3.3.1. Configuration Bitstream Encryption Using the Programming File Generator Graphical Interface 3.3.2. Configuration Bitstream Encryption Using the Programming File Generator Command Line Interface 3.3.3. Partially Encrypted Configuration Bitstream Generation Using the Command Line Interface 3.3.4. Partial Reconfiguration Bitstream Encryption
4.1. Using SDM Provision Firmware 4.2. Using QSPI Factory Default Helper Image on Owned Devices 4.3. Authentication Root Key Provisioning 4.4. Programming Key Cancellation ID Fuses 4.5. Canceling Root Keys 4.6. Programming Counter Fuses 4.7. Secure Data Object Service Root Key Provisioning 4.8. Security Setting Fuse Provisioning 4.9. AES Root Key Provisioning 4.10. Converting Owner Root Key, AES Root Key Certificates, and Fuse files to Jam STAPL File Formats
2.2.4. Partial Reconfiguration Multi-Authority Support
Intel® Agilex™ devices support partial reconfiguration multi-authority authentication, where the device owner creates and signs the static bitstream, and a separate PR owner creates and signs PR persona bitstreams. Intel® Agilex™ devices implement multi-authority support by assigning the first authentication root key slots to the device or static bitstream owner, and assigning the final authentication root key slot to the partial reconfiguration persona bitstream owner.
Note: Partial Reconfiguration static and persona bitstream encryption when multi-authority support is enabled is planned in a future release.
Implementing partial reconfiguration multi-authority support requires several steps:
- The device or static bitstream owner generates one or more authentication root keys as described in Creating Authentication Key Pairs in SoftHSM, where the --key_type option has value owner.
- The partial reconfiguration bitstream owner generates an authentication root key, but changes the --key_type option value to secondary_owner.
- Both the static bitstream and partial reconfiguration design owners ensure that the Enable Multi-Authority support checkbox is enabled in the Assignments > Device > Device and Pin Options > Security tab.
Figure 2. Intel® Quartus® Prime Enable Multi-Authority Option Settings
- Both the static bitstream and partial reconfiguration design owners create signature chains based on their respective root keys as described in Creating a Signature Chain.
- Both the static bitstream and partial reconfiguration design owners convert their compiled designs to .rbf format files and sign the .rbf files.
- The device or static bitstream owner generates and signs a PR public key program authorization compact certificate.
quartus_pfg --ccert –o ccert_type=PR_PUBKEY_PROG_AUTH \ –o owner_qky_file="root0.qky;root1.qky" unsigned_pr_pubkey_prog.ccert
quartus_sign --family=agilex --operation=sign \ --qky=design0_sign_chain.qky --pem=design0_sign_private.pem \ --cancel=svnA:0 unsigned_pr_pubkey_prog.ccert signed_pr_pubkey_prog.ccert
quartus_sign --family=agilex --operation=sign --module=softHSM \ --module_args="--token_label=s10-token --user_pin=s10-token-pin \ --hsm_lib=/usr/local/lib/softhsm/libsofthsm2.so" \ --keyname=design0_sign --qky=design0_sign_chain.qky \ --cancel=svnA:0 unsigned_pr_pubkey_prog.ccert signed_pr_pubkey_prog.ccert
- The device or static bitstream owner provisions their authentication root key hashes to the device, then programs the PR public key program authorization compact certificate, and finally provisions the partial reconfiguration bitstream owner root key to the device. The Device Provisioning section describes this provisioning process.
- Intel® Agilex™ device is configured with the static region .rbf file.
- Intel® Agilex™ device is partially reconfigured with the persona design .rbf file.
Did you find the information on this page useful?