Keystone

The Keystone is a an encrypted key used on PS Vita, PS4 and PS5 to prevent files modification and extraction. It can be found on different places in the filesystem and is used for Save Data, Trophy Data, Game Data and Additional Contents decryption and encryption.

The keystone is used to verify that:

• somebody who wants to extract/verify a PKG file is the owner of the product
• a patch data is published by the creator of the app data

The keystone is generated from a unique Passcode chosen by the developer when building a PKG file. The keystone is stored in a hashed file named keystone, stored in the sce_sys folder of the content and encrypted under the PFS layer, then packed into a PKG file.

PS Vita

Location

The keystone file is located in the sce_sys folder of every applications/patches/additional contents/savedata/trophies. It is PFS encrypted.

<save data directory>:/sce_sys/keystone

Structure

Offset	Size	Description	Notes
0x0	0x8	Magic	"keystone"
0x8	0x2	Type	always 2
0xA	0x2	Version	always 1
0xC	0x14	Padding	always zeroed
0x20	0x20	Passcode Digest	HMAC-SHA256
0x40	0x20	Keystone Digest	HMAC-SHA256

Usage

Generation

SCE provides in official SDK a tool called pc2ks that converts a passcode to a keystone.

Verification

The first step is to check the Digest of the keystone file (using sceSblPostSsMgrVerifyKeystoneForDriver). The process is to use the Keystone HMAC Key (see [1]) to check the keystone Digest at position 0x40 in the file.

If it is correct, it proceeds to check the passcode Digest, ?which is not present on retail units?. Use Passcode HMAC Key (see [2]) to calculate the digest of the passcode stored at offset 0x20.

Debug Usage

On TestKits/DevKits/internal PS Vita consoles, more functions are provided by the API to encrypt, verify and decrypt the keystones.

sceSblPostSsMgrVerifyKeystoneWithPasscodeForDriver

sceSblPostSsMgrDebugEncryptKeystoneForDriver

sceSblPostSsMgrDebugDecryptKeystoneForDriver