The authentication of a bitstream is different from other partitions. The FSBL can be wholly contained within the OCM, and therefore authenticated and decrypted inside of the device. The bitstream file is so large that the device cannot hold it entirely. Therefore, the system must use external memory. The use of external memory creates a challenge to maintain security because an adversary might have access to this external memory. When a user requests bitstream authentication, Bootgen divides the bitstream into 8 MB blocks and has an authentication certificate for each block. If a bitstream is not in multiples of 8 MB, the last block contains the remaining bitstream data. When both authentication and encryption are enabled, the process first encrypts the bitstream. Then Bootgen divides the encrypted data into blocks and places an authentication certificate for each block.
