Secure Boot Implementation For Stm32 Microcontroller — Complete Documentation & Simulation

Overview & System Context

Secure Boot Implementation For Stm32 Microcontroller: Comprehensive Web-Sourced Technical Investigation Exhaustive Research Dossier · Pure Web-Scraped Content: ~7114 Words · Real Software Screenshots: 3 1. Executive Overview & Technical Background RP2350 is a 32-bit dual-core microcontroller (containing selectable ARM Cortex-M33 and/or Hazard3 RISC-V cores) by Raspberry Pi Ltd. In August 2024, it was released as part of the Raspberry Pi Pico 2 board.

RP2350A - 30 GPIO in a 7 × 7 mm QFN-60EP (0.4mm pitch) package (EP means exposed pad in center) RP2350B - 48 GPIO in a 10 × 10 mm QFN-80EP (0.4mm pitch) package (EP means exposed pad in center) RP2354A - same package as RP2350A (above) includes 2 MB QSPI NOR flash RP2354B - same package as RP2350B (above) includes 2 MB QSPI NOR flash Note: inside the "54" IC packages, a NOR flash die is stacked on top of the microcontroller die, then connected to its QSPI bus and first chip select. At announcement time, seventeen other manufacturers had products expected to be available within a month.

Key features: Two different CPU designs sharing the same computer bus and a 150 MHz clock: Dual ARM Cortex-M33F (ARMv8-M instruction set). Includes DSP instructions, single-precision (SP) floating-point instructions, and a simplified double-precision floating-point coprocessor provides add, subtract, multiply, divide, square root. Dual Hazard3 (RISC-V instruction set, RV32IMAC+), an open-source CPU designed by Luke Wren. Only one or two cores may be used at the same time. In a "normal" setup, the BootROM spins up core 0, which then performs a "core 1 reset" to spin up a core 1 of the same architecture. A core may be swapped for one of a different architecture by manipulating the ARCHSEL register and initiating a core reset. It is possible to access all four cores without power-cycling the rest of the board. 520 KB SRAM in ten concurrently accessible banks 8 KB of one-time-programmable (OTP) memory QSPI bus controller supports external flash and PSRAM with execute in place (XIP) Optional in-package 2 MB QSPI NOR flash connected to first chip select DMA controller, 16 channel, 4 IRQ AHB crossbar, fully-connected On-chip switched-mode power supply and programmable low-dropout regulator (LDO) to generate core voltage Two on-chip PLLs to generate 48 MHz USB and 150MHz core clocks RP2350A has 30 GPIO pins, of which four can optionally be used as analog inputs, RP2350B has 48 GPIO pins where eight can be used as analog inputs. Optional boot signing with protected OTP storage Hardware SHA-256 accelerator Hardware random number generator (TRNG) based on ARM's TRNG IP block Peripherals: One USB 1.1 (LS & FS) controller and PHY, host and device support, 1.5 Mbps (Low Speed) and 12 Mbps (Full Speed). Two UART controllers. Two SPI controllers. One QSPI (quad SPI) controller, supports 1 / 2 / 4-bit SPI transfers, 2 chip selects. Two I²C controllers. One HSTX (high-speed serial transmit) controller, output-only. This is meant for digital video output. Has access to 8 pins at 300 Mb/s per pin (double data rate) 12 PIO (programmable input–output) state machines. 8 (QFN-60) or 12 (QFN-80) units of dual-channel PWM. Each unit can drive two output signals or measure the frequency or duty cycle of an input signal. 4/8-channel 12-bit 500-kSPS SAR ADC, extra channel is connected to internal temperature sensor. QFN-60EP package has 4 channels, QFN-80EP package has 8 channels.

Once your STM32 devices are in the field, every firmware update becomes a security decision: who is allowed to run code on this hardware, and what happens if an update is interrupted or malicious? A secure bootloader architecture adds signatures, anti-replay and clear recovery paths on top of your existing update flow. Figure 1: STM32 ExpressLink Tutorial Part 3: Secure Boot - YouTube We assume you already have a basic bootloader or update mechanism. If you are still defining your overall firmware structure and timing, you may want to read this together with your firmware architecture and real-time optimisation plans.

“Secure bootloader” can mean anything from “basic sanity checks” to “full-blown hardened system”. To avoid over-engineering in the wrong places, write down what you are actually defending against. For each category, decide whether your priority is integrity (no unauthorised code), availability (device always recovers) or confidentiality (protecting IP) – or a mix.

A root of trust is the part of the system you decide to trust unconditionally. On STM32, this is typically: Figure 2: Protecting microcontrollers. Implementing Firmware Hardening and Secure ... Keep this root-of-trust code as small and boring as possible. Complexity belongs in updatable areas, not here. Signatures guarantee that only firmware produced by you (or explicitly authorised parties) will run on the device.

