Computer-implemented method for extended key wrapping, computer program and system implementing program instructions (key block extended wrapping)

Abstract

To provide a clear key with an attribute that controls the use of a clear key since the protection of data in encryption depends on the confidentiality of the key.SOLUTION: An extended key wrapping method includes providing a clear key with an attribute that controls the use of the clear key. The clear key includes a wrapping key that wraps key data and the clear key in at least a first 8-byte section and second and third 8-byte sections. The method further includes chaining the first, second, and third 8-byte sections with zeros in those 8-byte sections that are not entered in chained key data, and deriving encryption and authentication keys from the wrapping key, calculating an authentication code for the clear key and the attribute using the authentication key, encrypting the chained key data using the encryption key for the generated encrypted chained key data, adding the authentication code, the attribute and the cryptographic chained key data, and forming a key block.SELECTED DRAWING: Figure 5

Description

[Technical Field]

[0001] The present invention relates to key block expansion wrapping, and more particularly to a key block expansion wrapping method. [Background technology]

[0002] Encryption is the transformation of intelligible information into a clearly unintelligible form in order to hide the information from unauthorized parties. Encryption is used for a variety of purposes, including protecting information transmitted over communications networks. It is also the most economical way to protect data at rest. Cryptographic procedures can be used to protect the privacy of data as well as to protect the integrity of data. The cryptographic transformation of data is usually defined by an algorithm or procedure selected under the control of a key. Summary of the Invention [Problem to be solved by the invention]

[0003] The protection of the transformed or encrypted data depends on the secrecy of the key because the algorithm is public knowledge. Therefore, the key must be kept secret to prevent an adversary from simply using a known algorithm and key to recover the encrypted data. Therefore, the protection of the data depends on the protection of the private key. [Means for solving the problem]

[0004]

[0003] An embodiment of the present invention relates to a computer-implemented method for enhanced key wrapping. A non-limiting example of the computer-implemented method includes providing a clear key with attributes that control its use. The clear key includes key data in at least a first 8-byte section and second and third 8-byte sections, and a wrapping key that wraps the clear key. The computer-implemented method further includes concatenating the first, second, and third 8-byte sections with zeros in those 8-byte sections that are not entered into chained key data, deriving an encryption key and an authentication key from the wrapping key, calculating an authentication code for the clear key and attributes using the authentication key, performing encryption of the chained key data using the encryption key on the generated encrypted chained key data, and appending the authentication code, attributes, and encrypted chained key data to form a key block.

[0005] Other embodiments of the present invention implement features of the above-described methods in computer systems and computer program products.

[0006] Additional technical features and advantages are realized through the techniques of the present invention. Embodiments and aspects of the present invention are described in detail herein and are considered a part of the claimed subject matter. For a better understanding, reference is made to the detailed description and drawings. [Brief explanation of the drawings]

[0007] The particulars of the exclusive rights set forth herein are particularly pointed out and distinctly claimed in the claims at the conclusion of the specification. The above and other features and advantages of embodiments of the present invention will become apparent from the following detailed description taken in conjunction with the accompanying drawings. [Figure 1] 1 illustrates a Common Cryptographic Architecture (CCA) key token and an AES key wrapping (AESKW) key token for Advanced Encryption Standard (AES) key wrapping for CCA key tokens, according to one or more embodiments of the present invention. [Figure 2]1 illustrates a system for key wrapping for CCA key tokens in accordance with one or more embodiments of the present invention. [Figure 3A] 1 illustrates an AESKW wrapping and unwrapping function system for AES key wrapping for CCA key tokens in accordance with one or more embodiments of the present invention. [Figure 3B] 1 illustrates an AESKW wrapping and unwrapping function system for AES key wrapping for CCA key tokens in accordance with one or more embodiments of the present invention. [Figure 4] 1 is a graphical flowchart illustrating a method for extended key wrapping in accordance with one or more embodiments of the present invention. [Figure 5] 1 is a flowchart illustrating a method for expanded key wrapping in accordance with one or more embodiments of the present invention. [Figure 6] 1 is a flowchart illustrating a method for expanded key unwrapping in accordance with one or more embodiments of the present invention. [Figure 7] 1 illustrates a computer system for implementing one or more embodiments of the present invention. DETAILED DESCRIPTION OF THE INVENTION

[0008] The diagrams shown herein are exemplary. There may be many variations to the diagrams or the operations described therein without departing from the spirit of the invention. For example, operations may be performed in a different order, or operations may be added, deleted, or modified. Additionally, the term "coupled" and variations thereof describe having a communication path between two elements, and do not imply a direct connection between the elements with no intervening elements / connections between them. All of these variations are considered part of this specification.

[0009] One or more embodiments of the present invention provide a system in which the key block and wrapping method are enhanced with an integrity check and key obfuscation. The integrity check includes offsetting a 64-byte structure with an 8-byte triple data encryption standard cipher-based message authentication code (TDES-CMAC). The key obfuscation is characterized in that all three sections of the key block used to store 8-byte sections of encrypted key material are always filled with encrypted data, thereby hiding the actual length of the key. The wrapping method is characterized in that the control vector is no longer XORed into the wrapping key; a CMAC is calculated over all bytes of the key block using clear key material as an integrity check and then placed at offset 40; the three sections of the key are chained together using SHA-256 and XOR; the three sections of the key are always encrypted and then always placed back into the token using 24 bytes of space.

[0010] By review, a control vector is a data structure containing one or more fields of predefined values ​​that collectively describe the intended use of the cryptographic key with which it is associated. The control vector is specified by the key creator when the key is created. In Common Cryptographic Architecture (CCA) key tokens, key attributes are stored in an unencrypted control vector. A CCA key can be wrapped using a different type of encryption, such as AES Key Wrapping (AESKW), to generate an AESKW key token that holds the CCA key and its attributes. AESKW is defined in the American National Standards Institute (ANSI) standard X9.102. In the resulting AESKW key token, some attributes that are not encrypted in the control vector portion of the CCA key token are moved to the encrypted portion of the AESKW key token. These attributes are split from the control vector so that some attributes of the control vector are bound to the key but not encrypted, and other attributes are encrypted along with the key itself. In various embodiments, any suitable type of encryption can be used to wrap the CCA key.

