Configuration Security Unit - 2020.2 English

Zynq UltraScale+ MPSoC Software Developer Guide (UG1137)

Document ID
Release Date
2020.2 English

The following are some of the important responsibilities of the configuration security unit (CSU):

  • Secure boot.
  • Tamper monitoring and response.
  • Secure key storage and management.
  • Cryptographic hardware acceleration.

The CSU comprises two main blocks as shown in the following figure. On the left is the secure processor block that contains a triple redundant processor for controlling boot operation. It also contains an associated ROM, a small private RAM, and the necessary control/status registers required to support all secure operations. The block on the right is the crypto interface block (CIB) and contains the AES-GCM, DMA, SHA, RSA, and PCAP interfaces.

Figure 1. Configuration and Security Unit Architecture

After boot, the CSU provides tamper response monitoring. These crypto interfaces are available during runtime. To understand how to use these features, seethe XilFPGA Library v5.3 in the OS and Libraries Document Collection (UG643). See the Security chapter of the Zynq UltraScale+ Device Technical Reference Manual (UG1085) for more information.

Secure Processor Block
The triple-redundant processor architecture enhances the CSU operations during single event upset (SEU) conditions.
Crypto Interface Block (CIB)
Consists of AES-GCM, DMA, SHA-3/384, RSA, and PCAP interfaces.
The AES-GCM core has a 32-bit word-based data interface, with 256-bits of key support.
Key Management
To use the AES, a key must be loaded into the AES block. The key is selected by CSU bootROM.
The SHA-3/384 engine is used to calculate a hash value of the input image for authentication.
RSA-4096 Accelerator
Facilitates RSA authentication.

To understand boot image encryption or authentication, refer to the following: