Readout Protection (Rdp); Table 11. Security Features For Stm32L5, Stm32U5, Stm32H503/5, Stm32H72X/73/74X/75, Stm32H7Ax/7Bx, Stm32F7 Devices - ST STM32C0 Series Application Note

Table 11. Security features for STM32L5, STM32U5, STM32H503/5, STM32H72x/73/74x/75, STM32H7Ax/7Bx, STM32F7
Feature STM32L5
Cortex core
RDP four
RDP additional protection
registers,
Up to four
protected
areas with
Flash WRP
granularity
SRAM WRP
PCROP
HDP
TrustZone secure domain
Firewall
MPU
OTP
(1)
UBE
Internal tamper detection
Hardware crypto
RNG
SBSFU
TF-M
KMS
1. Unique boot entry.
6.2

Readout protection (RDP)

The readout protection is a global flash memory protection allowing the embedded firmware code to be protected
against copy, reverse engineering, dumping, using debug tools, or code injection in SRAM. The user must set
this protection after the binary code is loaded to the embedded flash memory.
The RDP applies to all STM32 devices for:
• the main flash memory
• the option bytes (level 2 only)
AN5156 - Rev 8
STM32
STM32U5
H503
Cortex‑M33
RDP four
levels, levels,
Product state instead of
backup backup
registers,
SRAM2 SRAM3
Two areas per bank defined by page
2‑K or range
4‑Kbyte
SRAM2, with 1‑Kbyte granularity
No (replaced by
No
TrustZone)
Up to two secure hide
3‑stage temporal isolation,
areas (HDP) inside the
No (replaced by
No
TrustZone)
Yes Yes Yes
512 bytes
Yes (boot lock feature) Yes
Yes Yes Yes
AES, HASH, PKA HASH
No No No
Yes Yes No
No No No
devices
STM32
STM32H5
H72x/73
Backup
SRAM,
backup
RDP
registers,
OTFDEC
By sectors (128 Kbytes)
No
No By area with
(replaced by 256‑byte
TrustZone) granularity
Yes (secure user memory, with 256‑byte
one per bank
No
(replaced by No
TrustZone)
Yes Yes
2 Kbytes No
Yes Yes (unique entry point in secure access)
Yes Yes
AES,
HASH,
AES, DES, HASH, OTFDEC
OTFDEC,
PKA
SP 800‑90‑B
No Yes
Yes No
Yes No
AN5156
Readout protection (RDP)
STM32 STM32
STM32F7
H74x/75 H7Ax/7Bx
Cortex‑M7
Backup
Backup
SRAM,
SRAM, Backup
backup
backup SRAM
registers,
registers
OTFDEC
By sectors
By group of
(16 K, 64 K,
4 8‑Kbyte
128 K, or
sectors
256 Kbytes)
No No
By area with 256‑byte
granularity, one area per By sectors
bank
granularity)
No No
Yes Yes
No No
Yes Yes
AES, HASH
SP800‑90‑A
Yes Yes
No No
No No
page 29/56
No
No
No
Yes
No
No
Yes
Yes
No
No