STM32 MCUs Security

I am trying to adapt an existing project that uses Keil RTX5 (RTOS2) which was written in C++ to include SBSFU functionality. So far I have got the project to build. However I am not sure about the integrity of the build as Micro-lib does not support C++ so I had to exclude it in other to get the project to build. Although the UserApp project that was part of the SBSFU example code had Micro-Lib enabled by default so not sure what impact this might have on the whole project.When I run the code I get the following error WARNING: A Reboot has been triggered by a Watchdog reset!My question has anyone been able to use any RTOS preferably the Keil RTX5 the with SBSFU and if so how did you go integrating.On enabling the RTOS it adds the following 3 function which conflicts with the default generated one in stm32h7xx_it.c./** * @brief This function handles SVCall exception. * @param None * @retval None */

Listen, I have chosen the day that had a plenty of free seats! First I have chosen another day but the system replied that this day is full, then I've chosen another one which was OK. Now I am simply thrown away from the event! WTF? Who do you think I am to beleive this ********?

Hello, there,I need CRC8 in my design. Thinking with the Polynomial programmability in Stm32G4 . It should be straight forward.When I tried to test with the example "CRC_UserDefinedPolynomial" coming with stm32cube_fw_g4_v130 in "Examples_LL" folder, the result (0xA6) matches the "expected value" set in the code.However, when the same group of the data is tested with other CRC calculator for Poly 0x9B, eg. https://crccalc.com/, the result is 0x88 instead of 0xA6. Then I tried another example (different data set 0x1, 0x2, 0x3, 0x4) with HAL, the result doesn't match either.

Hi,According to the document "AN5056-Integration guide for the X-CUBE-SBSFUSTM32Cube Expansion Package" Table 3. SBSFU code size reduction,In project "NUCLEO-G071RB", I build "1_Image_SECoreBin" by modify SECBOOT_CRYPTO_SCHEME from "SECBOOT_ECCDSA_WITH_AES128_CBC_SHA256" to "SECBOOT_AES128_GCM_AES128_GCM_AES128_GCM", and find "SECoreBin.bin" size reduce about 9 Kbytes.But I clean and build "1_Image_SBSFU", the "SBSFU.bin" size not change.Why the "SBSFU.bin" size not reduce?Thanks.

I am using STM32F0 , F1 , F4 series of MCU now i want to apply encryption for protecting my firmware so i want to know which encryption is best for this purpose?

I am trying to build SBSFU V2.3.0 on STM32L496G-DISCOVERY board. I can build SeCoreBin and SBSFU. Flashed into board. All fine and it comes up over serial usb. However I am having trouble building the user app to exercise flashing. I am building on system workbench. The build is fine but it fails running the post build scripts: Building target: UserApp.elfInvoking: MCU GCC Linkerarm-none-eabi-gcc -z max-page-size=8 -mcpu=cortex-m4 -mthumb -mfloat-abi=hard -mfpu=fpv4-sp-d16 -L"/ml/Users/MAGICLEAP/rabd/Downloads/STM32CubeExpansion_SBSFU_V2.3.0/Projects/32L496GDISCOVERY/Applications/2_Images/2_Images_SBSFU/SW4STM32/STM32L496G-Discovery_2_Images_SBSFU/Debug" -specs=nosys.specs -specs=nano.specs -Xlinker -L ../../../../Linker_Common/SW4STM32 -T"../STM32L496AGIx_FLASH.ld" -Wl,-Map=output.map -Wl,--gc-sections -o "UserApp.elf" @"objects.list" -l:se_interface_app.o -lmFinished building target: UserApp.elfmake --no-prin

I have filled request form for X-Cube-SBSFU software. Later I get the download link.When I clicked the download link first I login with my account. There were not a downloda link in that page It seams Validating One day later When I login again Validating changed as Request Software as seen below

I would like to extend the GCM example in STM32CubeExpansion_Crypto_V3.1.0 to be able to encrypt messages over a wired bus. Every message should contain an authentication. So the encryption of every message begins with AES_GCM_Encrypt_Init, and ends with AES_GCM_Encrypt_Finish. My problem is: Using the same initialization vector for every message would degrade security. So I need to obtain the the correct IV (according to the standard) to be used for the next call of AES_GCM_Encrypt_Init. There is no method in the API to retrieve the current vector value. I guess it is stored inside AESGCMctx_stt.amIv, but as an uint32_t-array (AES_GCM_Encrypt_Init needs an uint8_t-array as IV-parameter). Of course I could convert this, but is this really the meaning?

