Intel® Agilex™ Device Security User Guide

Download PDF
ID 683823
Date 11/09/2021
Public

A newer version of this document is available. Customers should click here to go to the newest version.

Document Table of Contents
Document Table of Contents x
1. Intel® Agilex® Device Security Overview 2. Authentication and Authorization 3. AES Bitstream Encryption 4. Device Provisioning 5. Advanced Features 6. Intel® Agilex™ Device Security User Guide Archives 7. Revision History for the Intel® Agilex® Device Security User Guide
1. Intel® Agilex® Device Security Overview x
1.1. Commitment to Product Security 1.2. Planned Security Features
1.2. Planned Security Features x
1.2.1. Physical Anti-Tamper 1.2.2. Black Key Provisioning 1.2.3. Intrinsic ID® Physically Unclonable Function (PUF) 1.2.4. Partial Reconfiguration Bitstream Security Verification
2. Authentication and Authorization x
2.1. Creating a Signature Chain 2.2. Signing a Configuration Bitstream
2.1. Creating a Signature Chain x
2.1.1. Creating Authentication Key Pairs on the Local Filesystem 2.1.2. Creating Authentication Key Pairs in SoftHSM 2.1.3. Creating the Signature Chain Root Entry 2.1.4. Creating a Signature Chain Public Key Entry
2.2. Signing a Configuration Bitstream x
2.2.1. Quartus Key File Assignment 2.2.2. Co-Signing SDM Firmware 2.2.3. Configuring Bitstream Signing Using the quartus_sign Command 2.2.4. Partial Reconfiguration Multi-Authority Support 2.2.5. Verifying Configuration Bitstream Signature Chains
3. AES Bitstream Encryption x
3.1. Creating the AES Root Key 3.2. Quartus Encryption Settings 3.3. Encrypting a Configuration Bitstream
3.3. Encrypting a Configuration Bitstream x
3.3.1. Configuration Bitstream Encryption Using the Programming File Generator Graphical Interface 3.3.2. Configuration Bitstream Encryption Using the Programming File Generator Command Line Interface 3.3.3. Partially Encrypted Configuration Bitstream Generation Using the Command Line Interface 3.3.4. Partial Reconfiguration Bitstream Encryption
4. Device Provisioning x
4.1. Using SDM Provision Firmware 4.2. Authentication Root Key Provisioning 4.3. Programming Key Cancellation ID Fuses 4.4. Canceling Root Keys 4.5. Programming Counter Fuses 4.6. Secure Data Object Service Root Key Provisioning 4.7. Security Setting Fuse Provisioning 4.8. AES Root Key Provisioning 4.9. Converting Owner Root Key, AES Root Key Certificates, and Fuse files to Jam STAPL File Formats
4.2. Authentication Root Key Provisioning x
4.2.1. Partial Reconfiguration Multi-Authority Root Key Programming
4.8. AES Root Key Provisioning x
4.8.1. AES Root Key Compact Certificate
5. Advanced Features x
5.1. Secure Debug Authorization 5.2. HPS Debug Certificates 5.3. Platform Attestation 5.4. Using Design Security Features with Remote System Update 5.5. SDM Cryptographic Services
5.5. SDM Cryptographic Services x
5.5.1. Vendor Authorized Boot 5.5.2. Secure Data Object Service 5.5.3. SDM Cryptographic Primitive Services
1. Intel® Agilex® Device Security Overview
2. Authentication and Authorization
3. AES Bitstream Encryption
4. Device Provisioning
5. Advanced Features
6. Intel® Agilex™ Device Security User Guide Archives
7. Revision History for the Intel® Agilex® Device Security User Guide

5.4. Using Design Security Features with Remote System Update

Remote System Update (RSU) is an Intel® Agilex® FPGAs feature that assists in updating configuration files in a robust way. RSU is compatible with design security features such as authentication, firmware, co-signing, and bitstream encryption as RSU does not depend on the design contents of configuration bitstreams.

In order to use design security features with RSU images, you follow the instructions in Generating Remote System Update Image Files Using the Programming File Generator of the Intel® Agilex® Configuration User Guide to generate RSU images with .sof file inputs. For every .sof file specified on the Input Files tab, you click the Properties... button and specify the appropriate settings and keys for the signing and encryption tools. The programming file generator tool automatically signs and encrypts factory and application images while creating the RSU programming files.

You may build RSU images with .rbf format files as inputs. You must encrypt and sign .rbf format files prior to selecting them as input files for RSU images; however, the RSU boot info .rbf file must not be encrypted, only signed. The Programming File Generator does not support modifying properties of .rbf format files.

The following examples demonstrate the necessary modifications to the commands in the Generating Remote System Update Image Files Using the Programming File Generator of the Intel® Agilex® Configuration User Guide.

Generating the Initial RSU Image Using .rbf Files: Command Modification

From Generating the Initial RSU Image Using .rbf Files, you modify the commands in Step 1. to enable the design security features as desired using instructions from earlier sections of this document.

In step 2, if you have enabled firmware co-signing, you must use an additional option in the creation of the boot .rbf from the factory image file: 
quartus_pfg -c factory.sof boot.rbf -o rsu_boot=ON \
-o fw_source=signed_agilex.zip

Generating an Application Image: Command Modification

To generate an application image with design security features, you modify the command in Generating an Application Image to use a .rbf with design security features enabled, including co-signed firmware if required, instead of the original application .sof file. 
quartus_pfg -c cosigned_fw_signed_encrypted_application.rbf \
secured_rsu_application.rpd -o mode=ASX4 \
-o start_address=<start_address> -o bitswap=ON

Generating a Factory Update Image: Command Modification

To generate an RSU factory update image, you modify the command from Generating a Factory Update Image to use a .rbf file with design security features enabled and add the option to indicate the co-signed firmware usage. 
quartus_pfg -c cosigned_fw_signed_encrypted_factory.rbf \
secured_rsu_factory_update.rpd \
-o mode=ASX4 -o start_address=<start_address> \
-o bitswap=ON -o rsu_upgrade=ON \
-o fw_source=signed_agilex.zip
Related Information
Level Two Title