Method for updating cryptographic keys to 256-bit cryptographic keys using a cryptographic key update system

Abstract

Methods for updating 256-bit cryptographic keys using a cryptographic key update system include the transmission of a first transmission, a second transmission, and a third transmission. The second transmission is a symmetric key encryption using a cipher key consisting of a concatenation of a plurality of parameters and a new cryptographic key.The sender derives the encryption key by transforming an authentication key and a bit sequence of constant values ​​based on a one-way compression function, which is one of the following: a Modification Detection Code 2 (MDC-2) cryptographic hash function with an advanced 128-bit encryption standard (AES-128) as the underlying block cipher, a Modification Detection Code 4 (MDC-4) cryptographic hash function with the advanced 128-bit encryption standard (AES-128) as the underlying block cipher, the Hirose compression function with the advanced 256-bit encryption standard (AES-256) as the underlying block cipher, and a 256-bit hash function.

Description

[0001] The present description refers to a system for updating cryptographic keys and procedures for updating 256-bit cryptographic keys.

[0002] A cryptographic key is a string of characters processed by cryptographic algorithms to encrypt or decrypt cryptographic data. A secure hardware extension (SHE) is an on-chip extension for a microcontroller designed to enhance the security of cryptographic keys. Specifically, the secure hardware extension shifts control over cryptographic keys from the software domain to the hardware domain, protecting them from cyberattacks.

[0003] Quantum computers are machines that exploit quantum mechanical phenomena to solve mathematical problems that are difficult for conventional computers to compute, and therefore have the potential to break many of the currently used public and symmetric key cryptosystems. Accordingly, quantum-resistant cryptography focuses on developing cryptographic systems that are secure against both quantum and classical computers and are compatible with existing communication protocols and networks.

[0004] The AUTomotive Open System Architecture (AUTOSAR) Secure Hardware Extension Key Update protocol only supports the provisioning and updating of 128-bit cryptographic keys. However, post-quantum security requires the updating of systems containing cryptographic keys with bit lengths of 256 bits or even longer. Relatively simple updates to the current Secure Hardware Extension Key protocol are insufficient to support cryptographic keys with an increased bit length of 256 bits or more, as transport security based on the current Secure Hardware Extension Key protocol is weaker than required when updating 256-bit keys.

[0005] German patent application DE 10 2020 200 726 A1 describes a method in a server for exchanging cryptographic keys for quantum-safe communication between the server and a client, comprising: receiving a request message for a secure communication channel from a client, wherein the request message includes at least one quantum-safe public key and a first nonce, the quantum-safe public key being part of a key pair generated by a key generation function of a quantum-safe key encapsulation mechanism; generating a second nonce; encapsulating the quantum-safe public key with an encapsulation function of the quantum-safe key encapsulation mechanism, the encapsulation generating a ciphertext and a shared secret; and generating a third and a fourth nonce using the generated shared secret.Generating hybrid symmetric keys from the first nonce, the second nonce, the third nonce, and the fourth nonce using a combiner, and sending a response message to the client, the response message containing at least the generated ciphertext and the second nonce.

[0006] German patent DE 10 2023 115 999 A1 describes a method, a device, a system, and a computer program product for post-quantum (PQ)-safe updating of a data processing unit. The method for post-quantum (PQ)-safe updating of a data processing unit comprises the following steps: receiving a message to initiate a communication session for an update from a second, controlling data processing unit, in particular a telematics control unit, by the unit to be updated, wherein the message includes a digital signature generated using a PQ-safe private signature key of the controlling unit; verifying the digital signature of the controlling unit using a PQ-safe public signature key of the controlling unit; and creating and sending a message to the controlling unit.

[0007] It can be considered a task to provide an improved approach for updating cryptographic keys with a larger bit length.

[0008] A method according to the invention for updating cryptographic keys to 256-bit keys by a cryptographic key update system is described. The method comprises the transmission of a first transmission by a transmitter to one or more control units that are part of a vehicle. The method comprises the transmission of a second transmission by the control unit to one or more control units, wherein the second transmission is a symmetric key encryption under a cipher key consisting of a concatenation of a plurality of parameters and a new cryptographic key, and the transmitter derives the cipher key by transforming an authentication key and a bit sequence of constant values ​​based on a one-way compression function.which is one of the following: a Modification Detection Code 2 (MDC-2) cryptographic hash function with a 128-bit Advanced Encryption Standard (AES-128) as the underlying block cipher, a Modification Detection Code 4 (MDC-4) cryptographic hash function with AES-128 as the underlying block cipher, a Hirose compression function with a 256-bit Advanced Encryption Standard (AES-256) as the underlying block cipher, and a 256-bit hash function. The method includes the transmission of a third transmission by the sender to one or more control units, wherein the third transmission is a 128-bit message authentication code based on an advanced encryption standard under a first message authentication code (MAC) key from a concatenation of the first transmission and the second transmission. The method includes the verification of the first transmission,The second and third transmissions involve the processing of data by one or more control units. Upon determining that the data processed by the first and second transmissions is valid, the procedure includes the extraction of the new cryptographic key by one or more control units. Finally, the procedure involves the execution of one or more cryptographic validation operations based on the new cryptographic key by one or more control units.

[0009] In one embodiment, in response to the extraction of the new cryptographic key by one or more control units, a fourth transmission and a fifth transmission are calculated based on the new cryptographic key.

[0010] In one embodiment, the method comprises transmitting the fourth transmission to the sender by one or more control units, wherein the fourth transmission is a bit sequence that is a concatenation of the received first transmission and a symmetric key encryption of a freshness counter value in the second transmission under a second encryption key and a symmetric AES encryption.

[0011] In one embodiment, the method comprises deriving the second encryption key by one or more control units by transforming the new cryptographic key and the constant-value bit string based on one of the following functions: an advanced encryption standard Miyaguchi-Preneel compression function and a 128-bit hash function.

[0012] In one embodiment, the method comprises transmitting the fifth transmission to the sender by the one or more control units, wherein the fifth transmission is a 128-bit message authentication code under a second MAC key of the fourth transmission.

[0013] In one embodiment, the derivation of the second MAC key by one or more control units is achieved by transforming the new cryptographic key and the bit sequence of constant values ​​based on one of the following functions: an advanced Miyaguchi-Preneel compression function and a 128-bit hash function.

[0014] In one embodiment, the method comprises transmitting the fifth transmission to the sender by the one or more control units, wherein the fifth transmission is a 256-bit message authentication code under a second MAC key of the fourth transmission.

[0015] In one embodiment, the method comprises deriving the second MAC key by one or more control units based on one of the following functions: the cryptographic hash function MDC-2 with AES-128 as the underlying block cipher, the cryptographic hash function MDC-4 with AES-128 as the underlying block cipher, and the Hirose compression function with AES-256 as the underlying block cipher.

[0016] In one embodiment, the method includes receiving the fourth and fifth transmissions from the one or more control units by the sender.

[0017] In one embodiment, in response to receiving the fourth and fifth transmissions, the sender verifies the fourth and fifth transmissions to ensure that the one or more control units have received a correct version of the new cryptographic key.