I build Projects "NUCLEO-G071RB" in X-CUBE-SBSFU and load "SBSFU.bin" into the board.After reset the board, I download firmware "UserApp.sfb" with SecureCRT by using menu "Transfer > Send Ymodem" , but it failed.I also try to use "Tera Term", it download firmware successfully. But the "Tera Term" only have Windows version.I need download firmware from Linux, Does anybody know which tool can download firmware by YMODEM successfully at linux?

Hi,I am working on stm32wb55 NUCLEO Board.I run sbsfu default code and userapp run correctly.Now i replace userapp with my customize app with few feature enable and it's working fine.If i add further features(additional code) it hang after printing below messages= [SBOOT] System Security Check successfully passed. Starting... = [FWIMG] Slot #0 @: 8010000 / Slot #1 @: 804f000 / Swap @: 808d000     ====================================================================== = (C) COPYRIGHT 2017 STMicroelectronics = = = = Secure Boot and Secure Firmware Update = ======================================================================     = [SBOOT] SECURE ENGINE INITIALIZATION SUCCESSFUL = [SBOOT] STATE: CHECK STATUS ON RESET INFO: A Reboot has been triggered by a Hardware reset! Consecutive Boot on error counter = 0 INFO: Last execution detected error was:No error. Success. = [SBOOT] STATE: CHECK NEW FIRMWARE TO D

I've heard that the next x-cube sbsfu release would include a fix for the ymodem protocol, such that it can be used from linux, and that it would be released by end of July.Does anybody know when it will be released?

EC key information:> openssl ec -in fake_key.pem -text -param_enc explicit -nooutread EC key Private-Key: (256 bit) priv: af:b9:... pub: 04:c0:ae:88:33:3d:a3:d9:ba:20:37:20:05:28:3e: 2a:eb:3e:44:c6:fb:57:08:cd:e4:f4:3e:f9:4d:a6: f0:29:70:94:90:53:87:50:8c:9f:4d:a7:81:83:e2: d7:ad:ab:98:09:71:9e:94:1f:d3:f7:2d:e1:0e:79: ac:e7:d9:3e:53 Field Type: prime-field Prime: 00:ff:ff:ff:ff:00:00:00:01:00:00:00:00:00:00: 00:00:00:00:00:00:ff:ff:ff:ff:ff:ff:ff:ff:ff: ff:ff:ff A: 00:ff:ff:ff:ff:00:00:00:01:00:00:00:00:00:00: 00:00:00:00:00:00:ff:ff:ff:ff:ff:ff:ff:ff:ff: ff:ff:fc B: 5a:c6:35:d8:aa:3a:93:e7:b3:eb:bd:55:76:98:86: bc:65:1d:06:b0:cc:53:b0:f6:3b:ce:3c:3e:27:d2: 60:4b Generator (uncompressed): 04:6b:17:d1:f2:e1:2c:42:47:f8:bc:e6:e5:63:a4: 40:f2:77:03:7d:81:2d:eb:33:a0:f4:a1:39:45:d8: 98:c2:96:4f:e3:42:e2:fe:1a:7f:9b:8e:e7:eb:4a: 7c:0f:9e:16:2b:ce:33:57:6b:31:5e:ce:cb:b6:40: 68:37:bf:51:f5 Order: 00:ff:ff:ff:ff:00:00:00:00:ff:ff:ff:ff:ff:f

Good evening,I requested the download for XSBSFU package last week , but never received a conformation Email. Today I made another one request and got a conformation Email. I read that it might take up to 48h to get the link, which would be to late for me, my workshop begins tomorrow at 9:00. Is there a way to speed up the process so I can participate ST-Workshop tomorrow?Thank you very much.

