1. Article purpose[edit | edit source]
The purpose of this article is to explain how to perform a secure boot on an STM32 MPU device with the Distribution Package.
Follow these steps to perform this use case:
- Create the signature key with the KeyGen tool (if not already done).
- Put the signature key on the STM32 MPU (if not already done).
- Compile a Distribution Package with a signed FIP.
- Sign the first-stage bootloader binaries with the signing tool.
- Create a FlashLayout file for signed binaries.
- Program and test.
- Close the device (if not already done).
You must proceed step-by-step (no rollback possible).
2. Signature / Encryption information[edit | edit source]
| STM32MP13 | STM32MP15 | STM32MP21 | STM32MP23 | STM32MP25 | ||||||
|---|---|---|---|---|---|---|---|---|---|---|
| Signature | Encryption | Signature | Encryption | Signature | Encryption | Signature | Encryption | Signature | Encryption | |
| Key Creation | PKHTH | EDMK | PKHTH | OEM-KEY1 | EDMK1-128b | OEM-KEY1 | EDMK1 | OEM-KEY1 | EDMK1 | |
| Put key on Board | PKHTH | EDMK | PKHTH | OEM-KEY1 | EDMK1-128b | OEM-KEY1 | EDMK1 | OEM-KEY1 | EDMK1 | |
| Signing/Encrypt
first boot stage on CortexA |
Signing | Signing & encrypt | Signing | Signing | Signing & encrypt | Signing | Signing & encrypt | Signing | Signing & encrypt | |
3. Creating signature key[edit | edit source]
To perform the secure boot, binaries must be signed with a specific signature key.
If this signature key is already present on the STM32 MPU device, go directly to Distribution Package with signed FIP.
To create the signature key, use the STM32MP KeyGen CLI Tool.
Refer to the KeyGen tool page for installation and command-line options.
The minimal command to use is:
STM32_KeyGen_CLI -abs <output directory> -pwd <password> -n <number of key>
With:
- <output directory> = Patch to the generated private and public key files (privateKey.pem and publicKey*.pem).
- <password> = Password of the private key. The password must contain at least four characters. The number of passwords must match the number of key pairings.
- <number of key> = Number of key pairs, one for STM32MP15 or eight for other platforms.
3.1. Creating signature key for STM32MP13[edit | edit source]
Click on "Expand", visible on the right side of the page, to view Creating signature key for STM32MP13x lines 
.
STM32MP13 device supports up to eight signature key pairs (public key/private key).
Example:
STM32_KeyGen_CLI -abs stm32mp13-key/ -pwd azerty azerty azerty azerty azerty azerty azerty azerty -n 8
-------------------------------------------------------------------
STM32MP Key Generator <tool version>
-------------------------------------------------------------------
Prime256v1 curve is selected.
AES_256_cbc algorithm is selected for private key encryption
Generating Prime256v1 keys...
Private key PEM file created
Public key PEM file created
public key hash file created
Keys packet 0 generated successfully.
+ public key: stm32mp13-key/publicKey00.pem
+ private key: stm32mp13-key/privateKey00.pem
+ public hash key: stm32mp13-key/publicKeyHash00.bin
------------------------------------------------------------
AES_256_cbc algorithm is selected for private key encryption
Generating Prime256v1 keys...
Private key PEM file created
Public key PEM file created
public key hash file created
Keys packet 1 generated successfully.
+ public key: stm32mp13-key/publicKey01.pem
+ private key: stm32mp13-key/privateKey01.pem
+ public hash key: stm32mp13-key/publicKeyHash01.bin
------------------------------------------------------------
AES_256_cbc algorithm is selected for private key encryption
Generating Prime256v1 keys...
Private key PEM file created
Public key PEM file created
public key hash file created
Keys packet 2 generated successfully.
+ public key: stm32mp13-key/publicKey02.pem
+ private key: stm32mp13-key/privateKey02.pem
+ public hash key: stm32mp13-key/publicKeyHash02.bin
------------------------------------------------------------
AES_256_cbc algorithm is selected for private key encryption
Generating Prime256v1 keys...
Private key PEM file created
Public key PEM file created
public key hash file created
Keys packet 3 generated successfully.
+ public key: stm32mp13-key/publicKey03.pem
+ private key: stm32mp13-key/privateKey03.pem
+ public hash key: stm32mp13-key/publicKeyHash03.bin
------------------------------------------------------------
AES_256_cbc algorithm is selected for private key encryption
Generating Prime256v1 keys...
