A good key management practice includes minimizing the use of secret or private keys. Use the operational key option enabled in Bootgen to accomplish this.
When this feature is enabled, Bootgen creates an encrypted, secure header. It
contains the user-specified operational key (opt_key) and the
initialization vector (IV) needed for the first block of the configuration file. As a
result, the device uses the AES key stored in either BBRAM or eFUSEs for only 384 bits.
This significantly limits its exposure to side-channel attacks. The opt_key attribute
specifies operational key usage. See fsbl_config
for more information about the opt_key value that is an
argument to the fsbl_config attribute. The following is
an example of using the opt_key attribute.
image:
{
[fsbl_config] opt_key
[keysrc_encryption] bbram_red_key
[bootloader,
destination_cpu = a53-0,
encryption = aes,
aeskeyfile = aes_p1.nky]fsbl.elf
[destination_cpu = a53-3,
encryption = aes,
aeskeyfile = aes_p2.nky]hello.elf
}The AES key (.nky) file provides the operation key under the name Key Opt, as shown in the following example.
Bootgen generates the encryption key file. If the BIF file enables opt_key, the system then generates the operational key opt_key in the .nky file, as shown in the previous example.
For another example of using the operational key, refer to Using Op Key to Protect the Device Key in a Development Environment.
For more details about this feature, see the section "Key Management" in section in the Zynq UltraScale+ Device Technical Reference Manual (UG1085).