Black/PUF Keys - Black/PUF Keys - 2026.1 English - UG1283

A PUF generates a cryptographically strong key encryption key (KEK), and the black key storage solution uses it to encrypt the user key. You can then store the resulting black key either in the eFUSE or as part of the authenticated boot header.

image:
{ 
	[puf_file] pufdata.txt
	[bh_key_iv] black_iv.txt
	[bh_keyfile] black_key.txt
	[fsbl_config] puf4kmode, shutter=0x0100005E, pufhd_bh
	[keysrc_encryption] bh_blk_key 
	
	[
	  bootloader,
	  destination_cpu = a53-0,
	  encryption      = aes, 
	  aeskeyfile      = aes_p1.nky
	] fsbl.elf
		 
	[
	  destination_cpu = r5-0,
	  encryption      = aes,
	  aeskeyfile      = aes_p2.nky
	] hello.elf
}

For another example of using the black key, see Use Cases and Examples.