Editing Keys

Jump to navigation Jump to search
Warning: You are not logged in. Your IP address will be publicly visible if you make any edits. If you log in or create an account, your edits will be attributed to your username, along with other benefits.

The edit can be undone. Please check the comparison below to verify that this is what you want to do, and then publish the changes below to finish undoing the edit.

Latest revision Your text
Line 156: Line 156:
</pre>
</pre>


== Static Keyslot 0x208 (Type 3) ==
== Static Keyslot 0x208 ==
<pre>
<pre>
2D B8 D5 93 4A 1D 77 89 EA 87 95 F7 8A 8F C2 B7  
2D B8 D5 93 4A 1D 77 89 EA 87 95 F7 8A 8F C2 B7  
Line 164: Line 164:
* credits to gleba, math, Proxima and xyz for the help finding this one
* credits to gleba, math, Proxima and xyz for the help finding this one


== Static Keyslot 0x209 (Type 3) ==
== Static Keyslot 0x209 ==


<pre>
<pre>
Line 171: Line 171:
</pre>
</pre>


== Static Keyslot 0x20A (Type 3)  ==
== Static Keyslot 0x20A ==


<pre>
<pre>
Line 178: Line 178:
</pre>
</pre>


== Static Keyslot 0x20B (Type 3)  ==
== Static Keyslot 0x20B ==


<pre>
<pre>
Line 185: Line 185:
</pre>
</pre>


== Static Keyslot 0x20C (Type 3)  ==  
== Static Keyslot 0x20C ==  


<pre>
<pre>
Line 192: Line 192:
</pre>
</pre>


== Static Keyslot 0x20D (Type 3)  ==
== Static Keyslot 0x20D ==


<pre>
<pre>
Line 255: Line 255:
</pre>
</pre>


== Static Keyslots 0x3XX (ROM) ==
== Static Keyslots 0x3XX ==


<pre>
<pre>
73 90 A5 77 F4 90 AD 3C D5 61 D6 CE D5 7A 33 C1 <- 0x300
73 90 A5 77 F4 90 AD 3C D5 61 D6 CE D5 7A 33 C1
BD 4F 51 1D 85 09 33 13 AC CB 7B 9F 99 91 EC 0F <- 0x300
BD 4F 51 1D 85 09 33 13 AC CB 7B 9F 99 91 EC 0F  
CA 21 C9 BB 4D B3 F8 7E D4 D1 DD 56 30 D5 22 F5  
CA 21 C9 BB 4D B3 F8 7E D4 D1 DD 56 30 D5 22 F5  
0B A3 DD 72 EA 15 7B A6 D7 44 98 34 9E BF 5A 22  
0B A3 DD 72 EA 15 7B A6 D7 44 98 34 9E BF 5A 22  
Line 772: Line 772:
</pre>
</pre>


== Static Keyslot 0x605 (OTP, ALL Types) ==
== Static Keyslot 0x605 ==


<pre>
<pre>
Line 837: Line 837:
</pre>
</pre>


== SLSK Verification RSA Keys (Static Keyslots 0x7XX) ==
= Keys =
 
== Bootrom ==
 
=== Personalization removal Key for SLSK (Proto) (Perconsole) (Slot 8) (Test Subject 0) ===
 
<pre>
85C688C1B3BACB16EB57B4CC35B7D590
</pre>
 
* decrypts the .enp (not ._enp!) perconsole layer of an enp file, turning it into an enc file
* algo is aes-128-cbc
 
=== Personalization removal Key for SLSK (Proto) (Perconsole) (Slot 8) (Test Subject 1) ===
 
<pre>
8B5415DC7EB5986472BF6B30D8E3E812
</pre>
 
=== Personalization removal Key for SLSK (Proto) (Perconsole) (Slot 8) (Test Subject 2) ===
 
<pre>
95B7B3EDB2EF277FB0F78FA3970EE0D0
</pre>
 
=== Personalization removal Key for SLSK (Proto) (Perconsole) (Slot 8) (Test Subject 3) ===
 
<pre>
CB0B65F7897F30310471F7CDA2CFD804
</pre>
 
=== Personalization removal Key for SLSK (Proto) (Perconsole) (Slot 8) (Test Subject 4) ===
 
<pre>
F3E408E1EDC3B513277DB99E58A15BE3
</pre>
 
=== Personalization removal IV for SLSK (Proto) (Perconsole) (Slot 8) ===
 
<pre>
FD4FA8FA4FE79430A0CA305C88E524DD
</pre>
 
=== Personalization removal KEY for SLSK (Proto) (Perconsole) (Slot 9) (JigKick) (Test Subject 0)  ===
<pre>
9E0A8285C3BE83951C78480A7AEC80FD
</pre>
 
=== Personalization removal KEY for SLSK (Proto) (Perconsole) (Slot 9) (JigKick) (Test Subject 1)  ===
<pre>
686268A876650A6A6DC353F69EB82F19
</pre>
 
