Renesas R5F565NEHDFC Installation and operating instructions

STZAN0114EN0100

Application Note

STZAN0114EN0100

Revision 1.00

April 2019

Getting Started with Embedded Trust and the RX65x

Introduction

This application note describes the use of the Embedded Trust and C-Trust security development environments

with the Renesas RSK+RX65N-2MB Starter Kit. The Renesas RSK series includes an LCD display module and

E2 Lite debugging emulator. The RSK also offers additional peripherals to extend the features of the board and

ease the development of custom security designs.

Target Devices

This application note refers to the following secure microcontroller :

➢Renesas Electronics R5F565NEHDFC microcontrollers

Related Documents

➢Renesas RSK+RX65N-2MB User’s Manual (R20UT3888EG0200 Rev 2.00 Dec 2017)

➢E1/E20/E2 Emulator, E2 Emulator Lite (R20UT0399EJ1200 Rev.12.00 Nov 2018)

➢Embedded Trust User Guide (available from Secure Thingz & IAR Systems websites)

STZAN0114EN0100

1. Kit Overview

The Renesas RSK+RX65N-2MB Starter Kit is a hardware platform for the evaluation of the Renesas RX65N

device. The Renesas RSK+RX65N-2MB Starter Kit part number is as follows:

• YRTK50565N200010BE (Renesas RSK+RX65N-2MB Kit CS+ & E2Lite-Encrypted)

The board offers a set of features that enables the user to get started with the microcontroller peripherals

immediately and to obtain an understanding of how to integrate the device in their required design.

This application note is primarily concerned with the RX65N-2MB device and RSK+RX65N-2MB Kit. Figure 1

shows the features of the Renesas RSK+RX65N-2MB Starter Kit.

Figure 1: Renesas RSK+RX65N-2MB Starter Kit features

Please refer to the Renesas RSK+RX65N-2MB User’s Manual (section 7) (see Related Documents) for details of

the implementation of connectors and headers on the starter kit.

STZAN0114EN0100

2. Getting Started

Download and install the following :

➢IAR Systems Embedded Workbench for RX provided by IAR Systems

➢Embedded Trust security development environment provided by Secure Thingz

➢C-Trust extension to IAR Embedded Workbench provided by IAR Systems

Refer to the Installation and Licensing Quick Reference Guide available from the IAR Systems website to

determine PC system requirements.

Launch Embedded Trust for RX. The tool will open as per that shown in Figure 2.

Figure 2: Embedded Trust for RX opening screen

Click on Example Projects -> Embedded Trust -> Getting Started -> RX65N Open Project (see Figure 3)

Figure 3: Open Getting Started project

An explorer dialog will open requiring the destination folder for the project to be located. Direct the open dialog

box to the folder to be used for the project and click “Select Folder”.

With the folder selected (and additional folder expansion), the IDE will look like that shown in Figure 4.

STZAN0114EN0100

Figure 4: Embedded Trust with Getting Started project loaded

Click on the Project tab and select “Create New Project” in the dropdown menu. The dialog box shown in

Figure 5 will be displayed. Click on the “Tool chain” dropdown and select “RX”.

We wish to add security to the Getting Started project we have just loaded so click on Secure Boot Manager in

the “Create New Project” dialog box and click “OK”.

Figure 5: Select Secure Boot Manager in Create New Project dialog box

An explorer dialog will open requiring a filename for the Secure Boot Manager project. Enter the filename to be

used into the open dialog box and click “Save”. In this example we have used SBM as the filename.

The IDE will now load the additional Secure Boot Manager project and look like that shown in Figure 6.

STZAN0114EN0100

Figure 6: IDE with Secure Boot Manager project loaded and active

Please read the Readme.txt file that is displayed in the IDE. This file includes important configuration information

for projects that are to have security added i.e. integrated with a Secure Boot Manager. Please note that "Erase

flash ROM before download" is enabled by default in the Hardware Setup dialog box (available on the debugger

driver menu in the IDE)

2.1 Configuring the Secure Boot Manager

The Secure Boot Manager project must now be configured for the RX65N. The configuration will be carried out

via the Project -> Options… menu provided by the IDE. To access this menu, right click on the SBM-Debug

project and select “Options…” in the dropdown menu (see Figure 7).

Figure 7: Selecting Project -> Options menu

STZAN0114EN0100

The menu for Options for node “SBM” will open. Select the “General Options” category and click on the

“Target” tab. Select the Device type as “R5F565NE”.

Select the “Debugger” category and select the “E2 Lite” Driver.

Select the “Security” category and click the Enable check box. The Embedded Trust dialog box shown in Figure

8 should be the resultant display.

Figure 8: Embedded Trust dialog box

We will now create a Security Context for the Secure Boot Manager project.

STZAN0114EN0100

2.2 Configuring the Security Context

In the Options for node “SBM” -> Embedded Trust dialog box (see Figure 8) click “New”. The dialog box for

“Create New Security Context” will open. Populate the values, in free text, with the required configuration. Note

that the Security Configuration information is the information that will be used to generate the Device Certificate

for the project. Figure 9 is an example of a completed Basic Setup configuration. Once the correct information

has been entered, click “Next”.

Figure 9: Basic Setup of Security Context dialog box

The Security Settings configuration dialog box will now be displayed (see Figure 10). There are two options

that require configuration, these are the Number of Certificates and the Device ID source.

Figure 10: Security Settings of Security Context dialog box

STZAN0114EN0100

2.2.1 Number of certificates

This option allows the user to select the number of digital certificates that are to be implemented in the chain of

trust (Public Key Infrastructure (PKI)) for the application. Figure 11 is an example of a chain of trust with 3 levels.

