Bootgen supports ECDSAp384, HSS-SHAKE256, RSA-4096, and LMS-SHAKE256 authentication algorithm. NIST SHA3-384 calculates hash on the PLM partition for Versal AI Edge Series Gen 2 and Versal Prime Series Gen 2.
HashBlock0
In Versal AI Edge Series Gen 2 and Versal Prime Series Gen 2, HashBlock0 is placed next to authenticate certificate by default in PDI. HashBlock0 is composed with BH hash, PLM hash, PL data hash, and padding. The signature calculated on the HashBlock0 is placed next to it in the PDI.
Note:
- For non secure PDI generation,
HashBlock0is calculated by default for data integrity check. - Digest size is 48 bytes (SHA3-384) and total size of hash block is 320 bytes. The block requires 8 bytes of padding to align to 16 bytes.
| Data | Field | Length (Bytes) |
|---|---|---|
| BH Hash | Hash Index | 4 |
| Hash Value | Digest Size | |
| PLM | Hash Index | 4 |
| Hash Value | Digest Size | |
| PL | Hash Index | 4 |
| Hash Value | Digest Size | |
| Reserved Slot 1 | Hash Index | 4 |
| Hash Value (zero-filled) | Digest Size | |
| Reserved Slot 2 | Hash Index | |
| Hash Value (zero-filled) | Digest Size | |
| Reserved Slot 3 | Hash Index | |
| Hash Value (zero-filled) | Digest Size | |
| Alignment Padding | Reserved (zero-filled) | 8 |
| Total | 320 | |
Note: The three Reserved entries and the Alignment Padding
together correspond to the region shown as Padding in the Versal AI Edge Series Gen 2/ Versal Prime Series Gen 2 boot-image
diagrams. The Reserved entries are pre-allocated by the secure boot engine for
future hash-type expansion; the 8-byte Alignment Padding rounds the block to a
16-byte boundary required by the hardware. Bootgen leaves all of these bytes
zero-filled and exposes no BIF attribute to populate them. Because the entire
HashBlock0 is covered by the HashBlock0 hash (non-secure PDIs) and signature
(authenticated PDIs), any modification of these bytes causes Bootgen -verify and the
device-side integrity / authentication check to fail at boot.
HashBlock1
It includes metaheader hashes and partition hashes when PSK/SSK are the same.
Note:
- For non-secure PDI generation, the system calculates HashBlock1 by default for the data integrity check.
- Digest size is 48 bytes (SHA3-384) and total size of hash block1 based on the number partition applies.
- If PSK/SSK keys differ between partitions, the system generates hashes separately in different hash blocks.
- If any two of partition's PSK/SSK are matching, then those partition hashes falls in single hashblock.
| Data | Field | Length (Bytes) |
|---|---|---|
| MH Hash (IHT+ Optional Data + IHs + PHTs) |
Hash Index Hash Value |
4 Digest Size |
| Partition1 |
Hash Index Hash Value |
4 Digest Size |
| Partition2 |
Hash Index Hash Value |
4 Digest Size |
| Partition n(n is the index of the Partition in the PDI) |
Hash Index Hash Value |
4 Digest Size |