Scan techniques are almost mandatorily adopted in designing current System-on-a-Chip (SoC) to enhance testability, but inadvertently secret keys can be stolen through the scan test channels of crypto SoCs. An efficient scan design technique is proposed in this paper to protect the secret key of an Advanced Encryption Standard (AES) core embedded in an SoC. A new instruction is added to IEEE 1149.1 boundary scan to use a fake key instead of user key, in which the fake key is chosen with meticulous care to improve the testability as well. Our approach can be implemented as user defined logic with conventional boundary scan design, hence no modification is necessary to any crypto IP core. Conformance to the IEEE 1149.1 standards is completely preserved while yielding better performance of area, power, and fault coverage with highly robust protection of the secret user key.