For SoC devices, the BootROM and the FSBL decrypt partitions during the booting cycle. The BootROM reads FSBL from flash, decrypts, loads, and hands off the control. After FSBL starts executing, it reads the remaining partitions, decrypts, and loads them. The AES key needed to decrypt the partitions can be retrieved from either eFUSE or BBRAM. The key source field of the boot header table in the boot image is read to know the source of the encryption key. An AES hardware engine decrypts each encrypted partition.
Important: Bootgen key generation is intended for
development and prototyping use. For fielded systems, the AES and HMAC key values
written into the .nky file should be generated from a high-quality
entropy source and then provided to the tools. Bootgen key generation is intended for
development use only and not for fielded systems.
Figure 1. Decryption Process Diagram
