Bitstream lengths on modern FPGAs are now large enough that a DPA attack can be attempted on a single valid bitstream load (the valid bitstream data appears random enough with many input changes). To protect against this, bitstreams in UltraScale and UltraScale+ FPGAs can be broken up into multiple smaller blocks, and each block is encrypted using its own unique user-defined key. The size of each block is programmable and depends on your security requirements. Smaller blocks are more secure because less side-channel data can be collected that corresponds to any one key.
To avoid having to store all the decryption keys in on-chip memory (BBRAM or eFUSE), UltraScale and UltraScale+ FPGAs use a key rolling technique where only the initial key (key 0) is stored on-chip, while keys for each successive block are encrypted (wrapped) in the previous block. The following figure illustrates this concept.
Although it is possible to load a valid bitstream an unlimited number of times, additional configurations do not reveal any new side channel information to the adversary. They can only reduce the signal-to-noise ratio of the side channel data contained in the first configuration. The key rolling method (along with either configuration counting or authenticate-then-decrypt) prevent the adversary from having enough changing values applied into the ciphertext port.
There are trade-offs to consider when combining the key rolling techniques with either configuration counting or authenticate-then-decrypt.