AN 556: Using the Design Security Features in Intel FPGAs

ID 683269
Date 5/21/2021
Document Table of Contents

Steps for Implementing a Secure Configuration Flow

To implement a secure configuration flow, follow these steps:

  1. Generate the .ekp file and encrypt the configuration data.
    The Intel® Quartus® Prime configuration software always uses the user-defined 256-bit key to generate a key programming file and an encrypted configuration file. The encrypted configuration file is stored in an external memory, such as a flash memory or a configuration device. For details, refer to Step 1: Generating .ekp File and Encrypting Configuration File.
    Note: For the 20-nm FPGAs, you can also encrypt an .rbf by using the stand-alone Qcrypt tool with extended security options.
  2. Program the user-defined 256-bit key into the FPGAs.
  3. Configure the 40-nm, 28-nm or 20-nm FPGA device.
    At power up, the external memory source sends the encrypted configuration file to the FPGA. The device uses the stored key to decrypt the file and to configure itself. For details about how to configure FPGAs with encrypted configuration data, refer to Step 3: Configuring the 40-nm, 28-nm, or 20-nm FPGAs with Encrypted Configuration Data.
    Figure 1. Secure Configuration Flow