Visible to Intel only — GUID: qiw1616589676749
Ixiasoft
3.3.1. Configuration Bitstream Encryption Using the Programming File Generator Graphical Interface
3.3.2. Configuration Bitstream Encryption Using the Programming File Generator Command Line Interface
3.3.3. Partially Encrypted Configuration Bitstream Generation Using the Command Line Interface
3.3.4. Partial Reconfiguration Bitstream Encryption
4.1. Using SDM Provision Firmware
4.2. Using QSPI Factory Default Helper Image on Owned Devices
4.3. Authentication Root Key Provisioning
4.4. Programming Key Cancellation ID Fuses
4.5. Canceling Root Keys
4.6. Programming Counter Fuses
4.7. Secure Data Object Service Root Key Provisioning
4.8. Security Setting Fuse Provisioning
4.9. AES Root Key Provisioning
4.10. Converting Owner Root Key, AES Root Key Certificates, and Fuse files to Jam STAPL File Formats
Visible to Intel only — GUID: qiw1616589676749
Ixiasoft
4.9.2.1. Intrinsic ID PUF Enrollment
To enroll the PUF, you must use the SDM provision firmware. The provision firmware must be the first firmware loaded after a power cycle, and you must issue the PUF enrollment command before any other command. The provision firmware supports other commands after PUF enrollment, including AES root key wrapping and programming quad SPI, however, you must power cycle the device to load a configuration bitstream.
You use the Intel® Quartus® Prime Programmer to trigger PUF enrollment and generate the PUF helper data .puf file.
Figure 7. Intrinsic ID PUF Enrollment
The Programmer automatically loads a provision firmware helper image when you specify both the i operation and a .puf argument.
quartus_pgm -c 1 -m jtag -o “ei;help_data.puf;AFGB014R24A”
If you are using co-signed firmware, you program the co-signed firmware helper image prior to using the PUF enrollment command.
quartus_pgm -c 1 -m jtag -o “p;signed_provision_helper_image.rbf” --force
quartus_pgm -c 1 -m jtag -o "e;help_data.puf;AFGB014R24A"