Versal AI Edge Series Gen 2 and Versal Prime Series Gen 2 Auth JTAG Message Format - Versal AI Edge Series Gen 2 and Versal Prime Series Gen 2 Auth JTAG Message Format - 2026.1 English - UG1283

Bootgen User Guide (UG1283)
Document ID
UG1283
Release Date
2026-06-23
Version
2026.1 English

For Versal AI Edge Series Gen 2and Versal Prime Series Gen 2 devices, the Authenticated JTAG (Auth JTAG) message generated by Bootgen always includes both the PPK and the SPK. The format is enhanced compared to the Versal Auth JTAG message and adds support for additional authentication algorithms (RSA-4096, ECDSA P-384, LMS-SHA256, LMS-SHAKE256, HSS-SHA256, and HSS-SHAKE256).

The following table describes the layout of the Auth JTAG message. Offsets up to 0x40 are fixed. The PPK, SPK, and signature offsets that follow 0x40 depend on the selected authentication algorithm (RSA-4096, ECDSA P-384, LMS, or HSS), so they are described by field rather than by absolute offset.

Table 1. Auth JTAG Message Format
Offset Field Description
0x00 ID Word 0x58414A47 (XAJG). Identifies the message as a Versal AI Edge Series Gen 2and Versal Prime Series Gen 2 Auth JTAG message.
0x04 Auth JTAG Message Length Total length of the Auth JTAG message in bytes.
0x08 Authentication Header Encodes PPK select, certificate format/version, hash algorithm, and public-key algorithm. See Auth JTAG Authentication Header*.
0x0C Total PPK Size PPK size including key alignment padding (equals Actual PPK Size when no padding is required).
0x10 Actual PPK Size Actual PPK Size | Size of the PPK in bytes (algorithm dependent).
0x14 Total Auth JTAG Message Signature Size Total Auth JTAG Message Signature Size | Auth JTAG message signature size including alignment padding.
0x18 Actual Auth JTAG Message Signature Size Size of the Auth JTAG message signature in bytes.
0x1C Auth JTAG Message Revocation ID Revocation ID for the Auth JTAG message (revoke_id from the BIF).
0x20 Attributes Reserved attribute word.
0x24 Device DNA 16-byte Device DNA value (device_dna from the BIF).
0x34 JTAG Timeout JTAG timeout value (jtag_timeout from the BIF).
0x38 Alignment 8 bytes of alignment padding to bring PPK to a 16-byte boundary.
0x40 PPK Primary Public Key data. Size is algorithm dependent
  PPK Alignment Padding to align the SPK header to a 16-byte boundary.
  Total SPK Size SPK size including key alignment padding.
  Actual SPK Size Size of the SPK in bytes.
  Total SPK Signature Size SPK signature size including alignment padding.
  Actual SPK Signature Size Size of the SPK signature in bytes.
  SPK Revocation ID Revocation ID for the SPK (spk_revoke_id from the BIF).
  SPK Header Alignment Padding to align SPK to a 16-byte boundary.
  SPK Public Key data. Size is algorithm dependent.
  SPK Alignment Padding to align the SPK signature to a 16-byte boundary.
  SPK Signature Signature over the fields from Total SPK Size through SPK Alignment, generated with the PSK.
  SPK Signature Alignment Padding to align the Auth JTAG message signature to a 16-byte boundary.
  Auth JTAG Message Signature Signature over the fields from ID Word through SPK Signature Alignment, generated with the SSK.
Note:
  • The fields from Total SPK Size through SPK Alignment are signed with the PSK to produce the SPK Signature.
  • The fields from ID Word through SPK Signature Alignment are signed with the SSK to produce the Auth JTAG Message Signature.
Table 2. Auth JTAG Authentication Header
Bits Size Field Description
[31:18] 14 Reserved Reserved
[17:16] 2 PPK Key Select
  • `0`: PPK 0 selection in eFUSE.
  • `1`: PPK 1 selection in eFUSE.
  • `2`: PPK 2 selection in eFUSE.
  • `3`: Reserved.
[15:14] 2 Authentication Certificate Format `0`: RSASSA-PSS
[13:12] 2 Authentication Certificate Version `0`: Current AC
[11] 1 PPK Key Type `0`: Hash Key
[10:9] 2 PPK Key Source `0`: eFUSE
[8] 1 SPK Enable `1`: SPK enabled
[7:4] 4 Hash Algorithm
  • `0`: SHA2-384 (not supported for TROM).
  • `1`: SHA3-384.
  • `2`–`16`: Reserved for future use.
[3:0] 4 Public Key Algorithm
  • `0`: Non-Secure.
  • `1`: RSA-4096.
  • `2`: ECDSA P-384.
  • `3`: ECDSA P-521 (only for PLM-loadable partitions).
  • `4`: LMS with HSS.
  • `5`: LMS.
  • `6`–`16`: Reserved for future use

Generating an Auth JTAG Message

Generate the Auth JTAG message with the -authenticatedjtag command-line option together with a BIF that defines the keys and an authjtag_config block.

BIF Example

LMS and HSS keys also require an lms_key_params block that specifies the LMS parameters for the primary (PSK) and secondary (SSK) keys.


BIF (auth_jtag_lms.bif)
    all:
    {
        ppkfile = primary.lms.pub
        pskfile = primary.lms.prv
        spkfile = secondary.lms.pub
        sskfile = secondary.lms.prv
        lms_key_params
        {
            primary   { lms-sha256 },
            secondary { lms-sha256 }
        }
        authjtag_config
        {
            device_dna    = 0x112233445566778899AABBCCDDEEFF00,
            jtag_timeout  = 30000,
            spk_revoke_id = 0,
            revoke_id     = 0
        }
    }
Command
    bootgen -arch versal_2ve_2vm -image auth_jtag_lms.bif \
            -authenticatedjtag lms-sha256 auth_jtag_lms.bin -log trace