Bootgen can encrypt the boot image partitions based on the user-provided encryption commands and attributes in the BIF file. AES is a symmetric key encryption technique; it uses the same key for encryption and decryption. The key used to encrypt a boot image should be available on the device for the decryption process while the device is booting with that boot image. Generally, the key is stored either in eFUSE or BBRAM, and you can select the source of the key during boot image creation through BIF attributes, as shown in the following figure.
Important: While Bootgen can automatically
generate AES keys for convenience during development, AMD
recommends that you generate your own keys for fielded systems using a high-quality
entropy source. Keys not generated from a high-quality entropy source can be weak,
which means they can be predictable or could be brute-forced. Tool-generated keys can be
useful for development or test flows when production keys are not yet available to
engineers. The specific values that must come from high-quality entropy sources vary by
device family and are identified in the following sections. Bootgen key generation is
intended for development use only and not for fielded systems. See AR76171 and Design Advisories for Bootgen for more information.
Figure 1. Encryption Process Diagram
