Zynq 7000 SoC devices provide the following secure boot features:
- Advanced Encryption Standard
- AES-CBC with 256-bit key (FIPS197)
- Encryption key stored on-chip in either eFuse or Battery-backed RAM (BBRAM)
- Keyed-hashed message authentication code (HMAC, FIPS198-1)
- SHA-256 authentication engine (FIPS180-4)
- RSA public key authentication (FIPS186-3)
- 2048-bit public key
A device secure boot involves several systems contained within the SoC device. The secure boot process is always initiated by the BootROM. The BootROM will use the public key to authenticate the first stage boot loader (FSBL) before it is decrypted or executed. If the boot image header indicates a secure boot, the BootROM enables the AES and HMAC engines which reside in the PL. The encrypted FSBL is then sent by the BootROM to the AES and HMAC, a hardened core within the PL, via the processor configuration access port (PCAP). The FSBL image is decrypted and sent back to the PS via the PCAP where it is loaded into the on-chip RAM (OCM) for execution. The PS is then able to securely configure the PL by sending an encrypted bitstream through the PCAP to the AES/HMAC for decryption, authentication, and distribution to the PL memory cells.