Private key PEM file created
Public key PEM file created
public key hash file created
Keys packet 4 generated successfully.
+ public key: stm32mp13-key/publicKey04.pem
+ private key: stm32mp13-key/privateKey04.pem
+ public hash key: stm32mp13-key/publicKeyHash04.bin
------------------------------------------------------------
AES_256_cbc algorithm is selected for private key encryption
Generating Prime256v1 keys...
Private key PEM file created
Public key PEM file created
public key hash file created
Keys packet 5 generated successfully.
+ public key: stm32mp13-key/publicKey05.pem
+ private key: stm32mp13-key/privateKey05.pem
+ public hash key: stm32mp13-key/publicKeyHash05.bin
------------------------------------------------------------
AES_256_cbc algorithm is selected for private key encryption
Generating Prime256v1 keys...
Private key PEM file created
Public key PEM file created
public key hash file created
Keys packet 6 generated successfully.
+ public key: stm32mp13-key/publicKey06.pem
+ private key: stm32mp13-key/privateKey06.pem
+ public hash key: stm32mp13-key/publicKeyHash06.bin
------------------------------------------------------------
AES_256_cbc algorithm is selected for private key encryption
Generating Prime256v1 keys...
Private key PEM file created
Public key PEM file created
public key hash file created
Keys packet 7 generated successfully.
+ public key: stm32mp13-key/publicKey07.pem
+ private key: stm32mp13-key/privateKey07.pem
+ public hash key: stm32mp13-key/publicKeyHash07.bin
------------------------------------------------------------
Hash of table of Hash of {algorithm + public Key} file generated successfully.
+ Hash Hash: stm32mp13-key/publicKeysHashHashes.bin
3.2. Creating signature key for STM32MP15[edit | edit source]
Click on "Expand", visible on the right side of the page, to view Creating signature key for STM32MP15x lines .
STM32MP15 device supports only one signature key pair (public key/private key).
Example:
STM32_KeyGen_CLI -abs stm32mp15-key/ -pwd azerty -n 1
-------------------------------------------------------------------
STM32MP Key Generator <tool version>
-------------------------------------------------------------------
Prime256v1 curve is selected.
AES_256_cbc algorithm is selected for private key encryption
Generating Prime256v1 keys...
Private key PEM file created
Public key PEM file created
public key hash file created
Keys packet 0 generated successfully.
+ public key: stm32mp15-key/publicKey00.pem
+ private key: stm32mp15-key/privateKey00.pem
+ public hash key: stm32mp15-key/publicKeyHash00.bin
------------------------------------------------------------
Hash of table of Hash of {algorithm + public Key} file generated successfully.
+ Hash Hash: stm32mp15-key/publicKeysHashHashes.bin
3.3. Creating signature key for STM32MP21, STM32MP23 and STM32MP25[edit | edit source]
Click on "Expand", visible on the right side of the page, to view Creating signature key for STM32MP21x lines or STM32MP23x lines or STM32MP25x lines .
STM32MP21, STM32MP23 and STM32MP25 device supports up to eight signature key pairs (public key/private key).
Example:
STM32_KeyGen_CLI -abs stm32mp25-key/ -pwd azerty azerty azerty azerty azerty azerty azerty azerty -n 8
-------------------------------------------------------------------
STM32MP Key Generator <tool version>
-------------------------------------------------------------------
Prime256v1 curve is selected.
AES_256_cbc algorithm is selected for private key encryption
Generating Prime256v1 keys...
Private key PEM file created
Public key PEM file created
public key hash file created
Keys packet 0 generated successfully.
+ public key: stm32mp25-key/publicKey00.pem
+ private key: stm32mp25-key/privateKey00.pem
+ public hash key: stm32mp25-key/publicKeyHash00.bin
------------------------------------------------------------
AES_256_cbc algorithm is selected for private key encryption
Generating Prime256v1 keys...
Private key PEM file created
Public key PEM file created
public key hash file created
Keys packet 1 generated successfully.
+ public key: stm32mp25-key/publicKey01.pem
+ private key: stm32mp25-key/privateKey01.pem
+ public hash key: stm32mp25-key/publicKeyHash01.bin
------------------------------------------------------------
AES_256_cbc algorithm is selected for private key encryption
Generating Prime256v1 keys...
