Why do I see Error (20354) and Error (20353) when signing CCERTs in Quartus® Prime Pro Edition version 26.3 with root keys generated in earlier versions?

Description

You may encounter a signing failure in Quartus® Prime Pro Edition Software version 26.3 when an Agilex® 7 FPGA device root key generated by quartus_sign in an earlier release, such as Quartus® Prime Pro Edition Software version 21.2, is used to create and sign compact certificates (CCERTs).

The operation fails with the following errors:

Error (20354): Fail to execute file <path>26.3/111/linux64/devices/programmer/python/agilex_sign.py
Error (20353): Module: bitstream.py, Function: verify_block0, Line: 798
Error (20353): Root key select is undetermined
Error: Quartus Prime Signing_Tool was unsuccessful. 3 errors, 1 warning

For example:

In Quartus® Prime Pro Edition Software version 21.2, the following files were generated:

• root0_212.qky
• root0_public_212.pem
• root0_private_212.pem
• root0_aes_212.qek

After switching to Quartus® Prime Pro Edition Software version 26.3 to generate the AES CCERT, the following commands were executed (using the AES CCERT test case as an example):

quartus_pfg --ccert -o ccert_type=EFUSE_WRAPPED_AES_KEY -o qek_file=root0_aes_212.qek unsigned_aesccert0-263.ccert

quartus_sign --family=agilex --operation=sign --pem=root0_private_212.pem --qky=root0_212.qky unsigned_aesccert0-263.ccert signed_aesccert0-263.ccert

Impacted Agilex 7 OPN

• AGF 012
  
• AGF 014
• AGF 022
• AGF 027
• AGI 022
• AGI 027

Resolution

Recommendation: 

To sign a CCERT, use one of the following options:

• • Use the same Quartus sofware version that was used to generate the existing root key.
  • Use Quartus Prime Pro Edition Software version 26.1.1 or earlier.
  • Use Quartus Prime Pro Edition Software version 26.3 or later to generate a new root key.
• Note: This behavior applies starting with Quartus Prime Pro Edition Software version 26.3 and is not expected to change in future releases.

Related Articles

Agilex 7 Part number Decoder