Arm TF-M solution

Arm trusted firmware existed for chips based on Cortex-A when the secure Cortex-M33 core was introduced with Armv8-M architecture. A more compact TF-M open-source implementation of PSA standard was provided as a reference secure firmware framework.

For STMicroelectronics MCUs that take advantage of the Armv8 architecture (such as STM32H5, STM32L5, STM32U3, and STM32U5 devices), the SBSFU is enhanced with the TF-M based solution.

For a documentation on TF-M itself, refer to the UM2851, and use Arm resources as well as the code comments.

For guidance on TF-M integration on the STM32L5 and STM32U5 devices, refer to the user manuals Getting started with STM32CubeL5 TF-M application (UM2671) or Getting started with STM32CubeU5 TF-M application (UM2851).

Refer to document AN5156_General-Info.html#concept_vts_yqx_fcb__entry_h2q_brz_qvb for a detailed comparison when migrating from X-CUBE-SBSFU package SBSFU to TF-M.

Table 8. Basic feature differences of TrustZone®-based secure software
Feature	SBSFU for TrustZone®	TF-M
RoT services	Immutable RoT	Immutable RoT + updatable RoT
Cryptographic key management	Static keys only	Key storage hierarchy with HUK root key
Secure storage	Absent	Internal and external
NV counter	No	Yes

Both alternatives are based on TF-M and MCU boot, but while SBSFU intends to replicate familiar features of X-CUBE-SBSFU while retaining most flash memory space for user code, TF-M offers more functionality. Some of that can be dropped to gain memory space. For the STM32H57x line, the Secure Manager, a closed-source implementation of TF-M, offers a convenient and express way to adopt certified secure solutions.

Secure manager

The goal of the Secure manager is to guide customers to a certified secure software solution. Secure manager implements the PSA secure APIs (similar to the TF-M) and by using them, the user nonsecure application can form a secure system with certified attack resistance.

The Secure manger application kit is distributed in the form of encrypted binary and is free to use on compatible STM32H5 MCUs.

Secure manager can expand its secure functionality by using modules.

Product certifications

Different secure applications often require certain certifications to prove their capability to perform in a secure manner. Independent or government agencies grant certification status to either an MCU application or a combination of MCUs with secure firmware after testing them against evaluation goals.

The certifications and evaluations related to STM32 microcontrollers include, but are not limited to:

PSA Certified (platform security architecture), governed by Arm, focused on IoT security, MCU certification, three levels of assessment
- STM32L4, STM32G0, and STM32G4 devices are certified up to level 1.
- STM32L5 devices with TF-M are certified PSA level 2, SESIP level 3.
- STM32C0, STM32C5, STM32U0, and STM32H7RS are PSA level 3 and SESIP level 3 certified or certifiable and under evaluation in their scope of secure boot features despite not having TrustZone® isolation
- STM32U5, STM32H7S, STM32U0, STM32U3, and STM32H5 devices with TF-M are certifiable up to level 3.
- To achieve Arm PSA certifiable security level, refer to the user manual STM32U585 security guidance for PSA Certified level 3 with SESIP profile (UM2852). Details of the particular PSA certificates are available online at https://products.psacertified.org/
SESIP (security evaluation standard for IoT platforms), international methodology adopted by several major security evaluation labs, five levels
- Systems using SBSFU or TF-M are compliant to level 3 with STM32L4, STM32L4+, STM32L5, STM32H5, STM32N6, and STM32U5 devices.
PCI (payment card information), an important security standard focusing on point of sale (POS) applications
- Good record of successful evaluation of systems, using, for example, STM32L4 devices

Note:

FIPS (Federal Information Processing Standards) is a set of standards published by NIST, some of which (FIPS 140, SP800) are related to security or cryptography.

Table 9. Certifications coverage
MCU series	Crypto conformance certification	Security system certification	Security system certification with physical resistance (invasive)
STM32G0/ STM32G4	FIPS CAVP, SP800-90A	PSA L1	-
STM32L4	FIPS CAVP, SP800-90A
STM32L4+	FIPS CAVP, SP800-90B
STM32H7
STM32L5		PSA L1, SESIP L3
STM32WBA		Yes	PSA L3, SESIP L3 (with TF-M)
STM32U5			PSA L3, SESIP L3 (with TF-M)
STM32H5			PSA L3, SESIP L3 (with Secure Manager)
STM32H7Sx, STM32C0, STM32C5, STM32U0			PSA L3, SESIP L3 (using iRoT)

For detailed and most recent evaluation status, refer to the official certificate listings:

STM32 security features

This section presents all the STM32 features that can be used to meet the different security concepts presented in previous sections, and to achieve a high level of security.

Overview of security features

Static and dynamic protections

A distinction can be made depending on whether protection features are static or dynamic:

Static protections refer to features that are set with option bytes. Their configuration is retained at power off.
Static protections are RDP (or product state), PCROP, WRP, BOR, OTP, and secure hide protection (when available).
Dynamic (or run time) protections do not retain their status at reset. They have to be configured at each boot (for example during Secure boot (SB) ).
Dynamic protections provided by STM32 include MPU, tamper detection, and firewall.
Other dynamic protections are related to both security and safety. An abnormal environment behavior may be accidental (safety) or intentional, in order to carry out an attack. These protections include clock and power monitoring systems, memory integrity bits, and independent watchdog (IWDG).