[0011] Typically, keys are encrypted when outside a protected environment. The encrypted key is transmitted in a protected data structure called a key token or key block (hereafter referred to as a key token). An AESKW key token has two sections: key data and attributes. The key data is encrypted to keep the key secret. The attributes are cryptographically bound to the key to protect it from modification, but are not encrypted and do not need to be kept secret. A CCA key token contains a bound but unencrypted control vector, a flags section that is neither encrypted nor bound, and the encrypted key data.

[0012] In various embodiments, conventional CCA keys, which may include Data Encryption Standard (DES) keys or double- or triple-length Triple DES (TDES) keys, can be exported to AES-protected tokens for transport, and the AES-protected tokens can be imported into TDES format for use by the receiving system. The CCA keys of the receiving system correspond to the CCA keys of the sending system. The key and attributes of the CCA keys of the importing system may be the same as those of the exporting system, except for system-dependent values. When encrypting using symmetric key techniques, CCA keys are encrypted using other CCA keys. This CCA key is known as a Key Encryption Key (KEK). However, because the AES encryption algorithm is stronger than TDES, wrapping conventional CCA keys in an AES KEK can enhance the security of the CCA keys.

[0013] For DES or TDES keys, the control vector is a sequence of bits the same length as the key itself. For example, it can be 8 or 16 bytes. For example, in a 16-byte control vector, the second 8 bytes are the same as the first 8 bytes, except for a field called the key form field, which indicates that this is the second part of a double-length (16-byte) control vector. The control vector consists of many bit fields of various lengths. Each bit field contains a value that indicates an attribute of the key, and the control vector fields are checked by the CCA firmware to determine whether the key can be used for the requested operation. Many bits in the control vector are polymorphic, meaning their definition changes depending on the overall type of key, indicated by fixed-definition fields in the control vector. The control vector for a CCA key can encode various types of information, such as key length, key type, and subtype. This information defines the operations the key can be used for, such as encrypting / decrypting data, calculating / verifying message authentication codes, encrypting other keys (KEKs), protecting financial identification numbers (PINs), deriving other keys, or calculating or combining credit card verification values. The export control field in the control vector indicates whether the key can be exported to another system. For most key types, the control vector also contains one or more fields that indicate the particular low-level operations the key can be used for, or the particular data formats the key can be used in. The key length may be indicated by a 3-bit key format field in the control vector of the CCA token.

[0014] The AESKW process encrypts the key it wraps but does not encrypt the key's associated data. While the associated data is encrypted and bound to the key so that changes can be detected, it is transported with the key in cleartext (unencrypted) form. Therefore, the associated data does not contain any information that could compromise security if its value were disclosed. Attributes that are harmless if viewed in cleartext (and in some cases must be viewed without decrypting the key token) are carried in the associated data, while attributes that must be kept secret for security reasons are carried in the encrypted payload. During wrapping of a CCA key in AESKW format, an indication of the key length is moved from the cleartext control vector in the CCA token and placed in the encrypted payload of the AESKW token. This allows the strength of the encryption key to be hidden when the key is in encrypted token form. Because short keys are easier to attack, knowing the key length helps an attacker identify the easiest keys to attempt to break.

[0015] Referring to Figure 1, a CCA key token 100 and an AES KW key token 104 for AES key wrapping for a CCA key are shown. In various embodiments, the CCA key token 100 can contain a DES or TDES key and includes key data 101, a control vector 102, and a flag 103. The key data 101 is encrypted for storing and transporting the key data 101 to keep it secret, but is not encrypted when the CCA key token 100 is stored in a secure system such as a hardware security module (HSM). The control vector 102 holds additional attributes and information about the key in the key data 101 within the CCA key token 100 and is not encrypted for transport, but is bound to the CCA key token 100 to protect the data in the control vector 102 from modification. Control vector 102 is comprised of a first set of fields, CV1 102A, which are security-critical, must be kept secret, and may contain the key length, and a second set of fields, CV2 102B, which are security-critical, must be protected from modification, but do not need to be kept secret. Flags 103 are not encrypted or bound and hold non-security-critical information about CCA key token 100. AESKW key token 104 contains and is encrypted cryptographic key data 105, which holds the key itself in addition to other information about the key. Associated data 106 is bound to AESKW key token 104 but is not encrypted. To wrap CCA key token 100 with AES, key data 101 is encrypted using AES in cryptographic key data 105. The CV1 102A field in control vector 102 may contain, for example, a key length indicator for CCA key token 100, encrypted by key data 101 in cryptographic key data 105. The CV2 102B field in the control vector 102 is used to create bound but unencrypted associated data 106. Additionally, the unbound flag 103 in the CCA key token 100 is bound to the AESKW key token in the associated data 106.CV2 102B and flags 103 may, in some embodiments, be transmitted from the exporting system to the importing system separately from the AESKW key token 104. In various embodiments, any suitable fields from the control vector 102 may be included in CV1 102A or CV2 102B.

[0016] Additional layout information is available for some embodiments of key data 101, control vectors 102, flags 103, cryptographic key data 105, and associated data 106. Flags 103 may be 1 byte in size, and therefore, in some embodiments, eight 1-bit flags can be supported.

