PUF Registration in Boot Header Mode - 2024.2 English - UG1209

The PUF registration software is included in the XILSKEY library. The PUF registration software operates in a boot header mode or eFUSE mode. The boot header mode allows development without programming the OTP eFUSEs. The eFUSE mode is used in production. This lab runs through PUF registration in boot header mode only. For PUF registration using eFUSE, see Programming BBRAM and eFUSEs (XAPP1319).

The PUF registration software accepts a red (unencrypted) key as input, and produces syndrome data (helper data), which also contains CHASH and AUX, and a black (encrypted) key. When the PUF boot header mode is used, the output is put in the boot header. When the PUF eFUSE mode is used, the output is programmed into eFUSEs.

1. In the Vitis IDE, navigate to tmr_psled_r5 Board Support Package Settings.

2. Ensure that the xilskey and the xilsecure libraries are enabled.

   

3. Click OK. Rebuild the hardware platform for changes to apply. Navigate to tmr_psled_r5_bsp settings.

4. Scroll to the Libraries section. Click xilskey 6.8 Import Examples.

5. In the view, select xilskey_puf_registration example. Click OK.

   

6. In the Project Explorer view, verify that the xilskey_puf_example_1 application is created.

7. In the Project Explorer view, xilskey_puf_example_1 ‘Src’, double-click xilskey_puf_registration.h to open it in the Vitis IDE.

8. Edit xilskey_puf_registration.h as follows:

   1. Change #define XSK_PUF_INFO_ON_UART from FALSE to TRUE.

   2. Ensure that #define XSK_PUF_PROGRAM_EFUSE is set to FALSE.

   3. Set XSK_PUF_AES_KEY (256-bit key).

      The key must be entered in hex format and should be Key 0 from the fsbl_a53.nky file that you generated in Generating All of the AES Keys. You can find a sample key below:

      #define XSK_PUF_AES_KEY
      "68D58595279ED1481C674383583C1D98DA816202A57E7FE4F67859CB069CD510"
      

      Note

      Do not copy this key. Refer to the fsbl_a53.nky file for your key.

   4. Set the XSK_PUF_BLACK_KEY_IV. The initialization vector IV is a 12-byte piece of data of your choice.

      #define XSK_PUF_BLACK_KEY_IV \"E1757A6E6DD1CC9F733BED31\"
      

      

9. Save the file and exit.

10. In the Project Explorer view, right-click the xilskey_puf_example_1 project and select Build Project.

11. In the Vitis IDE, select Vitis → Create Boot Image.

12. Select Zynq Ultrascale+ in the Architecture view.

13. Specify the BIF path in the Output BIF file path view as C:\edt\secureboot_sd\puf_registration\puf_registration.bif.

14. Specify the output path in the Output Path view as C:\edt\secureboot_sd\puf_registration\BOOT.bin.

15. In the Boot Image Partitions pane, click Add. Add the partitions and set the destination CPU of the xilskey_puf_example_1 application to R5-0:

C:\edt\fsbl_a53\Debug\fsbl_a53.elf
C:\edt\xilskey_puf_example_1\Debug\xilskey_puf_example_1.elf

16. Click Create Image to create the boot image for PUF registration.

    

17. Insert an SD card into the PC SD card slot.

18. Copy C:\edt\secureboot_sd\puf_registration\BOOT.bin to the SD card.

19. Move the SD card from the PC SD card slot to the ZCU102 card slot.

20. Start a terminal session using Tera Term or Minicom depending on the host machine being used, as well as the COM port and baud rate for your system.

21. In the communication terminal menu bar, select File → Log. Enter C:\edt\secureboot_sd\puf_registration\puf_registration.log in the view.

22. Power cycle the board.

23. After the puf_registration software has run, exit the communication terminal.

24. The puf_registration.log file is used in Using PUF in Boot Header Mode. Open puf_registration.log in a text editor.

25. Save the PUF Syndrome data that starts after App PUF Syndrome data Start!!! and ends at PUF Syndrome data End!!!, non-inclusive, to a file named helperdata.txt.

26. Save the black key IV identified by App: Black Key IV to a file named black_iv.txt.

27. Save the black key to a file named black_key.txt.

28. The files helperdata.txt, black_key.txt, and black_iv.txt can be saved in C:\edt\secure_boot_sd\keys.