The device key source selection is exclusively performed by the RCU ROM based on the authenticated boot image header. The AES key management block selects the appropriate key that needs to be input to the AES core.
The AES_KEY_SEL register determines which of the keys available is used for the encryption and decryption operation. The AES_KEY_SIZE register determines if the key is 128 bits or 256 bits. The AES_KEY_LOAD register loads the key value into the AES core.
In addition to the BBRAM and eFUSE key storage locations, the Versal AI Edge Series Gen 2 and Versal Prime Series Gen 2 device also allows for the device key to be stored in the boot header from the boot device. This key can be stored in its black form (i.e., encrypted with the PUF KEK).