[0017] FIG. 2 illustrates an embodiment of a system 200 for AES key wrapping for a CCA key token. System 200 includes an export system 201 and an import system 206, each of which may include, for example, any suitable type of computer system including a processor and memory. A CCA key token 202A, including the fields shown for CCA key token 100 of FIG. 1 and including a control vector such as control vector 102, is stored in an HSM 207 on export system 201. To export CCA key token 202A, export system 201 wraps CCA key token 202A using key export function 203 located in HSM 207 and described in further detail below with respect to FIG. 3(A) to generate an AESKW key token 204. The AESKW key token 204 is encrypted for transport, includes the fields shown for AESKW key token 104 of FIG. 1, and is sent to import system 206 over network 209. Network 209 may be any type of connection between export system 201 and import system 206. The AESKW key token 204 is received by the import system 206 via network 209. The import system 206 uses key import functionality 205, located in the HSM 208 and described in further detail below with respect to FIG. 3(B), to unwrap the AESKW key token 204 and generate a CCA key token 202B for use by the import system 206. The CCA key token 202B on the import system 206 is securely stored in the HSM 208 in some embodiments and corresponds to the CCA key token 202A on the export system 201. In other embodiments, the CCA key token 202B is encrypted and stored at the import system 206 outside of the HSM 208. The CCA key token 202B can be used, for example, for communications between the export system 201 and the import system 206, or for verifying sensitive data such as a personal identification number (PIN) on the import system 206.

[0018] FIG. 3(A) illustrates an embodiment of a key export function 300A, which may include the key export function 203 of FIG. 2, and is described with reference to FIGS. 1 and 2. The key export function 300A, in some embodiments, may be implemented in the HSM 207 within the export system 201. The key export function 300A receives unencrypted key data 101 and CV1 102A from the control vector 102 within the CCA key token 100 / 202 as key and CV1 303. CV2 102B and flags 103 are received by the key export function 300A as CV2 and flags 301, and a hash of CV2 and flags 301 is input from hash function 302 to AESKW wrap 304. In some embodiments, hash function 302 may compress CV2 and flags 301 using a Secure Hash Algorithm (SHA)-256 hash function to provide a value that is short enough for input to AESKW wrap 304. In some embodiments, hash function 302 can be omitted, and CV2 and flag 301 can be input directly into AESKW wrap 304 to generate associated data 106. Key and CV1 303 are encrypted by AESKW wrap 304 using AES KEK 305 to generate cryptographic key data 105 in wrapped key block 306, which includes AESKW key token 104, shown in FIG. 1 . CV2 and flag 301 are not encrypted, but a hash of CV2 and flag 301 is included in wrapped key block 306 as associated data 106. CV2 and flag 301 are also bound to wrapped key block 306 by including binding information in wrapped key block 306. CV2 and flag 301 are also sent, along with wrapped key block 306, as unencrypted plaintext from export system 201 to import system 206. The binding of CV2 and flags 301 to wrapped key block 306 ensures that any changes in CV2 and flags 301 that may have occurred, for example, during transmission, are detected.

[0019] FIG. 3(B) illustrates an embodiment of a key import function 300B, which may include the key import function 205 of FIG. 2, and is described with reference to FIGS. 1 and 2. In some embodiments, the key import function 300B may be implemented in the HSM 208 within the import system 206. The key import function 300B receives the AESKW key token 104 / 204 containing the wrapped key block 306 and a plaintext CV2 and flags 301 containing the associated data 106. The CV2 and flags 301 are hashed using a hash function 307 and input to the AESKW unwrap 308 along with the wrapped key block 306. The hash function 307 may be omitted, and the CV2 and flags 301 may be input directly to the AESKW unwrap 308. The wrapped key block 306 is decrypted by the AESKW unwrap 308 using the AES KEK 309 and output as the key and CV1 303. AESKW unwrap 308 also determines whether CV2 and flags 301 have been altered during transport based on a hash of CV2 and flags 301 and the binding information included in wrapped key block 306. If it is determined that CV2 and flags 301 have not been altered, a valid flag is output at valid / invalid output 310, and the received key is used on import system 206; otherwise, an invalid flag is output at valid / invalid output 310, and the received key is not used. In some embodiments, AESKW unwrap 308 may not output key and CV1 303 based on the invalid flag. The key portion of key and CV1 303 includes unencrypted key data 101 of FIG. 1. CV1 (of key and CV1 303) and CV2 (of CV2 and flags 301) together include control vector 102 of FIG. 1, and the flag of CV2 and flags 301 includes flag 103 of CCA key token 100 / 202.

[0020] In some cases, the CV lacks integrity protection and the key length cannot be obfuscated.

[0021] One or more embodiments of the present invention address one or more of the above-mentioned shortcomings of the prior art by providing an enhanced key wrapping (WRAPENH3) method that provides CV and key length obfuscation integrity protection.

[0022] The following sections refer to the DES key token structure shown in the WRAPENH3 update. TIFF0007764094000001.tif245170TIFF0007764094000002.tif242170TIFF0007764094000003.tif241170TIFF0007764094000004.tif154170

[0023] CCA encryption commands form a complete, consistent, and secure set of commands that run within tamper-resistant hardware. The encryption commands use a set of different DES key types to provide a secure encryption system that blocks many attacks directed against it. CCA implementations use control vectors to separate fixed-length DES keys into different key types and further restrict key usage. The control vector is a non-secret value that is transmitted in cleartext along with the encryption key specified in the DES / TDES key token.

[0024] The CV is cryptographically associated with the DES / TDES key through the key block wrapping method, which permanently binds the CV to the key wrapped in the key block. Any modification of the original control vector will result in an error being returned by the integrity check process of the unwrapping process.

[0025] After the DES key is encrypted, the key creator can ensure that the key's intended use is preserved by implementing CCA control vector design and only giving key-encrypting keys to systems controlled by an auditing organization.

[0026] Check the DES control vector before processing the encryption command.

[0027] Before a CCA encryption function processes a command that uses a DES / TDES key, the function's logic checks the control vector associated with the key. The control vector must indicate a valid key type for the requested command, and the control vector restriction (key usage) bits must be set appropriately for the command. If the command allows use of the control vector, the encryption function unwraps the key and uses it to process the command.

[0028] For the purposes mentioned above, the control vector has sections for general key management, and key type and key usage control. For general key management, these bytes have control bits that apply to multiple key types, such as key import / export. For key type and key usage control, these bytes indicate the services and operations for which the key can be used.