Many teams document this alongside their overall firmware and system design as part of engineering & firmware consulting . Signatures alone do not stop an attacker from installing an old, vulnerable version that is still correctly signed. Anti-replay protections address exactly this. Figure 3: Protecting microcontrollers. Implementing Firmware Hardening and Secure ...

You may still want a way to perform controlled rollbacks (for example after a bad release), but then: The bootloader’s job is not to handle every detail of your transport (UART, USB, BLE, app), but to define a small set of states any update must go through. A common pattern: If you already have a dual-slot and rollback design, secure boot logic hooks directly into it: only signed and non-replayed images ever reach “pending” or “confirmed” state.

Secure boot is not only about saying “no”. It also needs to answer: “what happens if something goes wrong?”. Typical recovery paths include: For STM32-based drive systems, recovery concepts must align with safety and protection logic in the motor control stack and the rest of the product – not just with the bootloader in isolation. That is why we usually treat it together with drive systems and protection & fault handling .

Once the architecture is in place, you want evidence that it works under real-world conditions. At minimum, test: For larger programmes, it is worth capturing these as explicit test cases in your system-level validation, alongside FOC tuning, protection tests and mechanical robustness. No. Even “offline” devices like tools, drives or lab equipment are often updated in the field via USB, service tools or mobile apps. Once firmware can be updated, someone can try to load their own code – secure boot defines where you draw the line.

Cryptography has a cost, but modern STM32 devices are usually capable of running signature checks if the architecture and timing are planned accordingly. The key is to keep the bootloader focused and avoid unnecessary complexity in the critical path. Secure boot runs before any FOC or control code, so it does not change your control loop timing directly. But it strongly influences how you structure your firmware images, configuration and update flow around the motor control. We usually design them together in STM32 drive projects – see drive systems and STM32 motor control consulting .

Secure boot must be consistent with how you program and debug devices in production and service. Typically this means locking or restricting debug interfaces after provisioning and having a clear, documented process for re-enabling them in controlled environments. The details depend on your production setup and are usually part of broader product development services .

If you are in the concept or early implementation phase of a secure bootloader for STM32, it helps to align architecture, cryptography choices and test strategy early – before they harden into difficult constraints. 2. System Architecture & Core Working Principles You can reach us via the contact page or through the overview on engineering & firmware consulting .

Implementation of a secure boot mechanism for STM32F407VET6 that verifies firmware integrity using SHA-256 hashes. MCUboot is a secure bootloader for 32-bit MCUs. The goal of MCUboot is to define a common infrastructure for the bootloader, system flash layout on microcontroller systems, and to provide a secure bootloader that enables simple software upgrades.

MCUboot is operating system and hardware independent and relies on hardware porting layers from the operating system it works with. MCUboot works with STM32Cube developement software and SoCs. Details about the updates made by STMicroelectronics are available in the release note here . Please refer to the release note in the repository of the STM32Cube firmware you are using to know which version of this middleware library to use with other components' versions ( e.g. , other middleware libraries, drivers). It is crucial that you use a consistent set of versions.

MCUboot is an OS- and HW-independent secure bootloader for 32-bit MCUs aiming at defining a common infrastructure for the bootloader and the system flash layout on microcontroller systems, and at providing a secure bootloader that enables simple software upgrades. STM32 bootloader development is the process of building firmware that can safely receive, verify, and install new application firmware on an STM32 microcontroller — without bricking the device if the update fails. A production-grade STM32 bootloader combines three core mechanisms: an over-the-air (OTA) delivery path for receiving new firmware images, dual-bank flash fallback for safely reverting a failed update, and secure boot for cryptographically verifying that only authorized firmware runs.

Getting any one of these wrong is the most common cause of field-bricked devices — and the most expensive class of defect in embedded products, since it often requires physical recovery or full unit replacement. This guide covers what each mechanism does, how they work together, and the implementation decisions that determine whether your STM32 bootloader is production-ready or a liability waiting to surface.

A bootloader is the first code that runs when an STM32 microcontroller powers on or resets. Its job is to decide which application firmware to run, and — in any product that supports field firmware updates — to manage the process of replacing that firmware safely. STM32 microcontrollers ship with a built-in ROM bootloader (accessible via UART, USB, or other interfaces depending on the series) intended primarily for initial factory programming. For field-deployed products that need OTA updates, dual-bank fallback, or cryptographic verification, a custom bootloader is required — ST’s built-in bootloader does not provide these capabilities on its own.

A custom STM32 bootloader sits in a protected region of flash memory, runs before the application firmware, and is responsible for: verifying the integrity of the current firmware image, receiving new firmware over whatever communication channel the product uses (UART, USB, CAN, BLE, Wi-Fi, Ethernet), validating that new firmware before committing to it, and falling back safely if anything goes wrong.

OTA firmware updates allow a manufacturer to push new firmware to deployed STM32 devices remotely, without physical access. This is now a baseline expectation for almost any connected product — automotive ECUs, industrial controllers, IoT devices, and consumer electronics all rely on it for bug fixes, feature additions, and security patches after the product has shipped.

