SECURE KEY DELIVERY

Abstract

Approaches in accordance with various illustrative embodiments provide encryption of communications entering and leaving a device, such as a chip or proprietary bus. The encryption can take place in a central root of trust (RoT), which may include agents for individual communication protocols to generate session keys used to encrypt communications for individual sessions. The data can then be sent to a crypto engine for the respective communication protocol.A key tunneling unit can be used to receive a packaged session key over the public bus and then unpack the key in hardware. The unpacked session key can then be sent to the appropriate crypto engine without exposing the session key to software running on the device outside the RoT. A nonce can be used with a current derivation key from a set of ephemeral keys to generate a new set of ephemeral keys. These new keys are used to perform various cryptographic operations, thus enabling secure rotation of package keys as well as other keys, such as derivation and message keys.