diff --git a/templates/pages/sega/hardware/keychip.html b/templates/pages/sega/hardware/keychip.html new file mode 100644 index 0000000..3eac51c --- /dev/null +++ b/templates/pages/sega/hardware/keychip.html @@ -0,0 +1,441 @@ +{% extends "sega.html" %} {% block title %}Ring Keychip{% endblock %} {% block body %} +

Ring Keychip

+

+ The Ring keychip is arguably simultaniously one of the most overkill while least utilised parts of the system. + On-board is a PIC microcontroller, a dedicated cryptography chip, a hardware SHA engine for authentication, and + flash storage. +

+

Protocol

+

+ The PIC communicates with the system using a parallel bus. This bus is exposed physically on the keychip connector, + and in software can be accessed using \\.\mxparallel. All bus communication is encrypted using AES 128 + ECB, using a different key for each data direction. Send/receive is defined from the perspective of the Ring system. + That is, the "Send" key handles data from the Ring to the keychip, and the "Receive" key handles data from the + keychip to the Ring. The initial key values are: +

+

Initial receive key:

+
75 6f 72 61 74 6e 65 6b 61 6d 69 68 73 75 6b 75
+

Initial send key:

+
66 6E 65 6B 65 72 61 77 64 72 61 68 61 67 65 73
+ +

+ All packets are first prefixed by a command ordinal (see below), then command-specific information. The base unit of + transfer is 16 bytes due to AES 128. Unused bytes can contain anything, however mxkeychip chooses to pad using + random bytes derrived from the current system time. +

+ +

Command Ordinals

+ + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + +
OrdinalCommand
0SetKeyS
1SetKeyR
2SetIv
3Decrypt
4Encrypt
5GetAppBootInfo
6EepromWrite
7EepromRead
8NvramWrite
9NvramRead
10AddPlayCount
11FlashRead
12FlashErase
13
14FlashWrite
15
16
17
18
19
20KcGetVersion
21SetMainId
22GetMainId
23SetKeyId
24GetKeyId
25GetPlayCounter
+ +

SetKeyS

+

Sets the "send" encryption key. The key is changed before communication of the reply.

+

Request

+ + + + + + + + + + + + + + + + + + + + + + + + + + + + +
0123456789ABCDEF
0unused
"send" encryption key
+

Response

+ + + + + + + + + + + + + + + + + + + + + + + + + +
0123456789ABCDEF
0unused
+

SetKeyR

+

Sets the "receive" encryption key. The key is changed before communication of the reply.

+

Request

+ + + + + + + + + + + + + + + + + + + + + + + + + + + + +
0123456789ABCDEF
1unused
"receive" encryption key
+

Response

+ + + + + + + + + + + + + + + + + + + + + + + + + +
0123456789ABCDEF
1unused
+

SetIv

+

Reset the game key IV to its initial value

+

Request

+ + + + + + + + + + + + + + + + + + + + + + + + + +
0123456789ABCDEF
2unused
+

Response

+ + + + + + + + + + + + + + + + + + + + + + + + + +
0123456789ABCDEF
2unused
+

Decrypt

+

Decrypt a block of data using the game key

+

Request

+ + + + + + + + + + + + + + + + + + + + + + + + + + + + +
0123456789ABCDEF
3unused
ciphertext to decrypt
+

Request

+ + + + + + + + + + + + + + + + + + + + + + + + + + + + +
0123456789ABCDEF
3unused
decrypted plaintext
+

Encrypt

+

Encrypt a block of data using the game key

+

Request

+ + + + + + + + + + + + + + + + + + + + + + + + + + + + +
0123456789ABCDEF
4unused
plaintext to encrypt
+

Request

+ + + + + + + + + + + + + + + + + + + + + + + + + + + + +
0123456789ABCDEF
4unused
encrypted ciphertext
+{% endblock %}