Key Block Enhanced Wrapping Integrity Protection
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing key wrapping methods lack integrity protection for control vectors and fail to effectively obfuscate key lengths, which can compromise security during key transport and usage.
Innovation Solution
The enhanced key wrapping method employs SHA-256 chaining and TDES-CMAC integrity checks, ensuring all key sections are encrypted and obfuscating key lengths by using a derived wrapping key for CBC encryption, while maintaining an integrity check through a CMAC calculated over the key block.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If traditional key wrapping methods are used, then the key can be encrypted and transported, but integrity protection for control vectors is lacking and key lengths are not obfuscated
Solution Approach 1:
The key is divided into multiple sections (first 8-byte section, second 8-byte section, third 8-byte section) that are processed and encrypted separately then combined. The control vector is also segmented into multiple fields (key form, key usage, export control, etc.) that are individually protected through encryption and integrity checking mechanisms.
Solution Approach 2:
Integrity checks are calculated over the control vector and key sections before the final encryption process. The wrapping key is derived in advance using key derivation functions, and authentication codes are pre-computed to ensure integrity protection is built into the structure before transport.
2Reliability
If key sections are not all encrypted, then the wrapping process is simpler, but key length obfuscation is compromised
Solution Approach 1:
All key sections (first 8-byte section, second 8-byte section, third 8-byte section) are merged into a single encrypted key block structure. The control vector fields are combined with the key material and encrypted together using the derived wrapping key, ensuring uniform encryption across all components for consistent key length obfuscation.
3Reliability
If integrity checks are not calculated over the key block, then the processing is faster, but the control vector integrity cannot be maintained
Solution Approach 1:
Authentication codes are calculated over the encrypted key block and control vector fields, providing feedback verification that the integrity of the wrapped key has been maintained. This allows receiving systems to verify control vector integrity without requiring complex re-processing of the entire key material.
Data Source
AI summary
Aspects of the invention include providing a clear key with an attribute that controls usage of the clear key. The clear key includes key data in at least a first 8-byte section and second and third 8-byte sections and a wrapping key for wrapping the clear key. The computer-implemented method further includes chaining the first, second and third 8-byte sections together with zeroes for those 8-byte sections that are unpopulated into chained key data, deriving encryption and authentication keys from the wrapping key, calculating an authentication code over the clear key and the attribute using the authentication key, executing encryption over the chained key data using the encryption key to generated encrypted chained key data and adding the authentication code, the attribute and the encrypted chained key data to form a key block.