301
edits
Changes
Jump to navigation
Jump to search
More keys
Line 260:
Line 260:
This unknown key is only generated in devkit units by decrypting the SEEPROM devkit key with a key from the OTP,+ or by taking a different key from the OTP if the SEEPROM one is not set.+
==Key object handles==
==Key object handles==
−The above crypto commands use key/crypto object handles. These handles can be either from IOSC_CreateObject(which can then be initialized with import_secret_key in the case of AES), or a built-in handle. The available built-in handles/keyids are listed below.
+The above crypto commands use key/crypto object handles. These handles can be either from IOSC_CreateObject(which can then be initialized with IOSC_ImportSecretKey in the case of AES), or a built-in handle. The available built-in handles/ids are listed below.
−The maximum number of keyobject-handles is 0x80, hence the highest valid keyobject-handle is 0x7F. Keyobject-handles <=0x40 are reserved for built-in handles, the rest are available for user-processes. Commands which write keyobjects' keydata are only allowed to use handles with value >0x40(user-process handles).
+The maximum number of keyobject-handles is 0x80, hence the highest valid keyobject-handle is 0x7F. Keyobject-handles <=0x40 are reserved for built-in handles, the rest are available for user-processes. Commands which write keyobjects' keydata are only allowed to use handles with value >0x40 (user-process handles).
{| class="wikitable sortable"
{| class="wikitable sortable"
Line 271:
Line 271:
| 0x00
| 0x00
| ECC-233
| ECC-233
−| Unknown private key. Possibly vWii NG ECC key.
+| Wii U NG private key
|-
|-
| 0x01
| 0x01
| NONE
| NONE
−| Unknown ID (0x04 bytes). Possibly vWii NG ID.
+| Wii U NG ID
|-
|-
| 0x02
| 0x02
| AES-128
| AES-128
−| Wii U NAND (slc) crypto key.
+| Wii U SLC (NAND) key
|-
|-
| 0x03
| 0x03
| HMAC SHA-1
| HMAC SHA-1
−| Wii U NAND (slc) HMAC.
+| Wii U SLC (NAND) HMAC
|-
|-
| 0x04
| 0x04
| AES-128
| AES-128
−| Old Wii common key.
+| Wii common key
|-
|-
| 0x05
| 0x05
| AES-128
| AES-128
−| Wii U RNG key. Used by commands 0x15, 0x16, 0x17 and 0x18.
+| Wii U RNG key
+ Used by commands 0x15, 0x16, 0x17 and 0x18.
|-
|-
| 0x06
| 0x06
| AES-128
| AES-128
−| Fixed key stored in IOS-CRYPTO's data.
+| Wii SD key
|-
|-
| 0x07
| 0x07
| AES-128
| AES-128
−| Wii U SEEPROM key.
+| Wii U SEEPROM key
|-
|-
| 0x08
| 0x08
| NONE
| NONE
−| Unused.
+| Unused
|-
|-
| 0x09
| 0x09
| NONE
| NONE
−| Unused.
+| Unused
|-
|-
| 0x0A
| 0x0A
| NONE
| NONE
−| Unused.
+| Unused
|-
|-
| 0x0B
| 0x0B
−| UNK
+| AES-128
−| Unknown (0x10 bytes).
+| Wii Korean key
|-
|-
| 0x0C
| 0x0C
| AES-128
| AES-128
−| Wii U drive key.
+| Wii U drive key
This key is generated by decrypting the SEEPROM drive key with the Wii U SEEPROM key.
This key is generated by decrypting the SEEPROM drive key with the Wii U SEEPROM key.
|-
|-
| 0x0D
| 0x0D
| AES-128
| AES-128
−| ARM [[Ancast_Image|Ancast Image]] (this and the below one are for all ARM-ancast images launched via IOS-MCP).
+| Wii U Starbuck [[Ancast_Image|ancast image]] key
|-
|-
| 0x0E
| 0x0E
−| RSA-2048 modulus
+| RSA-2048
−| ARM [[Ancast_Image|Ancast Image]] (stored inside IOS-CRYPTO's data).
