Editing Keys

Jump to navigation Jump to search
Warning: You are not logged in. Your IP address will be publicly visible if you make any edits. If you log in or create an account, your edits will be attributed to your username, along with other benefits.

The edit can be undone. Please check the comparison below to verify that this is what you want to do, and then publish the changes below to finish undoing the edit.

Latest revision Your text
Line 1: Line 1:
[[Category:Software]]
[[Category:Software]]<noinclude>[[Category:Main]]</noinclude>
<noinclude>
[[Category:Main]]
</noinclude>


= Useful Information =
= Useful Information =
Line 20: Line 17:
* pub file (public): %s-pub-%s
* pub file (public): %s-pub-%s
* priv file (private): %s-priv-%s
* priv file (private): %s-priv-%s
= Per-console keys =
See [https://www.psdevwiki.com/psp/Kirk#Individual_Seed Kirk documentation] for usage of PSP-related individual seeds.
== Cmep Keyring 0x600 - Visible ID (Test Subject 9 PS Vita) ==
<pre>
00 00 01 01 AC 72 45 00 F5 68 96 03 80 57 C8 1A
25 99 21 A1 73 A4 89 F2 E9 96 23 E9 86 0F 74 2D
</pre>
* Contains the console's [https://wiki.henkaku.xyz/vita/VisibleId Visible ID].
== Cmep Keyring 0x601 - ScePspIndividualKeyMeshCert first half (Test Subject 9 PS Vita) ==
* Contains the first half (0x20 bytes) of of the console's [https://www.psdevwiki.com/psp/Kirk#PSP_Individual_Key_Mesh_Certificate ScePspIndividualKeyMeshCert].
* Warning: the dump presented here is byte-swapped.
<pre>
B9 18 4E 22 83 8B 91 6D 19 86 72 D5 FB 10 FD A3 <- byte-swapped key_mesh.derivation_seed_1
4A 4E 72 CB 02 6E 96 E9 96 B2 C3 23 B9 CF 36 A4 <- byte-swapped key_mesh.derivation_seed_0
</pre>
== Cmep Keyring 0x602 - ScePspIndividualKeyMeshCert second half (Test Subject 9 PS Vita) ==
* Contains the second half (0x20 bytes) of the console's [https://www.psdevwiki.com/psp/Kirk#PSP_Individual_Key_Mesh_Certificate ScePspIndividualKeyMeshCert].
* Warning: the dump presented here is byte-swapped.
<pre>
85 4B 14 AB 00 00 00 00 00 45 72 AC 01 01 08 10 <- byte-swapped hash, byte-swapped reserved, byte-swapped fuse_id
FF 9A 3E E5 A2 B9 F5 25 32 4D E0 2A 8F B1 8F B9 <- byte-swapped key_mesh.derivation_key
</pre>
== ScePspIndividualKeyMeshCert (Test Subject 9 PS Vita) ==
* By byte-swapping keyrings 0x601 and 0x602 or by taking Fuse ID only and running the ScePspIndividualKeyMeshCert generation algorithm (see PSP Jig Kick flashData.prx), we can obtain ScePspIndividualKeyMeshCert.
<pre>
A4 36 CF B9 23 C3 B2 96 E9 96 6E 02 CB 72 4E 4A <- key_mesh.derivation_seed_0
A3 FD 10 FB D5 72 86 19 6D 91 8B 83 22 4E 18 B9 <- key_mesh.derivation_seed_1
B9 8F B1 8F 2A E0 4D 32 25 F5 B9 A2 E5 3E 9A FF <- key_mesh.derivation_key
10 08 01 01 AC 72 45 00 00 00 00 00 AB 14 4B 85 <- fuse_id, reserved, hash
</pre>


= SUPER KEYS (Dumped by SDBoot glitching) =
= SUPER KEYS (Dumped by SDBoot glitching) =
Line 102: Line 56:
</pre>
</pre>


== Perconsole Keyslot 0x200 (Test Subject 5?) ==
== Static Keyslot 0x605 ==


<pre>
<pre>
D8 E9 45 05 08 3D 81 63 77 AB 64 7A 36 94 2C FD
3B 39 E9 2E 25 B0 40 38 27 EE 32 D7 D6 49 A8 47
84 6F 37 44 A5 D9 8F 02 F8 C8 B7 D7 B0 22 05 1B
D7 F1 1E 24 D0 11 76 0A 79 43 37 D4 F7 40 C9 DF
</pre>
</pre>


== Perconsole Keyslot 0x201 (Test Subject 5?) ==
* Universal
 
== Perconsole Keyslot 0x606 (Test Subject 5) ==


<pre>
<pre>
83 BF 0D 44 0B 79 82 B9 05 F2 68 1A C9 9C 1E 49
5E 75 05 CD A7 40 E8 5D 7F 82 B7 EA EA 32 CE 1C
7A 3F 38 F1 1A B7 BF A1 2E 8F 04 79 C8 D7 1F E7
66 04 2C E9 E6 B6 F4 F1 DC AA 94 A1 06 B8 32 EF
</pre>
</pre>


== Perconsole Keyslot 0x202 (Test Subject 5?) ==
== Perconsole Keyslot 0x606 (Test Subject 6) ==


<pre>
<pre>
DC 79 77 20 6D E7 8F 09 4D 35 9F 0E 42 68 7A 88
DD DF C7 61 C7 7F AE 89 CF 39 6F BC 30 CF 7F 60 
77 44 D8 1D CA 45 2B 6B AC 23 1C 63 0C E6 A2 1B
F8 BF BC 24 E1 3F 5A CE 46 50 BC 66 2F 73 AC D4 
</pre>
</pre>


== Perconsole Keyslot 0x203 (Test Subject 5?) ==
== Perconsole Keyslot 0x606 (Test Subject 7) ==


<pre>
<pre>
85 66 77 B1 57 3A 21 0C 6A EC AC 38 F3 2C 3A DA
72 39 DE 10 B7 F1 92 D5 78 E1 03 81 63 7F CF CF 
4B A6 3F 39 68 52 79 34 3C 3E 5E A3 77 6A 46 0D
D4 44 9B 58 A1 7C 97 E5 EC F6 1D 09 40 82 7B B2 
</pre>
</pre>


== Perconsole Keyslot 0x204 (Test Subject 5?) ==
== Perconsole Keyslot 0x606 (Test Subject 8) ==


<pre>
<pre>
34 3A EF 0C D8 51 B5 38 F5 C9 4E FE 0E 1D 6B CB
98 AF 08 AD B7 8A E2 83 0A 31 47 0A FD 00 B2 64 
38 6F C3 FD FC 6F D5 85 A0 52 BB 0A 39 7D 97 31
D4 E2 C5 83 E2 14 EB 57 F9 58 CD 54 C4 BA 09 4C
</pre>
</pre>


== Perconsole Keyslot 0x205 (Test Subject 5?) ==
== Perconsole Keyslot 0x607 (Test Subject 5) ==


<pre>
<pre>
9E BE CF DD 5B 42 AD 95 87 2C D6 A3 FF 25 EB E4  
F5 B1 8E B5 37 DD C4 6F 6B 59 A4 19 AD AB F4 A8
18 39 73 28 27 32 68 E8 85 65 DF 9F E7 D3 D8 62
52 02 9A 0E 50 E4 FC 3F F0 93 88 EA E3 34 C7 E3
</pre>
</pre>


== Perconsole Keyslot 0x206 (Test Subject 5?) ==
== Perconsole Keyslot 0x607 (Test Subject 6) ==
 
<pre>
<pre>
80 86 DC B9 CB 23 A0 53 E6 2C 67 2F 13 99 D3 E6
FA 87 A5 75 15 B2 88 60 57 5E 2C 2D 45 7F BA 86
73 9B 21 78 15 0B C1 E9 30 DD EA 55 24 FC 0A D7
55 32 A9 74 96 BF D5 B9 E8 D4 CE D7 98 19 40 97
</pre>
</pre>


== Perconsole Keyslot 0x207 (Test Subject 5?) ==
== Perconsole Keyslot 0x607 (Test Subject 7) ==
<pre>
53 D4 2F 37 73 18 AD CF D2 F7 48 30 95 56 96 EE
87 EB 88 A6 47 1E 7E 8A 8B 96 10 FE CE CC F8 92
</pre>


== Static Keyslot 0x208 (Type 3) ==
<pre>
<pre>
2D B8 D5 93 4A 1D 77 89 EA 87 95 F7 8A 8F C2 B7
7E EE 37 A4 C0 DA C7 D2 0A AA 5E DA 34 17 B4 5C 
74 D8 52 91 FE 6C 6B AD 37 25 48 18 E6 8C 45 A0
45 A8 DA 4E FD 40 7D 9D E5 08 53 B4 9A 06 29 43
</pre>
</pre>


* credits to gleba, math, Proxima and xyz for the help finding this one
== Perconsole Keyslot 0x607 (Test Subject 7) ==
 
== Static Keyslot 0x209 (Type 3) ==


<pre>
<pre>
35 AA 63 F3 A6 36 90 CA 10 6A 57 67 37 B3 C7 FB
6E 1E 68 77 A7 1D 05 8B 97 55 F6 9D 2E 2A 24 1C 
7D C9 A1 29 A3 29 60 B6 4B 4E B1 29 9E 55 68 FD
4A 3D B7 E4 3B E8 F0 65 FA A0 8C 20 58 89 3F F2
</pre>
</pre>


== Static Keyslot 0x20A (Type 3)  ==
= Keys =


<pre>
== Bootrom ==
A1 26 81 75 F4 23 9F 20 08 8C 99 67 96 2A 9C 6B
42 2B 64 48 FA 52 B9 13 E7 24 F5 8B 8B 76 22 00
</pre>


== Static Keyslot 0x20B (Type 3) ==
=== Personalization removal Key for SLSK (Proto) (Perconsole) (Slot 8) (Test Subject 0) ===


<pre>
<pre>
31 6A 59 86 45 6F 32 24 50 86 E0 1B 5C 3E D0 C6
85C688C1B3BACB16EB57B4CC35B7D590
94 3F F9 D4 4F 95 6E 3B A0 EE A4 0E 2D 3B 77 D3
</pre>
</pre>


== Static Keyslot 0x20C (Type 3) ==  
* decrypts the .enp (not ._enp!) perconsole layer of an enp file, turning it into an enc file
* algo is aes-128-cbc
 
=== Personalization removal Key for SLSK (Proto) (Perconsole) (Slot 8) (Test Subject 1) ===


<pre>
<pre>
69 6D EC 63 EC FE 80 75 FF 68 17 E3 92 BA FC 59
8B5415DC7EB5986472BF6B30D8E3E812
D0 93 42 32 A0 62 C6 33 45 77 CD E0 7E 1E B6 C7
</pre>
</pre>


== Static Keyslot 0x20D (Type 3) ==
=== Personalization removal Key for SLSK (Proto) (Perconsole) (Slot 8) (Test Subject 2) ===


<pre>
<pre>
75 F3 E4 4B BC 4E 4B EB 65 35 07 E6 91 EF 1E 64
95B7B3EDB2EF277FB0F78FA3970EE0D0
4B 3F 5F D2 9D 56 8F 4D E4 B4 62 49 6A BA 60 18
</pre>
</pre>


== Perconsole Keyslot 0x210 (Test Subject 5?) ==
=== Personalization removal Key for SLSK (Proto) (Perconsole) (Slot 8) (Test Subject 3) ===


<pre>
<pre>
4E A2 CD 6F C6 4A ED 5C 41 B3 49 9F 01 61 1C 53
CB0B65F7897F30310471F7CDA2CFD804
04 91 00 3B 2E ED DE BC F1 AE F8 EC 0C DB AB 3D
</pre>
</pre>


== Perconsole Keyslot 0x211 (Test Subject 5?) ==
=== Personalization removal Key for SLSK (Proto) (Perconsole) (Slot 8) (Test Subject 4) ===


<pre>
<pre>
13 F8 D3 36 8F F2 AF 34 A5 46 60 79 7A 08 98 14
F3E408E1EDC3B513277DB99E58A15BE3
25 DC B1 DA 6C C2 39 08 33 A4 C1 71 A6 7E C5 3D
</pre>
</pre>


== Perconsole Keyslot 0x212 (Test Subject 5?) ==
=== Personalization removal IV for SLSK (Proto) (Perconsole) (Slot 8) ===


<pre>
<pre>
D8 E1 58 85 03 D0 55 71 B0 9D CC B3 8E 95 5B 6C
FD4FA8FA4FE79430A0CA305C88E524DD
C6 10 E8 C7 CB EC 75 49 2D F0 D5 AD 1C E2 DA 08
</pre>
</pre>


== Perconsole Keyslot 0x213 (Test Subject 5?) ==
=== Personalization removal KEY for SLSK (Proto) (Perconsole) (Slot 9) (JigKick) (Test Subject 0) ===
 
<pre>
<pre>
F8 4C 66 6B B8 88 6F 49 BF 60 3A 79 74 BB 8A 0C
9E0A8285C3BE83951C78480A7AEC80FD
DF 37 25 EF 4A A1 EC 0A 59 9C F6 01 4E 13 3F A7
</pre>
</pre>


== Perconsole Keyslot 0x214 (Test Subject 5?) ==
=== Personalization removal KEY for SLSK (Proto) (Perconsole) (Slot 9) (JigKick) (Test Subject 1) ===
 
<pre>
<pre>
94 7E 3B F8 50 67 03 E5 4D 3E 49 73 83 A1 15 31
686268A876650A6A6DC353F69EB82F19
84 65 BD E2 4D CF 71 3E 3F F7 55 13 36 1D 75 13
</pre>
</pre>


== Perconsole Keyslot 0x215 (Test Subject 5?) ==
=== Personalization removal KEY for SLSK (Proto) (Perconsole) (Slot 9) (JigKick) (Test Subject 2) ===
 
<pre>
<pre>
F8 CD CE F6 74 65 56 3F D9 AC 4E EA B9 48 83 C1
E7A8ADF7B7E2BC26E3445084384FBCE1
C5 25 6A 69 71 78 EB 24 2A 36 36 6F 61 EB BF 94
</pre>
</pre>


== Perconsole Keyslot 0x216 (Test Subject 5?) ==
=== Personalization removal KEY for SLSK (Proto) (Perconsole) (Slot 9) (JigKick) (Test Subject 3) ===
 
<pre>
<pre>
6B EF 5C 91 0F 04 3E BE CA 2A 85 1F 29 44 1C A2
736F7501E9A15AB29800113686C946BA
CA 43 11 F8 D1 23 F3 DF 6D B8 46 9D 37 EB E6 4A
</pre>
</pre>


== Perconsole Keyslot 0x217 (Test Subject 5?) ==


=== Personalization removal KEY for SLSK (Proto) (Perconsole) (Slot 9) (JigKick) (Test Subject 4)  ===
<pre>
<pre>
A6 F9 47 7E 62 46 3E 15 5D 9E FE F3 53 62 38 A3
BEA39D6443FBACAB05DA62BB95470D57
80 60 78 50 D6 01 DF 47 CE 91 74 C4 3E E7 B2 09
</pre>
</pre>


== Static Keyslots 0x3XX (ROM) ==
=== Personalization removal IV for SLSK (Proto) (Perconsole) (Slot 9) (JigKick) ===