=== Personalization removal KEY for SLSK (Proto) (Perconsole) (Slot 9) (JigKick) (Test Subject 2)  ===
<pre>
E7A8ADF7B7E2BC26E3445084384FBCE1
</pre>
 
=== Personalization removal KEY for SLSK (Proto) (Perconsole) (Slot 9) (JigKick) (Test Subject 3)  ===
<pre>
736F7501E9A15AB29800113686C946BA
</pre>
 
 
=== Personalization removal KEY for SLSK (Proto) (Perconsole) (Slot 9) (JigKick) (Test Subject 4)  ===
<pre>
BEA39D6443FBACAB05DA62BB95470D57
</pre>
 
=== Personalization removal IV for SLSK (Proto) (Perconsole) (Slot 9) (JigKick) ===
 
<pre>
986D5EE1E7759F4F52DB43F33FA5960A
</pre>
 
=== SLSK SHA256HMAC KEY (NonPerconsole) (Slot 0x20) ===
 
<pre>
2E1FC0BF211AEE3977C96F1089A150F5
A3CB9E41314BC39F0CBEC16AF3B0B9AC
</pre>
 
* calculates header hmac (0:0x1C0) which is compared against signature at 0x1C0 size 0x100, verified with key 0 from bootrom rsa pairs
* calculates encrypted body hmac + 0x10 bytes (0x2B0:end_of_body_from_header) verified against hmac at 0x190 (encrypted with double AA key and custom iv from bootrom)
 
=== SLSK Header HMAC/CBC KEY/IV ===
 
* key
 
<pre>
AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
</pre>
 
* iv
 
<pre>
EEB5EC5CCF1CF43113F5213AD5B8D6DA
</pre>
 
* decrypts what's at 0x190 size 0x20 of .enc file using aes 256 cbc
* result will be a hmac calculated with key 2E1FC0BF211AEE3977C96F1089A150F5A3CB9E41314BC39F0CBEC16AF3B0B9AC
* said hmac will be from header size (usually 0x2B0) until header size plus body size (0x2B0 + ???) with body encrypted
 
=== Factory Handshake Key ===
 
<pre>
F47716E6C5649FD648538FD9773D12D1
229E118737B1D782D6A80CDB72E4B9C3
</pre>
 
* Shared with SYSCON
 
=== SLSK IV (Confirmed) ===
 
<pre>
AF5F2CB04AC1751ABF51CEF1C8096210
</pre>
 
* Used with AA 16x Battery key (AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA) to decrypt SLSK after depersonalization
 
=== Bootrom RSA Key (Fallback for SLSK Validation, all fuses blown) (Proto) ===
 
<pre>
3BD3D7E98A17F359F19E3AF9802B95E9
D6946CA8903136582EFC9C88F4F01E3D
3101E2FA33541A231E4E45F05E8536C6
4D69B60EF4B3004D23AD72BF801B8695
EEA843BE585862A63D6B2BE7F90055A8
C690AECAD63B85EA118A79BBD510156F
53D3B7623811C18F0829364ABAFB1A6C
9D841F20A08831963C0D5B64FB360947
206C748AEFDB1715896BCA4D2980EE22
B0C3243FB73C3F2A0A868C587E57B77A
FEBE2B983046D6428C722319A598A5C6
0EFB9C4E9FDCF793DFA3CDEEC6C8A249
42652531706D6D701B0B0C660E79D241
9D38E1B8E976BD9FB4D4CD1E6F461E86
B295C6FA10D1C7927CB266C08B3025CC
76A4837EF0D8208BBA305059E23DDABC
</pre>
 
=== SLSK Verification RSA Keys ===


<pre>
<pre>
Line 1,386: Line 1,527:


