Distributed Seed Storage for Quantum-Safe Keys on Constrained IoT
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Constrained devices, such as embedded and IoT devices, face challenges in supporting quantum-safe algorithms due to the significantly larger private key sizes required, exceeding their limited memory and resource capabilities.
Innovation Solution
Storing seeds for private keys in constrained devices and generating the keys on demand using associated logic, rather than storing the keys themselves, to reduce resource usage and enhance security.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If quantum-safe algorithms are implemented on constrained devices, then security is improved, but memory usage increases significantly
Solution Approach 1:
The private key is segmented into multiple seed values that are stored separately in the constrained device. These seed values are smaller individual components that can be stored in limited memory, while collectively they enable reconstruction of the full private key when needed.
Solution Approach 2:
Seed values are pre-generated and stored in the constrained device before the private key is needed. This preliminary action allows the device to have the necessary cryptographic material ready without storing the full private key, enabling fast key generation when required.
2Adaptability or versatility
If private keys for quantum-safe algorithms are stored in constrained devices, then cryptographic functionality is enabled, but resource constraints are exceeded
Solution Approach 1:
The full private key is extracted from the storage requirements and replaced with only its essential components (seed values) being stored in the device. The complete private key can be reconstructed temporarily when needed but is not permanently stored, reducing the storage burden on constrained devices.
Solution Approach 2:
The storage parameters are changed from storing the full private key (large size) to storing only seed values (small size). This parameter change maintains cryptographic functionality while adapting to the memory constraints of embedded devices.
3Ease of operation
If private keys are stored in constrained devices, then authentication functions are enabled, but security is reduced
Solution Approach 1:
Seed values serve as intermediaries between the constrained device and the full private key. The device stores and manipulates these smaller seed values locally, which mediate the cryptographic operations without requiring the device to hold the complete private key, thus maintaining security while enabling authentication functions.
Data Source
AI summary
A constrained device generates private keys for quantum-safe algorithms using seeds obtained from multiple sources. A first plurality of seeds may be provisioned in device memory during manufacturing or assembly, while a second plurality of seeds may be received during an upgrade or update of the device. The device combines the pluralities of seeds to derive a private key, utilizes the private key for functions such as authentication, enrollment, encrypted communication, provisioning, or software updates, and removes the private key after use. Security enhancements include verifying integrity of update-provided seeds and periodically refreshing seeds to support continued trust. Corresponding methods are disclosed for storing seeds, receiving seeds during updates, generating private keys from the combined seeds, and managing use and deletion of private keys in Internet-of-Things devices, tracker tags, and other resource-constrained systems operating with quantum-safe cryptographic algorithms.