diff --git a/SabreTools.Security.Cryptography/N3DSEncryptionSettings.cs b/SabreTools.Security.Cryptography/N3DSEncryptionSettings.cs
new file mode 100644
index 0000000..2ed99fd
--- /dev/null
+++ b/SabreTools.Security.Cryptography/N3DSEncryptionSettings.cs
@@ -0,0 +1,353 @@
+using SabreTools.Matching;
+
+namespace SabreTools.Security.Cryptography
+{
+    /// <summary>
+    /// 3DS Encryption settings to be passed around during processing
+    /// </summary>
+    public class N3DSEncryptionSettings
+    {
+        /// <summary>
+        /// Indicates if development images are expected
+        /// </summary>
+        public bool Development { get; set; }
+
+        /// <summary>
+        /// AES Hardware Constant
+        /// </summary>
+        /// TODO: Validate this value on assignment
+        public byte[] AESHardwareConstant { get; set; } = [];
+
+        /// <summary>
+        /// KeyX 0x18 (New 3DS 9.3)
+        /// </summary>
+        public byte[] KeyX0x18
+        {
+            get;
+            set
+            {
+                // Ignore missing key data
+                if (value.Length == 0)
+                    return;
+
+                // Validate the key data
+                var cipher = AESCTR.CreateEncryptionCipher(KeyX0x18, TestIV);
+                byte[] actual = cipher.ProcessBytes(TestPattern);
+                if (!actual.EqualsExactly(ExpectedKeyX0x18))
+                    return;
+
+                // Assign the validated value
+                field = value;
+            }
+        } = [];
+
+        /// <summary>
+        /// Dev KeyX 0x18 (New 3DS 9.3)
+        /// </summary>
+        public byte[] DevKeyX0x18
+        {
+            get;
+            set
+            {
+                // Ignore missing key data
+                if (value.Length == 0)
+                    return;
+
+                // Validate the key data
+                var cipher = AESCTR.CreateEncryptionCipher(DevKeyX0x18, TestIV);
+                byte[] actual = cipher.ProcessBytes(TestPattern);
+                if (!actual.EqualsExactly(ExpectedDevKeyX0x18))
+                    return;
+
+                // Assign the validated value
+                field = value;
+            }
+        } = [];
+
+        /// <summary>
+        /// KeyX 0x1B (New 3DS 9.6)
+        /// </summary>
+        public byte[] KeyX0x1B
+        {
+            get;
+            set
+            {
+                // Ignore missing key data
+                if (value.Length == 0)
+                    return;
+
+                // Validate the key data
+                var cipher = AESCTR.CreateEncryptionCipher(KeyX0x1B, TestIV);
+                byte[] actual = cipher.ProcessBytes(TestPattern);
+                if (!actual.EqualsExactly(ExpectedKeyX0x1B))
+                    return;
+
+                // Assign the validated value
+                field = value;
+            }
+        } = [];
+
+        /// <summary>
+        /// Dev KeyX 0x1B New 3DS 9.6)
+        /// </summary>
+        public byte[] DevKeyX0x1B
+        {
+            get;
+            set
+            {
+                // Ignore missing key data
+                if (value.Length == 0)
+                    return;
+
+                // Validate the key data
+                var cipher = AESCTR.CreateEncryptionCipher(DevKeyX0x1B, TestIV);
+                byte[] actual = cipher.ProcessBytes(TestPattern);
