KiviBoot-Tiny
Software-based secure boot for FPGA systems
Verify firmware before startup
Check the next software image before handing over execution, extending trust beyond the initial platform configuration.
Start with a board reference
Use prepared boot components and an example application to explore the signing and verified-startup workflow.
Fast availability and direct support
Evaluation packages and documentation are available via download, with rapid responsive web support to keep your project moving.
European technology
Developed in Germany, with predictable availability giving design teams transparency, control, and long-term planning security.
KiviBoot Overview
KiviBoot-Tiny is the pure software-based variant of the KiviBoot family. AES, hashing and image verification run on the target processor. It fits FPGA-based systems where programmable-logic resources are limited and software-based boot performance meets the application’s startup requirements.
The two-stage architecture separates the initial trusted bootloader from application loading and verification:
- KiviBoot-NanoBL provides the initial software stage in on-chip memory. It loads and checks KiviBoot-SecureBL before transferring control.
- KiviBoot-SecureBL loads the application image from external flash, performs the configured decryption and authenticity checks, and starts the application after successful verification.
The trusted starting point depends on the target platform. FPGA softcore systems can establish it through the protected FPGA configuration. SoC implementations integrate with the processor’s native boot architecture. KiviBoot-Tiny must be combined with the appropriate protection of the initial boot components and keys.
Tested reference platforms
KiviBoot has been implemented on the following reference systems. Each uses a platform-specific memory layout and boot flow.
| Reference Boards | Processor | External execution memory |
| Efinix Titanium Ti375 C529 Development Board | Hardened Sapphire RISC-V SoC | DDR RAM |
| TRS-STAR T*Square Ti60-256 Education Board | Sapphire RISC-V softcore | HyperRAM |
| Digilent Arty A7-100T | MicroBlaze RISC-V softcore on AMD Artix-7 | DDR3L RAM |
| Digilent Arty Z7-20 | Arm Cortex-A9 on AMD Zynq-7000 | DDR3 RAM |
Key Features
-
Two bootloader stages: KiviBoot-NanoBL and KiviBoot-SecureBL
-
Software implementation of AES, hashing and image verification
-
Verification of subsequent software images before execution
-
Loading of bootloader and application images from external flash into system memory
-
Decryption of protected software images as part of the configured boot flow
-
Integration with ARM and RISC-V processor platforms, including hardened processors and FPGA softcores
-
Intended for bare-metal and RTOS-based application environments, with platform-specific integration
-
Host-side image signing and encryption toolchain
-
Source code for both bootloader stages under the product license
Applications
-
FPGA systems loading application firmware from external flash.
-
Bare-metal or RTOS designs requiring verified software startup.
-
Designs where FPGA fabric is reserved for application logic and software cryptography meets boot-time requirements.
-
Teams evaluating a signed firmware workflow before adapting it to production hardware and keys.
Interested in KiviBoot-Tiny?
Get pricing based on your project and licensing requirements.
Licensing
Licensing and deliverables
| License type | Purpose | Scope | Fee | Deliverables |
| Product License | Manufacture of products intended for commercial distribution. | Valid for single-instance implementation into one device (e.g., one type of SoC, or FPGA) for a specific project or product definition. | One-time fee |
|
| Evaluation License | Usability and evaluation for upcoming design | Valid for single-instance implementation into one device (SoC, or FPGA) for a specific upcoming design project. | Free, no license fee |
|
Support and maintenance
-
Maintenance and updates of software included
-
Rapid bug fix cycles
-
Documentation and integration examples included
-
Web based support with response times of 8 hours (Mo to Fri)
Technical documentation and evaluation package
Register for the evaluation portal to access evaluation packages and technical documentation.