Double AEAD Key Wrapping for Software-Based Encryption Recovery
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing encryption systems lack a reliable method for recovering encrypted data when a site key or password is lost, particularly in software-based solutions without a direct tie to specific hardware, leading to permanent unavailability of encrypted data.
Innovation Solution
The proposed system generates site keys based on a configuration file, storing hashed values within the encrypted data, allowing recovery using header values, and employs double AEAD key wrapping to securely hide and unhide key material without relying on an outside master key, ensuring secure key recovery and decryption.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If key material is wrapped using traditional methods with an outside master key, then key security is improved, but system complexity and dependency on external keys increases
Solution Approach 1:
The invention extracts the dependency on external master keys by using only the original key material itself for wrapping. The key material is divided into portions and processed through cryptographic functions to generate wrap keys, eliminating the need for separate master key storage and management infrastructure.
Solution Approach 2:
The key material serves its own wrapping function by generating the wrap keys from itself through cryptographic processing. The original key material is processed to create portions and derived wrap keys, allowing the system to be self-sufficient without external master key dependencies.
2Reliability
If hardware-specific key recovery methods are used, then key recovery capability is improved, but adaptability to software-only environments is reduced
Solution Approach 1:
The invention creates a universal key wrapping and recovery mechanism that functions across both hardware and software environments. The cryptographic process using key material portions and derived wrap keys can be implemented without hardware-specific features, making it adaptable to purely software-based systems while maintaining key recovery capability.
Solution Approach 2:
The invention replaces hardware-specific key recovery mechanisms with a software-based cryptographic system. Instead of relying on hardware identifiers or physical key stores, the system uses cryptographic functions processed entirely in software to achieve key recovery, eliminating the need for hardware-specific infrastructure.
3Ease of manufacture
If master key obfuscation is used instead of encrypted key wrapping, then implementation simplicity is improved, but security is reduced
Solution Approach 1:
The invention transforms the simple obfuscation approach into a cryptographic wrapping system by changing the parameters from basic hiding to structured encryption. Key material is divided into portions and processed through cryptographic functions to generate wrap keys, providing enhanced security while maintaining systematic implementation through defined cryptographic operations.
Data Source
AI summary
Systems, methods, and other embodiments associated with encryption are described. In one embodiment, a method comprises selecting a secret key for encryption and encrypting the secret key by applying a first pass of Authenticated Encryption with Additional Data (AEAD) using first keys generated from a random seed value. The random seed value is encrypted by applying a second pass of the Authenticated Encryption with Additional Data (AEAD) using second keys generated from the encrypted secret key. A wrapped key is generated by combining the encrypted secret key and the encrypted random seed value.