BINDING OF CRYPTOGRAPHIC OPERATIONS TO CONTEXT OR SPECULATIVE EXECUTION RESTRICTIONS

• US 20200134234A1
• Filed: 12/20/2019
• Published: 04/30/2020
• Est. Priority Date: 12/20/2019
• Status: Active Grant

• Current Assignee: Intel Corporation
• Original Assignee: Intel Corporation
• Inventors: LeMay, Michael, Durham, David M., Brandt, Jason W.
• Granted Patent: US 11,250,165 B2
• Time in Patent Office: Days
• CPC Class Codes: G06F 21/602 Providing cryptographic facilities or services
• CPC Class Codes: G06F 21/72 in cryptographic circuits
• CPC Class Codes: H04L 9/0631 Substitution permutation network [SPN], i.e. cipher composed of a number of stages or rounds each involving linear and nonlinear transformations, e.g. AES algorithms
• CPC Class Codes: H04L 9/0822 using key encryption key
• CPC Class Codes: H04L 9/0894 Escrow, recovery or storing of secret information, e.g. secret key escrow or cryptographic key storage

Abstract

A processor comprising a first register to store a wrapping key, a second register to store a pointer to a handle stored in a memory coupled to the processor, the handle comprising a cryptographic key encrypted using the wrapping key, and a core to execute a decryption instruction. The core is to, responsive to the decryption instruction, identify, in the decryption instruction, a pointer to ciphertext stored in the memory, retrieve the ciphertext and the handle from the memory, decrypt the cryptographic key of the handle based on the wrapping key, and decrypt the ciphertext based on the decrypted cryptographic key.

Claims

1. A processor comprising:

a first register to store a wrapping key;

a second register to store a pointer to a handle stored in a memory coupled to the processor, the handle comprising a cryptographic key encrypted using the wrapping key; and

a core to execute a decryption instruction, wherein the core comprises circuitry to, responsive to the decryption instruction;

identify, in the decryption instruction, a pointer to ciphertext stored in the memory;

retrieve the ciphertext and the handle from the memory;

decrypt the cryptographic key of the handle based on the wrapping key; and

decrypt the ciphertext based on the decrypted cryptographic key.

2. The processor of claim 1, wherein the core is to determine whether the decryption instruction is authorized to decrypt the ciphertext prior to decrypting the ciphertext.

3. The processor of claim 2, wherein the core is to determine whether the decryption instruction is authorized to decrypt the ciphertext based on a value of a bit included in the pointer to the ciphertext.

4. The processor of claim 3, wherein the processor is to set the bit included in the pointer to the ciphertext responsive to a memory allocation instruction.

5. The processor of claim 3, wherein the core is configured to execute a second decryption instruction, wherein the core is to, responsive to the second decryption instruction:

identify, in the second decryption instruction, a pointer to data stored in the memory;

determine that a bit included in the pointer to data stored in the memory is not set, wherein the bit included in the pointer to data stored in the memory has the same position as the bit included in the pointer to the ciphertext of the decryption instruction; and

pass data from the memory to a third register without decrypting data responsive to the determination.

6. The processor of claim 1, wherein the processor is configured to retrieve the pointer to the handle from the second register responsive to the decryption instruction and the decryption instruction does not include a parameter that explicitly references the second register.

7. The processor of claim 1, wherein the core is further to determine, in response to the decryption instruction, whether speculative execution restrictions are active prior to decrypting the ciphertext based on the decrypted cryptographic key.

8. The processor of claim 1, wherein the core is to decrypt the ciphertext further based on a tweak comprising context information associated with the decryption instruction.

9. The processor of claim 8, wherein the context information is derived from the pointer to ciphertext.

10. The processor of claim 8, wherein the context information is included in an immediate operand of the decryption instruction.

11. The processor of claim 8, wherein the context information is stored in a third register of the processor and the third register is specified in the decryption instruction.

12. The processor of claim 8, wherein the context information comprises a cryptographic context identifier defining an access scope to the pointer to ciphertext for a tenant that issued the decryption instruction.

13. The processor of claim 12, wherein the cryptographic context identifier is selected from a plurality of cryptographic context identifiers associated with the tenant, wherein the selection is based on a cryptographic context index included within the pointer to ciphertext or otherwise associated with the decryption instruction.

14. The processor of claim 12, wherein the cryptographic context identifier is decrypted using the wrapping key prior to being used in the tweak.

15. The processor of claim 1, further comprising one or more of a battery communicatively coupled to the processor, a display communicatively coupled to the processor, or a network interface communicatively coupled to the processor.

16. A method comprising:

storing a wrapping key in a first register of a processor;

storing, in a second register of the processor, a pointer to a handle stored in a memory coupled to the processor, the handle comprising a cryptographic key encrypted using the wrapping key; and

executing, by a core of the processor, a decryption instruction, the execution comprising;

identifying, in the decryption instruction, a pointer to ciphertext stored in the memory;

retrieving the ciphertext and the handle from the memory;

decrypting the cryptographic key of the handle based on the wrapping key; and

decrypting the ciphertext based on the decrypted cryptographic key.

17. The method of claim 16, further comprising, determining whether the decryption instruction is authorized to decrypt the ciphertext prior to decrypting the ciphertext.

18. The method of claim 17, further comprising determining whether the decryption instruction is authorized to decrypt the ciphertext based on a value of a bit included in the pointer to the ciphertext.

19. One or more non-transitory computer-readable media with code stored thereon, wherein the code is executable to cause a machine to:

store a wrapping key in a first register;

store, in a second register, a pointer to a handle stored in a memory, the handle comprising a cryptographic key encrypted using the wrapping key; and

execute a decryption instruction, the execution comprising;

identifying, in the decryption instruction, a pointer to ciphertext stored in the memory;

retrieving the ciphertext and the handle from the memory;

decrypting the cryptographic key of the handle based on the wrapping key; and

decrypting the ciphertext based on the decrypted cryptographic key.

20. The one or more computer-readable media of claim 19, wherein the code is executable to cause the machine further to determine whether the decryption instruction is authorized to decrypt the ciphertext prior to decrypting the ciphertext.