Private key PEM file created
Public key PEM file created
public key hash file created
Keys packet 2 generated successfully.
+ public key: stm32mp25-key/publicKey02.pem
+ private key: stm32mp25-key/privateKey02.pem
+ public hash key: stm32mp25-key/publicKeyHash02.bin
------------------------------------------------------------
AES_256_cbc algorithm is selected for private key encryption
Generating Prime256v1 keys...
Private key PEM file created
Public key PEM file created
public key hash file created
Keys packet 3 generated successfully.
+ public key: stm32mp25-key/publicKey03.pem
+ private key: stm32mp25-key/privateKey03.pem
+ public hash key: stm32mp25-key/publicKeyHash03.bin
------------------------------------------------------------
AES_256_cbc algorithm is selected for private key encryption
Generating Prime256v1 keys...
Private key PEM file created
Public key PEM file created
public key hash file created
Keys packet 4 generated successfully.
+ public key: stm32mp25-key/publicKey04.pem
+ private key: stm32mp25-key/privateKey04.pem
+ public hash key: stm32mp25-key/publicKeyHash04.bin
------------------------------------------------------------
AES_256_cbc algorithm is selected for private key encryption
Generating Prime256v1 keys...
Private key PEM file created
Public key PEM file created
public key hash file created
Keys packet 5 generated successfully.
+ public key: stm32mp25-key/publicKey05.pem
+ private key: stm32mp25-key/privateKey05.pem
+ public hash key: stm32mp25-key/publicKeyHash05.bin
------------------------------------------------------------
AES_256_cbc algorithm is selected for private key encryption
Generating Prime256v1 keys...
Private key PEM file created
Public key PEM file created
public key hash file created
Keys packet 6 generated successfully.
+ public key: stm32mp25-key/publicKey06.pem
+ private key: stm32mp25-key/privateKey06.pem
+ public hash key: stm32mp25-key/publicKeyHash06.bin
------------------------------------------------------------
AES_256_cbc algorithm is selected for private key encryption
Generating Prime256v1 keys...
Private key PEM file created
Public key PEM file created
public key hash file created
Keys packet 7 generated successfully.
+ public key: stm32mp25-key/publicKey07.pem
+ private key: stm32mp25-key/privateKey07.pem
+ public hash key: stm32mp25-key/publicKeyHash07.bin
------------------------------------------------------------
Hash of table of Hash of {algorithm + public Key} file generated successfully.
+ Hash Hash: stm32mp25-key/publicKeysHashHashes.bin
3.4. Creating remote processor signature key for STM32MP21, STM32MP23 and STM32MP25[edit | edit source]
Click on "Expand", visible on the right side of the page, to view Creating signature key for STM32MP21x lines or STM32MP23x lines or STM32MP25x lines .
STM32MP21, STM32MP23 and STM32MP25 device supports one signature key pairs (public key/private key).
Example:
STM32_KeyGen_CLI -abs stm32mp2-rproc-key/ -pwd azerty
-------------------------------------------------------------------
STM32MP Key Generator <tool version>
-------------------------------------------------------------------
Prime256v1 curve is selected.
AES_256_cbc algorithm is selected for private key encryption
Generating Prime256v1 keys...
Private key PEM file created
Public key PEM file created
public key hash file created
Keys generated successfully.
+ public key: stm32mp2-rproc-key/publicKey.pem
+ private key: stm32mp2-rproc-key/privateKey.pem
+ public hash key: stm32mp2-rproc-key/publicKeyhash.bin
Rename the files:
mv stm32mp2-rproc-key/publicKey.pem stm32mp2-rproc-key/rproc_sign_publicKey.pem mv stm32mp2-rproc-key/privateKey.pem stm32mp2-rproc-key/rproc_sign_privateKey.pem mv stm32mp2-rproc-key/publicKeyhash.bin stm32mp2-rproc-key/rproc_sign_publicKeyhash.bin
Generate DER version of public key
openssl ec -pubin -in stm32mp2-rproc-key/rproc_sign_publicKey.pem -outform DER -pubout -out stm32mp2-rproc-key/rproc_sign_publicKey.der
4. Creating encryption key[edit | edit source]
4.1. Creating encryption key for STM32MP13, STM32MP21, STM32MP23 and STM32MP25[edit | edit source]
Click on "Expand", visible on the right side of the page, to view Creating encryption key for STM32MP13x lines , STM32MP21x lines ,STM32MP23x lines and STM32MP25x lines .
