Hybrid Key Import with Classical and Quantum-Safe Encryption
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Current key management services are vulnerable to future quantum computer decryption due to reliance on breakable classical cryptography algorithms, which can compromise root of trust key materials used for encrypting data, leading to potential widespread breaches.
Innovation Solution
Implementing hybrid encryption using both classical cryptography (CC) and quantum-safe cryptography (QSC) algorithms, where a user system encrypts key material with both CC and QSC public keys, and the encrypted material is securely stored in a hardware security module (HSM) within a key management service (KMS), ensuring security against future quantum computers.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If classical cryptography algorithms are used for key management, then current encryption standards are maintained and compatibility is preserved, but security vulnerability to future quantum computer decryption increases
Solution Approach 1:
The patent combines classical cryptography (CC) and quantum-safe cryptography (QSC) into a hybrid encryption scheme. The key material is encrypted using both CC public key and QSC public key, creating a dual-layer encrypted structure that leverages the strengths of both cryptographic systems while mitigating their individual weaknesses.
Solution Approach 2:
The encryption structure uses composite cryptographic materials by integrating two different cryptographic algorithms (classical and quantum-safe) into a single encryption process. This composite approach ensures that even if one cryptographic system becomes vulnerable, the other remains secure.
2Reliability
If hybrid encryption with two public keys is implemented, then quantum-safe security is achieved, but computational complexity and processing time increase
Solution Approach 1:
The encryption process is segmented into distinct stages: first encrypting key material with the CC public key, then encrypting the result with the QSC public key. This segmentation allows each cryptographic operation to be performed independently and efficiently, rather than requiring a complex unified algorithm.
Solution Approach 2:
The system performs preliminary actions by generating and distributing both CC and QSC public keys in advance, and pre-encrypting the key material using the hybrid scheme before storage. This preliminary encryption reduces the computational burden during key import and storage operations.
3Reliability
If hybrid-encrypted key material is stored in HSM, then long-term security against quantum attacks is ensured, but storage and retrieval process complexity increases
Solution Approach 1:
The patent introduces an intermediary key import module that acts as a mediator between the user system and the HSM. This module automates the complex process of receiving key material, encrypting it with both CC and QSC public keys, and storing it in the HSM, thereby simplifying the user interface while maintaining security.
Solution Approach 2:
The system performs self-service by automatically generating the hybrid-encrypted key material and storing it in the HSM without requiring manual intervention. The key import module handles the entire process autonomously, from receiving the key material to completing the encrypted storage, reducing operational complexity for users.
Data Source
AI summary
Hybrid encryption of imported key material is provided. A request to import key material is received from a user system. In response to the request, two public keys are sent to the user system. The two public keys include a classical cryptography (CC) public key and a quantum-safe cryptography (QSC) public key. At least one public key of the two public keys is retrieved from a hardware security module (HSM). Hybrid-encrypted key material is received from the user system. The hybrid-encrypted key material is key material that has been encrypted using the two public keys. The key material, at least partially encrypted by the at least one public key, is sent to the HSM.