I am wondering how exactly the password comes into play with the encryption itself.
You have (at least) two options here.
- The decryption key is derived from the password
This would not give an attacker any advantage. If he steals the device the decryption key is as unknown as the password. So there is no way the decryption key can be leaked because it is simply not in the device.
- The password is used to unlock the device which already contains the encryption key
Here the decryption key is stored inside the device.
So there are way to extract it.
First of all you can open the device with acid or whatever does the job and read out the key. This is obviously not too simple.
There may also be possibilities to recover the password, depending on the implementation of the password check. If you compare Byte by Byte timing attacks may be possible.
Considering without such 'initiation password' an attacker with physical access would just need to take the FPGA power it on and listens to the crypto hardware operations in order to crack the key?
This might not be necessary at all. Depending on the implementation it may be sufficient to let the device encrypt zeroes to recover the pad that is used for encryption.
When the device is 'unlocked', it may be possible to recover the key with a side-channel attack.
If the implementation is done without protection a simple or differential power analysis can recover the key bit by bit or byte by byte.
Regarding side-channel-attacks is there a preference between symmetric vs asymmetric algorithms used in FPGA to protect data?
There is no preference.
Side-channel attacks can recover keys of both types.
Are there open source code reference implementations available for FPGA with reviewed source code?
Not to my knowledge.
Can you recommend a website or community regarding FPGA crypto implementations, either symmetric and asymmetric algorithms.
Actually no. Side-channel resistant implementations are a good starting point for your own business. They are of great value.