To perform secure boot with encrypted binaries, you must have binaries encrypted with a specific encryption key.
If this signature key is already present on the STM32 MPU device, go directly to Distribution Package with signed FIP.
To create an encryption key, you must generate a random key of 16 bytes and another random key of 32 bytes.
On Linux with STM32_KeyGen_CLI:
STM32_KeyGen_CLI -rand 16 stm32mp_encryption_key.bin STM32_KeyGen_CLI -rand 32 stm32mp_encryption_key_256bits.bin
On Windows with STM32_KeyGen_CLI:
STM32_KeyGen_CLI.exe -rand 16 stm32mp_encryption_key.bin STM32_KeyGen_CLI.exe -rand 32 stm32mp_encryption_key_256bits.bin
5. Putting signature key on STM32 MPU[edit | edit source]
 Information
|
| For demonstration and test purposes, the signature key can be put on the STM32MP device with a simple U-Boot command on the development board. For production purposes, it must be set in the production step, as described in Secure Secret Provisioning (SSP) overview. |
Click on "Expand", visible on the right side of the page, to view Putting hash key on device for STM32MP13x lines , STM32MP15x lines , STM32MP21x lines , STM32MP23x lines and STM32MP25x lines .
Array of correspondence between platform and key/signature file
| key name | binary file | |
|---|---|---|
| STM32MP13 | PKHTH | publicKeysHashHashes.bin |
| STM32MP15 | PKHTH | publicKeysHashHashes.bin |
| STM32MP21 | OEM-KEY1 | publicKeysHashHashes.bin |
| STM32MP23 | OEM-KEY1 | publicKeysHashHashes.bin |
| STM32MP25 | OEM-KEY1 | publicKeysHashHashes.bin |
To manually put the public key hash (PKH) on the STM32 MPU device with a U-Boot stm32key command:
- Put the Public Key Hash file (publicKeysHashHashes.bin), generated as described in the previous section, on the bootfs partition.
- Boot the board and stop on the U-Boot console.
- Load public key hash in DDR.
For example, the hash key file is located on the eighth partition of the SD card:
stm32key list
- Select the key to use following the platform
stm32key select <key name>
load mmc 0:8 ${loadaddr} <binary name>
- Register public key hash.
stm32key fuse ${loadaddr}
For more information, refer to How to use U-Boot stm32key command.
6. Putting encryption key on STM32 MPU[edit | edit source]
| Information
|
| For demonstration and test purposes, the encryption key can be put on the STM32 MPU device with a simple U-Boot command on the development board. For production purposes, it must be set in the production step. |
Click on "Expand", visible on the right side of the page, to view Putting an encryption key on the device for STM32MP13x lines , STM32MP15x lines , STM32MP21x lines , STM32MP23x lines and STM32MP25x lines .
Array of correspondence between platform and key/signature file
| key name | binary file | |
|---|---|---|
| STM32MP13 | EDMK | stm32mp_encryption_key.bin |
| STM32MP15 | ||
| STM32MP21 | EDMK1-128b | stm32mp_encryption_key.bin |
| FIP-EDMK | stm32mp_encryption_key_256bits.bin | |
| STM32MP23 | EDMK1 | stm32mp_encryption_key.bin |
| FIP-EDMK | stm32mp_encryption_key_256bits.bin | |
| STM32MP25 | EDMK1 | stm32mp_encryption_key.bin |
| FIP-EDMK | stm32mp_encryption_key_256bits.bin |
To manually put the key on the STM32 MPU device with a U-Boot stm32key command:
- Put the encryption key file (stm32mp_encryption_key.bin), generated as demonstrated in the previous section, on the bootfs partition.
- Boot the board and stop it on the U-Boot console.
- Load the encryption key in DDR.
For example, the key file is located on the eighth partition of the SD card:
stm32key list
- Select the EDMK key to use following the platform (How to use U-Boot stm32key command|):
stm32key select <key name>
load mmc 0:8 ${loadaddr} <binary name>
- Register the encryption key:
stm32key fuse ${loadaddr}
- Verify that the key is registered:
stm32key read
For more information, refer to How to use U-Boot stm32key command.
