The BQ34Z100 implements a key-access scheme to transition between SEALED, UNSEALED, and FULL ACCESS modes. Each transition requires that a unique set of two keys be sent to the BQ34Z100 via the Control() command (these keys are unrelated to the keys used for SHA-1/HMAC authentication). The keys must be sent consecutively, with no other data being written to the Control() register in between. Note that to avoid conflict, the keys must be different from the codes presented in the CNTL DATA column of Table 7-2 subcommands.

When in SEALED mode, the [SS] bit of Control Status() is set, but when the UNSEAL keys are correctly received by the BQ34Z100, the [SS] bit is cleared. When the full access keys are correctly received, then the Flags() [FAS] bit is cleared.

Both sets of keys for each level are 2 bytes each in length and are stored in data flash. The UNSEAL key (stored at Unseal Key 0 and Unseal Key 1) and the FULL ACCESS key (stored at Full Access Key 0 and Full Access Key 1) can only be updated when in FULL ACCESS mode. The order of the bytes entered through the Control() command is the reverse of what is read from the part. For example, if the 1st and 2nd word of the UnSeal Key 0 returns 0x1234 and 0x5678, then Control() should supply 0x3412 and 0x7856 to unseal the part.