STM32 MCUs Security

Posted on June 25, 2018 at 19:53For a customer I want to set RDP Level1 on STM32F4, and put in first sector a bootloader that manager a jump to DFU for device upgrade.I set the RDP L1 by code at init, and disable it with STMCubeProgrammer.Will the IAP also be erased with the application code ? How Can I prevent it ?The AN3965 descirbes an IAP that is not compatible : Note: In this application, the read protection is not supported, so the user has to verify that theFlash memory is not read-protected.Is there another way to protect code content against reading ?#stm32-iap #rdp-level-1

Posted on February 05, 2018 at 11:12Dear All,I have some questions related to  ♯?:1) How to enable ♯ for ♯ boot-loader and for user application?2) Since I was not able to find an information how to make a ♯ and remove ♯ from the MCU (STM32L476) I would like to ask how to do it?Thank you in advance for you response.#debug-mode #sbsfu #update-firmware #x-cube-sbsfu #debug_mode #downgrade

Posted on May 14, 2018 at 10:07Hi,Does anyone knows how the counter is handled in AES_CTR_Encrypt_Init() / AES_CTR_Encrypt_Append().I suppose it is somewhere in the IV, but the documentation does not talk about it.The examples use an IV initialised at 0xF0, 0xF1, ..., 0xFF with a nice comment :'Third parameter is NULL because CTR doesn't use any IV'.If the counter is not in the IV where is it ? How can I modify it ?Is it a 16 bytes big integer ?A 32 bit integer ?Endianness ?Regards,Fred.#x-cube-cryptolib-aes-ctr

Posted on March 30, 2017 at 10:13Hi,I would like to use a software read protection on STM32F0. I've made such a function:PROTECT_STATUS ReadProtectionConfig(uint8_t ProtectionLevel){ uint8_t status = OK; FLASH_OBProgramInitTypeDef OB_Init; HAL_FLASH_Unlock(); HAL_FLASH_OB_Unlock(); OB_Init.OptionType = OPTIONBYTE_RDP; if (ProtectionLevel == 0) { OB_Init.RDPLevel = OB_RDP_LEVEL_0; } else if (ProtectionLevel == 1) { OB_Init.RDPLevel = OB_RDP_LEVEL_1; } else if (ProtectionLevel == 2) { OB_Init.RDPLevel = OB_RDP_LEVEL_2; } else { status = RDPLevel_Error; return status; }HAL_FLASHEx_OBProgram(&OB_Init); HAL_FLASH_OB_Launch(); HAL_FLASH_OB_Lock(); HAL_FLASH_Lock(); return status;}but it don't work properly. I mean even if I choose OB_RDP_LEVEL_0 it blocks read out of flash

Posted on May 12, 2018 at 05:54My device use STM32f437VG (which supports hardware crypto) but sometimes we cannot buy it and use STM32F427VG (which NOT support hardware crypto) instead.So my program have to check if the MCU is 437 or 427 to use properly library calls. After reading manual, datasheet... i cannot know how to diffentiate them.My solution now is: write 0x00010000 to CRYP->CR register and readback, the 427 will return 0, the 437 will return 0x00010000.#cryptography

Posted on May 11, 2018 at 14:41Hi!I'm struggeling with hardware accelerated aes algorythim. Based on example project I've enabled CRC clock and initilzed the operation, by passing the key (AccHw_AES_CFB_Encrypt_Init(&, , )). After that I'm trying encrypt data, but the function AccHw_AES_CFB_Encrypt_Append(&, , , ,&) return an error status HW_TIMEOUT. I set up a GCC compiler in AccHw_config.h witout any optimalization.  Floating point hardware with hard ABI has been set up as well. Oh and I'm using libSTM32AccHwCryptoV3.0.0__GCC_FPU.a libaries, STM32F429I-DISC1 discovery kit and SW4STM32 as a IDE.If anyone of you guys has some idea what should be checked or done for fix the issue, I will be grateful for any help.#hw_timeout #acc_hw #aes

