Xilinx Zynq-7000 Manual

Chapter 32: Device Security
XILINX CONFIDENTIAL — DISCLOSED UNDER NDA
Zynq-7000 EPP Technical Reference Manual www.xilinx.com 6
UG585 (DRAFT) February 15, 2012
Table 1: Boot ROM Header Summary
Boot ROM Header Value at 0x028 Description
0xA5C3C5A3 Encrypted image using eFuse key
0x3A5C3C5A Encrypted image using BBRAM key
All other Non-encrypted image
The boot ROM header and partition headers are not encrypted. Partition data is signed and encrypted. The partition
data will be decrypted and authenticated by the AES and HMAC engines within the PL. When encryption is used, all
partitions will be encrypted. There cannot be a mix of encrypted and non-encrypted partitions in a boot image.
33.2.3 eFuse Settings
The Zynq-7000 secure boot features can also be controlled via three PL eFuse bits that are described in Table 2.
Table 2 eFuse Settings Summary
eFuse
Description
eFuse Secure Boot
The Zynq device must boot securely and use the eFuse key as the
AES key source. Non-secure boot of the device is not allowed. If
the boot image header doesn’t match this setting, a security
lockdown will occur.
BBRAM Key Disable If the Zynq device is booted in secure mode, then the eFuse key
must be selected. Non-secure boot of the device is allowed. If the
boot image header doesn’t match this setting, a security lockdown
will occur.
JTAG Chain Disable The ARM DAP controller is permanently set in bypass mode. Any
attempt to activate the ARM DAP controller will cause a security
lockdown.
See the 7-Series FPGA Configuration User Guide for information regarding PL eFuses.
33.3 Encryption, Authentication and Key Management
33.3.1 Boot Image and Bitstream Encryption
Boot images and PL configuration bitstreams are encrypted by running bootgen. This program will created a boot
image with the correct header. See the Bootgen User Guide for more information.
33.3.2 Boot Image and Bitstream Decryption and Authentication
For cipher text decryption, Xilinx uses the Advanced Encryption Standard (AES) in Cipher Block Chaining (CBC)
mode with a 256-bit key. PS images and PL bitstreams are authenticated with a Keyed-Hashed Message Authentica-
tion Code (HMAC) using the SHA-256 hash algorithm (FIPS180-2). When the Boot ROM detects that the FSBL
image is encrypted, it enables the decryption and authentication engines within the PL. Both are enabled or disabled in
tandem.
Subsequent PS images do not have to be encrypted. Once an encrypted FSBL has been loaded, it is “trusted” and can
then load a plain text second stage boot loader or application. The path from the external memory to the OCM can
bypass the decryption / authentication engines within the PL. Loading of plain text PS images after a secure boot is not
recommended and should only be done after fully evaluating the system-level security.

Xilinx Zynq-7000 Specifications

General

Brand	Xilinx
Model	Zynq-7000
Category	Motherboard
Language	English