Forum Discussion
New ContributorCyclon 5 tampering protection bit
I have a cyclone V with an AS scheme.
I have generated an key-file (ekp) with tampering protection bit set according to AN556
Then I open it in the programmer programmer and generate a jam-file
now in the jam-file the procedure DO_KEY_SECURE is optional which means I have to enable that procedure manualy with "-e DO_KEY_SECURE" in the command, for example:
quartus_jli -c <n> keys.jam -e DO_KEY_SECURE -a <action>
is it possible to make this procedure non-optional so it will program the tampering bit by default when programming the key?
2 Replies
MLars19Thanks
Farabi_AlteraRegular Contributor
Hello,
Unfortunately, you cannot make DO_KEY_SECURE non-optional in the generated .jam file itself. The switch must always be explicitly passed at the command line.
Here's the background:
When programming the design security key with a .jam file that has been converted from an Encryption Key Programming file (.ekp) that contains the tamper-protection bit programming instruction, you must add the switch -eDO_KEY_SECURE to your programming command if programming of the tamper-protection bit is desired. How do I enable programming of the tamper-protection bit when programming with a .jam file which has been converted from an an .ekp file that contains the tamper-protection bit programming instruction?
The reason this is intentionally kept as an opt-in switch rather than a default is critical to understand:
The tamper-protection bit is one-time programmable and is irreversible. How do I enable programming of the tamper-protection bit when programming with a .jam file which has been converted from an an .ekp file that contains the tamper-protection bit programming instruction?
Enabling the tamper protection bit disables the test mode in Cyclone V devices and disables programming through the JTAG interface. This process is irreversible and prevents Altera from carrying out failure analysis. Cyclone V Device Handbook Volume 1: Device Interfaces and Integration
Because of that irreversibility, the tool deliberately requires an explicit opt-in — it's a safeguard against accidentally burning the tamper bit during routine key programming operations. There is no supported mechanism to change the .jam file itself so that DO_KEY_SECURE executes by default.
The resolution is simply to add the switch -eDO_KEY_SECURE to your programming command whenever tamper-protection bit programming is desired. How do I enable programming of the tamper-protection bit when programming with a .jam file which has been converted from an an .ekp file that contains the tamper-protection bit programming instruction?
So your command line is exactly right:
quartus_jli -c keys.jam -eDO_KEY_SECURE -aA couple of additional things worth keeping in mind for your AS-scheme deployment:
After you set the tamper protection bit, the Cyclone V device can only accept configuration files encrypted with the same key. Additionally, programming through the JTAG interface and configuration interface is blocked. Cyclone V Device Handbook Volume 1: Device Interfaces and Integration
The device must be configured using an encrypted bitstream over PS, AS, or FPP configuration modes — configuration over JTAG is disabled when the tamper-protection bit is enabled. Can I use SignalTap II Logic Analyzer in Stratix V, Arria V or Cyclone V series devices which have the design security key programmed and the tamper-protection bit set? Since you're on AS, that's fine, but make sure your AS flash holds the encrypted bitstream before you burn the tamper bit.
My recommendation: wrap the `quartus_jli` call with the `-eDO_KEY_SECURE` flag inside a controlled production script with explicit confirmation prompts, so the irreversible step is never triggered accidentally. That's the standard approach for production key programming flows.