<pre>
<pre>
73 90 A5 77 F4 90 AD 3C D5 61 D6 CE D5 7A 33 C1 <- 0x300
986D5EE1E7759F4F52DB43F33FA5960A
BD 4F 51 1D 85 09 33 13 AC CB 7B 9F 99 91 EC 0F <- 0x300
CA 21 C9 BB 4D B3 F8 7E D4 D1 DD 56 30 D5 22 F5
0B A3 DD 72 EA 15 7B A6 D7 44 98 34 9E BF 5A 22
62 AE C2 42 E4 03 4F E7 80 41 EF 0F 67 A4 C1 4A
61 B0 1E D8 31 99 A5 68 1D 6B E9 2A 01 D4 B0 8F
15 28 8E 4E FE 67 E5 AB 94 2D 9C D9 A0 9D B9 DA
9F DC 28 F1 98 0E F7 A1 76 67 BF 9F 79 1B 33 C1
05 39 41 F5 95 D0 0F A9 78 2B 8B 39 24 90 A7 71
83 D0 C7 1E 7E 7D F3 9F FA 46 CB 71 A9 84 0A 1E
81 B5 CC 1F A4 4F 81 0C CB FB 01 63 3F 5C A3 D1
ED 4C 76 57 6B D2 43 2F 30 B1 00 F5 96 25 23 85
CA 26 B8 6F 96 06 E6 14 70 35 AC D3 29 49 7A 3C
A9 E6 C3 60 F1 AC 4D EC 51 B2 5D FD 80 E8 CD E4
55 79 67 44 20 82 76 FC E6 4A 0A 03 43 29 6E B0
61 9C CA E0 72 BD 83 D2 87 20 50 F5 FD 66 EE 2B
84 8E F3 F5 2D 2A 5E A7 9F 2D 88 90 E3 66 65 51
7A 96 1F 6E 48 05 AD BC 6A 28 F5 9F 76 FB 77 A1
D9 A6 73 CA B8 A8 1C D7 47 D6 79 8F 36 CD A7 24
79 64 C4 43 63 6C 01 C2 76 36 1C E3 22 AF D3 A6
7E C9 72 F1 76 D5 32 17 81 FE 33 53 83 A0 14 22
4B B8 71 EE E5 28 A2 96 5A 70 32 D1 52 90 3E 66
71 F2 1D F4 DF CC C0 C9 17 2D 8F 27 79 A1 84 DA
44 1D 45 E0 71 E7 EB BF BC AF 1A 8C F9 3E C9 FC
B9 64 4A E3 02 85 63 17 2E B3 76 9B BE 62 95 8F
A2 EB C5 9C 21 66 64 8B 4A B7 FF D4 84 F9 CE 67
2F 86 AE FF F6 40 58 7E CB 2C E1 6A 09 FE 6C C8
BA EB 0E 88 31 F6 78 E9 11 16 45 C1 A7 FD 02 EB
B3 7D 32 17 03 C2 86 6F 8A 02 EE 2D 50 B6 86 09
13 7D 34 7C F2 41 AC F3 E9 0D 14 87 81 9A 93 DC
F9 42 04 88 CE A2 F5 15 D2 A7 3D CF C7 1C CF 46
80 2D FF 39 FC 40 DE 42 12 71 65 53 AC 7B 82 07
AE 71 8C 07 34 0E D0 01 52 2C F4 B3 61 05 4B 5F
1A 7C F1 D8 92 A2 B0 B8 1E 87 A4 55 AE 4E B2 01
6F 02 EB 38 83 52 B4 D4 18 E8 08 C2 57 F2 8B 9E
87 06 40 0B 92 4A 13 F8 C3 18 15 35 FD ED A2 E3
6F A1 7F 61 C7 9D 39 B6 82 4E 96 DC 51 82 2B 63
29 58 18 FD 48 16 99 5D 62 68 B7 DE 27 FC 0A 45
CC C3 8C 34 CD 9B A4 91 2D 9A 5E 7E 29 85 56 59
B4 27 FF 97 02 B2 16 FC CF 91 74 4C F9 56 E1 C3
77 45 B3 C2 94 45 F9 FA 4D 41 D7 E7 51 BF 71 1E
09 E1 67 96 3D A9 06 CD 76 8C DA 86 BF DA E4 C9
B5 20 45 AB C5 97 CF 46 76 55 27 77 69 32 D6 98
1A 87 50 64 9B C8 5F C3 BE F7 33 60 03 C8 85 AA
00 57 36 FF E1 2E E0 40 A4 E5 3A 8D 5E BB 73 76
9B 3C F3 8F 4B 10 D9 90 4D DF 86 26 FE 35 EE 37
86 7B 02 B9 AD C0 E3 5F EE 0E AF 9B 05 75 DC 20
65 B4 55 8D EE D4 72 66 66 2E 12 FD DC 0F DD 97
06 E1 44 36 EB F4 A3 57 AB A2 D4 31 1A 51 5A F3
76 C6 02 CE 65 56 88 60 DD 4B 33 60 AA 34 80 A5
42 F6 DB 9F 55 A6 E8 3A 9A 43 F8 8A A6 CC C0 7A
AF 14 8C F7 82 88 6C 83 26 DD C0 B2 34 D7 CE ED
36 8E 8D 0B 75 AF CF 26 42 6F 10 B2 B9 80 3A 14
C0 0C 85 C2 60 41 DF 22 CF CB 22 98 4F 78 4F AB
02 64 1F 8D C0 B6 16 B8 89 59 F1 4B C1 C0 25 82
3D 0E A9 A7 1B 00 C0 57 83 0D B4 30 E8 6C 02 62
A7 F7 96 EB 80 62 02 76 3D B4 1C 35 F7 81 4B 27
91 49 BE 42 49 E8 BA A6 B5 43 11 3B 5F DC 90 FD
09 0D C6 40 E6 20 D1 3E 8C D6 AC 48 D7 DF B7 9B
89 C8 6F 1A 5B 7D F9 EB B9 F6 5B 09 67 E8 6C CC
FE 33 23 8F 60 9B D6 E7 E6 8F 39 BE EC ED BA DC
3F 1F 52 24 E0 DD C9 6E 4F 01 E5 94 81 BC 6F FE
2D EC 49 8E C7 CE 45 FD 4D F1 66 FC DD 51 13 89
3C F7 BA 03 F4 B9 4F DB A3 D4 1E 3D 8A 46 44 72
EF 89 6B D4 C9 31 E0 01 53 21 AD EE 5D DE 65 D2
5A 77 5A 75 FF C4 A0 08 33 7F EB 2D 8E 1D 14 2B
CE 29 EC EB A2 55 60 28 A1 03 BC 46 15 00 66 7D
78 54 25 AB BE 85 7E CB C7 F7 2C 14 EB 09 61 48
B1 11 98 6F F1 4C F8 5F 3C D5 50 3C DD F5 B1 1E
CA 42 0E E3 8F 60 6A 44 16 B2 5A 6F 72 A6 E5 9C
B7 E3 A5 80 56 DE B4 32 E4 66 BC 6B 39 0F 88 98
C3 9E 97 5E 85 37 8F 62 CD 87 58 24 8A 1A C5 88
AD 86 CB E0 CD FA AE 23 C7 D2 3A 03 93 39 47 0E
DF 41 F2 49 CE 03 E9 7D BA 7A 6C B7 64 9F C2 32
B9 13 53 DF 57 FB A6 EA 5D E2 22 86 C4 49 73 2A
7A AA 50 0D C5 B8 BE 66 26 7C 0D F7 8C 45 83 D5
06 D5 8F C5 0E 45 58 0E 4B BE 8C D6 7D F5 E0 BB
66 E9 89 B9 EC 73 C9 59 66 49 74 2A 93 20 A6 37
8E 4F D4 93 DC 97 58 32 59 5C 60 A5 E4 2F DE 02
64 80 75 10 A1 78 AF B8 C0 08 2F 7D 92 12 EE EF
01 E3 76 72 A5 9C 19 4B E6 1D D2 E8 73 B0 87 ED
55 CC F3 4A 44 60 7C 4C 2F 5E 15 7F 3F C4 9E 4E
76 83 76 5F 55 38 FC A1 BC 48 57 A7 CF 05 29 84
AF 13 22 B5 96 9C D8 E2 4B B3 1C 4D F0 05 35 32
3A DF 17 4C 7E B5 9B B1 15 B1 5D 90 63 37 C8 CC
BC 15 2E 2C D6 94 BD 8F 3A 84 B7 DC C3 3F D5 1F
EC 6D 01 55 56 48 46 43 F3 78 E0 1A A6 0F 84 1E
CA FA C9 A0 FC A2 E2 FB 3E 6B 7E E5 29 F7 4D 63
44 11 AA E1 1E 5D 80 44 9C 62 31 01 45 7C 7B 2A
74 52 70 2A 4A B7 AF 68 0B 2B 21 1D CD 7E 11 73
5E 53 06 1D F7 6E A6 37 E7 AA 2C 4C D8 AB 00 04
AE 28 41 BA 3E C6 A2 F6 6E 3E C4 14 C7 18 5C C4
CA 3A F2 62 20 17 27 C7 8A 53 03 8B 67 F7 33 ED
22 2C 9E 5B D5 0B 9D AF 1F 4F 08 A3 F9 8B 5F 5D
20 E5 4A 4A C8 46 75 8F 7E 9E D5 2B A4 8A D8 1C
15 AB 5F CB 4F 04 60 7D C4 B9 81 C8 E6 ED 6C 72
C1 EB 5D CD 21 E6 8E D6 C0 14 39 BB A8 6D CE F4
06 A6 46 0B 05 3A 18 13 43 91 4A 57 08 AC 68 28
BD 17 53 B4 7E F3 A4 19 58 64 D5 A8 70 C3 43 81
62 0A 0E 69 4B 7C 26 E9 94 4E FA B1 26 75 62 7F
6B 32 53 E2 48 39 98 CD CA 79 52 3D 08 92 63 AE
4B EB 89 33 23 32 21 BD 52 BE C8 5D 91 EA DA FE
77 7E C8 4F 42 63 4F 34 D5 20 71 60 D6 95 CE 72
19 40 BB 74 B8 DD 70 7A 70 4E AE 82 94 52 D2 6D
A5 AD 1B D3 A7 93 28 1F 13 7A 49 C4 BA D7 85 4A
B3 8B 2F F4 59 1C F0 18 DC 8B FE 85 2C 4B 24 27
DC E7 7B 51 65 1D 5C 25 67 FD E7 D3 46 2F 7C 36
95 24 31 96 21 A9 5B 85 40 05 8B C4 A3 8E 20 B3
2E 6E 6A F2 12 86 AF 04 8E 10 9C E4 C8 4C 54 C0
4B FE CD 12 36 82 FB AD 3E 18 8C E5 7F 16 08 06
A9 47 07 25 E4 3D AA C1 04 A5 3E CC 42 41 79 B5
BD 80 89 27 CD AE 87 74 44 9C 50 DC 31 3E 12 1A
2D DA D1 B8 55 91 0B 50 57 4A 21 D4 AB E3 B3 FC
33 AE 75 8F F9 5E AB C0 CF 27 4E 5C 29 0A F2 48
60 54 85 8A F7 50 08 A6 E3 A1 03 F2 FD 88 2F 37
B1 1A EE BE 39 A8 98 8D 41 CE C0 29 96 DB 6E 3C
95 02 9E 20 2F C4 91 3E E1 94 6C 3A 3E 73 FB 7F
16 81 B4 24 FC 8C 69 BF 1D 1A C6 2B 5F 32 12 1D
52 8C F2 A3 C7 96 43 B4 C0 E8 4A F7 8D BB 6C 49
65 92 3F 9B E5 AA A6 1D 61 A8 1D 3F 74 C4 E7 0D
A1 00 DB 74 4E 36 88 89 1B F1 16 D5 A7 2E F5 10
1D 4D 1E F1 4E 98 6C CC 91 C9 F3 72 DA C7 1F 65
BC 2B 19 88 4A 2E 65 DE 32 2D CB AE 95 4C 8C 7F
2B D7 E7 B6 72 66 DD 83 54 76 BB CD 4B 87 42 CC
9B 20 66 7A 52 D6 89 A2 87 27 88 F9 9D DF D4 05
96 3E E2 6F A0 22 50 32 AC C9 D7 AA 90 22 1C 99
5D 5C F1 38 1E 90 D2 1C C6 C4 4B 71 79 F9 F6 62
4B 62 F3 CD 0F 64 A5 3F 61 F7 40 9C BE 3C DE 5A
24 F0 EA 9E 46 03 63 B6 BF E5 A2 4D 27 82 C2 59 <- KeySlot 0x340 GCAUTHMGR KIRK 4/7
A3 81 D9 73 79 86 DD ED 5B 36 FD 2B F0 50 50 BA <- KeySlot 0x340 GCAUTHMGR KIRK 4/7
11 96 5B 38 FD 66 D3 0E 4D 8E 6F 4E 32 58 F7 33
49 32 D5 CC D1 5D DE F0 4B ED 2A 5E 22 E0 6C F0
9B EE 8E C4 16 B1 48 B3 28 A4 AF 7E E9 D6 96 FC
5D 28 F9 2D 26 29 FB D8 08 2D B8 4B D7 08 CD A5
45 DB A1 04 23 15 E6 69 CF 32 1D 1D 98 EB 7A 04
BB 35 C6 08 55 10 13 F1 C2 8F 3B A3 DC 8C 7A F7
95 F8 05 47 30 F7 80 A9 4D 5F 69 8D DA 75 CC E5 <- KeySlot 0x344 BOOTROM SLSK HMAC256
1C 23 16 A5 D0 A7 0E A6 9C DB 41 5C 64 3A 5A C1 <- KeySlot 0x344 BOOTROM SLSK HMAC256
74 C3 9C A4 EF 4F 12 29 15 C7 1E DA 46 C8 8B 55 <- KeySlot 0x345 GCAUTHMGR KIRK 4/7
BB AD 1F 40 33 D7 55 CE A0 56 3C C3 41 F9 2E 66 <- KeySlot 0x345 GCAUTHMGR KIRK 4/7
74 11 8C 2D 8F 64 79 D9 35 84 7C 69 BA 3E 4A BF
FB 2C 97 70 FE A2 69 00 FC 20 1C 96 E3 DF C5 35
1D BB 5F C4 27 44 DE 75 A3 6D 33 20 11 69 D9 28
BE 29 BC 45 DD FF 18 98 1F 64 AA 77 18 01 F1 A2
C0 26 28 14 13 FA 46 2C CD EE D4 BD 6D 08 C3 7C
A6 C9 32 2A BD 4C 40 AD E7 2A 0F 54 4F 40 13 AD
64 D2 66 BD 35 7B C8 8E EB B3 27 CA 85 61 5D 20
73 CC DB 61 DE 38 2A D3 58 31 FD E0 D0 8A 0D F6
E8 38 F0 CD 85 B8 FC 07 C2 EF AA C9 C4 A6 55 4A
91 2C 07 87 5D 4C 6C EF DB 80 37 35 CE 76 3D 6F
52 A4 66 26 20 70 6E 26 96 15 52 69 2C EE CD BD
B9 34 7F 53 6C CF C4 9D AF 87 1F 76 08 F4 5D 41
74 0F 65 E1 CF 4E 44 C4 25 06 0E B4 A8 1E 21 EA
F7 60 65 11 1C 6B 4A A8 77 DE 5F 0E AF 79 A7 E1
D1 AA 64 69 D0 28 33 72 48 EA 25 E5 FC AD 3D 7C
F0 7F ED 64 C3 AB B9 FD 80 4C E9 C2 9D 09 13 01
F6 E8 B1 8A EE 53 3C F9 20 D2 60 5C 07 5B 44 7F
AA F8 7F 3C C2 94 E5 B6 A3 65 50 08 8C 4E 70 E9
7D E9 77 04 80 61 51 7C 93 DD 92 74 1D 09 C4 0A
9C B0 48 F0 CB 8C 86 51 66 B7 6C BA E9 B8 B4 18
80 C3 4C 4A 4B 32 7A 9F C9 AA B8 83 24 8A 3F B4
F3 F8 96 0A 9A 45 4A 50 3A 25 CB 23 41 9A 39 35
B6 3C FE A6 C2 58 7C A6 FF C8 AF 78 CD 90 C7 B8
D8 1C 63 27 A6 15 D8 42 64 72 D3 1F 4E 5F 2E E1
69 4A ED 98 15 CC DE 44 48 99 2C A1 84 48 E4 3D
75 6D BC 55 EE A4 0F E4 B5 DB FD 28 BF B3 FB 81
E6 DA EE 8C B3 B7 6F 6C B5 2A 44 3B A9 AF 7A 39
CE E9 29 2E F5 D5 65 9B 43 13 11 37 90 96 51 03
12 E4 46 93 90 73 BF 13 AC 32 4F E4 8B 3D 63 A8
20 F3 53 CA 38 AC 91 B4 52 13 9E B7 88 0E 1D 11
FC E7 13 D6 CE D2 F3 91 00 28 9F E4 0D BB F1 6F
1E 5B DE 4C 47 CF 68 B7 9C B6 E4 F5 35 B1 47 59
CE BC 43 84 F3 4E 7C 96 3F 1E 85 B2 CE 2A EC 57
13 BE 29 A3 35 B3 97 8A D6 73 7A F8 EC B5 9A A3
92 3B 40 00 FC 4B 62 45 15 A7 CB A9 9F 54 AB 02
DC 59 EC AB E5 3C 66 C7 F4 A3 A1 E7 75 FD F2 5B
54 A2 49 2D F8 1A DE 24 F0 7C 67 6D B0 CB 14 00
F7 E5 63 B6 87 5B 58 B6 28 5E 70 3E 9E CF 22 4D
1E F3 92 02 8E AA 19 64 9F AF 0C A9 A7 FD E0 D1
49 3D D5 83 91 5A 89 80 C2 CD DC 1D 17 92 11 08
04 1C 98 0B 49 87 27 89 65 17 FB F6 BD 21 63 8A
DD A9 68 B6 49 88 3C 21 69 41 03 FD 50 EE 75 00
06 1A 44 2F 03 2E A9 66 25 B4 1D 3E CB 48 48 7B
12 CD 08 79 45 F6 85 2A F7 2B DD BE BD A6 17 96
71 79 D3 61 DE CA CB 27 2E C5 5A 89 68 38 A8 C5
06 E1 DB 7B F4 99 51 8E 15 5F AE F6 0D DC 4E C5
55 94 93 F9 16 37 15 16 60 06 DF ED 3A 37 63 AE
68 5D 55 A9 55 B6 76 6E 14 0B 8F 2F 6D 1F A3 B6
5C 24 B1 5A 6A 3F 86 01 B8 3C 14 F6 4B B2 1A 03
5F A2 31 3A C1 7A BC A6 1A 47 C3 22 90 C9 FE BD
AC A5 5B 1E 55 AF AB 9D 57 1E 20 9D 22 44 C3 82
8F 1A B0 0A 9D E7 BC 12 1D E7 A9 51 7B F3 8B 66
00 BB 65 28 B1 BA 62 DF B2 3B 0D 57 6C AE 67 26
4C 03 AA 88 B9 5F 4B A3 32 52 DE 35 E9 83 E5 01
A1 AF 40 B0 55 29 15 1E 1C 5B 43 50 F9 A4 80 92
30 DE F4 3E 3C 4E 02 EB 47 15 19 8A 04 46 B7 57
32 2A BC 12 72 0F C6 8E 91 31 C2 93 56 4C 21 62
22 F0 8C 2A F3 32 79 54 7E 48 80 57 8A E5 CB E9
BD DC 72 75 73 82 BE B9 DF F5 EE 37 45 C7 7D 50
13 D5 AE 72 F5 23 09 1B 25 B7 41 00 92 34 FB BC
3B E4 C3 BB 61 96 9A D2 6F 15 77 0F 8B 69 17 23
E8 C8 23 55 15 09 F8 21 BF 3D 87 B0 F3 83 E2 73
52 7B 5E 91 22 74 97 44 23 FD 48 8E 42 04 D4 56
C0 7A 29 A2 36 A8 A4 74 B3 EC F8 D6 B1 33 AC AB
5D CD 81 07 8F A5 F0 F0 01 4C C6 5D 4B F8 B5 11
C1 17 89 2B AC 86 5B BE 0F AF 41 92 93 01 6A AB
3C EC FE 41 6D 31 23 C2 13 1D 80 3D ED 6F C0 14
D0 78 82 93 1F 70 A7 02 8A 0E 7F A9 E5 7A F7 AA
C9 60 5D 32 96 A6 9A F2 82 6E 15 F5 F6 8E 0E 53
93 A3 83 85 AD AC 6D 77 3E 8C 4E D3 CD 13 43 BC
02 CD 77 1F A5 00 4F C9 98 3F 02 89 E0 FD 97 57
74 42 5C 9A 0B FC CE 7D A0 75 AA 74 0D C1 18 1F
CB 9C A9 C1 46 2F F5 74 B3 5F D3 46 D5 4C 82 B2
16 49 C9 91 6D C2 10 51 6B 38 36 33 D0 E4 55 0B
00 C2 D2 76 8D 22 E0 82 1F 50 64 4D 4C B5 E6 6C
2F 54 64 D4 DF 35 71 F5 7A 8A BB 3E 27 64 0D 6F
E2 89 34 29 DF 66 D9 2D 5E 7E DC D2 0C F8 2D 22
BC AA 1D 12 10 F2 D3 69 1D EB 12 48 09 3C FC 0A
F7 1D D6 D3 31 18 F4 8A 20 BB CB 72 E4 7C 81 48
A9 0D 04 B9 AC E7 DF E3 B7 AD 65 AD 02 EA 4B 46
6F C0 6D 70 87 2A C1 C2 C1 9B 94 DF BC BB 5A 7B
B4 2F 1D 13 2B 05 E4 84 B9 CE C7 0A B9 CC A4 09
B9 96 3D 4B AC 06 83 25 F4 B3 BD BC 15 39 3C 40
51 85 DD F2 74 F8 87 D2 E4 90 69 15 FF 57 6F 4C
22 61 AD 36 90 BD E8 92 1A 35 14 D9 B4 DF A9 F2
85 B1 EB 31 7F 82 0B DD 4B 76 D3 A4 8F 8D E4 57
3B D1 93 EB 13 18 EB F9 00 68 61 59 04 04 96 4E
0B A6 00 66 7A 43 78 FA DA 3D F7 37 A2 C1 27 3F
2B 6C E0 A3 A4 99 24 2E C0 51 6D 20 6A 3C 70 71
EB 42 19 58 0B 1F C2 61 0A 63 9A CA EE 98 96 1C
E2 4F 5C 9D 57 84 95 9D 41 C9 7A 9D DC FE 66 2C
AE 4D C5 E0 8F 06 BE 05 CB 66 17 B7 88 30 84 23
B0 D6 BB 00 6E 82 BE 9C 6C AF 58 7C 53 3D 25 57
46 93 41 50 8B 39 DC 48 CA 82 06 79 F2 CF 3B D2
7A 03 C7 ED E0 3A 36 E4 10 5E 89 C1 9B 68 7D EC
2B 75 8D FA 01 06 F5 53 A2 30 9B C9 08 7F 8E EC
DF 38 1E 17 FD A6 F3 76 E0 6D 37 95 25 B7 21 EA
15 37 F8 40 AF 43 C7 72 F4 A4 0B 81 BE 15 81 91
FA 1C E8 BA C3 33 BC 76 47 82 DC 85 22 A4 F6 31
72 A6 A1 65 F6 1D 18 44 F7 B5 1A C3 5D FF 6F F0
4D 1D 59 B9 7D 0F 25 A5 A6 E2 2E 4F A4 74 D2 FE
AB 61 AC 0F 12 A9 DB 2D 05 C4 ED CF 36 DE D3 24
06 02 EF 76 A8 3B F2 89 72 0C C6 FD A3 38 18 F7
13 D1 0D A3 9C 4F 4A 35 BF 1E F9 93 CE 60 BE 18
FC 60 5A 40 E4 A8 17 C5 06 D5 06 42 C0 A1 B2 07
AC 9B 73 33 FB 74 0F 57 EC 15 EA 78 80 5C 85 24
A9 D4 4A BE 86 99 50 42 F1 3A DC 7D CE 34 B2 BE
1B 8C 7A EE 72 86 B3 F6 DE 30 B8 B6 CF EE FE D7
CE 6A 3A 66 63 C0 27 BB 7C 52 98 A5 E8 77 9F C2
FB 53 9D E5 FC BB 67 CE 0A 3F 41 4C E0 2E 84 E8
1A FD DF 79 7A A1 CB 6E 74 FA 87 9E E7 94 8B C7
E1 F3 0B 3C B9 FD BE 2E 66 CC F6 08 09 95 9F 73
3E 69 F4 1F F5 6A C5 CA 72 4F DD 45 8D 5B 9B E8
6D F4 96 CC C9 94 AB 3B AB 7E 70 E9 44 CA FA 94
21 B3 03 D5 6B DF 1D 8C B4 FC B4 8B 79 E0 06 6D
49 EC A0 D0 34 99 F9 A6 C5 33 38 31 02 03 00 E7
7D C6 D1 03 69 D2 DD 59 22 EE 30 C4 3D AC 93 4B
1E D8 88 02 4C 67 69 86 DA FC C9 1C 1B 74 3C D9
59 C2 BC 34 05 3D C0 62 D4 6D 8D DB B4 56 34 14
17 57 1C 2F D9 26 BF 54 A5 F0 DE 56 A8 CF BC C8
45 69 A2 BC 3A E9 36 24 79 68 BB B3 37 E1 F0 C0
84 27 BF 81 1A AB 03 F5 F9 F0 78 45 E1 21 BB 69
60 8B C8 FE 22 07 16 EE 55 CE 9F 73 2D 21 1C ED
02 BB D4 D0 87 54 32 8E 41 41 A2 96 F6 EE 55 39
FB 06 B3 6E 52 29 B7 64 6A 19 54 DA 56 AA FA 4A
4D 47 AF 05 CE 35 0A F2 F2 6C F5 08 0B AB BC F6
1D 94 9A 9B 60 05 9D AC BC 9F 98 FA 5F 91 4E 2D
B3 48 ED 31 51 E5 A8 AD 64 FC F9 E3 21 06 46 1E
39 2A AE 73 5D E3 60 C4 6C 77 87 A5 35 75 E2 4A
18 AF FD 30 8B 7A 27 1D C9 57 35 5C 28 D4 B3 01
4D FD CD D1 88 CE 90 3A FA EB 9A 3C 09 73 86 AA
DA BA C0 E4 07 72 13 6A 56 45 AA 50 E5 6F 36 2C
EC BE A6 2A AC 54 AD D6 15 21 9A 20 36 0B A0 D5
4C 1C D3 C9 E6 83 BD 93 2E 41 56 1E D9 67 6A E0
4B 99 9F EC 34 FA 47 CB 49 1B 5C 46 00 51 17 FD
86 BD B8 64 C5 0F 35 01 48 41 A3 11 8D C2 09 99
2B E9 50 69 FE B1 7F 65 99 A2 ED FE 22 CE C9 58
32 D4 ED 24 5C EC CA 0B 08 AB AF 3B 36 9D FF 75
85 FB C3 41 99 B8 76 E1 66 AD B4 D0 91 79 D9 BD
FB 82 FF 6C B7 50 85 74 CC A5 C2 76 33 C6 BF DC
24 20 F3 23 C5 B4 76 5E 56 8D 85 E6 69 C2 C9 33
4C 6F 61 C1 B1 70 32 30 CA F7 B0 F9 11 94 41 85
E3 C7 A8 1D 37 A0 CE E4 E8 3A 74 45 E5 42 19 08
B1 3A D3 E2 B8 9E 09 D1 87 2D 07 60 AC F4 5E B2
7F 5C 88 61 1B B2 44 92 68 1A 41 8A 24 0D 49 C5
15 2B 38 1A DC 87 CA 89 65 25 19 BF 97 BC 52 65
56 FC 76 45 8F ED 18 D0 39 99 2F 8A E4 DB BF 0F
86 E2 F8 4C BE AF D9 24 3A 24 C0 EC 16 8C 93 05
DE 87 D3 7D F9 29 3F FF D3 62 B1 D4 7F B4 40 22
57 6B C3 19 18 31 FD ED D2 B9 17 52 15 36 56 B3
8A 44 03 FC 31 5A 07 87 B5 46 BD 4A 2D 36 BF 83
A7 8E F0 18 3F 95 7D 8B C6 2C 12 30 BB 13 9A 77
2B B0 83 6B B0 81 FA 77 24 0C 13 35 11 26 BC D1
60 AA 59 B6 02 4F C9 19 E2 5F 14 66 13 F3 3A 2A
D6 7B 6D 92 2B 8D DA 98 05 C7 2D DE E0 E7 7B 1B
00 87 F4 4B F4 06 D6 15 77 7B C8 D0 EB A4 03 17
51 83 58 5B 46 1B 25 D5 6D 59 DB D8 91 26 10 19
CB AF B5 61 FF 2A 6F B5 06 9F D0 3C 60 DA DB AD
AF 73 D9 B0 9F 4A D2 46 A3 F9 12 BC 9E F1 44 27
14 5C 7F EF 9A D9 F5 AD 60 4F 42 B2 D4 C6 DC ED
C0 75 B4 0B 3F 4C A3 65 F5 F8 A6 7F 57 4C C5 18
00 82 DF 79 77 8F B5 C7 09 3D FD 1D 7B 69 36 06
36 7F 6C 6B 32 DC 96 60 86 81 20 85 9C 4D CB 0A
92 84 3C 9A B9 2C BB D5 5D D0 92 69 86 CF 10 AD
F9 4A 33 21 07 FE 42 83 CB F7 33 96 96 E0 AB 60
E6 90 56 A0 E5 45 EC CF 6E 8F AE 49 75 CC 7C 53
21 A0 44 09 94 46 9A A6 F9 53 B5 4D 29 C9 FB F6
62 F7 32 D1 62 EF 89 AB 44 32 5D BD 6B 45 88 41
58 9B DD 77 02 27 D4 FF 53 CF D2 93 58 77 52 BB
CC 59 4C 5A 3F 28 E8 9B 9D 82 57 F7 3F E1 1D 55
01 F0 87 87 EC B7 7B 1C A2 C8 45 CD 69 A9 1A E6
0A 8C 8D 24 B0 08 34 2D E9 62 F2 3F 80 70 80 AD
FD ED 60 10 8C 81 7B 6C C7 5B 08 00 4B 3C 3F 22
DD 5E BB 49 26 B0 A4 10 5E 8C 98 8C 03 2F F0 ED
23 D6 B5 D5 7D CB C3 7F 58 DE 2F B1 A7 82 37 ED
D1 D4 32 11 5A 71 B7 54 86 17 1F 43 F1 91 14 63
D4 96 8D 96 A6 D7 59 E0 B1 A2 E6 BA D4 E6 69 35
69 D1 F7 8D F1 3E E7 6A 3A 94 FC F1 47 94 8E E0
EF EA 7F 31 87 30 B6 F7 62 62 47 FF 81 E8 E9 C3
48 D9 6C 56 49 7E D6 8C 52 0E FA 2E D7 71 8C 85
B5 D9 CA 9E D1 41 46 02 DD BC B2 1A B3 5E 12 09
EE 99 06 4B 1F 01 F6 46 FC 2D 82 8E F1 55 17 02
F0 58 72 F0 9C 87 DB 61 7E 6A 0E 88 39 41 C1 E8
83 15 30 70 B5 53 B6 10 23 35 53 8C 72 48 0E D6
70 D7 EC DA 7E 2F 1F F1 EF A0 13 BA AA 95 85 6F
B2 8C 80 E0 CF 0B 62 55 86 53 BE 2F 77 A4 35 7F
5A C4 BE F3 AB 9F 16 69 D0 15 33 7B 76 1E 0E 6D
D9 18 23 B6 F1 F1 7F 7C E6 80 EA 66 08 12 8D D4
08 D0 05 86 8A B4 89 62 F8 66 2E 91 B6 08 F1 8E
DB C2 24 D1 67 72 78 2E FB 8E 5B CA EB 4D 35 D4
D4 7E 4D 25 B8 FD 15 9A 93 46 E9 44 D5 AA 38 AE
86 E4 BA F1 6C AC 77 6E E4 38 15 61 20 9A D1 03
9F 65 12 6B 5E 55 37 58 73 E6 61 2B 2A B7 E0 B9
73 1E 0A 9F 53 69 70 2F 22 19 55 5E 26 5C D5 25
14 7D AB 1A 3A B4 5B C4 0A B8 85 67 41 E7 C1 51
CA E2 96 35 A1 DB 7B 1B 34 42 EB 31 67 35 FA 6B
48 D0 CA ED E2 BE E6 28 05 35 30 E7 07 A5 33 78
C8 5B DC DB F7 FE 1F 5E 32 E3 F7 A6 A4 8E 31 2A
FF 50 AD E8 0F 0B 02 B2 60 06 DC CE 4C 73 A8 0C
C9 DA 6C 65 55 5E BF 95 F6 31 89 49 BF C0 51 52
A0 BD 9A FE 59 14 33 01 EF 45 F5 81 70 FB 5F D5
4A 0A 4F 8B E8 56 2F B2 A8 99 6B 30 46 F0 05 0C
F5 AC FF D9 1F 56 A4 87 AA 21 CF 80 35 42 0D 65
B5 53 A2 51 D8 90 30 7B BB 49 16 47 FE F8 60 58
3A C5 4B 6B E1 B1 3D AB 01 58 26 D8 7D DA CA 4E
3B C4 20 F6 AD 23 4A AA 62 B0 97 57 16 31 6D 3D
DC 64 4F 01 84 02 9B C5 18 37 37 87 4F B6 00 DB
CF 25 FA E3 6C 50 2A 62 B1 C2 AD AE 1D 02 16 74
95 01 BF E4 92 B8 78 C7 C8 F8 E8 49 E2 42 0F 62
F2 9C A6 3D 97 82 70 65 5B F0 F9 6E 5D 3A E4 48
61 BA EA 53 7C 7D 03 B6 4B 1E 4A 3F 09 6B EC EE
CA 3F 69 04 F0 D1 AE B0 99 F1 75 27 DB F2 60 97
1F B4 1E 22 60 6F 11 71 89 4A E1 A0 B8 E0 92 08
B9 94 59 76 C6 1F FA 79 7C 3B FE A2 BD 99 AB 02
E9 3C 03 75 E2 24 04 6E A7 4D BC 41 53 EE 1D A9
BA 97 64 12 82 9D 7E 7B 4E A2 9C 28 7E 03 3E BC
A3 BE 07 D6 7B 60 EE 17 46 4B E4 A8 A9 21 2C 53
6B 3D 70 B2 8F 46 6B DB C7 62 94 9F 66 74 7E AE
1D 26 87 AB DE B8 27 7E EC 40 76 26 E0 C2 64 D7
06 F6 3C C5 17 08 30 61 AA EC 78 3D EC 03 E0 79
44 DA 48 5F 71 DF CA 18 C4 5B CD D7 8D 50 44 44
2C 31 94 3A DD AB AE 59 FE DA E6 16 9E 82 7B 14
47 EE 29 E5 1A 13 00 AF 5B D6 9D AF 67 87 78 73
73 9A 5D E4 09 B5 79 B4 A2 82 8D 78 6D DF E7 53
AB 5A AA 22 1B 0B 64 CA 49 E1 1E 3C 09 A6 27 53
0A EC 24 88 B1 D3 C3 89 6C 23 5A 7F C0 30 23 E6
10 0B 32 20 BE 0C EF 71 E5 02 8F BF 76 90 09 59
15 21 3B 2C 69 43 8F 7E 18 7A 3B 58 7C CD E9 2E
ED 8F FA 2F 29 0D 4B FA EA 50 0B FD DB DC 26 9F
EE FC 8A 97 43 09 BB AA B2 D9 48 E8 AA 54 F5 B6
F1 CE 86 CF 4E 7B 3D 67 0A 3A 4E 2F 29 69 33 58
75 0F 2A 77 7B 4B 81 1C D0 94 EC 76 51 AA 9A 7B
7B F4 7D 6B FE CB 8B 5E C7 02 E0 FA 7F 13 D9 27
E3 5F 6A 75 F4 2C 2D D4 61 97 43 EB 42 71 33 9A
A4 FB E9 0B 40 61 04 9B 07 05 23 92 82 B9 4D 36
40 4D 2D 41 01 D1 44 19 03 74 9E A0 EC E2 10 E3
24 1F 48 F5 26 EF 9A 3B 52 AE 46 A3 94 5A 91 EB
D4 8B 82 9C B7 0E 33 B1 63 42 9C 0E F3 CB 07 FD
E4 EC 99 3D E5 FD BB 11 2E 38 7E 5D 1B C5 FC 7B
FB 57 82 96 64 B8 AF 29 C9 C4 C4 04 C3 DB BF 0A
09 A0 32 FA 2A 07 BC 4E 81 43 66 1B 3A E8 3D E1
1F 40 90 B2 2C 5D DF D6 3F 72 B9 2C 1D C2 83 AD
DB 2C 91 82 79 19 82 1F EB A9 64 53 5F 0C 1D 16
AC 16 18 83 6A AB 69 6C B4 EE C5 F2 CE 62 4E DF
3C 45 EC 5F 4A 2A 9B 75 B5 E2 1C 93 1D C2 75 40
89 11 C6 41 E8 4F 16 8C EC FE 43 48 C2 6B FA 00
4F 3E 4A A1 E0 00 5F 81 F8 55 A3 F2 F6 23 69 DB
26 72 35 60 C2 9D D5 3A CA 12 64 BD 7F 58 EF C4
C8 D4 D9 28 0B B6 1B FE 36 9D D4 F6 92 71 49 C8
2D CA 11 22 D0 A4 4E 32 42 7B C5 C3 3D 6F 07 FD
AB 34 7C CC 74 B2 F4 49 51 45 15 65 7E E6 F5 D8
7B 00 07 5B 6A 7D 53 62 B4 72 AE 8E CB D6 AA 62
A0 50 85 0D E1 E6 A4 4A 44 B0 57 74 47 0F F6 42
19 64 F8 A3 FA 3F 69 80 D7 36 AC A0 47 05 7E 70
C1 BD FF 81 11 1F 66 F8 47 B0 DC 98 45 C0 FC 43
6C 64 28 6F 92 C4 4D 5B 09 7F BE 0F 48 C5 6E 02
F8 54 59 BA BC 6E E1 BB 02 6B 3E 1C 4C E2 38 28
42 22 D2 2B 01 1B D3 F3 45 AA 55 D7 0A B5 F3 BC
89 2A 60 09 FD D1 B7 E8 D5 3E 0B 13 70 C2 5E 6F
53 B2 BC E2 5F 34 88 A6 47 9E 30 C0 8D 8C DF 39
73 F2 97 58 F0 9D 2D A1 6E FF 66 DE 3C CC AD E2
94 C0 54 68 91 0E FB 9F 4A F7 CD 7E B7 D4 38 78
A3 7D 17 3A B8 88 7A F7 8E 8E B9 B3 71 39 5E 59
41 7D AF 5E 9C 60 DB 3F AB 24 4A 97 2B C0 CC 2D
F8 D8 A3 7C 1F 50 DD B5 95 95 A8 7D B2 34 9C 84
98 3C 8B 7C 3D 6E B7 72 FB 27 C6 E9 A5 40 2D 58
61 0E DF 04 28 0B 0B 40 C8 FD FF 89 33 9C 69 74
D8 2F 56 8B 42 3B FE A7 5E 40 66 99 E8 17 7C 86
06 12 14 D9 91 19 51 70 AE 54 CB 94 97 18 2F F6
9A 89 18 6C 66 C6 0E F7 CC 22 D0 0E AF F4 B4 DF
16 8D BA 19 C8 11 0E CC AC A3 F7 61 A8 43 A6 04
7C A3 B6 6B 0B 82 B5 34 EE 32 7F F0 12 D7 73 4A
F0 89 A5 18 C4 67 41 56 1A AC 2A 90 AA AD 86 C7
5A 4E 0A 8D E4 BB 3B 73 4A 48 97 2B 52 BC 83 0B
DB 1E 2C 9B 1E 89 87 A9 3D 2F A0 E3 26 81 78 D1
44 34 A8 21 E6 41 79 23 EC 09 B6 37 26 D8 BF 5D
E1 82 04 EA 55 CE 4B 3C 39 4F 20 6D F1 B0 96 7F
72 91 F6 76 17 B5 1E 49 56 EA EA 1C 6A 12 E0 62
46 F7 C0 9C 41 A1 61 2D FE 2C 8B 4E A1 20 68 4E
0D C1 44 86 8B 4F 28 98 27 AC 97 83 24 DB AC 3A
27 D5 D9 66 6B 4F CC EE 10 EF B2 C7 4B CA 51 CC
57 1D 91 38 CA 03 02 A6 C4 91 86 AE E7 AF FF 19
76 D6 8C 11 5D 54 88 A4 01 54 3E 61 53 56 FA E8
17 DA F6 FC 48 B7 12 2E E5 7F 94 52 89 A4 76 83
3C 3C E0 31 94 DF 35 CC 6F 64 95 09 FA A9 50 DD
A3 D1 63 0E 3F 89 E7 D4 54 A8 C2 D3 9D 38 F1 36
86 D3 B9 0A 0C 6C 20 E2 25 1C CD 7D D4 DB AA 1D
DF 18 47 DC A8 7C 7C 6C 0E 46 4C 3D AF 3F 59 97
74 7E A6 A7 7A E0 64 7E E7 5A 44 C8 D9 12 DD 04
B7 3D E2 86 72 5F 0C A0 AA 0C FC 84 D1 BA 52 51
74 C4 52 6C A0 57 CF 7D 26 B6 6D 45 97 92 09 8F
A0 87 29 AD D6 1A 02 03 ED 28 B1 97 CC 5B 03 71
96 7B C4 41 7C 92 3B 63 B0 74 C9 AC B2 BB E4 3F
85 01 AE 8C BC 50 19 2A 3D 3D 37 E0 E3 EC 8A E5
AD 35 E1 27 F4 CC 7A BC CE 97 07 91 08 20 78 E9
16 0C 14 B3 9A 12 A9 BC CF 6D 93 E9 0B 69 46 D5
B3 41 C7 7C 57 9A 99 7F 56 C6 30 1C BC E7 EF 00
CB 93 4A 49 55 66 F0 B9 40 A0 E0 97 42 69 89 D2
A9 8E 05 25 C1 BE 54 2E C7 65 E8 43 EC 88 31 52
8A 6F 65 B8 3F 3C E3 7B B6 1B 31 61 AB 9E 22 EC
CD 6B C3 1F 78 38 9E 57 3B 1F EB 56 CD B0 CE F4
8E C1 FD 35 4F 20 A6 20 C1 D5 CF BE 5D C3 98 90
F5 BD 21 5E 5C 0C CB 30 6B 84 30 66 9A 9C DF D3
0A 6D 4F 25 BA A2 54 04 64 DD 8A 85 F0 BB E2 00
CF B1 E2 2D 56 00 5F 7C F7 65 7B E4 B0 5E 04 3C
4D 79 F0 51 D3 98 A9 96 15 EA E4 38 DF FA EC 47
DB 9A 47 4D C8 EC E9 B0 C4 A7 DF D8 19 4A 30 58
27 72 7F C6 07 F9 DC 7A 6B B4 6C 30 42 2D F8 35
9F 2F 5D CF E6 AB 94 25 94 74 CB D3 38 6B 77 7F
11 D2 72 34 02 1B 9D F8 FE D7 FA CC C6 63 8B 6C
51 B0 4F A7 7B F2 17 9D 22 CA 16 F9 C3 8C 36 50
9E AA 2C 2F 4F 79 6E 51 44 CE 53 94 25 32 F2 2D
50 5D 2B 95 08 8B 22 BC B6 1B 10 3C 29 3E C3 67
E8 98 94 3D 90 1A 9B CC 16 99 F4 BE 09 4B D2 5F
E3 5C 3C F4 01 28 FD 1F 56 D1 AF 27 3C F7 6C 5F
2A F8 8B 3B CA 50 86 13 E1 46 87 B0 F8 2F 6E 62
FC 88 19 36 DF A4 56 9D 90 D1 41 30 B6 F0 2B 7D
8A 35 3C 3C 1D B5 BE B1 7A 29 E0 F9 7B 9E 56 2E
8C B7 51 C0 21 9B B9 2A D9 F0 BC 95 5D E2 48 2C
1F AB A6 66 45 F2 E8 14 0C 43 B2 61 7D BA 7C E0
32 12 E1 C3 FE 56 D2 08 2C D4 D6 CC 79 AA 43 50
07 1B E8 57 DE 41 85 B6 8F F2 F0 03 33 F1 E8 9E
80 8B 74 6B 4C 62 B0 7D 73 4A 58 0A B6 8F 41 BF
51 C9 98 CA FF 7B 73 00 47 ED 73 56 B5 0A BE E4
52 95 93 78 60 78 C0 80 6F B5 A5 79 50 8A 31 35
D5 EF E6 BE 19 9C A8 DC 67 54 38 F6 D7 1D 4D 5F
22 45 FB 65 EB 41 8D 31 FE F6 55 47 48 BF B3 3F
FA 54 61 26 AC E7 B0 CD 10 7F 7B 3D B7 BD 0E 21
26 53 A1 53 B1 FF 84 BD 99 F4 AE 76 A8 EB 65 DC
48 4A 12 86 99 54 13 B2 F2 28 7F C2 42 B1 C4 DD
E6 CF AE 1C D0 7E 73 55 D6 13 D2 BE AB 8A E8 3D
F3 A7 83 19 F6 B1 32 37 F7 7F 1D D7 1E CD CB D6
6E 60 8D A6 AC D1 EC 6C 0D 8A D6 88 C9 A5 20 52
70 B9 55 94 99 AB E4 AF F3 9B B4 47 67 3B D5 C7
6E F3 0B 9A 5A 80 A4 D3 46 61 50 2C 2E 19 64 8B
57 CD DB 02 7B A7 94 98 29 61 D8 28 4D 18 3B A1
6B 44 D5 32 E7 74 EF 2B F1 8A CC 5E 5A 2F 40 9C
2E 5D 7A 94 A2 F3 E4 1A AB EF 29 EB 8D FD A6 B2
5C 23 F2 E1 3E 71 0F F5 92 32 66 86 EE 55 4E 16
DD BC 78 B9 B7 D4 9E F1 DF F6 E5 0D D9 7D 4F 7A
96 0F 31 73 57 62 5A A1 89 A5 21 34 45 9F 20 E1
53 D5 AB 94 A3 15 91 BC 9B D0 DB 95 07 5E 1E 91
B7 19 A1 9F AD 13 8E A5 FC 8C 05 DB F6 92 08 54
8D 9F 07 61 A0 19 5A 9C 98 0D 3A 29 FE 4C 46 4B
E3 3C 30 A6 85 B1 BD 9C 30 B0 AD 56 3B AB D2 B3
0F 33 8A 0B 72 59 77 EA E1 6D EB 61 DD A0 F5 E2
0A 9F 25 8B 20 93 27 47 4F 95 8C 64 28 18 36 ED
41 4B 51 18 69 EC B2 FC FE 40 CB CB BD B8 DC BA
60 67 BE 5A 65 28 96 E5 53 3F F1 B0 1F 31 2E D1
C3 0A 4F 3E 63 C6 A1 92 0F CD 78 BA 36 0B B1 8C
90 26 5A D1 65 C1 E0 31 4C 0C 26 8E 82 8A 96 1E
63 74 A4 01 1E B9 05 C8 55 53 4F 82 40 94 85 97
42 01 CF 27 54 F3 B4 23 9E 9F 48 3F D1 05 04 64
6B E3 D1 A9 8C D5 4D EC 2D 4C 70 70 7E 00 3A 59
3D 16 51 27 74 B7 83 7D 63 64 95 5E A7 C9 97 1C
9B 28 A0 4C 47 67 82 80 C0 82 FD 05 33 B7 FF 50
BB C7 7E 35 70 BC E4 E5 33 21 E3 E0 FE 0A AD BD
90 4B A4 6D AB 6D 72 15 41 9E 9A 8A CE 04 80 3F
D2 8A 9F E1 8B 4C 98 F4 7A 43 25 82 80 DC BF 4E
B9 87 57 23 9D 37 0D F6 17 0A 1F F6 A6 57 F9 DA
5C 57 86 60 31 D6 34 2F AD 9D 25 27 20 E5 32 B6
8A 27 B8 D7 70 B4 87 69 1D A9 79 2D 8B F6 BE D0
54 1F 95 BC E0 C6 F3 1A A9 90 88 C4 33 05 29 28
C9 F9 FD 42 E2 AB BE 8A BC 11 E3 73 72 16 60 CA
6B E5 DD 10 DD AF F3 B9 83 D2 BD 54 35 FA AD 10
BC C8 2C AF 76 2F 43 00 7D F1 21 48 84 BE 6D B4
F2 40 42 7E 5D 1C CF B7 B9 52 1F 1A 88 45 8B 64
F5 05 BA 4E E5 AB A1 D0 09 91 2D 2E 1B 1F E9 BB
0E 3D 8A 05 0F 11 1E 2B E5 B2 20 F7 DB 7F C2 8A
8B C6 97 0D E2 4F 4E 05 EA FE C3 1C 11 05 D9 D0
6B 48 38 F9 33 92 FE 61 C2 B5 F3 15 77 92 3A 73
66 7D 36 A6 B0 EE 82 C0 F2 3F 92 5E 58 C7 5E 07
</pre>
</pre>