The new firmware image is received by the application (or a dedicated update agent) over the connectivity channel, written to a staging area in flash, and then handed off to the bootloader to validate and activate on the next reset. Different STM32 products use different transport mechanisms depending on connectivity and bandwidth constraints: Dual-bank flash is the mechanism that makes STM32 OTA updates safe. Several STM32 series — including the F4, F7, H5, and H7 families, plus select G0 variants (G0B1, G0C1 with 256 KB or 512 KB flash) — provide two independent flash banks that can be addressed and booted independently. This allows a new firmware image to be written to the inactive bank while the device continues running the current, known-good firmware from the active bank.

A robust dual-bank implementation does not consider an update successful just because the device booted. The standard practice — used in production-grade implementations — requires the newly booted firmware to explicitly confirm it is healthy before the bootloader commits to that bank permanently: The first boot right after an OTA update is allowed, but a second boot requires an “it’s safe” flag to be set. If the system resets during this first boot before the flag is set, the bootloader treats the image as unbootable and reverts to the previous image.

(Shirtec, 2019) This single mechanism is what prevents a subtly broken firmware update — one that boots but crashes shortly after, perhaps due to a watchdog timeout or an unhandled fault — from permanently bricking the device. Without it, a device could update into firmware that boots successfully once, fails seconds later, and has no path back to the previous working version.

Single-bank devices (such as the STM32F1 series) require an alternative staging approach — typically an external SPI flash chip or a reserved region of internal flash holds the incoming image until it is fully validated, at which point it is written over the active firmware in a single atomic operation, with the original bootloader region itself left untouched and immutable as the ultimate fallback path (Ampheo Electronics, 2025).

Secure boot ensures that only firmware signed by an authorized key can run on the device — preventing unauthorized or malicious firmware from being installed, even if an attacker gains access to the update channel. For any product handling sensitive data, operating in a regulated industry, or simply valuable enough to be a target for IP theft or tampering, secure boot is not optional.

STMicroelectronics provides X-CUBE-SBSFU (Secure Boot and Secure Firmware Update) as the official reference implementation for secure bootloading on STM32. It implements signature verification, encrypted firmware images, and anti-rollback as a packaged solution. Third-party alternatives such as wolfBoot and MCUboot (the latter used within the Zephyr ecosystem) provide similar capabilities with different licensing models, cryptographic library choices, and feature sets — including wolfBoot’s specific support for STM32H5’s TrustZone-M secure boot chain.

A complete, production-grade STM32 bootloader combines all three mechanisms into a single coherent update flow: Every step in this chain exists because of a real failure mode observed in production embedded systems. Skipping any one of them — writing directly over active firmware, skipping signature verification “for now,” or omitting the first-boot health confirmation — reintroduces exactly the risk the architecture is designed to eliminate.

3. Software Implementation, Frameworks & Protocols Overwriting the active firmware bank directly. Any update strategy that writes incoming firmware over the currently running code, rather than into a separate bank or staging buffer, has no recovery path if the transfer is interrupted by a power loss or communication failure.

Treating “boots successfully” as “update successful.” Without a first-boot health confirmation step, a firmware image with a subtle runtime fault can pass initial boot and still permanently brick the device on the next power cycle. Skipping signature verification during development “to move faster.” This is consistently the step that gets cut under schedule pressure — and consistently the step whose absence becomes a security incident after launch.

Not testing power-loss scenarios explicitly. A bootloader must be validated against power interruption at every stage of the update process: mid-transfer, mid-write, mid-verification, and mid-bank-swap. Each of these is a distinct failure mode requiring its own test case. Storing cryptographic keys in plain, readable flash. Without OTP storage or hardware-isolated secure storage (such as TrustZone-M on STM32H5), keys embedded in flash are extractable by anyone with physical access to the device.

Q: What is dual-bank flash on STM32, and which series support it? A: Dual-bank flash is a memory architecture where the STM32’s flash is split into two independently addressable and bootable regions, allowing a new firmware image to be written to one bank while the device continues running from the other. STM32 series with dual-bank flash support include the F4, F7, H5, and H7 families, plus specific G0 variants (G0B1/G0C1 at 256 KB+ flash densities), among others — coverage varies by specific device, so always confirm dual-bank support against the datasheet for your exact part number.

Q: How do I implement secure OTA updates on STM32? A: A secure OTA implementation requires four components working together: a bootloader resident in protected flash that verifies and applies updates, application firmware that contains the product’s main functionality, a communication interface (Wi-Fi, BLE, CAN, UART, etc.) to receive new firmware, and a security layer providing digital signature verification and encryption. STMicroelectronics provides X-CUBE-SBSFU as an official reference implementation, while third-party options like wolfBoot and MCUboot offer alternative approaches with different cryptographic libraries and licensing terms.

