Rolling Keys - Rolling Keys - 2026.1 English - UG1283

AES-GCM also supports the rolling keys feature. It represents the entire encrypted image as smaller AES-encrypted blocks or modules. Each module is encrypted using its own unique key. The initial key is stored at the key source on the device, while keys for each successive module are encrypted (wrapped) in the previous module. You can generate the boot images with rolling keys using Bootgen. The BIF attribute "blocks" specifies the pattern for creating multiple smaller blocks for encryption.

all:
{
	id_code = 0x04ca8093
	extended_id_code = 0x01
	id = 0x2

	metaheader
	{
		encryption = aes,
		keysrc = bbram_red_key,
		aeskeyfile = efuse_red_metaheader_key.nky,
		dpacm_enable
	}

	image
	{
		name = pmc_subsys, id = 0x1c000001
		partition
		{
			id = 0x01, type = bootloader,
			encryption = aes,
			keysrc = bbram_red_key,
			aeskeyfile = bbram_red_key.nky,
			dpacm_enable,
			blocks = 4096(2);1024;2048(2);4096(*),
			file = plm.elf
		}
		partition
		{
			id = 0x09, type = pmcdata, load = 0xf2000000,
			aeskeyfile = pmcdata.nky,
			file = pmc_data.cdo
		}
	}

	image
	{
		name = lpd, id = 0x4210002
		partition
		{
			id = 0x0C, type = cdo,
			encryption = aes,
			keysrc = bbram_red_key,
			aeskeyfile = key1.nky,
			dpacm_enable,
			blocks = 8192(20);4096(*),
			file = lpd_data.cdo
		}
		partition
		{
			id = 0x0B, core = psm,
			encryption = aes,
			keysrc = bbram_red_key,
			aeskeyfile = key2.nky,
			dpacm_enable,
			blocks = 4096(2);1024;2048(2);4096(*),
			file = psm_fw.elf
		}
	}

	image
	{
		name = fpd, id = 0x420c003
		partition
		{
			id = 0x08, type = cdo,
			encryption = aes,
			keysrc = bbram_red_key,
			aeskeyfile = key5.nky,
			dpacm_enable,
			blocks = 8192(20);4096(*),
			file = fpd_data.cdo
		}
	}
}