NXP Semiconductors K32 L2A Series, Reference Manual, Page: 317 / 1379

If no key is programmed in these registers, then an attempt is made to decrypt the file
using an all-zero key.
14.6.1 Decryption using MMCAU
The MMCAU code must flashed to the device memory in a separate step. The location of
MMCAU initialization, encryption, and decryption functions does not matter, as long as
it is on accessible memory. The provided functions are expected to have the following
prototypes:
void mmcau_aes_init(unsigned int* key, unsigned int* keySchedule, unsigned int* rcon);
void mmcau_aes_encrypt(unsigned int* in, unsigned int* key, unsigned int* keySchedule,
unsigned int* out);
void mmcau_aes_decrypt(unsigned int* in, unsigned int* key, unsigned int* keySchedule,
unsigned int* out);
NOTE
The mmCAU software library source code can be downloaded
from
www.nxp.com .
In order to decrypt an encrypted SB file using the MMCAU peripheral, the following
information must be provided:
• The Bootloader Configuration Area (BCA) contains a pointer to an MMCAU set-up
structure. The location in the configuration area (relative to the BCA) is at offset
0x20, as shown in the BCA layout in this document. The pointer is a little endian
memory location that contains the following structure:
typedef struct mmcau_function_info
{
uint32_t tag;
uint32_t length;
uint32_t aes_init_start;
uint32_t aes_encrypt_start;
uint32_t aes_decrypt_start;
} mmcau_function_info_t;
For decryption to work properly, the mmcau_function_info structure must contain
valid values for all the fields in this structure:
a. The tag field must equal 'kcau'.
b. The length field must equal the size of the total length of the aes_init,
aes_encrypt, and aes_decrypt functions. All of these function must be in a
contiguous region of memory that fits within 1280 bytes. All code in the
functions must be relocatable.
c. aes_init_start contains the memory location of the aes_init function.
d. aes_encrypt_start contains the memory location of the aes_encrypt function.
e. aes_decrypt_start contains the memory location of the aes_decrypt function.
Chapter 14 Kinetis ROM Bootloader
K32 L2A Reference Manual, Rev. 2, 01/2020
NXP Semiconductors 317