119
edits
Changes
Jump to navigation
Jump to search
Line 624:
Line 624: − + − + + + + + + +
→Hardware key generator: Added algorithm for hardware key generator
=== Hardware key generator ===
=== Hardware key generator ===
A dedicated hardware key generator can be used to generate a keyslot's normalkey from its keyX and keyY. The hardware key generator is triggered by writing the keyY, which is the only way to trigger it with the 3DS keyslots. The algorithm used for key generation is unknown.
A dedicated hardware key generator can be used to generate a keyslot's normal-key from its keyX and keyY. The hardware key generator is triggered by writing the keyY, which is the only way to trigger it with the 3DS keyslots.
Unless noted otherwise, all keyslots on retail units use the hardware key-generator.
The algorithm for generating the normal-key from keyX and keyY is as follows, in big-endian 128-bit unsigned wraparound arithmetic:
NormalKey = (((KeyX ROL 2) XOR KeyY) + C) ROL 87
The secret constant C has not been publicly disclosed.
Unless noted otherwise, all keyslots on retail units use the hardware key generator.
=== FIRM-launch key clearing ===
=== FIRM-launch key clearing ===
Starting with [[9.0.0-20]] the Process9 FIRM-launch code now "clears" the following AES keyslots, with certain keydata by writing the normal-key: 0x15 and 0x18-0x20. These are the keyslots used by the New3DS [[FIRM]] arm9bin loader(minus keyslot 0x11), the New3DS Process9 does this too.
Starting with [[9.0.0-20]] the Process9 FIRM-launch code now "clears" the following AES keyslots, with certain keydata by writing the normal-key: 0x15 and 0x18-0x20. These are the keyslots used by the New3DS [[FIRM]] arm9bin loader(minus keyslot 0x11), the New3DS Process9 does this too.