Versal Authentication Support - Versal Authentication Support - 2026.1 English - UG1283

Meta Header Authentication

For a Versal adaptive SoC, Bootgen authenticates the meta header based on the parameters under the bif attribute "metaheader." The following snippet shows the usage.

metaheader
{
	authentication = rsa,
	pskfile = psk.pem,
	sskfile = ssk.pem
}

Authentication Optimization

Starting in v2024.1, for a Versal adaptive SoC, you can opt for authentication time reduction.

If you are using the same SPK (with the same authentication algorithm and key strength) for the Meta Header and partitions loaded by the PLM, it is possible to avoid the SPK and partition data signature validations. Enable the use of authenticated partition digests stored in the optional Image Header Table. At boot, the system uses SHA partition digests to validate the integrity of the partition data.

When reading the Meta Header, PLM authenticates and copies the table of partition digests to be used during partition loading. You can skip authentication for any partition with a digest entry in the table. In this case, the system passes the partition data through the SHA engine. It then compares the resulting digest against the authenticated digest value stored for that partition in the Image Header Table.

PPK Hash for eFUSE

Bootgen generates the PPK hash and stores it in eFUSE so the PPK is trusted. You need this step only for authentication with eFUSE mode. Program the value from efuseppksha.txt into the eFUSE for AHWRoT authentication.

BIF File Example

The following is a sample BIF file, generate_hash_ppk.bif.

generate_hash_ppk:
{
    pskfile = primary0.pem
    sskfile = secondary0.pem
    image
    {
        name = pmc_ss, id = 0x1c000001
        { type=bootloader, authentication=rsa, file=plm.elf}
        { type=pmcdata, load=0xf2000000, file=pmc_cdo.bin}
    }
}

Command

The command to generate PPK hash for eFUSE programming is:

bootgen –image generate_hash_ppk.bif –arch versal –w –o test.bin –efuseppkbits efuseppksha.txt

Cumulative Secure Boot Operations for Versal Adaptive SoC