Posted on May 10, 2018 at 00:37Hi, people!how can i reset Read Out Protection on F103 series WITHOUT Power-off and reset??HAL_FLASH_ob_launch --> it is reset (and hold MCU).1. I set the LEVEL from 1 to 0 in subprogramm. All ok. Flash erased, all FF. good. But.. 2st first pages still in RW protect mode.2. Then, I use my functions for remove write protection (chip now erased!). Then look debug on UART over terminal:..before my operations: 0x1FFFF800: FFFFFF00..after works my func: 0x1FFFF800: FFFF5AA5Howerver, first 2st pages (4096 bytes) still on lock mode. And i can't modify it from my subprogram from RAM.all other sectors is good, only first 2st FF FF FF FF FF........... and locked. not modified. Only after hard reset or power off - pages have a writable mode.QUESTION: How can i write on 2st pages without reset when chip is already erased??????(0x08000000..0x08001000

Posted on May 11, 2018 at 09:39Hello,we are are looking for a microprocessor or microcontroller with the following features:o USB FS or ethernet connectivity, ( USB FS preferred)o high processing power >= 700MHz, multi core if possibleo secure and protected flash for our program binariesI understand, that high performance calculations and on chip flash don't match that well, but maybe somebody has heard of a solution for this dilemma?One main point is that we need to have our firmware well protected. External flash solutions seem to fail on this requirement...Can somebody please give me a clue?Thanks in advance!Markus#secure-boot #performance

Posted on August 07, 2017 at 12:40Are there any examples of enabling (level 1) and disabling code readout protection for stm32f7?I have just tried this on an stm32f767 based on code that worked for stm32f4xx and I seem to have 'bricked' the microcontroller - my Rowley Crossconnect JTAG debugger cannot connect any more.Enabling read-out protection with the following sequence seemed to work (although I did not get the log message I expected):__attribute__ ((section('.fast')))// attribute fast forces this code to be in RAMvoid enableReadProtection(void) {    // this is destructive and hangs    const char *rommessage = '\nCycle power to complete\n';    char rammessage[40];    char *message;    FLASH_Status status = FLASH_COMPLETE;    message = strcpy(rammessage, rommessage);  &nbs

Posted on May 27, 2016 at 13:26Hi,I�m trying to use the �STM32 Cryptographic library package V2.0.6� provided from ST on my STM32F030 device.I�m using IAR Workbench 7.30 and example (AES CTR) compiles without any error.The problem is that data encrypted doesn�t match with expected data.  The Key data, IV, plaintext and expected data is being used as example default. I have not touched anything:const uint8_t Plaintext[64] =  {    0x6b, 0xc1, 0xbe, 0xe2, 0x2e, 0x40, 0x9f, 0x96,    0xe9, 0x3d, 0x7e, 0x11, 0x73, 0x93, 0x17, 0x2a,    0xae, 0x2d, 0x8a, 0x57, 0x1e, 0x03, 0xac, 0x9c,    0x9e, 0xb7, 0x6f, 0xac, 0x45, 0xaf, 0x8e, 0x51,    0x30, 0xc8, 0x1c, 0x46, 0xa3, 0x5c, 0xe4, 0x11, &nbs

Posted on February 13, 2017 at 13:01Hello everybody,I'm tryin to make a Nucleo-F401 sign a message and then verify this message on a Linux machine. Currently I am able to inject both private and public key into the STM32F401RE (and, starting from ECDSA keygen and sign example, I checked that it works). However, the public keys given by Python ECDSA and CryptoLib are different. Since I'm using the same curve for both (FIPS 186-3 NIST256P), what can cause this behaviour?Regards,Fabio#cryptographic-library #ecc #cryptography #elliptic-curve #ecdsa #x-cube-cryptolib

Posted on March 17, 2018 at 20:14Hi I want to PORT X-CUBE-SBSFU on to STM32L475 Discovery IoT kit.I want to know what are the initial steps i need to do for PORTING SBSFU on any nucleo Board.Thanks Phanirajkiran#iot-node #device-security #secure-boot #secure-engine #stm32-security #secure-firmware-update

