Earlier versions of Bootgen supported creating the boot image by encrypting multiple partitions with a single encryption key. Each partition uses the same key over and over again. This is a security weakness and not recommended. Use each key only once in the flow.
Bootgen supports separate encryption keys for each partition. In case of multiple key files, ensure that each encryption key file uses the same Key0 (device key), IV0, and Operational Key. Bootgen does not allow creating boot images if these are different in each encryption key file. You must specify multiple encryption key files, one for each of partition in the image. The system encrypts the partitions using the key specified for the partition.
.1, .2, .n, and so on
in the same directory of the key file meant for that partition.The following snippet shows a sample encryption key file:
all:
{
[keysrc_encryption] bbram_red_key
// FSBL (Partition-0)
[
bootloader,
destination_cpu = a53-0,
encryption = aes,
aeskeyfile = key_p0.nky
]fsbla53.elf
// application (Partition-1)
[
destination_cpu = a53-0,
encryption = aes,
aeskeyfile = key_p1.nky
]hello.elf
}- The partition fsbla53.elf is encrypted using the keys from key_p0.nky file.
- Assuming hello.elf has three partitions because it has three loadable sections, then keys from the key_p1.nky file encrypt partition hello.elf.0.
- Partition hello.elf.1 is then encrypted
using keys from
key_p1.1.nky. - Partition hello.elf.2 is encrypted using
keys from
key_p1.2.nky.