Device and method for key strengthening

Abstract

A processor, configured to: generate an initial seed (L) according to a random number generator; derive a seed value (SEED) according to the initial seed (L) and a first key definition function; generate a key pair (K) according to the seed value (SEED) and a first key generation method; pub , K priv The key pair (K pub , K priv ) includes the public key (K pub ) and the private key (K priv ). According to the public key (K pub ) encrypts the initial seed to create an encrypted value (X). Construct a bundle (B), the bundle (B) including the encrypted value (X) and the public key (K pub A subsequent process or device may use the bundle (B) and the embedded encryption value (X) to verify the key pair (K pub , K priv ) is generated by an approved key generation method.

Description

Technical Field

[0001] Aspects of the disclosed embodiments relate generally to computer security and, more particularly, to verifying the strength of cryptographic keys. Background Art

[0002] The digital security of modern cryptographic systems is based on confidential, hard-to-guess binary values, called secret keys or cryptographic keys. Key generation usually requires applying a deterministic key generation method to one or more random values. The strength of the obtained key depends on the quality of the random number generator and the key generation method applied.

[0003] Industry standards such as Federal Information Processing Standard (FIPS) 186-4 provide clear guidelines on how keys should be generated. Failure to follow the approved guidelines can result in weak keys being generated. There are a variety of reasons for weak keys being generated.

[0004] Currently, there is no way to determine the strength of a given key, or to determine that a given key was generated using an approved key generation method. The device manufacturer or user must trust that the key generation was performed appropriately and that the resulting key is of sufficient strength.

[0005] Therefore, there is a need for improved methods and apparatus to prove that a key was generated using an approved or accepted key generation method and that appropriate entropy has been included in the random number generator.It is therefore desirable to provide methods and apparatus that address at least some of the problems discussed above. Summary of the invention

[0006] Various aspects of the disclosed embodiments are directed to proving that a key was generated using an approved or accepted key generation method and ensuring that appropriate additional entropy has been employed. This and other objects are achieved by the subject matter claimed in the independent claims. Other advantageous modifications are provided in the dependent claims.

[0007] According to a first aspect, the above and other objects and advantages are achieved by a computing device. In one embodiment, the computing device includes a memory, and the memory is coupled to a processor in a communication manner. The processor is used to: generate an initial seed (L) according to a random number generator; derive a seed value (SEED) according to the initial seed (L) and a first key definition function; generate a key pair (K) according to the seed value (SEED) and a first key generation method; pub , K priv ), the key pair (K pub , K priv ) includes the public key (K pub ) and the private key (K priv ); according to the public key (Kpub ) encrypts the initial seed to create an encrypted value (X); constructs a bundle (B), the bundle (B) including the encrypted value (X) and the public key (K pub A subsequent process or device may use the bundle (B) and the embedded encryption value (X) to verify the key pair (K pub , K priv ) is generated by an approved key generation method.

[0008] In a possible implementation of the computing device, the processor is configured to: priv ) generates a signature; combines the signature and the bundle (B) into a signature bundle (B S ). In the signature bundle (B S ) provides a means for verifying the signature contained in the signed bundle (B S ) and verify the integrity of the data in the signature bundle (B S ) has the corresponding private key (K priv ).

[0009] In a possible implementation of the computing device, the processor is configured to: S ) is configured as a certificate signing request (CSR). Using a standardized format such as the CSR format simplifies the processing of the information contained in the bundle.

[0010] In a possible implementation of the computing device, the processor is configured to: S ) is configured as one of a self-signed certificate and a certificate authority signed certificate. Using the self-signed certificate format simplifies the processing of the information contained in the signature bundle, and the certificate authority (CA) signed certificate improves security by utilizing a trusted third party to provide a signature.

[0011] In a possible implementation of the computing device, the processor is configured to: generate the seed value (SEED) further according to an additional seed (G). The additional seed (G) may contain information related to additional criteria such as an expiration time applied to the seed value (SEED).