[0029] General Key Management CV Byte

[0030] The XPRTCPAC bit (bit 59) controls the export of TDEA keys using intra-system services and is set to "0" by default, disallowing export. Note the "Byte 0...Byte 7" numbering at the top. The breakdown of each byte for key type and usage is generally as follows: byte 0 contains the calculation / method bits applicable to a particular key type, byte 1 contains the key type and subtype, and byte 2 contains the usage or service control bits along with export control. Also, bits 16-22 and 33-37 generally have different meanings for different key classes.

[0031] Key type / Key usage CV bytes

[0032] The following table shows the default CV byte settings for key types when generated or imported, with the left and right halves depicted: TIFF0007764094000005.tif244150TIFF0007764094000006.tif177150

[0033] Wrapping Operations

[0034] Referring to Figure 4, the WRAPENH3 process includes the following operations: key data chaining (1), wrapping key derivation (2), TDES-CMAC key derivation (3), TDES-CMAC calculation (4), and CBC encryption of the key (5). The wrapping key and TDES-CMAC key derivation operations use unique 16 labels as input to the key derivation functions. Key data chaining uses SHA-256 as the hash function for WRAPENH3. The TDES-CMAC calculation includes calculating the TDES-CMAC on the complete key block using the derived CMAC key placed in the CV2 field.

[0035] Chaining of key data in operation (1) in Figure 4.

[0036] The key to be wrapped (*K) is chained from right to left to create the chained wrapped key (*KC). 1. Processing a. Keys are always wrapped as 168-bit keys. i. Keys shorter than 168 bits are padded on the right with 0x00 bytes. b.K3C=K3 c.K2C=K2^hash(K3) i. Ensure that the parity of K2 and K3 is adjusted. d.K1C=K1^hash(K2) i. Ensure that the parity of K1 is adjusted. e.*KC=K1C||K2C||K3C 2. Where: a.^ means bitwise exclusive OR. b.|| means concatenation. c.hash is an algorithm-dependent hash function. i.WRAPENH3: hash=SHA-256

[0037] The wrapping key derivation in operation (2) in Figure 4.

[0038] The derived wrapping key is input to the wrapping process used for the target key token. The derived wrapping key is derived by a derivation process that uses a 16-byte string that is unique to the key hierarchy implemented. For WRAPENH3, the wrapping key derivation label is a unique 16-byte label. The key is derived using the method defined in the National Institute of Standards and Technology (NIST) standard SP800-108, "Recommendation for Key Derivation Using Pseudorandom Functions" (October 2009). The derivation uses a method called KDF in counter mode, using the pseudorandom function (PRF) HMAC-SHA256. The (PRF) HMAC-SHA256 algorithm provides sufficient strength for deriving keys for any algorithm used. The HMAC algorithm is defined as follows: TIFF0007764094000007.tif6134b. Where: iH is an approved hash function. ii.K is a secret key shared between the creator and the intended recipient. iii. K0 is the key K after any preprocessing necessary to form a key of the appropriate length. iv.ipad is the constant X'36' repeated to form a string of the same length as K0. v.opad is the constant X'5C' repeated to form a string of the same length as K0. text is the text to be hashed. vi.|| means concatenation. vii.XOR means bitwise exclusive OR. c. If the length of the key K is equal to the input block size of the hash function (512 bits for SHA-256), then K0 is set to the value of K. Otherwise, K0 is formed from K by hashing or padding.

[0039] The NIST Key Derivation Function (KDF) specification requires input to include an optional two-byte string called a label and a context. The context is not used. This label string does not need to be of any particular minimum size, since the security of the derivation process is based on the security of the derived key and the HMAC and key derivation function (KDF) itself. The label is followed by a separation indicator byte of X'00' as specified in the NIST document. a. The label used is specific to the wrapping method used on the token. b. The parameters of the counter mode KDF defined in NIST standard SP800-108 are: i. Fixed Value: 1.h PRF output length, 256 bits. 2.r Counter length, in bits, 32. The counter is an unsigned 4-byte value. ii. Input: 1. KI (Input Key) - The key from which it is derived. This is the Input Master Key or KEK. 2. Labels - Map to KDF values ​​as above. 3. Separator byte - X'00' following the label value. 4. Context - Null string. No context is used. 5. L - The length of the derived key to be generated, rounded up to the next multiple of 256. 6. PRF‐HMAC-SHA256.

[0040] TDES-CMAC in operation (3) of Figure 4.

[0041] The derived TDES-CMAC key is used to create a TDES-CMAC on the target key token. This operation is identical to WRAPENH3 "Derive Wrapping Key" except for the derivation label. The wrapping key and the TDES-CMAC key cannot be related except by an irreversible process. The derivation process uses a 16-byte string that is unique to the implemented key hierarchy. For WRAPENH3, the TDES-CMAC key derivation label is a unique 16-byte label.

[0042] TDES-CMAC calculation in operation (4) in Figure 4.

[0043] The TDES-CMAC is calculated on the completed key block and placed in the CV2 location (offset 40). The process is as follows: 1. Fill in the key block with the following: a. Reference Value: i.tokenFlag, ii.reserved1, iii.Oldmkvp, iv.version(0x00), v.reserved2, vi.flags, vii.mkvp, b. Set to 0x00. i.CV2 / CMAC field ii. tokenmarks, iii.tvv c.flags2 has "3" in bits 0-2, binary "011", and 0b0 in the remaining bits. d.CV1 is in place, but the key form is set to "011" in all cases. e. The clear key value is: i.K1, ii. K2 in position K2 (or a zero byte for single-length keys) 1. When storing double-length keys, do not set K2 = K1. This weakens the key because K1 and K2 cancel each other out, turning what appears to be a double-length key into an actual single-length key. iii. K3 in position K3 (or a zero byte for single-length or double-length keys) 2. Calculate the 8-byte TDES-CMAC for all key blocks using the CMAC key derived from the "Derive TDES-CMAC Key" step. 3. Enter the 8-byte TDES-CMAC in the CV2 field.

[0044] CBC encryption of the key in operation (5) in Figure 4.

