Kirk

The PSP KIRK Crypto Engine is a security hardware device that is embedded into the TACHYON main IC chip. It is a bus master and can DMA to/from main DDR RAM memory, operating independantly of the CPU. It is intefaced via memory mapped registers at base of 0xBDE00000 ([SPOCK Crypto Engine] on the other hand is mapped to 0xBDF00000). It is capable of performing AES encryption, decryption, SHA1 Hash, pseudo random number generation, and signature generation and verifications (ECDSA) and CMAC.

Commands

On PSP there are 18 KIRK commands. On PSVita, there are these 18 commands plus some new commands to support bigger keys (192 bits for example). See F00D commands.

Table

Command ID	Name	Short description	Input size	Output size	Result	Used in
1	KIRK_CMD_DECRYPT_PRIVATE	Super-Duper decryption (no inverse)	buf_size+0x40	buf_size		memlmd, mesg_led
2	KIRK_CMD_2	Encrypt Operation (inverse of cmd 3)
3	KIRK_CMD_3	Decrypt Operation (inverse of cmd 2)
4	KIRK_CMD_ENCRYPT_IV_0	Encrypt Operation (inverse of cmd 7) (IV=0)	buf_size+0x14	buf_size+0x14		chnnlsv, memab
5	KIRK_CMD_ENCRYPT_IV_FUSE	Encrypt Operation (inverse of cmd 8) (IV=FuseID)	buf_size+0x14	buf_size+0x14		chnnlsv
6	KIRK_CMD_ENCRYPT_IV_USER	Encrypt Operation (inverse of cmd 9) (IV=UserDefined)
7	KIRK_CMD_DECRYPT_IV_0	Decrypt Operation (inverse of cmd 4) (IV=0)	buf_size+0x14	buf_size+0x14		memlmd, mesg_led,chnnlsv, memab
8	KIRK_CMD_DECRYPT_IV_FUSE	Decrypt Operation (inverse of cmd 5) (IV=FuseID)	buf_size+0x14	buf_size+0x14		chnnlsv
9	KIRK_CMD_DECRYPT_IV_USER	Decrypt Operation (inverse of cmd 6) (IV=UserDefined)
10 (0xA)	KIRK_CMD_PRIV_SIGVRY	Private Signature Verify (checks for private SCE sig)
11 (0xB)	KIRK_CMD_HASH	SHA1 Hash	buf_size >= 0x14	?0x14?		memlmd, mesg_led, memab
12 (0xC)	KIRK_CMD_MUL1	ECDSA Generate Keys	0	0x3C		memab
13 (0xD)	KIRK_CMD_MUL2	ECDSA Multiply Point	0x3C	0x3C
14 (0xE)	KIRK_CMD_PRNGEN	Pseudo Random Number Generation	0	0x14		mesg_led, chnnlsv, memab, semawm
15 (0xF)	KIRK_CMD_15	(absolutely no idea – could be KIRK initialization)
16 (0x10)	KIRK_CMD_SIGGEN	ECDSA Signature Generation	0x34	0x28		memab
17 (0x11)	KIRK_CMD_SIGVRY	Signature Verification (checks for generated signatures)	0x64	0		memab
18 (0x12)	KIRK_CMD_CERTVRY	Certificate Verification (IDStorage certificates CMAC)	0xB8	0		openpsid, memab

Library

Calling commands using KIRK registers

• [1]

• [2]

• [3]

• [4]

Notes

In 2008 SilverSpring wrote:

Currently what is known about the cipher is that it is:
a block cipher operating in CBC mode
an all zero 128-bit initialization vector
128-bit block and key sizes
cmd4/7 uses a static key that is identical in all PSP’s
cmd5/8 uses a key based off the fuseID making all operations unique per PSP
cmd6/9 uses a user-defined 128-bit key
cmd1/2/3 uses the block cipher but also signature algorithms
the remaining KIRK cmd’s do not use the block cipher (sig, hash, & prng algo’s)
</source>