SPRUJ55D September 2023 – July 2025 AM263P2 , AM263P2-Q1 , AM263P4 , AM263P4-Q1
The Image Encryption Object Identifier has the following format: -
imageEncryption ::= SEQUENCE {
iv: OCTET STRING -- The initialization vector
rs: OCTET STRING -- Random string
iter: INTEGER -- Iteration count
salt: OCTET STRING -- encryption salt value
}The Boot-ROM only supports AES-CBC mode with 256bit keys. The information in the image encryption object identifier is used to decrypt the image.
IV:The initialization vector is used during the AES-CBC decryption procedure. The initialization vector needs to be 16bytes.
rs:
This is the random string which is 32bytes long and is added by the X.509 certificate generator at the end of the image. The Boot-ROM will decrypt the image and will perform a random string comparison to determine if the decryption was successful.
iter:
Iteration Count which is used to determine if the HKDF needs to be performed and key derivation needs to be done. If the iteration count is 0 then the key from the e-fuse is used as is for the decryption. If the iteration count is non-zero then the Boot-ROM will perform the HKDF key derivation using the salt. The derived key is then used for the decryption operation.
salt:
The salt is used only if the iteration count is non-zero and key derivation is being done. The salt is fed to the HKDF module to derive the key. The salt fields should be 32bytes.