Rolling Keys - Rolling Keys - 2026.1 English - UG1283

AES-GCM also supports the rolling keys feature, which represents the entire encrypted image using smaller AES-encrypted blocks or modules. The system encrypts each module with its own unique key. The device stores the initial key at the key source, while the previous module encrypts (wraps) the keys for each successive module. Bootgen can generate boot images with rolling keys. The BIF attribute blocks specifies the pattern to create multiple smaller blocks for encryption.

image:
{
	[keysrc_encryption] bbram_red_key
		
	[
		bootloader, 
		destination_cpu = a53-0,
		encryption      = aes, 
		aeskeyfile      = aes_p1.nky,
		blocks          = 1024(2);2048;4096(2);8192(2);4096;2048;1024 
	]    fsbl.elf
	 	
	[
		destination_cpu = a53-3,
		encryption      = aes, 
		aeskeyfile      = aes_p2.nky,
		blocks          = 4096(1);1024 
	]    hello.elf
}