In a Versal adaptive SoC, Bootgen encrypts the meta header if the metaheader attribute explicitly specifies encryption. You can specify the aeskeyfile in the bif using the parameters under metaheader. The following example shows a usage snippet.
Note: Meta Header encryption includes all the
headers except the Image Header Table.
metaheader
{
encryption = aes,
keysrc = bbram_red_key,
aeskeyfile = headerkey.nky,
}The following conditions apply.
- If a specific aeskeyfile is not specified for the meta header, Bootgen generates a file named meta_header.nky, and uses it during encryption.
- If a boot loader is present in the bif, it is mandatory to encrypt boot loader to encrypt meta header. For a partial PDI, you can optionally choose to encrypt the meta header.
- During meta header encryption, the system adds the Image Header Table as additional authenticated data to ensure its correctness.