Bootgen has the capability of generating AES-GCM keys. It uses the NIST-approved Counter Mode KDF, with CMAC as the pseudo random function. Bootgen takes seed as input in case the user wants to derive multiple keys from seed due to key rolling. If a seed is specified, the keys are derived using the seed. If seeds are not specified, keys are derived based on Key0. If an empty key file is specified, Bootgen generates a seed with time based randomization (not KDF), which in turn is the input for KDF to generate other the Key/IV pairs.
- If one encryption file is specified and others are generated, Bootgen can make sure to use the same Key0/IV0 pair for the generated keys as in the encryption file for the first partition. For example, in the case of a full boot image, the first partition is the bootloader.
- If an encryption file is generated for the first partition and other encryption file with Key0/IV0 is specified for a later partition, then Bootgen exits and returns the error that an incorrect Key0/IV0 pair was used.
Key Generation
The following example shows a sample key file:
Device xczu9eg;
Key 0 AD00C023E238AC9039EA984D49AA8C819456A98C124AE890ACEF002100128932;
IV 0 11198912D243EF0AFEAC8970;
Key 1 C023E238AC903111DEF0AABB98C1CCDDEEFF021001289011198C1E238AC34012;
IV 1 111DEFOAABBCCDDEEFF00112;
Key 2 11456A9B8764DE111444C023E238A98C1CCC9031177112E01289011198CFF010;
IV 2 9C64778CBAF48D6DDE13749B;
Key Opt 229C993D1310DD27B6713749B6D07FCF8D3DCA01EC9C64778CBAF457D613508F;Obfuscated Key Generation
Bootgen can generate the obfuscated key by encrypting the red key with the family key and a user-provided IV. The family key is delivered by the AMD Security Group. For more information, see familykey. To generate an obfuscated key, Bootgen takes the following inputs from the BIF file.
obf_key:
{
[aeskeyfile] aes.nky
[familykey] familyKey.cfg
[bh_key_iv] bhiv.txt
}The command to generate the obfuscated key is:
bootgen -arch zynqmp -image all.bif -generate_keys obfuscatedkey