[0018] In one embodiment, the method includes determining the first transmission by the sender, which contains a concatenation of an identifier corresponding to one or more control units, a slot identifier of the new cryptographic key, and a slot identifier of the authentication key. Fig.Figure 1 is a schematic diagram of the disclosed cryptographic key update system in a vehicle, comprising one or more control units that communicate with a transmitter that is either located in a back office or is one or more trust anchor control units located inside the vehicle, according to an exemplary embodiment; Fig. Figure 2 is a diagram of the exchange of transmissions between the one or more control units and the device in Fig. 1 transmitter shown according to an exemplary embodiment; Fig. Figure 3 shows two individual processing units that are located on one or more control units as well as on the in Fig. 1 transmitters shown according to the embodiment in Table 1 are implemented according to an exemplary embodiment; Fig.Figure 4 is a process flow diagram illustrating a method for updating cryptographic 256-bit keys by the cryptographic key update system based on the embodiment shown in Table 1 according to an exemplary embodiment; Fig. Figure 5 is a process flow diagram illustrating another method for updating cryptographic 256-bit keys by the cryptographic key update system based on the embodiment in Table 2 according to an exemplary embodiment; Fig. Figure 6 is a process flow diagram illustrating another method for updating cryptographic 256-bit keys by the cryptographic key update system based on the embodiment in Table 3 according to an exemplary embodiment; Fig.7 is an N-bit compression function implemented by the cryptographic key update system when using the embodiment shown in Table 4, according to an exemplary embodiment; Fig. Figure 8 shows two individual processing units, which are found both in one or more control units and in the Fig. 1. Transmitters shown are implemented according to the embodiment in Table 4, specifically according to an exemplary embodiment; and Fig. Figure 9 is a process flow diagram illustrating another method for updating cryptographic keys of arbitrary length by the cryptographic key update system based on the embodiment in Table 4 according to an exemplary embodiment.

[0019] Fig.Figure 1 shows a schematic representation of a vehicle 10 with one or more control units 20 that are part of a cryptographic key update system 12. The vehicle 10 can be any type of vehicle, such as a sedan, truck, sport utility vehicle, van, or motorhome. The one or more control units 20 constitute a peripheral security device that receives cryptographic key update transmissions from a transmitter 22, which is part of the cryptographic key update system 12. In one embodiment, the transmitter 22 is a computer 24 located in a back office 26 at a location remote from the vehicle 10, where the computer 24 communicates wirelessly with the one or more control units 20.In another embodiment, the transmitter 22 is one or more trust anchor control units 28 that are part of the vehicle 10, wherein the one or more control units 20 are in electronic communication with the one or more trust anchor control units 28.

[0020] As explained below, this supports Fig.Figure 1, Cryptographic Key Update System 12, is a cryptographic key update protocol for updating 256-bit cryptographic keys with 256-bit transport security. The cryptographic key update protocol is backward compatible and can also support updating a 128-bit cryptographic key to a 256-bit cryptographic key. In a non-restrictive embodiment, the cryptographic key update system 12 supports the AUTomotive Open System Architecture (AUTOSAR) Secure Hardware Extension Key Update Protocol. However, it is understood that the cryptographic key update system 12 can support any other type of cryptographic key update protocol for updating a 256-bit key or for updating a 128-bit key to a 256-bit key. Although in Fig.While a vehicle 10 is described and illustrated, the cryptographic key update system 12 is not limited to a vehicle and can also be used in other applications. For example, the cryptographic key update system can also be used in other applications that use cryptographic keys, such as a smartphone or a camera.

[0021] Fig. Figure 2 is a diagram illustrating the transmissions exchanged between the one or more control units 20 and the transmitter 22. In the Fig.In the embodiment shown in Figure 2, the transmitter 22 determines and transmits a first transmission M1, a second transmission M2, and a third transmission M3 to one or more control units 20. The first transmission M1, the second transmission M2, and the third transmission M3 contain information about a new cryptographic key, an encryption of the new cryptographic key, and a message authentication code (MAC) derived from a concatenation of the first transmission M1 and the second transmission M2. Although Fig. The three transmissions M1, M2 and M3 shown should be noted. Fig.Figure 2 is only an example, and the transmitter 22 can transmit the data to the one or more control units 20 based on any number of transmissions. It should also be understood that the transmissions M1, M2, and M3 can be transmitted in any order and do not have to be sequential; however, the one or more control units 20 first receive all data elements in the transmissions M1, M2, and M3 before verifying the data transmitted by transmissions M1, M2, and M3 and extracting the new encryption key.

[0022] The one or more control units 20 perform one or more cryptographic validation operations based on the new cryptographic key, including, but not limited to, MAC verification, decryption, compression, and key derivation. In response to the extraction of the new cryptographic key, the one or more control units 20 then compute a fourth transmission M4 and a fifth transmission M5 based on the new cryptographic key. The one or more control units 20 then transmit the fourth transmission M4 and the fifth transmission M5 back to the sender 22. The sender 22 receives the fourth transmission M4 and the fifth transmission M5 from the one or more control units 20.In response to receiving the fourth transmission M4 and the fifth transmission M5, the transmitter 22 checks the fourth transmission M4 and the fifth transmission M5 to ensure that the one or more control units 20 have received the correct version of the new cryptographic key. Although in . Fig. 2. Two transmissions M4 and M5 are shown; it should be noted that Fig. 2 is only an example, and the one or more control units 20 can transmit the data that is part of the fourth transmission M4 and the fifth transmission M5 in any number of transmissions. It should also be understood that transmissions M4 and M5 do not have to be transmitted sequentially. However, the transmitter 22 first receives all the data in transmissions M4 and M5 before checking their validity.

[0023] In the exemplary embodiment described and illustrated in Table 1, the authentication key is a 128-bit value and the new cryptographic key is a 256-bit value. In another embodiment, however, both the authentication key and the new cryptographic key are 256-bit values. In the present embodiment, the first transmission M1, the second transmission, the third transmission M3, the fourth transmission M4, and the fifth transmission M5 are summarized in Table 1 below. In one embodiment, the first transmission M1 is a 128-bit value that concatenates an identifier for the one or more control units 20 (ECU_ID), a slot identifier of the new cryptographic key (NEW Key Slot ID), and the slot identifier of the authentication key (Key). AUTHSlot ID). Although the first transmission M1 is described with a length of 128 bits and specific values, the bit length and content of the first transmission M1 are not limited to the embodiment shown in Table 1. Furthermore, the authentication key (KeyAUTH) can be 128 ) either to the current cryptographic key that needs to be updated, or to the master key.

[0024] In one embodiment, the second transmission M2 is a 384-bit value representing a symmetric encryption under the encryption key (K1). 256 ) a concatenation of a plurality of parameters and the new cryptographic key (New Key256) bit ). In one embodiment, the majority of parameters include, in particular, a freshness counter value (counter). 28), a bitstring flag identifier that encodes a list of operations for which the new cryptographic key can be used (FID5), and a padding (0...0 95 Although the second transmission M2 is described as having a length of 384 bits, its bit length and content are not limited to the embodiment shown in Table 1, and the second transmission M2 can contain any content, including an encryption of the new cryptographic key, a freshness counter, and other application-dependent parameters. Symmetric key encryption is performed using a 256-bit key block cipher in an encryption mode such as the advanced encryption standard with a 256-bit key (AES-256) in Cipher Block Chaining (CBC) mode (AES). CBC ) carried out, whereby the key encryption key (K1) 256The key is a 256-bit value, the bitstring flag identifier is a 5-bit value, and the padding is a 95-bit value. It should be noted that the bit values ​​described for most of the parameters are only examples, and other bit values ​​can also be used. The bitstring flag identifier is a bitmask that specifies the tasks for which the new cryptographic key can be used, e.g., only for verifying the message authentication code, or for both verifying and generating the message authentication code.

