Method and devices for storing a security key using programmable fuses

1. A programmable logic device (PLD) comprising:

a configuration memory adapted to be programmed with configuration data;

a plurality of programmable fuses adapted to store a security key for use with configuration data, the security key comprising a plurality of data bit values, wherein each data bit value of the security key is associated with a subset of a least three fuses each storing a bit;

a plurality of decoders, each decoder adapted to retrieve a data bit value of the security key by providing the bit value stored by a majority of the fuses of the associated subset as the data bit value of the security key; and

a decryption engine adapted to decrypt configuration data for the configuration memory using the retrieved security key.

2. The PLD of claim 1 , wherein the fuses are one-time-programmable (OTP) fuses.

3. The PLD of claim 1 , wherein the security key is not discernable by visual inspection of the fuses.

4. The PLD of claim 1 including a hash circuit adapted to hash the retrieved security key to obtain a hashed version of the retrieved security key.

5. The PLD of claim 1 including:

a data port adapted to receive the security key from a device external to the PLD; and

a hash circuit adapted to hash the received security key to obtain a hashed version of the received security key, wherein the hashed version of the received security key is used to program the fuses.

6. The PLD of claim 1 including a key lock circuit adapted to prevent read back of the fuses to a device external to the PLD.

7. The PLD of claim 6 , wherein the key lock circuit includes a key lock register and a key lock fuse.

8. The PLD of claim 1 , wherein the fuses comprise:

a plurality of test fuses;

a plurality of key fuses; and

a plurality of redundant fuses,

wherein the associated subset of fuses includes a test fuse, a key fuse, and a redundant fuse.

9. The PLD of claim 1 , wherein the fuses within the subset are physically located in close proximity to each other within the PLD.

10. The PLD of claim 1 , wherein the configuration memory is volatile memory.

11. A programmable logic device (PLD) comprising:

a configuration memory adapted to be programmed with configuration data;

a plurality of programmable fuses adapted to store a security key for use with configuration data, the security key comprising a plurality of data bit values, wherein each data bit value of the security key is associated with a subset of a least three fuses each storing a bit;

means for retrieving the stored security key by decoding the bits stored in each associated subset of fuses to provide the bit value stored by a majority of the fuses as a data bit value of the security key; and

means for decrypting configuration data for the configuration memory using the retrieved security key.

12. A method of decrypting an encrypted configuration data bitstream for a programmable logic device, the method comprising:

providing a plurality of programmable fuses that stores a security key comprising a plurality of data bit values, wherein each data bit value is associated with a respective subset of a least three fuses each storing a bit;

retrieving the stored security key by decoding the bits stored in each associated subset of fuses to provide the bit value stored by a majority of the fuses as a data bit value of the security key; and

decrypting the encrypted configuration data bitstream with the retrieved security key.