Renesas R5F565NEHDFC Installation and operating instructions

STZAN0114EN0100
1
Application Note
STZAN0114EN0100
Revision 1.00
April 2019
Getting Started with Embedded Trust and the RX65x
Introduction
This application note describes the use of the Embedded Trust and C-Trust security development environments
with the Renesas RSK+RX65N-2MB Starter Kit. The Renesas RSK series includes an LCD display module and
E2 Lite debugging emulator. The RSK also offers additional peripherals to extend the features of the board and
ease the development of custom security designs.
Target Devices
This application note refers to the following secure microcontroller :
➢Renesas Electronics R5F565NEHDFC microcontrollers
Related Documents
➢Renesas RSK+RX65N-2MB User’s Manual (R20UT3888EG0200 Rev 2.00 Dec 2017)
➢E1/E20/E2 Emulator, E2 Emulator Lite (R20UT0399EJ1200 Rev.12.00 Nov 2018)
➢Embedded Trust User Guide (available from Secure Thingz & IAR Systems websites)

STZAN0114EN0100
2
1. Kit Overview
The Renesas RSK+RX65N-2MB Starter Kit is a hardware platform for the evaluation of the Renesas RX65N
device. The Renesas RSK+RX65N-2MB Starter Kit part number is as follows:
• YRTK50565N200010BE (Renesas RSK+RX65N-2MB Kit CS+ & E2Lite-Encrypted)
The board offers a set of features that enables the user to get started with the microcontroller peripherals
immediately and to obtain an understanding of how to integrate the device in their required design.
This application note is primarily concerned with the RX65N-2MB device and RSK+RX65N-2MB Kit. Figure 1
shows the features of the Renesas RSK+RX65N-2MB Starter Kit.
Figure 1: Renesas RSK+RX65N-2MB Starter Kit features
Please refer to the Renesas RSK+RX65N-2MB User’s Manual (section 7) (see Related Documents) for details of
the implementation of connectors and headers on the starter kit.

STZAN0114EN0100
3
2. Getting Started
Download and install the following :
➢IAR Systems Embedded Workbench for RX provided by IAR Systems
➢Embedded Trust security development environment provided by Secure Thingz
➢C-Trust extension to IAR Embedded Workbench provided by IAR Systems
Refer to the Installation and Licensing Quick Reference Guide available from the IAR Systems website to
determine PC system requirements.
Launch Embedded Trust for RX. The tool will open as per that shown in Figure 2.
Figure 2: Embedded Trust for RX opening screen
Click on Example Projects -> Embedded Trust -> Getting Started -> RX65N Open Project (see Figure 3)
Figure 3: Open Getting Started project
An explorer dialog will open requiring the destination folder for the project to be located. Direct the open dialog
box to the folder to be used for the project and click “Select Folder”.
With the folder selected (and additional folder expansion), the IDE will look like that shown in Figure 4.

STZAN0114EN0100
4
Figure 4: Embedded Trust with Getting Started project loaded
Click on the Project tab and select “Create New Project” in the dropdown menu. The dialog box shown in
Figure 5 will be displayed. Click on the “Tool chain” dropdown and select “RX”.
We wish to add security to the Getting Started project we have just loaded so click on Secure Boot Manager in
the “Create New Project” dialog box and click “OK”.
Figure 5: Select Secure Boot Manager in Create New Project dialog box
An explorer dialog will open requiring a filename for the Secure Boot Manager project. Enter the filename to be
used into the open dialog box and click “Save”. In this example we have used SBM as the filename.
The IDE will now load the additional Secure Boot Manager project and look like that shown in Figure 6.

STZAN0114EN0100
5
Figure 6: IDE with Secure Boot Manager project loaded and active
Please read the Readme.txt file that is displayed in the IDE. This file includes important configuration information
for projects that are to have security added i.e. integrated with a Secure Boot Manager. Please note that "Erase
flash ROM before download" is enabled by default in the Hardware Setup dialog box (available on the debugger
driver menu in the IDE)
2.1 Configuring the Secure Boot Manager
The Secure Boot Manager project must now be configured for the RX65N. The configuration will be carried out
via the Project -> Options… menu provided by the IDE. To access this menu, right click on the SBM-Debug
project and select “Options…” in the dropdown menu (see Figure 7).
Figure 7: Selecting Project -> Options menu

STZAN0114EN0100
6
The menu for Options for node “SBM” will open. Select the “General Options” category and click on the
“Target” tab. Select the Device type as “R5F565NE”.
Select the “Debugger” category and select the “E2 Lite” Driver.
Select the “Security” category and click the Enable check box. The Embedded Trust dialog box shown in Figure
8 should be the resultant display.
Figure 8: Embedded Trust dialog box
We will now create a Security Context for the Secure Boot Manager project.

