Intel® Agilex™ Device Security User Guide

ID 683823
Date 10/31/2022
Public

A newer version of this document is available. Customers should click here to go to the newest version.

Document Table of Contents

5.3. Platform Attestation

You can generate a reference integrity manifest (.rim) file using the programming file generator tool:
quartus_pfg -c signed_encrypted_top.rbf top_rim.rim
Follow these steps to ensure the platform attestation in your design:
  1. Use the Intel® Quartus® Prime Pro Programmer to configure your device with the design you created a reference integrity manifest for.
  2. Use a platform attestation verifier to enroll the device by issuing commands to the SDM via the SDM mailbox to create the device ID certificate and firmware certificate on reload.
  3. Use the Intel® Quartus® Prime Pro Programmer to reconfigure your device with the design.
  4. Use the platform attestation verifier to issue commands to the SDM to get the attestation device ID, firmware, and alias certificates.
  5. Use the attestation verifier to issue the SDM mailbox command to get the attestation evidence and the verifier checks the returned evidence.
  6. Leave the TCK pin unconnected or connect the TCK pin to the VCCIO_SDM power supply using a 10 kΩ resistor. The existing guidance in the Pin Connection Guidelines to connect TCK to a 1-kΩ pull-down resistor is included for noise suppression. The change in guidance to a 10 kΩ pull-up resistor doesn't affect the device functionally. For more information about connecting the TCK pin, refer to Intel® Agilex® Pin Connection Guidelines.

You may implement your own verifier service using the SDM mailbox commands, or use the Intel platform attestation verifier service. For more information about Intel platform attestation verifier service software, availability, and documentation, contact Intel Support.

Did you find the information on this page useful?

Characters remaining:

Feedback Message