== Static Keyslot 0x605 (OTP, ALL Types) ==
=== SLSK SHA256HMAC KEY (NonPerconsole) (Slot 0x20) ===


<pre>
<pre>
3B 39 E9 2E 25 B0 40 38 27 EE 32 D7 D6 49 A8 47
2E1FC0BF211AEE3977C96F1089A150F5
D7 F1 1E 24 D0 11 76 0A 79 43 37 D4 F7 40 C9 DF
A3CB9E41314BC39F0CBEC16AF3B0B9AC
</pre>
</pre>


* Universal
* calculates header hmac (0:0x1C0) which is compared against signature at 0x1C0 size 0x100, verified with key 0 from bootrom rsa pairs
* calculates encrypted body hmac + 0x10 bytes (0x2B0:end_of_body_from_header) verified against hmac at 0x190 (encrypted with double AA key and custom iv from bootrom)
 
=== SLSK Header HMAC/CBC KEY/IV ===


== Perconsole Keyslot 0x606 (Test Subject 5) ==
* key


<pre>
<pre>
5E 75 05 CD A7 40 E8 5D 7F 82 B7 EA EA 32 CE 1C
AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
66 04 2C E9 E6 B6 F4 F1 DC AA 94 A1 06 B8 32 EF
</pre>
</pre>


== Perconsole Keyslot 0x606 (Test Subject 6) ==
* iv


<pre>
<pre>
DD DF C7 61 C7 7F AE 89 CF 39 6F BC 30 CF 7F 60 
EEB5EC5CCF1CF43113F5213AD5B8D6DA
F8 BF BC 24 E1 3F 5A CE 46 50 BC 66 2F 73 AC D4 
</pre>
</pre>


== Perconsole Keyslot 0x606 (Test Subject 7) ==
* decrypts what's at 0x190 size 0x20 of .enc file using aes 256 cbc
* result will be a hmac calculated with key 2E1FC0BF211AEE3977C96F1089A150F5A3CB9E41314BC39F0CBEC16AF3B0B9AC
* said hmac will be from header size (usually 0x2B0) until header size plus body size (0x2B0 + ???) with body encrypted
 
=== Factory Handshake Key ===


<pre>
<pre>
72 39 DE 10 B7 F1 92 D5 78 E1 03 81 63 7F CF CF 
F47716E6C5649FD648538FD9773D12D1
D4 44 9B 58 A1 7C 97 E5 EC F6 1D 09 40 82 7B B2 
229E118737B1D782D6A80CDB72E4B9C3
</pre>
</pre>


== Perconsole Keyslot 0x606 (Test Subject 8) ==
* Shared with SYSCON
 
=== SLSK IV (Confirmed) ===


<pre>
<pre>
98 AF 08 AD B7 8A E2 83 0A 31 47 0A FD 00 B2 64 
AF5F2CB04AC1751ABF51CEF1C8096210
D4 E2 C5 83 E2 14 EB 57 F9 58 CD 54 C4 BA 09 4C
</pre>
</pre>


== Perconsole Keyslot 0x607 (Test Subject 5) ==
* Used with AA 16x Battery key (AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA) to decrypt SLSK after depersonalization
 
=== Bootrom RSA Key (Fallback for SLSK Validation, all fuses blown) (Proto) ===


<pre>
<pre>
F5 B1 8E B5 37 DD C4 6F 6B 59 A4 19 AD AB F4 A8
3BD3D7E98A17F359F19E3AF9802B95E9
52 02 9A 0E 50 E4 FC 3F F0 93 88 EA E3 34 C7 E3
D6946CA8903136582EFC9C88F4F01E3D
3101E2FA33541A231E4E45F05E8536C6
4D69B60EF4B3004D23AD72BF801B8695
EEA843BE585862A63D6B2BE7F90055A8
C690AECAD63B85EA118A79BBD510156F
53D3B7623811C18F0829364ABAFB1A6C
9D841F20A08831963C0D5B64FB360947
206C748AEFDB1715896BCA4D2980EE22
B0C3243FB73C3F2A0A868C587E57B77A
FEBE2B983046D6428C722319A598A5C6
0EFB9C4E9FDCF793DFA3CDEEC6C8A249
42652531706D6D701B0B0C660E79D241
9D38E1B8E976BD9FB4D4CD1E6F461E86
B295C6FA10D1C7927CB266C08B3025CC
76A4837EF0D8208BBA305059E23DDABC
</pre>
</pre>


== Perconsole Keyslot 0x607 (Test Subject 6) ==
=== SLSK Verification RSA Keys ===


<pre>
<pre>
FA 87 A5 75 15 B2 88 60 57 5E 2C 2D 45 7F BA 86 
CDAE7E886C890F5EC5FF3AB72EE09D4A
55 32 A9 74 96 BF D5 B9 E8 D4 CE D7 98 19 40 97
2369F5593A3BAD32256747103EB173E5
</pre>
 
== Perconsole Keyslot 0x607 (Test Subject 7) ==
 
<pre>
7E EE 37 A4 C0 DA C7 D2 0A AA 5E DA 34 17 B4 5C 
45 A8 DA 4E FD 40 7D 9D E5 08 53 B4 9A 06 29 43
</pre>
 
== Perconsole Keyslot 0x607 (Test Subject 8) ==
 
<pre>
6E 1E 68 77 A7 1D 05 8B 97 55 F6 9D 2E 2A 24 1C 
4A 3D B7 E4 3B E8 F0 65 FA A0 8C 20 58 89 3F F2
</pre>
 
== SLSK Verification RSA Keys (Static Keyslots 0x7XX) ==
 
<pre>
CDAE7E886C890F5EC5FF3AB72EE09D4A
2369F5593A3BAD32256747103EB173E5
9E6EAD3ABD18C0474CF54A09A0500B94
9E6EAD3ABD18C0474CF54A09A0500B94
CC20534F04CC8268507F0E3E109307F3
CC20534F04CC8268507F0E3E109307F3
Line 1,387: Line 812:
* Only first key is used
* Only first key is used


= Keys =
=== Keyseed 0 (Proto) ===
 
== Bootrom ==
 
=== Personalization removal Key for SLSK (Proto) (Perconsole) (Slot 8) (Test Subject 0) ===


<pre>
<pre>
85C688C1B3BACB16EB57B4CC35B7D590
1EB25643234EF6EF380F9E57A216FA22
D835FF0508BEBBE97676FA478C29C21D
</pre>
</pre>


* decrypts the .enp (not ._enp!) perconsole layer of an enp file, turning it into an enc file
* Encrypt AES256ECB into Slot 8 using slot 0x206
* algo is aes-128-cbc
* Obtain PCK Layer Removal SLSK From NAND Key (128 Bit)


=== Personalization removal Key for SLSK (Proto) (Perconsole) (Slot 8) (Test Subject 1) ===
=== Keyseed 1 (Proto) ===


<pre>
<pre>
8B5415DC7EB5986472BF6B30D8E3E812
50976238EED23234F9C746CCB07D6D71
3F5BA67BC8C097DAE52D8512084683E7
</pre>
</pre>


=== Personalization removal Key for SLSK (Proto) (Perconsole) (Slot 8) (Test Subject 2) ===
* Encrypt AES256ECB into Slot 9 using slot 0x207
* Obtain SLSK ENP DePersonalization Key (JigKick Only) (128bit)
 
=== Keyseed 2 (Proto) ===


<pre>
<pre>
95B7B3EDB2EF277FB0F78FA3970EE0D0
4A41DEDEFFBAC04F52602D0034DAD666
164E3CF1FC23BE4F4D0F8471A7E60563
</pre>
</pre>


=== Personalization removal Key for SLSK (Proto) (Perconsole) (Slot 8) (Test Subject 3) ===
* Encrypt AES256ECB into Slot 0x20 with key 0x344
* Obtain SLSK HMAC-SHA256 Key
 
=== SLSK KEY IVs ===


<pre>
<pre>
CB0B65F7897F30310471F7CDA2CFD804
B07FEB18E422167AECDB60A8EE0CA427 Index 0
69425551E9AE3945F36873F110FDA6FB Index 1
1C48B1C8A599CD59C7AECF8E469830BE Index 2
7C598FB45BCF00A9F49E5AFAD3554754 Index 3
98E3F508D16EF78C8FAE96F4168F20A6 Index 4
766410AE5109F2201DDAE41FB07F6EF6 Index 5
</pre>
</pre>


=== Personalization removal Key for SLSK (Proto) (Perconsole) (Slot 8) (Test Subject 4) ===
=== Auxiliary IVs ===


<pre>
<pre>
F3E408E1EDC3B513277DB99E58A15BE3
0962939DC5BE560F52F6BB45B34CE097
D46CF82FC8BA5D5B6436F9F7E4E20434
EA574C6CB6B11505D5DA35446D187808
8F62AAEDBD4E025BE6E8FF8E7D654704
C898610BF8E6CCC12C9BA48414CC2BCF
</pre>
</pre>


=== Personalization removal IV for SLSK (Proto) (Perconsole) (Slot 8) ===
* Used with other possible keys besides AA key (5 possibilities)
* Never seen used


<pre>
FD4FA8FA4FE79430A0CA305C88E524DD
</pre>


=== Personalization removal KEY for SLSK (Proto) (Perconsole) (Slot 9) (JigKick) (Test Subject 0)  ===
<pre>
9E0A8285C3BE83951C78480A7AEC80FD
</pre>


=== Personalization removal KEY for SLSK (Proto) (Perconsole) (Slot 9) (JigKick) (Test Subject 1) ===
== Second Loader ==
 
=== FallBack IDPS and PSID (CEM/DEM) ===
 
<pre>
<pre>
686268A876650A6A6DC353F69EB82F19
fallback cem idps
 
00 00 00 01 01 03 00 10 90 00 00 00 C8 B4 00 CD
 
 
fallback cem psid
 
C9 E5 91 3A FD 20 52 AA 4B 85 97 51 24 F7 59 A2
 
 
fallback dem idps
 
00 00 00 01 01 00 00 01 00 00 00 01 88 25 9E 0E
 
 
fallback dem psid
 
71 CB BB DE 6B D4 1B 24 37 A3 6E BA 3E C3 6C 93
</pre>
</pre>


=== Personalization removal KEY for SLSK (Proto) (Perconsole) (Slot 9) (JigKick) (Test Subject 2)  ===
=== Jig Auth 5 Keys (SharedKeyB SharedDataB related) ===
 
<pre>
<pre>
E7A8ADF7B7E2BC26E3445084384FBCE1
1C7FD39E8D63AA32D386413EE6A01C15C4876BF614CA954E36C1602DD7871C4F KEY
051DFE9D9BEA8087F66EB8F631010D88 IV
</pre>
</pre>


=== Personalization removal KEY for SLSK (Proto) (Perconsole) (Slot 9) (JigKick) (Test Subject 3)  ===
=== Unknown GCAUTHMGR Key and IV ===
<pre>
<pre>
736F7501E9A15AB29800113686C946BA
821C5714415E9804D6AAE324EB3DDDFE7BB73E8EC0F9E04D3D6D60BCD0CF4EE9
</pre>
</pre>


=== Personalization removal KEY for SLSK (Proto) (Perconsole) (Slot 9) (JigKick) (Test Subject 4)  ===
<pre>
<pre>
BEA39D6443FBACAB05DA62BB95470D57
CEC36FCD7DB3102A80E9C2AA65734FC1
</pre>
</pre>


=== Personalization removal IV for SLSK (Proto) (Perconsole) (Slot 9) (JigKick) ===
=== SMI Modulus ===


