Editing Kirk

The PSP KIRK Crypto Engine is a security hardware device that is embedded into the TACHYON main IC chip. It is a bus master and can DMA to/from main DDR RAM memory, operating independantly of the CPU. It is intefaced via memory mapped registers at base of 0xBDE00000 ([SPOCK Crypto Engine] on the other hand is mapped to 0xBDF00000). It is capable of performing AES encryption, decryption, SHA1 Hash, pseudo random number generation, and signature checks (OMAC and ECDSA).

= Commands =

On PSP there are 18 KIRK commands. On PSVita, there are these 18 commands plus some new commands to support bigger keys (192 bits for example). See [https://wiki.henkaku.xyz/vita/F00D_Commands#gcauthmgr_sm.self F00D commands].

{| class="wikitable"
|-
! scope="col"| Command ID
! scope="col"| Name
! scope="col"| Short description
! scope="col"| Input
! scope="col"| Output
! scope="col"| Result
! scope="col"| Used in
|-
| 1
| 
| Super-Duper decryption (no inverse)
| Input size: size+0x40
| 
| 
| memlmd, mesg_led
|-
| 2
| 
| Encrypt Operation (inverse of cmd 3)
| 
| 
| 
| 
|-
| 3
| 
| Decrypt Operation (inverse of cmd 2)
| 
| 
| 
| 
|-
| 4
| 
| Encrypt Operation (inverse of cmd 7) (IV=0)
| Input size: size+0x14
| 
| 
| chnnlsv, memab
|-
| 5
| 
| Encrypt Operation (inverse of cmd 8) (IV=FuseID)
| Input size: size+0x14
| 
| 
| chnnlsv
|-
| 6
| 
| Encrypt Operation (inverse of cmd 9) (IV=UserDefined)
| 
| 
| 
| 
|-
| 7
| 
| Decrypt Operation (inverse of cmd 4) (IV=0)
| Input size: size+0x14
| 
| 
| memlmd, mesg_led,chnnlsv, memab
|-
| 8
| 
| Decrypt Operation (inverse of cmd 5) (IV=FuseID)
| Input size: size+0x14
| 
| 
| chnnlsv
|-
| 9
| 
| Decrypt Operation (inverse of cmd 6) (IV=UserDefined)
| 
| 
| 
| 
|-
| 10 (0xA)
| 
| Private Signature Check (checks for private SCE sig)
| 
| 
| 
| 
|-
| 11 (0xB)
| 
| SHA1 Hash
| Input size: size
| 
| 
| memlmd, mesg_led, memab
|-
| 12 (0xC)
| 
| Mul1
| Input size: 0
| 
| 
| memab
|-
| 13 (0xD)
| 
| Mul2
| Input size: 0x3C
| 
| 
| 
|-
| 14 (0xE)
| 
| Pseudo Random Number Generation
| Input size: 0
| 
| 
| mesg_led,chnnlsv,memab,semawm
|-
| 15 (0xF)
| 
| (absolutely no idea – could be KIRK initialization)
| 
| 
| 
| 
|-
| 16 (0x10)
| 
| Signature Generation
| Input size: 0x34
| 
| 
| memab
|-
| 17 (0x11)
| 
| Signature Check (checks for generated sigs)
| Input size: 0x64
| 
| 
| memab
|-
| 18 (0x12)
| 
| Certificate Check (idstorage signatures)
| Input size: 0xB8
| 
| 
| openpsid, memab
|}

= Library =

== Calling commands using KIRK registers ==

* [https://github.com/DaveeFTW/iplsdk/tree/master/src/kirk]

* [https://github.com/TheHellcat/psp-hb/blob/master/KirkCrypt/intercom/silvercode.c]

* [http://uofw.github.io/upspd/docs/SilverSpring_Blog/my.malloc.us/silverspring/2007/10/ipl-decrypt-sample-direct-hw-access/index.html]

* [http://uofw.github.io/upspd/docs/SilverSpring_Blog/my.malloc.us/silverspring/kirk-crypto-engine/index.html]

= Notes =

In 2008 SilverSpring wrote:
<pre>
Currently what is known about the cipher is that it is:
a block cipher operating in CBC mode
an all zero 128-bit initialization vector
128-bit block and key sizes
cmd4/7 uses a static key that is identical in all PSP’s
cmd5/8 uses a key based off the fuseID making all operations unique per PSP
cmd6/9 uses a user-defined 128-bit key
cmd1/2/3 uses the block cipher but also signature algorithms
the remaining KIRK cmd’s do not use the block cipher (sig, hash, & prng algo’s)
</source>