Secure Boot Loader

A two-stage secure boot that extends trust from the protected FPGA configuration to the application firmware.

KiviBoot protects software loaded after FPGA configuration. Its two-stage architecture combines the compact KiviBoot-NanoBL first-stage bootloader with the flexible KiviBoot-SecureBL second stage for application verification and firmware updates. The solution can be adapted to FPGA SoCs and softcore processor systems, external memory configurations, hardware roots of trust and application-specific security requirements.

Extend the chain of trust to every software stage

Native FPGA security mechanisms can authenticate and encrypt the configuration bitstream. But FPGA-based systems often load additional boot software and application firmware from external flash or other memories after configuration. If these components are not verified before execution, they remain outside the hardware-established chain of trust.

KiviBoot closes this gap. It provides a trusted transition from the authenticated FPGA design to the bootloader and application software. Images are decrypted and cryptographically verified before control is transferred to the next stage.

Validated implementation

Support for additional FPGA manufacturers and device families will be introduced successively. 

KiviBoot components for secure boot

KiviBoot separates the minimal trusted boot stage from the more flexible system functionality. This limits the attack surface of the first stage while allowing the second stage to be adapted to the target solution.

Platform adaption

KiviBoot is designed as a portable product concept rather than a bootloader tied to a single FPGA. Porting takes the complete target architecture into account:

• FPGA or FPGA SoC and its native security mechanisms
• Hardened processor or soft-core CPU
• External flash and RAM architecture
• Trust anchors, key storage and provisioning
• Application environment: bare metal, RTOS or Linux
• Firmware update, recovery and rollback requirements

Proven on Efinix Titanium

The implementation of KiviBoot has been developed and measured on the Efinix Titanium Ti375 C529 Development Kit with the hardened Sapphire high-performance RISC-V SoC. It combines the Ti375 native bitstream security with KiviBoot-NanoBL and KiviBoot-SecureBL. It extends the chain of trust from the encrypted and authenticated FPGA configuration to software stored in external flash.

• Platform: Efinix Titanium Ti375 C529 Development Kit
• Processor system: Hardened Sapphire high-performance RISC-V SoC
• Architecture: Two-stage, pure-software secure boot

How it works

• 1. The FPGA verifies and decrypts its configuration bitstream using the platform's native security mechanisms.
• 2. The authenticated FPGA configuration establishes the hardware-based starting point and initializes KiviBoot-NanoBL in protected on-chip memory.
• 3. KiviBoot-NanoBL loads, decrypts and verifies KiviBoot-SecureBL.
• 4. KiviBoot-SecureBL loads the application, decrypts the image and verifies its integrity and digital signature.
• 5. The application starts only after all required checks have passed.

• Extends the FPGA hardware root of trust to application firmware
• Protects software stored in external flash and loaded into RAM
• Adapts to bare-metal, RTOS and Linux-based systems
• Supports software cryptography, external secure elements and FPGA-based crypto acceleration
• Enables platform-specific firmware update and lifecycle-security concepts