Stratix10 mailbox - key verify

[Oczkowski]

Hi,

Is there any command for Stratix10 Mailbox similar to old key_verify for cycloneV/10 ?.  I would like to obtain information that device is in OWNER mode - confirmation that public authentication key was written into device and/or it's running signed bitstream.

I know some information is available with 

quartus_pgm -c 1 -m jtag -o "ei;programming_file.fuse;...." command or jtag -status but what's Mailbox command code equivalent to those ?

Regards

TO

[WZ2]

Yeah~ You can follow this link:

https://www.intel.com/content/www/us/en/docs/programmable/683642/22-2/creating-a-signature-chain-s10-fm-dm.html

[Oczkowski]

Hi, 

thanks for answer, can you point me exactly where I can find it in Intel® Stratix® 10 Device Security
User Guide documentation ?.

I'm looking form MailBox command code and response template that can be used inside FPGA -VHDL/Verilog - driver for Mailbox IPcore not quartus programmer/jtag instructions.

In our products JTAG is not available anymore after unit shipment to customer.

[WZ2]

Hi there,

I see what you mean. Here it is:

1.   The mailbox’s function of enabling cryptographic services is just available for Intel Agilex® 7 devices in Intel® Quartus® Prime software version 21.3 or later.

2.   Normally, the S10 use command line to realize the function what you need, which based on system console (JTAG).

3.   I will try to ask if there is any other way to set the key into S10 without JTAG.

[Oczkowski]

Thanks that would be great.

For now our main problem is that some units where shipped without owner key programmed into device. As signed software can run on unsigned FPGA goal is to update software with Mailbox IP that will check if owner public key was written into that specific FPGA - similar to (wyswing) internal_jtag module and key_verify command for older FPGA's - thats the feature what we found is missing in mailbox IP commands documentation.

[WZ2]

Hi there,

I check again, For S10, there is no mailbox command for your requirement. There is a way may work for you is use the command line to write the key to device again for all device, Do you think so?

[Oczkowski]

Is there any at least any mailbox command to check if keys were written into device - so that only production units without the keys will have to be pulled back to our factory ?

[WZ2 · Accepted solution]

Hi there,

For Stratix 10, no such command... I am sorry about it

[WZ2]

Hi there,

I wanted to check if you have any further questions or concerns. If not, I will go ahead and mark this issue as resolved.

Additionally, we would greatly appreciate it if you could take a moment to fill out our survey. Your feedback is valuable to us and helps us improve our support quality.

Thank you for your time and cooperation.

Best regards,

WZ