Keyword to set minimum key strength
AssigneeInternational Business Machines Corporation
InventorsRichard V. Kisley, Michael J. Miele
Life of this patent
Estimating the term…
Abstract
Embodiments are directed to a computer-implemented method and system, and for setting a minimum key strength in a key hierarchy. The method and system can include the use of a key strength keyword that set a minimum key strength for a plurality of key classes. The setting of a key strength lower than that set forth in the key strength command is prohibited. The key classes can include DES keys, AES keys, HMAC keys, RSA PKI keys, RSA usage keys, RSA key generation keys, ECC PKI keys, ECC usage keys, and ECC key generation keys. A multi-dimension key hierarchy, including a master key and a key that is derived through the use of a key derivation function is also described herein.
Claims7
A computer implemented method for setting a minimum key strength in a key hierarchy in a hardware security module (HSM), the method comprising:
- receiving, using a processor, a key strength keyword to set a minimum key strength for a plurality of key classes;
- and
- preventing, using the processor, a setting of a key strength lower than the minimum key strength, wherein the key strength keyword comprises, for each key class in the plurality of key classes, a bit-map that indicates which key strengths are allowed for the key class, wherein the key hierarchy comprises:
- a first master key arranged to wrap operational keys in a first key sub-hierarchy, the first key sub-hierarchy comprising one or more compliant keys and key encrypting keys configured to wrap external keys;
- and
- a derived master key arranged to wrap operational keys in a second key sub-hierarchy, the second key sub-hierarchy comprising one or more non-compliant keys;
- wherein the derived master key is derived from the first master key through the use of a key derivation function.
A computer system for setting a minimum key strength in a key hierarchy in a hardware security module (HSM), comprising:
- a memory;
- and
- a processor system communicatively coupled to the memory;
- the processor system configured to perform a method comprising:
- receiving a key strength keyword to set a minimum key strength for a plurality of key classes;
- and
- preventing a setting of a key strength lower than the minimum key strength;
- wherein:
- the plurality of key classes includes:
- DES keys, AES keys, HMAC keys, RSA PKI keys, RSA usage keys, RSA key generation keys, ECC PKI keys, ECC usage keys, and ECC key generation keys and further wherein the key strength keyword comprises, for each key class in the plurality of key classes, a bit-map that indicates which key strengths are allowed for the key class, wherein the key hierarchy comprises:
- a first master key arranged to wrap operational keys in a first key sub-hierarchy, the first key sub-hierarchy comprising one or more compliant keys and key encrypting keys configured to wrap external keys;
- and
- a derived master key arranged to wrap operational keys in a second key sub-hierarchy, the second key sub-hierarchy comprising one or more non-compliant keys;
- wherein the derived master key is derived from the first master key through the use of a key derivation function.
Dependencies are inferred from the claim text.