[0012] In one possible implementation of the computing device, the processor is configured to obtain the additional seed (G) from a trusted entropy source, the additional seed (G) being available to the key detection device. Obtaining the additional seed in this way can improve the quality of the initial random value used for key generation. In addition, security is improved by including an additional entity during verification and revealing the additional seed during verification.

[0013] In one possible implementation of the device, the processor is used to obtain the additional seed (G) from a trusted entropy source, the additional seed (G) being publicly available for use in a key detection device. Including the additional seed (G) has advantages, such as providing a means for including additional entropy from a trusted or reliable server in the seed.

[0014] In a possible implementation of the computing device, the processor is configured to: secretly provide the additional seed (G) in the computing device. The secure provision helps to protect the confidentiality of the additional seed (G).

[0015] In one possible implementation of the computing device, the processor is configured to include information indicating the key generation method in the bundle (B). Including information about the key generation method in the bundle avoids providing an alternative channel to pass the information from the key generation device to the key verification device.

[0016] According to a second aspect, the above and other objects and advantages are achieved by a computing device. In one embodiment, the computing device includes a memory, the memory is communicatively coupled to a processor. The processor is configured to: receive a first private key (K priv1 ) and a bundle (B1), the bundle comprising an encrypted value (X) and a public key (K pub ), the first private key (K priv1 ) is generated according to the first key generation method; according to the first private key (K priv1 ) decrypts the encrypted value (X) to restore the decrypted initial seed (L'); derives a second seed value (SEED') according to the decrypted initial seed (L') and a second key definition function; generates a second private key (K') according to the second seed value (SEED') and a second key generation method priv ); By comparing the first private key (K priv1 ) and the second private key (K' priv ), verify the first key generation method. priv1 ) and the second private key (K' priv ) matches the first private key (K priv1) is generated using the first key generation method.

[0017] In one possible implementation of the computing device, the processor is configured to: receive an additional seed (G1); generate the second seed value based on the second initial seed (L'), the additional seed (G) and the key definition function. Including the additional seed in the key generation improves security and provides a means for adding additional functionality when verifying the obtained key. When the additional seed (G1) is provided, the above verification method can prove that the additional seed (G1) was used when generating the key. When it is known that the additional seed (G1) was generated by a trusted random number generator, the verifier can conclude that the SEED value based on the initial seed (L) and the additional seed (G) contains a suitable amount of entropy.

[0018] In one possible implementation of the computing device, the processor is configured to: record a plurality of decrypted initial seed values ​​(L'); and run an entropy measurement test on the recorded plurality of decrypted initial seed values. Running the test on the plurality of initial seed values ​​can detect problems with an entropy source used during random number generation.

[0019] According to a third aspect, the above and other objects and advantages are achieved by a method. In one embodiment, the method comprises: generating an initial seed (L) according to a random number generator; deriving a seed value (SEED) according to the initial seed (L) and a first key definition function; generating a key pair (K) according to the seed value (SEED) and a first key generation method; pub , K priv ), the key pair (K pub , K priv ) includes the public key (K pub ) and the private key (K priv ); according to the public key (K pub ) encrypts the initial seed to create an encrypted value (X); constructs a bundle (B), the bundle (B) including the encrypted value (X) and the public key (K pub The obtained bundle (B) provides the necessary information to subsequently verify the private key (K priv ) is generated according to an approved key generation method.

[0020] In a possible implementation of the method, the method further includes: according to the bundle (B) and the private key (K priv ) generates a signature; combines the signature and the bundle (B) into a signature bundle (B S ). In the signature bundle (B S) provides a means for verifying the signature contained in the signed bundle (B S ) in terms of data integrity.

[0021] In one possible implementation of the method, the bundle (B) includes information indicating the key generation method. Including information about the key generation method in the bundle avoids providing an alternative channel to pass this information from the key generation device to the key verification device.

