Systems And Methods For Debugging Cryptographic Modules

1 . An integrated circuit comprising:

a first cryptographic module that enables debugging of the first cryptographic module, wherein the first cryptographic module comprises a first logic block; and

a second cryptographic module that disables all debugging of the second cryptographic module, wherein the second cryptographic module comprises the first logic block.

2 . The integrated circuit of claim 1 , wherein the first cryptographic module further comprises a first persistent storage block in the integrated circuit, and wherein the second cryptographic module further comprises a second persistent storage block in the integrated circuit that is non-overlapping with the first persistent storage block.

3 . The integrated circuit of claim 1 , wherein the first cryptographic module further comprises a second logic block, and wherein the second cryptographic module further comprises the second logic block.

4 . The integrated circuit of claim 1 , wherein the first cryptographic module is implemented by a first firmware image, and wherein the second cryptographic module is implemented by a second firmware image.

5 . The integrated circuit of claim 1 , wherein the integrated circuit loads a firmware image for only one of the first cryptographic module or the second cryptographic module into the integrated circuit in response to a flag.

6 . The integrated circuit of claim 1 , wherein the first cryptographic module permits a user to debug the first logic block using a debug interface that is within a first logical boundary of the first cryptographic module, and wherein a second logical boundary of the second cryptographic module excludes the debug interface.

7 . The integrated circuit of claim 1 , wherein the first cryptographic module is compliant with Security Level 1 of Federal Information Processing Standards.

8 . The integrated circuit of claim 1 , wherein the second cryptographic module is compliant with Security Level 2 of Federal Information Processing Standards.

9 . The integrated circuit of claim 1 , wherein the integrated circuit is a configurable logic integrated circuit, and wherein the first logic block comprises configurable logic circuits.

10 . A method comprising:

loading in an electronic device a first firmware image of a first cryptographic module that allows debugging of the first cryptographic module in response to a flag having a first value; and

loading in the electronic device a second firmware image of a second cryptographic module that prevents debugging of the second cryptographic module in response to the flag having a second value.

11 . The method of claim 10 , wherein the first cryptographic module comprises a first functional block in the electronic device, and wherein the second cryptographic module comprises the first functional block.

12 . The method of claim 11 , wherein the first cryptographic module further comprises a second functional block in the electronic device, and wherein the second cryptographic module further comprises the second functional block.

13 . The method of claim 10 , wherein the first cryptographic module further comprises a first persistent storage block in the electronic device, and wherein the second cryptographic module further comprises a second persistent storage block in the electronic device.

14 . The method of claim 10 further comprising:

storing first sensitive security parameters in a first non-volatile storage block in the electronic device for the first cryptographic module if the first firmware image is loaded in the electronic device; and

storing second sensitive security parameters in a second non-volatile storage block in the electronic device for the second cryptographic module if the second firmware image is loaded in the electronic device.

15 . The method of claim 10 , wherein the second cryptographic module performs a same set of logical functions that are performed by the first cryptographic module.

16 . The method of claim 10 , wherein the first firmware image or the second firmware image is loaded in the electronic device only during boot of the electronic device.

17 . A non-transitory computer readable storage medium comprising computer readable instructions stored thereon for causing an integrated circuit to:

load a first firmware image for a first cryptographic module that permits a user of the integrated circuit to debug the first cryptographic module; and

load a second firmware image for a second cryptographic module that blocks the user from performing any debugging functions on the second cryptographic module, wherein a logical boundary of each of the first cryptographic module and the second cryptographic module comprises a functional block in the integrated circuit.

18 . The non-transitory computer readable storage medium of claim 17 , wherein the computer readable instructions further cause the integrated circuit to load only one of the first firmware image or the second firmware image that is selected based on a value of a flag.

19 . The non-transitory computer readable storage medium of claim 17 , wherein the first cryptographic module comprises first persistent memory in the integrated circuit, and wherein the second cryptographic module comprises second persistent memory in the integrated circuit that is non-overlapping with the first persistent memory.

20 . The non-transitory computer readable storage medium of claim 17 , wherein the first cryptographic module comprises a debug interface block.