Speculation here. Since the PSP is effectively leveraging TrustZone, I'm guessing it's generated and stored inside the TrustZone itself. This article states it'

Speculation here. Since the PSP is effectively leveraging TrustZone, I'm guessing it's generated and stored inside the TrustZone itself. This article states it's generated by a hardware RNG, so user control is unlikely. One important factor missing from this article is the AES cipher mode being used. Not sure how you'd be able to use an authenticated mode and maintain random access, so maybe XTS or even ECB?