ASYMMETRIC KEY WRAPPING USING A SYMMETRIC CIPHER

• US 20090034741A1
• Filed: 07/31/2007
• Published: 02/05/2009
• Est. Priority Date: 07/31/2007
• Status: Active Grant

• Current Assignee: Avago Technologies International Sales Pte Limited (Broadcom, Inc.)
• Original Assignee: Avago Technologies General IP PTE Limited (Broadcom, Inc.)
• Inventors: Sabev, Anton I.
• Granted Patent: US 8,681,996 B2
• Time in Patent Office: Days
• US Class Current: 380/279
• CPC Class Codes: H04L 2209/12 Details relating to cryptographic hardware or logic circuitry
• CPC Class Codes: H04L 2209/26 Testing cryptographic entity, e.g. testing integrity of encryption key or encryption algorithm
• CPC Class Codes: H04L 9/0822 using key encryption key
• CPC Class Codes: H04L 9/0825 using asymmetric-key encryption or public key infrastructure [PKI], e.g. key signature or public key certificates
• CPC Class Codes: H04L 9/0894 Escrow, recovery or storing of secret information, e.g. secret key escrow or cryptographic key storage

Abstract

A method of asymmetric key wrapping in a system is disclosed. The method generally includes the steps of (A) transferring a shared key from a key storage to a cipher operation, wherein the cipher operation comprises a symmetric-key cipher utilizing a cipher key, (B) generating an encrypted key by encrypting a decrypted key with the cipher operation using the shared key as the cipher key in a wrap-encrypt mode and (C) presenting the encrypted key external to the system in the wrap-encrypt mode.

Claims

1. A method of asymmetric key wrapping in a system, comprising the steps of:

(A) transferring a shared key from a key storage to a cipher operation, wherein said cipher operation comprises a symmetric-key cipher utilizing a cipher key;

(B) generating an encrypted key by encrypting a decrypted key with said cipher operation using said shared key as said cipher key in a wrap-encrypt mode; and

(C) presenting said encrypted key external to said system in said wrap-encrypt mode.

2. The method according to claim 1, further comprising the steps of:

generating said decrypted key by decrypting said encrypted key with said cipher operation using said shared key as said cipher key in a wrap-decrypt mode; and

transferring said decrypted key to said key register in said wrap-decrypt mode, wherein said key register is unreadable from external to said system.

3. The method according to claim 2, further comprising the step of:

transferring said decrypted key from said key register to said cipher operation as said cipher key.

4. The method according to claim 3, further comprising the step of:

generated a ciphertext by encrypting a plaintext with said cipher operation in a normal-encrypt mode.

5. The method according to claim 4, further comprising the step of:

generating said plaintext by decrypting said ciphertext with said cipher operation in a normal-decrypt mode.

6. The method according to claim 1, wherein said shared key is common to a plurality of said systems.

7. The method according to claim 6, further comprising the step of:

transferring a unique key from said key storage to said cipher operation as said cipher key, wherein said unique key is different in each of said systems.

8. A method of asymmetric key wrapping in a system, comprising the steps of:

(A) transferring a shared key from a key storage to a cipher operation, wherein said cipher operation comprises a symmetric-key cipher utilizing a cipher key;

(B) generating a decoded key by decoding an encrypted key with said cipher operation using said shared key as said cipher key in a wrap-decrypt mode; and

(C) transferring said decoded key from said cipher operation to a key register in said wrap-decrypt mode, wherein said key register is unreadable from external to said system.

9. The method according to claim 8, further comprising the steps of:

generating said encrypted key by encrypting said decrypted key with said cipher operation using said shared key as said cipher key in a wrap-encrypt mode; and

presenting said encrypted key external to said system in said wrap-encrypt mode.

10. The method according to claim 9, further comprising the step of:

transferring said decrypted key from said key register to said cipher operation as said cipher key.

11. The method according to claim 10, further comprising the step of:

generated a ciphertext by encrypting a plaintext with said cipher operation in a normal-encrypt mode.

12. The method according to claim 11, further comprising the step of:

generating said plaintext by decrypting said ciphertext with said cipher operation in a normal-decrypt mode.

13. The method according to claim 8, wherein said shared key is common to a plurality of said systems.

14. The method according to claim 13, further comprising the step of:

transferring a unique key from said key storage to said cipher operation as said cipher key, wherein said unique key is different in each of said systems.

15. A system comprising:

a cipher circuit configured to generate(i) an encrypted key by encrypting a decrypted key in a wrap-encrypt mode and (ii) said decrypted key by decrypting said encrypted key in a wrap-decrypt mode, wherein said cipher circuit performs a symmetric-key cipher utilizing a cipher key;

a key storage configured to store a shared key;

a key register configured to store said decrypted key, wherein said key register is unreadable from external to said system; and

a switching circuit configured to transfer (i) said shared key from said key storage to said cipher circuit as said cipher key, (ii) said encrypted key from said cipher circuit to an external port of said system in said wrap-encrypt mode and (iii) said decrypted key to said key register in said wrap-decrypt mode.

16. The system according to claim 15, wherein said shared key is common to a plurality of said systems.

17. The system according to claim 16, wherein said key storage is further configured to store a unique key, wherein said unique key is different in each of said systems.

18. The system according to claim 17, wherein said key storage is further configured to store a programmable key writable into said key storage from external to said system.

19. The system according to claim 18, wherein said key storage comprises a logic circuit configured to exclusively OR said programmable key with a selective one of (i) said shared key and (ii) said unique key.

20. The system according to claim 15, wherein said key register is writable from external to said system.