[0022] In a possible implementation of the method, the method further includes: receiving the private key (K priv ) and the bundle (B); according to the private key (K priv ) decrypts the encrypted value (X) to restore the decrypted initial seed (L'); derives a second seed value (SEED') according to the decrypted initial seed (L') and a second key definition function; generates a second private key (K') according to the second seed value (SEED') and a second key generation method priv ); By comparing the received private key (K priv ) and the second private key (K' priv ), verify the first key generation method. priv1 ) and the second private key (K' priv ) matches the first private key (K priv1 ) is generated using the first key generation method.

[0023] These and other aspects, implementations and advantages of the exemplary embodiments will become apparent from the embodiments described herein when considered in conjunction with the accompanying drawings. It should be understood, however, that such description and drawings are for illustrative purposes only and are not intended to limit the disclosed invention; any limitations of the invention should be understood by reference to the appended claims. Additional aspects and advantages of the invention will be set forth in the subsequent description, and some aspects and advantages will be apparent from the description or may be learned by practicing the invention. In addition, aspects and advantages of the invention may be realized and obtained by the means or combinations particularly indicated in the appended claims. BRIEF DESCRIPTION OF THE DRAWINGS

[0024] In the following detailed description of the present invention, the present invention will be explained in detail with reference to exemplary embodiments shown in the accompanying drawings, in which:

[0025] Figure 1 A schematic block diagram illustrating an exemplary computing device incorporating aspects of the disclosed embodiments is shown;

[0026] Figure 2A schematic block diagram illustrating an exemplary computing device incorporating aspects of the disclosed embodiments is shown;

[0027] Figure 3 A flow chart 300 of an exemplary key generation and key verification process incorporating aspects of the disclosed embodiments is shown. DETAILED DESCRIPTION

[0028] Figure 1 A schematic block diagram of an exemplary apparatus 100 provided by aspects of the disclosed embodiments is shown. Aspects of the disclosed embodiments are directed to proving that cryptographic keys were generated using an accepted key generation method and, if needed, proving that additional entropy from a trusted server was used during base random number generation.

[0029] like Figure 1 As shown, computing device 100 includes memory 152 that is communicatively coupled to processor 150. Figure 1 Only one memory 152 is shown, but it should be understood that the memory 152 may include one or more memory blocks or modules. The memory 152 may be a combination of various types of volatile and non-volatile computer memory, such as read only memory (ROM), random access memory (RAM), magnetic or optical disk, flash memory, or other suitable types of computer memory.

[0030] The processor 150 may be any suitable type of computer processing device. For example, the processor 150 may be a single processing device, or may include multiple processing devices, including dedicated devices, such as digital signal processing (DSP) devices, microprocessors, dedicated processing devices, parallel processing cores, or general-purpose computer processors. In some embodiments, the processor 150 and the memory 152 may be included in a system on a chip (SoC) device or chipset. The processor 150 is used to read non-transient program instructions from the memory 152 and execute any method and process described herein. The processor 150 may also include a CPU that works in conjunction with a graphics processing unit (GPU), and the GPU may include a DSP or other dedicated graphics processing hardware.

[0031] In one embodiment, the processor 150 is used to generate an initial seed (L) according to the random number generator 102, and the initial seed can be a random binary value. Advantageously, any suitable type of random number generator 102 can be used, such as a hardware-based random number generator and a pseudo-random number generator. The random number generator 102 is used to generate a true random number sequence or a suitable apparent random number sequence. As required, the initial seed (L) can be a suitable large random binary value or number.

[0032] The processor 150 is configured to derive a seed value (SEED) based on the initial seed (L) and the first key definition function 104. The first key definition function 104 may be any desired key definition function (KDF) configured to deterministically derive a desired seed value (SEED) from an initial value such as the initial seed (L).

