Secure Boot Signature Chain Using One Post-Quantum Verification
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing secure boot mechanisms for classical computers are vulnerable to quantum computers, which can break encryption faster and require significantly more memory and processing resources, leading to increased storage and power consumption when using post-quantum cryptography.
Innovation Solution
Implement a single post-quantum cryptographic signature to secure a list of classical cryptographic signatures for each bootloader stage, amortizing the larger size of the post-quantum cryptographic signature across multiple classical cryptographic signatures.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If post-quantum cryptographic signatures are used for each bootloader stage, then security against quantum attacks is improved, but storage space and processing resources are significantly increased
Solution Approach 1:
The patent merges multiple individual post-quantum cryptographic signatures into a single aggregate signature that covers multiple bootloader stages. Instead of storing separate PQC signatures for each stage (ROM1, ROM2, etc.), the system creates one consolidated PQC signature that authenticates a collection of classical cryptographic signatures, thereby reducing total storage requirements while maintaining security.
Solution Approach 2:
The single post-quantum cryptographic signature serves multiple functions by simultaneously authenticating multiple bootloader stages. This universal signature replaces what would otherwise require multiple separate PQC signatures, achieving both security against quantum attacks and efficient use of storage resources.
2Reliability
If post-quantum cryptographic signatures are used for each bootloader stage, then security against quantum attacks is improved, but processing cycles and power consumption are significantly increased
Solution Approach 1:
The patent combines multiple post-quantum cryptographic verification operations into a single verification process. By aggregating the signatures and performing one PQC verification instead of multiple separate verifications, the system reduces processing cycles and power consumption while still providing quantum-resistant security for all bootloader stages.
Solution Approach 2:
The system uses classical cryptographic signatures (which require minimal processing) for individual bootloader stage authentication, and applies post-quantum cryptography only once at the aggregate level. This partial use of PQC provides sufficient quantum resistance without the excessive processing overhead of applying PQC to every single stage.
3Reliability
If post-quantum cryptography is implemented, then protection against quantum computer attacks is improved, but memory and processing resource requirements are increased
Solution Approach 1:
The patent segments the cryptographic authentication process into two layers: a first layer using classical cryptographic signatures for individual bootloader stages (low resource requirement), and a second layer using a single post-quantum cryptographic signature for aggregate authentication (high security, controlled resource usage). This segmentation allows the system to achieve quantum resistance without uniformly increasing resources across all authentication operations.
Solution Approach 2:
The system introduces classical cryptographic signatures as an intermediary layer between the bootloader stages and the post-quantum cryptographic verification. Instead of directly verifying PQC signatures for each stage (which would require excessive resources), the classical signatures serve as intermediaries that can be efficiently verified individually, with a single PQC verification providing overarching security.
Data Source
AI summary
In general, a computing device comprising a secure memory, a storage device, and a processor may be configured to implement the techniques. The secure memory may store a post-quantum cryptographic reference signature (PQCRS). The storage device may store bootloader stages, a list of classical cryptographic reference signatures (CCRS), and a PQC public key (PQCPK). The processor may, prior to executing a first bootloader stage, obtain the list of CCRS, the PQCRS, and the PQCPK. The processor may also apply a PQC algorithm with respect to the PQCRK and the list of CCRS to obtain a PQC verification signature (PQCVS), and responsive to the PQCVS matching the PQCRS, compare a first CCRS in the digitally signed list of CCRS to a first CC verification signature (CCVS) obtained based on the first bootloader stage. The processor may also, responsive to the first CCVS matching the first CCRS, execute the first bootloader stage.