Intel® Agilex™ Device Security User Guide

ID 683823
Date 1/20/2022
Public

A newer version of this document is available. Customers should click here to go to the newest version.

Document Table of Contents

2.2.4. Partial Reconfiguration Multi-Authority Support

Intel® Agilex™ devices support partial reconfiguration multi-authority authentication, where the device owner creates and signs the static bitstream, and a separate PR owner creates and signs PR persona bitstreams. Intel® Agilex™ devices implement multi-authority support by assigning the first authentication root key slots to the device or static bitstream owner, and assigning the final authentication root key slot to the partial reconfiguration persona bitstream owner.
Note: Partial Reconfiguration static and persona bitstream encryption when multi-authority support is enabled is planned in a future release.

Implementing partial reconfiguration multi-authority support requires several steps:

  1. The device or static bitstream owner generates one or more authentication root keys as described in Creating Authentication Key Pairs in SoftHSM, where the --key_type option has value owner.
  2. The partial reconfiguration bitstream owner generates an authentication root key, but changes the --key_type option value to secondary_owner.
  3. Both the static bitstream and partial reconfiguration design owners ensure that the Enable Multi-Authority support checkbox is enabled in the Assignments > Device > Device and Pin Options > Security tab.
    Figure 2.  Intel® Quartus® Prime Enable Multi-Authority Option Settings
  4. Both the static bitstream and partial reconfiguration design owners create signature chains based on their respective root keys as described in Creating a Signature Chain.
  5. Both the static bitstream and partial reconfiguration design owners convert their compiled designs to .rbf format files and sign the .rbf files.
  6. The device or static bitstream owner generates and signs a PR public key program authorization compact certificate.
    quartus_pfg --ccert –o ccert_type=PR_PUBKEY_PROG_AUTH \
    –o owner_qky_file="root0.qky;root1.qky" unsigned_pr_pubkey_prog.ccert
    quartus_sign --family=agilex --operation=sign \ 
    --qky=design0_sign_chain.qky --pem=design0_sign_private.pem \ 
    --cancel=svnA:0 unsigned_pr_pubkey_prog.ccert signed_pr_pubkey_prog.ccert
    quartus_sign --family=agilex --operation=sign --module=softHSM \
    --module_args="--token_label=s10-token --user_pin=s10-token-pin \
    --hsm_lib=/usr/local/lib/softhsm/libsofthsm2.so" \
    --keyname=design0_sign --qky=design0_sign_chain.qky \
    --cancel=svnA:0 unsigned_pr_pubkey_prog.ccert signed_pr_pubkey_prog.ccert
  7. The device or static bitstream owner provisions their authentication root key hashes to the device, then programs the PR public key program authorization compact certificate, and finally provisions the partial reconfiguration bitstream owner root key to the device. The Device Provisioning section describes this provisioning process.
  8. Intel® Agilex™ device is configured with the static region .rbf file.
  9. Intel® Agilex™ device is partially reconfigured with the persona design .rbf file.

Did you find the information on this page useful?

Characters remaining:

Feedback Message