Key agility refers to the ability to update or change the AES bitstream decryption
key in BBRAM via the FPGA logic. This does not apply to eFUSE-based keys.
In the following figure, an UltraScale/UltraScale+ FPGA is shown with its initial key already loaded
into BBRAM. You can then load in an external encrypted bitstream, decrypt it, and
then have the initial FPGA logic design up and running.
Figure 1. UltraScale/UltraScale+ FPGA with Key Loaded into BBRAM
At some time in the future, a key management event occurs, which means that the key
requires to be changed or updated due to a security breach, good cryptographic
practice, or new design. By using some sort of secure key exchange algorithm (which
would be an IP core running in FPGA logic, such as the Diffie-Hellman protocol) you
can bring in an external encrypted key, perhaps even via the Internet. Then, you can
decrypt this key with the IP core, load it into BBRAM, and perform the integrity
check internally via the MASTER_JTAG primitive, as shown in the following
figure.
Figure 2. Key Management Event
You can then load in an external encrypted bitstream (encrypted on the new key),
decrypt it, and have a new fabric design that was decrypted with this new key as
shown in the following figure.
Figure 3. New Fabric Design
Using the above scheme, it is possible to update the key in the field without having
to bring the board or the system all the way back to a secure facility.