Bitstream Authentication (Asymmetric) - Bitstream Authentication (Asymmetric) - XAPP1098

Developing Tamper-Resistant Designs with UltraScale and UltraScale+ FPGAs (XAPP1098)
Document ID
XAPP1098
Release Date
2025-05-22
Revision
1.5.1 English
Important: RSA authentication on UltraScale and UltraScale+ FPGAs can be circumvented when encryption is not enforced using eFUSE programming. To avoid potential security issues, users requiring RSA authentication should also enforce encryption by configuring an AES key in either BBRAM or eFUSEs and configuring the device to only accept encrypted bitstreams. Devices configured to enforce both RSA authentication and encryption are not susceptible to the RSA authentication issue. For further details, refer to this link, Design Advisory for UltraScale/UltraScale+ FPGA Series: RSA Authentication Vulnerability (JustSTART).

UltraScale and UltraScale+ FPGAs have the capability of loading the entire encrypted bitstream into the device and then authenticating it before sending it to the on-chip decryption engine (“authenticate-then-decrypt”). If the bitstream has been modified in any way (including only a single bit change), the device’s asymmetric authentication function detects these change(s) and not only disables the decryption engine (if enabled for an encrypted bitstream) but also prevents the startup of the device. In short, if this feature is enabled, only an authorized bitstream can configure the UltraScale or UltraScale+ FPGA. When asymmetric authentication is enabled, the symmetric authentication functions of the AES-GCM algorithm are not performed (that is, the periodic and complete symmetric authentication checks are not performed).

Because this method uses the RSA-2048 asymmetric digital signature (authentication) algorithm, it does not require the device to contain a “secret” to accomplish this authentication task. Instead, the asymmetric authentication function contains user-defined public key information. Due to limited space, the feature uses a 384-bit SHA-3 hash of the 2048-bit public key and is programmed into the eFUSE bits of the UltraScale or UltraScale+ FPGA. It is up to you to define the private and public key pairs for this operation. There are a number of open source and commercial products that can be used to create these key pairs (such as OpenSSL and SafeNet). Because this authentication scheme does not require a secret to operate, adversarial attacks such as side channel analysis do not reveal any information that is useful to an attacker.

There are several reasons to use the RSA asymmetric authentication:

  1. Authenticate the entire bitstream before decrypting it. This method is part of a DPA attack countermeasure described in the DPA Protections section.
  2. Prevent unauthorized users from ever running their own (potentially malicious) designs on the UltraScale or UltraScale+ FPGA. When an authorized user programs the public key hash into the eFUSE bits and the RSA_AUTH eFUSE has been programmed (forcing RSA authentication), only authorized bitstreams can be loaded.

The following figure illustrates (at a high-level) how the bitstream is constructed using RSA/SHA-3 and how the entire bitstream is authenticated internally on-chip. The top portion of the figure is performed by the software tools to create the RSA authenticated bitstream and the bottom portion of the figure is done inside the UltraScale or UltraScale+ FPGA to authenticate the bitstream.

Figure 1. Constructing the Bitstream with RSA Signature
x1098_02 Data Bitstream1 Bitstream1 Process.4 Generate RSA-2048 Digital Signature (with SHA-3) Generate RSA-2048 Digital Signature(with SHA-3) Sheet.3 Data.4 Public Key2 + Public Key2 + Data.8 Signature + Signature + Sheet.6 Sheet.7 Sheet.8 Process.14 SHA-3 SHA-3 Sheet.10 Sheet.11 Private Key2 Private Key2 Sheet.12 Public Key2 Public Key2 Sheet.13 Sheet.14 Sheet.15 Software Tools Software Tools Sheet.16 UltraScale Device UltraScale Device Sheet.17 Sheet.18 Yes Yes Sheet.19 Yes Yes Sheet.20 No No Sheet.21 Sheet.22 Okay to Decrypt/Startup Okay to Decrypt/Startup Sheet.24 Sheet.25 RSA Authenticated Bitstream RSA Authenticated Bitstream Sheet.26 Sheet.27 ERROR ERROR Sheet.28 No No Sheet.29 Sheet.30 Sheet.31 Sheet.32 Sheet.33 Sheet.34 Sheet.35 2048 2048 Sheet.36 2048 2048 Process.58 Verify RSA-2048 Digital Signature Verify RSA-2048 Digital Signature Sheet.38 Sheet.39 Sheet.40 2048 2048 Sheet.41 Sheet.42 2048 2048 Sheet.43 Sheet.44 n n Sheet.45 Sheet.46 n n Sheet.47 Sheet.48 Sheet.49 2048 2048 Sheet.50 Sheet.51 n n Sheet.52 Sheet.53 384 384 Sheet.54 Data.32 eFUSEs eFUSEs Decision.24 = ? =? Sheet.57 Sheet.58 384 384 Sheet.59 Sheet.60 Sheet.61 Sheet.62 Sheet.63 Process.18 SHA-3 (+ padding3) SHA-3(+ padding3) Sheet.65 Sheet.66 2048 2048 Sheet.67 Decision.27 = ? =? Sheet.69 Sheet.70 Sheet.71 2048 2048 Sheet.72 Sheet.73 Sheet.74 Data.2 Bitstream1 Bitstream1 Process.87 SHA-3 SHA-3 Sheet.77 Sheet.78 Sheet.79 Sheet.81 X1098_02_082018 X1098_02_082018
Note:
  1. Bitstream can be encrypted (ciphertext) or unencrypted (plaintext).
  2. Private/public key pair generated by the user.
  3. PKCS #1 v1.5 padding scheme.

