X-CUBE-RSSe

Description

The X-CUBE-RSSe STM32Cube Expansion Package provides STM32 RSSe extension binaries to the root security services (RSS), personalization data files to the STM32HSM-V2 secure application module, and option bytes templates.

In STM32 microcontrollers, the system memory is a read-only part of the embedded flash memory. It is dedicated to the STMicroelectronics bootloader. Some devices might include an RSS library in this area. This RSS library is immutable. It consolidates functionalities and APIs to perform the security functions provided by the STM32 device.

Part of the RSS provides runtime services and functions, which are exposed to the user within the CMSIS device header file of the STM32Cube MCU Package firmware.

Part of the RSS is provided as external RSS extension binaries (RSSe) that extend the security services supported by the STM32. They are authenticated and encrypted libraries delivered in a binary format that only dedicated STM32 devices can execute. RSSe libraries are used by the STMicroelectronics ecosystem tools and by STMicroelectronics programming tool partners to support secure manufacturing processes:

• To use the RSSe-SFI secure firmware install binary, refer to the STM32 MCUs secure firmware install (SFI) overview application note (AN4992) and visit the SFI overview page of the STM32 MCU wiki at wiki.st.com/stm32mcu.
• The RSSe-KW secure key wrapping service ensures the protection of private keys. Once wrapped, the private keys are not accessible by the user application or by the CPU. The secure key wrapping service uses the coupling and chaining bridge peripheral (CCB) to manage the wrapped keys.

At first, the RSSe binaries, STM32HSM-V2 personalization data files, and option bytes templates were integrated and distributed via the STM32CubeProgrammer tool (STM32CubeProg). From STM32CubeProgrammer version v2.18.0 onwards, all these files are delivered separately in the dedicated X-CUBE-RSSe Expansion Package. They must be installed manually into the STM32 tools. X-CUBE-RSSe is regularly maintained, updated, and made available on www.st.com. It is the integrator's responsibility to use the latest version to limit vulnerability exposures.