[0025] In embodiments where the protocol for updating the cryptographic key is backward compatible, the last two padding bits of the padding (0...0 93The last two padding bits (XX) are used to indicate the type of update. For example, if in an implementation the last two padding bits are "00", this means an update from one 128-bit cryptographic key to another 128-bit cryptographic key; if the last two padding bits are "01", this means an update from one 128-bit cryptographic key to another 256-bit cryptographic key; and if the last two padding bits are "10", this means an update from one 256-bit cryptographic key to another 256-bit cryptographic key. It goes without saying that more than two padding bits can be used if more combinations of cryptographic key sizes are required.

[0026] Channel 22 ( Fig. 1) transmits the encryption key (K1) 256 ) by using the authentication key (KeyAUTH) 128) and converts a bit sequence of constant values ​​(KEY_UPDATE_ENC_CST) based on a one-way compression function (AES-COMPRESSION_FUNC), where the output of the one-way compression function is a 256-bit value. The one-way compression function is one of the following: a modifier detection code 2 (MDC-2) cryptographic hash function with an advanced 128-bit encryption standard (AES-128) as the underlying block cipher, a modifier detection code 4 (MDC-4) cryptographic hash function with the advanced 128-bit encryption standard (AES-128) as the underlying block cipher, the Hirose compression function with the advanced 256-bit encryption standard (AES-256) as the underlying block cipher, and a 256-bit hash function.Some examples of the 256-bit hash function are the secure hash algorithm 2 (SHA2-512) and the secure hash algorithm 3 (SHA3-512), which has been shortened to 256 bits.

[0027] The third transmission M3 is a 128-bit message authentication code based on the Advanced Encryption Standard Cipher-based Message Authentication Code (AES-CMAC) under the first MAC key (K2). 128 ) the concatenation of the first transmission M1 and the second transmission M2 is calculated, where the first MAC key (K2) 128 ) is a 128-bit value. Sender 22 transmits the first MAC key (K2). 128 ) by using the authentication key (KeyAUTH) 128) and converts the bit sequence of constant values ​​(KEY_UPDATE_ENC_CST) based on one of the following methods: the advanced encryption standard Miyaguchi-Preneel compression function (AES-MP) and a 128-bit hash function. Some examples of the 128-bit hash function are the secure hash algorithm 2 (SHA2-512) and the secure hash algorithm 3 (SHA3-512), which has been truncated to 128 bits.

[0028] The one or more control units 20 then verify the message authentication code under the first MAC key (K2). 128 ) the concatenation of the first transmission M1 and the second transmission M2. In response to the verification of the message authentication code under the first MAC key (K2) 128 ) the chaining of the first transmission M1 and the second transmission M2, the one or more control units 20 transmit the encryption key (K1). 256 ) and extract based on the encryption key (K1)256 ) the new cryptographic key (New Key256 bit ) from the second transmission M2. In response to the extraction of the new cryptographic key (New Key256) bit ) the one or more control units 20 then calculate the fourth transmission M4 and the fifth transmission M5 based on the new cryptographic key (New Key256). bit ).

[0029] The fourth transmission M4 is a 256-bit sequence that concatenates the first transmission M1 received from sender 22 and a symmetric key encryption of the freshness counter value (counter). 28 ) in the second transmission M2 under a second encryption key (K3) 128 ) and a symmetric key AES encryption (M4* 128 ) of the freshness counter value (Counter 28 ) in the second transmission M2 under the second encryption key (K3) 128). The one or more control units 20 initiate the AES encryption with a symmetric key (M4*). 128 ) by changing the freshness counter value (counter 28 ) from the second transmission M2 based on the advanced encryption standard (AES) under the second encryption key (K3) 128 ) encrypt. The one or more control units 20 transmit the second encryption key (K3). 128 ) by using the new cryptographic key (New Key256) bit ) and convert the bit sequence of constant values ​​(KEY_UPDATE_ENC_CST) based on one of the following functions: a Miyaguchi-Preneel compression function of the Advanced Encryption Standard (AES-MP) and the 128-bit hash function.

[0030] The fifth transmission, M5, is a 128-bit message authentication code under a second MAC key (K4). 128) of the fourth transmission M4. The 128-bit message authentication code is derived based on an encryption-based message authentication code (Advanced Encryption Standard Cipher-based Message Authentication Code, AES-CMAC). The one or more control units 20 forward the second MAC key (K4). 128 ) by using the new cryptographic key (New Key256) bit ) and convert the bit sequence of constant values ​​(KEYUPDATE _ENC_CST) based on one of the following functions: the Miyaguchi-Preneel compression function of the Advanced Encryption Standard (AES-MP) and the 128-bit hash function. Table 1 M1128 bit = Old Key oderECU_ID || NEW Key Slot ID || Key AUTH Slot ID, wobei KeyAUTH 128 =Master Key M2384 bit = AES CBC (K1 256 , Counter 28 || FID5 || 0...0 95 || New Key256 bit), wobei K1 256 = AESS-COMPRESSION_FUNC(KeyAUTH 128 || KEY_UPDATE_ENC_CST) M3128 bit = AES-CMAC(K2 128 , M1 || M2) wobei K2 128 = AES-MP(KeyAUTH 128 ||KEY_UPDATE_CMAC_CST) M4256 bit = M1128 || M4* 128 , where M4* 128 = AES EBC (K3 128 , counter 28 ), and K3 128 = AES-MP(NEW key 256 || KEY_UPDATE_ENC_CST) M5128 bit = KEY UPDATE_AES-CMAC(K4 128 ,M4), wobei K4 128 = AES-MP(NEW Key 256 ||CMAC_CST)

[0031] Fig. Figure 3 shows four individual processing units 40, 42, 50, 52, which are located both in one or more control units 20 and in the Fig.The transmitter 22 shown in Figure 1 is implemented (where the transmitter 22 is either the computer 24 located in the back office 26 or one or more trust anchor control units 28). The single processing unit 40 is based on the advanced 128-bit encryption standard (AES-128) and comprises a plurality of cryptographic operation modules 44A-44F that use AES-128 as a subroutine.Specifically, the Cryptographic Operations Module 44A implements encryption functions, the Cryptographic Operations Module 44B implements decryption functions, the Cryptographic Operations Module 44C calculates encryption-based message authentication codes (CMAC), the Cryptographic Operations Module 44D implements the Advanced Encryption Standard Miyaguchi-Preneel Compression Function (AES-MP), the Cryptographic Operations Module 44E implements the cryptographic hash function MDC-2, and the Cryptographic Operations Module 44F implements the cryptographic hash function MDC-4. The single processing unit 42 is based on the 256-bit Advanced Encryption Standard (AES-256) and comprises a plurality of Cryptographic Operations Modules 46A-46D.Cryptographic Operations Module 46A performs encryption operations, Cryptographic Operations Module 46B performs decryption operations, Cryptographic Operations Module 46C performs the Advanced Encryption Standard Miyaguchi-Preneel (AES-MP) compression function, and Cryptographic Operations Module 46D performs the Hirose compression function. The individual processing units 50 and 52 are described below.

