The Authentication Certificate is a structure that contains all the information related to the authentication of a partition. This structure has the public keys and the signatures that BootROM/FSBL needs to verify. There is an Authentication Header in each Authentication Certificate, which gives information like the key sizes, algorithm used for signing, and so forth. The system appends the Authentication Certificate to the actual partition that has authentication enabled. If authentication is enabled for any of the partitions, the header tables also needs authentication. The system appends the Header Table Authentication Certificate to the header tables at the end of the content.
The AMD Zynq™ UltraScale+™ MPSoC uses RSA-4096 authentication, which means the primary and secondary key sizes are 4096-bit. The following table provides the format of the Authentication Certificate for the Zynq UltraScale+ MPSoC device.
| |||||||||||||||||||||||||||||||||||||||
FSBL Signature = RSA-4096 ( SSK, Padding || SHA-384 (PMUFW || FSBL ||
Padding || Authentication Header || SPK ID || UDF || PPK || SPK || SPK Signature|| BH Signature))