Using PUF in Boot Header Mode - 2024.2 English - UG1209

The following steps describe the process to update the BIF file from the previous sections to include using the PUF in Boot Header mode. This section makes use of the syndrome data and black key created during PUF registration process.

1. Enable use of the PUF by adding all of the fields and attributes indicated in bold to the BIF file (key_generation.bif) as shown below.

   the_ROM_image:
   {
   [pskfile]psk0.pem
   [sskfile]ssk0.pem
   [auth_params]spk_id = 0; ppk_select = 0
   [keysrc_encryption]bh_blk_key
   [bh_key_iv]black_iv.txt
   [bh_keyfile]black_key.txt
   [puf_file]helperdata.txt
   [fsbl_config]a53_x64, bh_auth_enable, opt_key, puf4kmode, shutter=0x0100005E,pufhd_bh
   [bootloader, authentication = rsa, encryption = aes, aeskeyfile = fsbl_a53.nky, blocks = 1728(*)]fsbl_a53.elf
   [destination_cpu = pmu, authentication = rsa, encryption = aes, aeskeyfile = pmufw.nky, blocks = 1728(*)]pmufw.elf
   [destination_device = pl, authentication = rsa, encryption = aes, aeskeyfile = edt_zcu102_wrapper.nky, blocks = 1728(*)]edt_zcu102_wrapper.bit
   [destination_cpu = a53-0, exception_level = el-3, trustzone, authentication = rsa]bl31.elf
   [destination_cpu = r5-0, authentication = rsa, encryption = aes, aeskeyfile = tmr_psled_r5.nky, blocks =1728(*)]tmr_psled_r5.elf
   [destination_cpu = a53-0, exception_level = el-2, authentication = rsa]u-boot.elf
   [load = 0x1000000, destination_cpu = a53-0, authentication = rsa]image.ub
   }
   

2. The above BIF file can be used for creating a final boot image using an AES key encrypted in the boot image header with the PUF KEK. This should be done using the following bootgen command:

   Note

   The above steps can also be executed with PUF in eFUSE mode. In this case, repeat the previous steps using the PUF in eFUSE mode. This requires enabling the programming of eFUSEs during PUF registration by setting the XSK_PUF_PROGRAM_EFUSE macro in the xilskey_puf_registration.h file used to build the PUF registration application. The BIF must also be modified to use the encryption key from eFUSE, and the helper data and black key files should be removed. PUF in eFUSE mode is not covered in this tutorial to avoid programming the eFUSEs on development or tutorial systems.

   [keysrc_encryption]efuse_blk_key
   [bh_key_iv]black_iv.txt