STM32 MCUs secure firmware install (SFI)

Owned by Michał Sieciński
Last updated: Nov 30, 2022 by Adam Czajkowski
2 min read

STM32 SFI is a solution for secure manufacturing in production environments that guarantees the authenticity, integrity, and confidentiality of the firmware. It is available on STM32L4, STM32L5, STM32U5, and STM32H7 microcontrollers.

Instructions

The procedure consists of two main steps:

  • Preparation of files and Hardware Secure Module (HSM) using the source code and the toolkit provided by STMicroelectronics. Two elements are necessary to perform an SFI sequence using Elprotronic’s GangFlasher-ST:

  • Programming of the flash memory and option bytes using Elprotronic’s GangFlasher and the files prepared in the first step.

1. Preparing necessary files:

  1. Preparation of the keys (AES128Key.bin and Nonce.bin)

  2. Preparation of Option Bytes Config file (OptionBytesSetting.csv)

  3. Preparation of firmware files (firmware.bin)

  4. Preparation of an encrypted firmware binary file (*.sfi) using STM32TrustedPackageCreator (SFI tab) or STM32TrustedPackageCreator_CLI (-sfi option), keys, option bytes config file and input firmware are necessary in this step.

  5. Programming HSM modules with a limited number of licenses using STM32TrustedPackageCreator (HSM tab) or STM32TrustedPackageCreator_CLI (-hsm option), keys (AES128Key.bin and Nonce.bin) are necessary in this step and they must be the same as for firmware encryption.

2. Programming flash memory and option bytes using Elprotronic’s GangFlasher-ST on Windows

  1. Open GangFlasher-ST

  2. Check connection with the board or scan “Setup->USB Location“

  3. Check connection with HSM “View->HSM“

  4. Load SFI file(*.sfi) in main window.

  5. Check “SFI Enable” box in SSP/SFI area and add optional log file to save used license from HSM module.

  6. Click “Autoprogram or write“ Button in main window.

  7. View report for target in Reports area.

Useful links

STMicroelectronics application notes and user manuals:

[1] AN5054 - Secure programming using STM32CubeProgrammer

[2] AN4992- STM32 MCUs secure firmware install (SFI) overview

[3] AN5156 - Introduction to STM32 microcontrollers security

[4] AN3156 - USB DFU protocol used in the STM32 bootloader

[5] UM2238 - STM32 Trusted Package Creator tool software description