Target description
1. Introduction
A critical security feature is a dedicated memory location where secret data such as keys can be stored in a very safe way.
The STM32H5 provides up to five secure storage fuflilling this requirement, called OB Keys storages.
Every secure storage is temporaly isolated through the HDPL level.
The figure below shows the five OB Keys secure storages, one for every HDPL level (HDPL0, HDPL1, HDPL2 , HDPL3 Secure and HDPL3 Non-Secure).
2. The secure storage areas for STM32H5 (OB key area)
The secure storage areas are also called Option-Byte Key (OBKeys) areas or Secure Key Storage areas.
As mentioned in the introduction, the STM32H5 provides five secure storage areas that can be used to store key but also any sensitive or secret data.
Any of these areas is related to a specific temporal isolation level HDPL. This will be explained in the next chapter.
The five areas are described in the table below.
| Temporal Isolation Level | Storage size (Bytes) | Usage | Regression |
|---|---|---|---|
| HDPL0 | 255 | Reserved for ST, HDPL0 keys | Never erased |
| HDPL1 | 2047 | iRoT keys | Erased through regression |
| HDPL2 | 767 | uRot, OS or Secure Application | Erased through regression |
| HDPL3S | 3071 | Secure Application keys | Erased through regression |
| HDPL3NS | 2031 | Non-Secure Application keys | Erased through NS-Regression |
3. Temporal isolation
As reminder: the different boot stages of the STM32H5 are protected through temporal isolation.
see: Secure_Boot_for_STM32H5
The firmware execute in HDPLx has no access to a firmware that has been execute in HDPLx-1 and earlier (HDPLx-n).
For the secure storage it's a similar principle, only the firmware currently execute in a specific HDPLx can access to the secure storage data of HDPLx.
An option-byte key can be accessed only if the OBK-HDPL (set in SBS) matches the HDPL
associated to the storage offset (as indicated below) (refer to Section 14.3.7: SBS hardware
secure storage control). If it is not the case, an OBKERR error is raised.
4. Secure storage protection
SAES side channel attack resistant. The SAES
DHUK (different for every HDPL domain isolation)
RHUK (anticloning)
EPOCH (anti-replay
access control
Including data encryption with SAES/DHUK
5. xxx
The hhhh Hardware Unique Key (HUK): to get a secure storage resistant to logical, side and physical attack. 5 secure storage domains; 4 HDPL Secure + 1 NS; Incl. Flash Secure Storage H5 Native support of key storage inside FLASH interface (enabling constraint debug feature)
5 secure storage areas • HDPL0 ➔ST (never erased) • HDPL1 ➔iROT (ST-iROT or OEM-iROT) • HDPL2 ➔uROT • HDPL3 + Secure ➔Trust Zone • HDPL3 + NS ➔Non secure appli
• Data can be Wrapped with DHUK • Based on HUK + Version counter • Different for each HDPLx