Encryption and Authentication - Encryption and Authentication - 2026.1 English - UG1283

Bootgen User Guide (UG1283)
Document ID
UG1283
Release Date
2026-06-23
Version
2026.1 English

AMD 7 series FPGAs use the embedded, PL-based, hash-based message authentication code (HMAC) and an advanced encryption standard (AES) module with a cipher block chaining (CBC) mode. UltraScale devices and newer use AES-256 in Galois Counter Mode (GCM), and they do not require HMAC.

Encryption Example

To create an encrypted bitstream, the AES key file is specified in the BIF using the attribute aeskeyfile. The attribute encryption=aes must be specified against the bitstream listed in the BIF file that needs to be encrypted.

Note: If the AES key file does not exist, Bootgen generates one automatically. This is intended for development use only. For fielded systems, AMD recommends providing your own keys generated from a high-quality entropy source. See AR76171 for more information.
bootgen -arch fpga -image secure.bif -w -o securetop.bit

The BIF file looks like the following:

the_ROM_image:
{
	[aeskeyfile] encrypt.nky
	[encryption=aes] top.bit
}

Authentication Example

A Bootgen command to authenticate an FPGA bitstream is as follows:

bootgen -arch fpga -image all.bif -o rsa.bit -w on -log error

The BIF file is as follows:

the_ROM_image:
{
	[sskfile] rsaPrivKeyInfo.pem
	[authentication=rsa] plain.bit
}

Family or Obfuscated Key

To support obfuscated key encryption, you must register with AMD support and request the family key file for the target device family. Pass the path to where this file is stored as a bif option before attempting obfuscated encryption. Contact secure.solutions@amd.com to obtain the Family Key.

image:
{
	[aeskeyfile] key_file.nky
	[familykey] familyKey.cfg
	[encryption=aes] top.bit
}

The following is the sample aeskey file:

Device       xc7z020clg484;
Key 0        031B27D83F8CDB761268B6014EB11ADCF763048DFD76DEB6CEE169F88DBFFE4A;
IV           FFF8FDE18674A28DC6ED8EF7;
 
Key 1        DE23171210A3F9DE55138D11AB78A9A60543F69187F994B5C061ADFAD26FCFB2;
IV 1         881CE29C18DE48B930E901A1;
 
Key 2        DE23171220A3F9DE55138D12AB78A9A60543F69187F994B5C061ADFAD26FCFB2;
IV 2         881CE29C28DE48B930E901A2;
 
Key 3        DE23171230A3F9DE55138D13AB78A9A60543F69187F994B5C061ADFAD26FCFB2;
IV  3        881CE29C38DE48B930E901A3;
 
Key 4        DE23171240A3F9DE55138D14AB78A9A60543F69187F994B5C061ADFAD26FCFB2;
IV 4         881CE29C48DE48B930E901A4;
 
Key 5        DE23171250A3F9DE55138D15AB78A9A60543F69187F994B5C061ADFAD26FCFB2;
IV 5         881CE29C58DE48B930E901A5;
 
Key 6        DE23171260A3F9DE55138D16AB78A9A60543F69187F994B5C061ADFAD26FCFB2;
IV 6         881CE29C68DE48B930E901A6;
 
Key 7        DE23171270A3F9DE55138D17AB78A9A60543F69187F994B5C061ADFAD26FCFB2;
IV 7         881CE29C78DE48B930E901A7;
 
Key 8        DE23171280A3F9DE55138D18AB78A9A60543F69187F994B5C061ADFAD26FCFB2;
IV 8         881CE29C88DE48B930E901A8;
 
Key 9        DE231712E093F9DE55138D19AB78A9A60543F69187F994B5C061ADFAD26FCFB2;
IV 9         881CE29C289E48B930E901A9;