7. Distribution Package with signed FIP[edit | edit source]
7.1. Prerequisites[edit | edit source]
- Signature key (public key(s), private key(s), hash key file, and password).
- STM32MPU Distribution Package.
7.2. Generate Distribution Package with signed binaries[edit | edit source]
| Information
|
| With this step only FIP binaries are signed. |
- Source the environment of the Distribution Package.
source layers/meta-st/scripts/envsetup.sh
Select your DISTRO and your machine.
- Indicate where to find the signature key (in this example, the signature key is located in the key directory on the meta-st-stm32mp layer).
Add the following lines to local.conf (in the build directory):
7.2.1. Generate Distribution Package with signed binaries for STM32MP13[edit | edit source]
Click on "Expand", visible on the right side of the page, to view Generate Distribution Package with signed binaries for STM32MP13.
echo 'SIGN_KEY = "key/stm32mp13/privateKey00.pem" ' >> conf/local.conf echo 'SIGN_KEY_stm32mp13 = "key/stm32mp13/privateKey00.pem" ' >> conf/local.conf echo 'EXTERNAL_KEY_CONF = "1" ' >> conf/local.conf echo 'SIGN_KEY_PASS = "<passwords of signature key>" ' >> conf/local.conf echo 'SIGN_ENABLE = "1" ' >> conf/local.conf echo 'SIGN_TOOL = "<path to STM32_SigningTool tools>" ' >> conf/local.conf
| Information
|
If there are eight key pairs, you need to declare eight passwords:
SIGN_KEY_PASS = "azerty azerty azerty azerty azerty azerty azerty azerty" |
7.2.2. Generate Distribution Package with signed binaries for STM32MP21 or STM32MP23 or STM32MP25[edit | edit source]
Click on "Expand", visible on the right side of the page, to view Generate Distribution Package with signed binaries for STM32MP21x lines , STM32MP23x lines and STM32MP25x lines .
echo 'SIGN_KEY = "key/stm32mp25/privateKey00.pem" ' >> conf/local.conf echo 'SIGN_KEY_stm32mp25 = "key/stm32mp25/privateKey00.pem" ' >> conf/local.conf echo 'EXTERNAL_KEY_CONF = "1" ' >> conf/local.conf echo 'SIGN_KEY_PASS = "<passwords of signature key>" ' >> conf/local.conf echo 'SIGN_ENABLE = "1" ' >> conf/local.conf echo 'SIGN_TOOL = "<path to STM32_SigningTool tools>" ' >> conf/local.conf
| Information
|
If there are eight key pairs, you need to declare eight passwords:
SIGN_KEY_PASS = "azerty azerty azerty azerty azerty azerty azerty azerty" |
If you would like to activate the signature of binaries use on co-processor:
echo 'SIGN_COPRO_ECC_INFOKEY = "stm32mp2-rproc-key/rproc_sign_publicKey.der" ' >> conf/local.conf echo 'SIGN_COPRO_ECC_PRIVKEY = "stm32mp2-rproc-key/rproc_sign_privateKey.pem" ' >> conf/local.conf echo 'SIGN_COPRO_ECC_INFOKEY_stm32mp25 = "key/stm32mp25/rproc_sign_publicKey.der" ' >> conf/local.conf echo 'SIGN_COPRO_ECC_PRIVKEY_stm32mp25 = "key/stm32mp25/rproc_sign_privateKey.pem" ' >> conf/local.conf echo 'SIGN_COPRO_ECC_PASS = "password of remote processor signature key " ' >> conf/local.conf
To desactivate it, just not provide the SIGN_COPRO_ECC informations
- Compile the binaries:
bitbake st-image-weston
The FIP file, signed and ready to be programmed on the board, can be found in tmp-glibc/deploy/images/<machine name>/fip/.
