FPGA accelerated bootloader

Verify firmware before startup

Move AES and SHA processing into dedicated FPGA hardware to address the cryptographic workload in your boot path.

Start with a board reference

Use prepared boot components and an example application to explore the signing and verified-startup workflow.

Fast availability and direct support

Evaluation packages and documentation are available via download, with rapid responsive web support to keep your project moving.

European technology

Developed in Germany, with predictable availability giving design teams transparency, control, and long-term planning security.

KiviBoot-Fast Overview

KiviBoot-Fast combines KiviBoot-NanoBL and KiviBoot-SecureBL with AES and SHA hardware accelerators in the programmable logic. It is designed to reduce cryptographic processing time and processor workload during boot, particularly for larger firmware images or stricter startup-time requirements.

KiviBoot-NanoBL provides the initial software stage in protected on-chip memory. It loads and checks KiviBoot-SecureBL before transferring control. KiviBoot-SecureBL then loads the application image, performs the configured decryption and authenticity checks, and starts the application after successful verification.

Both bootloader stages can use the hardware crypto functions through the software interface to the IP cores. The trusted starting point depends on the target architecture and requires appropriate protection of the initial boot components, FPGA configuration and keys.

Tested reference platforms

KiviBoot-Fast has been implemented on the following reference systems. Each uses a platform-specific memory layout and boot flow.

Reference Boards	Processor	External execution memory
Efinix Titanium Ti375 C529 Development Board	Hardened Sapphire RISC-V SoC	DDR RAM
TRS-STAR T*Square Ti60-256 Education Board	Sapphire RISC-V softcore	HyperRAM
Digilent Arty A7-100T	MicroBlaze RISC-V softcore on AMD Artix-7	DDR3L RAM
Digilent Arty Z7-20	Arm Cortex-A9 on AMD Zynq-7000	DDR3 RAM

Key Features

Two software bootloader stages: KiviBoot-NanoBL and KiviBoot-SecureBL
FPGA-based AES and SHA acceleration
Software interface between the bootloader stages and crypto IP cores
Verification of subsequent software images before execution
Decryption of protected software images as part of the configured boot flow
Loading of bootloader and application images from external flash into system memory
Integration for bare-metal and RTOS-based application environments
Host-side encryption and signature toolchain
Optional integration of an external secure element for platform-specific security functions

Applications

FPGA-based systems where software AES and SHA processing limits the available boot-time budget
Designs loading larger protected firmware images from external flash
Bare-metal and RTOS systems requiring verified application startup with FPGA-based cryptographic acceleration
Teams assessing the trade-off between boot-processing time and FPGA resource

Licensing and deliverables

License type	Purpose	Scope	Fee	Deliverables
Product License	Manufacture of products intended for commercial distribution.	Valid for single-instance implementation into one device (e.g., one type of SoC, or FPGA) for a specific project or product definition.	One-time fee	KiviBoot-NanoBL source code KiviBoot-SecureBL source code Reference application source code Encryption and signature toolchain Documentation
Evaluation License	Usability and evaluation for upcoming design	Valid for single-instance implementation into one device (SoC, or FPGA) for a specific upcoming design project.	Free, no license fee	Bitstream w/ KiviBoot-NanoBL KiviBoot-SecureBL image Reference application binary & source code Encryption and signature toolchain Documentation

Support and maintenance

Maintenance and updates of software included
Rapid bug fix cycles
Documentation and integration examples included
Web based support with response times of 8 hours (Mo to Fri)

KiviBoot-Fast

FPGA-accelerated secure boot for embedded systems