+| Wii U Starbuck [[Ancast_Image|ancast image]] modulus
|-
|-
| 0x0F
| 0x0F
−| RSA-2048 modulus
+| RSA-2048
−| Unknown (stored inside IOS-CRYPTO's data).
+| Wii U boot1 [[Ancast_Image|ancast image]] modulus
|-
|-
| 0x10
| 0x10
| AES-128
| AES-128
−| Wii U common key.
+| Wii U common key
|-
|-
| 0x11
| 0x11
| AES-128
| AES-128
−| MLC WFS crypto key. (0x10 bytes).
+| Wii U MLC (eMMC) key
|-
|-
| 0x12
| 0x12
| AES-128
| AES-128
−| USB WFS and WagonU key.
+| USB WFS and WagonU key
− This key is generated by ECB-encrypting the SEEPROM USB key seed with a key from the OTP. Some factory code uses a static seed instead.
+ This key is generated by ECB-encrypting the SEEPROM USB key seed with a key from the OTP.
+ The SEEPROM USB key seed must start with the same first 0x04 bytes as the Wii U NG ID.
|-
|-
| 0x13
| 0x13
| AES-128
| AES-128
−| Old Wii NAND (slccmpt) crypto key.
+| Wii U SLCCMPT (vWii NAND) key
|-
|-
| 0x14
| 0x14
| HMAC SHA-1
| HMAC SHA-1
−| Old Wii NAND (slccmpt) HMAC key.
+| Wii U SLCCMPT (vWii NAND) HMAC
|-
|-
| 0x15
| 0x15
| AES-128
| AES-128
−| vWii common key.
+| vWii common key
|-
|-
| 0x16
| 0x16
| AES-128
| AES-128
−| Key to encrypt DRH WLAN data.
+| Key to encrypt/decrypt DRH WLAN data
|-
|-
| 0x17
| 0x17
| AES-128
| AES-128
−| UDS local-WLAN CCMP key.
+| UDS local-WLAN CCMP key
Generated by XORing the Wii U XOR key and static data inside IOS-CRYPTO (used by IOS-NET).
Generated by XORing the Wii U XOR key and static data inside IOS-CRYPTO (used by IOS-NET).
This key is shared with the 3DS.
This key is shared with the 3DS.
Line 371:
Line 373:
| 0x18
| 0x18
| AES-128
| AES-128
−| DLP key.
+| DLP key
Generated by XORing the Wii U XOR key and static data inside IOS-CRYPTO (used by IOS-NET).
Generated by XORing the Wii U XOR key and static data inside IOS-CRYPTO (used by IOS-NET).
This key is shared with the 3DS.
This key is shared with the 3DS.
Line 377:
Line 379:
| 0x19
| 0x19
| AES-128
| AES-128
−| APT wrap key.
+| APT wrap key
Generated by XORing the Wii U XOR key and static data inside IOS-CRYPTO (used by IOS-ACP).
Generated by XORing the Wii U XOR key and static data inside IOS-CRYPTO (used by IOS-ACP).
This key is shared with the 3DS.
This key is shared with the 3DS.
|-
|-
| 0x1A
| 0x1A
−| UNK
+| AES-128
−| Unknown (0x10 bytes).
+| Unknown
|-
|-
| 0x1B
| 0x1B
| AES-128
| AES-128
−| Key to encrypt/decrypt SSL RSA key.
+| Key to encrypt/decrypt SSL RSA key
|-
|-
| 0x1C
| 0x1C
−| UNK
+| ECC-233
−| Unknown (0x1E bytes).
+| Wii U private key for NSS device certificate
|-
|-
| 0x1D
| 0x1D
−| UNK
+| ECC-233
−| Unknown (0x1E bytes).
+| vWii private key for NSS device certificate
|-
|-
| 0x1E
| 0x1E
| AES-128
| AES-128
−| Unknown (used by IOS-NET).
+| Key to encrypt/decrypt APPSTORE objinfo/objdata
+ This key is the first 0x10 bytes of the Wii U private key for NSS device certificate.
|-
|-
| 0x1F
| 0x1F
| AES-128
| AES-128
−| Unknown.
