SWCU195A December 2024 – May 2025 CC2744R7-Q1 , CC2745P10-Q1 , CC2745R10-Q1 , CC2745R7-Q1 , CC2755R10
This region is located at the last 792 bytes of the SCFG memory region. It is used to store up to 18 key hashes of either App or SSB type. In this context, a Key Ring of type App is applicable for App 0 and App 1 image types. It is used to validate that the Public Key used to verify the signature of a given target, either App or SSB, is in fact the authorized key. If an image public key does not match the active key of the corresponding image type, the image will be rejected.
If a given private key, either to sign App or SSB, gets compromised, a new key of that given type can be added to the system. The Key Update section describes how new keys can be added to the ring.
The following describes the binary structure of each entry.
// Key ring config, length 792B
struct {
// Key Entries
#define SCFG_KEY_HASH_RING_NUM 18U
struct keyRingEntry {
// SHA-256 hash a public key (key type depends on secBootCfg.policyCfg.authAlgorithm)
uint8_t keyHash[32];
// ID corresponding to type of keyEntry
uint32_t type;
#define SCFG_KEY_ENTRY_TYPE_APP 0x3F68A5A5U
#define SCFG_KEY_ENTRY_TYPE_BLDR 0x6C715A5AU
// CRC across keyHash through type
uint32_t crc32;
// Status is intentionally left out of crc32 coverage
// A value other than SCFG_KEY_ENTRY_STATUS_ACTIVE is considered inactive
uint32_t status;
#define SCFG_KEY_ENTRY_STATUS_ACTIVE 0x59183d3bU
} keyEntries[SCFG_KEY_HASH_RING_NUM];
} keyRingCfg;Once the Key Ring is full, no more Key Updates are allowed. A chip erase will always reset the state of the key ring.