[0045] Encryption of the wrapped key proceeds with *KEKC and *K as follows: TIFF0007764094000008.tif5129 where, 1.K1C, K2C, K3C are the modified sections of *KC from the "Chaining Key Data" step. 2.KEK1, KEK2, and KEK3 are sections of the *KEK output from the "wrapping key derivation" step. a.*KEK does not have any XOR of its contents and no key variants are created for use as wrapping keys. b. In the case of 112-bit*KEKs, KEK1 is used for KEK3. 3. || means concatenation. 4. ecbc means encryption using cipher block chaining mode. 5.dcbc means decryption using cipher block chaining mode. 6.8 bytes of 0x00 are used as the initialization vector for encryption.

[0046] Referring to Figure 5, a method for enhanced key wrapping is provided, comprising providing a clear key (501) with attributes that control use of the clear key. The clear key includes key data in at least a first 8-byte section, second and third 8-byte sections, with or without key data entered, and a wrapping key that wraps the clear key. The method further comprises concatenating the first, second and third 8-byte sections with zeros for those 8-byte sections not entered into chained key data (502), deriving an encryption key and an authentication key from the wrapping key (503), calculating an authentication code for the clear key and attributes using the authentication key (504), performing encryption on the generated encrypted chained key data using the encryption key (505), and adding the authentication code, attributes and encrypted chained key data to form a key block (506).

[0047] According to one or more embodiments of the present invention, the attributes may include a set of attributes that control how the clear key is used. The wrapping key may be derived using at least one of a pseudorandom function (PRF) algorithm and a key derivation function (KDF) algorithm. The authentication code may be a triple data encryption standard (TDES-CMAC) based message authentication code, and the encryption may include cipher block chaining (CBC) encryption.

[0048] Referring to Figure 6, according to a further embodiment of the present invention, the method may further include unwrapping the key block. As shown in Figure 6, unwrapping the key block includes providing an unwrapping key based on the wrapping key for unwrapping the key block (601), deriving a decryption key and an authentication key from the unwrapping key (602), decrypting the encrypted chained key data using the decryption key to generate chained key data (603), unchaining the chained key data to generate key data (604), and calculating an authentication code for the key data and attributes using the authentication key (605). The unwrapping of this method may also include verifying that the authentication code matches the authentication code of the key block (606), and returning an error if the authentication code does not match the authentication code of the key block (607).

[0049] Referring to Figure 7, a computer system 700 for enhanced key wrapping is shown. The methods described herein can be implemented in hardware, software (e.g., firmware), or a combination thereof. In an exemplary embodiment, the methods described herein are implemented in hardware as part of a microprocessor of a special-purpose or general-purpose digital computer, such as a personal computer, workstation, minicomputer, or mainframe computer. Thus, system 700 may include a general-purpose computer or mainframe capable of simultaneously running multiple instances of an O / S.

[0050] With respect to the hardware architecture, as shown in FIG. 7 , in an exemplary embodiment, a computer includes one or more processors 705, memory 710 coupled to a memory controller 715, and one or more input and / or output (I / O) devices 740, 745 (or peripherals) communicatively coupled via a local input / output controller 735. The input / output controller 735 may be, for example, but not limited to, one or more buses or other wired or wireless connections as known in the art. The input / output controller 735 may have additional elements, omitted for simplicity, such as controllers, buffers (caches), drivers, repeaters, and receivers to enable communication. Furthermore, the local interface may include address, controller, and / or data connections to enable appropriate communication between the aforementioned components. The input / output controller 735 may include multiple sub-channels configured to access the output devices 740 and 745. The sub-channels may include fiber optic communication ports.

[0051] Processor 705 is a hardware device for executing software, particularly software stored in storage 720, such as cache storage or memory 710. Processor 705 may be any custom-made or commercially available processor, a central processing unit (CPU), a coprocessor among several processors associated with a computer, a semiconductor-based microprocessor (in the form of a microchip or chipset), a microprocessor, or generally any device for executing instructions.

[0052] The memory 710 can include any one or combination of volatile memory elements (e.g., random access memory (RAM, e.g., DRAM, SRAM, SDRAM, etc.)) and non-volatile memory elements (e.g., ROM, erasable programmable read-only memory (EPROM), electronically erasable programmable read-only memory (EEPROM), programmable read-only memory (PROM), tape, compact disc read-only memory (CD-ROM), disk, diskette, cartridge, cassette, etc.). Furthermore, the memory 710 can incorporate electronic, magnetic, optical, or other types or combinations of storage media. It should be noted that the memory 710 may have a distributed architecture in which various components are located remotely from each other, yet can be accessed by the processor 705.

[0053] The instructions in memory 710 may include one or more separate programs, each of which may include an ordered list of executable instructions for implementing a logical function. In the example of Figure 7, the instructions in memory 710 form a suitable operating system (OS) 711. The operating system 711 essentially controls the execution of other computer programs and provides scheduling, input / output control, file and data management, memory management, and communication control and related services.

[0054] Memory 710 may include multiple logical partitions (LPARs), each running an instance of an operating system. The LPARs may be managed by a hypervisor, which may be a program stored in memory 710 and executed by processor 705.

[0055] In an exemplary embodiment, a conventional keyboard 750 and mouse 755 may be coupled to the input / output controller 735. Other output devices, such as I / O devices 740, 745, may include input devices such as, but not limited to, printers, scanners, microphones, etc. Finally, I / O devices 740, 745 may include devices for communicating both input and output, such as network interface cards (NICs) or modulators / demodulators (for accessing other files, devices, systems, or networks), radio frequency (RF) or other transceivers, telephone interfaces, bridges, routers, etc. System 700 may further include a display controller 725 coupled to a display 730. In an exemplary embodiment, system 700 may further include a network interface 760 for coupling to a network 765. Network 765 may be an IP-based network for communication between the computer and any external servers, such as clients, via a broadband connection. Network 765 transmits and receives data between the computer and external systems. In an exemplary embodiment, network 765 may be a managed IP network managed by a service provider. Network 765 may be implemented in a wireless manner using wireless protocols and technologies such as, for example, WiFi, WiMax, etc. Network 765 may also be a packet-switched network such as a local area network, a wide area network, a metropolitan area network, an Internet network, or other similar type of network environment. Network 765 may be a fixed wireless network, a wireless local area network (LAN), a wireless wide area network (WAN), a personal area network (PAN), a virtual private network (VPN), an intranet, or other suitable network system and includes equipment for transmitting and receiving signals.

