An active tamper detection circuit with bypass detection is provided. A bypass detection circuit is coupled to an active mesh loop. The bypass detector includes a voltage comparator with a variable hysteresis control circuit and a calibration engine. The bypass detector detects a change in impedance in the mesh when an attacker attempts to bypass the active loop using a wire. As part of a boot-up sequence, the calibration engine runs a hysteresis sweep on the voltage comparator and stores a hysteresis sweep boot-up signature. When bypass protection is enabled, the bypass detector runs a hysteresis sweep of the voltage comparator periodically at a predetermined interval. Each sweep generates a generated signature that is compared to the stored boot-up signature. Any signature mismatch will be signaled as an impedance mismatch, or tamper. The hysteresis step size is also programmable. The calibration engine can make small changes to the boot-up signature to allow for small voltage variations.

A method of secure key generation includes writing a predetermined write pattern to a particular address of volatile memory, wherein the volatile memory includes bit lines; reading data from the particular address while applying a first set of operating variables to the volatile memory, subsequent to the writing; sensing a first plurality of timing mismatches during the reading, wherein sense amplifiers are coupled to the bit lines, each latch of a plurality of latches is coupled between a respective pair of sense amplifiers, and each latch is configured to output a data value that indicates a respective timing mismatch between outputs of the respective pair of sense amplifiers; and determining an entropy ratio for the particular address, wherein the entropy ratio is equivalent to a ratio of a first number of latches that output a first data value to a second number of latches that output a second data value.

Methods and systems are disclosed for key management for on-the-fly hardware decryption within an integrated circuit. Encrypted information is received from an external memory and stored in an input buffer within the integrated circuit. The encrypted information includes one or more encrypted key blobs. The encrypted key blobs include one or more secret keys for encrypted code associated with one or more encrypted software images stored within the external memory. A key-encryption key (KEK) code for the encrypted key blobs is received from an internal data storage medium within the integrated circuit, and the KEK code is used to generate one or more key-encryption keys (KEKs). A decryption system then decrypts the encrypted key blobs using the KEKs to obtain the secret keys, and the decryption system decrypts the encrypted code using the secret keys. The resulting decrypted software code is then available for further processing.

A processing system includes a processor and a temperature security module coupled to provide a temperature tamper signal to the processor. The temperature security module includes a shelf mode trim value, an operating mode trim value, and a programmable temperature trim value. One of the programmable temperature trim value, the shelf mode trim value, and the operating mode trim value, is used based on a deployment mode of the processing system to set a temperature monitor trim value.