7.2.3. Generate Distribution Package with signed binaries for STM32MP23 or STM32MP25[edit | edit source]
Click on "Expand", visible on the right side of the page, to view Generate Distribution Package with signed binaries for STM32MP23/STM32MP25.
echo 'SIGN_KEY = "key/stm32mp25/privateKey00.pem" ' >> conf/local.conf echo 'SIGN_KEY_stm32mp25 = "key/stm32mp25/privateKey00.pem" ' >> conf/local.conf echo 'EXTERNAL_KEY_CONF = "1" ' >> conf/local.conf echo 'SIGN_KEY_PASS = "<passwords of signature key>" ' >> conf/local.conf echo 'SIGN_ENABLE = "1" ' >> conf/local.conf echo 'SIGN_TOOL = "<path to STM32_SigningTool tools>" ' >> conf/local.conf
| Information
|
If there are eight key pairs, you need to declare eight passwords:
SIGN_KEY_PASS = "azerty azerty azerty azerty azerty azerty azerty azerty" |
- Compile the binaries:
bitbake st-image-weston
The FIP file, signed and ready to be programmed on the board, can be found in tmp-glibc/deploy/images/<machine name>/fip/.
7.3. Generate a Distribution Package with encrypted partition binaries[edit | edit source]
7.3.1. Generate a Distribution Package with encrypted partition binaries for STM32MP13[edit | edit source]
Click on "Expand", visible on the right side of the page, to view Generate a Distribution Package with encrypted partition binaries for STM32MP13.
To enable secure boot with encryption support, add DECRYPTION_SUPPORT=aes_gcm to ENCRYPT_BLx to specify the encrypted binary.
Request encryption support on BL2 TF-A binaries:
echo 'ENCRYPT_ENABLE = "1" ' >> conf/local.conf echo 'ENCRYPT_FSBL_KEY = "key/stm32mp13/stm32mp13_encryption_key.bin" ' >> conf/local.conf echo 'ENCRYPT_FIP_KEY = "stm32mp13_encryption_key_256bits.txt" ' >> conf/local.conf
7.3.2. Generate a Distribution Package with encrypted partition binaries for STM32MP23 and STM32MP25[edit | edit source]
Click on "Expand", visible on the right side of the page, to view Generate a Distribution Package with encrypted partition binaries for {{MicroprocessorDevice | device=21}, STM32MP23x lines or STM32MP25x lines .
To enable secure boot with encryption support, add DECRYPTION_SUPPORT=aes_gcm to ENCRYPT_BLx to specify the encrypted binary.
Request encryption support on BL2 TF-A binaries:
echo 'ENCRYPT_ENABLE = "1" ' >> conf/local.conf echo 'ENCRYPT_FSBL_KEY = "key/stm32mp25/stm32mp25_encryption_key.bin" ' >> conf/local.conf echo 'ENCRYPT_FIP_KEY = "stm32mp25_encryption_key_256bits.txt" ' >> conf/local.conf
8. Signing first-stage bootloader binaries manually[edit | edit source]
If the first-stage bootloader binaries (TF-A BL2) are generated unsigned, they must be signed manually using STM32_SigningTool_CLI.
For installation and command-line options, see Signing tool.
| Information
|
| If you need to populate the FSBL binary with STM32CubeProgrammer, you also need to sign the serial boot TF-A BL2 loaded in memory. |
These tools are used to sign a binary with an STM32 header, with the minimal options to sign the FSBL binary:
STM32_SigningTool_CLI -pubk <public key> -prvk <private key> -pwd <password> -t fsbl -of <Option_Flags> -bin FSBL binary not signed>.stm32 -o <FSBL binary signed>.stm32
with:
- <public key> = The path of the public key file generated by KeyGen: publicKey.pem.
- <private key> = The path of the private key files generated by KeyGen: privateKey*.pem; one for STM32MP15 and eight for STM32MP13/STM32MP21/STM32MP23/STM32MP25.
- <password> = Password used by KeyGen to protect the key files. The number of passwords must match the number of key pairs.
- <Option_Flags> = The -of option is required for STM32MP13/STM32MP21/STM32MP23/STM32MP25, with a 0x0000 0001 value.
Click on "Expand", visible on the right side of the page, to view Signing first stage bootloader binaries for STM32MP13x lines , STM32MP15x lines , STM32MP21x lines , STM32MP23x lines and STM32MP25x lines .