[0032] Fig. Figure 4 shows an exemplary process flow diagram illustrating a procedure 400 for updating either old 128-bit or 256-bit cryptographic keys based on the embodiment of the cryptographic key update system 12 shown in Table 1. Referring to the Fig. 1, Fig. 2 and Fig.4. Procedure 400 begins in block 402. In block 402, sender 22 transmits the first transmission M1 to one or more control units 20. Sender 22 determines the first transmission, which is the concatenation of the identifier corresponding to one or more control units 20 (ECU_ID), the slot identifier of the new cryptographic key (NEW Key Slot ID), and the slot identifier of the authentication key (Key). AUTH (Slot ID). Procedure 400 can then proceed to block 404.

[0033] In block 404, the transmitter 22 transmits the second transmission M2 to one or more control units 20, the second transmission being a symmetric key encryption under the encryption key (K1). 256 ) a concatenation of a plurality of parameters and the new cryptographic key (New Key256) bit ). Procedure 400 can then proceed to block 406.

[0034] In block 406, the sender 22 transmits the third transmission M3 to the one or more control units 20, wherein the third transmission M3 is a 128-bit Advanced Encryption Standard Cipher-based Message Authentication Code (AES-CMAC) under the first MAC key (K2). 128 ) the chaining of the first transmission M1 and the second transmission M2. Procedure 400 can then proceed to decision block 408.

[0035] In decision block 408, the one or more control units 20 check the data transmitted by transmissions M1, M2, and M3. If it is determined that the data transmitted by transmissions M1, M2, and M3 is valid, procedure 400 can proceed to block 410. Otherwise, procedure 400 can be aborted.

[0036] In block 410, in response to the finding that the data transmitted by transmissions M1, M2 and M3 are valid, the one or more control units 20 extract the new cryptographic key (New Key256). bit Procedure 400 can then continue with block 412.

[0037] In block 412, one or more control units 20 transmit the fourth transmission M4 to the transmitter 22. The fourth transmission M4 is a 256-bit string that concatenates the first transmission M1 received by the transmitter 22 and an AES encryption with a symmetric key (M4*). 128 ) of the freshness counter value (Counter 28 ) in the second transmission M2 under a second encryption key (K3) 128 ). Procedure 400 can then be continued with block 414.

[0038] In block 414, one or more control units 20 send the fifth transmission M5 to the transmitter 22. The fifth transmission M5 is a 128-bit message authentication code under the second MAC key (K4). 128 ) the fourth transmission M4. Procedure 400 can then continue with block 416.

[0039] In block 416, transmitter 22 receives the fourth transmission M4 and the fifth transmission M5 from one or more control units 20. The procedure 400 can then be continued with block 418.

[0040] In block 418, in response to receiving the fourth transmission M4 and the fifth transmission M5, the transmitter 22 checks whether one or more control units 20 have the correct version of the new cryptographic key (New Key256). bit have received. Procedure 400 can then be terminated.

[0041] In the embodiment described and shown in Table 1, the fourth transmission M4 and the fifth transmission M5 are both provided with 128-bit cryptographic keys (i.e., the fourth transmission M4 is encrypted with the second encryption key (K3)). 128 ) which is a 128-bit value, and the fifth transmission M5 is equipped with the second MAC key (K4) 128) which is a 128-bit value). The embodiment shown in Table 1 can be used in cases where offline attacks are not a problem. However, in cases where offline attacks on the message authentication codes can be a problem, especially if there is a risk of an offline attack on the fifth transmission to recover the new cryptographic key and forge a 128-bit message authentication code, the fifth transmission M5 is set as a 256-bit message authentication code, as described below and shown in Table 2.

[0042] In the exemplary embodiment as described and illustrated in Table 2, the current cryptographic key is a 128-bit value and the new cryptographic key is a 256-bit value. As can be seen from the Fig. 1 and Fig.As shown in Figure 2 and Table 2, the first transmission M1, the second transmission, the third transmission M3, and the fourth transmission M4 contain the same data elements as the embodiment described in Table 1. The fifth transmission M5 is a 256-bit message authentication code under the second MAC key (K4). 256 ) of the fourth transmission M4, where the 256-bit message authentication code is derived based on a 256-bit message authentication code function. Some examples of the 256-bit message authentication code function are, among others, a Keccak message authentication code (KMAC-256()) and a hash-based message authentication code (HMAC-256()). The one or more control units 20 forward the second MAC key (K4). 128 ) by using the new cryptographic key (New Key256) bit) and convert the bit sequence of constant values ​​(KEY_UPDATE_ENC_CST) based on one of the following 256-bit compression functions (AES-COMPRESSION_FUNC): the cryptographic hash function MDC-2 with AES-128 as the underlying block cipher, the change detection code MDC-4 with AES-128 as the underlying block cipher, and the Hirose compression function with AES-256 as the underlying block cipher. Table 2 M1128 bit = Old Key oderECU_ID || NEW Key Slot ID || Key AUTH Slot ID, wobei KeyAUTH 128 =Master Key M2384 bit = AES CBC (K1 256 , Counter 28 || FID5 || 0...0 95 || New Key256 bit), wobei K1 256 = AES- 128 || KEY_UPDATE_ENC_CST) M3128 bit = AES-CMAC(K2 128 , M1 || M2) wobei K2 128 = AES-MP(KeyAUTH 128 || KEY_UPDATE_CMAC_CST) M4256 bit = M1128 || M4* 128 , where M4* 128 = AES EBC (K3 128 , counter 28 ), and K3 128 = AESSchlüssel 256 || KEY_UPDATE_ENC_CST) M5256 bit = 256-bit-MAC-FUNC(K4 256 ,M4) where: K4 = AES- COMPRESSION FUNC 256 (NEW key) 256 || KEY_UPDATE 256-bit-MA_CMAC_CST), and C-FUNC() is implemented as KMAC-256(), HMAC-256() or similar.

[0043] Fig. Figure 5 shows an exemplary process flow diagram illustrating a procedure 500 for updating old 128-bit to 256-bit cryptographic keys based on the embodiment of the cryptographic key update system 12 shown in Table 2, wherein the fifth transmission is a 256-bit message authentication code. Referring to the Fig. 1, Fig. 2 and Fig.In block 502, procedure 500 begins. In block 502, sender 22 transmits the first transmission M1 to one or more control units 20. Sender 22 determines the first transmission, which is the concatenation of the identifier corresponding to the one or more control units 20 (ECU_ID), the slot identifier of the new cryptographic key (NEW Key Slot ID), and the slot identifier of the authentication key (Key). AUTH (Slot ID). Procedure 500 can then proceed with block 504.

[0044] In block 504, the transmitter 22 transmits the second transmission M2 to one or more control units 20, the second transmission being a symmetric key encryption under the encryption key (K1). 256 ) a concatenation of a plurality of parameters and the new cryptographic key (New Key256) bit ). Procedure 500 can then proceed to block 506.

[0045] In block 506, the transmitter 22 transmits the third transmission M3 to the one or more control units 20, wherein the third transmission M3 is a 128-bit Advanced Encryption Standard Cipher-based Message Authentication Code (AES-CMAC) under the first MAC key (K2). 128 ) the chaining of the first transmission M1 and the second transmission M2. Procedure 500 can then proceed to decision block 508.

[0046] In decision block 508, the one or more control units 20 check the data transmitted by transmissions M1, M2, and M3. If it is determined that the data transmitted by transmissions M1, M2, and M3 is valid, procedure 500 can proceed to block 510. Otherwise, procedure 500 can be aborted.

[0047] In block 510, the one or more control units 20 extract the new cryptographic key (New Key256) in response to the finding that the data transmitted by transmissions M1, M2 and M3 are valid. bit Procedure 500 can then continue with block 512.