<pre>
<pre>
986D5EE1E7759F4F52DB43F33FA5960A
C618BE3270E1553B2D08660C70000616
38388DB331BFF30E7DB6334EA8F8F7EB
93540B6624465ABE2AFAF01ACF0B8705
1CBAE118769183B9EA9B09C225A063BA
387A23452BBCDA2949C4ABA0C66A8D1D
0A44A7AE22D1AC449C9EAC5ED79A18AC
1B0691B3451673965ED336C9987EF5B4
2FA6DE995FFD319A629A5E2523164E3F
B9C7BDE7025E839C3B528F53E5ABB077
776C80E1C7A15720CBEA770D7674C9CD
C44559F0ED538DE33F79E9334C62AD81
114B23432D736A89CE7A53FECD50E66E
021F9DCC2B635E33305FD5EA8F15656D
2B00E93BBC78EE97B6BDDDF8EE218289
2D6A739CA1001AD8849F2F0A2550592A
4DA15742BB712E07B7933B8BFE1F2AD1
</pre>
</pre>


=== SLSK SHA256HMAC KEY (NonPerconsole) (Slot 0x20) ===
=== SMI (Slot 0x213) ===
 
<pre>
<pre>
2E1FC0BF211AEE3977C96F1089A150F5
310D20077AF3BF121F21D9ADAF389CDA IV First Derivation SMI
A3CB9E41314BC39F0CBEC16AF3B0B9AC
</pre>


* calculates header hmac (0:0x1C0) which is compared against signature at 0x1C0 size 0x100, verified with key 0 from bootrom rsa pairs
2F0AEEF98EE3965650F8485E6C0BC2C4 IV First Decryption SMI
* calculates encrypted body hmac + 0x10 bytes (0x2B0:end_of_body_from_header) verified against hmac at 0x190 (encrypted with double AA key and custom iv from bootrom)


=== SLSK Header HMAC/CBC KEY/IV ===
D9A2CA7FD2E5AA65134CBF9ECF036F8AACE02A42D9187A08717C0255A13AB966 Seed Second Derivation SMI


* key
0F92B97AC4353337FD222A0E7E49EB58 IV Second Derivation SMI


<pre>
69D7618B7DBE7B59C04DEF5169831FBF IV Second Decryption SMI
AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
</pre>
</pre>


* iv
=== Other Keys/IVs ===


<pre>
<pre>
EEB5EC5CCF1CF43113F5213AD5B8D6DA
62FC3C4751B32657E71E89ECE4324BE3 (Internal) (Introduced in 0.920I, removed in 0.995I, qa flag related?)
</pre>
</pre>


* decrypts what's at 0x190 size 0x20 of .enc file using aes 256 cbc
=== Secure Kernel XXX Proto Keys ===
* result will be a hmac calculated with key 2E1FC0BF211AEE3977C96F1089A150F5A3CB9E41314BC39F0CBEC16AF3B0B9AC
 
* said hmac will be from header size (usually 0x2B0) until header size plus body size (0x2B0 + ???) with body encrypted
* Algorithm is AES 256 CBC
* IV is all zeroes
 
==== External ====
 
<pre>
992EF70868DE1B219EC3618FA79DAEC39067FE5638116C29FC0FF7E2A58FBD9E
</pre>


=== Factory Handshake Key ===
==== Internal ====


<pre>
<pre>
F47716E6C5649FD648538FD9773D12D1
AC78EE86799148699B9CB3F5C6CAB73A6AC45EB11F44E9151232CF8F123C7D88
229E118737B1D782D6A80CDB72E4B9C3
</pre>
</pre>


* Shared with SYSCON
== AIMGR ==
 
* All these seem to be fallback keys in case keyslot 0 (aka pck0) fails to decrypt the idstorage enc_cmac located at cert + 0xD8
 
* algo used is aes-128-ecb-dec


=== SLSK IV (Confirmed) ===
* used together with keyslot 0x212 for cmac


<pre>
<pre>
AF5F2CB04AC1751ABF51CEF1C8096210
7BB73E8EC0F9E04D3D6D60BCD0CF4EE9
 
CEC36FCD7DB3102A80E9C2AA65734FC1
 
89398ED8AE6FB3B0519485893AD0E5F3
 
33B90F7B250879F87DB269CFC4E7FB35
</pre>
</pre>


* Used with AA 16x Battery key (AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA) to decrypt SLSK after depersonalization
* This seems to be used to derive decryption for the certificate from idstorage


=== Bootrom RSA Key (Fallback for SLSK Validation, all fuses blown) (Proto) ===
* used with slot 0x204 (likely iv for aes-256 master key)


<pre>
<pre>
3BD3D7E98A17F359F19E3AF9802B95E9
821C5714415E9804D6AAE324EB3DDDFE
D6946CA8903136582EFC9C88F4F01E3D
3101E2FA33541A231E4E45F05E8536C6
4D69B60EF4B3004D23AD72BF801B8695
EEA843BE585862A63D6B2BE7F90055A8
C690AECAD63B85EA118A79BBD510156F
53D3B7623811C18F0829364ABAFB1A6C
9D841F20A08831963C0D5B64FB360947
206C748AEFDB1715896BCA4D2980EE22
B0C3243FB73C3F2A0A868C587E57B77A
FEBE2B983046D6428C722319A598A5C6
0EFB9C4E9FDCF793DFA3CDEEC6C8A249
42652531706D6D701B0B0C660E79D241
9D38E1B8E976BD9FB4D4CD1E6F461E86
B295C6FA10D1C7927CB266C08B3025CC
76A4837EF0D8208BBA305059E23DDABC
</pre>
</pre>
=== PSN Keys ===
==== X-I-4-Passphrase ====


=== Keyseed 0 (Proto) ===
used to aes-128-cbc encrypt X-I-4-Passphrase header of PSN authentication request:


- Version 1 (used until 3.63)
<pre>
<pre>
1EB25643234EF6EF380F9E57A216FA22
EA35FA34B747929A540219DBA2DA001F
D835FF0508BEBBE97676FA478C29C21D
</pre>
</pre>
 
- Version 2 (used 3.63 onwards)
* Encrypt AES256ECB into Slot 8 using slot 0x206
* Obtain PCK Layer Removal SLSK From NAND Key (128 Bit)
 
=== Keyseed 1 (Proto) ===
 
<pre>
<pre>
50976238EED23234F9C746CCB07D6D71
886073DE0511F0581792DC66FD6CA6AF
3F5BA67BC8C097DAE52D8512084683E7
</pre>
</pre>


* Encrypt AES256ECB into Slot 9 using slot 0x207
notes:
* Obtain SLSK ENP DePersonalization Key (JigKick Only) (128bit)
the IV is all 0 in both cases
 
PSN will still accept a version 1 passphrase which is how henkaku psn spoof works
=== Keyseed 2 (Proto) ===


==== X-I-4-Passphrase HMAC ====
used to generate the HMAC signature for X-I-4-Passphrase
<pre>
<pre>
4A41DEDEFFBAC04F52602D0034DAD666
4D3E171CFB60DF96D1AFA6E76FEBFB5C079A5D177919C3EF417BAFA23A0B0DE2036624F0C87A8D3659DAE19E77195146B11A767D8A35A8610D301A79BBA9342D
164E3CF1FC23BE4F4D0F8471A7E60563
</pre>
</pre>


* Encrypt AES256ECB into Slot 0x20 with key 0x344
== Communication Processor ==
* Obtain SLSK HMAC-SHA256 Key


=== SLSK KEY IVs ===
=== ES2 fsimage1.trf Pub ===


<pre>
<pre>
B07FEB18E422167AECDB60A8EE0CA427 Index 0
A9 69 7F 9D 93 43 CA DE 68 E0 4F 9E 35 6E 6A B6
69425551E9AE3945F36873F110FDA6FB Index 1
BB C7 DE 36 A4 D8 1B 98 A8 3B C1 2B E3 F6 DF 96
1C48B1C8A599CD59C7AECF8E469830BE Index 2
ED 7A 64 38 94 56 AC A9 33 BE BF BA 4F FE F0 5C
7C598FB45BCF00A9F49E5AFAD3554754 Index 3
F4 5F 2F 88 6F 43 4F BB C3 A0 13 48 53 30 70 C0
98E3F508D16EF78C8FAE96F4168F20A6 Index 4
B7 D5 E9 C2 1E FE 53 E9 5A 60 19 DB 51 C1 2C 6B
766410AE5109F2201DDAE41FB07F6EF6 Index 5
AF EB 94 E9 92 28 79 63 44 8E 59 60 63 84 B9 9F
3F F3 E5 EB 6A A0 8B F3 2A 4D BA 7A 31 25 20 CE
C2 B6 9B B2 0A 6D 06 40 B1 17 17 0A A2 DD A1 FB
59 0A EE 7A DF C4 E8 0D FC F2 7F A5 5D DE C9 2C
07 92 2F DD 05 AB 16 18 DC B7 27 AA 6F F7 00 27
A9 41 0B C8 45 E5 0E AF D4 6C 0F D9 2F F5 00 67
2D E5 64 89 C6 69 B0 AA 48 1F FD 75 E9 9E 21 A8
DC 2F 9F 9E 87 95 7B 46 BB F6 3F B7 DD BE 8B 8C
A8 61 BA 34 9A 62 45 8E 85 5E E7 8C 3D D6 79 1F
92 E7 64 22 14 4E 51 29 5B 13 37 E1 5C 12 6D F6
FA 0C 29 32 1B C1 D7 C0 0E 3C 19 EE F3 A3 E7 A5
</pre>
</pre>


=== Auxiliary IVs ===
=== ES2 CPUP Pub ===


<pre>
<pre>
0962939DC5BE560F52F6BB45B34CE097
A7 CC AE 0F 50 11 88 52 7B F3 DA CC A3 E2 31 C8
D46CF82FC8BA5D5B6436F9F7E4E20434
D8 70 1E 7B 91 92 73 90 70 1D E5 E7 A9 63 27 DA
EA574C6CB6B11505D5DA35446D187808
D8 71 67 A8 F0 13 68 AD DF E4 90 E3 25 A2 90 53
8F62AAEDBD4E025BE6E8FF8E7D654704
36 97 05 8F BA 77 57 66 69 80 10 AF D8 FD 7A 3F
C898610BF8E6CCC12C9BA48414CC2BCF
FD 26 5E 0A 52 FE 04 92 8B CE 8B 43 02 F4 C7 0F
FA C3 C9 39 7F D2 4B 10 62 71 E5 7B DA 20 D2 D7
02 29 8F 6F 99 0E CF 9B 0F E0 4F F6 CC EE 17 0B
55 53 04 23 20 12 D7 8E 60 19 DA B2 97 63 82 9E
6A F5 AD A8 02 20 4F A5 51 63 11 79 CB FE 61 64
73 26 62 E8 57 67 41 94 9B B1 36 45 6C 11 DE 35
5F 48 72 11 D2 30 26 7D C0 5E 69 9A 26 52 AD 5C
6D 74 B0 56 83 26 F4 F2 F5 B8 6A D9 56 E9 44 04
D3 A6 59 28 F4 EA 21 89 56 7C E9 98 99 11 B0 48
08 51 7F 4C 76 A8 B2 5D F1 D6 AB BE 85 95 C4 69
BF D7 E8 70 C4 F0 0A 89 61 0C 2C 9B 79 F6 25 A4
2C A2 B4 C6 B8 D3 7E 62 CE 9E C6 1A 85 6F D3 2F
</pre>
</pre>


* Used with other possible keys besides AA key (5 possibilities)
=== NBL Configs ===
* Never seen used


== Second Loader ==
==== Key ====


=== FallBack IDPS and PSID (CEM/DEM) ===
<pre>
3C 97 EB 60 B2 06 80 E9 5E B7 00 13 11 96 5F AE
</pre>


==== IV ====
<pre>
<pre>
fallback cem idps
4D 8A C9 0A E0 B3 C1 30 46 31 A8 6D 56 32 02 70
</pre>


00 00 00 01 01 03 00 10 90 00 00 00 C8 B4 00 CD
=== Deobfuscated blob ===


<pre>
4D 8A C9 0A E0 B3 C1 30 46 31 A8 6D 56 32 02 70 iv  blob01 aes-128-cbc
3C 97 EB 60 B2 06 80 E9 5E B7 00 13 11 96 5F AE key blob01 aes-128-cbc


fallback cem psid
A9 69 7F 9D 93 43 CA DE 68 E0 4F 9E 35 6E 6A B6 fs1 rsa
 
BB C7 DE 36 A4 D8 1B 98 A8 3B C1 2B E3 F6 DF 96 fs1
C9 E5 91 3A FD 20 52 AA 4B 85 97 51 24 F7 59 A2
ED 7A 64 38 94 56 AC A9 33 BE BF BA 4F FE F0 5C fs1
F4 5F 2F 88 6F 43 4F BB C3 A0 13 48 53 30 70 C0 fs1
B7 D5 E9 C2 1E FE 53 E9 5A 60 19 DB 51 C1 2C 6B fs1
AF EB 94 E9 92 28 79 63 44 8E 59 60 63 84 B9 9F fs1
3F F3 E5 EB 6A A0 8B F3 2A 4D BA 7A 31 25 20 CE fs1
C2 B6 9B B2 0A 6D 06 40 B1 17 17 0A A2 DD A1 FB fs1
59 0A EE 7A DF C4 E8 0D FC F2 7F A5 5D DE C9 2C fs1
07 92 2F DD 05 AB 16 18 DC B7 27 AA 6F F7 00 27 fs1
A9 41 0B C8 45 E5 0E AF D4 6C 0F D9 2F F5 00 67 fs1
2D E5 64 89 C6 69 B0 AA 48 1F FD 75 E9 9E 21 A8 fs1
DC 2F 9F 9E 87 95 7B 46 BB F6 3F B7 DD BE 8B 8C fs1
A8 61 BA 34 9A 62 45 8E 85 5E E7 8C 3D D6 79 1F fs1
92 E7 64 22 14 4E 51 29 5B 13 37 E1 5C 12 6D F6 fs1
FA 0C 29 32 1B C1 D7 C0 0E 3C 19 EE F3 A3 E7 A5 fs1 rsa


68 48 3F BB 69 F1 04 A3 CB 0A D8 18 7F 90 0B 12
89 6F F0 68 51 B5 51 CC 75 B9 C7 01 4D B1 8F A9
0A 82 27 97 B6 CC 1D C0 2B CD 68 8E 91 C6 22 64
1B F4 36 ED 32 2D D4 F0 D2 CD C1 7F 20 35 AA 0B
F4 E0 8D 02 49 BF EE 25 52 90 AC E9 40 C4 69 27
E0 C9 DF 3D 3A A0 62 98 4E B6 D3 77 41 5C C4 09
3F B8 3E 20 28 65 2D 80 70 C5 25 4A CA 0B CA D0
A7 C3 3A DC 90 EF 6B 66 D2 CD F5 0B A3 CC A0 E2
29 9E 38 D2 76 11 66 B9 2C 28 7F 75 1F 94 FF 06
74 18 EA A9 D7 C9 EF 9A 26 3D 42 8C 23 33 0D 27
41 42 67 E7 DB BC A6 B7 07 F8 C3 3D 9F 06 B0 3E
CB 45 3F A6 40 22 28 A4 0A 13 8A 49 68 F3 F0 72
94 EA D9 E8 55 37 CF 8D 43 AD AF EC 51 87 40 D4
D4 D5 A5 4B AE 14 27 7E FB 42 F9 C7 81 4E 1E E5
</pre>


fallback dem idps
== Ernie ==


00 00 00 01 01 00 00 01 00 00 00 01 88 25 9E 0E
=== Security ID (RL78) ===


<pre>
00 00 00 00 00 00 00 00 00 00 (it's blank LMAO)
</pre>


fallback dem psid
=== Ernie Update AES128CBC Key 0x10/0x30/0x31/0x40/0x41 (PHAT) ===


71 CB BB DE 6B D4 1B 24 37 A3 6E BA 3E C3 6C 93
<pre>
key: 12B5408FD189E223B61890F488536008
iv : 82D6528A87BC55B38EF29A45730EF130
</pre>
</pre>


=== Jig Auth 5 Keys (SharedKeyB SharedDataB related) ===
* supports type 0
* for block size 0x400 ONLY (block size 0x800 not supported)
 
=== Ernie Updater AES128CBC Key 0x10/0x30/0x31/0x40/0x41 (PHAT) ===


<pre>
<pre>
1C7FD39E8D63AA32D386413EE6A01C15C4876BF614CA954E36C1602DD7871C4F KEY
key: EAE43A1C48CD32A565E2CA7D8F9018DC
051DFE9D9BEA8087F66EB8F631010D88 IV
iv: C9D9619CA151342D04602ECF0B8D6E33
</pre>
</pre>


=== SMI Modulus ===
* supports type 0
* for block size 0x400 ONLY (block size 0x800 not supported)
* for updater and confzz firmwares ONLY
* location: around 0xFXXX of syscon firmware
 
=== Ernie Update AES128CBC Key 0x60 (PHAT) ===


<pre>
<pre>
C618BE3270E1553B2D08660C70000616
key: 8C9ED3908C4143AE02855794C025BE1A
38388DB331BFF30E7DB6334EA8F8F7EB
iv : C85AE1576D5E205FE8043573F55F4E11
93540B6624465ABE2AFAF01ACF0B8705
</pre>
1CBAE118769183B9EA9B09C225A063BA
 
387A23452BBCDA2949C4ABA0C66A8D1D
* supports type 0
0A44A7AE22D1AC449C9EAC5ED79A18AC
* location: around 0xFXXX in syscon firmware
1B0691B3451673965ED336C9987EF5B4
 
2FA6DE995FFD319A629A5E2523164E3F
=== Ernie Updater AES128CBC Key 0x60 (PHAT) ===
B9C7BDE7025E839C3B528F53E5ABB077
776C80E1C7A15720CBEA770D7674C9CD
C44559F0ED538DE33F79E9334C62AD81
114B23432D736A89CE7A53FECD50E66E
021F9DCC2B635E33305FD5EA8F15656D
2B00E93BBC78EE97B6BDDDF8EE218289
2D6A739CA1001AD8849F2F0A2550592A
4DA15742BB712E07B7933B8BFE1F2AD1
</pre>


=== SMI (Slot 0x213) ===
<pre>
<pre>
AB7097356FDD49D83878540167F0C4AD85537C5A56BD15DF0EB5F7F0D9E276E6 Seed First Derivation SMI
key: 7014BEE6136725B9FFBE9A8614DD5C2A
iv: FBD11DF2E0AAEE0B9C3738163CB8B6BD
</pre>


310D20077AF3BF121F21D9ADAF389CDA IV First Derivation SMI
* supports type 0
* for updater and confzz firmwares ONLY


2F0AEEF98EE3965650F8485E6C0BC2C4 IV First Decryption SMI
=== Ernie Update AES128CBC Key 0x70/0x72 (PSTV) ===


D9A2CA7FD2E5AA65134CBF9ECF036F8AACE02A42D9187A08717C0255A13AB966 Seed Second Derivation SMI
<pre>
key: 67C34253A7DE13517EC903FE1119C04C
iv : DB302673D69F0D513A635E68A470F9C1
</pre>


0F92B97AC4353337FD222A0E7E49EB58 IV Second Derivation SMI
* aka the key for the meaning of life, universe and everything else
* supports type 6 and 7


69D7618B7DBE7B59C04DEF5169831FBF IV Second Decryption SMI
=== Ernie Updater AES128CBC Key 0x70/0x72 (PSTV) ===
</pre>
 
=== Other Keys/IVs ===


<pre>
<pre>
62FC3C4751B32657E71E89ECE4324BE3 (Internal) (Introduced in 0.920I, removed in 0.995I, qa flag related?)
key: BE01B7FA1EC3ED641879DDE44D60486E
iv : 671A74C7E50F25CF64D4341039C78705
</pre>
</pre>


=== Secure Kernel XXX Proto Keys ===
* aka the key for the meaning of life, universe and everything else
* supports type 6 and 7
* for updater and confzz firmwares ONLY


* Algorithm is AES 256 CBC
=== Ernie Update AES128CBC Key 0x80/0x82 (PS Vita SLIM) ===
* IV is all zeroes
 
==== External ====


<pre>
<pre>
992EF70868DE1B219EC3618FA79DAEC39067FE5638116C29FC0FF7E2A58FBD9E
key: 523BEB53FCB95DC772AA1BFB0A96CD10
iv : 385D67E50CE7669ECD171FE576814343
</pre>
</pre>


==== Internal ====
* supports type 5 and 8
 
=== Ernie Updater AES128CBC Key 0x80/0x82 (PS Vita SLIM) ===


<pre>
<pre>
AC78EE86799148699B9CB3F5C6CAB73A6AC45EB11F44E9151232CF8F123C7D88
key: DBD9450ACCA8544895663A6F472BDE7F
iv : F927C6A1153DB2D65F736C3AD9E1CE76
</pre>
</pre>


== GcAuthMgr ==
* supports type 5 and 8
=== Master Key Seeds ===
* for updater and confzz firmwares ONLY
As part of gc authentication, some keys are derived using these key seeds
& 0x345 and 0x348 bbmac.
different key seeds are used depending on the key id used by the gamecart.


==== KeyID 0x1 ====
=== SERVICE 0x900 PASSPHRASE ===
KEYSEED:
<pre>
<pre>
7f1fd065dd2f40b3e26579a6390b616d
93CE8EBEDF7F69A96F35DDE3BECB97D5
</pre>
</pre>
IV:
 
=== BStoBSid Key ===
<pre>
<pre>
8b14c8a1e96f30a7f101a96a3033c55b
46B532E3F012E663C0694ECA7C8C58B7
</pre>
</pre>
==== KeyID 0x8001 ====
 
KEYSEED:
=== First Loader Jig Handshake Key ===
 
Also known as g_debug_challenge_key. See [https://wiki.henkaku.xyz/vita/Enc#Secret_debug_mode].
 
AES256ECB Key:
<pre>
<pre>
6f2285ed463a6e57c5f3550ddcc81feb
F47716E6C5649FD648538FD9773D12D1
229E118737B1D782D6A80CDB72E4B9C3
</pre>
</pre>
==== KeyID 0x8002 ====
 
KEYSEED:
=== Supported Keysets by Ernie ===
<pre>
<pre>
da9608b528825d6d13a7af1446b8ec08
0, 1, 0xB, 0xE, 0xF
</pre>
</pre>
==== KeyID 0x8003 ====
 
KEYSEED:
=== Ernie Handshake Keysets ===
 
These keysets are stored on each side (Ernie firmware and cMeP binaries).
 
==== Keyset 0x0 ====
 
===== SharedData_0 =====
<pre>
<pre>
368b2eb5437a821862a6c95596d8c135
80996FBBC8B4EBA30595F4D379A23BD0
</pre>
</pre>
=== Unknown GcAuthMgr Key and IV ===
 
===== SharedKey_0_A =====
<pre>
<pre>
821C5714415E9804D6AAE324EB3DDDFE7BB73E8EC0F9E04D3D6D60BCD0CF4EE9
EF685D2E33C7D029A1A2EE646BE39D41
</pre>
</pre>


===== SharedKey_0_B =====
<pre>
<pre>
CEC36FCD7DB3102A80E9C2AA65734FC1
CE7867DE57575C008D998281E8DA5912
</pre>
</pre>


==== Keyset 0x1 ====


== KPRX_AUTH ==
===== SharedData_1 =====
keys part of kprx_auth_sm
<pre>
8C20B6FABD2236F772AA283B8C82B13E
</pre>


=== Bind Data HMAC Key ===  
===== SharedKey_1_A =====
used for ksceSblAuthMgrDecBindData
<pre>
<pre>
901a84fb13a744a378c5018a60f58c22
87DC6ECFF1CA5D709B01AEF69EA6B283
</pre>
</pre>
HMAC-SHA256 using this key
result is the key to aes-cbc-decrypt bind data
first 0x10 is key, last 0x10 is iv.


== AIMGR ==
===== SharedKey_1_B =====
<pre>
51EB8DD39B0585CE915F3BFF609C9563
</pre>


* All these seem to be fallback keys in case keyslot 0 (aka pck0) fails to decrypt the idstorage enc_cmac located at cert + 0xD8
==== Keyset 0xB (command 0xA0) ====


* algo used is aes-128-ecb-dec
===== SharedKey_B_A =====
 
<pre>
* used together with keyslot 0x212 for cmac
BB644721CB4C55072E83177BEB3BBEE9 (2F1C)
</pre>
Initial key to encrypt step 2 packet.


===== SharedKey_B_B =====
<pre>
<pre>
7BB73E8EC0F9E04D3D6D60BCD0CF4EE9
DC6B6EE0F457DF0E7BAD1C5EA338027F (2F2C)
</pre>
Intermediate key used to decrypt Syscon step 3 response.


CEC36FCD7DB3102A80E9C2AA65734FC1
Ernie communication session key AES128ECB master key:
<pre>
00000000000000000000000000000000
</pre>
Unused with command 0xA0.


89398ED8AE6FB3B0519485893AD0E5F3
===== SharedData_B =====
 
<pre>
33B90F7B250879F87DB269CFC4E7FB35
CF2E93E9F94E28CCA48026134C7C77CE (2F0C)
</pre>
</pre>
Checked in Syscon only.