STM32_SigningTool_CLI -pubk <public key> -prvk <private key> -pwd <password> -t fsbl <Option_Flags> -bin arm-trusted-firmware/tf-a-<board name>-<storage>.stm32 -o arm-trusted-firmware/tf-a-<board name>-<storage>_Signed.stm32
Array of correspondence between platform and command parameters
| public key | private key | password | Option flags | Storage supported | |
|---|---|---|---|---|---|
| STM32MP13 | publicKey*.pem | privateKey00.pem | <list of passwords> | -of 0x00000001 | sdcard
emmc nand nor usb (used with STM32CubeProgrammer) uart (used with STM32CubeProgrammer) |
| STM32MP15 | publicKey.pem | privateKey.pem | <password> | sdcard
emmc nand nor usb (used with STM32CubeProgrammer) uart (used with STM32CubeProgrammer) | |
| STM32MP21 | publicKey*.pem | privateKey00.pem | <list of passwords> | -of 0x00000001 --header-version 2.3 | sdcard
emmc nand nor usb (used with STM32CubeProgrammer) uart (used with STM32CubeProgrammer) |
| STM32MP23 | publicKey*.pem | privateKey00.pem | <list of passwords> | -of 0x00000001 --header-version 2.2 | |
| STM32MP25 | publicKey*.pem | privateKey00.pem | <list of passwords> | -of 0x00000001 --header-version 2.2 | sdcard
emmc nand nor usb (used with STM32CubeProgrammer) uart (used with STM32CubeProgrammer) |
9. Sign and Encrypt first stage bootloader binaries manually[edit | edit source]
If the first-stage bootloader binaries (TF-A BL2) are generated unsigned/unecrypted, they must be signed and encrypted manually using STM32_SigningTool_CLI.
For installation and command-line options, see Signing tool.
These tools are used to sign and encrypt a binary with an STM32 header, with the minimal options to sign and encrypt the FSBL binary:
STM32_SigningTool_CLI -pubk <public key> -prvk <private key> -pwd <password> -t fsbl -of <Option_Flags> --enc-key <encrypt key> --enc-dc <encryption derivation constant> --image-version <image version key> -bin FSBL binary not signed>.stm32 -o <FSBL binary signed>.stm32
with:
- <public key> = The path of the public key file generated by KeyGen: publicKey.pem.
- <private key> = The path of the private key files generated by KeyGen: privateKey*.pem; one for STM32MP15 and eight for STM32MP13/STM32MP23/STM32MP25.
- <password> = Password used by KeyGen to protect the key files. The number of passwords must match the number of key pairs.
- <Option_Flags> = The -of option is required and must be adapted for encryption.
- --enc-key = The path of encryption key file generated by KeyGen : stm32mp_encryption_key.bin
- --enc-dc = The encryption derivation constant
- --image-version = The image version
Click on "Expand", visible on the right side of the page, to view Sign and Encrypt first stage bootloader binaries for STM32MP13x lines , STM32MP21x lines , STM32MP23x lines and STM32MP25x lines .
STM32_SigningTool_CLI -pubk <public key> -prvk <private key> -pwd <password> -t fsbl <Option_Flags> --enc-key <encrypt key> --enc-dc <encryption derivation constant> --image-version <image version key> -bin arm-trusted-firmware/tf-a-<board name>-<storage>.stm32 -o arm-trusted-firmware/tf-a-<board name>-<storage>_Encrypted_Signed.stm32
Array of correspondence between platform and command parameters
| public key | private key | password | Option flags | encryption key | encryption
derivation constant |
image version | Storage supported | |
|---|---|---|---|---|---|---|---|---|
| STM32MP13 | publicKey*.pem | privateKey00.pem | <list of passwords> | -of 0x80000003 | stm32mp_encryption_key.bin | 0x0E5F2025 | 0 | sdcard
emmc nand nor |
| STM32MP15 | ||||||||
| STM32MP21 | publicKey*.pem | privateKey00.pem | <list of passwords> | -of 0x80000003 --header-version 2.3 | stm32mp_encryption_key.bin | 0x25205f0e | 0 | sdcard
emmc nand nor |