[0056] If the computer is a PC, workstation, intelligent device, etc., the instructions in memory 710 may further include a basic input / output system (BIOS) (omitted from the diagram for simplicity). The BIOS is a set of essential software routines that initializes and tests hardware at startup, starts the OS 711, and supports data transfers between hardware devices. The BIOS is stored in ROM so that the BIOS can be executed when the computer starts up.

[0057] When the computer is operating, the processor 705 is configured to execute instructions stored in the memory 710, to communicate data to and from the memory 710, and generally to control the operation of the computer in accordance with the instructions.

[0058] Various embodiments of the present invention are described herein with reference to the associated drawings. Alternate embodiments of the present invention may be devised without departing from the scope of the present invention. In the following description and in the drawings, various connections and relationships (e.g., above, below, adjacent, etc.) between elements are shown. These connections and / or relationships may be direct or indirect unless otherwise specified, and the present invention is not intended to be limited in this respect. Thus, coupling of entities may refer to either direct or indirect coupling, and relationships between entities may be direct or indirect. Furthermore, various tasks and process steps described herein may be combined into a more comprehensive procedure or process having additional steps or functions not specifically described herein.

[0059] One or more of the methods described herein can be implemented with any one or combination of the following technologies known in the art: discrete logic circuits having logic gates for implementing logic functions on data signals, application specific integrated circuits (ASICs) having appropriate combinations of logic gates, programmable gate arrays (PGAs), field programmable gate arrays (FPGAs), etc.

[0060] For the sake of brevity, conventional techniques related to making and using aspects of the present invention may or may not be described in detail herein. In particular, various aspects of computing systems and specific computer programs for implementing various technical features described herein are well known. Thus, for the sake of brevity, many conventional implementation details are only briefly mentioned herein or are omitted entirely without providing details of well-known systems and / or processes.

[0061] In some embodiments, various functions or operations may be performed at a given location, or in conjunction with the operation of one or more devices or systems, or both. In some embodiments, a portion of a given function or operation may be performed at a first device or location, and the remainder of the function or operation may be performed at one or more additional devices or locations.

[0062] The terminology used herein is for the purpose of describing particular embodiments only and is not intended to be limiting. As used herein, the singular forms "a," "an," and "the" are intended to include the plural forms as well, unless the context clearly dictates otherwise. As used herein, the term "comprises" and / or "comprising" specifies the presence of stated features, integers, steps, operations, elements, or components, or combinations thereof, but does not exclude the presence or addition of one or more other features, integers, steps, operations, element components, or groups or combinations thereof.

[0063] All corresponding structure, material, acts, and all equivalent means or step-plus-function elements in the following claims are intended to include any structure, material, or act for performing a function in combination with other claimed elements, as specifically claimed. This disclosure has been presented for purposes of illustration and description, but is not intended to be exhaustive or limited to the precise form disclosed. Many modifications and variations will be apparent to those skilled in the art without departing from the scope and spirit of the disclosure. The embodiments were chosen and described to best explain the principles and practical applications of the disclosure and to enable those skilled in the art to understand the disclosure in various embodiments with various modifications suitable for the particular use contemplated.

[0064] The diagrams shown herein are exemplary. There may be many variations to the diagrams or the steps (or operations) described therein without departing from the spirit of the disclosure. For example, operations may be performed in a different order, or operations may be added, deleted, or modified. Also, the term "coupled" describes having a signal path between two elements and does not imply a direct connection between elements with no intervening elements / connections between them. All of these variations are considered part of the disclosure.

[0065] The following definitions and abbreviations will be used in interpreting the claims and the specification. As used herein, "comprises," "comprising," "includes," "including," "has," "having," "contains," "containing," or any other variation thereof, is intended to cover an exclusive inclusion. For example, a composition, mixture, process, method, article, or device that includes a list of elements is not necessarily limited to only those elements, but can include other elements not expressly listed or inherent in such composition, mixture, process, method, article, or device.

[0066] Additionally, the term "exemplary" is used herein to mean "serving as an example, instance, or illustration." Any embodiment or design described herein as "exemplary" is not necessarily to be construed as preferred or advantageous over other embodiments or designs. The terms "at least one" and "one or more" are understood to include one or more, i.e., any integer number such as 1, 2, 3, 4, etc. The term "plurality" is understood to include two or more, i.e., any integer number such as 2, 3, 4, 5, etc. The term "connected" can include both an indirect and a direct "connection."

[0067] The terms "about," "substantially," "approximately," and variations thereof are intended to include the degree of error associated with measurement of a particular quantity based on equipment available at the time of filing. For example, "about" can include a range of ±8%, 5%, or 2% of a particular value.

[0068] The present invention may be a system, method, or computer program product, or combination thereof, integrated at any possible level of technical detail. The computer program product may include a computer-readable storage medium having stored thereon computer-readable program instructions for causing a processor to carry out aspects of the present invention.

[0069] A computer-readable storage medium may be a tangible device capable of retaining and storing instructions for use by an instruction execution device. The computer-readable storage medium may be, by way of example, an electronic storage device, a magnetic storage device, an optical storage device, an electromagnetic storage device, a semiconductor storage device, or a suitable combination thereof. More specific examples of computer-readable storage media include portable computer diskettes, hard disks, RAM, ROM, EPROM (or flash memory), SRAM, CD-ROMs, DVDs, memory sticks, floppy disks, mechanically encoded devices having instructions recorded on punch cards or ridge-in-groove structures, or the like, and suitable combinations thereof. Computer-readable storage devices, as used herein, should not be construed as ephemeral signals per se, such as radio waves or other freely propagating electromagnetic waves, electromagnetic waves propagating through a waveguide or other transmission medium (e.g., light pulses passing through a fiber optic cable), or electrical signals transmitted over wires.

