KiviBoot extends the chain of trust from your platform’s protected boot configuration to bootloader and application software. Choose software-based cryptography, FPGA-based AES and SHA acceleration, or integration with a Linux boot environment to match your system.
Embedded systems rely on trusted software from the moment they start. If an attacker can modify, replace, or extract firmware during the boot process, security mechanisms at the application level may already be compromised.
KiviBoot establishes a secure chain of trust from the hardware root of trust to the bootloader and application software. Only authenticated software is executed, while optional encryption helps protect sensitive code and intellectual property.
KiviBoot helps address key security risks in embedded FPGA and SoC systems.
Prevent modified or unauthorized firmware from being executed.
Protect proprietary firmware and software against unauthorized extraction and cloning.
Reduce the risk of sensitive data and cryptographic assets being exposed through compromised software.
Prevent untrusted or malicious software from gaining control of the system during the boot process.
Secure boot is becoming increasingly important for meeting security requirements and industry security practices.
Introduces security requirements for products with digital elements throughout their lifecycle.
Defines security requirements for industrial automation and control systems.
Provides guidance for Platform Firmware Resiliency (PFR) to protect firmware and establish firmware resilience.
Address security capabilities and requirements for IoT devices.
Aaddress hard-/firmware security for infrastructure such as data-center platforms and BMCs.
Native FPGA security mechanisms can authenticate and encrypt the configuration bitstream. But FPGA-based systems often load additional boot software and application firmware from external flash or other memories after configuration. If these components are not verified before execution, they remain outside the hardware-established chain of trust.
KiviBoot closes this gap. It provides a trusted transition from the authenticated FPGA design to the bootloader and application software. Images are decrypted and cryptographically verified before control is transferred to the next stage.
Start with your application environment, then consider the cryptographic workload and FPGA resources available for boot processing.
All KiviBoot products use the same two-stage boot architecture, they differ in cryptographic implementation and supported application environment.
KiviBoot-Tiny executes the cryptographic boot operations on the available target processor.
KiviBoot-Fast combines the software boot stages with AES and SHA hardware acceleration in the FPGA fabric
Choose it for bare-metal or RTOS designs where cryptographic boot processing calls for acceleration.
KiviBoot-Linux combines the KiviBoot boot stages with hardware-accelerated cryptographic processing and integration of the platform-specific Linux boot chain.
Choose it when your design needs the additional boot components and an agreed verification scope for Linux startup.
Tell us about your FPGA, processor architecture, memory configuration and security requirements. We will assess how KiviBoot can be adapted to your target platform.
KiviBoot separates the minimal trusted boot stage from the more flexible system functionality. This limits the attack surface of the first stage while allowing the second stage to be adapted to the target solution.
Designed for execution from protected on-chip RAM or ROM. It contains a small, fixed set of functions required to start the next trusted component.
Runs after successful verification by KiviBoot-NanoBL. It loads and protects the application stage and can implement product-specific boot policies.
