Security User Guide: Intel® Programmable Acceleration Card with Intel® Arria® 10 GX FPGA

ID 683453
Date 3/06/2020
Document Table of Contents

3.3. Creating Unsigned Images

The TCM does not accept an AFU without the prepended authentication blocks generated by PACSign, even if an AFU root entry hash bitstream has not been programmed. If you want to operate an Intel® FPGA PAC without a root entry hash bitstream programmed, such as in a development environment, you must still use PACSign to prepend the authentication blocks but you may do so with an empty signature chain. An image with prepended authentication blocks containing an empty signature chain is called an unsigned image. PACSign supports the creation of an unsigned image by using the UPDATE operation without specifying keys. Intel recommends using signed images in production deployments.

  1. Create unsigned bitstream.
    Using OpenSSL:
    [PACSign_Demo]$ PACSign PR -t UPDATE -H openssl_manager -i hello_afu.gbs \
    -o hello_afu_unsigned_ssl.gbs
    Using HSM:
    [PACSign_Demo]$ PACSign PR -t UPDATE -H pkcs11_manager -C softhsm.json \
    -i hello_afu.gbs -o hello_afu_unsigned_hsm.gbs
    The output prompts you to enter Y or N to continue generating an unsigned bitstream.
    No root key specified. Generate unsigned bitstream? Y = yes, N = no: Y
    No CSK specified. Generate unsigned bitstream? Y = yes, N = no: Y
  2. Program the unsigned bitstream.
    [PACSign_Demo]$ sudo fpgasupdate hello_afu_unsigned_ssl.gbs b2:00.0
    Note: If you attempt to program an AFU without the prepended authentication blocks, the TCM rejects the update and the Intel® FPGA PAC requires a power cycle before the next programming attempt.