Cryptographic Key Generation via Split Seed Injection
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
The existing methods for establishing a secure private key during the manufacturing of computing devices are vulnerable to compromise by third-party vendors, as they have access to the key insertion process, which can lead to security risks.
Innovation Solution
A method where a processor random seed and a board random seed are generated at different manufacturing locations, combined, and encrypted to generate a private key, ensuring that neither location can determine the key without information from the other, thereby enhancing security.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Productivity
If the private key is created and inserted during manufacture by third party vendors, then the manufacturing process is simplified and efficient, but the security of the private key is weakened due to vendor access
Solution Approach 1:
The private key generation process is segmented into multiple independent stages performed by different entities. First, a processor seed is generated during processor manufacturing. Second, a board seed is generated during board assembly. Finally, the private key is generated by combining both seeds in the finished device. This segmentation ensures that no single vendor has access to the complete private key material, thereby maintaining security while preserving manufacturing efficiency.
2Reliability
If the private key is generated by combining seeds from different manufacturing locations, then the security against vendor compromise is improved, but the manufacturing process complexity increases
Solution Approach 1:
The necessary seed materials are prepared in advance during standard manufacturing processes without adding complexity to the final device assembly. The processor seed is generated during processor fabrication, and the board seed is generated during board assembly - both are preliminary actions that occur naturally in the manufacturing flow. The actual private key generation then occurs automatically in the finished device by combining these pre-prepared seeds, requiring no additional manufacturing steps.
Data Source
Figure 1
Figure 2
Figure 3
AI summary
A method of manufacturing a computing device is provided that allows the computing device to generate a secret value, where any one manufacturer of the computing device lacks sufficient information to determine the secret value. The method may include manufacturing a processor and injecting a first random seed into the processor at a first manufacturing location. After assembling the processor with other hardware components onto a PCB, a second random seed may be injected at a second manufacturing location. After injection of the random seeds, the processor may execute instructions to combine the seeds to generate the secret value.