Visible to Intel only — GUID: mwh1410385066394
Ixiasoft
1.1. Generating Primary Device Programming Files
1.2. Generating Secondary Programming Files
1.3. Enabling Bitstream Security for Stratix® 10 and Agilex™ 7 Devices
1.4. Enabling Bitstream Encryption or Compression for Arria® 10 and Cyclone® 10 GX Devices
1.5. Generating Programming Files for Partial Reconfiguration
1.6. Generating Programming Files for Intel® FPGA Devices with Hard Processor Systems
1.7. Scripting Support
1.8. Generating Programming Files Revision History
2.1. Quartus® Prime Programmer
2.2. Programming and Configuration Modes
2.3. Basic Device Configuration Steps
2.4. Specifying the Programming Hardware Setup
2.5. Programming with Flash Loaders
2.6. Verifying the Programming File Source with Project Hash
2.7. Using PR Bitstream Security Verification ( Stratix® 10 Designs)
2.8. Stand-Alone Programmer and Tools
2.9. Programmer Settings Reference
2.10. Scripting Support
2.11. Using the Quartus® Prime Programmer Revision History
2.9.1. Device & Pin Options Dialog Box
2.9.2. More Security Options Dialog Box
2.9.3. Output Files Tab Settings (Programming File Generator)
2.9.4. Input Files Tab Settings (Programming File Generator)
2.9.5. Bitstream Co-Signing Security Settings (Programming File Generator)
2.9.6. Configuration Device Tab Settings
2.9.7. Add Partition Dialog Box (Programming File Generator)
2.9.8. Add Filesystem Dialog Box (Programming File Generator)
2.9.9. Convert Programming File Dialog Box
2.9.10. Compression and Encryption Settings (Convert Programming File)
2.9.11. SOF Data Properties Dialog Box (Convert Programming File)
2.9.12. Select Devices (Flash Loader) Dialog Box
Visible to Intel only — GUID: mwh1410385066394
Ixiasoft
1.3. Enabling Bitstream Security for Stratix® 10 and Agilex™ 7 Devices
Stratix® 10 and Agilex™ 7 devices provide flexible and robust security features to protect sensitive data, intellectual property, and device hardware from physical and remote attacks. The Stratix® 10 and Agilex™ 7 device architectures support bitstream authentication and encryption security features. The Assembler applies bitstream compression automatically to reduce file size whenever you use authentication or encryption.
- Bitstream Authentication—verifies that the configuration bitstream and firmware are from a trusted source. Enable additional co-signing device firmware authentication to ensure that only signed firmware runs on the HPS or FPGA, and to authorize HPS JTAG debugging. Enable authentication security by specifying a first level signature chain file (.qky) for the Quartus Key File option (Device and Pin Options dialog box), as Enabling Bitstream Authentication (Programming File Generator) describes.5
- Bitstream Encryption—protects proprietary or sensitive data from view or extraction in the configuration bitstream using an Advanced Encryption Standard (AES) 256-bit or 384-bit security key. Encryption also provides side-channel protection from non-intrusive attack. You can store the owner AES key in eFuses or BBRAM. Enable encryption by turning on the Enable programming bitstream encryption option (Device and Pin Options dialog box), as Enabling Bitstream Encryption (Programming File Generator) describes.
| Term | Description | Extension |
|---|---|---|
| First Level Signature Chain Key File | File you generate that specifies the root key (.pem) and one or more design signing keys (.pem) required to sign the bitstream and allow access to the FPGA when using authentication or encryption. | .qky |
| Root Key File | File you generate that anchors the first level signature chain to a known root key. The FPGA calculates the hash of the root entry and checks if it matches the expected hash. The Assembler appends the root key to the programming file and stores the key in eFuses. | .qky |
| Design Signing Key File | File you generate and append to the root key that authenticates the bitstream in the SDM to allow configuration of the device with the pending bitstream. Use separate design signing keys for the FPGA and HPS for highest security. | .pem |
| Firmware Co-signing Key File | Files provided in <install>\devices\programmer\firmware that includes the owner signature and firmware file that you use to sign the firmware to run on the FPGA or HPS. | .zip |
| Signed HPS Certificate File | Specifies a secure HPS debug certificate that permits access to the JTAG interface for HPS debugging. A secure HPS debug certificate is valid until you power down or reconfigure the device. | .cert |
Note: Arria® 10 and Cyclone® 10 GX devices do not support bitstream authentication.
Section Content
Enabling Bitstream Authentication (Programming File Generator)
Specifying Additional Physical Security Settings (Programming File Generator)
Enabling Bitstream Encryption (Programming File Generator)
5 For Stratix® 10 devices, bitstream authentication is available only for devices that include the AS (Advanced Security) ordering code suffix and all Stratix® 10 DX devices.