Security features by STM32 devices

The following tables are intended for reference and the prospects of secure code porting between STM32 products. The presence or absence of a particular feature may not be indicative of achievable security. For that reason, refer to the available security certifications for the particular product.

Table 10. Security features for STM32C0/5, STM32F0/1/2/3/4, STM32G0/4 devices
Feature		STM32C0	STM32C5	STM32F0	STM32F1	STM32F2	STM32F3	STM32F4	STM32G0	STM32G4
Cortex core		Cortex‑M0+	Cortex‑M33	Cortex‑M0	Cortex‑M3	Cortex‑M3	Cortex‑M4	Cortex‑M4	Cortex‑M0+	Cortex‑M4
RDP additional protection		Bad OBL recovery	Backup registers, SRAM2, 2-level RDP only	Backup registers	2-level RDP only	Backup SRAM	Backup registers	Backup SRAM	Backup registers	Backup registers, CCMSRAM
Flash WRP		By area with 2‑Kbyte granularity, two areas available	By pages (8 Kbytes)	By sectors (4 Kbytes)	By pages (4 K or 8 Kbytes)	By sectors (16 K, 64 K, or 128 Kbytes)	By sectors (4 Kbytes)	By sectors (16 K, 64 K, or 128 Kbytes)	By area with 2‑Kbyte granularity, two areas available	By page (2 K or 4 Kbytes)
SRAM WRP		No	SRAM2, 1‑Kbyte granularity	No	No	No	No	No	No	CCM SRAM, with 1‑Kbyte granularity
PCROP		By area with 256‑byte granularity, one area per bank	No	No	No	No	No	By sectors	By area with 512‑byte granularity, two areas available	By area with 64‑ or 128‑bit granularity, up to two areas
HDP		Yes (securable memory area)	Yes, 3 levels	No	No	No	No	No	Yes (securable memory area)
Firewall		No	No	No	No	No	No	No	No	No
MPU		Yes	Yes	No	Yes^¹	Yes	Yes^²	Yes	Yes	Yes
OTP		1 Kbyte	4.5 Kbyte	No	No	Yes	Yes	512 bytes	1 Kbyte	1 Kbyte
UBE^³		Yes (boot lock feature)	Yes (boot lock feature)	No	No	No	No	No	Yes (boot lock feature)	Yes
Internal tamper detection		No	Yes	No	No	No	No	No	Yes	Yes
Hardware crypto^⁴		No	AES, HASH, SAES, PKA, CCB	No	No	AES, HASH	No	AES, HASH	AES
RNG		No	SP800‑90‑B	No	No	SP800‑90‑A	No	SP800‑90‑A
Secure software	SBSFU	No	Yes	No	No	No	No	Yes	Yes	Yes
	TF-M	No	No	No	No	No	No	No	No	No
	KMS	No	No	No	No	No	No	No	No	No

Table 11. Security features for STM32L0/1/4/4+ and STM32U0 devices
Feature		STM32L0	STM32L1	STM32L4	STM32L4+	STM32U0
Cortex core		Cortex‑M0	Cortex‑M3	Cortex‑M4		Cortex‑M0+
RDP additional protection		EEPROM		Backup registers, SRAM2		Backup registers, SRAM2
Flash WRP		By sectors (4 Kbytes)		By area with 2‑Kbyte granularity, one area per bank		Two areas per bank defined by page range
SRAM WRP		No	No	SRAM2, with 1‑Kbyte granularity		No
PCROP		By sectors		By area with 8‑byte granularity, one area per bank		No
HDP		No	No	No	No	Yes, with second stage extension
Firewall		Yes	No	Yes	Yes	No
MPU		Yes	Yes	Yes	Yes	Yes
OTP		No	No	1 Kbyte		1 Kbyte
UBE^⁵		No	No	No	No	Yes (boot lock feature)
Internal tamper detection		No	No	No	No	Yes
Hardware crypto^⁶		AES		AES, HASH	AES, HASH, (some PKA)	AES
RNG		No	No	SP800‑90‑A	SP800‑90‑B	SP800‑90‑B
Secure software	SBSFU	Yes	Yes	Yes	Yes	MCUboot
	TF-M	No	No	No	No	No
	KMS	No	No	Yes	Yes	No

