Secure initialization vector generation
AssigneeAmazon Technologies, Inc.
InventorMatthew John Campagna
Life of this patent
Estimating the term…
Abstract
A plaintext and cryptographic key are used to generate an initialization vector to be used in a cryptographic algorithm, such as an encryption algorithm. In some examples, the plaintext and cryptographic key are input into an effectively one-way function, such as a cryptographic hash function, the output of which is usable as an initialization vector. Cryptographic keys may be rotated probabilistically based at least in part on probabilities of output collisions of the effectively one-way function to ensure a low probability of two different plaintexts resulting in calculation of the same initialization vector for use with the same cryptographic key.
Claims20
A computer-implemented method, comprising:
- generating, based at least in part on an amount of usage of a cryptographic key, a determination whether to replace the cryptographic key with another cryptographic key, the determination generated to comply with a condition that use of the cryptographic key in an algorithm, used by a set of devices, to generate an initialization vector based at least in part on an input plaintext and an input cryptographic key, is such that a probability of repeated use of the cryptographic key and a same initialization vector with different plaintexts is below a threshold.
A system, comprising one or more computing devices including one or more computer-readable storage medium storing instructions that, when executed by one or more processors of the one or more computing devices, cause the one or more computing devices to:
- generate, based at least in part on an amount of usage of a cryptographic key, a determination whether to replace the cryptographic key with another cryptographic key, the determination generated to comply with a condition that use of the cryptographic key in an algorithm, used by a set of devices, to generate an initialization vector based at least in part on an input plaintext and an input cryptographic key, is such that a probability of repeated use of the cryptographic key and a same initialization vector with different plaintexts is below a threshold.
A non-transitory computer-readable storage medium storing executable instructions that, as a result of execution by one or more processors of a computer system, cause the computer system to at least:
- generate, based at least in part on an amount of usage of a cryptographic key, a determination whether to replace the cryptographic key with another cryptographic key, the determination generated to comply with a condition that use of the cryptographic key in an algorithm, used by a set of devices, to generate an initialization vector based at least in part on an input plaintext and an input cryptographic key, is such that a probability of repeated use of the cryptographic key and a same initialization vector with different plaintexts is below a threshold.
Dependencies are inferred from the claim text.