* This seems to be used to derive decryption for the certificate from idstorage
==== Keyset 0xE ====


* used with slot 0x204 (likely iv for aes-256 master key)
===== SharedData_E =====


<pre>
<pre>
821C5714415E9804D6AAE324EB3DDDFE
AD2F322F4256C49D1848818F0FDD81BE
</pre>
</pre>
=== PSN Keys ===
==== X-I-4-Passphrase ====


used to aes-128-cbc encrypt X-I-4-Passphrase header of PSN authentication request:
===== SharedKey_E_A =====


- Version 1 (used until 3.63)
<pre>
<pre>
EA35FA34B747929A540219DBA2DA001F
4ACE3A668AAEBB11793C432FB8A4CE88
</pre>
</pre>
- Version 2 (used 3.63 onwards)
 
===== SharedKey_E_B =====
 
<pre>
<pre>
886073DE0511F0581792DC66FD6CA6AF
1CBAE93DE883557C8AA14886786BE227
</pre>
</pre>


notes:
==== Keyset 0xF (command 0xD0) ====
the IV is all 0 in both cases
PSN will still accept a version 1 passphrase which is how henkaku psn spoof works


==== X-I-4-Passphrase HMAC ====
===== SharedKey_F_A =====
used to generate the HMAC signature for X-I-4-Passphrase
<pre>
<pre>
4D3E171CFB60DF96D1AFA6E76FEBFB5C079A5D177919C3EF417BAFA23A0B0DE2036624F0C87A8D3659DAE19E77195146B11A767D8A35A8610D301A79BBA9342D
50E4C3A77264167C409C72A9B57A8609 (2F5C)
</pre>
</pre>
Initial key to encrypt step 2 packet.


== Communication Processor ==
===== SharedKey_F_B =====
 
<pre>
=== ES2 fsimage1.trf Pub ===
9E34087C48985B4B351A63572D9B481B (2F6C)
</pre>
Intermediate key used to decrypt Syscon step 3 response.


===== SharedKey_F_Master =====
<pre>
<pre>
A9 69 7F 9D 93 43 CA DE 68 E0 4F 9E 35 6E 6A B6
EBE3460D84A41754AC441368CF0200D8 (2F7C)
BB C7 DE 36 A4 D8 1B 98 A8 3B C1 2B E3 F6 DF 96
ED 7A 64 38 94 56 AC A9 33 BE BF BA 4F FE F0 5C
F4 5F 2F 88 6F 43 4F BB C3 A0 13 48 53 30 70 C0
B7 D5 E9 C2 1E FE 53 E9 5A 60 19 DB 51 C1 2C 6B
AF EB 94 E9 92 28 79 63 44 8E 59 60 63 84 B9 9F
3F F3 E5 EB 6A A0 8B F3 2A 4D BA 7A 31 25 20 CE
C2 B6 9B B2 0A 6D 06 40 B1 17 17 0A A2 DD A1 FB
59 0A EE 7A DF C4 E8 0D FC F2 7F A5 5D DE C9 2C
07 92 2F DD 05 AB 16 18 DC B7 27 AA 6F F7 00 27
A9 41 0B C8 45 E5 0E AF D4 6C 0F D9 2F F5 00 67
2D E5 64 89 C6 69 B0 AA 48 1F FD 75 E9 9E 21 A8
DC 2F 9F 9E 87 95 7B 46 BB F6 3F B7 DD BE 8B 8C
A8 61 BA 34 9A 62 45 8E 85 5E E7 8C 3D D6 79 1F
92 E7 64 22 14 4E 51 29 5B 13 37 E1 5C 12 6D F6
FA 0C 29 32 1B C1 D7 C0 0E 3C 19 EE F3 A3 E7 A5
</pre>
</pre>
Master key to generate Ernie communication session key (stored in Bigmac keyslot 0x511) by encrypting step 2 data.


=== ES2 CPUP Pub ===
===== SharedData_F =====  
 
<pre>
<pre>
A7 CC AE 0F 50 11 88 52 7B F3 DA CC A3 E2 31 C8
C86B51FB019A207F32118E55462D5008 (2F3C)
D8 70 1E 7B 91 92 73 90 70 1D E5 E7 A9 63 27 DA
D8 71 67 A8 F0 13 68 AD DF E4 90 E3 25 A2 90 53
36 97 05 8F BA 77 57 66 69 80 10 AF D8 FD 7A 3F
FD 26 5E 0A 52 FE 04 92 8B CE 8B 43 02 F4 C7 0F
FA C3 C9 39 7F D2 4B 10 62 71 E5 7B DA 20 D2 D7
02 29 8F 6F 99 0E CF 9B 0F E0 4F F6 CC EE 17 0B
55 53 04 23 20 12 D7 8E 60 19 DA B2 97 63 82 9E
6A F5 AD A8 02 20 4F A5 51 63 11 79 CB FE 61 64
73 26 62 E8 57 67 41 94 9B B1 36 45 6C 11 DE 35
5F 48 72 11 D2 30 26 7D C0 5E 69 9A 26 52 AD 5C
6D 74 B0 56 83 26 F4 F2 F5 B8 6A D9 56 E9 44 04
D3 A6 59 28 F4 EA 21 89 56 7C E9 98 99 11 B0 48
08 51 7F 4C 76 A8 B2 5D F1 D6 AB BE 85 95 C4 69
BF D7 E8 70 C4 F0 0A 89 61 0C 2C 9B 79 F6 25 A4
2C A2 B4 C6 B8 D3 7E 62 CE 9E C6 1A 85 6F D3 2F
</pre>
</pre>
Checked by Syscon only.


=== NBL Configs ===
Step 4-5 passphrase:
 
==== Key ====
 
<pre>
<pre>
3C 97 EB 60 B2 06 80 E9 5E B7 00 13 11 96 5F AE
B01103B0623832D62540B56333D6E11D (2F4C)
</pre>
</pre>
Checked by both Syscon (step 4) and cMeP (step 5) to ensure packet authenticity.
=== All not known Ernie-embedded Keys ===


==== IV ====
<pre>
<pre>
4D 8A C9 0A E0 B3 C1 30 46 31 A8 6D 56 32 02 70
DB D9 45 0A CC A8 54 48 95 66 3A 6F 47 2B DE 7F 21C44(USS-1002) AES KEY
F9 27 C6 A1 15 3D B2 D6 5F 73 6C 3A D9 E1 CE 76 21C44(USS-1002) AES IV
</pre>
</pre>


=== Deobfuscated blob ===
=== JigKick Key Expansion ===


<pre>
<pre>
4D 8A C9 0A E0 B3 C1 30 46 31 A8 6D 56 32 02 70 iv  blob01 aes-128-cbc
$ ./aes_keyschedule.exe F47716E6C5649FD648538FD9773D12D1229E118737B1D782D6A80CD
3C 97 EB 60 B2 06 80 E9 5E B7 00 13 11 96 5F AE key blob01 aes-128-cbc
B72E4B9C3
K00: F47716E6C5649FD648538FD9773D12D1
K01: 229E118737B1D782D6A80CDB72E4B9C3
K02: 9C2138A65945A770111628A9662B3A78
K03: 116F913B26DE46B9F0764A628292F3A1
K04: D12C0AB58869ADC5997F856CFF54BF14
K05: 074F99C12191DF78D1E7951A537566BB
K06: 481FE058C0764D9D5909C8F1A65D77E5
K07: 23036C180292B360D375267A800040C1
K08: 23169895E360D508BA691DF91C346A1C
K09: BF1B6E84BD89DDE46EFCFB9EEEFCBB5F
K10: 83FC57BD609C82B5DAF59F4CC6C1F550
K11: 0B6388D7B6EA5533D816AEAD36EA15F2
K12: 24A5DEB844395C0D9ECCC341580D3611
K13: 61B48D55D75ED8660F4876CB39A26339
K14: 5E5ECCAA1A6790A784AB53E6DCA665F7
</pre>
 
* Some keys are repeated in the Ernie memory dump, as it seems Ernie stores many versions of code binaries. Maybe backup bank or updater.


A9 69 7F 9D 93 43 CA DE 68 E0 4F 9E 35 6E 6A B6 fs1 rsa
== Ernie Handshake Keys (not stored in Ernie) ==
BB C7 DE 36 A4 D8 1B 98 A8 3B C1 2B E3 F6 DF 96 fs1
ED 7A 64 38 94 56 AC A9 33 BE BF BA 4F FE F0 5C fs1
F4 5F 2F 88 6F 43 4F BB C3 A0 13 48 53 30 70 C0 fs1
B7 D5 E9 C2 1E FE 53 E9 5A 60 19 DB 51 C1 2C 6B fs1
AF EB 94 E9 92 28 79 63 44 8E 59 60 63 84 B9 9F fs1
3F F3 E5 EB 6A A0 8B F3 2A 4D BA 7A 31 25 20 CE fs1
C2 B6 9B B2 0A 6D 06 40 B1 17 17 0A A2 DD A1 FB fs1
59 0A EE 7A DF C4 E8 0D FC F2 7F A5 5D DE C9 2C fs1
07 92 2F DD 05 AB 16 18 DC B7 27 AA 6F F7 00 27 fs1
A9 41 0B C8 45 E5 0E AF D4 6C 0F D9 2F F5 00 67 fs1
2D E5 64 89 C6 69 B0 AA 48 1F FD 75 E9 9E 21 A8 fs1
DC 2F 9F 9E 87 95 7B 46 BB F6 3F B7 DD BE 8B 8C fs1
A8 61 BA 34 9A 62 45 8E 85 5E E7 8C 3D D6 79 1F fs1
92 E7 64 22 14 4E 51 29 5B 13 37 E1 5C 12 6D F6 fs1
FA 0C 29 32 1B C1 D7 C0 0E 3C 19 EE F3 A3 E7 A5 fs1 rsa


68 48 3F BB 69 F1 04 A3 CB 0A D8 18 7F 90 0B 12
These keysets are stored in second_loader and in many SMs.
89 6F F0 68 51 B5 51 CC 75 B9 C7 01 4D B1 8F A9
0A 82 27 97 B6 CC 1D C0 2B CD 68 8E 91 C6 22 64
1B F4 36 ED 32 2D D4 F0 D2 CD C1 7F 20 35 AA 0B
F4 E0 8D 02 49 BF EE 25 52 90 AC E9 40 C4 69 27
E0 C9 DF 3D 3A A0 62 98 4E B6 D3 77 41 5C C4 09
3F B8 3E 20 28 65 2D 80 70 C5 25 4A CA 0B CA D0
A7 C3 3A DC 90 EF 6B 66 D2 CD F5 0B A3 CC A0 E2
29 9E 38 D2 76 11 66 B9 2C 28 7F 75 1F 94 FF 06
74 18 EA A9 D7 C9 EF 9A 26 3D 42 8C 23 33 0D 27
41 42 67 E7 DB BC A6 B7 07 F8 C3 3D 9F 06 B0 3E
CB 45 3F A6 40 22 28 A4 0A 13 8A 49 68 F3 F0 72
94 EA D9 E8 55 37 CF 8D 43 AD AF EC 51 87 40 D4
D4 D5 A5 4B AE 14 27 7E FB 42 F9 C7 81 4E 1E E5
</pre>


== Ernie ==
=== Keyset 4 ===
 
=== Security ID (RL78) ===


Step 2 AES128ECB key:
<pre>
<pre>
00 00 00 00 00 00 00 00 00 00 (it's blank LMAO)
A6CD383341CB9B0D69FD4A243E30F4B1
</pre>
</pre>
Initial key to encrypt step 2 packet.


=== Ernie Update AES128CBC Key 0x10/0x30/0x31/0x40/0x41 (PHAT) ===
Step 3 AES128ECB key:
 
<pre>
<pre>
key: 12B5408FD189E223B61890F488536008
D3EFEDE608691946CB77E14F8DEC69FA
iv : 82D6528A87BC55B38EF29A45730EF130
</pre>
</pre>
Intermediate key used to decrypt Syscon step 3 response.


* supports type 0
Ernie communication session key AES128ECB master key:
* for block size 0x400 ONLY (block size 0x800 not supported)
 
=== Ernie Updater AES128CBC Key 0x10/0x30/0x31/0x40/0x41 (PHAT) ===
 
<pre>
<pre>
key: EAE43A1C48CD32A565E2CA7D8F9018DC
15C7B32429F8603216F4F3E081D7C86D
iv: C9D9619CA151342D04602ECF0B8D6E33
</pre>
</pre>
Master key to generate Ernie communication session key (stored in Bigmac keyslot 0x511) by encrypting step 2 data.


* supports type 0
Step 2 passphrase:
* for block size 0x400 ONLY (block size 0x800 not supported)
<pre>
* for updater and confzz firmwares ONLY
9ABD1B275C7537F7E62AB93AB3EB76F9
* location: around 0xFXXX of syscon firmware
</pre>
 
Checked by Syscon only.
=== Ernie Update AES128CBC Key 0x60 (PHAT) ===


Step 4-5 passphrase:
<pre>
<pre>
key: 8C9ED3908C4143AE02855794C025BE1A
DC454ED5F6E8A2B1B24D34A82215B2A5
iv : C85AE1576D5E205FE8043573F55F4E11
</pre>
</pre>
Checked by both Syscon (step 4) and cMeP (step 5) to ensure packet authenticity.


* supports type 0
=== Keyset 6 ===
* location: around 0xFXXX in syscon firmware
 
=== Ernie Updater AES128CBC Key 0x60 (PHAT) ===


Step 2 AES128ECB key:
<pre>
<pre>
key: 7014BEE6136725B9FFBE9A8614DD5C2A
1053143BEAECC59FCFF1A195F8F5AFB0
iv: FBD11DF2E0AAEE0B9C3738163CB8B6BD
</pre>
</pre>
Initial key to encrypt step 2 packet.


* supports type 0
Step 3 AES128ECB key:
* for updater and confzz firmwares ONLY
 
=== Ernie Update AES128CBC Key 0x70/0x72 (PSTV) ===
 
<pre>
<pre>
key: 67C34253A7DE13517EC903FE1119C04C
F90CDCBF009BA8367F841B25E8B10306
iv : DB302673D69F0D513A635E68A470F9C1
</pre>
</pre>
Intermediate key used to decrypt Syscon step 3 response.


* aka the key for the meaning of life, universe and everything else
Ernie communication session key AES128ECB master key:
* supports type 6 and 7
 
=== Ernie Updater AES128CBC Key 0x70/0x72 (PSTV) ===
 
<pre>
<pre>
key: BE01B7FA1EC3ED641879DDE44D60486E
6F6374FD1A41A75269EE15832451DEBF
iv : 671A74C7E50F25CF64D4341039C78705
</pre>
</pre>
Master key to generate Ernie communication session key (stored in Bigmac keyslot 0x511) by encrypting step 2 data.


* aka the key for the meaning of life, universe and everything else
Step 2 passphrase:
* supports type 6 and 7
* for updater and confzz firmwares ONLY
 
=== Ernie Update AES128CBC Key 0x80/0x82 (PS Vita SLIM) ===
 
<pre>
<pre>
key: 523BEB53FCB95DC772AA1BFB0A96CD10
B6806F9F58706D72B0E03717197D430C
iv : 385D67E50CE7669ECD171FE576814343
</pre>
</pre>
Checked by Syscon only.


* supports type 5 and 8
Step 4-5 passphrase:
 
=== Ernie Updater AES128CBC Key 0x80/0x82 (PS Vita SLIM) ===
 
<pre>
<pre>
key: DBD9450ACCA8544895663A6F472BDE7F
0E08A20C8718BD3B158E2E6992202DE7
iv : F927C6A1153DB2D65F736C3AD9E1CE76
</pre>
</pre>
Checked by both Syscon (step 4) and cMeP (step 5) to ensure packet authenticity.


* supports type 5 and 8
=== Keyset 0xC (AuthEtoI, similar to command 0xA0) ===
* for updater and confzz firmwares ONLY


=== SERVICE 0x900 PASSPHRASE ===
Step 2 AES128ECB key:
<pre>
<pre>
93CE8EBEDF7F69A96F35DDE3BECB97D5
3CF54027DAE2F45C929B76927DFFD269
</pre>
</pre>
Initial key to encrypt step 2 packet.


=== BStoBSid Key ===
Step 3 AES128ECB key:
<pre>
<pre>
46B532E3F012E663C0694ECA7C8C58B7
39AF55239062D2F3F6CBB401EDC54C09
</pre>
</pre>
Intermediate key used to decrypt Syscon step 3 response.


=== First Loader Jig Handshake Key ===
Ernie communication session key AES128ECB master key:
 
Also known as g_debug_challenge_key. See [https://wiki.henkaku.xyz/vita/Enc#Secret_debug_mode].
 
AES256ECB Key:
<pre>
<pre>
F47716E6C5649FD648538FD9773D12D1
00000000000000000000000000000000
229E118737B1D782D6A80CDB72E4B9C3
</pre>
</pre>
Unused with command AuthEtoI.


=== Supported Keysets by Ernie ===
Step 2 passphrase:
<pre>
<pre>
0, 1, 0xB, 0xE, 0xF
4231FFB14B941DBFEB44DFF97E64EC7D
</pre>
</pre>
Checked in Syscon only.


=== Ernie Handshake Keysets ===
==== Keyset 0xE ====


These keysets are stored on each side (Ernie firmware and cMeP binaries).
Step 2 AES128ECB key:
 
==== Keyset 0x0 ====
 
===== SharedData_0 =====
<pre>
<pre>
80996FBBC8B4EBA30595F4D379A23BD0
E55364616CA8C3DD2859B1D913E1CC15
</pre>
</pre>
Initial key to encrypt step 2 packet.


===== SharedKey_0_A =====
Step 3 AES128ECB key:
<pre>
<pre>
EF685D2E33C7D029A1A2EE646BE39D41
02DA870FB5983DE568E324DDF5330C9D
</pre>
</pre>
Intermediate key used to decrypt Syscon step 3 response.


===== SharedKey_0_B =====
Ernie communication session key AES128ECB master key:
<pre>
<pre>
CE7867DE57575C008D998281E8DA5912
D606A99E381A4B440DB9A8A87F608F1B
</pre>
</pre>
Master key to generate Ernie communication session key (stored in Bigmac keyslot 0x511) by encrypting step 2 data.


==== Keyset 0x1 ====
Step 2 passphrase:
 
===== SharedData_1 =====
<pre>
<pre>
8C20B6FABD2236F772AA283B8C82B13E
8082307DA258780D5088C40218B98EFC
</pre>
</pre>
Checked by Syscon only.


===== SharedKey_1_A =====
Step 4-5 passphrase:
<pre>
<pre>
87DC6ECFF1CA5D709B01AEF69EA6B283
D14A64DF4011E110325E159602F23BA7
</pre>
</pre>
Checked by both Syscon (step 4) and cMeP (step 5) to ensure packet authenticity.
== Ernie SNVS Keys ==
=== Prototype Ernie SNVS Keys (min FW < 0.996) ===
Maybe also eMMC Keys.
These constant keys are used instead of per-console keys stored in Bigmac keyslots 0x502-0x504.
==== AES XTS Tweak Key ====


===== SharedKey_1_B =====
<pre>
<pre>
51EB8DD39B0585CE915F3BFF609C9563
E122F9C47E1C94F082536A1F244B9A9C
E08DA5E8E122F9C47E1C94F082536A1F
</pre>
</pre>


==== Keyset 0xB (command 0xA0) ====
==== AES XTS Decryption Key ====


===== SharedKey_B_A =====
<pre>
<pre>
BB644721CB4C55072E83177BEB3BBEE9 (2F1C)
244B9A9CE08DA5E8E122F9C47E1C94F0
82536A1F244B9A9CE08DA5E8E122F9C4
</pre>
</pre>
Initial key to encrypt step 2 packet.


===== SharedKey_B_B =====
==== HMAC-SHA256 Key ====
 
<pre>
<pre>
DC6B6EE0F457DF0E7BAD1C5EA338027F (2F2C)
EDF481EF0AFF55CD1A643E8A7AF50911
36A7749CEDF481EF0AFF55CD1A643E8A
</pre>
</pre>
Intermediate key used to decrypt Syscon step 3 response.


Ernie communication session key AES128ECB master key:
== Mystery update_service_sm Keys ==
<pre>
00000000000000000000000000000000
</pre>
Unused with command 0xA0.


===== SharedData_B =====
These keys are found in update_service_sm and are used for something unknown. They are not used by the PS Vita.
<pre>
CF2E93E9F94E28CCA48026134C7C77CE (2F0C)
</pre>
Checked in Syscon only.


==== Keyset 0xE ====
=== SCE WaterMark External (Not Used) ===


===== SharedData_E =====
Exponent: 0x10001


<pre>
==== P ====
AD2F322F4256C49D1848818F0FDD81BE
</pre>
 
===== SharedKey_E_A =====


<pre>
<pre>
4ACE3A668AAEBB11793C432FB8A4CE88
EA236F5002D0B5EB937ED04E5A100276
26A47DB379E2B3049EA2CC6ED5E48B5A
A8BA066A7827D2D5D83C238F7BA807B9
43E07616C77E69AA2A2FC447C3FC5A1B
BB4678E6931078DA24DF6904E8F5C628
EFC79548F49D7665A8FA40B4B24679AB
B4AADD00AF0829B0CB97A2A6FD44E813
BFCC06C46B1DB91E4CB30C992B255E21
</pre>
</pre>


===== SharedKey_E_B =====
==== Q ====


<pre>
<pre>
1CBAE93DE883557C8AA14886786BE227
E22A87F84528A12EB31AAA6A8FC4D6EF
6352133A4D6ABDF917A0967370307E65
98216D4A251FFAFDDF41F79CFAF477D6
B7A513B953E0F42D27C5687EBE39FFF9
A48C6000D34F5FFE92FE1967C5B6E42A
CC38FDB71294042FA0695F19C502FAD1
BD125672C0C20AD029B75379CCE2BBAA
D88FE9EC4B3C18269CEEE87DA330DF99
</pre>
</pre>


==== Keyset 0xF (command 0xD0) ====
==== DP ====


===== SharedKey_F_A =====
<pre>
<pre>
50E4C3A77264167C409C72A9B57A8609 (2F5C)
75F155A0335AD9590ADA85AA025A3033
3E31FC140DA0F1D6B0E6871E89E66F80
42A03A9D255BC22BF09A12BBB369A842
5DFBD2E094AB8C24A8CD990D219F9BF0
7E3CF8A8058AF5A5C58F38C2BD6B18E0
0431407518ABBD39668E714BD4C60582
46270FDEC94CCE5B7DA32BCEFCA3DA58
207471303E5921A82EB0BEF6E53214A1
</pre>
</pre>
Initial key to encrypt step 2 packet.


===== SharedKey_F_B =====
==== DQ ====
 
<pre>
<pre>
9E34087C48985B4B351A63572D9B481B (2F6C)
2948B0373E9093138E3810E190CAD29D
32191A4F6B304FEB3747E60EBE6CEBB5
A9D67837AF9D2DD8C7B727F6ECCC514F
CD880198B3D9FD587CC9093111924ECA
8821E3A862EA3B50A20E661ECE357B62
E0928AA5AF6B7B742228F9E61F5352EB
9442D3AAF0CABAE492A8D741058861CF
66E6A641AEDE125E82090E4158D7A409
</pre>
</pre>
Intermediate key used to decrypt Syscon step 3 response.


===== SharedKey_F_Master =====
==== DinvQ ====
 
<pre>
<pre>
EBE3460D84A41754AC441368CF0200D8 (2F7C)
68A77889A624A12BFF7013D4A390B101
</pre>
77F18C6E2AA0894408B328F78A1DF319
Master key to generate Ernie communication session key (stored in Bigmac keyslot 0x511) by encrypting step 2 data.
B9C243C815C293A8B080C40849B811CE
1168821C3AF49F6B771F3DE4396F731E
4402679475F5379077B70FA44F495B1B
36B89F7E62C37333344F54FAE248CB69
EB92F540E65F50A1D19F98AA476EF103
71648229865145C3FE240F4BD6D83254
</pre>


===== SharedData_F =====
==== Modulus ====
<pre>
C86B51FB019A207F32118E55462D5008 (2F3C)
</pre>
Checked by Syscon only.


