Bitstream Encryption

410 views Asked by At

I have a question related to bitstream encryption using eFUSE option. If my FPGA has bitstream encryption key stored in the eFUSE, how Vivado will know the encryption key when generating new encrypted bitstream? Does Vivado has a method to readback the key from eFUSE and use it for encryption?

1

There are 1 answers

2
Fra93 On BEST ANSWER

How can Vivado know the encryption key?

Vivado uses an NKY file that is generated when setting the encryption key. For instance when executing

 set_property BITSTREAM.ENCRYPTION.KEY0 56’h12345678ABCDDCBA12345678ABCDDCBA12345678ABCDDCBA12345678ABCDDCBA current_design]

An NKY file will be create, whose format is:

KEY 0 <hex string> (256 bit AES key)

For example: (top.nky)

Device xc7k325t;
Key 0 12345678ABCDDCBA12345678ABCDDCBA12345678ABCDDCBA12345678ABCDDCBA;
Key StartCBC 7115e9aa80085ea3ed65d26d3a8ab608;
Key HMAC d293d51c6058430262b05521f8f67279c9abce27d5fcafcf839bbe1af46713cc;

Can Vivado read back the key?

Quoting XAPP1239

The encryption key can only be loaded onto a device through the JTAG interface

After the key is programmed and the key-access mode is exited, the key cannot be read out of the device by any means, and it cannot be reprogrammed without clearing the entire device.