[0033] Then, the processor 150 generates an asymmetric key pair (K pub , K priv ), the key pair (K pub , K priv ) includes the public key (K pub ) and the private key (K priv The first key generation method 106 may be an accepted and / or approved key generation method, such as the key generation method described in the Federal Information Processing Standard (FIPS) 186-4, which provides clear guidelines on how keys should be generated. pub , K priv ) can be any desired type of asymmetric encryption key pair, such as a key pair based on the Rivest-Shamir-Adleman (RSA) encryption system, an elliptic curve cryptography (ECC) system, or other desired asymmetric encryption system.

[0034] Then, the processor 150 constructs a bundle (B) in the following manner: pub ) encrypts the initial seed (L) (108) to create an encrypted value (X); generates the bundle (B), the bundle (B) including the encrypted value (X) and the public key (K pubTo aid understanding, it may be helpful to consider the bundle (B) as a verification bundle that includes the necessary information to verify or prove the key pair (K pub , K priv ) is generated using an accepted key generation method. Encryption (108) is performed according to the encryption system corresponding to the first key generation method 106, wherein the public key (K pub ) is used to encrypt the initial seed (L) to create the encrypted initial seed value (X). pub ) encrypts the initial seed (L) to ensure that the initial seed (L) can only be used by a user who has access to the corresponding private key (K priv ) entity recovery.

[0035] As will be discussed further below, the bundle (B) may be used to certify the key pair (K pub , K priv ) is generated according to the approved key generation method and has not been weakened or otherwise attacked.

[0036] In one embodiment of the computing device 100, the processor 150 is configured to: priv ) generates a signature 110; combines the signature and the bundle (B) into a signature bundle (B S The signature 110 can verify the integrity of the bundle, thereby providing additional assurance that the information in the bundle (B) has not been tampered with or altered. The signature 110 also proves that the person who created the signed bundle (B) S ) owns the private key (K priv ).

[0037] In some embodiments, it may be advantageous to configure the signature bundle according to an established format such as a certificate signing request (CSR) or a self-signed digital certificate that conforms to the well-known X.509 public key certificate format. S ). Although the bundle is a new type of bundle, the use of a standardized data format to carry the new type of information bundle can simplify the development of computer software for processing the new type of information bundle (B) by incorporating third-party software libraries rather than developing a completely new software program.

[0038] Alternatively, the bundle (B) or the signed bundle (B S) is provided to a trusted certificate authority for inclusion in an X.509 or other desired digital certificate. The signature can be verified based on the public key of the trusted certificate authority. Using a trusted certificate authority provides an additional level of assurance that the information in the bundle (B) has not been altered.

[0039] In one embodiment, the processor 150 is configured to generate the seed value (SEED) based on the initial seed (L), the additional seed (G) and the random number generator 102. The additional seed can be any desired value, such as a publicly available value and a securely provided value. The additional seed (G) can be obtained from a trusted entropy source and can be publicly available for key detection devices. Including the additional seed (G) has advantages, such as providing a method for including additional entropy from a trusted or reliable server in the seed value (SEED), and a method for including additional factors obtained from a third party or external service during key verification.

[0040] In some embodiments, it may be necessary to obtain the additional seed (G) from a publicly available source. When the additional seed (G) is obtained from a publicly available source, the verifier can perform verification without any additional configuration or communication between the key generation and verification process. The public value or additional seed (G) may contain verification criteria, for example, an expiration time may be included to indicate that a key should only be generated based on the additional seed (G) value within a specific time window.

[0041] In one embodiment, the processor 150 is configured to: secretly provide the additional seed (G) in the computing device 100. Secretly providing the additional seed (G) in the computing device is a process in which the additional seed (G) is securely provided in the computing device in a manner that ensures the confidentiality of the additional seed (G). Secretly providing the additional seed (G) improves security based on the additional shared secret value between the key generation and verification device or process. The term "secret provision" as used herein refers to the process of securely storing the confidential value in the computing device in a manner that ensures the confidentiality of the confidential value is protected.