[0048] In block 512, one or more control units 20 transmit the fourth transmission M4 to the transmitter 22. The fourth transmission M4 is a 256-bit sequence that concatenates the first transmission M1 received by the transmitter 22 and an AES encryption with a symmetric key (M4*). 128 ) of the freshness counter value (Counter 28 ) in the second transmission M2 under a second encryption key (K3) 128 ). Procedure 500 can then continue with block 514.

[0049] In block 514, one or more control units 20 send the fifth transmission M5 to the transmitter 22. The fifth transmission M5 is a 256-bit message authentication code under the second MAC key (K4). 256 ) of the fourth transmission M4, where the 256-bit message authentication code is derived based on a 256-bit message authentication code function. Procedure 500 can then proceed to block 516.

[0050] In block 516, transmitter 22 receives the fourth transmission M4 and the fifth transmission M5 from one or more control units 20. The procedure 500 can then be continued with block 518.

[0051] In block 518, in response to receiving the fourth transmission M4 and the fifth transmission M5, the transmitter 22 checks whether one or more control units 20 have the correct version of the new cryptographic key (New Key256). bithave received. Procedure 500 can then be terminated.

[0052] In the exemplary embodiment as described and illustrated in Table 3, both the key and the new cryptographic key are 256-bit values. Referring to the Fig. 1 and Fig. Table 2 and Table 3 contain the first transmission M1, the second transmission, the fourth transmission M4 and the fifth transmission M5, which have the same data elements as the embodiment described in Table 2, except that the authentication key (KeyAUTH) 256 ) is a 256-bit value and the third transmission M3 is a 256-bit message authentication code.

[0053] The third transmission M3 is a 256-bit message authentication code under the first MAC key (K2). 256 ) the concatenation of the first transmission M1 and the second transmission M2. Transmitter 22 transmits the first MAC key (K2).256 ) by using the authentication key (KeyAUTH) 128 ) and converts the bit sequence of constant values ​​(KEY_UPDATE_ENC_CST) based on one of the following 256-bit compression functions: the MDC-2 cryptographic hash function with AES-128 as the underlying block cipher, the MDC-4 cryptographic hash function with AES-128 as the underlying block cipher, and the Hirose compression function with AES-256 as the underlying block cipher. The 256-bit message authentication code in the third transmission M3 is computed based on a 256-bit message authentication code function. As mentioned above, some examples of the 256-bit message authentication code function include, among others, a Keccak message authentication code (KMAC-256()) and a hash-based message authentication code (HMAC-256()). Table 3 M1128 bit =ECU_ID || NEW Key Slot ID || Key AUTH Slot ID, wobei KeyAUTH 256 = Old Key or Master Key M2384 bit =AES CBC (K1 256 , Counter 28 || FID5 || 0...0 95 || New Key256 bit), wobei K1 256 = AES-COMPRESSION_ FUNC(KeyAUTH 256 || KEY_UPDATE_ENC_CST) M3 256 bit = 256-bit-MAC-FUNC (K2 256 , M1 ||M2) where: K2 256 = AES-COMPRESSION_FUNC (KeyAUTH 256 || KEY_UPDATE_CMAC_CST), and 256-bit-MAC-FUNC() = KMAC-256(), HMAC-256() or similar. M4256 bit =M1 128 || M4* 128 , where M4* 128 = AES EBC (K3 128 , counter 28 ), and K3 128 = AES-MP(NEW key 256 || KEY_UPDATE_ENC_CST) M5256 bit =256-bit-MAC-FUNC(K4 256 ,M4) where: K4 256 = AES-COMPRESSION_FUNC (NEW key) 256 || KEY_UPDATE256-Bit-MAC-FUNC()_and_is implemented as KMAC-256(), HMAC-256() or similar.

[0054] Fig.Figure 6 shows an exemplary process flow diagram illustrating a procedure 600 for updating cryptographic 256-bit keys based on the embodiment of the cryptographic key update system 12 shown in Table 3, wherein the third transmission M3 is a 256-bit message authentication code. Referring to the Fig. 1, Fig. 2 and Fig. In block 602, procedure 600 begins. In block 602, sender 22 transmits the first transmission M1 to one or more control units 20. Sender 22 determines the first transmission, which is the concatenation of the identifier corresponding to one or more control units 20 (ECU_ID), the slot identifier of the new cryptographic key (NEW Key Slot ID), and the slot identifier of the authentication key (Key). AUTH (Slot ID). Procedure 600 can then proceed to block 604.

[0055] In block 604, the transmitter 22 transmits the second transmission M2 to one or more control units 20, the second transmission being a symmetric key encryption under the encryption key (K1). 256 ) a concatenation of a plurality of parameters and the new cryptographic key (New Key256) bit ). Procedure 600 can then proceed to block 606.

[0056] In block 606, the transmitter 22 transmits the third transmission M3 to the one or more control units 20, where the third transmission M3 is a 256-bit message authentication code under the first MAC key (K2). 256 ) the concatenation of the first transmission M1 and the second transmission M2, where the first MAC key (K2) 256 ) is a 256-bit value. Procedure 600 can then proceed to decision block 608.

[0057] In decision block 608, the one or more control units 20 check the data transmitted by transmissions M1, M2, and M3. If it is determined that the data transmitted by transmissions M1, M2, and M3 is valid, procedure 600 can proceed to block 610. Otherwise, procedure 600 can be aborted.

[0058] In block 610, in response to the finding that the data transmitted by transmissions M1, M2 and M3 are valid, the one or more control units 20 extract the new cryptographic key (New Key256). bit ). Procedure 600 can then continue with block 612.

[0059] In block 612, one or more control units 20 send the fourth transmission M4 to the transmitter 22. The fourth transmission M4 is a 256-bit sequence that concatenates the first transmission M1 received by the transmitter 22 and an AES encryption with a symmetric key (M4*). 128) of the freshness counter value (Counter 28 ) in the second transmission M2 under a second encryption key (K3) 128 ). Procedure 600 can then continue with block 614.

[0060] In block 614, one or more control units 20 send the fifth transmission M5 to the transmitter 22. The fifth transmission M5 is a 256-bit message authentication code under the second MAC key (K4). 256 ) of the fourth transmission M4, where the 256-bit message authentication code is derived based on a 256-bit message authentication code function. Procedure 600 can then proceed to block 616.

[0061] In block 616, transmitter 22 receives the fourth transmission M4 and the fifth transmission M5 from one or more control units 20. The procedure 600 can then be continued with block 618.

[0062] In block 618, in response to receiving the fourth transmission M4 and the fifth transmission M5, the transmitter 22 checks the fourth transmission M4 and the fifth transmission M5 to ensure that the one or more control units 20 have the correct version of the new cryptographic key (New Key256). bit have received. Procedure 600 can then be terminated.

[0063] Back to Fig. 3: The individual processing units 50, 52 are located both on one or more control units 20 and on the in Fig.The sender 22 shown in Figure 1 (where the sender 22 is either the computer 24 located in the back office 26 or the one or more trust anchor control units 28) is implemented if the fifth transmission M5 contains a 256-bit message authentication code, or if both the third transmission M3 and the fifth transmission M5 contain 256-bit message authentication codes. Specifically, the individual processing unit 50 is based on the secure hash algorithm 2 (SHA2-256), which generates a 256-bit digest, and includes a cryptographic operation module 54 for computing the HMAC-256() authentication code function. In embodiments where either the KMAC-256() authentication code function or both the HMAC-256() and KMAC-256() authentication code functions are executed, the individual processing unit 52 can be used.The individual processing unit 52 is based on the secure hash algorithm 3 (SHA3-256) which generates a 256-bit digest and includes a cryptographic operation 56A to execute the HMAC-256() authentication code function and a cryptographic operation 56B to execute the KMAC-256() authentication code functions.

