Cryptographic Key Ordering and CBC Wrapping for Protected Keys
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing cryptographic processing methods lack effective protection for data keys, particularly in environments where confidentiality is critical, such as in the use of the XTS-AES algorithm, where the protected key is vulnerable to unauthorized access.
Innovation Solution
A computer program product encrypts a set of data keys as a single encrypted key, ensuring the protected key is not in the first position and using cipher block chaining to scramble the sequence, with separate instructions for decryption and encryption to maintain key confidentiality.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Ease of operation
If data keys are stored in a standard format with the protected key in a predictable position, then ease of operation is improved, but security is worsened because the protected key becomes vulnerable to unauthorized access
Solution Approach 1:
The patent applies asymmetry by reversing the conventional key ordering - instead of placing the protected key in the first position (which is easier to access but less secure), the protected key is placed in the last position of the key schedule. This asymmetric arrangement maintains operational functionality while significantly improving security by making the protected key harder to access during cryptographic operations.
Solution Approach 2:
The patent inverts the traditional key management approach by storing and processing keys in reverse order. The protected key, which would conventionally be in the first position, is instead placed in the last position. This inversion ensures that during decryption operations, the protected key is accessed last rather than first, reducing its exposure to potential attacks and unauthorized access.
2Ease of operation
If multiple data keys are encrypted separately, then ease of operation is improved, but device complexity worsens due to multiple encryption operations
Solution Approach 1:
The patent merges multiple separate encryption operations into a single unified encryption process. By encrypting all data keys (including the protected key) together as one batch operation, the system reduces the number of individual encryption calls required. This combining approach maintains security while simplifying the overall encryption process and reducing computational overhead.
3Productivity
If the protected key is easily accessible for decryption operations, then productivity is improved, but reliability worsens because the key is more exposed to potential attacks
Solution Approach 1:
The patent implements preliminary action by pre-arranging the key schedule in a secure reversed order before cryptographic operations begin. The protected key is positioned in the last position of the key schedule in advance, so that during actual decryption operations, it is naturally accessed last rather than first. This preliminary arrangement maintains operational speed while inherently protecting the key through its positional design.
Data Source
AI summary
A set of data keys arranged in a particular order is obtained. The set of data keys includes multiple data keys. The multiple data keys include a protected key. The protected key is prevented from being in a selected position within the particular order. The set of data keys is encrypted as a single encrypted key. The single encrypted key is an encryption of the multiple data keys. The single encrypted key is returned. The single encrypted key is to be decrypted to obtain multiple decrypted keys. At least one decrypted key of the multiple decrypted keys is a decrypted protected key to be used in encryption of a confidential value.