Truncated Pseudorandom Value Encryption for Key Management
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
The frequent need for key rotation in data encryption systems leads to increased resource usage and costs due to the requirement for storing old keys, re-encrypting data, and distributing new keys, which can compromise security if not managed effectively.
Innovation Solution
The system employs symmetric encryption and decryption using a sequence of truncated pseudorandom values to generate a shared cryptographic key, allowing for prolonged use of a key without rotation by disregarding a portion of encrypted counters, thus enhancing security and reducing key management costs.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If cryptographic keys are rotated frequently to maintain security, then security level is improved, but resource usage and costs increase due to storing old keys, re-encrypting data, and distributing new keys
Solution Approach 1:
The system dynamically generates a sequence of pseudorandom values from a single cryptographic key, allowing the key to be used multiple times without rotation. Each pseudorandom value in the sequence serves as a unique encryption component, enabling continuous secure operation without the static key rotation process that consumes resources.
Solution Approach 2:
The cryptographic key continues to be useful throughout its entire sequence of pseudorandom values rather than becoming obsolete after a single use or fixed period. The key maintains its security utility continuously by generating multiple secure pseudorandom values, eliminating the need for periodic key rotation and its associated resource costs.
2Reliability
If cryptographic keys are rotated frequently to maintain security, then security level is improved, but key management costs increase due to storing old keys, re-encrypting data, and distributing new keys
Solution Approach 1:
The system transforms a single static key into a dynamic sequence of pseudorandom values, allowing one key to serve multiple encryption operations. This eliminates the need to manage multiple keys simultaneously, reducing storage requirements and distribution overhead while maintaining security through the continuous generation of new pseudorandom values from the original key.
Solution Approach 2:
A single cryptographic key performs multiple functions by generating an entire sequence of pseudorandom values that can be used for multiple encryption operations. The original key serves as the root for all subsequent pseudorandom values, eliminating the need for separate key management for each encryption instance and significantly reducing key management costs.
3Productivity
If cryptographic keys are used beyond their typical security bounds, then key rotation frequency is reduced, but security level may be compromised
Solution Approach 1:
The system maintains security while extending key usage by dynamically generating a sequence of pseudorandom values from the cryptographic key. Each pseudorandom value provides fresh entropy for encryption operations, ensuring security is not compromised even though the original key is used for multiple operations rather than being rotated after each use.
Data Source
AI summary
Plaintext data is encrypted and decrypted using a symmetric encryption algorithm that generates a sequence of pseudorandom values from a cryptographic key. A portion of the sequence of pseudorandom values is discarded. For example, in an embodiment, each value in the sequence of pseudorandom values is truncated by a number of bits. Encryption and decryption is performed by combining plaintext or ciphertext with the truncated sequence of pseudorandom values. In an embodiment, the combination is made by performing a bitwise exclusive or operation between the truncated pseudorandom values and the plaintext or ciphertext. In an embodiment, a number of bits discarded from each value is encoded into a message authentication code which is provided with any resulting ciphertext.