[0064] The in the Fig.The cryptographic key update system shown in Figures 1-6 for updating 256-bit cryptographic keys offers various technical effects and advantages. In particular, the disclosed cryptographic key update system provides an approach for updating 256-bit cryptographic keys with 256-bit transport security. The cryptographic key update protocol is backward compatible and can also support updating a 128-bit cryptographic key to a 256-bit cryptographic key. The cryptographic key update system offers an approach for updating current systems based on 128-bit cryptographic keys to meet post-quantum security requirements.

[0065] In another embodiment, as shown in Table 4, the new cryptographic key has an arbitrary bit length greater than 256 bits. Specifically, in one embodiment, the current cryptographic key is a P-bit value, the new cryptographic key is an N-bit value, the value of N is greater than 256 (N>256), and the value of P is less than the value of N. However, it is understood that in an alternative embodiment, both the current cryptographic key and the new cryptographic key are N-bit values. In other words, the current cryptographic key has a bit length that is either less than or equal to the bit length of the new cryptographic key. The cryptographic key update protocol described in Table 4 is backward compatible even when the value of P is less than the value of N (P <N).

[0066] According to Fig.1-2 and Table 4 contain the same data for the first transmission M1 as the embodiment described in Table 1, however, the authentication key (KeyAUTH) is P ) a P-bit value or alternatively an N-bit value (KeyAUTH) N The authentication key (KeyAUTH) P ) can be set to the current cryptographic key that needs to be updated, or to the master key.

[0067] In one embodiment, the second transmission M2 is an (N + B)-bit value, where the value B is an integer and the value N is a multiple of the value B. In one embodiment, for example, the value of B is 128 or B = 128. Although the second transmission M2 is described as having a length of N + B bits, the bit length and content of the second transmission M2 are not limited to the embodiment shown in Table 4, and the second transmission M2 can contain any content, including an encryption of the new cryptographic key, a freshness counter, and other application-dependent parameters. The second transmission M2 is a symmetric key encryption under the cipher key (K1). N ) a concatenation of the majority of parameters and the new cryptographic key (New Key) N bit), where the majority of parameters are the freshness counter value (counter 28), the bitstring flag identifier that encodes a list of operations for which the new cryptographic key can be used (FID5), and the padding (0...0 95 ) includes. Symmetric key encryption is performed using a block cipher with a block size of B bits. In one embodiment, the block cipher is, for example, in Cipher Block Chaining (CBC) mode (BlockCipher). CBC In the embodiment described in Table 4, the encryption key (K1) N ) an N-bit value, the bit string flag identifier a 5-bit value, and the padding a 95-bit value. It should be noted that the bit values ​​described for the bit string flag identifier and the padding are only examples and other bit values ​​can also be used. The transmitter 22 ( Fig. 1) transmits the encryption key (K1) N ) by concatenating the authentication key and the string of constant values ​​(KeyAUTH) P| | KEY_UPDATE_ENC_CST) based on an N-bit compression function 70, which is converted into Fig. 7 is shown and described below.

[0068] As in Fig. As shown in Figure 7, the N-bit compression function 70 receives an input X and determines an output with an N-bit value, where the input X is a concatenation of the authentication key and the bit sequence of constant values ​​(KeyAUTH). P | | KEY_UPDATE_ENC_CST) is, and the output of the encryption keys (K1 NThe input X contains an arbitrary bit length greater than 256 bits. The N-bit compression function 70 comprises n block ciphers E, where each block cipher E has a B-bit block size and a k-bit key size. The key size of each block cipher E is larger than the block size, or k > B. Thus, the number n of block ciphers E is equal to the bit length of the output of the N-bit compression function 70 divided by the block size B of each block cipher E, or n=NB. The input X is divided into a ℓ number of blocks, each containing a t-bit block size, or (X = X1|| ... ||X ℓIn the described embodiment, the value t is equal to 128 bits. However, the value t can also include other values, as long as the value t is smaller than the key size k of the block ciphers E. It should be noted that the N-bit compression function goes through a number of rounds to determine the output with the N-bit value, where the number of rounds is equal to the number of blocks ℓ that divide the input X. Hereinafter, each round is denoted by the value i, where 1 ≤ i ≤ ℓ. The compression function processes one of the ℓ number of blocks of the input X during each round.

[0069] The N-bit compression function 70 receives a first output parameter G. i-1 and a second output parameter (Hi−11,⋯,Hi−1n−1) In round 72, a concatenation block links the input X. i and a hash of the first output parameter (Hi−11,⋯,Hi−1n−1) to generate a corresponding key k i for each block cipher E, or ki=Hash(Hi−11,⋯,Hi−1n−1)‖Xi. It is to be understood that instead of concatenating the input X i with the hash value of the first output parameter (Hi−11,⋯,Hi−1n−1) In another embodiment, concatenation block 72 can replace the hash function with the advanced encryption standard Miyaguchi-Preneel compression function (AES-MP) when the value of k is 256 and the value of t is 128. In another embodiment, when the value of k is 384 and the value of t is 128, concatenation block 72 can replace the hash function with one of the following one-way compression functions: the cryptographic hash function Modification Detection Code 2 (MDC-2), the cryptographic hash function Modification Detection Code 4 (MDC-4), and the Hirose compression function.

[0070] The N-bit compression function first initializes the first output parameter G. i-1 and the second output parameter (Hi−11,⋯,Hi−1n−1) or G0,H01,⋯,H0n−1 or zero. The N-bit compression function iterates a number of rounds (equal to the number of blocks ℓ that divide the input X) to determine the output with the N-bit value. The first output parameter G i in the i th The round of the N-bit compression function is the exclusive-OR (XOR) function of the second output parameter G. i-1 from the previous round of the N-bit compression function and a symmetric key encryption of the first output parameter G i-1 in the previous round of the N-bit compression function under the corresponding key k i or G i = G i-1 ⊕ E(k i , G i-1As mentioned above, the N-bit compression function 70 comprises an n number of block ciphers E, where a first block cipher 74 receives the first output parameter G. i-1 and j represents an index of the remaining part of the block ciphers E encompassed by the N-bit compression function 70, or 1 ≤ j ≤ n - 1. As in Fig. To see 7, receives a n th Block cipher 76 the constant c n-1 For 1 ≤ j ≤ n - 1, the j th first output parameters Hi in the i th Round the N-bit compression function to the exclusive OR function (XOR) of the exclusive OR function (XOR) of the first output parameter G. i-1 , in the previous round of the N-bit compression function and the j th constant c j and a symmetric key encryption of the j th constant c j exclusively or under the corresponding key k i , or Hij=Gi−1⊕cj⊕E(ki,Gi−1⊕cj), for 1 ≤ j ≤ n - 1.

