Obfuscated Key Loading and Storage - Obfuscated Key Loading and Storage - XAPP1098

Developing Tamper-Resistant Designs with UltraScale and UltraScale+ FPGAs (XAPP1098)

Document ID
XAPP1098
Release Date
2025-05-22
Revision
1.5.1 English

Optionally, key data written and stored into an UltraScale or UltraScale+ FPGA’s eFUSE array or BBRAM (via JTAG) can be obfuscated. The key data is encrypted using a fixed family key that is identical for all UltraScale FPGAs and all UltraScale+ FPGAs, and is known only to AMD. (The UltraScale FPGA family key is different from the UltraScale+ FPGA family key). This provides for an increased level of security in commercial production situations (for example, secret red key protection at a contract manufacturer). The internally stored obfuscated key is decrypted at the beginning of an encrypted bitstream load and then used to decrypt the bitstream that follows it. This feature is enabled by a control bit in the FUSE_SEC control register (eFUSE-based key) or by control bits written into the BBRAM (BBRAM-based key). The following figure provides a high-level summary of this operation.

Note: AMD does not provide the family key as part of the Vivado tools. Customers must send a request for the family key to secure.solutions@xilinx.com. It will then be distributed to qualified customers through the Product Licensing site on www.amd.com.
Note: The use of obfuscated key storage is not compatible with the configuration counting DPA countermeasure for BBRAM key storage.
Figure 1. Summary of Obfuscated Key Loading and Storage
x1098_01 Sheet.32 Standard Arrow.36 Sheet.9 Secret “Red” Key Secret “Red” Key Laptop Sheet.8 Family Key Family Key Sheet.10 AES-GCM AES-GCM Sheet.11 Sheet.12 Circle.267 Sheet.14 Sheet.15 Sheet.16 Obfuscated Key Obfuscated Key Sheet.18 AES-GCM AES-GCM Sheet.19 Sheet.20 Family Key Family Key Laptop.6 Sheet.7 Circle.267 Sheet.21 Sheet.22 Sheet.24 AES-GCM AES-GCM Sheet.25 Sheet.23 Secret “Red” Key Secret “Red” Key Custom 3 User Design User Design Sheet.27 Secret “Red” Key During Configuration ONLY Secret “Red” Key During Configuration ONLY Sheet.28 Circle.267 Sheet.30 Sheet.31 Standard Arrow.486 Standard Arrow.34 Sheet.35 Flash Flash Sheet.37 Encrypted Bitstream Encrypted Bitstream Sheet.38 Encrypted Bitstream Encrypted Bitstream Sheet.39 FPGA FPGA Standard Arrow.40 Sheet.41 Unencrypted Bitstream Unencrypted Bitstream Standard Arrow.42 Sheet.2 Circle.267 Sheet.4 Sheet.5 Standard Arrow.43 Sheet.44 Obfuscated Key Load Obfuscated Key Load Sheet.45 X1098_01_082018 X1098_01_082018