+                if (!actual.EqualsExactly(ExpectedDevKeyX0x1B))
+                    return;
+
+                // Assign the validated value
+                field = value;
+            }
+        } = [];
+
+        /// <summary>
+        /// KeyX 0x25 (> 7.x)
+        /// </summary>
+        public byte[] KeyX0x25
+        {
+            get;
+            set
+            {
+                // Ignore missing key data
+                if (value.Length == 0)
+                    return;
+
+                // Validate the key data
+                var cipher = AESCTR.CreateEncryptionCipher(KeyX0x25, TestIV);
+                byte[] actual = cipher.ProcessBytes(TestPattern);
+                if (!actual.EqualsExactly(ExpectedKeyX0x25))
+                    return;
+
+                // Assign the validated value
+                field = value;
+            }
+        } = [];
+
+        /// <summary>
+        /// Dev KeyX 0x25 (> 7.x)
+        /// </summary>
+        public byte[] DevKeyX0x25
+        {
+            get;
+            set
+            {
+                // Ignore missing key data
+                if (value.Length == 0)
+                    return;
+
+                // Validate the key data
+                var cipher = AESCTR.CreateEncryptionCipher(DevKeyX0x25, TestIV);
+                byte[] actual = cipher.ProcessBytes(TestPattern);
+                if (!actual.EqualsExactly(ExpectedDevKeyX0x25))
+                    return;
+
+                // Assign the validated value
+                field = value;
+            }
+        } = [];
+
+        /// <summary>
+        /// KeyX 0x2C (< 6.x)
+        /// </summary>
+        public byte[] KeyX0x2C
+        {
+            get;
+            set
+            {
+                // Ignore missing key data
+                if (value.Length == 0)
+                    return;
+
+                // Validate the key data
+                var cipher = AESCTR.CreateEncryptionCipher(KeyX0x2C, TestIV);
+                byte[] actual = cipher.ProcessBytes(TestPattern);
+                if (!actual.EqualsExactly(ExpectedKeyX0x2C))
+                    return;
+
+                // Assign the validated value
+                field = value;
+            }
+        } = [];
+
+        /// <summary>
+        /// Dev KeyX 0x2C (< 6.x)
+        /// </summary>
+        public byte[] DevKeyX0x2C
+        {
+            get;
+            set
+            {
+                // Ignore missing key data
+                if (value.Length == 0)
+                    return;
+
+                // Validate the key data
+                var cipher = AESCTR.CreateEncryptionCipher(DevKeyX0x2C, TestIV);
+                byte[] actual = cipher.ProcessBytes(TestPattern);
+                if (!actual.EqualsExactly(ExpectedDevKeyX0x2C))
+                    return;
+
+                // Assign the validated value
+                field = value;
+            }
+        } = [];
+
+        #region Internal Test Values
+
+        /// <summary>
+        /// Initial value for key validation tests
+        /// </summary>
+        private static readonly byte[] TestIV =
+        [
+            0x00, 0x01, 0x02, 0x03, 0x04, 0x05, 0x06, 0x07,
+                0x08, 0x09, 0x0A, 0x0B, 0x0C, 0x0D, 0x0E, 0x0F,
+            ];
+
+        /// <summary>
+        /// Pattern to use for key validation tests
+        /// </summary>
