Is it possible to perform partial reconfiguration using encrypted bitstreams on Virtex devices?
No. Partial reconfiguration using encrypted bitstreams is not supported for Virtex-II/-II Pro/Virtex-4/Virtex-5 devices. The reason this is not possible is because the encryption engine in the device does not allow control of the Frame Address Register to the user application. Consequently, when encryption is used by the bitstream, the Frame Address Register must start at 0.
Partial Bitstream Encryption must be implemented at the user-application level. IP must be created to un-encrypt incoming partial bitstreams before they are processed by the ICAP.