Abstract: An external storage device may transmit encrypted configuration data to a PLD during a configuration operation without transmitting the encryption key to the PLD and without retaining decryption information in the PLD. During a set-up operation, the encryption key is provided to the PLD, which generates an ID code upon power-up. The PLD generates a correction word in response to the encryption key and the ID code. The correction word is output from the PLD, which is powered-down, and is stored with the encrypted configuration data in the storage device. Then, during a configuration operation, the PLD is powered-on and re-generates the ID code. The correction word and the encrypted configuration data are transmitted to the PLD, which generates a decryption key in response to the re-generated ID code and the correction word.