A maximum of 8 levels are supported by the Secure Boot Manager, however, due to the requirement to store the

certificates in secure memory, there is a limitation on the number of certificates that can be implemented in a

usable system. The default number of levels is 3 for the RX65N when using the GettingStarted example

application.

Figure 11: Example chain of trust with 3 levels

It is recommended that the Number of certificates required option is set to the default of 3.

2.2.2 Device ID

This option concerns the serial number field in the digital certificate for the device. The serial number of the

certificate can be created from either the silicon ID of the target device or a random number generated by

Embedded Trust. If From device is selected, the silicon ID is read out of the target device during the first phase

of provisioning and used to create the certificate serial number. This certificate is then tightly bound to the target

device. Note that once completed, the certificate hash is calculated and then signed by the Certificate Authority

Private key. The Random option is an alternative to using the silicon ID. In this case, Embedded Trust will

generate a random number which will be used as the device certificate serial number.

It is recommended that From device is selected as the Device ID option as this will allow the user to check the

device certificate programmed into the device against the unique ID of the RX65N.

Once the options described and recommended in sections 2.2.1 and 2.2.2 are set click “Next”

The Secure Boot Manager Settings dialog box will now be displayed (see Figure 12). For the initial release of

Embedded Trust, there are no options within this dialog box that can be set by the user.

STZAN0114EN0100

Figure 12: Secure Boot Manager Settings dialog box

Click “Create” to allow Embedded Trust to create the Security Context. A dialog box will open to confirm the use

of the profile that has just been created, click “Yes”. The dialog box shown in Figure 13 is an example of the final

Security Context created showing the newly created security context profile (in this example My Security

Context_profile-default). Click “OK”.

Figure 13: Completed Security Context example

The IDE will now return to the screen similar to that as shown in Figure 6 but with the addition of SBM source

and Output folders. Please review the Secure Boot Manager source files. These files are open source and can be

modified by the user. If the user is required to make major modifications to the Secure Boot Manager source code,

it is recommended that the changes be reviewed by Secure Thingz to ensure security is not compromised.

STZAN0114EN0100

2.3 Connecting the Renesas RSK+RX65N-2MB Starter Kit

Figure 14 shows the connections that are required between the RSK+RX65N-2MB Starter Kit CPU board, E2

Lite debugger and the host PC. It is recommended that the user consult the RSK+RX65N-2MB Starter Kit Quick

Start guide for more detailed information concerning the operation of the kit. Please note that the +5V centre-

positive PSU supplied with the kit is required.

Figure 14: Debugger connection diagram

In addition to the debugger connections as shown in Figure 14, an additional terminal connection is required

between the PC and the CPU board. Figure 15 shows the additional terminal output connection available on the

RSK+RX65N-2MB Starter Kit. Please connect the RSK+RX65N-2MB Starter Kit to the PC that is running the

Embedded Trust software as shown in Figures 14 and 15.

Figure 15: Connection for terminal output

Table of contents

Other Renesas Microcontroller manuals

Renesas

Renesas RH850 Series User manual

Renesas

Renesas Synergy DK-S3A7 User manual

Renesas

Renesas RL78/G23 User manual

Renesas

Renesas EK-RE01 256KB Installation and operating instructions

Renesas

Renesas RX62T User manual

Renesas

Renesas RL78/G11 User manual

Renesas

Renesas 78K0R/KE3 User manual

Renesas

Renesas RL78/G13 User manual

Renesas

Renesas RX600 Series User manual

Renesas

Renesas RL78/G1F User manual

Renesas

Renesas RZ/G2L User guide

Renesas

Renesas RA2E2 Series User manual

Renesas

Renesas Starter Kit+ User manual

Renesas

Renesas RX111 User manual

Renesas

Renesas 78K0R/KF3 User manual

Renesas

Renesas V850ES/F 3-L Series User manual

Renesas

Renesas R5F51105ADFM User manual

Renesas

Renesas RX600 Series User manual

Renesas

Renesas R-IN32M3-EC Installation and operation manual

Renesas

Renesas RTK5RLG1M0C00000BJ User manual

Renesas

Renesas rl78/g1g User manual

Renesas

Renesas DK-S124 User manual

Renesas

Renesas RL78/G15 User manual

Renesas

Renesas RX66N RX600 Series User manual

Popular Microcontroller manuals by other brands

AMS

AMS AS7261 Demo Kit user guide

Novatek

Novatek NT6861 manual

Espressif Systems

Espressif Systems ESP8266 SDK AT Instruction Set

Nuvoton

Nuvoton ISD61S00 ChipCorder Design guide

STMicrolectronics

STMicrolectronics ST7 Assembler Linker user manual

Texas Instruments

Texas Instruments Chipcon CC2420DK user manual

Lantronix

Lantronix Intrinsyc Open-Q 865XR SOM user guide

NEC

NEC 78GK0S/K 1+ Series Application note

Mikroe

Mikroe SEMITECH N-PLC Click Application note

Intel

Intel Agilex user guide

Cypress

Cypress CY4607 HX2VL quick start guide

DIGITAL-LOGIC

DIGITAL-LOGIC MICROSPACE manual

Texas Instruments

Texas Instruments TMS320F2837 D Series Workshop Guide and Lab Manual

CYPRES

CYPRES CY14NVSRAMKIT-001 user guide

Texas Instruments

Texas Instruments INA-DUAL-2AMP-EVM user guide

Espressif Systems

Espressif Systems ESP8266EX Programming guide

Abov

Abov AC33M8128L user manual

Laird

Laird BL654PA user guide