Valid Bitstream Data - Valid Bitstream Data - XAPP1098

Developing Tamper-Resistant Designs with UltraScale and UltraScale+ FPGAs (XAPP1098)

Document ID
XAPP1098
Release Date
2025-05-22
Revision
1.5.1 English

Bitstream lengths on modern FPGAs are now large enough that a DPA attack can be attempted on a single valid bitstream load (the valid bitstream data appears random enough with many input changes). To protect against this, bitstreams in UltraScale and UltraScale+ FPGAs can be broken up into multiple smaller blocks, and each block is encrypted using its own unique user-defined key. The size of each block is programmable and depends on your security requirements. Smaller blocks are more secure because less side-channel data can be collected that corresponds to any one key.

To avoid having to store all the decryption keys in on-chip memory (BBRAM or eFUSE), UltraScale and UltraScale+ FPGAs use a key rolling technique where only the initial key (key 0) is stored on-chip, while keys for each successive block are encrypted (wrapped) in the previous block. The following figure illustrates this concept.

Figure 1. Key Rolling
x1098_06 Sheet.1 Software Software Sheet.2 FPGA FPGA Sheet.3 Original Bitstream Original Bitstream Sheet.4 Block 0 Block 0 Sheet.5 Block 1 Block 1 Sheet.6 Block 2 . . Block 2.. Sheet.7 . . Block n ..Block n Standard Arrow.486 Sheet.9 Break into n Blocks Break into n Blocks Sheet.10 Block 0 + Key 1 Block 0+ Key 1 Sheet.11 Block 1 + Key 2 Block 1+ Key 2 Sheet.12 Block 2 + Key 3 . . Block 2+ Key 3.. Sheet.13 . . Block n ..Block n Standard Arrow.15 Sheet.15 Encrypt with n Unique Keys Encrypt with n Unique Keys Sheet.16 Flash Flash Sheet.17 = Plaintext = Plaintext Sheet.18 Sheet.19 = Ciphertext = Ciphertext Sheet.20 Sheet.21 AES AES Sheet.22 Block 0 Block 0 Sheet.23 Key 1 Key 1 Standard Arrow.24 Standard Arrow.26 Sheet.26 BBRAM or eFUSE BBRAM or eFUSE Sheet.27 Key 0 Key 0 Sheet.28 Sheet.29 X1098_06_082018 X1098_06_082018 Bracket.284 Bracket.32 Sheet.32 Sheet.33 Block 1 Block 1 Sheet.34 Block 2 . . Block 2.. Sheet.35 . . Block n ..Block n Sheet.36 Key 2 Key 2 Sheet.37 Key 3 Key 3 Sheet.38 AES AES Standard Arrow.39 Standard Arrow.40 Sheet.41 Sheet.42 AES AES Standard Arrow.43 Standard Arrow.44 Sheet.45 Sheet.46 AES AES Standard Arrow.47 Standard Arrow.48 Sheet.49

Although it is possible to load a valid bitstream an unlimited number of times, additional configurations do not reveal any new side channel information to the adversary. They can only reduce the signal-to-noise ratio of the side channel data contained in the first configuration. The key rolling method (along with either configuration counting or authenticate-then-decrypt) prevent the adversary from having enough changing values applied into the ciphertext port.

Important: You must use key rolling (valid data attack countermeasure) with either of the random data attack countermeasures (configuration counting or authenticate-then-decrypt).

There are trade-offs to consider when combining the key rolling techniques with either configuration counting or authenticate-then-decrypt.