Allow encrypted POF only

Hello, 

Once you selected "Allow encryption POF only" - the device refuses unencrypted configuration images, only encrypted POF (must match AES key) can be used to configure the FPGA. 

1- After programming the encrypted POF (even with matching key), any further operation will fail, until you erase. The device remains in a secure state that rejects even valid encrypted/reconfigured POFs. 

2- The device expects the AES key to be in place before its encrypted POF is accepted. Trying to load a new encrypted POF without loading its matching EKP first, will cause rejection. 

Steps :

1- Generate .ekp and encrypted .pof in Quartus:

a. Use Convert Programming File GUI

b. Within Options/Boot info -> enable the Security option 

c. "Allow encrypted POF only"

d. "Verify Protect" 

e. Add .ekp file, then generate both .ekp and encrypted .pof.

2- Erase the device completely

a. Before any configuration- "Erase Device" in Quartus Programmer tool

b. This will clear any prior AES key on encrypted image that would block new programming. 

3- Program the AES key(.ekp) first

a. In Quartus Programmer, add the .ekp file

b. command : quartus_pgm -c 1 -m jtag -o "p;yourfile.ekp"

c. Ensure .ekp key is loaded and ready.

4- Program the encrypted POF

a. After .ekp in place: run this command : quartus_pgm -c 1 -m jtag -o "p;yourfile.pof"

regards,

Farabi