Cyclon 5 tampering protection bit

Hello,

Unfortunately, you cannot make DO_KEY_SECURE non-optional in the generated .jam file itself. The switch must always be explicitly passed at the command line.

Here's the background:

When programming the design security key with a .jam file that has been converted from an Encryption Key Programming file (.ekp) that contains the tamper-protection bit programming instruction, you must add the switch -eDO_KEY_SECURE to your programming command if programming of the tamper-protection bit is desired. How do I enable programming of the tamper-protection bit when programming with a .jam file which has been converted from an an .ekp file that contains the tamper-protection bit programming instruction?

The reason this is intentionally kept as an opt-in switch rather than a default is critical to understand:

The tamper-protection bit is one-time programmable and is irreversible. How do I enable programming of the tamper-protection bit when programming with a .jam file which has been converted from an an .ekp file that contains the tamper-protection bit programming instruction?

Enabling the tamper protection bit disables the test mode in Cyclone V devices and disables programming through the JTAG interface. This process is irreversible and prevents Altera from carrying out failure analysis. Cyclone V Device Handbook Volume 1: Device Interfaces and Integration

Because of that irreversibility, the tool deliberately requires an explicit opt-in — it's a safeguard against accidentally burning the tamper bit during routine key programming operations. There is no supported mechanism to change the .jam file itself so that DO_KEY_SECURE executes by default.

The resolution is simply to add the switch -eDO_KEY_SECURE to your programming command whenever tamper-protection bit programming is desired. How do I enable programming of the tamper-protection bit when programming with a .jam file which has been converted from an an .ekp file that contains the tamper-protection bit programming instruction?

So your command line is exactly right:

quartus_jli -c keys.jam -eDO_KEY_SECURE -a

A couple of additional things worth keeping in mind for your AS-scheme deployment:

After you set the tamper protection bit, the Cyclone V device can only accept configuration files encrypted with the same key. Additionally, programming through the JTAG interface and configuration interface is blocked. Cyclone V Device Handbook Volume 1: Device Interfaces and Integration

The device must be configured using an encrypted bitstream over PS, AS, or FPP configuration modes — configuration over JTAG is disabled when the tamper-protection bit is enabled. Can I use SignalTap II Logic Analyzer in Stratix V, Arria V or Cyclone V series devices which have the design security key programmed and the tamper-protection bit set? Since you're on AS, that's fine, but make sure your AS flash holds the encrypted bitstream before you burn the tamper bit.

My recommendation: wrap the `quartus_jli` call with the `-eDO_KEY_SECURE` flag inside a controlled production script with explicit confirmation prompts, so the irreversible step is never triggered accidentally. That's the standard approach for production key programming flows.