Practical examples are proposed to provide an overview and to help to understand the STM32U3 security solution.
These examples are based on the board, tools, and codes provided by ST.
In the guides listed below, each step to follow is described in detail.
It is advised to get familiar with the available tools by using these examples before making your own developments.
| Product Series | STM32U3x | |
|---|---|---|
| Board | NUCLEO-U385RG-Q | NUCLEO-U3C5ZI-Q |
| Embedded flash size | 1M | 2M |
| OEMiRoT how to | Link to article * | |
| OEMiRoT + OEMuRoT how to | ** | |
| CCB KW ECDSA Signature introduction article | Link to article | |
| CCB KW ECDSA Signature how to | Link to article | |
| KWE Initial attestation introduction article | Link to article | |
| KWE Initial attestation how to | Link to article | |
| ROT How to adapt a user application to ROT | Link to article |
Notes:
- * supported for all products but no dedicated wiki article
- ** STM32CubeFW available but no dedicated wiki article
- CCB see Coupling and Chaining Bridge wiki article
- KWE Key Wrap examples provided in the STM32CubeFW (Projects\NUCLEO-U385RG-Q\Applications\MbedTLS_HW_KWE), all can be reused for NUCLEO-U3C5ZI-Q, see example KW ECDSA signature how to.
The focus for the security of this product is on the secure boot and simple, but hardened protection of assets.
The platform security certifications are targeting SESIP3, which is a stand-out feature for such a small product.
Password protected regression is another differentiating feature of the STM32U3 series.
1. RDP regression
The important feature of the STM32U3 is the ability to lock regression from RDP1 to RDP0 using password and allow password-protected regression from RDP2 to RDP1.
Further reading:
- Main RDP regression article: Using RDP regression on the STM32U3
2. OEMiRoT and OEMuRoT- Root of Trust
An OEM can develop its own customized Immutable Root of Trust (OEMiRoT).
The STM32CubeU3 provides examples configuration files, codes, data files and scripts.
- The OEMiRoT for STM32U3 wiki article gives an overview to be read before executing the getting started.
- The How to start with OEMiRoT on STM32U3 wiki article is a step-by-step guide for the STM32Cube OEMiRoT example.
- The OEMuRoT optional second boot stage is documented in STM32CubeFW example is OEMiRoT for STM32U3
3. CCB (Coupling and Chaining Bridge)
The Coupling and Chaining Bridge is a new feature introduced for this product.
It allows to avoid the access from the CPU to the private keys and some critical security operations done by hardware.
A tutorial is proposed showing how the private key wrapping is done, how the wrapped key is used and also how the public key is generated from this wrapped private key.
- The Introduction for How to start with CCB on STM32U3 wiki article must be read before starting the step by step.
- The How to start with CCB on STM32U3 wiki article is a step-by-step guide using the Elliptic Curve Digital Signature and signature verification (ECDSA) example proposed in the STM32CubeFW.