Forum Discussion
New ContributorCyclon 5 tampering protection bit
I have a cyclone V with an AS scheme.
I have generated an key-file (ekp) with tampering protection bit set according to AN556
Then I open it in the programmer programmer and generate a jam-file
now in the jam-file the procedure DO_KEY_SECURE is optional which means I have to enable that procedure manualy with "-e DO_KEY_SECURE" in the command, for example:
quartus_jli -c <n> keys.jam -e DO_KEY_SECURE -a <action>
is it possible to make this procedure non-optional so it will program the tampering bit by default when programming the key?
8 Replies
MLars19Well
I can't write the protection bit afterwards.How can I do it without the quartus_jli attempting to write the kay as well, now I get this error message
Error - Non-volatile key programming already attempted on device 1
Exit code = 10... Device programming failure
Farabi_AlteraRegular Contributor
Hello,
Do you have further question?
- Farabi_Altera
This is a well-known situation with Cyclone V non-volatile key programming. Once the non-volatile key has already been burned into the OTP fuses, any subsequent attempt to re-run the full key programming sequence (including the key write itself) will fail with that "Non-volatile key programming already attempted" error — because OTP fuses are one-time programmable.
You still can program the tamper-protection bit separately, without re-programming the key.
Program the tamper-protection bit independently using a .jam file
When programming the design security key with a .jam file that has been converted from an Encryption Key Programming file (.ekp) that contains the tamper-protection bit programming instruction, add the switch -eDO_KEY_SECURE to your programming command if programming of the tamper-protection bit is desired.
You can program the anti-tamper bit into an Altera device whilst the design security key is being programmed, or some time after the design security key has been programmed. In the latter case, the encryption key programming file (.ekp) is not required. When can the anti-tamper bit be programmed into an Altera device that supports the design security feature?
Key points on the -eDO_KEY_SECURE switch
Use
quartus_jliwith your .jam file and append -eDO_KEY_SECURE to the command line. This instructs the JAM player to execute the tamper-protection bit programming instruction without attempting to re-burn the key fuses.Note that the tamper-protection bit is one-time programmable and is irreversible.
Enabling the tamper protection bit disables the test mode in Cyclone V devices and disables programming through the JTAG interface. This process is irreversible and prevents Altera from carrying out failure analysis. Cyclone V Device Handbook Volume 1: Device Interfaces and Integration
- MLars19
If one for example missed the `-eDO_KEY_SECURE` flag and just programmed the key.
Is it possible to just program the tampering bit afterwards?
- Farabi_Altera
Hello,
Do you have further question?
regards,
Farabi - Farabi_Altera
Yes, you can program the tamper protection bit separately after the key has already been programmed. The `-eDO_KEY_SECURE` switch is what triggers tamper-bit programming during a `.jam` file execution, so if you omitted it the first time, you can re-run the programming command with that switch added.
When programming the design security key with a `.jam` file that has been converted from an Encryption Key Programming file (`.ekp`) that contains the tamper-protection bit programming instruction, add the switch `-eDO_KEY_SECURE` to your programming command if programming of the tamper-protection bit is desired. How do I enable programming of the tamper-protection bit when programming with a .jam file which has been converted from an an .ekp file that contains the tamper-protection bit programming instruction?
So the resolution is straightforward: add the switch `-eDO_KEY_SECURE` to your programming command if programming of the tamper-protection bit is desired.
- MLars19
Thanks
- Farabi_Altera
Hello,
Unfortunately, you cannot make DO_KEY_SECURE non-optional in the generated .jam file itself. The switch must always be explicitly passed at the command line.
Here's the background:
When programming the design security key with a .jam file that has been converted from an Encryption Key Programming file (.ekp) that contains the tamper-protection bit programming instruction, you must add the switch -eDO_KEY_SECURE to your programming command if programming of the tamper-protection bit is desired. How do I enable programming of the tamper-protection bit when programming with a .jam file which has been converted from an an .ekp file that contains the tamper-protection bit programming instruction?
The reason this is intentionally kept as an opt-in switch rather than a default is critical to understand:
The tamper-protection bit is one-time programmable and is irreversible. How do I enable programming of the tamper-protection bit when programming with a .jam file which has been converted from an an .ekp file that contains the tamper-protection bit programming instruction?
Enabling the tamper protection bit disables the test mode in Cyclone V devices and disables programming through the JTAG interface. This process is irreversible and prevents Altera from carrying out failure analysis. Cyclone V Device Handbook Volume 1: Device Interfaces and Integration
Because of that irreversibility, the tool deliberately requires an explicit opt-in — it's a safeguard against accidentally burning the tamper bit during routine key programming operations. There is no supported mechanism to change the .jam file itself so that DO_KEY_SECURE executes by default.
The resolution is simply to add the switch -eDO_KEY_SECURE to your programming command whenever tamper-protection bit programming is desired. How do I enable programming of the tamper-protection bit when programming with a .jam file which has been converted from an an .ekp file that contains the tamper-protection bit programming instruction?
So your command line is exactly right:
quartus_jli -c keys.jam -eDO_KEY_SECURE -aA couple of additional things worth keeping in mind for your AS-scheme deployment:
After you set the tamper protection bit, the Cyclone V device can only accept configuration files encrypted with the same key. Additionally, programming through the JTAG interface and configuration interface is blocked. Cyclone V Device Handbook Volume 1: Device Interfaces and Integration
The device must be configured using an encrypted bitstream over PS, AS, or FPP configuration modes — configuration over JTAG is disabled when the tamper-protection bit is enabled. Can I use SignalTap II Logic Analyzer in Stratix V, Arria V or Cyclone V series devices which have the design security key programmed and the tamper-protection bit set? Since you're on AS, that's fine, but make sure your AS flash holds the encrypted bitstream before you burn the tamper bit.
My recommendation: wrap the `quartus_jli` call with the `-eDO_KEY_SECURE` flag inside a controlled production script with explicit confirmation prompts, so the irreversible step is never triggered accidentally. That's the standard approach for production key programming flows.
