Technologies for provisioning cryptographic keys
AssigneeIntel Corporation
InventorsXiaoyu Ruan, Vincent Von Bokern, Daniel Nemiroff
Life of this patent
Estimating the term…
Abstract
Technologies for provisioning cryptographic keys include hardcoding identical cryptographic key components of a Rivest-Shamir-Adleman (RSA) public-private key pair to each compute device of a plurality of compute devices. A unique cryptographic exponent that forms a valid RSA public-private key pair with cryptographic key components hardcoded into each compute device is provided to each compute device so that each compute device has a unique public key. The public key of each compute device may be used to provision unique secrets to the corresponding compute device.
Claims22
A cryptographic key server for provisioning cryptographic keys to a plurality of compute devices separate from the cryptographic key server, the cryptographic key server comprising:
- a cryptographic component generator to determine (i) cryptographic key components of a Rivest-Shamir-Adleman (RSA) public-private key pair to be hardcoded into each compute device of the plurality of compute devices, wherein the cryptographic key components comprises a pair of different prime numbers, p and q, and a modulus, n, of the determined pair of prime numbers, p and q and (ii) a plurality of cryptographic exponents, wherein each cryptographic exponent forms a valid RSA public-private key pair with the cryptographic key components hardcoded into each compute device of the plurality of compute devices;
- and
- a key provisioner to transmit, over a network external to the cryptographic key server and to each compute device of the plurality of compute devices, a different cryptographic exponent of the determined plurality of cryptographic exponents to be stored on the corresponding compute device;
- wherein to determine the plurality of cryptographic exponents comprises to (i) determine, by the cryptographic key server, a potential cryptographic exponent and (ii) validate the determined cryptographic potential exponent by determining whether a solution exists for d≡e1 (mod φ(n)), wherein φ (n)=(p−1)(q−1) and e is the potential cryptographic exponent.
A method for provisioning cryptographic keys to a plurality of compute devices separate from a cryptographic key server, the method comprising:
- determining, by the cryptographic key server, cryptographic key components of a Rivest-Shamir-Adleman (RSA) public-private key pair to be hardcoded into each compute device of the plurality of compute devices, wherein the cryptographic key components comprises a pair of different prime numbers, p and q, and a modulus, n, of the determined pair of prime numbers, p and q;
- determining, by the cryptographic key server, a plurality of cryptographic public exponents, e, wherein each cryptographic public exponent forms a valid RSA public-private key pair with the cryptographic key components hardcoded into each compute device of the plurality of compute devices;
- and
- transmitting, by the cryptographic key server over a network external to the cryptographic key server and to each compute device of the plurality of compute devices, a different cryptographic exponent of the determined plurality of cryptographic exponents to be stored on the corresponding compute device;
- wherein determining the plurality of cryptographic exponents comprises:
- determining, by the cryptographic key server, a potential exponent;
- and
- validating the determined potential exponent by determining whether a solution exists for d≡e1 (mod φ(n)), wherein φ (n)=(p−1)(q−1).
One or more non-transitory, machine-readable storage media comprising a plurality of instructions stored thereon that, when executed, causes a cryptographic key server to:
- determine cryptographic key components of a Rivest-Shamir-Adleman (RSA) public-private key pair to be hardcoded into each compute device of a plurality of compute devices, wherein each of the plurality of compute devices is separate from the cryptographic key server and wherein the cryptographic key components comprises a pair of different prime numbers, p and q, and a modulus, n, of the determined pair of prime numbers, p and q;
- determine a plurality of cryptographic public exponents, e, wherein each cryptographic public exponent forms a valid RSA public-private key pair with the cryptographic key components hardcoded into each compute device of the plurality of compute devices;
- and
- transmit, over a network external to the cryptographic key server and to each compute device of the plurality of compute devices, a different cryptographic exponent of the determined plurality of cryptographic exponents to be stored on the corresponding compute device;
- wherein to determine the plurality of cryptographic exponents comprises to:
- determine a potential exponent;
- and
- validate the determined potential exponent by determining whether a solution exists for d≡e1 (mod φ(n)), wherein φ (n)=(p−1)(q−1).
Dependencies are inferred from the claim text.