A hardware secure module (HSMa) comprising a cryptographic coprocessor comprising: - a key storage memory for storing at least one cryptographic key (MK, CK), - a first interface configured to receive source data (SD) to be processed, - a hardware crypto engine configured to process said source data (SD) as a function of at least one cryptographic key (MK, CK) stored in said key storage memory , - a second interface configured to receive a first cryptographic key (CK), and - a hardware key management circuit ; characterized in that said cryptographic coprocessor comprises a third interface configured to receive a second cryptographic key (MK), and wherein said hardware secure module (HSMa) comprises: - a processing unit , wherein said processing unit is a programmable processing unit having associated a non-volatile program memory adapted to store the firmware for said programmable processing unit , wherein said processing unit is configured to read said first cryptographic key (CK) from said non-volatile memory and send said first cryptographic key (CK) to said second interface ; - a non-volatile memory adapted to store said second cryptographic key (MK), wherein said non-volatile memory adapted to store said second cryptographic key (MK) is said non-volatile program memory, and wherein said second cryptographic key (MK) is stored in memory locations not accessible by said programmable processing unit ; and - a hardware configuration module configured to read said second cryptographic key (MK) from said non-volatile memory and send said second cryptographic key (MK) to said third interface ; wherein said hardware key management circuit is configured to: a) store said second cryptographic key (MK) in said key storage memory , b) provide said first cryptographic key (CK) to said hardware crypto engine in order to decrypt said first cryptographic key (CK) with said second cryptographic key (MK) stored in said key storage memory , and c) store said decrypted first cryptographic key (CK) in said key storage memory . - a key storage memory for storing at least one cryptographic key (MK, CK), - a first interface configured to receive source data (SD) to be processed, - a hardware crypto engine configured to process said source data (SD) as a function of at least one cryptographic key (MK, CK) stored in said key storage memory , - a second interface configured to receive a first cryptographic key (CK), and - a hardware key management circuit ; - a processing unit , wherein said processing unit is a programmable processing unit having associated a non-volatile program memory adapted to store the firmware for said programmable processing unit , wherein said processing unit is configured to read said first cryptographic key (CK) from said non-volatile memory and send said first cryptographic key (CK) to said second interface ; - a non-volatile memory adapted to store said second cryptographic key (MK), wherein said non-volatile memory adapted to store said second cryptographic key (MK) is said non-volatile program memory, and wherein said second cryptographic key (MK) is stored in memory locations not accessible by said programmable processing unit ; and - a hardware configuration module configured to read said second cryptographic key (MK) from said non-volatile memory and send said second cryptographic key (MK) to said third interface ; a) store said second cryptographic key (MK) in said key storage memory , b) provide said first cryptographic key (CK) to said hardware crypto engine in order to decrypt said first cryptographic key (CK) with said second cryptographic key (MK) stored in said key storage memory , and c) store said decrypted first cryptographic key (CK) in said key storage memory . <EOS>