(PG036) for the 7 Series and Zynq-7000 Soft Error Mitigation v4.1 IP indicates that bitstream encryption is supported, but bitstream authentication is not supported.
This Answer Record provides the latest update regarding bitstream security support using the SEM IP.
The information in this Answer Record supersedes the information described in (PG036).
In 7 Series FPGA, private key encryption and authentication of the bitstream is supported with the SEM IP.
Bitstream encryption using AES-256 along with SHA2-256 HMAC for authentication has been verified to be compatible with the SEM IP in hardware testing using ISE 14.7 and Vivado 2014.3.
In Zynq-7000 SoC devices, the same private key encryption and authentication of the bitstream (AES-256 with SHA2-256 HMAC) is supported with the SEM IP.
Public key authentication using RSA-2048 has not been verified, and as a result, is not supported by the SEM IP.
For more information, contact Xilinx support.