Black/PUF Keys - Black/PUF Keys - 2026.1 English - UG1283

The Versal AI Edge Series Gen 2and Versal Prime Series Gen 2 devices supports Black key encryption using a PUF (Physically Unclonable Function) derived Key Encryption Key (KEK). This secure boot mechanism ensures the system never exposes user keys directly. It encrypts them with the PUF-based KEK. Store the encrypted keys (black keys) in eFUSE or embed them in the boot header.

bif:
{
    bh_kek_iv   = black_iv.txt           // Initialization vector for black key encryption
    bh_keyfile  = black_key.txt          // Encrypted (black) key file
    puf_file    = pufdata.txt            // PUF registration data
    boot_config {puf4kmode}              // Enable 4K mode for PUF
    image
    {
        {type=bootloader, encryption=aes, keysrc=bh_blk_key, pufhd_bh,
         aeskeyfile=red_grey.nky, file=plm.elf}
        {type=pmcdata, load=0xf2000000, aeskeyfile=pmcdata.nky,
         file=pmc_data.cdo}
        {core=psm, file=psm.elf}
        {type=cdo, file=ps_data.cdo}
        {type=cdo, file=subsystem.cdo}
        {core=a72-0, exception_level=el-3, file=hello_world.elf}
    }
}

• bh_kek_iv: Initialization vector used to encrypt the KEK with the PUF.
• bh_keyfile: The file containing the encrypted (black) user key.
• puf_file: Contains PUF data generated during enrollment.
• boot_config {puf4kmode}: Enables 4 KB mode for PUF operations.
• keysrc=bh_blk_key: Indicates the bootloader must use a black key sourced from PUF.
• pufhd_bh: The boot header embeds the PUF header.