[0071] For each round i, each block cipher E, with the exception of the first block cipher 74, receives the corresponding key k. i and the corresponding plaintext 78, wherein the corresponding plaintext 78 is an output of a corresponding exclusive or function 80 (XOR) of the j th constant c j and the first output parameter G i-1 in the previous round of the N-bit compression function. Each block cipher E, except for the first block cipher 74, determines a ciphertext 82. The ciphertext 82 and the corresponding plaintext 78, which corresponds to each block cipher E except for the first block cipher 74, are combined at an exclusive OR (XOR) function 84 to determine a corresponding output. Hi to determine, where 1 ≤ j ≤ n - 1. The first block cipher 74 receives the corresponding key k. iand plaintext 86, where plaintext 86 is the first output parameter G i-1 the previous round of the N-bit compression function. The first block cipher 74 determines a ciphertext 88. The ciphertext 88 and the plaintext 86 are combined in an exclusive-OR (XOR) function 90 to determine an output G. i In round f, the N-bit compression function concatenates the output of each block cipher E to determine the output with the N-bit value, where the output is expressed as Gl‖Hl1‖⋯‖Hln−1.

[0072] The third transmission M3 is an N-bit message authentication code, based on an N-bit message authentication code function described below, under a first MAC key (K2). N ) the concatenation of the first transmission M1 and the second transmission M2 is calculated, where the first MAC key (K2) N) is an N-bit value. Sender 22 transmits the first MAC key (K2). N ) by using the authentication key (KeyAUTH) P ) and converts the bit sequence of constant values ​​(KEY_UPDATE_ENC_CST) based on the N-bit message authentication code function.

[0073] The N-bit message authentication code function uses the sponge construction and requires two inputs: a MAC key (such as the first MAC key K2). N) and a data payload of arbitrary bit length (i.e., in the present embodiment, the data payload is a concatenation of the first transmission M1 and the second transmission M2). The N-bit message authentication code determines an output bitstream of N-bit length (i.e., the third transmission M3 has a bit length of N). The N-bit message authentication code function includes a capacity c, a rate around a permutation function f. The capacity c of the N-bit message authentication code function is set to twice the bit length of the N-bit message authentication code function, or 2N, to ensure N-bit security.The rate r of the N-bit message authentication code function is set to one of the following values: 1600 minus the capacity c (1600 - c) if the value of N is less than 800 (N < 800), and to a value q ≥ 1 if the value of N is greater than or equal to 800, where q represents the size of the elementary parts of the input data being processed by the N-bit message authentication code function at any given time. The value of q is chosen to balance or optimize two factors. These two factors are the computational requirements f associated with executing the permutation function and the number of times the sender executes the permutation function f during one iteration of the sponge construction.Increasing the value of q leads to an increase in the computational requirements associated with executing the permutation function f, while decreasing the value of q results in the sender 22 executing the permutation function f during one iteration of the sponge construction.

[0074] The permutation function f is set to the Keccak-p permutation with a width of 1600, and the number of internal rounds is set to 24 if the bit length N of the N-bit message authentication code function is less than 800, or (Keccak-p[1600,24]) if N < 800. Otherwise, if the bit length N of the N-bit message authentication code function is equal to or greater than 800, the permutation function f is set to the Keccak-p permutation having a width of capacity c plus rate r or c + r, and the number of internal rounds is set to 12+2log2(c+r25) or (Keccak-p[c+r,12+2log2(c+r25)]).

[0075] The fourth transmission M4 is a (128 + B)-bit string that concatenates the first transmission M1 received by sender 22 and a symmetric key encryption (M4*). N ) of the freshness counter value (Counter 28 ) in the second transmission M2 under the second encryption key (K3) N ) is. The one or more control units 20 conduct the symmetric key encryption (M4*). N ) by changing the freshness counter value (counter 28 ) from the second transmission M2 based on a block cipher under the second encryption key (K3) N ) encrypt. In one embodiment, the block cipher is, for example, in Cipher Block Chaining (CBC) mode (BlockCipher) CBC The one or more control units 20 transmit the second encryption key (K3). N ) by using the new cryptographic key (New Key)N bit ) and the bit sequence of constant values ​​(KEY_UPDATE_ENC_CST) based on the one in Fig. Convert the N-bit compression function shown in Figure 70.

[0076] The fifth transmission M5 is an N-bit message authentication code under a second MAC key (K4). N ) of the fourth transmission M4. In particular, the N-bit message authentication code is derived based on the N-bit message authentication code function. The one or more control units 20 forward the second MAC key (K4). N ) by using the new cryptographic key (New Key) N bit ) and the bit sequence of constant values ​​(KEY_UPDATE_ENC_CST) based on the one in Fig. 7 transform the N-bit compression function shown. Table 4 M1128 bit =ECU_ID || NEW Key Slot ID || Key AUTH Slot ID, wobei KeyAUTH P = Old Key or master key of length P bits M2N+B bit =BlockCipher CBC (K1 N , counter 28 || FID5 || 0 ... 0 95 || New key N bit ), where: BlockCipher has a block size of B bits (e.g., B=128) and a key of N. Bits. For simplicity, we assume that N is a multiple of B. K1 N = N-bitt-COMPRESSION_FUNC(KeyAUTH P || KEY_UPDATE_ENCRYPTION_CONSTANTS) M3N bit = N-bit-MAC-FUNC (K2 N , M1 || M2) where: K2 N = N-bit-COMPRESSION_FUNC (KeyAUTH P || KEY_UPDATE_CMAC_CST) M4128+B bit M1 128 || M4* B Whereby: M4* B = BlockCipher CBC (K3 N , counter), and K3 N = N-bit-COMPRESSION_FUNC(NEW Key N || KEY_UPDATE_ENC_CST) M5N bit = N-bit-MAC-FUNC (K4 N , M4) where: K4 N = N-bitCOMPRESSION_FUNC(NEW Key N || KEY_UPDATE_CMAC_CST),

[0077] Fig.Figure 8 is a representation of two individual processing units 100, 102, which are located on one or more control units 20 as well as on the in Fig. The transmitter 22 shown in Figure 1 is implemented (where the transmitter 22 is either the computer 24 located in the back office 26 or the one or more trust anchor control units 28). The single processing unit 100 is based on the block cipher with a block size of B bits and a key size of N bits and comprises a plurality of cryptographic operation modules 104A-104C that use the block cipher as a subroutine. In particular, cryptographic operation module 104A implements encryption functions, cryptographic operation module 104B implements decoding functions, and cryptographic operation module 104C implements the functions shown in Figure 104A. Fig.Figure 7 shows the N-bit compression function 70. The single processing unit 102 is based on the N-bit message authentication code function, which uses Keccak-p permutations as building blocks, and comprises a plurality of cryptographic operation modules 106A-106B. In particular, cryptographic operation module 106A performs encryption operations and cryptographic operation module 106B performs decryption operations.

[0078] Fig. Figure 9 shows an exemplary process flow diagram illustrating a procedure 900 for updating cryptographic keys based on the embodiment of the cryptographic key update system 12 in Table 4. With reference to the Fig. 1, Fig. 2 and Fig.9 begins the procedure 900 in block 902. In block 902, sender 22 transmits the first transmission M1 to one or more control units 20. Sender 22 determines the first transmission, which is the concatenation of the identifier corresponding to one or more control units 20 (ECU_ID), the slot identifier of the new cryptographic key (NEW Key Slot ID), and the slot identifier of the authentication key (Key). AUTH (Slot ID). Procedure 900 can then proceed to block 904.

[0079] In block 904, the transmitter 22 transmits the second transmission M2 to one or more control units 20, the second transmission being a symmetric key encryption under the encryption key (K1). N ) a concatenation of the majority of parameters and the new cryptographic key (New Key) N bit ). Procedure 900 can then transition to block 906.

