Secure Boot for Edge FPGAs

Every edge FPGA that closes a control loop boots only cryptographically verified firmware, from an immutable root of trust to the running bitstream.

Why the edge FPGAs are the crown jewels

The L1 fast control loop runs on FPGAs at the machine edge because plasma shape and position on the breeder (9.66 MA, delta -0.30) and mirror/plug control on the burner demand deterministic sub-millisecond response. That places these devices directly on the actuation path. If an attacker can substitute the bitstream, they own the actuators. Secure boot ensures the device will refuse to run anything not signed by Kronos.

The chain of trust

• Root of trust: an immutable boot ROM and fused public-key hash the device manufacturer cannot rewrite in the field.
• First-stage bootloader: verified against the fused key before execution.
• Bitstream: encrypted and authenticated (see bitstream integrity); a failed signature halts boot.
• Runtime measurement: each stage measures the next into a protected register for later attestation.

# Measured, verified boot (conceptual, per stage)
def boot_stage(image, next_pubkey_in_image):
    if not verify_sig(image, key=fused_root_pubkey if stage==0 else prev_key):
        halt('signature failure')          # fail closed, do not run
    measure_extend(pcr, sha384(image))     # accumulate measurement
    key = extract_pubkey(image)            # key for the next stage
    exec_verified(image)
    return key

Fail-closed, not fail-open

A verification failure never falls back to an unverified image. The node halts and signals the supervisor, which treats the missing node as a fault and drives the machine toward a safe state via the independent safety-instrumented system. A dead controller is safe; a subverted one is not.

Design status

Secure-boot logic, measured-boot extension, and fail-closed handling are implemented and tested on development FPGA boards and in the twin. The fused production keys and field-locked ROM configuration are part of the FOAK hardware provisioning; no live-reactor FPGA is yet in service.