[0042] In one embodiment, the processor 150 is configured to include in the bundle (B) information indicating the key generation method 106. For example, when some keys are based on ECC and other keys are based on RSA, it may be necessary to use multiple key generation methods 106. Including information about the key generation method 106 in the bundle enables a single verification device or process to be used to verify a variety of different key generation methods according to a variety of different encryption systems without requiring a priori knowledge of the key generation method employed.

[0043] Figure 2 FIG. 2 is a schematic block diagram of an exemplary apparatus 200 provided by various aspects of the disclosed embodiments. The exemplary apparatus 200 is used to verify an encryption key that has been generated according to an approved key generation method, such as the key pair (K pub , K priv ).

[0044] like Figure 2 As shown, the computing device 200 includes a memory 252, which is communicatively coupled to a processor 250. The memory 252 and the processor 250 may include any suitable type of processor 250 and memory 252, such as those described above and in combination with Figure 1 The processor 150 and the memory 152 are described.

[0045] exist Figure 2 In the exemplary embodiment shown, the processor 250 is configured to receive a private key (K priv1 ) and bundle (B1). The received private key (K priv1 ) and bundle (B1) can be as above and combined Figure 1 The private key (K priv ) and bundle (B), the received private key (K priv1 ) and the bundle (B1) includes sufficient to verify the private key (K priv1 ) is information generated according to an approved key generation method (for example, the key generation method described in the industry standard FIPS 186-4). Any type of cryptographic key that requires proof of key strength can be used as the private key (K priv1 ).

[0046] The bundle (B1) may include an encrypted value (X) and a public key, wherein the included public key is a corresponding public key from the key pair including the received private key (K priv1 In one embodiment, it is advantageous to include information indicating the second key generation function 204 in the received bundle (B1). Including the indication of the second key generation function 204 in the received bundle (B1) enables the apparatus 200 to be used to verify keys based on various key generation functions, thereby enabling the apparatus 200 to be used to verify a wider variety of key types. Similarly, the bundle (B1) may include information that facilitates verification of the received private key (K priv1 ), such as information about the key generation method, the encryption system, or other information used during key generation.

[0047] The processor 250 decrypts (202) the encrypted value (X) to recover the initial seed value (L').priv1 ) decrypts the encrypted value (X). The initial seed (L') may be a priv1 ) is the same random number or random binary value used during generation.

[0048] The processor 250 is used to derive a second seed value (SEED') according to the second key definition function 204 and the decrypted initial seed value (L'). Then, the second seed value (SEED') can be used to generate a second private key (K') according to the second seed value (SEED') and the key generation method 206. priv ).

[0049] By comparing (208) the received private key (K priv1 ) and the second private key (K' priv ), verify the first key generation method 106. Only when the private key (K priv1 ) and the key generation method for generating the second private key (K' priv ) is the same as the second key generation method 206, the received private key (K priv1 ) is combined with the second private key (K' priv ) are the same. Therefore, the received private key (K priv ) and the second private key (K' priv ) matches the private key (K priv1 ) and the key generation method for generating the second private key (K' priv ) is the same as the second key generation method 206 of the first key generation method. The term "verifying the first key generation method" as used herein means proving that the first key generation method is the same as the second key generation method by comparing the first private key generated by the first key generation method and the second private key generated by the second key generation method.

[0050] In one embodiment, the processor 250 is configured to: receive an additional seed value (G1); generate a second seed value (SEED') based on the additional seed value (G1), the initial seed value (L') and the key definition function 204. The additional seed value can be any desired value, such as the above and in combination with Figure 1 The additional seeds (G).

[0051] In some embodiments, the processor 250 is configured to: record a plurality of decrypted initial seed values ​​(L'); and run an entropy test on the recorded plurality of seed values. Running the entropy test on the plurality of seed values ​​(L') can detect problems with an entropy source used during key generation.

[0052] refer to Figure 3 , a flowchart 300 of an exemplary key generation 350 and key verification 352 process incorporating aspects of the disclosed embodiments is shown. The exemplary method 300 may be used to demonstrate to others that high security standards were followed during cryptographic key generation.

