FPGA configuration bitstream encryption using modified key

A method of decrypting a configuration bitstream comprising:

• receiving, at a first time, a first key using an integrated circuit;
• performing a function on the first key a first number of times to generate a second key;
• using the second key to set a first number of non-volatile memory locations wherein the first number of non-volatile memory locations configure a decoder circuit;
• receiving, at a second time, the first key using the integrated circuit;
• decoding the first key using the configured decoder circuit to generate a third key;
• performing the function on the third key the first number of times to generate a fourth key;
• storing the fourth key in a second number of non-volatile memory locations;
• and
• decrypting the configuration bitstream using a fifth key derived from the fourth key.

An integrated circuit that decrypts a configuration bitstream that configures the integrated circuit, the integrated circuit comprising:

• an input for receiving a first key;
• a first circuit that performs a function on the first key a first number of times to generate a second key and that stores the second key in a memory;
• a second circuit that, at power up of the integrated circuit, retrieves the second key from the memory and that performs the function on the second key a second number of times to generate a third key, wherein the third key is different from the first key;
• and
• a decryption circuit that uses the third key to decrypt the configuration bitstream.

An integrated circuit that decrypts a configuration bitstream that configures the integrated circuit, the integrate circuit comprising:

• an input for receiving a first key a first time;
• a first circuit that performs a function on the first key a first number of times to generate a second key;
• a first number of non-volatile memory locations that are set using the second key;
• a decoding circuit that is configured by the first number of non-volatile memory locations and that decodes the first key using the configured decoder circuit to generate a third key;
• a second circuit that performs a function on the third key the first number of times to generate a fourth key;
• and
• a second number of non-volatile memory locations that store the fourth key;
• a decryption circuit that uses a fifth key, derived from the fourth key, to decrypt the configuration bitstream.