Bitstream encryption is supported for Tandem Configuration, for both Tandem PROM and Tandem PCIe approaches. For Tandem PCIe, the stage 2 bitstream must remain encrypted using the same key as the stage 1 bitstream, because the MCAP (unlike the ICAP) cannot receive unencrypted bitstreams after an encrypted initial load. Bitstream authentication is only supported for AMD Zynq™ devices, not for FPGAs. Encryption and authentication options must be selected in Bootgen for Zynq UltraScale+ devices. For more information on Bootgen, see Bootgen User Guide (UG1283).