[0053] The exemplary key generation method 350 first generates (302) an initial seed (L) from a random number generator. The random number generator may be any desired type of random number generator capable of generating a series of random or pseudo-random numbers or binary values.

[0054] In 304, a seed value is derived from the initial seed and a first key definition function. The key definition function, sometimes also referred to as a key derivation function, may be any desired deterministic function for deriving an initial seed value from one or more random values.

[0055] A key pair (K pub , K priv ), the key pair (K pub , K priv ) includes a public key and a corresponding private key. The key pair can be based on any desired asymmetric encryption system, such as RSA, ECC or other sufficiently secure encryption systems.

[0056] In the exemplary key generation method 350, according to the generated key pair (K pub , K priv ) to create an encrypted value (X). The encrypted value (X) can then be used to construct (310) a bundle (B) that includes the encrypted value (X) and the public key (K pub ).

[0057] In some embodiments, based on the bundle (B) and the key pair (K) generated (306) pub , K priv )'s private key portion. The generated signature and the generated (312) signature are included (314) in the signature bundle (B S ), the signed bundle includes the bundle (B).

[0058] In some embodiments, it may be advantageous to include additional information in the bundle (B), for example indicating the key generation method, the encryption system and the key pair (K) used in generating (308) the key pair. pub , K privAdvantageously, any information used to inform the subsequent key verification process 352 can be included in the bundle (B).

[0059] If necessary, a signature may be generated (312) based on the bundle (B) and the private key generated (306). The signature may be included in the bundle (B) to create (314) a signed bundle (B). S ). The signature can then be used to verify the integrity of the bundle (B), thereby ensuring that the encrypted values ​​and other information in the bundle (B) have not been tampered with or otherwise altered.

[0060] Can be Figure 3 The exemplary key verification process 352 shown proves that the key pair (K pub , K priv ) is generated (306) according to an approved key generation method. The exemplary key verification process 352 is used to receive (320) a private key (K priv1 ) and bundle (B1), such as a private key and bundle (B) generated by the key generation method 350 described above.

[0061] In some embodiments, the received bundle (B1) may include a digital signature. The signature or the digital signature may be used to verify the integrity of the received bundle (B1).

[0062] Using the received private key (K priv1 ) decrypts (322) the encrypted value (X) contained in the received bundle (B1) to recover the initial seed value (L'). The recovered initial seed value can be used to derive (324) a second seed value (SEED') according to a key definition function.

[0063] A second private key (K') is generated (326) based on the second seed value (SEED') and the key generation method. priv ). The key generation method may be any desired or approved key generation method, such as the key generation method described in the industry standard FIPS 186-4 or other suitable secure key generation method.

[0064] When the second private key (K' priv ) and the private key (K priv ) are the same, verifying the received private key (K priv ) is used to generate the second private key (K' priv ) is generated by the same key generation method (326) as that of the received private key. The forward comparison (328) proves that the received private key (Kpriv ) is generated (306) according to an approved key generation method.

[0065] Therefore, although the basic novel features of the invention as applied to exemplary embodiments of the invention have been shown, described and pointed out herein, it should be understood that various omissions, substitutions and changes may be made to the form and details of the illustrated apparatus and methods and the set operations by those skilled in the art without departing from the spirit and scope of the invention. Further, it is expressly intended that all combinations of those elements that perform substantially the same functions in substantially the same manner to achieve the same results are within the scope of the invention. In addition, it should be recognized that the structures and / or elements shown and / or described in conjunction with any form or embodiment of the invention disclosed may be incorporated into any other form or embodiment disclosed or described or suggested as a general term of design choice. Therefore, it is intended to be limited only as indicated by the scope of the appended claims.

