Bitstream Encryption

Several ZTEX FPGA Boards support Bitstream encryption, e.g. USB-FPGA Modules 2.16, 2.13 and 1.15y.

The key which is used to decrypt the bitstream is stored in special low power memory of the FPGA which is powered by a battery. This battery is an option and not installed by default.

Using encrypted bitstreams is quite simple:

1. Generate an encrypted bitstream either (ISE only:) using the bitgen option -g Encypt:Yes and -g KeyFile:<.nky file> or (Vivado only:) using the constraints

   set_property BITSTREAM.ENCRYPTION.ENCRYPT Yes [current_design]
   set_property BITSTREAM.ENCRYPTION.ENCRYPTKEYSELECT bbram [current_design]
   set_property BITSTREAM.ENCRYPTION.KEYFILE <.nky file> [current_design]

   If no key file (.nky file) is given a new one with random key is created. The ucecho example for USB-FPGA Modules 2.16 and 2.13 already contains encrypted bitstreams (ucecho-encrypted.bit) and corresponding key file (ucecho-encrypted.nky).

2. Upload the key (.nky file) to the FPGA through JTAG using Xilinx Impact
3. FPGA now accepts the encrypted bitstream