FlashROM in Actel’s Low-Power Flash Devices
v1.1
5 - 5
FlashROM Security
Low-power flash devices have an on-chip Advanced Encryption Standard (AES) decryption core,
combined with an enhanced version of the Actel flash-based lock technology (FlashLock).
Together, they provide unmatched levels of security in a programmable logic device. This security
applies to both the FPGA core and FlashROM content. These devices use the 128-bit AES (Rijndael)
algorithm to encrypt programming files for secure transmission to the on-chip AES decryption core.
The same algorithm is then used to decrypt the programming file. This key size provides
approximately 3.4 × 1038 possible 128-bit keys. A computing system that could find a DES key in a
second would take approximately 149 trillion years to crack a 128-bit AES key. The 128-bit
FlashLock feature in low-power flash devices works via a FlashLock security Pass Key mechanism,
If the device is locked with certain security settings, functions such as device read, write, and erase
are disabled. This unique feature helps to protect against invasive and noninvasive attacks.
Without the correct Pass Key, access to the FPGA is denied. To gain access to the FPGA, the device
first must be unlocked using the correct Pass Key. During programming of the FlashROM or the
FPGA core, you can generate the security header programming file, which is used to program the
AES key and/or FlashLock Pass Key. The security header programming file can also be generated
independently of the FlashROM and FPGA core content. The FlashLock Pass Key is not stored in the
FlashROM.
Low-power flash devices with AES-based security allow for secure remote field updates over public
networks such as the Internet, and ensure that valuable intellectual property (IP) remains out of
the hands of IP thieves.
Figure 5-5 shows this flow diagram.
Figure 5-5 Programming FlashROM Using AES
Fusion
AES
Encryption
Encrypted Data
AES-128
Decryption
Core
Encrypted Data
FlashROM
FPGA Core
Programming
Data
Untrusted
Medium
Same AES Key