Claims

1. A computing device (100), characterized in that: The invention comprises a memory (152) communicatively coupled to a processor (150), wherein the processor (150) is configured to: Generate an initial seed (L) according to a random number generator (102); Derivation of a seed value (SEED) based on the initial seed (L) and a first key definition function; Generate a key pair (K) according to the seed value (SEED) and the first key generation method pub , K priv ), the key pair (K pub , K priv ) includes the public key (K pub ) and the private key (K priv ); According to the public key (K pub ) encrypting the initial seed to create an encrypted value (X); Construct a bundle (B), the bundle (B) including the encrypted value (X) and the public key (K pub ).

2. The computing device (100) according to claim 1, characterized in that The processor (150) is used to: priv ) generates a signature (110); combines the signature (110) and the bundle (B) into a signature bundle (B S ).

3. The computing device (100) according to claim 2, characterized in that The processor (150) is used to: S ) is configured as a certificate signing request (CSR).

4. The computing device (100) according to claim 2, characterized in that The processor (150) is used to: S ) is configured as one of a self-signed certificate and a certificate authority-signed certificate.

5. The computing device (100) according to any one of the preceding claims, characterized in that: The processor (150) is used to: further generate the seed value (SEED) according to an additional seed (G).

6. The computing device (100) according to claim 5, characterized in that The processor (150) is used to obtain the additional seed (G) from a trusted entropy source, and the additional seed (G) can be used in a key detection device.

7. The computing device (100) according to claim 5, characterized in that The processor (150) is configured to secretly provide the additional seed (G) in the computing device (100).

8. The computing device (100) according to any one of claims 1 to 4, characterized in that: The processor (150) is configured to include information indicating the key generation method in the bundle (B).

9. A computing device (200), characterized in that: The invention comprises a memory (252) communicatively coupled to a processor (250), wherein the processor (250) is configured to: Receive the first private key (K priv1 ) and a bundle (B1), the bundle comprising an encrypted value (X) and a public key (K pub ), the first private key (K priv1 ) is generated according to a first key generation method; According to the first private key (K priv1 ) decrypting the encrypted value (X) to recover the decrypted initial seed (L'); Derived a second seed value (SEED') according to the decrypted initial seed (L') and the second key definition function; Generate a second private key (K') according to the second seed value (SEED') and the second key generation method priv ); By comparing the first private key (K priv ) and the second private key (K' priv ) to verify the first key generation method.

10. The computing device (200) according to claim 9, characterized in that The processor (250) is used to: Receive additional seeds (G1); The second seed value (SEED') is further generated based on the additional seed (G1).

11. The computing device (200) according to any one of claims 9 or 10, characterized in that: The processor (250) is used to: save a plurality of decrypted initial seed values ​​(L'); and run an entropy measurement test on the recorded plurality of decrypted initial seed values.

12. A calculation method (300), characterized in that: include: Generate (302) an initial seed (L) according to a random number generator; deriving (304) a seed value (SEED) based on the initial seed (L) and a first key definition function; A key pair (K pub , K priv ), the key pair (K pub , K priv ) includes the public key (K pub ) and the private key (K priv ); According to the public key (K pub ) encrypting (308) the initial seed to create an encrypted value (X); Construct (310) a bundle (B), the bundle (B) comprising the encrypted value (X) and the public key (K pub ).

13. The method (300) according to claim 12, characterized in that: Also includes: Based on the bundle (B) and the private key (K priv ) Generate (312) a signature; The signature and the bundle (B) are combined (314) into a signed bundle (B S ).

14. The method (300) according to claim 12, characterized in that: The bundle (B) includes information indicating the key generation method.

15. The method (300) according to any one of claims 12 to 14, characterized in that: Also includes: Receive (320) the private key (K priv ) and said bundle (B); According to the private key (K priv ) decrypting (322) the encrypted value (X) to recover the decrypted initial seed (L'); deriving (324) a second seed value (SEED') based on the decrypted initial seed (L') and the second key definition function; A second private key (K') is generated (326) based on the second seed value (SEED') and the second key generation method. priv ); By comparing the private key (K priv ) and the second private key (K' priv ), verify (328) the first key generation method.

Images