Q: What happens if an STM32 firmware update fails halfway through? A: In a properly designed dual-bank or staged-update architecture, a failed update should never affect the currently running firmware, because the new image is written to a separate bank or buffer rather than overwriting active code. If the device loses power mid-transfer, mid-write, or mid-verification, it simply continues running the last known-good firmware on the next boot — the incomplete or corrupted new image is discarded or simply never activated.

Q: What is the difference between X-CUBE-SBSFU and wolfBoot? A: X-CUBE-SBSFU is STMicroelectronics’ official secure boot and secure firmware update package, tightly integrated with the STM32Cube ecosystem. wolfBoot is a third-party secure bootloader supporting a wider range of cryptographic algorithms (including post-quantum options like LMS and XMSS), backed by wolfCrypt — a cryptographic library with FIPS 140-2 and 140-3 validated configurations, and specific support for STM32H5’s TrustZone-M secure boot chain. The right choice depends on certification requirements, cryptographic algorithm preferences, and how much customization the project needs versus using STMicroelectronics’ supported reference design directly.

Q: How long does it take to develop a custom STM32 bootloader? A: A basic single-bank bootloader with UART-based updates and simple checksum validation can be implemented in a few weeks. A production-grade dual-bank bootloader with cryptographic signature verification, anti-rollback protection, first-boot health confirmation, and full power-loss-resilience testing typically requires 2–4 months of dedicated embedded engineering effort, including the test campaign needed to validate every failure mode. Projects that underestimate the testing phase — particularly power-loss scenario testing — are the most common source of schedule overruns in bootloader development.

A production-grade STM32 bootloader is not a single feature: it is the combination of OTA delivery, dual-bank (or staged) fallback, and secure boot working together as one coherent safety system. Each mechanism addresses a distinct failure mode: OTA delivery handles getting new firmware to the device, dual-bank fallback handles what happens when that firmware turns out to be broken, and secure boot handles what happens when someone tries to install firmware that was never supposed to run at all.

Cutting corners on any one of these — even under schedule pressure — reintroduces exactly the risk the architecture exists to prevent. For products that will spend years in the field, the cost of getting bootloader development right once is consistently lower than the cost of a field-bricked device fleet later. GNS Engineering is a European embedded software development company based in Cluj-Napoca and TimiIoara, Romania.

Our team has developed custom STM32 and AUTOSAR-based bootloaders for production programs, including a custom CAN bootloader for next-generation BMW instrument cluster ECUs with FOTA support. Contact us to discuss bootloader development for your product. With expertise in embedded software engineering and a strong focus on the automotive and industrial sectors, GNS Engineering supports businesses in accelerating digital transformation and product development through advanced engineering services.

In the realm of embedded systems, ensuring the integrity and security of firmware is paramount. One prominent approach is Secure Boot, a robust mechanism that safeguards against unauthorized code execution and tampering. In this article, we delve into the technical intricacies of integrating Secure Boot using the widely adopted I2C communication protocol on STM32 microcontrollers.

Secure Boot is a critical security feature that prevents the execution of unauthenticated or malicious firmware on a microcontroller. At its core, it relies on cryptographic algorithms to verify the authenticity and integrity of the firmware before allowing it to run. In the context of STM32 microcontrollers , implementing Secure Boot involves integrating cryptographic checks into the boot process.

The I2C (Inter-Integrated Circuit) protocol , a popular synchronous serial communication standard, plays a pivotal role in establishing communication between microcontrollers and peripheral devices. Its bidirectional nature and multi-master capability make it an ideal choice for interconnecting components in a secure boot system. Leveraging I2C, the STM32 microcontroller can communicate securely with external storage, such as an EEPROM or external flash memory, to fetch the cryptographic keys and firmware signatures required for verification.

Configuring the STM32 microcontroller for Secure Boot involves setting up the necessary hardware peripherals and initializing the I2C interface. The STM32CubeMX tool simplifies this process, allowing developers to define the I2C configuration , pin mappings, and clock settings seamlessly. The integration of Secure Boot features necessitates meticulous attention to the initialization sequence, ensuring proper communication between the microcontroller and external memory.

In the secure boot process, cryptographic algorithms such as SHA-256 or HMAC (Hash-based Message Authentication Code) play a pivotal role. These algorithms generate digital signatures or hash values that serve as unique fingerprints for the firmware. Verifying these signatures through the I2C interface ensures that the firmware loaded into the microcontroller is authentic and unaltered. Understanding the nuances of these algorithms is crucial for a robust and reliable secure boot implementation.

The secure boot workflow involves a series of steps, from fetching the firmware image from external memory to verifying its integrity using cryptographic keys. Through the I2C interface, the STM32 microcontroller communicates with the external storage, retrieves the firmware image, and performs cryptographic checks. Any deviation from the expected signature results in the rejection of the firmware, preventing the execution of potentially compromised code.

While implementing Secure Boot with I2C on STM32MCU enhances firmware security, developers must be cognizant of potential challenges. These may include ensuring the confidentiality of cryptographic keys, protecting against side-channel attacks, and mitigating the risks associated with external memory access. Addressing these challenges is imperative for creating a robust and resilient secure boot solution.

