A newer version of this document is available. Customers should click here to go to the newest version.
3.3.1. Configuration Bitstream Encryption Using the Programming File Generator Graphical Interface 3.3.2. Configuration Bitstream Encryption Using the Programming File Generator Command Line Interface 3.3.3. Partially Encrypted Configuration Bitstream Generation Using the Command Line Interface 3.3.4. Partial Reconfiguration Bitstream Encryption
4.1. Using SDM Provision Firmware 4.2. Using QSPI Factory Default Helper Image on Owned Devices 4.3. Authentication Root Key Provisioning 4.4. Programming Key Cancellation ID Fuses 4.5. Canceling Root Keys 4.6. Programming Counter Fuses 4.7. Secure Data Object Service Root Key Provisioning 4.8. Security Setting Fuse Provisioning 4.9. AES Root Key Provisioning 4.10. Converting Owner Root Key, AES Root Key Certificates, and Fuse files to Jam STAPL File Formats
- 3.3.2. Configuration Bitstream Encryption Using the Programming File Generator Command Line Interface
5.3. Platform Attestation
You can generate a reference integrity manifest (.rim) file using the programming file generator tool:
quartus_pfg -c signed_encrypted_top.rbf top_rim.rim
Follow these steps to ensure the platform attestation in your design:
- Use the Intel® Quartus® Prime Pro Programmer to configure your device with the design you created a reference integrity manifest for.
- Use a platform attestation verifier to enroll the device by issuing commands to the SDM via the SDM mailbox to create the device ID certificate and firmware certificate on reload.
- Use the Intel® Quartus® Prime Pro Programmer to reconfigure your device with the design.
- Use the platform attestation verifier to issue commands to the SDM to get the attestation device ID, firmware, and alias certificates.
- Use the attestation verifier to issue the SDM mailbox command to get the attestation evidence and the verifier checks the returned evidence.
- Avoid externally connecting the TCK pin to pull up or pull down a resistor while still using it for JTAG. However, you may connect the TCK pin to the VCCIO_SDM power supply using a 10 kΩ resistor. The existing guidance in the Pin Connection Guidelines to connect TCK to a 1-kΩ pull-down resistor is included for noise suppression. The change in guidance to a 10 kΩ pull-up resistor doesn't affect the device functionally. For more information about connecting the TCK pin, refer to Intel® Agilex® Pin Connection Guidelines.
You may implement your own verifier service using the SDM mailbox commands, or use the Intel platform attestation verifier service. For more information about Intel platform attestation verifier service software, availability, and documentation, contact Intel Support.
Did you find the information on this page useful?