Bootgen has the capability of generating AES-GCM keys. It uses the NIST-approved Counter Mode KDF, with CMAC as the pseudo random function. Bootgen takes seed as input in case you want to derive multiple keys from seed due to key rolling. If a seed is specified, the keys are derived using the seed. If seeds are not specified, keys are derived based on Key0. If an empty key file is specified, Bootgen automatically generates a seed, which in turn is the input for KDF to generate the Key/IV pairs.
- In this flow, you must generate the seed from a high-quality entropy source, when the seed is specified; otherwise generate the Key0 from a high-quality entropy source. Then, you must provide the input for the tools.
- If one encryption file is specified and others are generated, Bootgen can make sure to use the same Key0/IV0 pair for the generated keys as in the encryption file for the first partition. For example, in the case of a full boot image, the first partition is the bootloader.
- If you generate an encryption file for the first partition and specify another file with Key0/IV0 for a later partition, Bootgen exits. It returns an error stating that you used an incorrect Key0/IV0 pair.
Key Generation
The following example shows a sample key file:
Device xczu9eg;
Key 0 AD00C023E238AC9039EA984D49AA8C819456A98C124AE890ACEF002100128932;
IV 0 11198912D243EF0AFEAC8970;
Key 1 C023E238AC903111DEF0AABB98C1CCDDEEFF021001289011198C1E238AC34012;
IV 1 111DEFOAABBCCDDEEFF00112;
Key 2 11456A9B8764DE111444C023E238A98C1CCC9031177112E01289011198CFF010;
IV 2 9C64778CBAF48D6DDE13749B;
Key Opt 229C993D1310DD27B6713749B6D07FCF8D3DCA01EC9C64778CBAF457D613508F;Obfuscated Key Generation
Bootgen can generate the obfuscated key by encrypting the red key with the family key and a user-provided IV. The AMD Security Group delivers the family key. For more information, see familykey. To generate an obfuscated key, Bootgen takes the following inputs from the BIF file.
obf_key:
{
[aeskeyfile] aes.nky
[familykey] familyKey.cfg
[bh_key_iv] bhiv.txt
}The command to generate the obfuscated key is:
bootgen -arch zynqmp -image all.bif -generate_keys obfuscatedkey