Stm32 Security Features; Overview Of Security Features; Static And Dynamic Protections; Security Features By Stm32 Devices - ST STM32C0 Series Application Note

6

STM32 security features

This section presents all the STM32 features that can be gathered to meet the different security concepts
presented in previous sections, and to achieve a high level of security.
6.1

Overview of security features

6.1.1

Static and dynamic protections

A distinction can be made depending on whether protection features are static or dynamic:
• Static protections refer to features that are set with option bytes. Their configuration is retained at power
off.
Static protections are RDP (or product state), PCROP, WRP, BOR, OTP, and secure hide protection (when
available).
• Dynamic (or run time) protections do not retain their status at reset. They have to be configured at each
boot (for example during
Dynamic protections provided by STM32 include MPU, tamper detection, and firewall.
Other dynamic protections are related to both security and safety. An abnormal environment behavior may
be accidental (safety) or intentional, in order to carry out an attack. These protections include clock and
power monitoring systems, memory integrity bits, and independent watchdog (IWDG).
6.1.2

Security features by STM32 devices

Table 9.
Feature STM32C0
Cortex core Cortex‑M0+
RDP
Bad OBL
additional
recovery
protection
By area with
2‑Kbyte
Flash WRP granularity,
two areas
available
SRAM WRP No
By area with
256‑byte
PCROP granularity,
one area per
bank
Yes
HDP (securable
memory area)
Firewall No
MPU Yes
OTP 1 Kbyte
Yes (boot lock
(3)
UBE
feature)
Internal
tamper No
detection
Hardware
No
crypto
AN5156 - Rev 8
Secure boot (SB)
Security features for STM32C0, STM32F0/1/2/3/4, STM32G0/4 devices
STM32F0 STM32F1
Cortex‑M0 Cortex‑M3
Backup 2 level RDP
registers only
By sectors By pages (4 K (16 K, 64 K,
(4 Kbytes) or 8 Kbytes)
128 Kbytes)
No No
No No
No No
No No
No (1)
Yes
No No
No No
No No
No No AES, HASH
).
STM32F2 STM32F3
Cortex‑M3 Cortex‑M4
Backup Backup
SRAM registers
By sectors
By sectors (16 K, 64 K,
or (4 Kbytes)
128 Kbytes)
No No
No No
No No
No No
Yes (2)
Yes
Yes Yes
No No
No No
No AES, HASH
STM32 security features
STM32F4 STM32G0
Cortex‑M4 Cortex‑M0+
Backup Backup
SRAM registers
CCMSRAM
By area with
By sectors
2‑Kbyte
By page (2 K
granularity,
or or 4 Kbytes)
two areas
available
CCM SRAM,
No No with 1‑Kbyte
By area with
By area with
512‑byte
64‑ or 128‑bit
By sectors granularity,
granularity, up
two areas
to two areas
available
No Yes (securable memory area)
No No
Yes Yes
512 bytes 1 Kbyte
Yes (boot lock
No
feature)
No Yes
AES
AN5156
STM32G4
Cortex‑M4
Backup
registers,
granularity
No
Yes
1 Kbyte
Yes
Yes
page 27/56