Security User Guide: Intel® FPGA Programmable Acceleration Card D5005

Download PDF
ID 683877
Date 8/25/2020
Public
Document Table of Contents
Document Table of Contents x
1. Overview 2. Intel® FPGA PAC Security Features 3. Intel FPGA PAC Security Flow 4. Using fpgasupdate 5. Document Revision History for Security User Guide
1. Overview x
1.1. About This Document 1.2. Prerequisites 1.3. Related Documentation 1.4. Glossary
2. Intel® FPGA PAC Security Features x
2.1. Secure Image Updates 2.2. Anti-Rollback Capability 2.3. Key Management 2.4. Authentication 2.5. Encryption
3. Intel FPGA PAC Security Flow x
3.1. Installing PACSign 3.2. PACSign Tool 3.3. Creating Unsigned Images 3.4. Using an HSM Manager 3.5. Creating Keys 3.6. Root Entry Hash Bitstream Creation 3.7. Signing Images 3.8. Creating a CSK ID Cancellation Bitstream 3.9. PACSign PKCS11 Manager *.json Reference 3.10. Creating a Custom HSM Manager 3.11. PACSign Man Page
3.5. Creating Keys x
3.5.1. OpenSSL Key Creation 3.5.2. HSM Key Creation
3.7. Signing Images x
3.7.1. Signing OpenCL* Images
3.10. Creating a Custom HSM Manager x
3.10.1. HSM_MANAGER.get_public_key(public_key) 3.10.2. HSM_MANAGER.sign(data, key) 3.10.3. Signing Operation Flow
3.10.1. HSM_MANAGER.get_public_key(public_key) x
3.10.1.1. PUBLIC_KEY.get_X_Y() 3.10.1.2. PUBLIC_KEY.get_permission() 3.10.1.3. PUBLIC_KEY.get_ID() 3.10.1.4. PUBLIC_KEY.get_content_type()
4. Using fpgasupdate x
4.1. Troubleshooting
1. Overview
2. Intel® FPGA PAC Security Features
3. Intel FPGA PAC Security Flow
4. Using fpgasupdate
5. Document Revision History for Security User Guide

2.1. Secure Image Updates

The Intel® MAX® 10 BMC RoT requires that all BMC firmware, BMC RTL, and FIM images are authenticated using ECDSA before loading and executing on the card. The Intel® MAX® 10 BMC RoT may optionally require that AFU images are authenticated before loading and executing as well. The RoT achieves this by storing the root entry hash bitstream for the corresponding image in a write-once location and subsequently verifying the signature of all images against these hashes. Intel® provides the root entry hash bitstreams for BMC firmware, BMC RTL, and FIM images. You create and program the root entry hash bitstream for AFU images. Until you program the AFU root entry hash bitstream, the Intel® FPGA PAC does not authenticate an AFU image prior to loading and executing the image
Table 3.  Keys and Authentication
Root Key Origin Used to Authenticate
Intel® MAX® 10 BMC root key Intel® Intel® MAX® 10 Images and Firmware
Partial reconfiguration (PR) AFU root key Customer AFUs
.

When you are in the development or validation phase and have not programmed your root entry hash bitstream, you create AFU images that contain the appropriate headers but are not signed using keys. This process is called creating an unsigned image. An Intel® FPGA PAC that has not had the AFU root entry hash bitstream programmed runs any unsigned or signed AFU image. This capability allows you to test and validate the functionality of your AFU image prior to fully signing the image for deployment into a production environment. Please refer to the Creating Unsigned Images section for more information.

You program your AFU root entry hash bitstream to enable AFU image authentication. This process establishes you as the owner of the Intel® FPGA PAC D5005. The Intel® FPGA PAC D5005 then requires you to create signatures based on this root entry for each AFU you intend to load on the Intel® FPGA PAC. Intel® strongly recommends that you program the root entry hash bitstream for Intel® FPGA PACs used in production environments. You must follow the following flow to enable user AFU image authentication on your Intel® FPGA PAC.

Figure 1. Secure User Image Flow

The chapters within this user guide cover the steps in this flow:

  1. Create your keys: Create your keys using a Hardware Security Module (HSM) or OpenSSL. You need at least two keys, one which you designate as a root key and another you designate as a code signing key (CSK). These keys are asymmetric keys, meaning they consist of an underlying pair of keys. The first is called a private key and the second is a public key that is derived from the private key. A private key is used to create signatures over objects that can be verified with the corresponding public key. The private key must be kept confidential, as anyone in possession of the private key can create a signature; conversely, if you maintain the confidentiality of the private key, then signatures can be trusted to originate only from you. The public key cannot create signatures or be used to derive the original private key. Therefore, it is not required nor important to protect the confidentiality of the public key; the public key is considered public information.
  2. Create your root entry hash bitstream: Use the PACSign tool to create a bitstream that contains the root entry hash. You create a root entry hash bitstream from your root public key. This hash is a representation of your root public key and can only be created with an exact copy of the root public key. The root entry hash bitstream is then programmed to the Intel® FPGA PAC. The Intel FPGA PAC then uses this hash to verify the integrity of the root public key, which is included with all images transmitted to an Intel® FPGA PAC. After the integrity of the root public key is confirmed, it can be used in the signature verification process.
  3. Program your root entry hash bitstream into the Intel® FPGA PAC . You must use the fpgasupdate command to program the bitstream containing your root entry hash into the flash on the board. Until you program the root entry hash bitstream, the Intel FPGA PAC loads and executes any signed or unsigned image. Intel strongly recommends that you create and program a root entry hash bitstream for Intel® FPGA PACs deployed in production environments. Please refer to the Using fpgasupdate chapter for more information.
    Note: Only the owner who is deploying the Intel® FPGA PAC must program the root entry hash bitstream.
  4. Sign your AFU image. Using PACSign you can sign your image with the root public key and code signing key. Please refer to the Using PACSign chapter for more information.
  5. Program your AFU image onto the Intel® FPGA PAC. Use the fpgasupdate command to program your AFU into flash. The Intel® FPGA PAC verifies the AFU to ensure only an authorized bitstream is loaded. The root public key, code signing public key, signature of the code signing public key, and signature of the code or design are all attached to the image transmitted to the Intel® FPGA PAC. The card first verifies the integrity of the root public key, then verifies the signature of the code signing public key using the root public key, and finally proceeds to verify the signature of the code or design using the code signing public key. The code or design is only accepted if all three of these steps are completed successfully.
Related Information
Level Two Title