Intel® Stratix® 10 Device Security User Guide

Download
ID 683642
Date 12/15/2021
Public

A newer version of this document is available. Customers should click here to go to the newest version.

Document Table of Contents
Document Table of Contents x
1. Intel Stratix 10 Device Security Overview 2. Authentication and Authorization 3. AES Bitstream Encryption 4. Device Provisioning 5. Advanced Features 6. Intel® Stratix® 10 Device Security User Guide Archives 7. Document Revision History for Intel® Stratix® 10 Device Security User Guide
1. Intel Stratix 10 Device Security Overview x
1.1. Commitment to Product Security
2. Authentication and Authorization x
2.1. Creating a Signature Chain 2.2. Signing a Configuration Bitstream
2.1. Creating a Signature Chain x
2.1.1. Creating Authentication Key Pairs on the Local File System 2.1.2. Creating Authentication Key Pairs in SoftHSM 2.1.3. Creating the Signature Chain Root Entry 2.1.4. Creating a Signature Chain Public Key Entry
2.2. Signing a Configuration Bitstream x
2.2.1. Quartus Key File Assignment 2.2.2. Co-Signing SDM Firmware 2.2.3. Signing Configuration Bitstream Using the quartus_sign Command 2.2.4. Verifying Configuration Bitstream Signature Chains
3. AES Bitstream Encryption x
3.1. Creating the AES Root Key 3.2. Quartus Encryption Settings 3.3. Encrypting a Configuration Bitstream
3.3. Encrypting a Configuration Bitstream x
3.3.1. Configuration Bitstream Encryption Using the Programming File Generator Graphical Interface 3.3.2. Configuration Bitstream Encryption Using the Programming File Generator Command Line Interface 3.3.3. Partially Encrypted Configuration Bitstream Generation Using the Command Line Interface 3.3.4. Partial Reconfiguration Bitstream Encryption
4. Device Provisioning x
4.1. Using SDM Provision Firmware 4.2. Authentication Root Key Provisioning 4.3. Using QSPI Factory Default Helper Image on Owned Devices 4.4. Programming Key Cancellation ID Fuses 4.5. Security Setting Fuse Provisioning 4.6. AES Root Key Provisioning 4.7. Converting Owner Root Key, AES Root Key Certificates, and Fuse files to Jam STAPL File Formats
4.6. AES Root Key Provisioning x
4.6.1. AES Root Key Compact Certificate 4.6.2. Intrinsic ID® PUF AES Root Key Provisioning 4.6.3. Black Key Provisioning
4.6.2. Intrinsic ID® PUF AES Root Key Provisioning x
4.6.2.1. Intrinsic ID PUF Enrollment 4.6.2.2. Wrapping the AES Root Key 4.6.2.3. Programming Helper Data and Wrapped Key to QSPI Flash Memory 4.6.2.4. Querying Intrinsic ID PUF Activation Status 4.6.2.5. Location of the PUF in Flash Memory
4.6.3. Black Key Provisioning x
4.6.3.1. Black Key Provisioning Options
5. Advanced Features x
5.1. Secure Debug Authorization 5.2. HPS Debug Certificates 5.3. Platform Attestation 5.4. Physical Anti-Tamper 5.5. Using Design Security Features with Remote System Update
5.4. Physical Anti-Tamper x
5.4.1. Anti-Tamper Responses 5.4.2. Anti-Tamper Detection 5.4.3. Anti-Tamper Lite Intel® FPGA IP
5.4.3. Anti-Tamper Lite Intel® FPGA IP x
5.4.3.1. Release Information
1. Intel Stratix 10 Device Security Overview
2. Authentication and Authorization
3. AES Bitstream Encryption
4. Device Provisioning
5. Advanced Features
6. Intel® Stratix® 10 Device Security User Guide Archives
7. Document Revision History for Intel® Stratix® 10 Device Security User Guide

4.6.3.1. Black Key Provisioning Options

The black key provisioning options is a text file passed to the Programmer through the quartus_pgm command. The file contains required information to trigger black key provisioning.

Example of bkp_options.txt file. 

bkp_cfg_id = 1
bkp_ip = 192.167.1.1
bkp_port = 10034
bkp_tls_ca_cert = root.cert
bkp_tls_prog_cert = prog.cert
bkp_tls_prog_key = prog_key.pem
bkp_tls_prog_key_pass = 1234
bkp_proxy_address = https://192.167.5.5:5000
bkp_proxy_user = proxy_user
bkp_proxy_password = proxy_password
Table 3.  Black Key Provisioning OptionsThis table displays the options required to trigger black key provisioning.
Option Name Type Description
bkp_ip Required Specifies the server IP address running the black key provisioning service.
bkp_port Required Specifies black key provisioning service port required to connect to the server.
bkp_cfg_id Required Identifies the black key provisioning configuration flow ID.

Black key provisioning service creates the black key provisioning configuration flows including an AES root key, desired eFuse settings, and other black key provisioning authorization options. The number assigned during the black key provisioning service setup identifies the black key provisioning configuration flows.

Note: Multiple devices may refer to the same black key provisioning service configuration flow.
bkp_tls_ca_cert Required

The root TLS certificate used to identify the black key provisioning services to the Intel® Quartus® Prime Programmer (Programmer). A trusted Certificate Authority for the black key provisioning service instance issues this certificate.

If you run the Programmer on a computer with Microsoft® Windows® operating system (Windows), you must install this certificate in the Windows certificate store.

bkp_tls_prog_cert

Required

 A certificate created for the instance of the black key provisioning Programmer (BKP Programmer). This is the https client certificate used to identify this BKP programmer instance to the black key provisioning service. You must install and authorize this certificate in the black key provisioning service prior to initiating a black key provisioning session.

If you run the Programmer on Windows, this option is not available. In this case, the bkp_tls_prog_key already includes this certificate.

bkp_tls_prog_key Required The private key corresponding to the BKP Programmer certificate. The key validates the identity of the BKP Programmer instance to black key provisioning service.

If you run the Programmer on Windows, the .pfx file combines the bkp_tls_prog_cert certificate and the private key. The bkp_tlx_prog_key option passes the .pfx file in the bkp_options.txt file.

bkp_tls_prog_key_pass Optional The password for the bkp_tls_prog_key private key. Not required in the black key provisioning configuration options (bkp_options.txt) text file.
bkp_proxy_address Optional Specifies the proxy server URL address.
bkp_proxy_user Optional Specifies the proxy server user name.
bkp_proxy_password Optional Specifies the proxy authentication password.
Level Two Title

Did you find the information on this page useful?

Characters remaining:

Feedback Message