Asymmetric Hardware Root of Trust Secure Boot - Asymmetric Hardware Root of Trust Secure Boot - AM011

The Versal adaptive SoC A-HWRoT boot mode is built upon the use of RSA-4096 or ECDSA P-384 asymmetric authentication algorithms along with hardware acceleration hashing. Versal Premium Series Gen 2 also supports ML-DSA, SLH-DSA, and LMS. The PPK is only used for verifying the signature of the SPK, while the SPK is used to authenticate the contents of the image itself. The following table lists the characteristics of each public key type. For usage details, see the Versal Adaptive SoC Security Manual (UG1508) or the Versal AI Edge Series Gen 2 and Prime Series Gen 2 Security Manual (UG1724) , which are available on the Design Security Lounge.

To reduce the number of fuses required in the Versal adaptive SoC, the full public key is stored in the boot image while 256 bits of a SHA-3/384 hash of each key is securely stored inside the device using eFUSEs. In the Versal Premium Series Gen 2 universal key manifest (UKM) hash is securely stored inside the device using eFUSEs. During the secure boot process, the RCU BootROM code first validates the integrity of the full public key stored in the authenticated boot image by hashing it , taking the hash, and comparing against the value stored in eFUSEs.

There are also 256 SPKs available, each of which are also revocable. The SPK is delivered inside the authenticated boot image, and is signed by the PPK, which is the primary purpose of the PPK. The SPK is intended to authenticate everything else.