Hi... there Hope all are doing well From past few days I'm playing with SBSFU with STM32 L4 Cell-01 Discovery board I'm using x-cube AWS default application with default settings of the linker fileIn demo code, I've added SDMMC with FAT fs, which is working well Now I need to send the sensors data to aws at some predefined interval by RTC having calling semaphore from ISR I've created the separated thread to read the sensors data having stack size of 512 Now the problem is, due to new thread cloud_run thread calling to malloc fail Handler to solve the issue, I've allocated 2K heap to project (default 18000 to 20000) in linker script However that cause the APPLI_region_RAM  over flow by 2048 bytes!I need to know, how i can effectively allocate the RAM for the application region After checking all the linker files, i got to know SRAM1 is used f

Hi!I requested the download on Saturday (sorry - I missed the first mail regarding the setup and was'nt aware of the delay in granting download permission...I started the setup late on Saturday) - I read that it might take up to 48h to get the link, which would be tonight (with the actual training starting tomorrow).Is there a way to speed up the process so I can set up the environment now to be ready for tomorrow?

Hi all,i watched the webinar: STM32CubeIDE for STM32L5 microcontroller and there is one question left:We have two independet projects for the secure and the non secure code. The gateway code that is provided to call secure functions from the non secure world is located in the secure world (and therefore in the secure project).How does the non secure project knows at which adresses the secure functions are located to be able to call them?Lets assume i want to deliver preprogramed chips with already programed secure area. How can i distribute the addresses (beside the header file) so that the linker of the non secure code is able to call the gateway functions?Thanks for helpThomas

Today when I generated CRC from output binary file I found it did not equal the data in the board. Then I check the data in board , I found the data which loaded by stm32CudeIDE was padding with 0xFF, but the stm32CudbeIDE generate the binary file with padding 0.

Hi, We are using SPSGRF-868 module in our project, With following settings of RF module operating @868 MHz Send/receive data without Encryption we are able to achieve 20~25 meter distance and working fine. But Send/Receive the data with encryption we are not able to achieve 20~25 meters distance.We followed below settings for with/without encryption: Date rate: 3.6 Ksps Frequency deviation : 9.918 KHz Channel filter : 50.961 KHzis it as payload size increases range is degraded and is it need to be change above settings for Send/Receive data with encryption to achieve 20~ 25 meters distance?Thanks,Nagaraj

I've developed an IOT device and now I'm concerned about security. Uses ethernet, tls and mqtt to upload cloud data. Checks a directory on the web for firmware updates. The mqtt is well sanitized and i'm not extremely worried about attack vectors coming from a compromised IOT device. I'm more concerned about software IP theft and attacks on the IOT devices themselves that would damage their operation. I’m also not after perfect security, just enough to be an enormous pain in the *** to anyone who gets the idea to try. The data sent and received apart from the firmware itself isn’t private in any sense.I have not setup or implemented IAP yet for firmware updating so I have some questions about that. Does IAP erase and replace the entire firmware or only the piece after where IAP runs? Can I have a persistent key saved on the chip [stm32f427] that survives the IAP so that firmware would not have to ship with it? All devices have sd cards.Delivering the firmware unencrypt

