The Versal device uses the AES-GCM core, which has support for a 256-bit key. When you create a secure image, you can optionally encrypt each partition in the boot image. Key source and aes key file are the prerequisites for encryption.
Note: When you enable encryption on a
Versal adaptive SoC, you must specify the AES key file and the key
source for each partition. Use the same Key0 in the AES key files corresponding to the
chosen key source, and apply the same mapping in reverse.
Key Management
Good key management practice includes minimizing the use of secret or private keys. Use different key/IV pairs across different partitions in the boot image to accomplish this. As a result, the device uses the AES key stored in BBRAM or eFUSEs for only 384 bits. This significantly limits its exposure to side channel attacks.
all: {
image
{
{type=bootloader, encryption=aes, keysrc=bbram_red_key, aeskeyfile=plm.nky, dpacm_enable, file=plm.elf}
{type=pmcdata, load=0xf2000000, aeskeyfile = pmc_data.nky, file=pmc_data.cdo}
{core=psm, file=psm.elf}
{type=cdo, encryption=aes, keysrc=bbram_red_key, aeskeyfile=ps_data.nky, file=ps_data.cdo}
{type=cdo, file=subsystem.cdo}
{core=a72-0, exception_level = el-3, file=a72-app.elf}
}
}