Bitstream Encryption

Several ZTEX FPGA Boards support Bitstream encryption, e.g. USB-FPGA Modules 2.16, 2.13, 2.14 and 2.18.

The key which is used to decrypt the bitstream is stored in special low power memory of the FPGA which is powered by a battery. This battery is an option and not installed by default.

Using encrypted bitstreams is quite simple:

1. Generate an encrypted bitstream either (ISE) using the bitgen option -g Encypt:Yes and -g KeyFile:<.nky file> or (Vivado) using the constraints

   set_property BITSTREAM.ENCRYPTION.ENCRYPT Yes [current_design]
   set_property BITSTREAM.ENCRYPTION.ENCRYPTKEYSELECT bbram [current_design]
   set_property BITSTREAM.ENCRYPTION.KEYFILE <.nky file> [current_design]

   If no key file (.nky file) is given a new one with random key is created.

2. Upload the key (.nky file) to the FPGA through JTAG using Xilinx tools
3. FPGA now accepts the encrypted bitstream (no special load technique is required but some options like bitstream compression may not work)