When creating a secure boot image for Spartan UltraScale+ devices, each partition within the image can be
optionally encrypted. To enable encryption, you must provide the following two key
parameters for each partition:
- keysrc
- The source of the AES key (for example, eFUSE).
- aeskeyfile
- A file containing the AES encryption key (in .nky format).
Note: Only eFuse based key source is applicable for Spartan UltraScale+.
Key Management Best Practices
Effective key management is crucial for reducing security risks that are specifically related to side-channel attacks. AMD recommends the following practices to minimize the exposure of sensitive AES keys stored in hardware (eFUSE):
- Use distinct Key/IV pairs for each partition
- Avoid reusing the same AES key across multiple partitions
- Limit the effective use of any one hardware-stored key to 384-bit of encrypted data and aligning with best practices for cryptographic containment.
- For fielded systems, generate your own keys using a high-quality entropy source
rather than relying on tool-generated keys. See AR76171 for more information.Note: Refer to LMS Key Expiration Error for more details.