In conclusion, integrating Secure Boot with the I2C communication protocol on STM32 microcontrollers elevates the security posture of embedded systems. This technical endeavor involves configuring the microcontroller, leveraging cryptographic algorithms, and orchestrating a meticulous workflow. As the industry continues to emphasize the importance of firmware security, mastering the integration of Secure Boot with I2C is a valuable skill for embedded systems developers.

A secure, lightweight bootloader designed for STM32F401RE microcontrollers that integrates hardware-based cryptographic verification using Infineon’s OPTIGA™ Trust M secure element. This project implements a robust and fail-safe firmware update mechanism that leverages YMODEM protocol for transmission and ECDSA signature verification for ensuring firmware authenticity before execution. Built for resource-constrained embedded systems, this bootloader is suitable for industrial, consumer, and IoT deployments where firmware security and reliability are critical.

Unlike conventional bootloaders that rely on internal flash-based key storage, this design uses a dedicated secure element (Trust M) to ensure the private key is never exposed — even to the MCU itself. The STM32 simply hashes the firmware and delegates validation to Trust M, creating a tamper-proof firmware update pipeline that is ideal for mission-critical devices. 4. Practical Deployment, Analysis & Case Studies Firmware Reception Bootloader receives a firmware.bin file with an appended ECDSA signature via UART using YMODEM.

SHA-256 Hashing Uses mbedTLS to compute the hash of the firmware (excluding the signature). Public Key Validation (Trust M) Verifies the hash against the signature using a secure public key stored in OPTIGA™ Trust M. Firmware Flashing & Jump If verification passes, firmware is flashed into application memory and execution is transferred. Feel free to open issues or submit pull requests to improve this bootloader or expand it to support other STM32 families.

Secure Boot + OTA system for STM32G4 using a minimal SBSFU bootloader. ESP32 NodeMCU handles secure OTA download/storage. OPTIGA Trust M enables cryptographic signature verification and key storage. Designed for low-flash MCUs with strong security needs. Step-by-step guide to implementing secure boot on ARM Cortex-M microcontrollers using TF-M, hardware root of trust, and cryptographic verification.

Secure boot is a critical security mechanism that ensures only authenticated and untampered firmware executes on a microcontroller, establishing a hardware root of trust from the moment the device powers on. On ARM Cortex-M devices, secure boot works by verifying the cryptographic signature of the firmware image against a public key stored in immutable memory (OTP fuses or ROM) before transferring execution control. The boot process forms a chain of trust: the ROM bootloader verifies the first-stage bootloader, which in turn verifies the application firmware. ARM's Platform Security Architecture (PSA) and Trusted Firmware-M (TF-M) provide standardized frameworks for implementing secure boot on Cortex-M23, M33, and M55 processors that support TrustZone-M. Without secure boot, attackers can flash malicious firmware, extract intellectual property, or compromise device integrity through physical or remote attacks on the update mechanism.

The chain of trust begins with an immutable root of trust, typically implemented in mask ROM or hardware security modules. When the device powers on, the ROM bootloader executes first and verifies the signature of the second-stage bootloader (often MCUboot or a vendor-specific bootloader). If verification succeeds, control passes to the second-stage bootloader, which then verifies the application firmware. Each stage in the chain must be verified before execution. If any verification fails, the device enters a safe state, preventing potentially compromised code from running. This hierarchical verification ensures that even if an attacker modifies the application firmware, the bootloader will detect the tampering and refuse to execute it.

ARM TrustZone-M, available on Cortex-M23, M33, and M55 processors, provides hardware-enforced isolation between Secure and Non-Secure worlds. In a secure boot implementation, the Secure Processing Environment (SPE) handles cryptographic verification, key storage, and secure services, while the Non-Secure Processing Environment (NSPE) runs the application code. The Security Attribution Unit (SAU) and Implementation Defined Attribution Unit (IDAU) control which memory regions and peripherals are accessible from each world. TF-M (Trusted Firmware-M) provides a reference implementation of PSA-compliant secure services including secure storage, cryptography, and attestation that run in the secure world.

Several common mistakes can undermine secure boot security. Storing private signing keys in version control or CI/CD systems without proper secrets management exposes the entire trust chain. Failing to protect debug interfaces (JTAG/SWD) allows attackers to bypass secure boot by directly reading or modifying flash memory. Not implementing rollback protection means attackers can downgrade to older firmware versions with known vulnerabilities. Leaving test or development keys in production devices creates a universal bypass. Always use hardware security modules (HSMs) for key management, disable debug access on production devices, implement monotonic version counters for anti-rollback, and rotate keys according to your security policy.

