Cryptographic unit for public key infrastructure (PKI) operations

A method for performing cryptographic operations, the method comprising:

• sending, by a cryptographic system, a challenge to a computing device, wherein the computing device is in communication with the cryptographic system over a wireless network, wherein the cryptographic system comprises one or more servers, and wherein the computing device comprises an embedded universal integrated circuit card (eUICC) having a first private key and a set of cryptographic parameters stored thereon, wherein the first private key is associated with a first public key, and the set of cryptographic parameters is for elliptic curve cryptography;
• receiving, by the cryptographic system and from the computing device, a first digital signature for at least the challenge;
• sending, by the cryptographic system, a signal to the computing device via the wireless network, wherein the signal comprises one or more parameters indicating a subset of the set of cryptographic parameters, wherein the one or more parameters of the signal are to be used by the eUICC to determine the subset of the set of cryptographic parameters, wherein the subset of the set of cryptographic parameters are to be used by the eUICC for deriving a second private key and a second public key, wherein the second private key is to be used by the eUICC to derive a first symmetric ciphering key, and wherein the first symmetric ciphering key is to be used by the eUICC to decrypt an encrypted profile received by the computing device from the cryptographic system;
• receiving, by the cryptographic system and from the computing device, the second public key and a second digital signature for at least the second public key;
• verifying, by the cryptographic system, the second digital signature for the second public key using the first public key;
• deriving, by the cryptographic system, a second symmetric ciphering key using the second public key;
• and
• sending, by the cryptographic system and to the computing device, the encrypted profile for the eUICC, wherein the encrypted profile is ciphered with the second symmetric ciphering key.

A cryptographic system, comprising:

• one or more servers configured for:
• sending a challenge to a computing device, wherein the computing device is in communication with the cryptographic system over a wireless network, and wherein the computing device comprises an embedded universal integrated circuit card (eUICC) having a first private key and a set of cryptographic parameters stored thereon, wherein the first private key is associated with a first public key, and the set of cryptographic parameters is for elliptic curve cryptography;
• receiving, from the computing device, a first digital signature for at least the challenge;
• sending, to the computing device, a signal via the wireless network, wherein the signal comprises one or more parameters indicating a subset of the set of cryptographic parameters, wherein the one or more parameters of the signal are to be used by the eUICC to determine the subset of the set of cryptographic parameters, wherein the subset of the set of cryptographic parameters are to be used by the eUICC for deriving a second private key and a second public key, wherein the second private key is to be used by the eUICC to derive a first symmetric ciphering key, and wherein the first symmetric ciphering key is to be used by the eUICC to decrypt an encrypted profile received by the computing device from the cryptographic system;
• receiving, from the computing device, the second public key and a second digital signature for at least the second public key;
• verifying the second digital signature for the second public key using the first public key;
• deriving a second symmetric ciphering key using the second public key;
• and
• sending, by the cryptographic system and to the computing device, the encrypted profile for the eUICC, wherein the encrypted profile is ciphered with the second symmetric ciphering key.

A non-transitory computer-readable medium having processor-executable instructions stored thereon for securely deriving keys and performing cryptographic operations, wherein the processor-executable instructions, when executed, facilitate:

• generating, by an embedded universal integrated circuit card (eUICC), a first digital signature for at least a challenge, wherein the eUICC has the first private key and a set of cryptographic parameters stored thereon, wherein the first private key is associated with a first public key, and wherein the set of cryptographic parameters is for elliptic curve cryptography;
• outputting, by the eUICC, the first digital signature;
• receiving, by the eUICC, a signal sent from a cryptographic system via a wireless network, wherein the signal comprises one or more parameters indicating a subset of the set of cryptographic parameters;
• determining, by the eUICC, based on the one or more parameters of the received signal, the subset of the set of cryptographic parameters;
• deriving, by the eUICC, a second private key and a second public key based on the determined subset of the set of cryptographic parameters;
• generating, by the eUICC, using the first private key, a second digital signature for at least the second public key;
• outputting, by the eUICC, the second digital signature and the second public key;
• obtaining, by the eUICC, an encrypted profile for the eUICC from the cryptographic system, wherein the encrypted profile is ciphered with a symmetric ciphering key;
• deriving, by the eUICC, the symmetric ciphering key using the second private key;
• and
• decrypting, by the eUICC, the encrypted profile using the symmetric ciphering key.