System, method, and device of authenticated encryption of messages

• US 10,454,674 B1
• Filed: 06/01/2015
• Issued: 10/22/2019
• Est. Priority Date: 11/16/2009
• Status: Active Grant

• Current Assignee: Arm Limited (SoftBank Group Corp.)
• Original Assignee: Arm Limited (SoftBank Group Corp.)
• Inventors: Bar-El, Hagai, Klimov, Alexander
• Primary Examiner(s): Lesniewski, Victor
• Application Number:
  US14/726,618
• Time in Patent Office: 1,604 Days
• CPC Class Codes: H04L 2209/24 Key scheduling, i.e. generating round keys or sub-keys for block encryption
• CPC Class Codes: H04L 2209/72 Signcrypting, i.e. digital signing and encrypting simultaneously
• CPC Class Codes: H04L 63/0428 wherein the data content is protected, e.g. by encrypting or encapsulating the payload
• CPC Class Codes: H04L 63/0435 wherein the sending and receiving network entities apply symmetric encryption, i.e. same key used for encryption and decryption cryptographic mechanisms or cryptographic arrangements for symmetric key encryption H04L9/06
• CPC Class Codes: H04L 63/067 using one-time keys cryptographic mechanisms or cryptographic arrangements for generation of one-time passwords H04L9/0863
• CPC Class Codes: H04L 63/123 received data contents, e.g. message integrity
• CPC Class Codes: H04L 9/0637 Modes of operation, e.g. cipher block chaining [CBC], electronic codebook [ECB] or Galois/counter mode [GCM]
• CPC Class Codes: H04L 9/0656 Pseudorandom key sequence combined element-for-element with data sequence, e.g. one-time-pad [OTP] or Vernam's cipher
• CPC Class Codes: H04L 9/0861 Generation of secret information including derivation or calculation of cryptographic keys or passwords
• CPC Class Codes: H04L 9/0869 involving random numbers or seeds
• CPC Class Codes: H04L 9/088 Usage controlling of secret information, e.g. techniques for restricting cryptographic keys to pre-authorized uses, different access levels, validity of crypto-period, different key- or password length, or different strong and weak cryptographic algorithms network architectures or network communication protocols for using time-dependent keys in a packet data network H04L63/068
• CPC Class Codes: H04L 9/14 using a plurality of keys or algorithms
• CPC Class Codes: H04L 9/3242 involving keyed hash functions, e.g. message authentication codes [MACs], CBC-MAC or HMAC

Abstract

System, device, and method of authenticated encryption of messages. A message intended for authenticated encryption is stored; and a secret authentication key and a secret encryption key are stored. A key-stream set of blocks is generated, each block including pseudo-random bits. The aggregate length of the key-stream is equal to or greater than the message-length of the message. Each block of the key-stream is generated by a deterministic pseudo-random number generator function that is instantiated with the secret encryption key. The key-stream is generated on a block-by-block basis, until the key-stream reaches in aggregate the message-length of the message. Each block of bits of the message is encrypted, on a per-block basis, with a corresponding block from the key-stream. Authentication is performed on the result of the encrypting operation, or on the message, by applying a keyed cryptographic checksum function that ascertains integrity and that utilizes the secret authentication key.

Claims

1. A method comprising:

(a) receiving at an electronic device an encrypted message that comprises;

(i) a payload encrypted with a secret one-time key; and

(ii) an outer integrity protection layer comprising a keyed cryptographic checksum generated by utilizing a secret key;

wherein said encrypted message is part of a group of encrypted messages that are intended for decryption;

wherein said encrypted message has a message-identifier;

wherein a secret cryptographic key is stored only in (I) said electronic device and in (II) an authorized server apparatus which sends said encrypted message to said electronic device;

wherein said secret cryptographic key comprises at least three concatenated sub-keys;

wherein a first sub-key of said secret cryptographic key is utilized by said authorized server for authenticated encryption of provisioning-messages that provision digital assets to said electronic device,

wherein a second sub-key of said secret cryptographic key is utilized by said authorized server for authenticated encryption of query-messages that query said electronic device,

wherein the third sub-key of said secret cryptographic key is utilized by said electronic device as an outer integrity protection layer to verify integrity of an encrypted message received at said electronic device without firstly decrypting the payload of said message;

(b) checking the keyed cryptographic checksum of the outer integrity protection layer of the message, against said third sub-key that is securely stored within said electronic device;

(c) if the checking result is negative, then;

(i) aborting decryption of the payload of said message, and (ii) aborting cryptographic verification of said message; and

(iii) avoiding utilization of a secret one-time key generated by said electronic device for decrypting said payload;

(d) if the checking result is positive, then;

utilizing a one-time key generated by said electronic device, for decrypting said payload;

wherein the method comprises;

protecting said recipient device from incoming fake messages, by checking at the recipient device, prior to attempting to decrypt a particular message, that an index number of said particular message is not a same index number of any other message that was received for decryption at said recipient device.

2. The method of claim 1, wherein in step (c), the method further comprises:

if the checking result is negative, then;

aborting any further cryptographic processing of said message.

3. The method of claim 1, wherein in step (d), the method further comprises:

if the checking result is positive, then;

recording within a storage of said electronic device, an indication that said one-time key is discarded and cannot be re-used for subsequent cryptographic operations by said electronic device.

4. The method of claim 1, wherein the receiving of step (a) comprises:

receiving at the electronic device an encrypted message that comprises;

(i) a payload encrypted with a secret one-time key; and

(ii) an outer integrity protection layer comprising a keyed cryptographic checksum generated by utilizing a secret non-one-time key;

wherein the checking of step (b) comprises;

checking the keyed cryptographic checksum of the outer integrity protection layer of the message, against a non-one-time key that is generated by said electronic device.