Forum Discussion

too_chappy's avatar
too_chappy
Icon for New Contributor rankNew Contributor
2 months ago

Allow encrypted POF only

Hi!

Can someone explain what this is security feature (Allow encrypted POF only) is supposed to do?  In the description it says, "When enabled, devices accepts encrypted POF".  However, this is not the case.  After creating a .pof with "Allow encrypted POF only" and encryption, then loading this .pof + ekp file, everything after this first program/configure fails.  This means you cannot program/configure/verify/blankcheck/examine with the same or different .pof/.ekp.  The only solution is erase.  

But this feature should have allowed for encrypted pof to be programmed.  Originally, I thought it would allow you to load a new .pof as long as you use the same key (.ekp).  After experimenting with various cases, I cannot get pass the failure of reconfiguring the device.  (CONFIG_DONE pin failed to go high in device 1.  .... Operation Failed).  The only solution is to erase.  Which brings me back to the question of what is "Allow encrypted POF only" supposed to do?  Can you provide procedures to get this feature to actual work?

I am on Quartus Prime Standard Edition version 23.1 using a Max10 (m50) FPGA.

Thank you!

 

Configuration
Security

5 Replies

  • Farabi's avatar
    Farabi
    Icon for Regular Contributor rankRegular Contributor
    31 days ago

    Hello, 

     

    You need to have separate license to enable the design encryption on MAX10 with Quartus Prime Standard edition. 

    link : https://licensing.intel.com/psg/s/?language=en_US

     

    regards,

    Farabi

    • too_chappy's avatar
      too_chappy
      Icon for New Contributor rankNew Contributor
      31 days ago

      I am able to encrypt the file so I have the right license.  I know this because without "Allow Encrypted POF only", I loaded an encrypted .pof with its .ekp and the FPGA behaved as expected (aka... lights blink after programming).

      Here is what I did and on the m50 development board from Altera.

      1. Create an .ekp + .pof from the Convert Programming File with the allow encrypted POF only enable AND generate encrypted bitstream enable.  (I created multiple versions with different keys and different .sof to test out.)
      2.  (Note:  I did this with loading the .ekp + .pof together and separate).  Program the FPGA with these files wait for successful programming.  --This works.
      3. (power cycle the board- which didn't seem necessary but I did it anyways.)
      4. Load a new/orig/same_key_generated_pof/different_key_same_sof/pof_only/sof_only/etc...  All the the results failed with  CONFIG_DONE pin failed to go high in device 1.  .... Operation Failed

       

      At Step 4, either the original programming file used in step 2 should work or one of the different other configuration combination should have also worked.  But all fail. 

      To get back to a working state, I had to erase the device.  I also figured out that I can load a .ekp file that does not have "Allow Encrypted POF only" to get back to a good working state. 

      So back to the original question which is what does "Allow Encrypted POF only" do and what steps do I do during FPGA configuration to see that this is working as intended?  The definition of this feature is "When enabled, device only accepts encrypted POF".  But it does NOT appear that it accepts anything configuration including the original configuration used during the first initial programming.

      Is there any other special thing I need to do?  Can you please check on your end to see?

      Thank you!

       

      • too_chappy's avatar
        too_chappy
        Icon for New Contributor rankNew Contributor
        19 days ago

        Hi!  Is there any updates on this?  Were you able to try this on your dev board?  Thank you for your assistance!

  • Farabi's avatar
    Farabi
    Icon for Regular Contributor rankRegular Contributor
    18 days ago

    Hello, 

     

    Once you selected "Allow encryption POF only" - the device refuses unencrypted configuration images, only encrypted POF (must match AES key) can be used to configure the FPGA. 

    1- After programming the encrypted POF (even with matching key), any further operation will fail, until you erase. The device remains in a secure state that rejects even valid encrypted/reconfigured POFs. 

    2- The device expects the AES key to be in place before its encrypted POF is accepted. Trying to load a new encrypted POF without loading its matching EKP first, will cause rejection. 

     

    Steps :

    1- Generate .ekp and encrypted .pof in Quartus:

    a. Use Convert Programming File GUI

    b. Within Options/Boot info -> enable the Security option 

    c. "Allow encrypted POF only"

    d. "Verify Protect" 

    e. Add .ekp file, then generate both .ekp and encrypted .pof.

     

    2- Erase the device completely

    a. Before any configuration- "Erase Device" in Quartus Programmer tool

    b. This will clear any prior AES key on encrypted image that would block new programming. 

     

    3- Program the AES key(.ekp) first

    a. In Quartus Programmer, add the .ekp file

    b. command : quartus_pgm -c 1 -m jtag -o "p;yourfile.ekp"

    c. Ensure .ekp key is loaded and ready.

     

    4- Program the encrypted POF

    a. After .ekp in place: run this command : quartus_pgm -c 1 -m jtag -o "p;yourfile.pof"

     

    regards,

    Farabi