+        private static readonly byte[] TestPattern =
+        [
+            0x0F, 0x0E, 0x0D, 0x0C, 0x0B, 0x0A, 0x09, 0x08,
+                0x07, 0x06, 0x05, 0x04, 0x03, 0x02, 0x01, 0x00,
+                0x0F, 0x0E, 0x0D, 0x0C, 0x0B, 0x0A, 0x09, 0x08,
+                0x07, 0x06, 0x05, 0x04, 0x03, 0x02, 0x01, 0x00,
+                0x0F, 0x0E, 0x0D, 0x0C, 0x0B, 0x0A, 0x09, 0x08,
+                0x07, 0x06, 0x05, 0x04, 0x03, 0x02, 0x01, 0x00,
+                0x0F, 0x0E, 0x0D, 0x0C, 0x0B, 0x0A, 0x09, 0x08,
+                0x07, 0x06, 0x05, 0x04, 0x03, 0x02, 0x01, 0x00,
+            ];
+
+        /// <summary>
+        /// Expected output value for KeyX0x18
+        /// </summary>
+        private static readonly byte[] ExpectedKeyX0x18 =
+        [
+            0x06, 0xF1, 0xB2, 0x3B, 0x12, 0xAD, 0x80, 0xC1,
+                0x13, 0xC6, 0x18, 0x3D, 0x27, 0xB8, 0xB9, 0x95,
+                0x49, 0x73, 0x59, 0x82, 0xEF, 0xFE, 0x16, 0x48,
+                0x91, 0x2A, 0x89, 0x55, 0x9A, 0xDC, 0x3C, 0xA0,
+                0x84, 0x46, 0x14, 0xE0, 0x16, 0x59, 0x8E, 0x4F,
+                0xC2, 0x6C, 0x52, 0xA4, 0x7D, 0xAD, 0x4F, 0x23,
+                0xF1, 0xC6, 0x99, 0x44, 0x39, 0xB7, 0x42, 0xF0,
+                0x1F, 0xBB, 0x02, 0xF6, 0x0A, 0x8A, 0xC2, 0x9A,
+            ];
+
+        /// <summary>
+        /// Expected output value for DevKeyX0x18
+        /// </summary>
+        private static readonly byte[] ExpectedDevKeyX0x18 =
+        [
+            0x99, 0x6E, 0x3C, 0x54, 0x97, 0x3C, 0xEA, 0xE8,
+                0xBA, 0xAE, 0x18, 0x5C, 0x93, 0x27, 0x65, 0x50,
+                0xF6, 0x6D, 0x67, 0xD7, 0xEF, 0xBD, 0x7C, 0xCB,
+                0x8A, 0xC1, 0x1A, 0x54, 0xFC, 0x3B, 0x8B, 0x3A,
+                0x0E, 0xE5, 0xEF, 0x27, 0x4A, 0x73, 0x7E, 0x0A,
+                0x2E, 0x2E, 0x9D, 0xAF, 0x6C, 0x03, 0xF2, 0x91,
+                0xC4, 0xFA, 0x73, 0xFD, 0x6B, 0xA0, 0x07, 0xD4,
+                0x75, 0x5B, 0x6F, 0x2E, 0x8B, 0x68, 0x4C, 0xD1,
+            ];
+
+        /// <summary>
+        /// Expected output value for KeyX0x1B
+        /// </summary>
+        private static readonly byte[] ExpectedKeyX0x1B =
+        [
+            0x0A, 0xE4, 0x79, 0x02, 0x1B, 0xFA, 0x25, 0x4B,
+                0x2D, 0x92, 0x4F, 0xA8, 0x41, 0x59, 0xCE, 0x10,
+                0x09, 0xE6, 0x08, 0x61, 0x23, 0xC7, 0xD2, 0x30,
+                0x84, 0x37, 0xD5, 0x49, 0x42, 0x94, 0xB2, 0x70,
+                0x6A, 0xF3, 0x75, 0xB0, 0x1F, 0x4F, 0xA1, 0xCE,
+                0x03, 0xA2, 0x6A, 0x19, 0x5D, 0x32, 0x0D, 0xB5,
+                0x79, 0xCD, 0xFD, 0xF0, 0xDE, 0x49, 0x26, 0x2D,
+                0x29, 0x36, 0x30, 0x69, 0x8B, 0x45, 0xE1, 0xFC,
+            ];
+
+        /// <summary>
+        /// Expected output value for DevKeyX0x1B
+        /// </summary>
+        private static readonly byte[] ExpectedDevKeyX0x1B =
+        [
+                0x16, 0x4F, 0xD9, 0x58, 0xC9, 0x20, 0xB3, 0xED,
+                0xC4, 0xEB, 0x57, 0x39, 0x10, 0xEF, 0xA8, 0xCC,
+                0xE5, 0x49, 0xBF, 0x52, 0x10, 0xA9, 0xCC, 0xE1,
+                0x65, 0x3B, 0x2D, 0x51, 0x45, 0xFB, 0x60, 0x52,
+                0x3E, 0x29, 0xEB, 0xEB, 0x3F, 0xF2, 0x76, 0x08,
+                0x00, 0x05, 0x7F, 0x64, 0x29, 0x4A, 0x17, 0x22,
+                0x56, 0x7F, 0x49, 0x94, 0x1A, 0x8C, 0x56, 0x35,
+                0x38, 0xBE, 0xA4, 0x2E, 0x58, 0xD3, 0x81, 0x8C,
+            ];
+
+        /// <summary>