[0080] In block 906, the transmitter 22 transmits the third transmission M3 to the one or more control units 20, where the third transmission M3 is an N-bit message authentication code based on the N-bit message authentication code function under the first MAC key (K2). N ) the concatenation of the first transmission M1 and the second transmission M2 is calculated, where the first MAC key (K2) N ) is an N-bit value. Procedure 900 can then proceed to decision block 908.

[0081] In decision block 908, the one or more control units 20 check the data transmitted by transmissions M1, M2, and M3. If the data transmitted by transmissions M1, M2, and M3 is found to be valid, procedure 900 can proceed to block 910. Otherwise, procedure 400 can be aborted.

[0082] In block 910, the one or more control units 20 extract the new cryptographic key (New Key) in response to the finding that the data transmitted by transmissions M1, M2 and M3 are valid. N bit Procedure 900 can then continue with block 912.

[0083] In block 912, one or more control units 20 send the fourth transmission M4 to the transmitter 22. The fourth transmission M4 is a (128 + B)-bit string that concatenates the first transmission M1 received by the transmitter 22 and the symmetric key encryption (M4*). N ) of the freshness counter value (Counter 28 ) in the second transmission M2 under the second encryption key (K3) N ). Procedure 900 can then continue with block 914.

[0084] In block 914, one or more control units 20 send the fifth transmission M5 to the transmitter 22. The fifth transmission M5 is an N-bit message authentication code under a second MAC key (K4). N ) of the fourth transmission M4, where the N-bit message authentication code is derived based on the N-bit message authentication code function. Procedure 900 can then proceed to block 916.

[0085] In block 916, transmitter 22 receives the fourth transmission M4 and the fifth transmission M5 from one or more control units 20. The procedure 900 can then be continued with block 918.

[0086] In block 918, in response to receiving the fourth transmission M4 and the fifth transmission M5, the transmitter 22 checks the fourth transmission M4 and the fifth transmission M5 to ensure that the one or more control units 20 have the correct version of the new cryptographic key (New Key). N bit have received. Procedure 900 can then be terminated.

[0087] With general reference to the Fig.References 1-2 and 7-9 describe the disclosed cryptographic key update system for updating cryptographic keys of arbitrary length with a length greater than 256 bits, offering various technical effects and advantages. In particular, the disclosed cryptographic key update system provides an approach for updating N-bit cryptographic keys with N-bit transport security, where the value of N is greater than 256. It is also commendable that the disclosed cryptographic key update system employs a novel N-bit compression function for determining an N-bit length output, as well as a novel N-bit message authentication code function for computing N-bit message authentication codes.

[0088] The control units can refer to or be part of an electronic circuit, a combinational logic circuit, a field-programmable gate array (FPGA), a (shared, dedicated, or grouped) processor that executes code, or a combination of some or all of the above, such as in a system-on-a-chip. Furthermore, the control units can be based on a microprocessor, such as a computer with at least one processor, memory (RAM and / or ROM), and associated input and output buses. The processor can be under the control of an operating system residing in memory. The operating system can manage the computer's resources so that the processor executes instructions for computer program code embodied as one or more computer software applications, such as an application residing in memory.In an alternative embodiment, the processor can execute the application directly; in this case, the operating system can be omitted.

Claims

[1] Method (400, 500, 600, 900) for updating cryptographic keys to 256-bit cryptographic keys by a cryptographic key update system (12), wherein the method (400, 500, 600, 900) comprises: Transmitted, by means of a transmitter (22), a first transmission (M1) to one or more control units (20) that are part of a vehicle (10); A second transmission (M2) is transmitted by the sender (22) to one or more control units (20), wherein the second transmission (M2) is a symmetric key encryption under a cipher key consisting of a concatenation of a plurality of parameters and a new cryptographic key, and wherein the sender (22) derives the cipher key by transforming an authentication key and a bit sequence of constant values ​​based on a one-way compression function, which is one of the following: a cryptographic hash function with a Modification Detection Code 2 (MDC-2) with a 128-bit Advanced Encryption Standard (AES-128) as the underlying block cipher, a cryptographic hash function with a Modification Detection Code 4 (MDC-4) with the AES-128 as the underlying block cipher, a Hirose compression function with a 256-bit Advanced Encryption Standard (AES-256) as the underlying block cipher, and a 256-bit hash function; Transmitted by the sender (22) a third transmission (M3) to the one or more control units (20), wherein the third transmission (M3) is a 128-bit Advanced Encryption Standard Cipher-based Message Authentication Code under a first Message Authentication Code (MAC) key of a concatenation of the first transmission (M1) and the second transmission (M2); Check, by which one or more control units (20) verify the data transmitted by the first transmission (M1), the second transmission (M2) and the third transmission (M3); in response to the determination by the first transmission (M1) that the second transmission (M2) is valid, extract, by one or more control units (20), the new cryptographic key; and Execute, by means of one or more control units (20), one or more cryptographic validation operations based on the new cryptographic key. [2] The method (400, 500, 600, 900) according to claim 1 further comprises the following: in response to the extraction of the new cryptographic key, the one or more control units (20) calculate a fourth transmission (M4) and a fifth transmission (M5) based on the new cryptographic key. [3] The method (400, 500, 600, 900) according to claim 2 further comprises the following: Transmission of the fourth transmission (M4) to the transmitter (22) by the one or more control units (20), wherein the fourth transmission (M4) is a bit sequence that is a concatenation of the received first transmission (M1) and a symmetric key encryption of a freshness counter value in the second transmission (M2) under a second encryption key and a symmetric key AES encryption. [4] The method (400, 500, 600, 900) according to claim 3 further comprises the following: Deriving the second encryption key by the one or more control units (20) by converting the new cryptographic key and the bit sequence of constant values ​​based on one of the following functions: an advanced Miyaguchi-Preneel compression function and a 128-bit hash function. [5] The method (400, 500, 600, 900) according to claim 3 further comprises the following: Transmission of the fifth transmission (M5) to the sender (22) by the one or more control units (20), wherein the fifth transmission (M5) is a 128-bit message authentication code under a second MAC key of the fourth transmission (M4). [6] The method (400, 500, 600, 900) according to claim 5 further comprises the following: Deriving the second MAC key by the one or more control units (20) by converting the new cryptographic key and the bit sequence of constant values ​​based on one of the following functions: an advanced Miyaguchi-Preneel compression function and a 128-bit hash function. [7] The method (400, 500, 600, 900) according to claim 3 further comprises the following: Transmission of the fifth transmission (M5) to the sender (22) by the one or more control units (20), wherein the fifth transmission (M5) is a 256-bit message authentication code under a second MAC key of the fourth transmission (M4). [8] The method (400, 500, 600, 900) according to claim 7 further comprises the following: Deriving the second MAC key by one or more control units (20) based on one of the following functions: the cryptographic hash function MDC-2 with AES-128 as the underlying block cipher, the cryptographic hash function MDC-4 with AES-128 as the underlying block cipher, and the Hirose compression function with AES-256 as the underlying block cipher. [9] The method (400, 500, 600, 900) according to claim 3 further comprises the following: Receiving the fourth and fifth transmissions (M5) from the one or more control units (20) by the transmitter (22). [10] The method (400, 500, 600, 900) according to claim 3 further comprises the following: In response to receiving the fourth transmission (M4) and the fifth transmission (M5), the sender (22) verifies the fourth transmission (M4) and the fifth transmission (M5) to ensure that the one or more control units (20) have received a correct version of the new cryptographic key.

Images