Authenticate-then-Decrypt Trade-off - Authenticate-then-Decrypt Trade-off - XAPP1098

Developing Tamper-Resistant Designs with UltraScale and UltraScale+ FPGAs (XAPP1098)
Document ID
XAPP1098
Release Date
2025-05-22
Revision
1.5.1 English

Because the entire encrypted bitstream is loaded into the FPGA’s configuration memory prior to decryption, the bitstream size is limited by the amount of memory in the device. In this case, what must be considered is the percent impact to overall configuration time. This impact depends on which external port is used for configuration. As mentioned previously, the internal RDW phase is always performed at 32 bits wide and at the rate of the specified clock frequency used for configuration. Therefore, if the external port is slower (the “bottleneck”), the overall configuration time might not be affected that much. Conversely, if a fast external port is used, there will be a larger overall percent increase in configuration time. Some examples are:

  • JTAG and Master SPI (x1):
    • Overall configuration time increased by ~8%
    • Serial load phase followed by 32-bit parallel RDW phase
  • Master SPI Quad (x4):
    • Overall configuration time increased by 32%
    • Quad SPI load phase followed by 32-bit parallel RDW phase
  • Master SPI Dual Quad (x8):
    • Overall configuration time increased by 63%
    • Dual Quad SPI load phase followed by 32-bit parallel RDW phase
  • Master (CCLK) asynchronous BPI (x16):
    • Configuration time increased by ~125%
    • 16-bit parallel load phase followed by a 32-bit parallel RDW phase
  • Master (EMCCLK) synchronous BPI (x16):
    • Configuration time increased by ~125%
    • 16-bit parallel load phase followed by a 32-bit parallel RDW phas
Note: All of the above SPI modes (with RSA enabled) are supported in UltraScale+ FPGAs. Consult UltraScale FPGA RSA Authentication and Supporting Configuration Modes (XCN15038), for which SPI modes (with RSA enabled) are supported on UltraScale FPGAs.
Important: Even though the examples towards the bottom of the list above have the greatest overall percent increase in configuration time, they are still a much less overall configuration time than the examples at the top of the list.
Important: Because the entire encrypted bitstream must fit inside the FPGA’s configuration memory prior to decryption, there is a limit as to how small the key rolling blocks are made. In the case of authenticate-then-decrypt, the size of the key rolling block cannot be smaller than 246 AES decryption blocks for UltraScale FPGAs and 186 AES decryption blocks for UltraScale+ FPGAs (each AES decryption block is 128 bits).