| STM32MP23 | publicKey*.pem | privateKey00.pem | <list of passwords> | -of 0x80000003 --header-version 2.2 | stm32mp_encryption_key.bin | 0x25205f0e | 0 | |
| STM32MP25 | publicKey*.pem | privateKey00.pem | <list of passwords> | -of 0x80000003 --header-version 2.2 | stm32mp_encryption_key.bin | 0x25205f0e | 0 | sdcard
emmc nand nor |
10. Create FlashLayout file for signed binaries[edit | edit source]
To populate the correct binaries on the board, you need to create a FlashLayout file with the signed binaries:
- FSBL = tf-a-*_Signed.stm32
- FIP = fip-*.bin
Example for FlashLayout_sdcard_stm32mp157f-dk2-optee.tsv:
#Opt Id Name Type IP Offset Binary - 0x01 fsbl-boot Binary none 0x0 arm-trusted-firmware/tf-a-stm32mp157f-dk2-usb.stm32 - 0x03 fip-boot FIP none 0x0 fip/fip-stm32mp157f-dk2-optee.bin P 0x04 fsbl1 Binary mmc0 0x00004400 arm-trusted-firmware/tf-a-stm32mp157f-dk2-sdcard.stm32 P 0x05 fsbl2 Binary mmc0 0x00044400 arm-trusted-firmware/tf-a-stm32mp157f-dk2-sdcard.stm32 P 0x06 metadata1 Binary mmc0 0x00084400 arm-trusted-firmware/metadata.bin P 0x07 metadata2 Binary mmc0 0x000C4400 arm-trusted-firmware/metadata.bin P 0x08 fip-a FIP mmc0 0x00104400 fip/fip-stm32mp157f-dk2-optee.bin PED 0x09 fip-b FIP mmc0 0x00504400 none PED 0x0A u-boot-env Binary mmc0 0x00904400 none P 0x10 bootfs System mmc0 0x00984400 st-image-bootfs-openstlinux-weston-stm32mp1.ext4 P 0x11 vendorfs FileSystem mmc0 0x04984400 st-image-vendorfs-openstlinux-weston-stm32mp1.ext4 P 0x12 rootfs FileSystem mmc0 0x05984400 st-image-weston-openstlinux-weston-stm32mp1.ext4 P 0x13 userfs FileSystem mmc0 0x33984400 st-image-userfs-openstlinux-weston-stm32mp1.ext4
Update the fsbl1-boot, fip-boot, fsbl1, fsbl2 and fip partitions.
Result:
#Opt Id Name Type IP Offset Binary - 0x01 fsbl-boot Binary none 0x0 arm-trusted-firmware/tf-a-stm32mp157f-dk2-usb_Signed.stm32 - 0x03 fip-boot FIP none 0x0 fip/fip-stm32mp157f-dk2-optee_Signed.bin P 0x04 fsbl1 Binary mmc0 0x00004400 arm-trusted-firmware/tf-a-stm32mp157f-dk2-sdcard_Signed.stm32 P 0x05 fsbl2 Binary mmc0 0x00044400 arm-trusted-firmware/tf-a-stm32mp157f-dk2-sdcard_Signed.stm32 P 0x06 metadata1 Binary mmc0 0x00084400 arm-trusted-firmware/metadata.bin P 0x07 metadata2 Binary mmc0 0x000C4400 arm-trusted-firmware/metadata.bin P 0x08 fip-a FIP mmc0 0x00104400 fip/fip-stm32mp157f-dk2-optee_Signed.bin PED 0x09 fip-b FIP mmc0 0x00504400 none PED 0x0A u-boot-env Binary mmc0 0x00904400 none P 0x10 bootfs System mmc0 0x00984400 st-image-bootfs-openstlinux-weston-stm32mp1.ext4 P 0x11 vendorfs FileSystem mmc0 0x04984400 st-image-vendorfs-openstlinux-weston-stm32mp1.ext4 P 0x12 rootfs FileSystem mmc0 0x05984400 st-image-weston-openstlinux-weston-stm32mp1.ext4 P 0x13 userfs FileSystem mmc0 0x33984400 st-image-userfs-openstlinux-weston-stm32mp1.ext4
11. Program and test[edit | edit source]
Use the previously created FlashLayout file with the signed binaries to populate the correct binaries on the board.
At board boot time, check the two levels of the secure boot: the ROM code secure boot validation and the TF-A BL2 trusted board boot validation.
12. Close the device[edit | edit source]
| Information
|
| For demonstration and test purposes, the STM32MP device can be closed with a simple U-Boot command on the development board. For production purposes, it must be set in production step as described in AN5510: Overview of the secure secret provisioning (SSP) on STM32MP1 series. |
For more information, refer to How to secure STM32 MPU.
In U-Boot console:
stm32key close
For more information, see the How to use U-Boot stm32key command.
As soon as the device is closed, the operation is irreversible; the user is forced to only use signed images.
13. References[edit | edit source]
Arm® is a registered trademark of Arm Limited (or its subsidiaries) in the US and/or elsewhere. 