Intel® Stratix® 10 Device Security User Guide

ID 683642
Date 7/20/2022
Public

A newer version of this document is available. Customers should click here to go to the newest version.

Document Table of Contents

4.6.2.1. Intrinsic ID PUF Enrollment

To enroll the PUF, you must use the SDM provision firmware. The provision firmware must be the first firmware loaded after a power cycle, and you must issue the PUF enrollment command before any other command. The provision firmware supports other commands after PUF enrollment, including AES root key wrapping and programming quad SPI, however, you must power cycle the device to load a configuration bitstream.

You use the Intel® Quartus® Prime Programmer to trigger PUF enrollment and generate the PUF helper data .puf file.
Figure 6. Intrinsic ID PUF Enrollment
The Programmer automatically loads a provision firmware helper image when you specify both the i operation and a .puf argument.
quartus_pgm -c 1 -m jtag -o “ei;help_data.puf;1SX280LH2”
If you are using co-signed firmware, you program the co-signed firmware helper image prior to using the PUF enrollment command.
quartus_pgm -c 1 -m jtag -o “p;signed_provision_helper_image.rbf” --force
quartus_pgm -c 1 -m jtag -o "e;help_data.puf;1SX280LH2"