Step 4-5 passphrase:
<pre>
<pre>
B01103B0623832D62540B56333D6E11D (2F4C)
CEDA2E70A6E473CB8F6CCBC808B75C88
C3B31125793EE135DDF2D36D68C22011
77079AF5234E8774B0634C6EAD9918C1
8024C67A4A4F4060B6C7AFE5E4BE6BE1
132CB334D0FABEBF64F5B23E711F8AF9
E7DE33C93239AD416DB61408A92CD768
687DCD5C37F2771F508790C461B3C475
8C5147FBE9C3A1F3A51898FD44BB6BAD
ACEF2EB5CA7D48EFFDC27E9350A9A29C
DBC478D5B8B64953DAEEF6A610E90B8A
D6F5A65C3E44662F028F4415268BF184
B939E6FB0C754D8B29C6C82B654B46F6
6ACC1E29B7A359A88BB42CCD21D3D0A8
54065DF50A34A6D8B80C5E76583E0EB0
DA4A7E60032476DDFA6C94FC4056CBE2
B2E6841E502D53673F67B42DFF8400B9
</pre>
</pre>
Checked by both Syscon (step 4) and cMeP (step 5) to ensure packet authenticity.
=== All not known Ernie-embedded Keys ===


==== Private ====
<pre>
<pre>
DB D9 45 0A CC A8 54 48 95 66 3A 6F 47 2B DE 7F 21C44(USS-1002) AES KEY
B3D81690734A253352DBF0C15672B5CD
F9 27 C6 A1 15 3D B2 D6 5F 73 6C 3A D9 E1 CE 76 21C44(USS-1002) AES IV
62F9096B5F634043A9593A61E1B70652
A8FEBFC76A8F184E681DAD927CF4A305
79F87F684BBB63E9B2812379E9CB75D8
16E7C257A56A9CF5A33DCB5F66D359ED
B59F07BF621FAB773B8017230093B025
62D41DFC93D807A1FE4E1F9BDEA681A5
01FE996B78EF529B976B2F78E48D5F2B
ECFDBE4744369BC8889AEC72B2FD4685
0666D3BE61B21A85AB145240E4D4374A
7FFEFF13A77076B6C9297E3BF0DB6A64
B39B6175B86EAE1DDB02AEECA452C931
506D31BE5B1129A9883117A90BF579EA
0AD2DE86EFBB8E7C8275CC6E01B4296D
90F567B310DA64E0A356018C25D11241
71A21254346E24B2DD883480618DBC01
</pre>
</pre>


=== JigKick Key Expansion ===
=== SCE WaterMark Internal (Not Used) ===
 
Exponent: 0x10001
 
==== P ====


<pre>
<pre>
$ ./aes_keyschedule.exe F47716E6C5649FD648538FD9773D12D1229E118737B1D782D6A80CD
E2946A07650E5C657AC662EB1A6DD6DF
B72E4B9C3
E44618AF35247EEF5E54559F581DBEAD
K00: F47716E6C5649FD648538FD9773D12D1
1AC2CF038ABF663344366F76E323F382
K01: 229E118737B1D782D6A80CDB72E4B9C3
1A3F3699C972664E636E1373130E8AA3
K02: 9C2138A65945A770111628A9662B3A78
71721B530CA58B8EA30E338AD1827FAC
K03: 116F913B26DE46B9F0764A628292F3A1
8147AFE207B116CCEC9EB9D9C5A8D48F
K04: D12C0AB58869ADC5997F856CFF54BF14
788A98CE6B5E2A99FE27F7197A5D6548
K05: 074F99C12191DF78D1E7951A537566BB
93C84D4292F394C1A4CD6D09FF06F7E5
K06: 481FE058C0764D9D5909C8F1A65D77E5
K07: 23036C180292B360D375267A800040C1
K08: 23169895E360D508BA691DF91C346A1C
K09: BF1B6E84BD89DDE46EFCFB9EEEFCBB5F
K10: 83FC57BD609C82B5DAF59F4CC6C1F550
K11: 0B6388D7B6EA5533D816AEAD36EA15F2
K12: 24A5DEB844395C0D9ECCC341580D3611
K13: 61B48D55D75ED8660F4876CB39A26339
K14: 5E5ECCAA1A6790A784AB53E6DCA665F7
</pre>
</pre>


* Some keys are repeated in the Ernie memory dump, as it seems Ernie stores many versions of code binaries. Maybe backup bank or updater.
==== Q ====
 
== Ernie Handshake Keys (not stored in Ernie) ==
 
These keysets are stored in second_loader and in many SMs.
 
=== Keyset 4 ===


Step 2 AES128ECB key:
<pre>
<pre>
A6CD383341CB9B0D69FD4A243E30F4B1
D369EC809646C3D07EBA35124F20FA33
D7ADC2E1C1A31D5909533F88CEEE6AD3
BF0FDFAFE67165DAF7229CA4F230CB7C
2C7D4525A942637ABCB843A8C2388B27
88848689DA3423A0D9CA8837A7BC1D9D
D5A89374689B77BC53C0FFB196A2A0F3
1D81E81F302A544C18942A44F08B8CF9
36D66ACA38512B5C5550AE178887151B
</pre>
</pre>
Initial key to encrypt step 2 packet.


Step 3 AES128ECB key:
==== DP ====
<pre>
D3EFEDE608691946CB77E14F8DEC69FA
</pre>
Intermediate key used to decrypt Syscon step 3 response.


Ernie communication session key AES128ECB master key:
<pre>
<pre>
15C7B32429F8603216F4F3E081D7C86D
2FB4FE2A366DF2A86F546C2982741425
2A24543837E14A54CE30C5A27A6430EC
B3D0C6D3C11811C5C39C0E9622B74423
65B15FA6BBD2B995D1BBB09EAF2985A9
6A4E9350463E69070C70060C3996D799
13D36B461546853D7AA8E50AE4626AF7
1673603F3E3E228C30066C31D220EE1D
7CF854C42ABADCDC74FDC7F2ADDEE2BD
</pre>
</pre>
Master key to generate Ernie communication session key (stored in Bigmac keyslot 0x511) by encrypting step 2 data.


Step 2 passphrase:
==== DQ ====
 
<pre>
<pre>
9ABD1B275C7537F7E62AB93AB3EB76F9
47054E6DE40DE1BA28D864FBC1995274
180047778F953C46ACDB4A7CAB076CDB
B5539FD17798A09EEE66B238B723AD38
09BA0B809B5BB20F89565D6453DAAAE4
9CF7E83A67131CE4EC451D7D94DB9D17
68AF38D9E24A57EEEC33E9B1BEE8E328
C8C0DB399EF4995CF6E4CF4E598087DB
3090D74F179C2CF4D7B442C7A515BC01
</pre>
</pre>
Checked by Syscon only.


Step 4-5 passphrase:
==== DinvQ ====
 
<pre>
<pre>
DC454ED5F6E8A2B1B24D34A82215B2A5
5B917A6768A9912815A0F09D2A8AA77D
72F1230A81987BB9452EF03BE0B5B63F
10AA391219D3EA92A3F2330F6899B458
DF04818DF79E126E84293595EBC60275
D96FC1D4DEAA024FF59E4187934BCDA2
B11BD26D941E6FC4E979BD12DB197D2A
D6EE300BA0E0A46CF2531B84F5F0102B
B714B9D176C46A8BDF3CFA8CD4DF6EDF
</pre>
</pre>
Checked by both Syscon (step 4) and cMeP (step 5) to ensure packet authenticity.


=== Keyset 6 ===
==== Modulus ====


Step 2 AES128ECB key:
<pre>
<pre>
1053143BEAECC59FCFF1A195F8F5AFB0
BB1E13963648B5EC36EC4DDD00DD3752
53B47A3FD452BB67F1FB8B0967DDAB08
AA82456200CC9006D27DD00144F36C5C
98EF4A2C53074C654978F49AE82E2589
887E2DF24E748BDB1B2EE222F8C6EC6E
0DF3C32666209882C008D66AEE35F18F
D8A810B886B1A926C3C96906482FAB7B
103EF76900FE7C1DF13041051398CAE8
83B8485069F98CB78CD275C96714DB22
C91CF19B4BE2C77AC228C93DFA0B09DA
ADE4ACFDA26D66DFFD18DDE58895A34C
A6377C2594603FE41E0C5062150761D8
73FB5394D1032FC0929F9ED6C5BE051B
039C6C5BF5D92BEBC3EC83EC06E3CC7B
5EC1BCE445622741CD60BE2DDCF83848
BC86B3EBF987C438320B6DEAD9D4EE27
</pre>
</pre>
Initial key to encrypt step 2 packet.


Step 3 AES128ECB key:
==== Private ====
<pre>
F90CDCBF009BA8367F841B25E8B10306
</pre>
Intermediate key used to decrypt Syscon step 3 response.


Ernie communication session key AES128ECB master key:
<pre>
<pre>
6F6374FD1A41A75269EE15832451DEBF
57CA38AE5531B008EF8BD6CC45C78459
</pre>
1FE4A126A95B5789E1427F6D1E4A2620
Master key to generate Ernie communication session key (stored in Bigmac keyslot 0x511) by encrypting step 2 data.
9EBF18066F118AD1689896AAC1CAE3A0
 
5E3086C05D042397B1ED09F653D0B2D3
Step 2 passphrase:
E03233246822CE2B3289C0975FD914BC
<pre>
5DD76C4BEBC687477109B46FDEEB7836
B6806F9F58706D72B0E03717197D430C
611419243A2DC88AE378EFC97EBCBEDB
B23798A4AF4EB6B4E5A01A21639C6036
0177A834BD946F442BF650F59030FF2F
28A18A31B6D45463FF8A7701764916C1
8E7A12B0848146B1FB1120405DD5A848
0D0C0C97DE5C2FC162362FCA01C71AE7
87C4040DA1D36EFAA318F91960FAB59E
76251FE9F34A91DCD2938FAFE2DA2E93
F2B6F53739616158064D1D3546F25B8C
8E9AA4D58542F3FDC91793ABD8EA6061
</pre>
</pre>
Checked by Syscon only.


Step 4-5 passphrase:
== PKG HMAC Keys ==
<pre>
0E08A20C8718BD3B158E2E6992202DE7
</pre>
Checked by both Syscon (step 4) and cMeP (step 5) to ensure packet authenticity.


=== Keyset 0xC (AuthEtoI, similar to command 0xA0) ===
* present in 0.920 os0 update_service_sm I


Step 2 AES128ECB key:
<pre>
<pre>
3CF54027DAE2F45C929B76927DFFD269
DBE1A473887A076D204B6CE361EFE4B9
</pre>
C540E10B7EEE29C0A225CDAE10E6134C
Initial key to encrypt step 2 packet.
59D6CDA0F426D9F0B4F8C5BAA0EF397B
D38FB0F9B9100B4615816B1F6810D651


Step 3 AES128ECB key:
F8EAFE04E0A66FCDDCD6CD2746DEBBEE
<pre>
81C614EED15E02CFA9D1F87F64AE7597
39AF55239062D2F3F6CBB401EDC54C09
B38B2AA048A3E0B14DA36904B01E4DAA
</pre>
C1317E63E6DE80196EBE2D0CC2715494
Intermediate key used to decrypt Syscon step 3 response.


Ernie communication session key AES128ECB master key:
A6E0B640BEEC23CC82DEDE0A227C5A58
<pre>
89D238906A7EFE369596A1346F0B3547
00000000000000000000000000000000
2654F43DEE032837601A3246514DF4E2
</pre>
E109829A60ABD62521EFE0FAC812E6DD
Unused with command AuthEtoI.


Step 2 passphrase:
8D814CE4C9C3298346F74079F077A2C8
<pre>
4BA0EA40E7BF55305F24976E2E3F7D97
4231FFB14B941DBFEB44DFF97E64EC7D
D37DC6B65149FF8560199FABF74A495E
</pre>
569EFEB78B4E128F914367C953405C13
Checked in Syscon only.


==== Keyset 0xE ====
5C93D3939B27B2CABD19848FF9075E81
00C92BBC9D4B5D1A4D135ADDE1FBD71B
66B724BDBA101D6A3057234895393610
91ED466F251A38EE90825F6287DC8C77


Step 2 AES128ECB key:
C7939B509967CE44A815F3D3A69F3BCA
<pre>
24080619F39B8B0D3EC22BFBE584D7C2
E55364616CA8C3DD2859B1D913E1CC15
B7124FD11B94F8004AD477AE689D0C1D
</pre>
B3B4E59E880163B279C83671F22FD285
Initial key to encrypt step 2 packet.


Step 3 AES128ECB key:
7721C65140A2CA799F366C7275C09F9D
<pre>
A03F12CC9D71C4BE21209167D403E834
02DA870FB5983DE568E324DDF5330C9D
9A831933A1D109D24DC850246D39EEEC
</pre>
CA64137119A95F5FB57E0EC310C2A73E
Intermediate key used to decrypt Syscon step 3 response.
 
AF92C200B8EBCA305C1D1273B636F912
B23247A4C573A69BA525D3AD5177F3EE
C45764EF426B6DA37AB25C37D5EE99AB
7ABDFCC9ED82C94C3016EDD295872061
 
C80EAAB7E368851BCC3319D806D5B5E6
AF613993B86F437AF05528219C549256
AC26FE362692EC55152E706CBB078A7A
0B35A20425BD8A18C581622359EEF7AE


Ernie communication session key AES128ECB master key:
B68C19699474A019CA7BAE575B1F5B7C
<pre>
6DD7A4C115B208666A9A93418DA224B7
D606A99E381A4B440DB9A8A87F608F1B
A202B21059BEA357A96B5A6D7AF01E9E
97CF303CA1207F58743E83CED77700BF
</pre>
</pre>
Master key to generate Ernie communication session key (stored in Bigmac keyslot 0x511) by encrypting step 2 data.


Step 2 passphrase:
== KIRK command 7 New Keys ==
<pre>
8082307DA258780D5088C40218B98EFC
</pre>
Checked by Syscon only.


Step 4-5 passphrase:
<pre>
<pre>
D14A64DF4011E110325E159602F23BA7
kirk7_key80 = 83FFF149A687A5C5CD95779352C8BF66
kirk7_key81 = D83D2D277CE2DE154A4E2AA6D1E8D20B
kirk7_key82 = 4C5C71519F62A5FE5EF36D4B075BE2F3
kirk7_key83 = 8005EF43124F650A9DF158F72A509C10
kirk7_keyC0 = BF57AEF02DC587F327C8C3F8BDECA5EE
kirk7_keyC1 = 9FFF2EECED8476D900DFD579E1AAAB63
kirk7_keyC2 = 04460D61F563D46C0C4EB9AAE5466E84
kirk7_keyC3 = 1E5B17DAC321E6B8DFE7718CA2930370
</pre>
</pre>
Checked by both Syscon (step 4) and cMeP (step 5) to ensure packet authenticity.


== Ernie SNVS Keys ==
== IdStorage Certificate Keys ==


=== Prototype Ernie SNVS Keys (min FW < 0.996) ===
=== IdStorage Certificates ECDSA Public Keys (160 bit) ===


Maybe also eMMC Keys.
==== PSP Certificates ====
 
These constant keys are used instead of per-console keys stored in Bigmac keyslots 0x502-0x504.
 
==== AES XTS Tweak Key ====


<pre>
<pre>
E122F9C47E1C94F082536A1F244B9A9C
4004C80BD9C8BA38221065923E324B5F0EC165ED6CFF7D9F2C420B84DFDA6E96C0AEE29927BCAF1E Sec.0 PSP IDPS
E08DA5E8E122F9C47E1C94F082536A1F
06485FD029853B552F7EFDD67A2DE7A1A4E25537B2459D8786426D5B27EFA5A9311CB8ABABFA0ECE Sec.1 PSP IDPS
3F8C34F210AEC48E1520FF2A44899E054A0DA33DF8B9754B09C0EC7E61867A5126FE6926972196F5 Sec.2 PSP IDPS
CCB3440DC4836DD519E13B2805B30870DCAEE462136B3888651A98E02B29FA0CD34F1616F1ED5786 Sec.3 PSP IDPS
08B336925C2B445D03A9BE51B9AABF54E4CC142EA72A23BB8060B03B71CDE0772DE82AD8931648D6 Sec.4 PSP IDPS
4F0A2BC9987640860E22EE5D86087C9692470BDF59DC4C1F2E38F92CE7B66875B59ED10C9D84FA6A Sec.5 PSP PSID
</pre>
</pre>


==== AES XTS Decryption Key ====
==== PS3 Certificates ====


<pre>
<pre>
244B9A9CE08DA5E8E122F9C47E1C94F0
94D100BE6E24991D65D93F3DA938858CEC2D133051F47DB4287AC86631719B31573EF7CCE071CA8A Sec.0 PS3 IDPS
82536A1F244B9A9CE08DA5E8E122F9C4
071984A1F27D1E91196410D57C828AF7115BF1A32071AA1EC25B7FBF4884F5322A26483C46D8B43C Sec.1 PS3 IDPS
1B6389CECD99843CA088E325C796F510A151C1545C5DE4E37A1D892D2504A8604C094F59063D589F Sec.2 PS3 IDPS
17BE639B87F138049D94398E8929DE535D1CB0DC5E7C04D720D2F3DE86F9B581DD1B6F7CDCF80DE4 Sec.4 PS3 IDPS
4B4F044420207907E3BC7D5423FF4D05E9DAA10B1F973327F7FEDEAE498BC656FF7C7459C9B993F4 Sec.5 PS3 IDPS
1F960A3BD61462553A0DC015AEC66C818CBAA8F62F733AC9F0C287D496F321058AC26669ECBED3DB Sec.6 PS3 PSID
</pre>
</pre>


==== HMAC-SHA256 Key ====
=== IdStorage Certificates ECDSA Public Keys (224 bit) ===
 
==== PS Vita Certificates ====


<pre>
<pre>
EDF481EF0AFF55CD1A643E8A7AF50911
1A9146C3AB04FBA1C32027C47C7906947CC2AB1E247AF59A8D714AF44CA559E78A2C164A77DAD5A878F516E4D905D810C73C39E70EA93198 Sec.0 PS Vita IDPS
36A7749CEDF481EF0AFF55CD1A643E8A
A17772FD3E86091EAE2B246D5E05CE80A8E24A03C6764D26CD2443AE3DD656F919A10F87C67CB2AE280D0751E15ECD3C4FDFC9D71D7F067C Sec.1 PS Vita IDPS
056891AE27047A7D5DE88C57612E1A7D0A7CCD369E8CF2F8F374FEA34155B20B613236C2BDFFE8187AC09C7EDF194D81A440BEB91DC6F257 Sec.2 PS Vita IDPS
6B0AB6A5570334E8B559CC06BA811618ADD2A1EC587A98D35A04E8B98B1D5903711469EE3049B06E1EC81EEB72A9E181D5920B453CF2C21F Sec.3 PS Vita IDPS
1C1816019AE3F8955021892257535F0E92D988E11EA45C2E908E2E208C10F3D7F3ED189EEFC027C8A91B6770A727402423CE976A3435FF8A Sec.4 PS Vita IDPS
108464CCDB76611475AEA911FBD1D476FF41F1C70D811031C552DB9B85E9941A3FD79644B717E0FEE48C4CF7387CF10E900BDBC2D7A35F5D Sec.5 PS Vita PSID
</pre>
</pre>


== Mystery update_service_sm Keys ==
== GC Auth Mgr ECDSA Keys ==


These keys are found in update_service_sm and are used for something unknown. They are not used by the PS Vita.
=== 160 bit Curve ===


=== SCE WaterMark External (Not Used) ===
<pre>
p=FFFFFFFFFFFFFFFF00000001FFFFFFFFFFFFFFFF
a=FFFFFFFFFFFFFFFF00000001FFFFFFFFFFFFFFFC
b=A68BEDC33418029C1D3CE33B9A321FCCBB9E0F0B
N=FFFFFFFFFFFFFFFEFFFFB5AE3C523E63944F2127
Gx=128EC4256487FD8FDF64E2437BC0A1F6D5AFDE2C
Gy=5958557EB1DB001260425524DBC379D5AC5F4ADF
</pre>


Exponent: 0x10001
=== 160 bit Public Key ===
 
==== P ====


<pre>
<pre>
EA236F5002D0B5EB937ED04E5A100276
Qx:55D73E67B84E15B2F28C3B1F6C9DCE2911E3B4ED
26A47DB379E2B3049EA2CC6ED5E48B5A
Qy:0333EEDA263BC89B7696AB5C6B69E18BF1785A80
A8BA066A7827D2D5D83C238F7BA807B9
43E07616C77E69AA2A2FC447C3FC5A1B
BB4678E6931078DA24DF6904E8F5C628
EFC79548F49D7665A8FA40B4B24679AB
B4AADD00AF0829B0CB97A2A6FD44E813
BFCC06C46B1DB91E4CB30C992B255E21
</pre>
</pre>


==== Q ====
=== 160 bit Private Key ===


<pre>
<pre>
E22A87F84528A12EB31AAA6A8FC4D6EF
53CCC36EDFADBE245583270552D23B22518EE3A8
6352133A4D6ABDF917A0967370307E65
98216D4A251FFAFDDF41F79CFAF477D6
B7A513B953E0F42D27C5687EBE39FFF9
A48C6000D34F5FFE92FE1967C5B6E42A
CC38FDB71294042FA0695F19C502FAD1
BD125672C0C20AD029B75379CCE2BBAA
D88FE9EC4B3C18269CEEE87DA330DF99
</pre>
</pre>


==== DP ====
* Seen on FW 3.70.
* Used by Kirk command 0x21 (related to new PS Vita NPDRM PKG files).
 
=== 224 bit Curve ===


<pre>
<pre>
75F155A0335AD9590ADA85AA025A3033
p=A53E113E46D8C9C1F09D9BCB2A5373D379F69DA28D09999FED57A90F
3E31FC140DA0F1D6B0E6871E89E66F80
a=A53E113E46D8C9C1F09D9BCB2A5373D379F69DA28D09999FED57A90C
42A03A9D255BC22BF09A12BBB369A842
b=9065941D29374A8F11DD1E540189434E4A6EBFAF5477F6C172F6855E
5DFBD2E094AB8C24A8CD990D219F9BF0
N=A53E113E46D8C9C1F09D9BCB2A522698DEEF58DB1AD9AB7F04E3AE7F
7E3CF8A8058AF5A5C58F38C2BD6B18E0
Gx=7E06098247E6B59F3110BCBB3AB6C250BC5AB06C032DAD43684C248F
0431407518ABBD39668E714BD4C60582
Gy=0BD9418DE8E3E45D2D701E0237FD7F2ADE0D48B74CEEF2F1C8AC484E
46270FDEC94CCE5B7DA32BCEFCA3DA58
207471303E5921A82EB0BEF6E53214A1
</pre>
</pre>


==== DQ ====
=== 224 bit Public Key ===
 
<pre>
Qx:5F9D171A2BDDA8D40878BF985AC326ED5EFF43C9376C77EC0A00C7BB
Qy:A344E44E6EAC255235F954F5B617C7BD49F180262454AAE1B62A9F2C
</pre>


<pre>
<pre>
2948B0373E9093138E3810E190CAD29D
Qx:67002D9BB8E42D2BF9610B27FEAB9B34561550921312DFEE7A3A86EC
32191A4F6B304FEB3747E60EBE6CEBB5
Qy:6CA714426F6D4E9609A638BF4AFB182BFA50C82FF2B4C5EC6CCD9765
A9D67837AF9D2DD8C7B727F6ECCC514F
CD880198B3D9FD587CC9093111924ECA
8821E3A862EA3B50A20E661ECE357B62
E0928AA5AF6B7B742228F9E61F5352EB
9442D3AAF0CABAE492A8D741058861CF
66E6A641AEDE125E82090E4158D7A409
</pre>
</pre>


==== DinvQ ====
=== 224 bit Private Key ===


<pre>
<pre>
68A77889A624A12BFF7013D4A390B101
767436A6999D88480EC856F55CEABB4396859E374599403921F55598
77F18C6E2AA0894408B328F78A1DF319
B9C243C815C293A8B080C40849B811CE
1168821C3AF49F6B771F3DE4396F731E
4402679475F5379077B70FA44F495B1B
36B89F7E62C37333344F54FAE248CB69
EB92F540E65F50A1D19F98AA476EF103
71648229865145C3FE240F4BD6D83254
</pre>
</pre>


==== Modulus ====
* Seen on FW 1.50.
* Used by Kirk command 0x22.


