Tag: KBAG

The KBAG (Key Bag) tag is an array of bytes, usually encrypted with the GID key. It consists of some information about the IV/key pair used to encrypt the payload, and the IV/key pair itself.

Tag Format

IMG3

Img3KbagTag {
   0  u32     magic      // 'GABK' ('KBAG' in little endian)
   4  u32     fullSize   // including header and padding
   8  u32     size       // including padding
   C  u32     cryptType  // 1: IV/Key are encrypted with the GID key
                         // 2: IV/Key are encrypted with the development GID key
  10  u32     aesSize    // the number of bits in the key:
                         //  0x80: AES-128 (16 bytes)
                         //  0xC0: AES-192 (24 bytes)
                         // 0x100: AES-256 (32 bytes)
  14  u8[16]  iv
  24  u8[]    key        // `aesSize / 8` bytes
????  u8[]    padding    // optional
}

Example Tag

The following tag is from the AppleLogo payload from the 2.0 (build 5A347) build for the iPhone (iPhone1,1).