[0070] The computer-readable program instructions described herein can be downloaded from a computer-readable storage medium to each computer / processing device. Alternatively, they can be downloaded to an external computer or external storage device via a network (e.g., the Internet, a LAN, a WAN, or a wireless network, or a combination thereof). The network can include copper transmission cables, optical fiber transmissions, wireless transmissions, routers, firewalls, switches, gateway computers, or edge servers, or a combination thereof. A network adapter card or network interface within each computer / processing device receives the computer-readable program instructions from the network and transfers the computer-readable program instructions to a computer-readable storage medium in the respective computer / processing device for storage.

[0071] The computer-readable program instructions for carrying out the operations of the present invention can be either assembler instructions, instruction set architecture (ISA) instructions, machine instructions, machine-dependent instructions, microcode, firmware instructions, state setting data, configuration data for integrated circuits, or source or object code written in any combination of one or more programming languages, including object-oriented programming languages ​​such as Smalltalk and C++, and procedural programming languages ​​such as the "C" programming language and similar programming languages. The computer-readable program instructions can execute entirely on the user's computer as a stand-alone software package, partially on the user's computer, partially on the user's computer and partially on a remote computer, or entirely on a remote computer or server. In the latter case, the remote computer may be connected to the user's computer via any type of network, including a LAN or WAN, or may be connected to an external computer (e.g., via the Internet using an Internet Service Provider). In some embodiments, electronic circuitry, including, for example, programmable logic circuits, field programmable gate arrays (FPGAs), programmable logic arrays (PLAs), can execute computer-readable program instructions by utilizing state information of the computer-readable program instructions to customize the electronic circuitry for carrying out aspects of the present invention.

[0072] Aspects of the present invention are described herein with reference to flowchart and / or block diagrams of methods, apparatus (systems), and computer program products according to embodiments of the invention. Each block of the flowchart and / or block diagrams, and combinations of blocks in the flowchart and / or block diagrams, can be implemented by computer-readable program instructions.

[0073] The computer-readable program instructions may be provided to a processor of a general-purpose computer, special-purpose computer, or other programmable data processing apparatus to produce a machine, whereby the instructions, executed by the processor of such computer or other programmable data processing apparatus, create means for performing the functions / acts specified in one or more blocks of the flowcharts and / or block diagrams. The computer-readable program instructions may also be stored on a computer-readable storage medium that can instruct a computer, programmable data processing apparatus, or other device, or combination thereof, to function in a particular manner. The computer-readable storage medium having the instructions stored thereon thereby constitutes an article of manufacture including instructions for performing aspects of the functions / acts specified in one or more blocks of the flowcharts and / or block diagrams.

[0074] Computer-readable program instructions may also be loaded into a computer, other programmable device, or other device and a series of operational steps executed on the computer, other programmable device, or other device to create a computer-implemented process, whereby the instructions executing on the computer, other programmable device, or other device perform the functions / operations identified in one or more blocks in the flowcharts and / or block diagrams.

[0075] The flowcharts and block diagrams in the figures of this disclosure illustrate the architecture, functionality, and operation of possible implementations of systems, methods, and computer program products according to various embodiments of the present invention. In this regard, each block in a flowchart or block diagram may represent a module, segment, or portion of instructions, including one or more executable instructions for performing a specific logical function. In some implementations, the functions depicted in the blocks may be performed in a different order than that depicted in the figures. For example, two blocks shown in succession may actually be accomplished as a single step, executed simultaneously or substantially simultaneously, executed in a partially or fully overlapping manner, or executed in reverse order, depending on the functionality involved. Note that each block in the block diagrams and / or flowcharts, and combinations of blocks in the block diagrams and / or flowcharts, may be implemented by a dedicated hardware-based system that performs a specific function or operation, or by a combination of dedicated hardware and computer instructions.

[0076] The description of various embodiments of the present invention is presented for illustrative purposes, but is not intended to be exhaustive or limited to the disclosed embodiments. It will be apparent to those skilled in the art that many modifications and variations are possible without departing from the scope and spirit of the described embodiments. The terms used herein have been selected to best explain the principles of the embodiments, practical applications or technical improvements to technology found in the market, or to enable those skilled in the art to understand the embodiments described herein.

Claims

1. 1. A computer-implemented method for extended key wrapping, the computer-implemented method comprising: providing a clear key with attributes that control its use; the attribute includes a cleartext portion and an encrypted portion, and during wrapping, an indication of key length is moved from the cleartext portion to the encrypted portion; The clear key is key data of at least a first 8-byte section and second and third 8-byte sections, all of which are always filled with encrypted data; a wrapping key that wraps the clear key; the second 8-byte section is derived from the second 8-byte section by applying a bitwise exclusive-or to a hash of the third 8-byte section and adjusting the parity of the second and third 8-byte sections; the first 8-byte section is derived from the first 8-byte section by applying a bitwise exclusive-or to a hash of the second 8-byte section and adjusting the parity of the first 8-byte section; wrapping the clear key by 168 bits by concatenating the first, second, and third 8-byte sections, always combining those 8-byte sections not entered into the chained key data with zeros to pad to a total of 168 bits of chained key data; deriving an encryption key and an authentication key from the wrapping key using a National Institute of Standards and Technology (NIST) key derivation algorithm defined in NIST standard SP 800-108 and using a unique label specific to the wrapping methodology as input to the key derivation algorithm; calculating an authentication code for the clear key and the attribute using the authentication key; Executing encryption of the chain key data using the encryption key for the generated encrypted chain key data; appending the authentication code, the attributes, and the encrypted chaining key data to form a key block; 12. A computer-implemented method comprising:

2. The computer-implemented method of claim 1 , wherein the attributes include a set of attributes that control how the clear key is used.

3. 10. The computer-implemented method of claim 1, wherein the wrapping key is derived using a selection from the group consisting of a pseudorandom function (PRF) algorithm and a key derivation function (KDF) algorithm.