Table 12. Security features for STM32WB, STM32WBA, STM32WB0x, STM32WL, and STM32WL3 devices
Feature		STM32WB	STM32WBA	STM32WB0x	STM32WL	STM32WL3
Cortex core		Cortex‑M4/Cortex‑M0+	Cortex‑M33	Cortex‑M0+	Cortex‑M4/Cortex‑M0+	Cortex‑M0+
RDP additional protection		Backup registers, SRAM2	RDP four levels,backup registers, SRAM	No	Backup registers, SRAM2	No
Flash WRP		By area with 4‑Kbyte granularity, two areas available	Two areas, defined by page range	By area with 2‑Kbyte granularity, two areas available		Four areas
SRAM WRP		SRAM2, with 1‑Kbyte granularity		No	SRAM2, with 1‑Kbyte granularity	No
PCROP		By area with 2‑Kbyte granularity, up to two areas	No		By area with 1‑Kbyte granularity, two areas available	No
HDP		Yes (dedicated to Cortex‑M0+ firmware only)	Yes	No	Yes	No
Firewall		No	No		Yes	No
MPU		Yes (Cortex‑M4)	Yes	Yes	Yes	Yes
OTP		1 Kbyte
UBE^⁷		No	Yes (lockable secure and NS address)	No	Yes (boot lock feature)	No
Internal tamper detection		No	Yes	No	Yes	No
Hardware crypto^⁸		AES, PKA	AES, HASH, PKA	AES^⁹, PKA		AES
RNG		SP800‑90‑A	SP800‑90‑B
Secure software	SBSFU	Yes	Yes	Yes^¹⁰	Yes	Yes^¹⁰
	TF-M	No	Yes	No	No	No
	KMS	No	No	No	No	No

Table 13. Security features for STM32L5, STM32U3, STM32U5, STM32H503/5, STM32H7R/S, STM32H72x/73/74x/75, STM32H7Ax/7Bx, STM32F7 devices
Feature		STM32L5	STM32U3 STM32U5	STM32H503	STM32H5	STM32 H7R/S	STM32 H72x/73x	STM32 H74x/75x	STM32 H7Ax/7Bx	STM32F7
Cortex core		Cortex‑M33	Cortex‑M33			Cortex‑M7
RDP additional protection		RDP four levels, backup registers, SRAM2	RDP four levels, backup registers, SRAM3	Product state instead of RDP		Product state instead of RDP, backup SRAM	Backup SRAM, backup registers, OTFDEC	Backup SRAM, backup registers	Backup SRAM, backup registers, OTFDEC	Backup SRAM
Flash WRP		Up to four protected areas with 2‑K or 4‑Kbyte granularity	Two areas per bank defined by page range		By group of 4 pages of 8‑Kbyte	By sectors (8 Kbytes)	By sectors (128 Kbytes)		By group of 4 8‑Kbyte sectors	By sectors (16 K, 64 K, 128 K, or 256 Kbytes)
SRAM WRP		SRAM2, with 1‑Kbyte granularity	SRAM2, with 1‑Kbyte granularity			No	No	No	No	No
PCROP		No (replaced by TrustZone)	No (replaced by TrustZone)	No	No (replaced by TrustZone)	No	By area with 256‑byte granularity	By area with 256‑byte granularity, one area per bank		By sectors
HDP		Up to two secure hide areas (HDP) inside the TrustZone secure domain	Up to two secure hide areas (HDP) inside the TrustZone secure domain	3‑stage temporal isolation, one per bank			Yes (secure user memory, with 256‑byte granularity)			No
Firewall		No (replaced by TrustZone)	No (replaced by TrustZone)	No	No (replaced by TrustZone)	No	No	No	No	No
MPU		Yes	Yes	Yes	Yes	Yes	Yes	Yes	Yes	Yes
OTP		512 bytes	512 bytes	2 Kbytes		1 Kbyte	No	No	No	No
UBE^¹¹		Yes (boot lock feature)		Yes	Yes	Yes (boot lock feature)	Yes (unique entry point in secure access)			No
Internal tamper detection		Yes	Yes	Yes	Yes	Yes	Yes	Yes	Yes	Yes
Hardware crypto^¹²		AES, HASH, PKA	AES, HASH, PKA, SAES, CCB^¹³	HASH	AES,SAES, HASH, OTFDEC, PKA	AES, SAES, HASH, PKA, MCE	AES, DES, HASH, OTFDEC			AES, HASH
RNG		SP800‑90‑B						SP800‑90‑A^¹⁴	SP800‑90‑B	SP800‑90‑A^¹⁴
Secure software	SBSFU	No	No	No	No	MCUboot	Legacy	Legacy	Legacy	Legacy
	TF-M	Yes	Yes	No	Yes	-	No	No	No	No
	KMS	No	No	No	Yes	-	No	No	No	No

¹ Only XL density devices feature the MPU.

² MPU is not universally supported in STM32F3 series. Refer to the product datasheet to confirm availability.

³ Unique boot entry.

⁴ For most devices with hardware crypto capability, there is a direct equivalent without it.

⁵ Unique boot entry.

⁶ For most devices with hardware crypto capability, there is a direct equivalent without it.

⁷ Unique boot entry.

⁸ For most devices with hardware crypto capability, there is a direct equivalent without it.

⁹ For STM32WB0, the AES is only available on the radio peripheral.

¹⁰ Secure boot solution separated from the usual X-CUBE-SBSFU package.

¹¹ Unique boot entry.

¹² For most devices with hardware crypto capability, there is a direct equivalent without it.

¹³ Only the selected STM32U3 series feature the CCB. It is not available on STM32U5 series.

¹⁴ RNG v2.0 can be used as a seed source for DRBG.