Bitstream Encryption

The bitstream is encrypted using a symmetric block cipher, typically AES-256-GCM, which provides both confidentiality and authenticated integrity. The FPGA fabric contains a dedicated hardware decryption engine that decrypts the bitstream on-the-fly during the configuration process, ensuring the plaintext configuration never resides in external memory. This mechanism is defined by the IEEE 1735 standard for electronic design intellectual property protection.

The secret decryption key can be stored in two primary locations on the FPGA:

• Battery-Backed RAM (BBRAM): A volatile key memory that is continuously powered by an external battery. Any physical tampering that disconnects the battery instantly erases the key, a process known as zeroization.
• eFUSE Registers: A one-time-programmable, non-volatile memory where the key is physically blown into the silicon at manufacturing or provisioning time. This provides a permanent, unalterable key that cannot be read back via software interfaces.

Bitstream encryption establishes a Hardware Root of Trust (HRoT) for the entire system. The decryption key is fused into the silicon and is never exposed to software, the operating system, or JTAG debugging interfaces. This creates a cryptographic boundary where the FPGA itself is the only entity capable of decrypting its configuration. This is a critical countermeasure against bus snooping attacks where an adversary probes the external SPI flash memory to capture the configuration data in transit.

Modern bitstream encryption schemes, such as those in Xilinx Versal and Intel Agilex devices, combine encryption with HMAC-based authentication. The bitstream is signed with a secret key, and the FPGA's configuration logic verifies the Message Authentication Code before loading. This prevents bitstream tampering—an attack where a malicious actor modifies the encrypted bitstream to cause a denial of service or to inject a hardware Trojan by exploiting error propagation in cipher modes like CBC.

A sophisticated side-channel attack against bitstream encryption involves measuring the FPGA's power consumption during decryption to statistically infer the secret key. Advanced FPGAs integrate hardware-level countermeasures to mitigate this:

• Masked AES Cores: The internal AES implementation uses random masks to decorrelate the power consumption from the secret key material.
• Amplitude Noise Injection: The power delivery network is deliberately perturbed to obscure the cryptographic operations' signal.
• Constant-Time Execution: The decryption path is designed to have a fixed number of cycles, independent of the key or data, preventing timing-based leakage.

To securely provision the symmetric bitstream key into a device in an untrusted manufacturing environment, FPGAs support public key wrapping. The device contains a manufacturer-provisioned, immutable device certificate and private key. The symmetric key is encrypted with the device's public key, ensuring that only the target FPGA can unwrap it. This process, often called key encapsulation, prevents the OEM's secret bitstream key from being exposed to contract manufacturers or supply chain intermediaries.

The on-the-fly encryption of data traveling between a processor and external memory. While bitstream encryption protects the configuration file at rest, bus encryption ensures that an attacker physically probing the memory bus cannot capture plaintext model weights or intermediate activations during runtime. This is critical for edge AI deployments where the FPGA interacts with external DRAM.

A hardware security primitive that derives a unique, unclonable cryptographic key from the inherent microscopic manufacturing variations in a silicon chip. PUFs are often used to generate or protect the key that decrypts the bitstream, binding the encrypted configuration to a specific physical device. If an attacker clones the bitstream to an identical FPGA, the PUF-derived key will not match and the design will fail to load.

A dedicated, tamper-resistant hardware chip designed to securely store cryptographic keys and execute sensitive operations in an isolated environment. In FPGA security architectures, the secure element often serves as the root of trust, storing the AES decryption key and releasing it to the FPGA's dedicated decryption logic only after successful authentication. This physically separates key storage from the device running the model.

An active defense mechanism that immediately and irrevocably erases cryptographic keys, decrypted bitstreams, and sensitive data from volatile memory upon detection of a physical tampering event. When paired with bitstream encryption, zeroization ensures that if an attacker attempts to probe the FPGA or breach its enclosure, the plaintext configuration is destroyed before it can be extracted. This is a critical fail-safe for anti-tampering systems.

A class of defenses that eliminate or mask physical information leakage—such as timing, power consumption, or electromagnetic emanations—from a processor running model inference. Even with a strongly encrypted bitstream, an attacker can potentially extract keys by observing power traces during decryption. Mitigations include:

A cryptographic protocol that allows a remote server to verify the integrity and trusted state of a device's software and hardware environment before provisioning a decryption key or allowing model execution. Before an FPGA is permitted to decrypt and load a bitstream, the attestation process verifies that the device is running authentic, untampered firmware and that the bitstream has not been modified. This establishes a hardware-rooted chain of trust from manufacturing to deployment.