Posted on March 12, 2018 at 07:21Hi How do i proceed to write a &sharpsecure boot on STM32L4RXX, with out &sharpHW Crypto. I need to make it by Software later i want to use the HW Crypto provided. Thanks.,Phani#secure-boot

Posted on March 05, 2018 at 19:18I am new to stm32 micro-controller.  I have a question regards to how to enable and disable write protection with stm32l4 chip.  My goal is first I will check if user application is write protected or not, if it is then I need to disable write protection to write into that section.  Any examples will help me a lotThank you in advance.#fft-stm32l4 #read-write-protection

Posted on February 25, 2018 at 11:10Hello friend,I have DS18B20. And I read his uniq ID with CRC.And I know, that STM has crc calculator. So I read data from DS18B20: 0xab 0x1 0x4b 0x46 0x7f 0xff 0x5 0x10 : CRC 0x92And I use internal calculator on this datas.But result is wrong, because I get: 0x19And you can see 0x92 is different from 0x19.For example:read ID with CRC.uint8_t *p = ds18b20_read_serial_number();And CRC calculation:uint8_t test_crc = CRC_Calculate8(p, 8, 1);Any idea, what is wrong?Here is function to calc CRC in STM32F767zi.uint32_t CRC_Calculate8(uint8_t* arr, uint32_t count, uint8_t reset){ /* Reset CRC data register if necessary */ if (reset) { /* Reset generator */ LL_CRC_ResetCRCCalculationUnit(CRC); //CRC->CR =

Posted on February 14, 2018 at 18:39Hy.I would like to download the crypto library. When I click the request software button, a form shows up. I fill the form correctly, but nothing happens, I cannot download the software.I really need the library. Can someone help?Hy,Petr�#library #cryptography

Posted on August 04, 2014 at 10:47 Hi, I created a C# class which calculates the CRC32 checksum exactly like the STM This may be useful to others: using System; using System.Collections.Generic; using System.Linq; using System.Text; using System.Security.Cryptography; namespace JCC224_User_Interface { public static class CRC32 { public static UInt32 calculateWord(UInt32 crc, UInt32 data) { int i; crc = crc ^ data; for (i = 0; i < 32; i++) { if ((crc & 0x80000000) != 0) { crc = (crc << 1) ^ 0x04C11DB7; // Polynomial used in STM32 } else { crc = (crc << 1); } } return (crc); } public static UInt32 calculateBuffer(UInt32 initial_value, UInt32[] buffer) { for ( int i = 0; i < buffer.Length; i++) { initial_value = calculateWord(initial_value, buffer[i]); } return initial_value; } } } #crc32

Posted on February 01, 2018 at 14:46Hi.I'm using an RSA cryptographic library and I have a big issue with the verification process.ST crypto library for RSA has a 'standard' module, message, key pairs and signatures in its main program.I need to use my own key pairs and module to sing my message, but the program doesn't get these keys. (I check if the keys were wrong or not, and I am sure they are good)If i check the status error, its set to 1004 ( #define AUTHENTICATION_FAILED     (int32_t) (1004)          /*!<  Authentication failed */)My RSA especification are this :const uint8_t T1_Modulus[] = { 0xAF, 0xEB, 0x5F, 0x07, 0x82, 0xDA, 0xCF, 0x72, 0xEF, 0x8A, 0x63, 0xE9, 0xA8, 0xA7, 0x66, 0xCA, 0x7B, 0xD2, 0xD4, 0xDB, 0xC3, 0xB0, 0x52, 0xC

Posted on January 25, 2018 at 06:42I am using ♯, where I tried to calculate the 32- bit CRC of my flash using ♯ register.How I can ensure if the CRC calculation of my flash is correct.CRC Configuration I used is :hcrc.Instance = CRC;hcrc.Init.DefaultPolynomialUse = DEFAULT_POLYNOMIAL_ENABLE;hcrc.Init.DefaultInitValueUse = DEFAULT_INIT_VALUE_ENABLE;hcrc.Init.InputDataInversionMode = CRC_INPUTDATA_INVERSION_NONE;hcrc.Init.OutputDataInversionMode = CRC_OUTPUTDATA_INVERSION_DISABLE;hcrc.InputDataFormat = CRC_INPUTDATA_FORMAT_WORDS;/*ROM address*/&sharpdefine ROM_START (( uint32_t * ) 0x08000000 ) &sharpdefine ROM_END (( uint32_t * ) 0x0801FFFB )Calculated CRC is stored in the variable.#flash #crc #stm32f070xb #crc->dr #crc-32

