A hardware secure module (HSMa) comprising a cryptographic coprocessor comprising: - a key storage memory for storing at least one cryptographic key (MK, CK), - a first interface configured to receive source data to be processed, - a hardware crypto engine configured to process said source data as a function of at least one cryptographic key (MK, CK) stored in said key storage memory, - a second interface configured to receive a first cryptographic key, and - a hardware key management circuit; characterized in that said cryptographic coprocessor comprises a third interface configured to receive a second cryptographic key, and wherein said hardware secure module (HSMa) comprises: - a processing unit, wherein said processing unit is a programmable processing unit having associated a non-volatile program memory adapted to store the firmware for said programmable processing unit, wherein said processing unit is configured to read said first cryptographic key from said non-volatile memory and send said first cryptographic key to said second interface; - a non-volatile memory adapted to store said second cryptographic key, wherein said non-volatile memory adapted to store said second cryptographic key is said non-volatile program memory, and wherein said second cryptographic key is stored in memory locations not accessible by said programmable processing unit; and - a hardware configuration module configured to read said second cryptographic key from said non-volatile memory and send said second cryptographic key to said third interface; wherein said hardware key management circuit is configured to: a) store said second cryptographic key in said key storage memory, b) provide said first cryptographic key to said hardware crypto engine in order to decrypt said first cryptographic key with said second cryptographic key stored in said key storage memory, and c) store said decrypted first cryptographic key in said key storage memory. - a key storage memory for storing at least one cryptographic key (MK, CK), - a first interface configured to receive source data to be processed, - a hardware crypto engine configured to process said source data as a function of at least one cryptographic key (MK, CK) stored in said key storage memory, - a second interface configured to receive a first cryptographic key, and - a hardware key management circuit; - a processing unit, wherein said processing unit is a programmable processing unit having associated a non-volatile program memory adapted to store the firmware for said programmable processing unit, wherein said processing unit is configured to read said first cryptographic key from said non-volatile memory and send said first cryptographic key to said second interface; - a non-volatile memory adapted to store said second cryptographic key, wherein said non-volatile memory adapted to store said second cryptographic key is said non-volatile program memory, and wherein said second cryptographic key is stored in memory locations not accessible by said programmable processing unit; and - a hardware configuration module configured to read said second cryptographic key from said non-volatile memory and send said second cryptographic key to said third interface; a) store said second cryptographic key in said key storage memory, b) provide said first cryptographic key to said hardware crypto engine in order to decrypt said first cryptographic key with said second cryptographic key stored in said key storage memory, and c) store said decrypted first cryptographic key in said key storage memory.