The following figure provides details on the actual format of an encrypted and RSA authenticated bitstream and further describes which parts are plaintext, authenticated plaintext, and authenticated ciphertext.

Figure 2. Bitstream Format Using RSA
X25190-x1098_03 Sheet.1 Plain Text Header (Sync, Width, BPI/SPI, Clock Rate Selection... Plain Text Header(Sync, Width, BPI/SPI, Clock Rate Selection, watchdog, iprog, ...) Sheet.2 RDRI Type 2 Packet Write Command (RSA Data in Register) RDRI Type 2 Packet Write Command (RSA Data in Register) Sheet.3 Public Key [2047:0] + Public Key SHA3 Padding (448 bits) Public Key [2047:0] + Public Key SHA3 Padding (448 bits) Sheet.4 Signature [2047:0] Signature [2047:0] Sheet.5 SIV [95:0] SIV [95:0] Sheet.6 Decryption Length Count (DLC) Decryption Length Count (DLC) Sheet.7 (Encrypted*) RSA Header (protected configuration register wri... (Encrypted*) RSA Header(protected configuration register writes – always 32 words) Sheet.8 (Encrypted*) Configuration RAM Contents (Encrypted*) Configuration RAM Contents Sheet.9 (Encrypted*) RSA Footer (protected configuration register wri... (Encrypted*) RSA Footer(protected configuration register writes – always 160 words) Sheet.10 Bitstream SHA-3 Padding (1 to 26 words) Bitstream SHA-3 Padding (1 to 26 words) Sheet.11 Subsequent Commands (e.g., LOUT) Subsequent Commands (e.g., LOUT) Sheet.12 RDW_GO (10000) Command RDW_GO (10000) Command Sheet.13 Sheet.14 Plaintext Plaintext Sheet.16 Sheet.17 RSA Authenticated Plaintext RSA Authenticated Plaintext Sheet.18 Sheet.19 RSA Authenticated Plaintext/Ciphertext RSA Authenticated Plaintext/Ciphertext Sheet.35 *Encryption is optional *Encryption is optional Sheet.23 X25190-031421 X25190-031421

Because the entire bitstream is loaded into the device and then authenticated prior to use, there is a configuration time penalty when using the RSA asymmetric authentication scheme (with an encrypted bitstream). However, depending on the configuration port used, the increase in overall configuration time might not be very significant. This is due to the fact that after the entire bitstream has been loaded and authenticated, the decryption process can take advantage of a full 32-bit wide data bus. Consult the UltraScale Architecture Configuration User Guide (UG570) for precise configuration time details.

Due to certain silicon design constraints, there are some limitations when using the RSA asymmetric authentication scheme on UltraScale and UltraScale+ FPGAs:

  • RSA authenticated bitstreams cannot be compressed. For details on compression, see the UltraScale Architecture Configuration User Guide (UG570).
  • Partial reconfiguration (PR) bitstreams cannot be RSA authenticated with the built-in silicon feature. (You can put your own authentication function in the FPGA logic.) For details on PR, see the Partial Reconfiguring section of Vivado Design Suite Tutorial: Dynamic Function eXchange (UG947).
  • Tandem bitstreams cannot be RSA authenticated. Tandem configuration is the AMD solution for fast configuration of PCIe® designs to meet enumeration needs within open PCIe systems.
  • For UltraScale FPGAs only, there are limitations on bitstream configuration widths when RSA is enabled. Some of the narrow configuration widths are not supported. See UltraScale FPGA RSA Authentication and Supporting Configuration Modes (XCN15038) for additional details.