Key takeaway: Secure boot on ARM Cortex-M establishes a hardware root of trust by verifying cryptographic signatures of firmware images at each boot stage. Using MCUboot with ECDSA P-256 signatures and TrustZone-M isolation on Cortex-M33/M55, you can prevent unauthorized code execution while adding under 100 ms to boot time. When we implemented secure boot for a client's industrial IoT gateway at EmbedCrest, we used an STM32L5 (Cortex-M33 with TrustZone) running MCUboot in the Secure Processing Environment. The boot chain consisted of three stages: the ROM bootloader (immutable, stored in factory-programmed OTP) verified MCUboot using a SHA-256 hash stored in OTP fuses, MCUboot verified the TF-M Secure image using ECDSA P-256 with a public key embedded in the MCUboot binary, and TF-M verified the Non-Secure application firmware before jumping to it. We stored the ECDSA signing private key in an AWS CloudHSM, with the CI/CD pipeline (GitHub Actions) requesting signatures through a limited-access IAM role. This prevented any single engineer from accessing the private key. Total boot time overhead was 65 ms for the two signature verifications, well within the 500 ms boot budget. We also implemented anti-rollback protection using a monotonic counter stored in STM32L5 OTP bits, preventing downgrade attacks to firmware versions with known CVEs.

Secure boot is only as strong as its weakest link. Follow these engineering practices to maintain the integrity of your boot chain. Store signing keys exclusively in Hardware Security Modules (HSMs) such as AWS CloudHSM, Azure Dedicated HSM, or YubiHSM 2. Never store private keys in version control, CI environment variables, or developer workstations. Implement key rotation procedures with a planned transition period where both old and new public keys are accepted. Disable all debug interfaces (JTAG/SWD) on production devices using permanent fuse settings, not software configuration. Enable flash readout protection (RDP Level 2 on STM32) to prevent firmware extraction via debug probes. Implement monotonic version counters in OTP or secure storage to prevent rollback attacks. Test your secure boot implementation against the OWASP Firmware Security Testing Methodology, including glitch injection resistance if your threat model includes physical attackers with moderate resources.

Signature verification time varies significantly across Cortex-M families and depends on whether hardware crypto acceleration is available. On a Cortex-M0+ at 48 MHz without crypto hardware, RSA-2048 verification takes 800-1200 ms and ECDSA P-256 takes 300-500 ms, making secure boot painfully slow. On a Cortex-M4 at 168 MHz (STM32F4) with no crypto accelerator, RSA-2048 drops to 150-250 ms and ECDSA P-256 to 60-120 ms. On a Cortex-M33 at 110 MHz with hardware PKA (STM32L5, STM32U5), ECDSA P-256 verification completes in 8-15 ms, making it nearly imperceptible. Ed25519 signatures offer faster software verification than ECDSA P-256 (approximately 30% faster on Cortex-M4 without hardware acceleration) while providing equivalent 128-bit security. For applications requiring the fastest boot possible, choose an MCU with hardware crypto acceleration and use ECDSA P-256 or Ed25519 rather than RSA.

Yes, secure boot can be implemented on any Cortex-M device using MCUboot or vendor-specific bootloaders. TrustZone adds hardware isolation but is not required for signature verification. RSA-2048 signature verification takes 50-200ms on a typical Cortex-M4 at 64MHz. ECDSA P-256 is faster at 20-80ms. Hardware crypto accelerators can reduce this to under 10ms.

Secure boot alone prevents unauthorized code execution but does not prevent reverse engineering of legitimate firmware. For IP protection, combine secure boot with firmware encryption and flash readout protection (RDP). Security first engineering with secure boot, encryption, QA testing, and R&D as a service. Comprehensive guide to securing IoT devices from an industrial IoT solutions provider. Covers hardware security, encrypted communication, secure boot, OTA updates, and vulnerability management.

Learn how over-the-air firmware updates work in embedded systems. A firmware development company guide covering A/B partitioning, delta updates, rollback protection, and secure delivery. From Edge AI to industrial IoT, our engineering team delivers end to end embedded systems solutions. Let us discuss your project requirements.

Discover how our CycloneBOOT solution performs across different evaluation boards. Below, youâIIll find an overview of the firmware update scenarios and available demos, including the protocols used for seamless firmware delivery. With this scenario, based on In-Application Programming (IAP), firmware updates are handled entirely by the CycloneBOOT Update Library , without the presence of a dedicated bootloader. This mode is supported only on dual-bank flash microcontrollers, where the internal flash memory is divided into two independent banks. When a new firmware image is received, the update library processes the incoming update image, performs verification and compatibility checks and installs the validated firmware into the inactive bank while execution continues from the active bank. Before rebooting, the update library configures the MCU to select the newly programmed bank as the primary boot bank. On reset, execution seamlessly switches to the updated user application. This approach minimizes system complexity, while providing update capability on platforms that support bank swapping.

5. Performance Evaluation & Extended Technical Observations This Hybrid mode combines the CycloneBOOT Update Library with the CycloneBOOT Bootloader to form a cooperative update mechanism. In this configuration, the user application is responsible for downloading and validating the new firmware image using the update library, and storing it in a designated download slot. Once the update is ready, control is transferred to the bootloader during the next reboot. The bootloader then performs final integrity checks, installs the validated firmware into its execution slot, and launches the updated user application. This mode cleanly separates the acquisition of updates from their installation. It also provides support for configurations using external flash memory.

