Under certain circumstances, Vivado generates encrypted bitstreams for UltraScale 3D ICs and UltraScale+ 3D ICs with insecure encryption settings that can affect authenticity and confidentiality of bitstreams used with the same key.
An adversary can use such a bitstream to forge new bitstreams that a device configured with the same key will accept as authentic. Under certain circumstances, an adversary is able to decrypt the bitstream or parts of it.
The issue arises when bitstreams for 3D ICs are generated using encryption settings meant for monolithic parts. In this case, the same key and IV will be reused for encrypting the bitstream partition of each SLR.
IV reuse in the bitstream encryption leads to a situation where an adversary might be able to construct a ciphertext forgery (loss of authenticity) or decrypt the ciphertext or parts thereof (loss of confidentiality).
More information can be found in NIST SP 800-38D (Appendix A) and NIST SP 800-38A (Appendix B).
Which Devices/Configurations are Affected?
Bitstreams are not affected by this issue when any of the following conditions is met.
- The FPGA used is not Kintex UltraScale, Kintex UltraScale+, Virtex UltraScale, or Virtex UltraScale+.
- The target devices are not 3D ICs.
- Encryption is turned on, but the NKY file, bitstream properties, and Vivado GUI do not define keys and IVs (keys/IVs will be auto-generated).
- Unique keys for each SLR are set up as recommended by Design Advisory 71558.
- The left-most 12 bytes of the IVs for each SLR are unique.
Figure 1. Flowchart to decide if a bitstream configuration is affected by this issue.
Affected by this issue are bitstreams generated for UltraScale and UltraScale+ 3D IC FPGA devices where only one key and IV set is set up, either per GUI configuration (Flow > Settings > Bitstream Settings > Configure additional bitstream settings > Encryption) as shown in Figure 2, NKY file as shown in Listing 1, or constraints as shown in Listing 2.
Figure 2. Insecure UltraScale/UltraScale+ 3D IC encryption configuration in Vivado GUI.
Device xcvu5p_CIV;
EncryptKeySelect BBRAM;
Key0 8b8f5d53860d8e5960169e0c1f43449f9f7e8de79b9157f9bfd870c811c5678f;
StartIV0 cbc9d3a13bb41a26410aa05d70cc2df6;
Listing 1. Insecure UltraScale/UltraScale+ 3D IC encryption configuration in NKY file.
set_property BITSTREAM.ENCRYPTION.ENCRYPT YES [current_design]
set_property BITSTREAM.ENCRYPTION.KEY0 256'h124DF9CEAEA0D3CF5E2CA937735D3807D6A97B2C98EC142C8E89553AC61A95F4 [current_design]
set_property BITSTREAM.ENCRYPTION.STARTIV0 128'h6285FA78ADD68E657C3FB4776729A17A [current_design]
Listing 2. Insecure UltraScale/UltraScale+ 3D IC encryption configuration in constraints file.