Posted on January 17, 2018 at 10:52Hello everyoneI have some trouble with the CRC unit on my STM32F407 MCU.Before each time I am going to use it to calculate a checksum, I reset it and after doing so I double check that the CRC data register (CRC_DR) is as what is expected (just 1s, 0xFFFF_FFFF). This is not always the case and I'm confused why.So far my application, that uses the CRC unit, seems to be working fine. I don't get any false positive errors (i.e. the CRC unit says the checksum was incorrect when it wasn't).I could just ignore this check and hope that nothing is wrong, but I have a bad gut feeling about doing that (something might actually be wrong).I speculate that I perhaps there's a timing issue of some sort. That the CRC unit needs a few more clock cycles before its data register has the correct reset value.Do you have any ideas about what could be wrong?I would really appreciate any help w

Posted on January 26, 2018 at 09:27Hi,I'm using AES CCM algorithm from X-CUBE-CRYPTOLIB (STM32AccHwCryptoV3.1.0_L4_KEIL_otslsm1elfspf.lib) in sensitive real time system and unfortunelaty it does not fit our time requirement. We would like to investigate the possibility to optimize AES CCM encryption/decryption for our application. Is there possibility to:- Get custom API for AES CCM (especially one API to change nonce only)- Get library sourcesThanks,Guillaume#x-cube-cryptolib #aes-ccm

Posted on January 24, 2018 at 15:19Hi,we are facing troubles with the readout Protection on the STM32L0: when you secure the chip and then want to do a firmware update, the Settings and serial numbers in EEPROM also are erased. Can we somehow protect the code without having a EEPROM erase with each firmware update?Thanks,Michael#rdp #stm32-l0

Posted on January 19, 2018 at 11:55Hello friends.I created CRC calculator, but I don't know, how to compare results.My input data:uint32_t data[16] = {       0x1234, 0x456, 0x78, 0x09,       0x10, 0x100, 0x1000, 0x01,       0x54, 0x35, 0x98, 0x2432,       0x2255, 0xAEFB, 0xAAAA, 0xFFFF };Function to calculation:uint32_t CRC_Calculate32(uint32_t* arr, uint32_t count, uint8_t reset){       /* Reset CRC data register if necessary */       if (reset) {             /* Reset generator */             LL_CRC_ResetCRCCalculationUnit(CRC);   &nbs

Posted on January 10, 2018 at 14:51 Hi there, I wrote a serial protocol to exchange data between MCU and a PC. This protocol provides a checksum to verify data integrity. At the moment I use a simple sum of each byte but I think that the use of CRC peripheral could be an improvements. Unfortunately the CRC peripheral requires a uint32_t buffer but my payload is an uint8_t. Casting the uint8_t to uint32_t is a problem because the CRC will be wrong because on the PC side. I computed the CRC as byte (from serial interface)but I computed the CRC on MCU as word (due to cast uint8_t to uint32_t ). /* This is my packet structure */ */ typedef struct PROTOCOL_Packet { uint8_t header; uint16_t length; uint8_t payload[128]; uint32_t checksum; } PROTOCOL_Packet_t; /* This is my routine to compute the CRC: */ if( CRC_Calculate( (uint32_t*)pkt->payload.bytes, (uint32_t)(*pkt).length, &pkt->checksu

Posted on January 09, 2018 at 14:27HelloI would like to use the crypto lib with gcc (eclipse/ system workbench).The compiler returns this:error: xxx.elf uses VFP register arguments, libSTM32CryptographicV3.0.0_CM4_GCC_ot.a(crypto.o) does not.I'm not sure to understand. My program is obviously using the hardware FPU. The library may have been compiled in soft FPU mode. I have no idea about the solution.Thank you for your help