<pre>
<pre>
CEDA2E70A6E473CB8F6CCBC808B75C88
607A2E5568B4B9A032F45253CFED20DB2E6E446C3782E82A1AB9C923
C3B31125793EE135DDF2D36D68C22011
77079AF5234E8774B0634C6EAD9918C1
8024C67A4A4F4060B6C7AFE5E4BE6BE1
132CB334D0FABEBF64F5B23E711F8AF9
E7DE33C93239AD416DB61408A92CD768
687DCD5C37F2771F508790C461B3C475
8C5147FBE9C3A1F3A51898FD44BB6BAD
ACEF2EB5CA7D48EFFDC27E9350A9A29C
DBC478D5B8B64953DAEEF6A610E90B8A
D6F5A65C3E44662F028F4415268BF184
B939E6FB0C754D8B29C6C82B654B46F6
6ACC1E29B7A359A88BB42CCD21D3D0A8
54065DF50A34A6D8B80C5E76583E0EB0
DA4A7E60032476DDFA6C94FC4056CBE2
B2E6841E502D53673F67B42DFF8400B9
</pre>
</pre>


==== Private ====
* Seen on FW 3.70.
<pre>
* Used by Kirk command 0x22.
B3D81690734A253352DBF0C15672B5CD
 
62F9096B5F634043A9593A61E1B70652
== MSIF Key / Memory Card Auth Key ==
A8FEBFC76A8F184E681DAD927CF4A305
    D419A2EB9D61A52F4FA28B27E32FCDD7E0048D443D63C92C0B27135541D92EC4
79F87F684BBB63E9B2812379E9CB75D8
 
16E7C257A56A9CF5A33DCB5F66D359ED
== PocketStation Keys ==
B59F07BF621FAB773B8017230093B025
62D41DFC93D807A1FE4E1F9BDEA681A5
01FE996B78EF529B976B2F78E48D5F2B
ECFDBE4744369BC8889AEC72B2FD4685
0666D3BE61B21A85AB145240E4D4374A
7FFEFF13A77076B6C9297E3BF0DB6A64
B39B6175B86EAE1DDB02AEECA452C931
506D31BE5B1129A9883117A90BF579EA
0AD2DE86EFBB8E7C8275CC6E01B4296D
90F567B310DA64E0A356018C25D11241
71A21254346E24B2DD883480618DBC01
</pre>


=== SCE WaterMark Internal (Not Used) ===
=== texture.enc key ===


Exponent: 0x10001
    5B27B12FCB513F79A3B610D912B09CF5


==== P ====
=== texture.enc iv ===


<pre>
    72D859C6642BE65CF0BE141B84B93AA8
E2946A07650E5C657AC662EB1A6DD6DF
E44618AF35247EEF5E54559F581DBEAD
1AC2CF038ABF663344366F76E323F382
1A3F3699C972664E636E1373130E8AA3
71721B530CA58B8EA30E338AD1827FAC
8147AFE207B116CCEC9EB9D9C5A8D48F
788A98CE6B5E2A99FE27F7197A5D6548
93C84D4292F394C1A4CD6D09FF06F7E5
</pre>


==== Q ====
=== MCX.BIN key ===


<pre>
    81D9CCE971A9499B04ADDC48307F0792
D369EC809646C3D07EBA35124F20FA33
 
D7ADC2E1C1A31D5909533F88CEEE6AD3
=== MCX.BIN iv ===
BF0FDFAFE67165DAF7229CA4F230CB7C
 
2C7D4525A942637ABCB843A8C2388B27
    13C2E7694BEC696D52CF00092AC1F272
88848689DA3423A0D9CA8837A7BC1D9D
D5A89374689B77BC53C0FFB196A2A0F3
1D81E81F302A544C18942A44F08B8CF9
36D66ACA38512B5C5550AE178887151B
</pre>


==== DP ====
== PSM Keys ==


<pre>
=== PSM PKG HMAC Key ===
2FB4FE2A366DF2A86F546C2982741425
2A24543837E14A54CE30C5A27A6430EC
B3D0C6D3C11811C5C39C0E9622B74423
65B15FA6BBD2B995D1BBB09EAF2985A9
6A4E9350463E69070C70060C3996D799
13D36B461546853D7AA8E50AE4626AF7
1673603F3E3E228C30066C31D220EE1D
7CF854C42ABADCDC74FDC7F2ADDEE2BD
</pre>


==== DQ ====
    5AE4E16B214290E14366E5B653C4E3C3
    E69E4956510EADD66ACB37A077E0686E
    086F8BAB5030E3D82407F01B676CB803
    7DF20D1420C08A91A2141A3FE5DC063C


<pre>
used to calculate PSM PKG URL
47054E6DE40DE1BA28D864FBC1995274
180047778F953C46ACDB4A7CAB076CDB
B5539FD17798A09EEE66B238B723AD38
09BA0B809B5BB20F89565D6453DAAAE4
9CF7E83A67131CE4EC451D7D94DB9D17
68AF38D9E24A57EEEC33E9B1BEE8E328
C8C0DB399EF4995CF6E4CF4E598087DB
3090D74F179C2CF4D7B442C7A515BC01
</pre>


==== DinvQ ====
hmacsha1("NPPA00236_00", key) = 87b2fc0108d5197ae7572bda397dd8a81b56839e


<pre>
use last 8 characters for this part: "NPPA00236_00_87B2FC01"
5B917A6768A9912815A0F09D2A8AA77D
 
72F1230A81987BB9452EF03BE0B5B63F
final result: http://psm-pkg.np.dl.playstation.net/psm/np/NPPA/NPPA00236_00_87B2FC01/1.00/NPPA00236_00.pkg
10AA391219D3EA92A3F2330F6899B458
 
DF04818DF79E126E84293595EBC60275
(change domain to zeus.dl.playstation.net to download in current year)
D96FC1D4DEAA024FF59E4187934BCDA2
B11BD26D941E6FC4E979BD12DB197D2A
D6EE300BA0E0A46CF2531B84F5F0102B
B714B9D176C46A8BDF3CFA8CD4DF6EDF
</pre>


==== Modulus ====
=== PSMDA "protected_kconsole_cache.dat" HMAC Key ===


<pre>
    B73966320E286ADC03F05465CA9E2F92388AEE236D43883135BAB0A5BD5043EA
BB1E13963648B5EC36EC4DDD00DD3752
53B47A3FD452BB67F1FB8B0967DDAB08
AA82456200CC9006D27DD00144F36C5C
98EF4A2C53074C654978F49AE82E2589
887E2DF24E748BDB1B2EE222F8C6EC6E
0DF3C32666209882C008D66AEE35F18F
D8A810B886B1A926C3C96906482FAB7B
103EF76900FE7C1DF13041051398CAE8
83B8485069F98CB78CD275C96714DB22
C91CF19B4BE2C77AC228C93DFA0B09DA
ADE4ACFDA26D66DFFD18DDE58895A34C
A6377C2594603FE41E0C5062150761D8
73FB5394D1032FC0929F9ED6C5BE051B
039C6C5BF5D92BEBC3EC83EC06E3CC7B
5EC1BCE445622741CD60BE2DDCF83848
BC86B3EBF987C438320B6DEAD9D4EE27
</pre>


==== Private ====
=== PSMDA "NSXVID-PSS.VT.WW-GLOBAL.xml" RSA Private ===


<pre>
    -----BEGIN PRIVATE KEY-----
57CA38AE5531B008EF8BD6CC45C78459
    MIIEvgIBADANBgkqhkiG9w0BAQEFAASCBKgwggSkAgEAAoIBAQCxl+8fRzDzyWb0
1FE4A126A95B5789E1427F6D1E4A2620
    89L9ssKWMO4IYJATVV/qsGPqL5XtgjqlSY6dV3QHWtdiqm4B9h8cy325+XEORMC8
9EBF18066F118AD1689896AAC1CAE3A0
    oErllSl7yovu956/D5laLLGqRkyFPcNer+DOjO99bDfJTTV1bSHuwc9oo3mJn6AO
5E3086C05D042397B1ED09F653D0B2D3
    WuiY3aguCIYxNgSlDsfavjmCDXa3Q85hFOxJnn7HlM4X6rNxFi9y48LqUrDyWw0L
E03233246822CE2B3289C0975FD914BC
    bs+07bqNLoYHXtMoZcNQHqNmGtIHGx4RuFzZ4hduorjNsmSKHiQSz+ydJgJWtLJO
5DD76C4BEBC687477109B46FDEEB7836
    tC2EM8zj8zStmlDiMTyAqKPHjENp4FBLoF87PISLsbyf4dTdWk35TvnsU/+tGVyH
611419243A2DC88AE378EFC97EBCBEDB
    bVNcEAzvAgMBAAECggEBAKSil//kDIKD/BkrDDc6h9+aHqDPe+EgbVnxCb8pPBFB
B23798A4AF4EB6B4E5A01A21639C6036
    gEKIbVh5oUvMMA38txzEYNVd5AELOH6kyBRVePlajWmAPLddAOJYgK6y7kVPBFMl
0177A834BD946F442BF650F59030FF2F
    Db/yxjJVPxODxjeshtmEQUfIjhGQMvSdcVC9gBFusyFxr41haW7mw+mKHV/uQVbk
28A18A31B6D45463FF8A7701764916C1
    TM/ZnEaN2Zrl7FfCUwXa3qyMrwj01bbAXXEqdM9ZF3UIXCLzihtNDKPAbpcVoQXH
8E7A12B0848146B1FB1120405DD5A848
    fItXVFeHjXqVCOVcKTI1PgElM6Q7VsVsU4pJGOmKy2gFbKqF4eniDK6gdGitbVpp
0D0C0C97DE5C2FC162362FCA01C71AE7
    rlXIrS2P8ZOfT+fSMjLbrr+mJEc2np4LYFlEHcJgtkkCgYEAwMrmf1LasiU/sijh
87C4040DA1D36EFAA318F91960FAB59E
    0fOTV6TXefSrOxnpiq9Qs/oTSZ5USTh5FrunF0dX5Isy4XjYKWfIVwVl9LnAXRqR
76251FE9F34A91DCD2938FAFE2DA2E93
    QTiHkbFon2KMYYyQfDUe4T9kuX6cAqp8WjBaivxs8chErM8rzZns62bR1B9+/IX4
F2B6F53739616158064D1D3546F25B8C
    VIiHA1jfP9eiCl+1lMhhnnNIHX0CgYEA69Ffc2w5UCJ1cHxu8dR9V4otY57vBJFN
8E9AA4D58542F3FDC91793ABD8EA6061
    2Svb8h3kJnO9LfU/RYMeXTgJSklh9Tw/zXPOMEQnxi7LocrDd1713vQTTspT3wWd
</pre>
    3AJ25l0BP3NGnbEtGwv6It+VnUULr964vOUv/bl4UMQs52JsnxURts+GPZ3gAF1S
 
    U2AVxvVej9sCgYBAk7Yhb99RTKjJRGhfqvbvpIeIkivI4CUaDx85KcrMHfydig0F
== PKG HMAC Keys ==
    UFXntj36j6W7YH8HX3v7qhM8pfuJNBzze7vtUT96I8hh5HOBJ0nwqQtUFtSrD/AX
 
    RZsOcv8K/coDGGHTvHtfXlFqfCJM85L6vcB7nokpGVFtqCFqdLQ+Ht9JAQKBgQCU
* present in 0.920 os0 update_service_sm I
    Ao/0dCLs5xPrDE7ePk6FmVavxlui9Eh2XI7qQlSmxdIhfGLAEHIIdFlwZOq076Hk
 
    JCFwLfcA7vIklI1m6RVNYMiVlWxa+L2CD5HtOMbFumbCJyh2Z2gSZ18SnPme4x30
<pre>
    ga1DhRu9JcRBXodqueCqa0qIdgTYdbpsVkyU2gEGLQKBgGotuH/yrXNfifTc6Y24
DBE1A473887A076D204B6CE361EFE4B9
    TSaqk/Dq6OvQOEFSIzgOzaQhWvwZjlz3uOnmi3vUo/guG9q/J1JWucWoXNXkkcmb
C540E10B7EEE29C0A225CDAE10E6134C
    trc3RYwzy6Rn+0uGHGA91e2bn6vT6PLNOgNUE7YCRDJe5DsDYHtUNILNbRVdSvNs
59D6CDA0F426D9F0B4F8C5BAA0EF397B
    rnh1i22Y3zLWChh3swswqgf7
D38FB0F9B9100B4615816B1F6810D651
    -----END PRIVATE KEY-----
 
* Used by the PSM Dev Assistant to sign the NSXVID-PSS.VT.WW-GLOBAL.xml file to prevent from modification.


F8EAFE04E0A66FCDDCD6CD2746DEBBEE
=== PSM Publishing License PKCS12 Import Password ===
81C614EED15E02CFA9D1F87F64AE7597
B38B2AA048A3E0B14DA36904B01E4DAA
C1317E63E6DE80196EBE2D0CC2715494


A6E0B640BEEC23CC82DEDE0A227C5A58
    password
89D238906A7EFE369596A1346F0B3547
2654F43DEE032837601A3246514DF4E2
E109829A60ABD62521EFE0FAC812E6DD


8D814CE4C9C3298346F74079F077A2C8
=== PSM Publishing License PKCS12 PEM Pass Phrase ===
4BA0EA40E7BF55305F24976E2E3F7D97
D37DC6B65149FF8560199FABF74A495E
569EFEB78B4E128F914367C953405C13


5C93D3939B27B2CABD19848FF9075E81
    password
00C92BBC9D4B5D1A4D135ADDE1FBD71B
66B724BDBA101D6A3057234895393610
91ED466F251A38EE90825F6287DC8C77


C7939B509967CE44A815F3D3A69F3BCA
* PKCS12 certificate used in signing PSM Dev PSSE with PSM SDK.
24080619F39B8B0D3EC22BFBE584D7C2
B7124FD11B94F8004AD477AE689D0C1D
B3B4E59E880163B279C83671F22FD285


7721C65140A2CA799F366C7275C09F9D
(World's most secure passwords ever, impossible to crack xD)   
A03F12CC9D71C4BE21209167D403E834
You can use openssl like so:   
9A831933A1D109D24DC850246D39EEEC
    openssl pkcs12 -in <filename> -password pass:password -passout pass:password
CA64137119A95F5FB57E0EC310C2A73E
to view the keystore of a PSM Publishing License


AF92C200B8EBCA305C1D1273B636F912
=== 'psm.pub' strong name signatures public key ===
B23247A4C573A69BA525D3AD5177F3EE
    00240000048000009400000006020000002400005253413100040000110000009133D396CA929938BC68440B541D8888614E7BD475B
C45764EF426B6DA37AB25C37D5EE99AB
    EF719AB4F4B85B1C21FC3EF2B5F32DF0DE7C769CA90687650DA49EEBE7ADCB71479F1463E10902CB65A1F44FA2E71B3F30E108FE0F6
7ABDFCC9ED82C94C3016EDD295872061
    699D179DAED5B1A774DB1ABA104C59118544B47CDA724AEA8E6899FA760DFE0BA8656515B48AE94FDE29FC8F5BD569126C7A9AE6F3


C80EAAB7E368851BCC3319D806D5B5E6
=== SCE_PSM_KDBG_ACCOUNT_KEY ===
AF613993B86F437AF05528219C549256
AC26FE362692EC55152E706CBB078A7A
0B35A20425BD8A18C581622359EEF7AE


B68C19699474A019CA7BAE575B1F5B7C
    965895DF95F5432CCBCC4B7823CBF4B3
6DD7A4C115B208666A9A93418DA224B7
A202B21059BEA357A96B5A6D7AF01E9E
97CF303CA1207F58743E83CED77700BF
</pre>


== KIRK command 7 New Keys ==
=== SCE_PSM_KDBG_ACCOUNT_IV ===


<pre>
    00000000000000000000000000000000
kirk7_key80 = 83FFF149A687A5C5CD95779352C8BF66
kirk7_key81 = D83D2D277CE2DE154A4E2AA6D1E8D20B
kirk7_key82 = 4C5C71519F62A5FE5EF36D4B075BE2F3
kirk7_key83 = 8005EF43124F650A9DF158F72A509C10
kirk7_keyC0 = BF57AEF02DC587F327C8C3F8BDECA5EE
kirk7_keyC1 = 9FFF2EECED8476D900DFD579E1AAAB63
kirk7_keyC2 = 04460D61F563D46C0C4EB9AAE5466E84
kirk7_keyC3 = 1E5B17DAC321E6B8DFE7718CA2930370
</pre>


== IdStorage Keys ==
=== SCE_PSM_KDBG_C1_KEY ===


=== PS Vita IdStorage leaves 0-0x7D RSA2048 Public Key ===
    965895DF95F5432CCBCC4B7823CBF4B3


<pre>
=== SCE_PSM_KDBG_C1_IV ===
E9 18 F0 8E F8 D1 ED 4A 5E 80 65 44 15 5D AF 3E
99 CD 65 65 5C 5D FE BC BA 59 A4 AB 52 81 63 53
B1 DC 9C 0E BB 70 F7 48 57 47 9C 4C 49 00 8E E4
F7 55 93 14 71 67 DF 9C 92 8E D8 42 4A 10 75 50
D0 9F 6A 48 57 9A E3 86 BF 6B A3 0C 73 57 00 DC
F7 CB 2B B3 7C 03 11 CC EC D9 0F BA A1 2E E5 EE
5C D3 10 D5 0F 1D 58 C1 23 8B CD 7B 9E E6 2C 7F
4C AE 11 01 8C A5 AE F0 D5 C2 8D 5E E9 F6 6F 1E
37 8B B4 BD BC C0 2F 3D 3D 6E F8 E6 35 EF B6 C2
EF 82 ED AD 07 16 5A 4D A4 AB 83 76 14 9D 6F 29
6D AD DA 83 CF 0D F3 9F 9C 6B AC 79 61 B6 6F 32
60 34 99 B4 C3 9C 94 D7 1A 29 8A B4 12 D8 42 F9
69 C3 0E 47 EF 86 FD 35 E5 CD 23 E8 95 B3 E1 A3
D6 E9 CA 90 8F 46 59 FE BC B3 00 C0 9C E7 34 07
5A 7F 85 2A 5B AD 82 B8 52 85 74 6F 73 45 C2 5F
4B 7A 8D 85 70 8B 6C FD AA 59 70 BF 33 00 79 D5
</pre>


* Exponent is 65537.
    00000000000000000000000000000000
* Found in PS Vita factTest.self.
* Signature is stored in PS Vita IdStorage leaf 0x7E offset 0x60.
* PSP IdStorage does not have this signature.
* This signature does not seem to be checked on console boot. It might be used only during manufacturing/servicing to ensure that IdStorage leaves 0-0x7D have been written correctly. This implies that IdStorage leaves 0-0x7D are not meant to be edited after manufacturing, contrarly to some other leaves.


== IdStorage Certificate Keys ==
=== SCE_PSM_KDBG_CONSOLE_KEY ===
 
=== IdStorage Certificates ECDSA Public Keys (160 bit) ===
 
==== PSP Certificates ====
 
<pre>
4004C80BD9C8BA38221065923E324B5F0EC165ED6CFF7D9F2C420B84DFDA6E96C0AEE29927BCAF1E Sec.0 PSP IDPS
06485FD029853B552F7EFDD67A2DE7A1A4E25537B2459D8786426D5B27EFA5A9311CB8ABABFA0ECE Sec.1 PSP IDPS
3F8C34F210AEC48E1520FF2A44899E054A0DA33DF8B9754B09C0EC7E61867A5126FE6926972196F5 Sec.2 PSP IDPS
CCB3440DC4836DD519E13B2805B30870DCAEE462136B3888651A98E02B29FA0CD34F1616F1ED5786 Sec.3 PSP IDPS
08B336925C2B445D03A9BE51B9AABF54E4CC142EA72A23BB8060B03B71CDE0772DE82AD8931648D6 Sec.4 PSP IDPS
4F0A2BC9987640860E22EE5D86087C9692470BDF59DC4C1F2E38F92CE7B66875B59ED10C9D84FA6A Sec.5 PSP PSID
</pre>
 
==== PS3 Certificates ====
 
<pre>
94D100BE6E24991D65D93F3DA938858CEC2D133051F47DB4287AC86631719B31573EF7CCE071CA8A Sec.0 PS3 IDPS
071984A1F27D1E91196410D57C828AF7115BF1A32071AA1EC25B7FBF4884F5322A26483C46D8B43C Sec.1 PS3 IDPS
1B6389CECD99843CA088E325C796F510A151C1545C5DE4E37A1D892D2504A8604C094F59063D589F Sec.2 PS3 IDPS
17BE639B87F138049D94398E8929DE535D1CB0DC5E7C04D720D2F3DE86F9B581DD1B6F7CDCF80DE4 Sec.4 PS3 IDPS
4B4F044420207907E3BC7D5423FF4D05E9DAA10B1F973327F7FEDEAE498BC656FF7C7459C9B993F4 Sec.5 PS3 IDPS
1F960A3BD61462553A0DC015AEC66C818CBAA8F62F733AC9F0C287D496F321058AC26669ECBED3DB Sec.6 PS3 PSID
</pre>
 
=== IdStorage Certificates ECDSA Public Keys (224 bit) ===
 
==== PS Vita Certificates ====
 
<pre>
1A9146C3AB04FBA1C32027C47C7906947CC2AB1E247AF59A8D714AF44CA559E78A2C164A77DAD5A878F516E4D905D810C73C39E70EA93198 Sec.0 PS Vita IDPS
A17772FD3E86091EAE2B246D5E05CE80A8E24A03C6764D26CD2443AE3DD656F919A10F87C67CB2AE280D0751E15ECD3C4FDFC9D71D7F067C Sec.1 PS Vita IDPS
056891AE27047A7D5DE88C57612E1A7D0A7CCD369E8CF2F8F374FEA34155B20B613236C2BDFFE8187AC09C7EDF194D81A440BEB91DC6F257 Sec.2 PS Vita IDPS
6B0AB6A5570334E8B559CC06BA811618ADD2A1EC587A98D35A04E8B98B1D5903711469EE3049B06E1EC81EEB72A9E181D5920B453CF2C21F Sec.3 PS Vita IDPS
1C1816019AE3F8955021892257535F0E92D988E11EA45C2E908E2E208C10F3D7F3ED189EEFC027C8A91B6770A727402423CE976A3435FF8A Sec.4 PS Vita IDPS
108464CCDB76611475AEA911FBD1D476FF41F1C70D811031C552DB9B85E9941A3FD79644B717E0FEE48C4CF7387CF10E900BDBC2D7A35F5D Sec.5 PS Vita PSID
</pre>
 
== GC Auth Mgr ECDSA Keys ==
 
=== 160 bit Curve ===
 
<pre>
p=FFFFFFFFFFFFFFFF00000001FFFFFFFFFFFFFFFF
a=FFFFFFFFFFFFFFFF00000001FFFFFFFFFFFFFFFC
b=A68BEDC33418029C1D3CE33B9A321FCCBB9E0F0B
N=FFFFFFFFFFFFFFFEFFFFB5AE3C523E63944F2127
Gx=128EC4256487FD8FDF64E2437BC0A1F6D5AFDE2C
Gy=5958557EB1DB001260425524DBC379D5AC5F4ADF
</pre>
 
=== 160 bit Public Key ===
 
<pre>
Qx:55D73E67B84E15B2F28C3B1F6C9DCE2911E3B4ED
Qy:0333EEDA263BC89B7696AB5C6B69E18BF1785A80
</pre>
 
=== 160 bit Private Key ===
 
<pre>
53CCC36EDFADBE245583270552D23B22518EE3A8
</pre>
 
* Seen on FW 3.70.
* Used by Kirk command 0x21 (related to new PS Vita NPDRM PKG files).
 
=== 224 bit Curve ===
 
<pre>
p=A53E113E46D8C9C1F09D9BCB2A5373D379F69DA28D09999FED57A90F
a=A53E113E46D8C9C1F09D9BCB2A5373D379F69DA28D09999FED57A90C
b=9065941D29374A8F11DD1E540189434E4A6EBFAF5477F6C172F6855E
N=A53E113E46D8C9C1F09D9BCB2A522698DEEF58DB1AD9AB7F04E3AE7F
Gx=7E06098247E6B59F3110BCBB3AB6C250BC5AB06C032DAD43684C248F
Gy=0BD9418DE8E3E45D2D701E0237FD7F2ADE0D48B74CEEF2F1C8AC484E
</pre>
 
=== 224 bit Public Key ===
 
<pre>
Qx:5F9D171A2BDDA8D40878BF985AC326ED5EFF43C9376C77EC0A00C7BB
Qy:A344E44E6EAC255235F954F5B617C7BD49F180262454AAE1B62A9F2C
</pre>
 
<pre>
Qx:67002D9BB8E42D2BF9610B27FEAB9B34561550921312DFEE7A3A86EC
Qy:6CA714426F6D4E9609A638BF4AFB182BFA50C82FF2B4C5EC6CCD9765
</pre>
 
=== 224 bit Private Key ===
 
<pre>
767436A6999D88480EC856F55CEABB4396859E374599403921F55598
</pre>
 
* Seen on FW 1.50.
* Used by Kirk command 0x22.
 
<pre>
607A2E5568B4B9A032F45253CFED20DB2E6E446C3782E82A1AB9C923
</pre>
 
* Seen on FW 3.70.
* Used by Kirk command 0x22.
 