STZAN0114EN0100
7
2.2 Configuring the Security Context
In the Options for node “SBM” -> Embedded Trust dialog box (see Figure 8) click “New”. The dialog box for
“Create New Security Context” will open. Populate the values, in free text, with the required configuration. Note
that the Security Configuration information is the information that will be used to generate the Device Certificate
for the project. Figure 9 is an example of a completed Basic Setup configuration. Once the correct information
has been entered, click “Next”.
Figure 9: Basic Setup of Security Context dialog box
The Security Settings configuration dialog box will now be displayed (see Figure 10). There are two options
that require configuration, these are the Number of Certificates and the Device ID source.
Figure 10: Security Settings of Security Context dialog box

STZAN0114EN0100
8
2.2.1 Number of certificates
This option allows the user to select the number of digital certificates that are to be implemented in the chain of
trust (Public Key Infrastructure (PKI)) for the application. Figure 11 is an example of a chain of trust with 3 levels.
A maximum of 8 levels are supported by the Secure Boot Manager, however, due to the requirement to store the
certificates in secure memory, there is a limitation on the number of certificates that can be implemented in a
usable system. The default number of levels is 3 for the RX65N when using the GettingStarted example
application.
Figure 11: Example chain of trust with 3 levels
It is recommended that the Number of certificates required option is set to the default of 3.
2.2.2 Device ID
This option concerns the serial number field in the digital certificate for the device. The serial number of the
certificate can be created from either the silicon ID of the target device or a random number generated by
Embedded Trust. If From device is selected, the silicon ID is read out of the target device during the first phase
of provisioning and used to create the certificate serial number. This certificate is then tightly bound to the target
device. Note that once completed, the certificate hash is calculated and then signed by the Certificate Authority
Private key. The Random option is an alternative to using the silicon ID. In this case, Embedded Trust will
generate a random number which will be used as the device certificate serial number.
It is recommended that From device is selected as the Device ID option as this will allow the user to check the
device certificate programmed into the device against the unique ID of the RX65N.
Once the options described and recommended in sections 2.2.1 and 2.2.2 are set click “Next”
The Secure Boot Manager Settings dialog box will now be displayed (see Figure 12). For the initial release of
Embedded Trust, there are no options within this dialog box that can be set by the user.

STZAN0114EN0100
9
Figure 12: Secure Boot Manager Settings dialog box
Click “Create” to allow Embedded Trust to create the Security Context. A dialog box will open to confirm the use
of the profile that has just been created, click “Yes”. The dialog box shown in Figure 13 is an example of the final
Security Context created showing the newly created security context profile (in this example My Security
Context_profile-default). Click “OK”.
Figure 13: Completed Security Context example
The IDE will now return to the screen similar to that as shown in Figure 6 but with the addition of SBM source
and Output folders. Please review the Secure Boot Manager source files. These files are open source and can be
modified by the user. If the user is required to make major modifications to the Secure Boot Manager source code,
it is recommended that the changes be reviewed by Secure Thingz to ensure security is not compromised.

STZAN0114EN0100
10
2.3 Connecting the Renesas RSK+RX65N-2MB Starter Kit
Figure 14 shows the connections that are required between the RSK+RX65N-2MB Starter Kit CPU board, E2
Lite debugger and the host PC. It is recommended that the user consult the RSK+RX65N-2MB Starter Kit Quick
Start guide for more detailed information concerning the operation of the kit. Please note that the +5V centre-
positive PSU supplied with the kit is required.
Figure 14: Debugger connection diagram
In addition to the debugger connections as shown in Figure 14, an additional terminal connection is required
between the PC and the CPU board. Figure 15 shows the additional terminal output connection available on the
RSK+RX65N-2MB Starter Kit. Please connect the RSK+RX65N-2MB Starter Kit to the PC that is running the
Embedded Trust software as shown in Figures 14 and 15.
Figure 15: Connection for terminal output