4. The computer-implemented method of claim 1 , wherein the authentication code is a Triple Data Encryption Standard-based Message Authentication Code (TDES-CMAC).

5. The computer-implemented method of claim 1 , wherein the encryption comprises cipher block chaining (CBC) encryption.

6. further comprising unwrapping the key block, wherein the unwrapping of the key block comprises: providing an unwrapping key based on the wrapping key for unwrapping the key block; deriving a decryption key and an authentication key from the unwrapping key; decrypting the encrypted chain key data using the decryption key to generate chain key data; breaking the chain of the chained key data to generate key data; calculating an authentication code over the key data and the attributes using the authentication key; The computer-implemented method of claim 1 , comprising:

7. The unwrapping step includes: verifying that the authentication code matches the authentication code of the key block; returning an error if the authentication code does not match the authentication code of the key block; The computer-implemented method of claim 6 further comprising:

8. a computer program embodied in program instructions, the program instructions being executable by a processor and causing the processor to perform operations; The program instructions may cause the processor to: providing the clear key with attributes that control its use; the attribute includes a cleartext portion and an encrypted portion, and during wrapping, an indication of key length is moved from the cleartext portion to the encrypted portion; The clear key is key data of at least a first 8-byte section and second and third 8-byte sections, all of which are always filled with encrypted data; a wrapping key that wraps the clear key; the second 8-byte section is derived from the second 8-byte section by applying a bitwise exclusive-or to a hash of the third 8-byte section and adjusting the parity of the second and third 8-byte sections; the first 8-byte section is derived from the first 8-byte section by applying a bitwise exclusive-or to a hash of the second 8-byte section and adjusting the parity of the first 8-byte section; The program instructions may cause the processor to: wrapping the clear key by 168 bits by concatenating the first, second, and third 8-byte sections, always combining those 8-byte sections not entered into the chained key data with zeros to pad to a total of 168 bits of chained key data; deriving an encryption key and an authentication key from the wrapping key using a National Institute of Standards and Technology (NIST) key derivation algorithm defined in NIST standard SP 800-108 and using a unique label specific to the wrapping methodology as input to the key derivation algorithm; calculating an authentication code for the clear key and the attribute using the authentication key; Executing encryption of the chain key data using the encryption key for the generated encrypted chain key data; appending the authentication code, the attributes, and the encrypted chaining key data to form a key block; A computer program that executes

9. The computer program product of claim 8 , wherein the attributes include a set of attributes that control how the clear key is used.

10. 9. The computer program product of claim 8, wherein the wrapping key is derived using a selection from the group consisting of a pseudorandom function (PRF) algorithm and a key derivation function (KDF) algorithm.

11. 9. The computer program product of claim 8, wherein the authentication code is a Triple Data Encryption Standard-based Message Authentication Code (TDES-CMAC).

12. The computer program product of claim 8 , wherein the encryption comprises cipher block chaining (CBC) encryption.

13. further comprising unwrapping the key block, wherein the unwrapping of the key block comprises: providing an unwrapping key based on the wrapping key for unwrapping the key block; deriving a decryption key and an authentication key from the unwrapping key; decrypting the encrypted chain key data using the decryption key to generate chain key data; breaking the chain of the chained key data to generate key data; calculating an authentication code over the key data and the attributes using the authentication key; 9. The computer program of claim 8, comprising:

14. The unwrapping step includes: verifying that the authentication code matches the authentication code of the key block; returning an error if the authentication code does not match the authentication code of the key block; 14. The computer program of claim 13, further comprising:

15. a memory having computer readable instructions; one or more processors for executing the computer readable instructions, the computer readable instructions controlling the one or more processors to perform operations, The computer readable instructions may cause the processor to: providing the clear key with attributes that control its use; the attribute includes a cleartext portion and an encrypted portion, and during wrapping, an indication of key length is moved from the cleartext portion to the encrypted portion; The clear key is key data of at least a first 8-byte section and second and third 8-byte sections, all of which are always filled with encrypted data; a wrapping key that wraps the clear key; the second 8-byte section is derived from the second 8-byte section by applying a bitwise exclusive-or to a hash of the third 8-byte section and adjusting the parity of the second and third 8-byte sections; the first 8-byte section is derived from the first 8-byte section by applying a bitwise exclusive-or to a hash of the second 8-byte section and adjusting the parity of the first 8-byte section; The computer readable instructions may cause the processor to: wrapping the clear key by 168 bits by concatenating the first, second, and third 8-byte sections, always combining those 8-byte sections not entered into the chained key data with zeros to pad to a total of 168 bits of chained key data; deriving an encryption key and an authentication key from the wrapping key using a National Institute of Standards and Technology (NIST) key derivation algorithm defined in NIST standard SP 800-108 and using a unique label specific to the wrapping methodology as input to the key derivation algorithm; calculating an authentication code for the clear key and the attribute using the authentication key; Executing encryption of the chain key data using the encryption key for the generated encrypted chain key data; appending the authentication code, the attributes, and the encrypted chaining key data to form a key block; A system that executes the following.

16. The system of claim 15 , wherein the attributes include a set of attributes that control how the clear key is used.

17. 16. The system of claim 15, wherein the wrapping key is derived using a selection from the group consisting of a pseudorandom function (PRF) algorithm and a key derivation function (KDF) algorithm.

18. 16. The system of claim 15, wherein the authentication code is a Triple Data Encryption Standard-based Message Authentication Code (TDES-CMAC).

19. 16. The system of claim 15, wherein the encryption comprises cipher block chaining (CBC) encryption.

20. further comprising unwrapping the key block, wherein unwrapping the key block comprises: providing an unwrapping key based on the wrapping key for unwrapping the key block; deriving a decryption key and an authentication key from the unwrapping key; decrypting the encrypted chain key data using the decryption key to generate chain key data; breaking the chain of the chained key data to generate key data; calculating an authentication code over the key data and the attributes using the authentication key; verifying that the authentication code matches the authentication code of the key block; returning an error if the authentication code does not match the authentication code of the key block; The system of claim 15 further comprising:

Images