+        /// Expected output value for KeyX0x25
+        /// </summary>
+        private static readonly byte[] ExpectedKeyX0x25 =
+        [
+            0x37, 0xBC, 0x73, 0xD6, 0xEE, 0x73, 0xE0, 0x94,
+                0x42, 0x84, 0x74, 0xE5, 0xD8, 0xFB, 0x5F, 0x65,
+                0xF4, 0xCF, 0x2E, 0xC1, 0x43, 0x48, 0x6C, 0xAA,
+                0xC8, 0xF9, 0x96, 0xE6, 0x33, 0xDD, 0xE7, 0xBF,
+                0xD2, 0x21, 0x89, 0x39, 0x13, 0xD1, 0xEC, 0xCA,
+                0x1D, 0x5D, 0x1F, 0x77, 0x95, 0xD2, 0x8B, 0x27,
+                0x92, 0x79, 0xC5, 0x1D, 0x72, 0xA7, 0x28, 0x57,
+                0x41, 0x0E, 0x46, 0xB8, 0x80, 0x7B, 0x7C, 0x0D,
+            ];
+
+        /// <summary>
+        /// Expected output value for DevKeyX0x25
+        /// </summary>
+        private static readonly byte[] ExpectedDevKeyX0x25 =
+        [
+            0x71, 0x65, 0x30, 0xF2, 0x68, 0xEC, 0x65, 0x0A,
+                0x8C, 0x9E, 0xC5, 0x5A, 0xFA, 0x37, 0x8E, 0xDA,
+                0x7B, 0x58, 0x3B, 0x66, 0x7C, 0x9D, 0x16, 0xD9,
+                0x2D, 0x8F, 0xCF, 0x04, 0x66, 0x7F, 0x27, 0x41,
+                0xBF, 0x5F, 0x1E, 0x11, 0x4C, 0xD6, 0xB9, 0x0A,
+                0xC5, 0x42, 0xCF, 0x2B, 0x87, 0x6B, 0xD4, 0x72,
+                0x4D, 0x9C, 0x29, 0x2E, 0xF8, 0xB0, 0x6F, 0x22,
+                0x35, 0x5B, 0x96, 0x83, 0xD1, 0xE4, 0x5E, 0xDB,
+            ];
+
+        /// <summary>
+        /// Expected output value for KeyX0x2C
+        /// </summary>
+        private static readonly byte[] ExpectedKeyX0x2C =
+        [
+            0xAE, 0x44, 0x20, 0xDB, 0xA5, 0x96, 0xDC, 0xF3,
+                0xD8, 0x23, 0x9E, 0x3C, 0x44, 0x73, 0x3D, 0xCD,
+                0x07, 0xD5, 0xF8, 0xD0, 0xC6, 0xB3, 0x5A, 0x80,
+                0xB5, 0x5A, 0x55, 0x30, 0x5D, 0x4A, 0xBE, 0x61,
+                0xBF, 0xEF, 0x64, 0x17, 0x28, 0xD6, 0x26, 0x52,
+                0x42, 0x4D, 0x8F, 0x1C, 0xBC, 0x63, 0xD3, 0x91,
+                0x7D, 0xA6, 0x4F, 0xAF, 0x26, 0x38, 0x60, 0xEE,
+                0x79, 0x92, 0x2F, 0xD8, 0xCA, 0x4E, 0xE7, 0xEC,
+            ];
+
+        /// <summary>
+        /// Expected output value for DevKeyX0x2C
+        /// </summary>
+        private static readonly byte[] ExpectedDevKeyX0x2C =
+        [
+            0x5F, 0x73, 0xD5, 0x9A, 0x67, 0xFF, 0x8C, 0x12,
+                0x31, 0x58, 0x0B, 0x58, 0x46, 0xFE, 0x05, 0x16,
+                0x92, 0xE4, 0x84, 0x06, 0x18, 0x9B, 0x58, 0x91,
+                0xE7, 0xF8, 0xCD, 0xA9, 0x95, 0xAC, 0x07, 0xCD,
+                0x43, 0x20, 0x7A, 0x8C, 0xCC, 0xAB, 0x48, 0x50,
+                0x29, 0x2F, 0x96, 0x73, 0xB0, 0xD9, 0xE5, 0xCB,
+                0xE6, 0x9A, 0x0D, 0xF7, 0xD0, 0x1E, 0xC2, 0xEC,
+                0xC1, 0xE2, 0x8E, 0xEE, 0x89, 0xB9, 0xB1, 0x97,
+            ];
+
+        #endregion
+    }
+}
diff --git a/SabreTools.Security.Cryptography/N3DSPartitionKeys.cs b/SabreTools.Security.Cryptography/N3DSPartitionKeys.cs
new file mode 100644
index 0000000..0d0921f
--- /dev/null
+++ b/SabreTools.Security.Cryptography/N3DSPartitionKeys.cs
@@ -0,0 +1,92 @@
+using System;
+using SabreTools.IO.Extensions;
+
+namespace SabreTools.Security.Cryptography
+{
+    /// <summary>
+    /// Set of all keys associated with a 3DS partition
+    /// </summary>
+    public class N3DSPartitionKeys
+    {
+        /// <summary>
+        /// Primary AES-CTR encryption key
+        /// </summary>