Note: This mode enables boot-time application firmware verification at every startup (Verified Boot) and advanced fallback support. The CycloneBOOT Standalone Bootloader is an independent, self-contained bootloader that manages the entire firmware update lifecycle without relying on the user application. Unlike Hybrid mode, all communication protocols, image validation, version control, and update logic are implemented directly within the bootloader itself. When a new firmware image is received, the standalone bootloader processes the update image, performs verification and compatibility checks, and installs the validated firmware into flash memory. After the installation is complete, the bootloader resumes its normal startup sequence and launches the updated user application.

Note: This solution also applies to MCUs supporting program execution from an external memory (EXecute-in-Place - XiP) The table below summarizes our available demos, organized by evaluation board and scenario (Dual-Bank, Hybrid, Standalone). It also highlights the protocol used for fetching new firmware updates. We have now standardized the use of CMake across all projects. However, our demonstration projects can also use the following toolchains: STM32CubeIDE, Microchip Studio, KEIL MDK-ARM, or Makefile.

If youâIId like to see a demo using your preferred toolchain, or if you need support for a different evaluation board, MCU part number, protocol or scenario, just let us know. We can tailor the demo to your needs! Is it possible to transform security on embedded systems from a burden to a blessing? It’s the question ST is trying to answer with STM32Trust , an initiative that focuses on all the software and hardware solutions we bring to improve the security of our devices as well as bring security expertise to non-experts . Information security, or InfoSec, can be a burden because it is so broad and complex. Hence, helping engineers means making ST tools more accessible. Indeed, taking advantage of all the features that a system offers is not always evident. Moreover, stringent certifications can increase costs and delay product launches. Developers thus need solutions to implement vital protections faster.

The latest initiative we announced in early 2023 was Secure Manager (more on that later). A few months later, we released the STM32H5 , the first MCU to support the security initiative. And a few weeks ago, we published updates to STM32CubeProgrammer and STM32CubeMX that open up certain features provided by Secure Manager. To make Secure Manager even more accessible, we are excited to offer a webinar on September 7th, coinciding with the release of binaries that will allow developers to easily implement the new STM32Trust TEE. Hence, as the solution becomes available to all, the webinar will provide a step-by-step guide to get started.

As cloud connectivity is ever more present, it becomes imperative to safeguard credentials, encryption keys, and more to prevent attacks on server farms and other sensitive infrastructures. As our lives are increasingly digital, sensor data can seriously hurt a person’s privacy. Furthermore, governments are starting to mandate stricter cybersecurity rules. The European Union is working on its Cyber Resilience Act, while the United States passed the IoT Cybersecurity Improvement Act in 2020, to name two initiatives only. The challenge is that many are left wondering what safeguards they should put in place and the impact of the new laws on the future of their products.

STM32Trust is ST’s solution to this challenge, as it makes security more accessible and straightforward. It is a program that keeps growing as we release more software tools and products over time. The initiative also helps educate developers to ensure their knowledge is current. As a result, ST holds training, publishes papers, writes documentation, and works with partners to facilitate the obtention of certifications . In other words, exhaustively explaining all the aspects of STM32Trust in one blog post would be futile, which is why The ST Blog decided to focus on core solutions to help readers better visualize how they can implement security into their system.

Secure Manager , announced recently, is the first Trusted Execution Environment solution by ST. Indeed, we offer binaries and, for the first time, handle the certification at the system level. As a result, customers targeting a SESIP & PSA Level 3 Certification can vastly hasten their qualification process. Available in June, it will only support the STM32H5 at launch but will be compatible with other STM32 MCUs over time. The Secure Manager will take the form of a downloadable software package containing binaries, libraries, code implementations, and documentation, among other things. There will also be configuration options in STM32CubeMX, ST’s initialization software , to guide developers in activating certain features like the STM32H5’s iRoT.

Previously, ST only provided source code, which meant that developers had to adapt it and compile it, which would force them to certify the code again. Indeed, the qualification is only valid if the code remains unchanged. A binary guarantees just that. Additionally, Secure Manager provides a turnkey solution that automatically sets up the iRoT and features like secure storage, cryptography, and certificates, making the process much simpler. Companies only have to worry about the secure modules they design in-house and the final application that will run on the microcontroller.

Additionally, customers don’t have to worry about updating their system in case of an issue. Since we own the binaries and manage the stack, we can write and publish a patch. Even teams with significant expertise in the matter will appreciate the vastly simpler workflow. Indeed, unless a product has very specific needs, using ST’s binaries saves tremendous time and resources. We also provide a Secure Manager Access Kit (or SMAK) to help developers create applications that use services from the Secure Manager but run on the non-trusted part of the TrustZone environment.