+| Unknown
Generated by XORing the Wii U XOR key and static data inside IOS-CRYPTO (used by IOS-NIM-BOSS).
Generated by XORing the Wii U XOR key and static data inside IOS-CRYPTO (used by IOS-NIM-BOSS).
|-
|-
| 0x20
| 0x20
| UNK
| UNK
−| Unknown.
+| Unknown
Generated by XORing the Wii U XOR key and static data inside IOS-CRYPTO (0x40 bytes).
Generated by XORing the Wii U XOR key and static data inside IOS-CRYPTO (0x40 bytes).
|-
|-
| 0x21
| 0x21
| UNK
| UNK
−| Unknown.
+| Unknown
− Generated by XORing the Wii U XOR key and static data inside IOS-CRYPTO (0x40 bytes).
+ Generated by XORing the Wii U XOR key and static data inside IOS-CRYPTO (0x20 bytes).
|-
|-
| 0x22
| 0x22
−| UNK
+| AES-128
−| Unknown.
+| Amiibo HMAC key 1
− Generated by XORing the Wii U XOR key and static data inside IOS-CRYPTO (0x40 bytes).
+ Generated by XORing the Wii U XOR key and static data inside IOS-CRYPTO (used by IOS-PAD).
+ This key is used to generate a SHA-256 HMAC for the Amiibo data.
|-
|-
| 0x23
| 0x23
−| UNK
+| AES-128
−| Unknown.
+| Amiibo HMAC key 2
− Generated by XORing the Wii U XOR key and static data inside IOS-CRYPTO (0x40 bytes).
+ Generated by XORing the Wii U XOR key and static data inside IOS-CRYPTO (used by IOS-PAD).
+ This key is used to generate a SHA-256 HMAC for the Amiibo data.
|-
|-
| 0x24
| 0x24
−| UNK
+| AES-128
−| Unknown.
+| NFC key
− Generated by XORing the Wii U XOR key and static data inside IOS-CRYPTO (0x10 bytes).
+ Generated by XORing the Wii U XOR key and static data inside IOS-CRYPTO (used by IOS-PAD).
+ This key is shared with the 3DS.
|-
|-
| 0x25
| 0x25
−| UNK
+| AES-128
−| Unknown.
+| Key to encrypt/decrypt Wii U NFC key block
− Generated by XORing the Wii U XOR key and static data inside IOS-CRYPTO (0x10 bytes).
+ Generated by XORing the Wii U XOR key and static data inside IOS-CRYPTO (used by IOS-PAD).
+ This key is used to decrypt a block of 0x70 bytes inside IOS-PAD.
+ Once decrypted, this block contains the Wii U specific "unfixed infos" and "locked secret" keys.
|-
|-
| 0x26
| 0x26
−| UNK
+| AES-128
−| Unknown.
+| Unknown
Generated by XORing the Wii U XOR key and static data inside IOS-CRYPTO (0x10 bytes).
Generated by XORing the Wii U XOR key and static data inside IOS-CRYPTO (0x10 bytes).
|-
|-
| 0x27
| 0x27
| AES-128
| AES-128
−| Unknown.
+| Key to encrypt/decrypt "pushmore" links
Generated by XORing the Wii U XOR key and static data inside IOS-CRYPTO (used by IOS-NIM-BOSS).
Generated by XORing the Wii U XOR key and static data inside IOS-CRYPTO (used by IOS-NIM-BOSS).
|-
|-
| 0x28
| 0x28
| AES-128
| AES-128
−| Devkit key.
+| Wii U extra storage key
− In debug hardware with an internal HDD (Kiosk and certain DevKits) this key is generated by decrypting the SEEPROM SHDD key with a key from the OTP.
− In debug hardware without additional internal storage, this is the same as the Wii U MLC (eMMC) key.
+ In retail hardware this key is never set.
|-
|-
| 0x29 to 0x40
| 0x29 to 0x40
| UNK
| UNK
−| Unused.
+| Unused
|}
|}