Cryptographic Key Storage Optimization Using Fuse Seeds
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
The increasing need for secure electronic data transmission and storage in semiconductor devices leads to a challenge in reducing on-chip fuse storage of cryptographic keys, which are costly and time-consuming to program, especially for devices requiring 128-bits of security using RSA, necessitating a significant number of fuse bits.
Innovation Solution
Storing a randomly generated, device-specific AES key in fuses to encrypt the RSA private key, allowing the encrypted key to be stored in external flash memory, reducing the number of fuse bits required and enabling the use of RSA in compute-constrained environments, while also allowing for the storage of Chinese Remainder Theorem parameters to speed up RSA operations.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If cryptographic keys are stored in on-chip fuses, then security is maintained, but die area increases and manufacturing cost increases
Solution Approach 1:
The patent extracts the cryptographic key storage function from the on-chip fuse array and relocates it to external non-volatile memory. The fuse array is used only to store a compact seed value, while the full cryptographic key is stored externally, thereby removing the bulk of the storage requirement from the on-chip area.
Solution Approach 2:
The patent introduces an intermediary mechanism where a seed value stored in fuses is used to generate or access the full cryptographic key stored in external memory. This intermediary approach allows the system to maintain security through the seed while reducing on-chip storage requirements by leveraging external memory for the full key.
2Reliability
If cryptographic keys are stored in on-chip fuses, then security is maintained, but manufacturing time increases
Solution Approach 1:
The patent extracts the time-consuming key programming operation from the manufacturing process. Instead of programming large cryptographic keys into fuses during manufacturing, only small seed values are programmed into fuses, while the full keys are stored externally, significantly reducing manufacturing time.
Solution Approach 2:
The patent performs preliminary action by pre-storing cryptographic keys in external non-volatile memory before the device is manufactured. This allows the keys to be available without requiring time-consuming programming operations during the manufacturing process itself.
3Reliability
If RSA keys with 128-bits of security are used, then security is achieved, but number of fuse bits required increases significantly
Solution Approach 1:
The patent extracts the large key data from the fuse storage requirement. By storing only a compact seed value (e.g., 128 bits) in fuses and deriving or accessing the full RSA key from external memory, the system achieves 128-bit security without requiring the full key size in fuse bits.
Solution Approach 2:
The patent changes the storage parameter from storing full cryptographic keys directly to storing compact seed values that can generate or access the full keys. This parameter transformation reduces the storage requirement from kilobits to much smaller values while maintaining the same security level.
Data Source
AI summary
A computing device has a processor and a first memory, e.g., a fuse-based memory, storing a first cryptographic key. The processor is configured to receive information related to a second cryptographic key from a cryptographic key provisioning system. The processor derives the second cryptographic key from the information related to a second cryptographic key. The first cryptographic key has fewer bits than the second cryptographic key. The processor is also configured to encrypt the second cryptographic key using the first cryptographic key, and store the encrypted second cryptographic key in a second memory, e.g., a flash memory.