ST designed the new Secure Manager with flexibility in mind, thus allowing more seasoned developers to customize their solutions. For instance, it comes with the Secure Manager Development Kit (SMDK), which can help create complex and trusted applications. A team working on a fingerprint algorithm would thus use the SMDK to turn it into a secure and encrypted module living in a privileged area.

Moreover, thanks to the iRoT, programmers can store keys and certificates in the STM32H5, and thus register an embedded system to a cloud server without needing external keys. Therefore, Secure Manager on the STM32H5 frees companies from dealing with external hardware security modules, among other things. Cryptographic APIs also allow programmers to wrap and unwrap sensitive credentials using encryption keys without ever accessing them directly, thus protecting them from attacks.

Secure Boot is a program that runs at startup or reset to verify the integrity of the boot files by checking file size or signature to determine if anything changed. It thus protects the system from attacks that want to compromise the firmware during the boot sequence. Another type of protection is a secure firmware update. This method shields users from attacks that modify the existing system remotely . Indeed, when a server sends a partial or complete encrypted firmware image update, the embedded system transmits it via UART to the MCU, the system checks its authenticity, and then decrypts it before installing it.

A package like X-CUBE-SBSFU allows developers to implement these features more easily. For instance, the code from X-CUBE-SBSFU that runs on our STM32L4 received a PSA Level 1 certification . Engineers can thus use it to receive the same accreditation much more quickly. Moreover, ST continues to make its source code available . As a result, developers can learn from our implementation and optimize their applications. For example, our libraries can generate 60 KB binaries approximately, which can be a bit large for some small embedded systems. However, optimization operations enable developers to trim the code and only use relevant functions to fit their MCU.

X-CUBE-SBSFU also serves other purposes as it helps teams take advantage of various STM32Trust tools. For instance, it uses our X-CUBE-CRYPTOLIB library to optimize cryptographic operations. ST recently overhauled the software package to offer a modular approach and certified code. Moreover, X-CUBE-CRYPTOLIB now segregates libraries according to the MCU to be more intuitive. X-CUBE-SBSFU also added support for STSAFE-A110 , the tamper-resistant secure element, found on the STEVAL-STWINKT1B , that stores various keys and certificates.

Both TF-M and TF-A are reference implementation of a Trusted Execution Environment (TEE). The former works on specific Cortex-M cores, while the latter is for Cortex-A devices. As the name implies, the point is to create trust by isolating and securing various aspects of the system . For instance, TF-M and TF-A leverage secure storage and cryptographic operations to secure the boot and update processes. Hence, they offer a way to guarantee the integrity of the Secure Boot mechanism and the firmware. They also sandbox runtimes to prevent an issue from affecting the whole system and enable services such as key storage as well as attestation and secure cryptography.

Developers looking to use TF-M on a compatible STM32 microcontroller will find what they need in its software package . For instance, implementing TF-M on an STM32L5 starts with STM32CubeL5 . The package has a reference implementation for significant features like secure boot, secure storage, secure isolation, and more. As a result, teams can create a mechanism similar to SFU but with standard isolation schemes.

We will also continue to improve our reference implementation over time to take advantage of more features. As for TF-A, since things are obviously different for an MPU, ST created a Wiki to guide engineers . It walks users through the major notions and software tools to rapidly implement a reference environment. Additionally, developers can also use OP-TEE, an Open Portable Trusted Execution Environment that serves as a companion solution for non-secure Linux kernels .

Secure Firmware Install is a mechanism that protects a customer’s binary from malicious activities . Very often, companies must rely on a third party to assemble their final product. The problem is that it can cause a great deal of anxiety and uncertainty. A rogue employee on the assembly line, or hackers, could steal the firmware, leading to catastrophic consequences. A secure firmware install protects against it by encrypting the firmware before shipping it to the OEM. Since decryption happens when the code is inside the MCU, the IP remains safe, and any stolen firmware is useless. Additionally, companies can even use this technique to track the number of firmware installations to monitor any product theft.

SFI relies primarily on two tools. Developers encrypt their firmware with the Trusted Package Creator utility available within the STM32CubeProgrammer software and place their private keys and certificates in a secure hardware module that takes the form of a smart card . Harvested Online Documentation & Reference Sources • https://en.wikipedia.org/wiki/RP2350 • https://hightechcom.de/blogs/electronics-and-firmware/stm32-secure-bootloader-architectures • https://github.com/sheltsnn15/stm32-secure-boot • https://github.com/STMicroelectronics/stm32-mw-mcuboot • https://gnsengineering.com/stm32-bootloader-development/ • https://researchtech.net/index.php/2024/01/simple-i2c-secure-boot-integration-stm32mcu/ • https://github.com/SirMcNugg3t/mySBSFU_STM32 • https://www.embedcrest.com/blog/secure-boot-arm-cortex-m • https://www.oryx-embedded.com/resources/open-source-secure-bootloader-demos.html • https://blog.st.com/stm32trust/