Versal AI Edge Series Gen 2 and Versal Prime Series Gen 2 devices use AES-GCM for encryption, which supports robust key management. Bootgen uses seed as input which supports deriving multiple keys from seed due to key rolling. If a seed is specified, the keys are derived using the seed. If seeds are not specified, keys are derived based on Key0. If an empty key file is specified, Bootgen automatically generates a seed, which in turn is the input for KDF to generate the Key/IV pairs.
Consistent Key Usage Across Generated Files
You explicitly provide an encryption file for the first partition, and you auto-generate files for later partitions. In that case, Bootgen uses the same Key0/IV0 pair from the first file for all subsequently generated keys. This ensures consistency in the cryptographic parameters.
Error on Mismatched Key0/IV0 in Later Partitions
If an encryption file is generated for the first partition and a manually specified encryption file using the same Key0/IV0 is provided for a later partition, Bootgen terminates and return an error due to an invalid reuse of the Key0/IV0 pair.
Default Key Generation per Partition
If you do not explicitly specify an encryption file but enable encryption on a partition, Bootgen automatically generates an AES key file. Bootgen names the file after the partition. This ensures that each partition uses a distinct AES key for encryption.
Support for Multiple Loadable Sections
For partitions that results in multiple loadable sections, Bootgen allows the use of unique key files per section. It performs either by reading or generating AES key files suffixed with extensions like .1, .2, ..., .n, placed in the same directory as the original partitions key file.