Intel Agilex Secure boot

Question

How to cancel the root keys in intel agilex series?
If root keys got compromised, how to cancel the rot keys ID from HPS linux userspace mailboxes or via FPGA mailbox client?

You may program a root key hash cancellation compact certificate via JTAG, FPGA, or
HPS mailboxes.

# Owner fuses =
"0x00000000000000000000000000000000000000000000000000000
00000000000000000000000000000000000000000000000000000
0000000000000000000000"
# Owner root public key hash 0 =
"0x00000000000000000000000000000000000000000000000000000
0000000000000000000000000000000000000000000"
# Owner root public key hash 1 =
"0x00000000000000000000000000000000000000000000000000000
0000000000000000000000000000000000000000000"
# Owner root public key hash 2 =
"0x00000000000000000000000000000000000000000000000000000
0000000000000000000000000000000000000000000

aikeu · Answer

Hi rajasekarselva,Sorry for the late respond.Referring to this document at Canceling Root Keys section:https://d2pgu9s4sfmw1s.cloudfront.net/DITA-technical-publications/PROD/PSG/ug20335-683823-681909.pdf?Expires=1645428302&amp;Key-Pair-Id=APKAJKRNIMMSNYXST6UA&amp;Signature=W6ji97kMzH1CbDC1-nFhcJrlYCFHrV6gCL92LpvZY6IcQa4xfhLovluMCgdG2Kn4dUE~YRV3NtWfXrPkRd98vU0kHMxQe3PMUG726EqLbJUir6EQYwbSsREu1DDG-wpPa6hMz55sNlLIvLufX2N1E5xNiPoIYP8dRb1cipwPe8bHqVjrwvvP77nuDOVmDFMYzm3Lkg8tHwGuEkznVDBviOiZwNNqeR9FMAOpsGsRicLVny69kXkQoeycVBxZGg0beaeI2O9SVY72IgmHsO~EIuoZSyR~nMU1V~veS4icH3mrFrf1Ggk0kl4ccyAUowRf6OjRIgngPzl-tUFmlEuiTA__Does this answer your questions?Thanks.Regards,Aik Eu

rajasekarselva · Answer

Thanks for your reply, Aik Eu.

Unfortunately, I can't able to open the link. Replied with 'Access Denied'  
&lt;Error&gt;

&lt;Code&gt;AccessDenied&lt;/Code&gt;
&lt;Message&gt;Access denied&lt;/Message&gt;

&lt;/Error&gt;
Do I need any additional login authentication to view this document?

rajasekarselva · Answer

As a reference, are you pointing the below document in the previous link?
Intel® Agilex™ Device Security User Guide

4.4. Canceling Root Keys

If you are pointing the above then there is no detailed explanation/brief on, How to do that from the FPGA mailbox IP or HPS mailbox IP client? Could you point that document, if possible?

Thanks
Raj

aikeu · Answer

Hi rajasekarselva,Yes, I am pointing to that document.I will get back to you on more info regarding cancellation of root keys from HPS Linux userspace or FPGA mailbox client.Thanks.Regards,Aik Eu

aikeu · Answer

Hi rajasekarselva,I get the info from the software security team as below:Firstly you would need to create the certificate to cancel the root key hash. This is detailed in section 4.5 “Canceling Root Keys” of the Agilex Device Security UG.To create the certificate, you would send the Certificate Command (0x0B) through the mailbox (HPS/FPGA)  This command is not currently documented, but will be soon in the Security Methodology UG.The Security Methodology UG will be out in at least one month time.Do let me know if you have further questions or concern from the info above.Thanks.Regards,Aik Eu

Forum Discussion

Intel Agilex Secure boot

7 Replies

Recent Discussions

Device stopped receiving config data: Internal error (0x0000, 0x00000000, 0x1800).

Mandelbrot viewer on Cyclone V - Platform Designer layout

Slow Runtime Performance in FIL Implementation on DE2-115 Using Ethernet

Stratix 10 GX SI Board - issue with the Board Test System (BTS)

Stratix 10 Development Kit HiLo connector