+        /// <remarks>Used for both EXE-FS and ROM-FS</remarks>
+        public byte[] NormalKey { get; private set; }
+
+        /// <summary>
+        /// Secondary AES-CTR encryption key
+        /// </summary>
+        /// <remarks>Used for only EXE-FS</remarks>
+        public byte[] NormalKey2C { get; }
+
+        /// <summary>
+        /// First 16 bytes of the RSA-2048 signature
+        /// </summary>
+        /// <remarks>Used as an XOR value during key generation</remarks>
+        private readonly byte[] KeyY;
+
+        /// <summary>
+        /// Create a new set of keys for a given partition
+        /// </summary>
+        /// <param name="signature">RSA-2048 signature from the partition</param>
+        /// <param name="fixedCryptoKey">Flag indicating if the FixedCryptoKey bit mask was set</param>
+        /// <param name="hardwareConstant">AES hardware constant to use</param>
+        /// <param name="keyX">KeyX value to assign based on crypto method and development status</param>
+        /// <param name="keyX0x2C">KeyX2C value to assign based on development status</param>
+        public N3DSPartitionKeys(byte[]? signature, bool fixedCryptoKey, byte[] hardwareConstant, byte[] keyX, byte[] keyX0x2C)
+        {
+            // Validate inputs
+            if (signature is not null && signature.Length < 16)
+                throw new ArgumentOutOfRangeException(nameof(signature), $"{nameof(signature)} must be at least 16 bytes");
+
+            // Backup headers can't have a KeyY value set
+            KeyY = new byte[16];
+            if (signature is not null)
+                Array.Copy(signature, KeyY, 16);
+
+            // Special case for zero-key
+            if (fixedCryptoKey)
+            {
+                Console.WriteLine("Encryption Method: Zero Key");
+                NormalKey = new byte[16];
+                NormalKey2C = new byte[16];
+                return;
+            }
+
+            // Set the standard normal key values
+            NormalKey = ProcessKey(keyX, KeyY, hardwareConstant);
+            NormalKey2C = ProcessKey(keyX0x2C, KeyY, hardwareConstant);
+        }
+
+        /// <summary>
+        /// Set RomFS values based on the bit masks
+        /// </summary>
+        /// <param name="fixedCryptoKey">Flag indicating if the FixedCryptoKey bit mask was set</param>
+        /// <param name="hardwareConstant">AES hardware constant to use</param>
+        /// <param name="keyX0x2C">KeyX2C value to assign based on development status</param>
+        public void SetRomFSValues(bool fixedCryptoKey, byte[] hardwareConstant, byte[] keyX0x2C)
+        {
+            // NormalKey has a constant value for zero-key
+            if (fixedCryptoKey)
+            {
+                NormalKey = new byte[16];
+                return;
+            }
+
+            // Encrypting RomFS for partitions 1 and up always use Key0x2C
+            NormalKey = ProcessKey(keyX0x2C, KeyY, hardwareConstant);
+        }
+
+        /// <summary>
+        /// Process a key with the standard processing steps
+        /// </summary>
+        private static byte[] ProcessKey(byte[] keyBase, byte[] keyY, byte[] hardwareConstant)
+        {
+            byte[] processed = keyBase.RotateLeft(2);
+            processed = processed.Xor(keyY);
+            processed = processed.Add(hardwareConstant);
+            return processed.RotateLeft(87);
+        }
+    }
+}