Please check attached Source code file with complete test code.I am using STM32WB55xx with algorithm : RSA/PKCS#1v15/rsa_pkcs1v15.h Note - Public key is 2048 bitIssue - If we set following modulus(publicModulus[2048 / 8] ) not getting any result/status.   uint8_t publicModulus[2048 / 8] = { 0xd4, 0x3a, 0x8a, 0xcd, 0x56, 0xdc, 0x46, 0x83, 0x8d, 0x7d, 0x15, 0xb8, 0xe0, 0xed, 0x34, 0xa2, 0xa1, 0x0e, 0x0a, 0x50, 0x07, 0x3a, 0xec, 0xb2, 0x0e, 0x8b, 0x55, 0xa0, 0x12, 0x38, 0xda, 0x2c, 0x16, 0x8c, 0xb0, 0xa6, 0xe2, 0x57, 0xa7, 0xea, 0x1c, 0xba, 0x8f, 0xe0, 0x1d, 0x67, 0xd6, 0xa1, 0x40, 0x26, 0xfe, 0x62, 0x3f, 0x3d, 0x9c, 0x17, 0x1d, 0xa4, 0xd3, 0xcd, 0x31, 0x2f, 0x08, 0x23, 0xbd, 0x75, 0x4e, 0x5a, 0xe3, 0xa4, 0x3d, 0x80, 0x7b, 0x0f, 0x3e, 0x6f, 0xa2, 0xfe, 0x31, 0x1d, 0xb7, 0x50, 0xff, 0x35, 0x4a, 0xa1, 0x95, 0x33, 0x5f, 0xf0, 0x5c, 0x9a, 0x79, 0x90, 0xf4, 0xda, 0xdc, 0xc8, 0x12, 0x4e, 0

Hi, I hope the day is going well for everyone.We've been working to validate SHA256 computations on the HASH unit of the board named in the question. In the process we have noted what appears to be a reproducible problem with the unit.In short it appears as if submitting a block of data on which to compute a SHA256 checksum hangs if the block of data is an even multiple of 32 bits, the word size of register in the HASH unit.The simplistic way to reproduce the problem is to request a hash of the following string:abcdefghijklFollowed by a request to compute the hash of the following string:abcdefghThe checksum computed from the first string is correct but the request to compute the second string hangs or gives a completely erroneous value.We have reproduced this behavior using both the HAL_HASHEx_SHA256_Start function which uses polling mode as well as with the HAL_HASHEx_SHA256_Start_DMA function in DMA mode.In add

Hi,The CRC function of the flash module in the STM32H753 is documented as using the polynomial 0x04c11DB7. If I use this module to calculate a CRC over 128 bytes all set to zero I get a non-zero answer (0x11e66c62) so it must also be using an initial value (crc burst size set to 4 = 128 bytes). So what is this initial value? It doesn't appear to be 0xFFFFFFFF as using that in PC code that uses the same polynomial does not produce the same value.The CRC function in the flash module is largely pointless if it's calculation cannot be reproduced off-chip. Is there example C code anywhere that can reproduce the CRC that the flash modules CRC produces?ThanksNigel

I have an STM32F405 (which has no PCROP). I want RDP Level 1, but also want to re-flash firmware updates using the bootloader (and the DeFuse utility). With RDP Level 0: everything works: I can reflash firmware updates, no problem.But when optionBits are set to RDP Level1: to quote @andy​ (from here: https://bit.ly/2DfaUjf :( It appears that the bootloader doesn't support any Flash writes until the read protection has been removed, and this involves erasing the entire Flash (OK) and then rebooting (not OK!). Rebooting the CPU exits the bootloader, leaving it with no firmware and BOOT[1..0] = 00.   In other words, bricked.Any ideas how to get the bootloader to reflash, yet have RDP level 1 ?

Is it possible to set level 2 RDP to just a subset of a certain Flash bank? not the entire bank. (Begin Address -> End Address for example)Is it possible to set RDP levels for an external flash not the internal MCU flash?

Hi all,I am sending a message via USART from STM32F303 (later to be moved from STM32F3 to STM32F427) to an X86.The message consists of 2 parts payload + crc ,CRC is calculated on stm32 using crc hardware engine and calling CRC_CalcCRC/CRC_CalcCRC16bits/CRC_CalcBlockCRC appropriately.I would like to do a crc check for the payload upon receipt by the X86 and validate against CRC available within the packet.So i sourced x86 code authored by Swhite (https://community.st.com/s/question/0D50X00009XkbhnSAB/crc-calculation-in-software), to calculate crc on x86.But the crc computed by stm32 doesn't match the crc computed by this code.A copy of the x86 crc code is attached as a zip.Could someone pl