When a device is blank, there are no user secrets on the device that can be used to encrypt the bitstream to load user keys. On the devices, there are three approaches for handling this:
- A factory-defined default key (KLK) may be used to load user keys. The KLK is common to a relatively large number of devices of the same type and version, and resides within the programming tool software.
- A key, DFK, derived from a device-unique factory key FK, may be used to load user keys. This allows a bitstream to be encrypted for a specific device. SPPS is required for this scheme.
- ECDH based scheme whereby the device and the programmer dynamically derive an ephemeral shared secret key unique to each FPGA and each session. This allows to truly secure the initial user key loading since the shared key is never exposed. It is ephemeral and only exists for a short time during the initial user key provisioning, only the Microchip certified target device is capable of decrypting the bitstream. SPPS is required for using this scheme.
The KLK based approach provides customer not concerned with bitstream security a simple method for programming devices that does not require the SPPS. Because all the devices support the ECDH based scheme, DFK mode is mainly reserved as an alternative quantum-safe mode, in case, quantum computing makes elliptic curve cryptography obsolete. Until then, in most cases, users equipped with the SPPS may want to use the ECDH-based key scheme.