KiviBoot protects software loaded after FPGA configuration. Its two-stage architecture combines the compact KiviBoot-NanoBL first-stage bootloader with the flexible KiviBoot-SecureBL second stage for application verification and firmware updates. The solution can be adapted to FPGA SoCs and softcore processor systems, external memory configurations, hardware roots of trust and application-specific security requirements.
Native FPGA security mechanisms can authenticate and encrypt the configuration bitstream. But FPGA-based systems often load additional boot software and application firmware from external flash or other memories after configuration. If these components are not verified before execution, they remain outside the hardware-established chain of trust.
KiviBoot closes this gap. It provides a trusted transition from the authenticated FPGA design to the bootloader and application software. Images are decrypted and cryptographically verified before control is transferred to the next stage.
Support for additional FPGA manufacturers and device families will be introduced successively.
| FPGA platform | Processor | Status |
| Efinix Titanium Ti375 | Sapphire RISC-V SoC | Tested |
| Efinix Titanium Ti60 | Sapphire RISC-V (softcore processor) | Tested |
| AMD Artix-7 | MicroBlaze (softcore processor) | Tested |
KiviBoot separates the minimal trusted boot stage from the more flexible system functionality. This limits the attack surface of the first stage while allowing the second stage to be adapted to the target solution.
Designed for execution from protected on-chip RAM or ROM. It contains a small, fixed set of functions required to start the next trusted component.
Runs after successful verification by KiviBoot-NanoBL. It loads and protects the application stage and can implement product-specific boot policies.
KiviBoot is designed as a portable product concept rather than a bootloader tied to a single FPGA. Porting takes the complete target architecture into account:
The implementation of KiviBoot has been developed and measured on the Efinix Titanium Ti375 C529 Development Kit with the hardened Sapphire high-performance RISC-V SoC. It combines the Ti375 native bitstream security with KiviBoot-NanoBL and KiviBoot-SecureBL. It extends the chain of trust from the encrypted and authenticated FPGA configuration to software stored in external flash.
Efinix Titanium Ti375 C529 Development Kit
Hardened Sapphire high-performance RISC-V SoC
Two-stage, pure-software secure boot
Tell us about your FPGA, processor architecture, memory configuration and security requirements. We will assess how KiviBoot can be adapted to your target platform.
