wolfHSM on STM32H5
wolfHSM now supports the STM32H5 family. The same wolfHSM server that runs on Infineon AURIX TC3xx and ST SPC58 automotive parts now runs on a Cortex-M33, isolated by Arm TrustZone-M instead of a discrete HSM coprocessor. No extra silicon, no second MCU, no external secure element.
The work is a two-part PR: wolfBoot #769 adds the WOLFCRYPT_TZ_WOLFHSM boot engine for STM32H5, and wolfHSM #348 adds the TrustZone NSC bridge transport in port/stmicro/stm32-tz/.
How It Works
The non-secure application uses the standard wolfCrypt API. Operations routed through WH_DEV_ID are intercepted by the wolfHSM client cryptocb, dispatched across the TrustZone boundary through a single non-secure-callable veneer (wcs_wolfhsm_transmit), and executed by the wolfHSM server on the secure side. Keys never leave the secure world. Persistent keys survive reset with two-partition flash journaling.
What Is Included
- wolfHSM server hosted inside wolfBoot’s secure boot image
- Flash-backed keystore with two-partition NVM journaling on internal flash
- Full wolfCrypt crypto surface (RNG, symmetric, asymmetric) on the secure side
- Config example: config/examples/stm32h5-tz-wolfhsm.config
- CI: m33mu emulator two-boot persistence test (CommInit, RNG, SHA256, AES, keystore restore)
- Host unit tests for the flash adapter (bounds, alignment, multi-sector, write-failure)
On-board verification on NUCLEO-H563ZI over UART
TrustZone Engine Options
wolfBoot now supports four mutually exclusive TrustZone engines for STM32H5:
| Engine | API Surface |
|---|---|
| WOLFCRYPT_TZ_PKCS11 | PKCS #11 key store |
| WOLFCRYPT_TZ_PSA | Arm PSA Crypto + DICE attestation |
| WOLFCRYPT_TZ_FWTPM | Firmware TPM 2.0 |
| WOLFCRYPT_TZ_WOLFHSM (new) | Full wolfHSM keystore, RNG, symmetric + asymmetric crypto |
The same client code that runs in an AURIX deployment compiles against this engine on STM32H5 with the right wolfhsm_cfg.h. The bridge transport is target-agnostic, so bringing wolfHSM up on additional ARMv8-M parts is a porting exercise.
Beyond Automotive
wolfHSM was built for automotive ECUs where HSM hardware is standard. But the threat model that drove HSM adoption in vehicles is now the threat model for every connected device that holds long-lived keys: medical infusion pumps, smart meters, industrial PLCs, building automation controllers, edge gateways. Each of these needs to isolate key material from the application, gate firmware updates through a signed boot path, and protect cryptographic operations from a compromised or buggy main application.
With wolfHSM on STM32H5, those devices get automotive-grade key isolation on a Cortex-M33 device with no BOM change. The same keystore, the same journaled NVM, the same signed-update path, running on a mainstream microcontroller that is already in volume production for IoT and industrial designs.
If you have questions about any of the above, please contact us at facts@wolfssl.com or call us at +1 425 245 8247.
Download wolfSSL Now