on STM32WB using the CRYP peripheral (HAL driver) ?Best regardsPaul

We are evaluating if we can use the STM32 to interface to existing devices. The critical fator is the expected endianness of the data. I have seen no reference in the docs if this can be set, so I have provided an example message and would like to know if this can correctly interpreted by the STM.The following sequence defines the values of bits 'in the air' as recorded on an oscilloscope. The most left bit is the first bit transmitted.10101010 10101010 10101010 10101010 These are the 4 preamble bytes. Byte value is 0x55 with LSBof each byte transmitted first00110011 01010101 00110011 01010101 These are the 4 Sync bytes 0xCC 0xAA 0xCC 0xAA in sequenceof transmission, with LSB of each byte transmitted first01000000 10000000 00000000 The first byte is the Variable Length : Value is 0x02, LSBtransmitted first. The data bytes are 0x01, 0x00, LSBtransmitted first01110100 11110110 The CRC is computed on the 3 bytes above. The

Hi i was wondering how i should go about implementing USB instead of UART to download the firmware in the SBSFU bootloader. I have successfully managed use USB in DFU mode to install a new firmware.

I have a workspace in CubeIDE that has two STM32F0 projects: A bootloader and an app.To be able to debug both, bootloader, and then jumping through to the app code, I made an additional Debug Configuration where I added the source folder, and the symbol file of the application.In principle, this works, and I can jump from bootloader right through my app code at source level (to land in the hardfault handler, see other thread ;) But it's in the app nonetheless)But only if I comment out my bootloader line "if (check_app_CRC()) ...".Because what I do is, as a post build step of the application, run a custom program I wrote to generate a header with e.g. CRC for the app.This is a separate file, and for update via my bootloader, I just concatenate header + app binary.But for debugging, and loading everything onto the target flash:Now, I can't add that custom header blob file to CubeIDE (Eclipse)'s Startup / Load

HiI've implemented a bootloader that receives, cache and upgrades my main program.When RDP (read out protection) is not enabled everything works as expected with no problem.If I enable RDP. And if I upload the same program as the one already on the chip theres no problem. (I combine program and bootloader together and upload them).But if I upload a changed version of program, after uploads finishes ( and restarts ) it breaks and stops working.I'm sure bootloader is working since its alright without RDP enabled. and uploaded program should not be corrupted since I verify once after writing.The only things that change between two version of program, I think, is size of program and starting address. Does enabling RDP freezes the starting address or something? any Idea?I'm using SM32f103RE.Thanks.

When I run the STM32SecuWS-material.exe installer, it tells me I need to install Java and takes me to Oracle's website. But my understanding is that Oracle Java is not free for commercial use and we would be using STMicro security in a commercial environment, so the free Java licence is not valid. Is this correct? Or has ST licenced Java for use with the programmer? In short. is it legal for me to install Java form Oracle to support the security workshop?I'm due to take the workshop on in 38 hours time.

Hello,i have a programm which is sending 2bytes + 16bit CRC from SPI2.There are two STM32F765 on my board. The test programm is generated with CubeIDE and only SPI2 initiallyzed.One MCU is calculating the crc correct and the other is not correct.(Checked with an online crc calculation website)polynom used: 0x9021Result from MCU 1(correct): 0x08 0x06 0x24 0xDCResult from MCU 2(not correct): 0x08 0x06 0x63 0xEEI have checked the register before sending, they are equal.After sending the registers are equal, the only differnce is in SPI2->DR where the calculated crc can be seen.Regards,BastianIs there a way to test if the processor hardware damaged?