Design Integrity With PolarFire® FPGAs: Built-In Digest Verification

Security mechanisms often focus on preventing access—encrypting data, protecting keys or blocking access. But all those protections assume something fundamental: the FPGA design has not been tampered with.

Digest checks address this assumption directly by verifying the integrity of the FPGA configuration. In PolarFire^® FPGA and PolarFire SoC devices, digest checks are a core building block of secure boot, authenticated configuration and runtime trust.

Real-World Motivation: Silent Modification Attacks

Integrity attacks are especially dangerous because systems may continue operating normally even after trusted low-level content has been altered. Public examples include malicious UEFI persistence, firmware-level persistence in storage devices, direct FPGA bitstream manipulation and attacks that break bitstream authenticity. In each case, the system may still boot or appear functional even though the trusted implementation has changed. That is exactly the gap digest checks are meant to close: they verify that the programmed configuration still matches the expected trusted design, rather than assuming that successful boot or prior authentication is enough.

Documented examples across the industry include:

• Stealth Firmware Persistence: attackers modify firmware to maintain persistence while preserving expected system behavior
• Firmware-Level Persistence in Storage: hard drive firmware was reprogrammed to create hidden persistence outside normal software visibility
• Trust Anchor Bitstream Manipulation: direct FPGA bitstream manipulation bypassed hardware-assisted secure boot and enabled persistent implants
• Bitstream Authenticity Break: attacks on FPGA bitstream protection showed that adversaries can modify configuration behavior, implant hardware Trojans or change system functionality

How Digest Checks Work in PolarFire Devices

In PolarFire devices, digest checks use SHA-256–based digests to protect the integrity of programmed design content. During design generation and programming, digest values are created for the programmed components and stored in the device. Importantly, digest checks are not limited to FPGA fabric. They can also verify the integrity of protected device contents, including security segments, key-storage segments, lock settings and internal nonvolatile memory such as Secure Non-Volatile Memory (sNVM) and Embedded Non-Volatile Memory (eNVM), helping verify that both the design and security assets remain unchanged from their trusted programmed state.

The system controller is responsible for validating design integrity by recomputing the digest from the programmed configuration and comparing it against the stored reference values. This verification is performed in dedicated hardware, independent of the user design. A match confirms that the programmed design is intact. Any mismatch indicates that the configuration has been altered or corrupted, signaling a potential integrity violation.

What Happens on a Digest Mismatch

When a selected digest check fails, the device treats it as an integrity violation. For power-on-reset digest checking, a failed digest check generates a tamper event to the fabric. The DIGEST tamper flag indicates that the requested digest checks failed, and the user design can then respond through the tamper framework. Available built-in response paths include I/O disable, security lockdown, device reset and zeroization, depending on the user design.

This is the practical value of digest checking in a deployed system: it does not just detect that something changed, but also provides a clean signal to the system so the design can take a defined action when trust is no longer established.

How Digest Checks Differ From Encryption and Digital Signatures

Digest checks serve a different purpose from encryption and digital signatures. Encryption protects confidentiality by preventing the programmed content from being read by unauthorized parties. Digital signatures authenticate the source of an image and verify that it was not modified before loading. Digest checks, by contrast, verify the integrity of the programmed design content by confirming that it still matches the trusted reference state that was established during programming. These mechanisms are complementary, not interchangeable; encryption and authentication protect loading and distribution, while digest checks help confirm post-programming integrity of the design in the device.

Integrity for Security and Reliability

Digest verification in PolarFire FPGAs provides value beyond security by also supporting system reliability.

From a reliability perspective, digest checks can also identify unintentional corruption, such as radiation-induced bit flips or programming errors. These faults may or may not immediately disrupt functionality but will lead to incorrect system behavior over time. Run-time digest verification grants configuration integrity and provides a consistent and trusted operating state throughout the device lifecycle.

Hardware-Assisted Digest Generation in PolarFire Devices

While digest verification can be implemented in software or user logic, PolarFire FPGAs perform this function using dedicated hardware managed by the system controller. Since digest computation and verification are handled outside of the user design, it cannot be modified or bypassed by the application.

Reference digests and integrity checks are also protected within secure, access-controlled on-chip memory, verifying that the values used to establish trust remain intact. This hardware-managed approach provides a consistent and reliable method for validating design integrity, eliminating dependence on user implementation and reducing the risk of misconfiguration or incomplete security coverage.

Conclusion: Integrity as a Continuous Commitment

Security systems might fail not because protections were absent, but because trust was assumed.

By integrating hardware-managed digest verification, PolarFire FPGAs establish a trusted foundation for both secure and reliable system operation, enabling detection of unauthorized modifications as well as unintentional corruption. By verifying design integrity at the device level, PolarFire FPGAs help create consistent, predictable behavior throughout the system lifecycle.

For more information, check out our PolarFire FPGA and PolarFire SoC FPGA web pages.