* Only first key is used
* Only first key is used
= Keys =
== Bootrom ==
=== Personalization removal Key for SLSK (Proto) (Perconsole) (Slot 8) (Test Subject 0) ===
<pre>
85C688C1B3BACB16EB57B4CC35B7D590
</pre>
* decrypts the .enp (not ._enp!) perconsole layer of an enp file, turning it into an enc file
* algo is aes-128-cbc
=== Personalization removal Key for SLSK (Proto) (Perconsole) (Slot 8) (Test Subject 1) ===
<pre>
8B5415DC7EB5986472BF6B30D8E3E812
</pre>
=== Personalization removal Key for SLSK (Proto) (Perconsole) (Slot 8) (Test Subject 2) ===
<pre>
95B7B3EDB2EF277FB0F78FA3970EE0D0
</pre>
=== Personalization removal Key for SLSK (Proto) (Perconsole) (Slot 8) (Test Subject 3) ===
<pre>
CB0B65F7897F30310471F7CDA2CFD804
</pre>
=== Personalization removal Key for SLSK (Proto) (Perconsole) (Slot 8) (Test Subject 4) ===
<pre>
F3E408E1EDC3B513277DB99E58A15BE3
</pre>
=== Personalization removal IV for SLSK (Proto) (Perconsole) (Slot 8) ===
<pre>
FD4FA8FA4FE79430A0CA305C88E524DD
</pre>
=== Personalization removal KEY for SLSK (Proto) (Perconsole) (Slot 9) (JigKick) (Test Subject 0)  ===
<pre>
9E0A8285C3BE83951C78480A7AEC80FD
</pre>
=== Personalization removal KEY for SLSK (Proto) (Perconsole) (Slot 9) (JigKick) (Test Subject 1)  ===
<pre>
686268A876650A6A6DC353F69EB82F19
</pre>
=== Personalization removal KEY for SLSK (Proto) (Perconsole) (Slot 9) (JigKick) (Test Subject 2)  ===
<pre>
E7A8ADF7B7E2BC26E3445084384FBCE1
</pre>
=== Personalization removal KEY for SLSK (Proto) (Perconsole) (Slot 9) (JigKick) (Test Subject 3)  ===
<pre>
736F7501E9A15AB29800113686C946BA
</pre>
=== Personalization removal KEY for SLSK (Proto) (Perconsole) (Slot 9) (JigKick) (Test Subject 4)  ===
<pre>
BEA39D6443FBACAB05DA62BB95470D57
</pre>
=== Personalization removal IV for SLSK (Proto) (Perconsole) (Slot 9) (JigKick) ===
<pre>
986D5EE1E7759F4F52DB43F33FA5960A
</pre>
=== SLSK SHA256HMAC KEY (NonPerconsole) (Slot 0x20) ===
<pre>
2E1FC0BF211AEE3977C96F1089A150F5
A3CB9E41314BC39F0CBEC16AF3B0B9AC
</pre>
* calculates header hmac (0:0x1C0) which is compared against signature at 0x1C0 size 0x100, verified with key 0 from bootrom rsa pairs
* calculates encrypted body hmac + 0x10 bytes (0x2B0:end_of_body_from_header) verified against hmac at 0x190 (encrypted with double AA key and custom iv from bootrom)
=== SLSK Header HMAC/CBC KEY/IV ===
* key
<pre>
AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
</pre>
* iv
<pre>
EEB5EC5CCF1CF43113F5213AD5B8D6DA
</pre>
* decrypts what's at 0x190 size 0x20 of .enc file using aes 256 cbc
* result will be a hmac calculated with key 2E1FC0BF211AEE3977C96F1089A150F5A3CB9E41314BC39F0CBEC16AF3B0B9AC
* said hmac will be from header size (usually 0x2B0) until header size plus body size (0x2B0 + ???) with body encrypted
=== Factory Handshake Key ===
<pre>
F47716E6C5649FD648538FD9773D12D1
229E118737B1D782D6A80CDB72E4B9C3
</pre>
* Shared with SYSCON
=== SLSK IV (Confirmed) ===
<pre>
AF5F2CB04AC1751ABF51CEF1C8096210
</pre>
* Used with AA 16x Battery key (AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA) to decrypt SLSK after depersonalization
=== Bootrom RSA Key (Fallback for SLSK Validation, all fuses blown) (Proto) ===
<pre>
3BD3D7E98A17F359F19E3AF9802B95E9
D6946CA8903136582EFC9C88F4F01E3D
3101E2FA33541A231E4E45F05E8536C6
4D69B60EF4B3004D23AD72BF801B8695
EEA843BE585862A63D6B2BE7F90055A8
C690AECAD63B85EA118A79BBD510156F
53D3B7623811C18F0829364ABAFB1A6C
9D841F20A08831963C0D5B64FB360947
206C748AEFDB1715896BCA4D2980EE22
B0C3243FB73C3F2A0A868C587E57B77A
FEBE2B983046D6428C722319A598A5C6
0EFB9C4E9FDCF793DFA3CDEEC6C8A249
42652531706D6D701B0B0C660E79D241
9D38E1B8E976BD9FB4D4CD1E6F461E86
B295C6FA10D1C7927CB266C08B3025CC
76A4837EF0D8208BBA305059E23DDABC
</pre>


=== Keyseed 0 (Proto) ===
=== Keyseed 0 (Proto) ===
Please note that all contributions to Vita Developer wiki are considered to be released under the GNU Free Documentation License 1.2 (see Vita Developer wiki:Copyrights for details). If you do not want your writing to be edited mercilessly and redistributed at will, then do not submit it here.
You are also promising us that you wrote this yourself, or copied it from a public domain or similar free resource. Do not submit copyrighted work without permission!

To protect the wiki against automated edit spam, we kindly ask you to solve the following hCaptcha:

Cancel Editing help (opens in new window)