== MSIF Key / Memory Card Auth Key ==
    D419A2EB9D61A52F4FA28B27E32FCDD7E0048D443D63C92C0B27135541D92EC4
 
== PocketStation Keys ==
 
=== texture.enc key ===
 
    5B27B12FCB513F79A3B610D912B09CF5
 
=== texture.enc iv ===
 
    72D859C6642BE65CF0BE141B84B93AA8
 
=== MCX.BIN key ===
 
    81D9CCE971A9499B04ADDC48307F0792
 
=== MCX.BIN iv ===
 
    13C2E7694BEC696D52CF00092AC1F272
 
== PSM Keys ==
 
=== Update HMAC Key ===
 
    5AE4E16B214290E14366E5B653C4E3C3E69E4956510EADD66ACB37A077E0686E
    086F8BAB5030E3D82407F01B676CB8037DF20D1420C08A91A2141A3FE5DC063C
 
how to calculate update URL:
 
HmacSha1("NPPA00236_00", hmackey) => 87b2fc0108d5197ae7572bda397dd8a81b56839e
 
append first 8 characters of hex encoded hmac; like such: "NPPA00236_00_87B2FC01"
 
update xml is => http://psm-pkg.np.dl.playstation.net/psm/np/NPPA/NPPA00236_00_87B2FC01/version.xml
 
you can get the PKG for any PSM application like so:
 
take "appVersion" from version.xml => "1.00"
 
build PKG link using version => http://psm-pkg.np.dl.playstation.net/psm/np/NPPA/NPPA00236_00_87B2FC01/1.00/NPPA00236_00.pkg
 
you can also get screenshots and description of the application; using /metadata.xml; for example;
 
http://psm-pkg.np.dl.playstation.net/psm/np/NPPA/NPPA00236_00_87B2FC01/1.00/metadata.xml
 
(note; you have to change the domain to zeus.dl.playstation.net as sony removed the "psm-pkg.np.dl.playstation.net" subdomain awhile ago)
 
=== 'psm.pub' strong name public key ===
Used for verifying strong name signature of runtime's Mono/.NET assemblies;
    00240000048000009400000006020000002400005253413100040000110000009133D396CA929938BC68440B541D8888614E7BD475B
    EF719AB4F4B85B1C21FC3EF2B5F32DF0DE7C769CA90687650DA49EEBE7ADCB71479F1463E10902CB65A1F44FA2E71B3F30E108FE0F6
    699D179DAED5B1A774DB1ABA104C59118544B47CDA724AEA8E6899FA760DFE0BA8656515B48AE94FDE29FC8F5BD569126C7A9AE6F3
 
 
=== PSM Developer Assistant ===
Keys used in the PlayStation Mobile Development Assistant and PlayStation Mobile Development Assistant for Unity applications
 
==== "protected_kconsole_cache.dat" HMAC Key ====
 
    B73966320E286ADC03F05465CA9E2F92388AEE236D43883135BAB0A5BD5043EA
 
==== "NSXVID-PSS.VT.WW-GLOBAL.xml" RSA Private ====
<pre>
    -----BEGIN PRIVATE KEY-----
    MIIEvgIBADANBgkqhkiG9w0BAQEFAASCBKgwggSkAgEAAoIBAQCxl+8fRzDzyWb0
    89L9ssKWMO4IYJATVV/qsGPqL5XtgjqlSY6dV3QHWtdiqm4B9h8cy325+XEORMC8
    oErllSl7yovu956/D5laLLGqRkyFPcNer+DOjO99bDfJTTV1bSHuwc9oo3mJn6AO
    WuiY3aguCIYxNgSlDsfavjmCDXa3Q85hFOxJnn7HlM4X6rNxFi9y48LqUrDyWw0L
    bs+07bqNLoYHXtMoZcNQHqNmGtIHGx4RuFzZ4hduorjNsmSKHiQSz+ydJgJWtLJO
    tC2EM8zj8zStmlDiMTyAqKPHjENp4FBLoF87PISLsbyf4dTdWk35TvnsU/+tGVyH
    bVNcEAzvAgMBAAECggEBAKSil//kDIKD/BkrDDc6h9+aHqDPe+EgbVnxCb8pPBFB
    gEKIbVh5oUvMMA38txzEYNVd5AELOH6kyBRVePlajWmAPLddAOJYgK6y7kVPBFMl
    Db/yxjJVPxODxjeshtmEQUfIjhGQMvSdcVC9gBFusyFxr41haW7mw+mKHV/uQVbk
    TM/ZnEaN2Zrl7FfCUwXa3qyMrwj01bbAXXEqdM9ZF3UIXCLzihtNDKPAbpcVoQXH
    fItXVFeHjXqVCOVcKTI1PgElM6Q7VsVsU4pJGOmKy2gFbKqF4eniDK6gdGitbVpp
    rlXIrS2P8ZOfT+fSMjLbrr+mJEc2np4LYFlEHcJgtkkCgYEAwMrmf1LasiU/sijh
    0fOTV6TXefSrOxnpiq9Qs/oTSZ5USTh5FrunF0dX5Isy4XjYKWfIVwVl9LnAXRqR
    QTiHkbFon2KMYYyQfDUe4T9kuX6cAqp8WjBaivxs8chErM8rzZns62bR1B9+/IX4
    VIiHA1jfP9eiCl+1lMhhnnNIHX0CgYEA69Ffc2w5UCJ1cHxu8dR9V4otY57vBJFN
    2Svb8h3kJnO9LfU/RYMeXTgJSklh9Tw/zXPOMEQnxi7LocrDd1713vQTTspT3wWd
    3AJ25l0BP3NGnbEtGwv6It+VnUULr964vOUv/bl4UMQs52JsnxURts+GPZ3gAF1S
    U2AVxvVej9sCgYBAk7Yhb99RTKjJRGhfqvbvpIeIkivI4CUaDx85KcrMHfydig0F
    UFXntj36j6W7YH8HX3v7qhM8pfuJNBzze7vtUT96I8hh5HOBJ0nwqQtUFtSrD/AX
    RZsOcv8K/coDGGHTvHtfXlFqfCJM85L6vcB7nokpGVFtqCFqdLQ+Ht9JAQKBgQCU
    Ao/0dCLs5xPrDE7ePk6FmVavxlui9Eh2XI7qQlSmxdIhfGLAEHIIdFlwZOq076Hk
    JCFwLfcA7vIklI1m6RVNYMiVlWxa+L2CD5HtOMbFumbCJyh2Z2gSZ18SnPme4x30
    ga1DhRu9JcRBXodqueCqa0qIdgTYdbpsVkyU2gEGLQKBgGotuH/yrXNfifTc6Y24
    TSaqk/Dq6OvQOEFSIzgOzaQhWvwZjlz3uOnmi3vUo/guG9q/J1JWucWoXNXkkcmb
    trc3RYwzy6Rn+0uGHGA91e2bn6vT6PLNOgNUE7YCRDJe5DsDYHtUNILNbRVdSvNs
    rnh1i22Y3zLWChh3swswqgf7
    -----END PRIVATE KEY-----
</pre>


* Used by the PSM Dev Assistant to sign the NSXVID-PSS.VT.WW-GLOBAL.xml file to prevent from modification.
    8235EDC66CD14D04F793369A74C7A4FE


==== Publishing License PKCS12 Import Password ====
=== SCE_PSM_KDBG_CONSOLE_IV ===


     password
     00000000000000000000000000000000


==== Publishing License PKCS12 PEM Pass Phrase ====
=== SCE_PSM_KDBG_LOGINFO_KEY ===


     password
     B293993BB5977F88844A7D21DDF63BC7


* PKCS12 certificate used in signing PSM Dev PSSE with PSM SDK.
=== SCE_PSM_KDBG_LOGINFO_IV ===
(World's most secure passwords ever, impossible to crack)   
 
You can use openssl like so:   
    openssl pkcs12 -in <filename> -password pass:password -passout pass:password
to view the private and public keys of a PSM Publishing license.
 
=== PSM Android ===
These keys are labeled within the debug symbols of the Android version of PSM.
 
==== SCE_PSM_KDBG_ACCOUNT_KEY ====
 
    965895DF95F5432CCBCC4B7823CBF4B3
 
==== SCE_PSM_KDBG_ACCOUNT_IV ====  


     00000000000000000000000000000000
     00000000000000000000000000000000


==== SCE_PSM_KDBG_C1_KEY ====  
=== SCE_PSM_KDBG_V1_KEY ===


     965895DF95F5432CCBCC4B7823CBF4B3
     14E5A03B1E62D483F88769986EDB1140
 
==== SCE_PSM_KDBG_C1_IV ====
 
    00000000000000000000000000000000
 
==== SCE_PSM_KDBG_CONSOLE_KEY ====


    8235EDC66CD14D04F793369A74C7A4FE
=== SCE_PSM_KDBG_V1_IV ===
 
==== SCE_PSM_KDBG_CONSOLE_IV ====  


     00000000000000000000000000000000
     00000000000000000000000000000000


==== SCE_PSM_KDBG_LOGINFO_KEY ====
=== SCE_PSM_HEADER_SIGNATURE_PUB_KEY ===
 
    B293993BB5977F88844A7D21DDF63BC7
 
==== SCE_PSM_KDBG_LOGINFO_IV ====  


     00000000000000000000000000000000
     3082010A0282010100A98F6B27F5AFF0F96C7411A337DFCF723C37BEF6FF6552B
    8E5A3EEE3672CF0366EA0442B7913018C7355C0F2336DE496DCADE8BF5A32D1DB
    25705D5A9A11C06FFF6801776BFF871FDDDC4EA4CAF49886E02D4835B3DCC9674
    457E4E66744CB997155271C211E2FAE0ECEA5FABD91719766C488860072E81CCC
    7B5DFEA0907D25E60CCB28500D3FDC9CC244DBBAED7A41FDA571C27D87E92B17E
    34B0289329EB0FEFED4682F1679D89FF00D2A78F78B8A05A9B4D7306E992AAE7B
    7A0E9ADDF4F4BC286E1E52A80AB2DF31012B18B996670446F07AF2307A7FFCBC4
    5ADB3B815B659536A7AADA813FD303156C792E28157001DC7BB9AF93A59A607E4
    F2EE34F88702030100010000


==== SCE_PSM_KDBG_V1_KEY ====  
=== SCE_PSM_WHOLE_SIGNATURE_PUB_KEY ===


     14E5A03B1E62D483F88769986EDB1140
     3082010A0282010100D452C18752BDE6289ACEB862AD32145322C13EEC82F5675
    E9DA96B51CCAA68488F2B5E09E1C1DEFE7A27ECB5EACF473A9D15171F43EE32DA
    03E7BA07182B408540C37CD8AA357F4DCD12295AD3901D6A0D6D41665BA7084B1
    A98DFE15A1F0B3A2A4B4D0A00A1CD8BA5B09E80BC4E2C588357C0F2E285C05055
    6DC971A43FEA4C056CF2DFD8BB2EE975F67F76878E1FB01E7A23F87FD5732864D
    D62B2C3FFD4BCF184923A3706819467723AA508FC53E80F6E5A57CF3E7B1BB0A3
    988037656CBB2FC70BDF344B5683E4943D08C609D44DFDAE90C5300C5CDE7C2D8
    9035B20FC189F9DBC34BEB6478D6B32183FB886133B04C1962EEEDA7FFD47DB80
    655F4CDE0F02030100010000


==== SCE_PSM_KDBG_V1_IV ====
=== internalKey (KeyStore) ===
 
    00000000000000000000000000000000
 
==== internalKey (KeyStore) ====  


     534B4257020000000000000010000000002F27E9ECD4606C3CE0BCFE99E2AE5EB
     534B4257020000000000000010000000002F27E9ECD4606C3CE0BCFE99E2AE5EB
Line 2,879: Line 2,098:
     E83746A9819C60AB7ED23B8D7685612A831C41000000
     E83746A9819C60AB7ED23B8D7685612A831C41000000


==== internalIcvKey (KeyStore) ====  
=== internalIcvKey (KeyStore) ===


     534B4257020000000000000010000000002F27E9ECD4606C3CE0BCFE99E2AE5EB
     534B4257020000000000000010000000002F27E9ECD4606C3CE0BCFE99E2AE5EB
Line 2,886: Line 2,105:
     C026F69D7A98767567BF04C95074B4C00000000000000000000000000000000BB
     C026F69D7A98767567BF04C95074B4C00000000000000000000000000000000BB
     6E2E9E14AB8D04309918ABD4186B5798F48C78000000
     6E2E9E14AB8D04309918ABD4186B5798F48C78000000
=== PSSE (PlayStation Suite Encryption) ===
PSSE is the encryption of PSM application files,
the whole game is encrypted and signed, PSSE serves a similar function as PFS for the PSVita.
==== RSA Keys ====
These are used to verify the signature of PSSE files, signature is SHA256 hash,
there are two keys one used to sign the header, and another used to sign the whole contents of the file.
the names of these keys were taken from export symbols from libdefault.so from the android version.
Sony, in their infinite wisdom and mysterious ways. decided to include the PRIVATE KEYS for signing RETAIL PlayStation Mobile games, in psm_encryptor64.dll.
===== PSSE Header Public Key (SCE_PSM_HEADER_SIGNATURE_PUB_KEY) =====
<pre>
-----BEGIN PUBLIC KEY-----
MIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAqY9rJ/Wv8PlsdBGjN9/P
cjw3vvb/ZVK45aPu42cs8DZuoEQreRMBjHNVwPIzbeSW3K3ov1oy0dslcF1amhHA
b/9oAXdr/4cf3dxOpMr0mIbgLUg1s9zJZ0RX5OZnRMuZcVUnHCEeL64OzqX6vZFx
l2bEiIYAcugczHtd/qCQfSXmDMsoUA0/3JzCRNu67XpB/aVxwn2H6SsX40sCiTKe
sP7+1GgvFnnYn/ANKnj3i4oFqbTXMG6ZKq57eg6a3fT0vChuHlKoCrLfMQErGLmW
ZwRG8HryMHp//LxFrbO4FbZZU2p6ragT/TAxVseS4oFXAB3Hu5r5OlmmB+Ty7jT4
hwIDAQAB
-----END PUBLIC KEY-----
</pre>
===== PSSE Entire File Public Key (SCE_PSM_WHOLE_SIGNATURE_PUB_KEY) =====
<pre>
-----BEGIN PUBLIC KEY-----
MIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEA1FLBh1K95iiazrhirTIU
UyLBPuyC9WdenalrUcyqaEiPK14J4cHe/non7LXqz0c6nRUXH0PuMtoD57oHGCtA
hUDDfNiqNX9NzRIpWtOQHWoNbUFmW6cISxqY3+FaHws6KktNCgChzYulsJ6AvE4s
WINXwPLihcBQVW3JcaQ/6kwFbPLf2Lsu6XX2f3aHjh+wHnoj+H/Vcyhk3WKyw//U
vPGEkjo3BoGUZ3I6pQj8U+gPblpXzz57G7CjmIA3ZWy7L8cL3zRLVoPklD0IxgnU
Tf2ukMUwDFzefC2JA1sg/Bifnbw0vrZHjWsyGD+4hhM7BMGWLu7af/1H24BlX0ze
DwIDAQAB
-----END PUBLIC KEY-----
</pre>
===== PSSE Header Private Key (SCE_PSM_HEADER_SIGNATURE_PRIV_KEY) =====
<pre>
-----BEGIN PRIVATE KEY-----
MIIEwAIBADANBgkqhkiG9w0BAQEFAASCBKowggSmAgEAAoIBAQCpj2sn9a/w+Wx0
EaM3389yPDe+9v9lUrjlo+7jZyzwNm6gRCt5EwGMc1XA8jNt5Jbcrei/WjLR2yVw
XVqaEcBv/2gBd2v/hx/d3E6kyvSYhuAtSDWz3MlnRFfk5mdEy5lxVSccIR4vrg7O
pfq9kXGXZsSIhgBy6BzMe13+oJB9JeYMyyhQDT/cnMJE27rtekH9pXHCfYfpKxfj
SwKJMp6w/v7UaC8Wedif8A0qePeLigWptNcwbpkqrnt6Dprd9PS8KG4eUqgKst8x
ASsYuZZnBEbwevIwen/8vEWts7gVtllTanqtqBP9MDFWx5LigVcAHce7mvk6WaYH
5PLuNPiHAgMBAAECggEBAJcvhMkdfOItU7FuZI0WZz6hSMdiLrjmeGxxrjhfL6eD
sUH/Zo/PDYtw7x5aFtc+gfGEs0mjIDsT3p8A7h8AAwkZv1/HXql5j0VgAVNYj51M
baiSgSe9jmsgegpkEeI6c7ekyHmBYgv7c8J4JklO3Oy1OjnM2aubIMqGmXnHKu4a
H/viUYE+WhJF9h+F5FXMXqF3AFvlWE97Y1ISehWRJOFWgBX3rVBIp79q28lBV6aj
6gI5p2WvaUzrSwFBjpzhEAdb5DPiWio2zCBBDu8e40fUK6OnMv3dXK9NOynjYQik
DpS0yrjUWYNxhh1EL8igXVl8Al2uRTVwDeELJE6CSFkCgYEA1vWBMZkElvI+2XdE
YsyL89vZXxGm1VjR4INkihE1no2oDmQ/FwqH64+Tq/vaeGc+AvHXbW2dKRRiJ2R7
25tSMEEPAcOkYZ3fWDQs0H5QK3U6T1hfQQz2OMEnHHWmR8fFa0537wYoOn5v1ewu
cd7w8s+aSHGrO5kdgztbMRUAnVUCgYEAye74R4uP+y6u2Y4o2DKpbR59vP7ogm5o
BTX7/3DWbKf2RsDv8GLfJ1EgPvmqi20OslKzqPsWc2bq/R/qBlJRDODcK8IgGJJd
3xMqxpwn+3opPv/0X+X8I2TOwVDWY2BQezxG66RrV0bvCJUj3lz5Ubu4gLkFZov+
tr0Gbsh2XmsCgYEAtPjV/vKrmYVzAlTV/zPkM7cIx3At+/oeIB2enFqmwMjUDuG4
9+YGznv/QFD1+l45J/OBggBByx79D9saJ6YZSMTNJJgYoZJvQWwTuqhNSHkWUUy+
TR7jgJ6lFeG6zz3R6GiUsmiFn9FoyDpiU731Lwc3Bfykw7VB0oU7XhQng00CgYEA
lbQuKIxU37jKM8tqiG12ocj7GsQ4B4pmX4aYHdW/gao7sFSVDTefjHxeVZGuV9Mw
FA+v1dTf3gosqB+i1bDtGYkScPZn6Q+JvDlvevKFya/VKDmFKBtOg8bWaQbPCbl7
sQEM6uFoGroht9EpWE7BH1D2BaglUtLysPMN8891waUCgYEAkMo3Xr4EfEPrpl6M
ujCY3o6Oxy5dBxV96KBRgbXZmV0rFpFgY4dNa8Dk3/RgYIlYCyxQem4Y4YVfm3VJ
xMrhotEFrigdV2eV/VtzgmNUl4SyUfqZmRYrT+dFLjmwbU5UcNnRC0/3KxbxPssn
l86n/Xiav/RPd9Pa/ezirx/jFb8=
-----END PRIVATE KEY-----
</pre>
===== PSSE Entire File Private Key (SCE_PSM_WHOLE_SIGNATURE_PRIV_KEY) =====
<pre>
-----BEGIN PRIVATE KEY-----
MIIEvgIBADANBgkqhkiG9w0BAQEFAASCBKgwggSkAgEAAoIBAQDUUsGHUr3mKJrO
uGKtMhRTIsE+7IL1Z16dqWtRzKpoSI8rXgnhwd7+eifsterPRzqdFRcfQ+4y2gPn
ugcYK0CFQMN82Ko1f03NEila05Adag1tQWZbpwhLGpjf4VofCzoqS00KAKHNi6Ww
noC8TixYg1fA8uKFwFBVbclxpD/qTAVs8t/Yuy7pdfZ/doeOH7AeeiP4f9VzKGTd
YrLD/9S88YSSOjcGgZRncjqlCPxT6A9uWlfPPnsbsKOYgDdlbLsvxwvfNEtWg+SU
PQjGCdRN/a6QxTAMXN58LYkDWyD8GJ+dvDS+tkeNazIYP7iGEzsEwZYu7tp//Ufb
gGVfTN4PAgMBAAECggEASnCNO2WOAKChzfIlXnWdXJxlxirjqyhHqt0YLECmShOO
ZnT83/K5vNyVHM+W+H8PlL0tMx/85kU7c0XscNPRNibDowTPgBwW6dwBNb/Q2g8x
j+mK+n0wUiyMBooar6GfDe8CnowkLk1UlPytQ9fgglPiM1q0gpIvWBQ6uSYN5pWG
72nL7MhJnpFg3hXH7NAZaD9vYeGZkK04cmqBSrgEQuhKvjajZHJXHHabwXQVz5Zh
NkwxThRz8bbfsnxRfYoTPWtqWUQtPZn7e9PxegeSnrQRAYL4EjtyT3UERGEpWqM/
qHW/ctT1SxURvt9uncvALHIFWsV3mkzdOozBjUZxIQKBgQD0++NJX5t3546AP6GC
RYl1LYw8+s3vBuTgYhn0ustYXAmMrgNFQ7FkeIxhp8h24ZlrSdxTlos2qKParURC
aln+HtziPsoCwxun2j3nDObURxVUtS5MK0rR4adOYrS1b8+izujvqZQvq9TWWGiQ
EEbQ3slzaXAbNvZWpYHybLFtfwKBgQDd3uXFCdnAn812uSgab021D2GIoSRdGZLG
/VzSnKkMm2pfjAwNv2gpy98xk0OVDzvyplIOZt+nuBAZtq3hPU22nugjLd+4oQ2Z
e3cfhHhNzaHcisHvSTGkBMn+wmpZArl4NxscnCGReAF224Ofy4dhu/dV+v+6pE4K
uHNpgqr3cQKBgQCRjd76xz09vmxiMmwpVFtZLZi22mTkcXom/uJhD2KluvlJhlIX
IyMQiLcPhnqKd3uJzTaEy1snPIct8+gsdbfGTlv6aEfp4DZcQkSpNHcpBJrd21AI
nWg0zxdycR7g9e+t0bWAP4b10+f++kQV5DXO/689TRX4dW1jCa7tdDruzQKBgEAS
lKw4UggMnhtBEVHA/uHg1TvNvWCdeAO7O0kfMLqRT0DUgs6djgkz9PquGoA7bAaA
/YVnNAONZijm1oQLXhv0+/jc0JTS/chrHVWevddKIQo9kA/4RTumnmbR4kBeRw1u
bIfwlskZrOKUNgi5kBkrXRwZZiySMm9qIPpBX/ohAoGBAOY9GZhur29tbaE81738
rrKWiu2cGs/2Iwc99bCuDzsXgY8Tt3wWjKBBIrUJxXBchdnEansfgOZFas2RGxMQ
dlVUf7ferhDzjMWh/Sqa6Fvh/Pq/CbScqeTfcHmI4gAwiRjJKfdDPL+YhwunBRki
3QAlUBmd5ByB6xFtHm+QDaap
-----END PRIVATE KEY-----
</pre>
==== AES Keys ====
used mostly just for encrypting the data in PSSE.


===== Header IV =====
=== PSSE Header IV ===


     000102030405060708090A0B0C0D0E0F
     000102030405060708090A0B0C0D0E0F


===== Header Key =====  
=== PSSE Header Key ===  
      
      
     4E298B40F531F469D21F75B133C307BE
     4E298B40F531F469D21F75B133C307BE


===== App Key =====  
=== Runtime PSSE App Key ===
For decrypting PSSE files with IP9100-NPXS10074_00-0000000000000000 as content id
For decrypting PSSE files with IP9100-NPXS10074_00-0000000000000000 as content id
     A8693C4DF0AEEDBC9ABFD8213692912D
     A8693C4DF0AEEDBC9ABFD8213692912D


===== Debug Header Key =====  
=== Debug PSSE Header Key ===
When you encrypt files locally for use in PSM Dev Assistant, using PSM SDK's "psm_encryptor64.dll"  
When you encrypt files locally for use in PSM Dev Assistant, using PSM SDK's "psm_encryptor64.dll"  
the following header key is used INSTEAD of the retail one.
the following header key is used INSTEAD of the retail one.
     00112233445566778899AABBCCDDEEFF
     00112233445566778899AABBCCDDEEFF
=== Hash Account ID ===
used for calculating "Unique ID" in
Sce.PlayStation.Core.Services.AccountInformation.UniqueID
==== Hash Account ID HMAC-SHA256 key ====
    BDEE3E0B93073749856F25CCDB443AFB0FAB94287493DC1AD0C5697E2A7AE14E
==== Hash Account ID AES-128-CBC Key ====
    5AA3DB8FE6AEE26CD185B086F5BD78A4
==== Hash Account ID AES-128-CBC Iv ====
    00000000000000000000000000000000
How to calculate UniqueID:
get psn accountid; => 0123456789abcdef (example)
sha256hmac(accountid, hmackey) => 4653ec6275f410c47d280a3688a554a579a7e7c9f52599381ae9ee4a1b6220e3
trim hmac to first 8 bytes => 4653ec6275f410c4
append trimmed hmac to accountid => 0123456789abcdef4653ec6275f410c4
aes128cbc(accountid + trimhmac, key, iv) => c7656d883573d94809c8fa05f511d84f
so "c7656d883573d94809c8fa05f511d84f" is the "UniqueID"


== EncDec Keys ==
== EncDec Keys ==
Line 4,062: Line 3,153:
! Type !! Version !! Modulus !! Usage || Notes
! Type !! Version !! Modulus !! Usage || Notes
|-
|-
| 0 and 1 || 1.00+ ||
| 0 and 1 || 1.00+ ||  
     9CCCE3A536FA641B2D1354EE98F093C2
     9CCCE3A536FA641B2D1354EE98F093C2
     68470F722C024B86CD60274E08E0067A
     68470F722C024B86CD60274E08E0067A
Line 4,146: Line 3,237:
! Type !! Version !! Modulus !! Usage || Notes
! Type !! Version !! Modulus !! Usage || Notes
|-
|-
| PSP || 1.00+ ||
| PSP || 1.00+ ||  
     BBDB6AA32E3B51A6D4708D5FC9899919
     BBDB6AA32E3B51A6D4708D5FC9899919
     395A2AAD83E98F4864C3BA43A5D6906F
     395A2AAD83E98F4864C3BA43A5D6906F
Line 4,218: Line 3,309:
== NID generation suffixes ==
== NID generation suffixes ==


* The algorithm is sha1(name + suffix).
* algo is sha1(name + suffix)


=== No suffix ===
=== No suffix ===
Line 4,224: Line 3,315:
For some PSP and PS Vita old NIDs, there was no suffix at all: algo was simply sha1(name).
For some PSP and PS Vita old NIDs, there was no suffix at all: algo was simply sha1(name).


=== PS3 NONAME suffix ===
=== PS3 NONAME default suffix ===


<pre>"0xbc5eba9e042504905b64274994d9c41f"</pre>
<pre>bc5eba9e042504905b64274994d9c41f</pre>


* Note that this ASCII string is used but not the hexadecimal value for it.
To check how to use this suffix (see: [https://www.psdevwiki.com/ps3/Keys#PS3_NONAME_NIDs_Salt]).


=== PS3 default suffix ===
=== PS3 default suffix ===
Line 4,234: Line 3,325:
<pre>6759659904250490566427499489741A</pre>
<pre>6759659904250490566427499489741A</pre>


* Note that this hexadecimal value is used but not the ASCII string for it.
=== PS Vita NONAME default suffix ===
 
=== PS Vita NONAME suffix ===


<pre>c1b886af5c31846467e7ba5e2cffd64a</pre>
<pre>c1b886af5c31846467e7ba5e2cffd64a</pre>
* Note that this hexadecimal value is used but not the ASCII string for it.


== SceKrm ==
== SceKrm ==
Please note that all contributions to Vita Developer wiki are considered to be released under the GNU Free Documentation License 1.2 (see Vita Developer wiki:Copyrights for details). If you do not want your writing to be edited mercilessly and redistributed at will, then do not submit it here.
You are also promising us that you wrote this yourself, or copied it from a public domain or similar free resource. Do not submit copyrighted work without permission!

To protect the wiki against automated edit spam, we kindly ask you to solve the following hCaptcha:

Cancel Editing help (opens in new window)
Retrieved from "http://www.psdevwiki.com/vita/Keys"