Contact

KiviBoot

A two-stage secure boot solutions that extends trust from the protected FPGA configuration to the application firmware.

KiviBoot Secure Bootloader

KiviBoot is a platform-integrated secure boot solutions for FPGA-based systems available as software-only, FPGA-accelerated and Linux-ready variants. It extends the chain of trust from the protected FPGA configuration to the application software. 

The solution can be adapted to FPGA SoCs and softcore processor systems, external memory configurations, hardware roots of trust and application-specific security requirements.

Find the right KiviBoot variant

Extend the chain of trust to every software stage

Native FPGA security mechanisms can authenticate and encrypt the configuration bitstream. But FPGA-based systems often load additional boot software and application firmware from external flash or other memories after configuration. If these components are not verified before execution, they remain outside the hardware-established chain of trust.

KiviBoot closes this gap. It provides a trusted transition from the authenticated FPGA design to the bootloader and application software. Images are decrypted and cryptographically verified before control is transferred to the next stage.

Extends the hardware root of trust to application firmware

Protects software stored in external flash and loaded into RAM

Adapts to bare-metal, RTOS and Linux-based systems

Supports software cryptography, external secure elements and FPGA-based crypto acceleration

Authenticates software before execution

Choose the KiviBoot solution for your system

All KiviBoot products use the same two-stage boot architecture. They differ in cryptographic implementation and supported application environment. 

KiviBoot-Tiny

Software only secure boot

Executes the cryptographic boot operations on the available target processor and does not require dedicated AES or SHA accelerators in the FPGA fabric. It is designed for systems where FPGA resources are limited and software-based boot performance is sufficient. 

  • Two-stage boot architecture
  • AES, hashing and image verification executed in software
  • NanoBL runs from protected on-chip RAM or ROM
  • SecureBL and application images can be loaded from external flash
  • Suitable for bare-metal and RTOS-based systems
  • Optional integration with an external secure element

KiviBoot-Fast

FPGA-accelerated secure boot

Combines the KiviBoot software stages with AES and SHA hardware accelerators in the programmable logic. It is intended to reduce cryptographic processing time and processor load, particularly for larger firmware images or systems with stricter startup-time requirements.

  • Two-stage boot architecture
  • AES and SHA acceleration in FPGA fabric
  • Software interface between the bootloader and crypto IP cores
  • Suitable for bare-metal and RTOS-based systems
  • Optional external secure element for key protection, entropy or other platform-specific security functions

KiviBoot-Linux

Secure boot for Linux systems

Extends the multi-stage KiviBoot architecture towards the Linux boot environment. It combines the KiviBoot boot stages with hardware-accelerated cryptographic processing and integration of the platform-specific Linux boot chain 

  • Two-stage boot architecture
  • AES and SHA acceleration in FPGA fabric
  • Integration with OpenSBI and U-Boot
  • Support for loading Linux kernel and device tree components
  • Adaptation to external flash, SD card and system memory architecture
  • Designed for FPGA SoCs and softcore processor systems
  • Application-specific verification scope and boot policy

Validated implementation

Support for additional FPGA manufacturers and device families will be introduced successively. 

FPGA platform Processor Status
Efinix Titanium Ti375 Sapphire hardened RISC-V SoC  Tested
Efinix Titanium Ti60 Sapphire RISC-V (softcore processor) Tested
AMD Artix-7  MicroBlaze RISC-V (softcore processor) Tested

 

Secure-Boot-Loader

How it works

  • 1. The FPGA verifies and decrypts its configuration bitstream using the platform's native security mechanisms.
  • 2. The authenticated FPGA configuration establishes the hardware-based starting point and initializes KiviBoot-NanoBL in protected on-chip memory.
  • 3. KiviBoot-NanoBL loads, decrypts and verifies KiviBoot-SecureBL.
  • 4. KiviBoot-SecureBL loads the application, decrypts the image and verifies its integrity and digital signature.
  • 5. The application starts only after all required checks have passed.

KiviBoot components for secure boot

KiviBoot separates the minimal trusted boot stage from the more flexible system functionality. This limits the attack surface of the first stage while allowing the second stage to be adapted to the target solution.

KiviBoot-NanoBL

Minimal first-stage secure bootloader

Designed for execution from protected on-chip RAM or ROM. It contains a small, fixed set of functions required to start the next trusted component.

  • Establish the trusted software entry point
  • Starts from protected on-chip memory
  • Loads KiviBoot-SecureBL
  • Decrypts and verifies KiviBoot-SecureBL before execution
  • Transfers control only after successful verification
  • Keeps the initial trusted software base small

KiviBoot-SecureBL

Second-stage bootloader for application security

Runs after successful verification by KiviBoot-NanoBL. It loads and protects the application stage and can implement product-specific boot policies.

  • Verify and manage application firmware
  • Loads application firmware
  • Decrypts the application image
  • Verifies image integrity and digital signatures
  • Supports firmware update handling
  • Can be adapted for image metadata, product and hardware identifiers, version checks, recovery and anti-rollback policies
  • Transfers control only to successfully verified application firmware

Platform adaption

KiviBoot is designed as a portable product concept rather than a bootloader tied to a single FPGA. Porting takes the complete target architecture into account:

FPGA or FPGA SoC and its native security mechanisms

Hardened processor or soft-core CPU

External flash and RAM architecture

Trust anchors, key storage and provisioning

Application environment: bare metal, RTOS or Linux

Firmware update, recovery and rollback requirements

Licensing

Licensing and deliverables

License type Purpose Scope Fee Deliverables
Product License Manufacture of products intended for commercial distribution. Valid for single-instance implementation into one device (e.g., one type of SoC, or FPGA) for a specific project or product definition.  One-time fee 
  • KiviBoot-NanoBL source code
  • KiviBoot-SecureBL source code
  • Reference application source code
  • Encryption and signature toolchain
  • Documentation
Evaluation License Usability and evaluation for upcoming design  Valid for single-instance implementation into one device (SoC, or FPGA) for a specific upcoming design project. Free, no license fee
  • Bitstream w/ KiviBoot-NanoBL
  • KiviBoot-SecureBL image
  • Reference application binary & source code
  • Encryption and signature toolchain
  • Documentation
Support and maintenance

  • Maintenance and updates of software included

  • Rapid bug fix cycles

  • Documentation and integration examples included

  • Web based support with response times of 8 hours (Mo to Fri)

Secure every stage of your FPGA-based boot process

Tell us about your FPGA, processor architecture, memory configuration and security requirements. We will assess how KiviBoot can be adapted to your target platform.

Discuss your target platform

Proven on Efinix Titanium

The implementation of KiviBoot has been developed and measured on the Efinix Titanium Ti375 C529 Development Kit with the hardened Sapphire high-performance RISC-V SoC. It combines the Ti375 native bitstream security with KiviBoot-NanoBL and KiviBoot-SecureBL. It extends the chain of trust from the encrypted and authenticated FPGA configuration to software stored in external flash.

Learn more about implementation

Platform

Efinix Titanium Ti375 C529 Development Kit

Processor system

Hardened Sapphire high-performance RISC-V SoC

Architecture

Two-stage, pure-software secure boot