Protecting FPGA Configuration?

It depends on what you want to protect and why. If you just want to prevent people from copying your design or reverse-engineer it, it may not be necessary to encrypt the configuration. AFAIK it isn't possible (or must be very hard) to reconstruct a full HDL design from the EPCS stream. It may be enough to use the challenge-response chip at run time, using a special HDL component that interrogates that chip and enables the rest of the FPGA only if it gets the correct answer. If the key is stored in FPGA registers and not in a memory block it will be very hard to extract from the EPCS stream.