# US 12,003,637 B1 · Secure initialization vector generation > Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt - Number: US 12,003,637 B1 - Document ID: US12003637B1 - Status: Granted - Kind: B1 - Application number: 18/222,951 - Filed: 2023-07-17 - Granted: 2024-06-04 - Earliest claimed: 2014-03-25 - Assignees: Amazon Technologies, Inc. - Applicants: Amazon Technologies, Inc. - Inventors: Matthew John Campagna - Web page: https://patentgrep.com/patent/US12003637B1 ## CPC - H04L 9/16: the keys or algorithms being changed during operation - G06F 21/602: {Providing cryptographic facilities or services} - H04L 9/0618: {Block ciphers, i.e. encrypting groups of characters of a plain text message using fixed encryption transformation} - H04L 9/0637: {Modes of operation, e.g. cipher block chaining [CBC], electronic codebook [ECB] or Galois/counter mode [GCM]} - H04L 9/0816: {Key establishment, i.e. cryptographic processes or cryptographic protocols whereby a shared secret becomes available to two or more parties, for subsequent use} - H04L 9/14: using a plurality of keys or algorithms - H04L 9/3239: {involving non-keyed hash functions, e.g. modification detection codes [MDCs], MD5, SHA or RIPEMD} - H04L 9/3242: {involving keyed hash functions, e.g. message authentication codes [MACs], CBC-MAC or HMAC} - H04L 63/06: {for supporting key management in a packet data network (cryptographic mechanisms or cryptographic arrangements for key management H04L9/08)} - H04L 9/0643: {Hash functions, e.g. MD5, SHA, HMAC or f9 MAC} - H04L 9/30: Public key, i.e. encryption algorithm being computationally infeasible to invert or user's encryption keys not requiring secrecy - H04L 63/0428: {wherein the data content is protected, e.g. by encrypting or encapsulating the payload} - H04L 63/123: {received data contents, e.g. message integrity} - H04L: TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION (arrangements common to telegraphic and telephonic communication H04M) - G06F: ELECTRIC DIGITAL DATA PROCESSING (computer systems based on specific computational models G06N) ## Abstract A plaintext and cryptographic key are used to generate an initialization vector to be used in a cryptographic algorithm, such as an encryption algorithm. In some examples, the plaintext and cryptographic key are input into an effectively one-way function, such as a cryptographic hash function, the output of which is usable as an initialization vector. Cryptographic keys may be rotated probabilistically based at least in part on probabilities of output collisions of the effectively one-way function to ensure a low probability of two different plaintexts resulting in calculation of the same initialization vector for use with the same cryptographic key. ## Claims ### Claim 1 A computer-implemented method, comprising: generating, based at least in part on an amount of usage of a cryptographic key, a determination whether to replace the cryptographic key with another cryptographic key, the determination generated to comply with a condition that use of the cryptographic key in an algorithm, used by a set of devices, to generate an initialization vector based at least in part on an input plaintext and an input cryptographic key, is such that a probability of repeated use of the cryptographic key and a same initialization vector with different plaintexts is below a threshold. ### Claim 2 (depends on 1) The computer-implemented method of claim 1, wherein the algorithm generates the initialization vector based at least in part on output of a preimage-resistant function applied to function input, the function input based at least in part on the plaintext and the cryptographic key. ### Claim 3 (depends on 1) The computer-implemented method of claim 1, wherein the algorithm applies a cryptographic hash function to a set of inputs based at least in part on the plaintext and the cryptographic key. ### Claim 4 (depends on 1) The computer-implemented method of claim 1, wherein the amount of usage of the cryptographic key is an amount of encryption operations performed by the set of devices. ### Claim 5 (depends on 1) The computer-implemented method of claim 1, wherein the amount of usage of the cryptographic key is a number of encryption operations performed using the cryptographic key as the input cryptographic key for the algorithm. ### Claim 6 (depends on 1) The computer-implemented method of claim 1, wherein the set of devices comprises a plurality of devices that each use the cryptographic key to perform cryptographic operations. ### Claim 7 A system, comprising one or more computing devices including one or more computer-readable storage medium storing instructions that, when executed by one or more processors of the one or more computing devices, cause the one or more computing devices to: generate, based at least in part on an amount of usage of a cryptographic key, a determination whether to replace the cryptographic key with another cryptographic key, the determination generated to comply with a condition that use of the cryptographic key in an algorithm, used by a set of devices, to generate an initialization vector based at least in part on an input plaintext and an input cryptographic key, is such that a probability of repeated use of the cryptographic key and a same initialization vector with different plaintexts is below a threshold. ### Claim 8 (depends on 7) The system of claim 7, wherein the algorithm generates the initialization vector based at least in part on output of a preimage-resistant function applied to function input, the function input based at least in part on the plaintext and the cryptographic key. ### Claim 9 (depends on 7) The system of claim 7, wherein the one or more computing devices comprises a plurality of devices that each use the cryptographic key to perform cryptographic operations, and the amount of usage of the cryptographic key is determined based at least in part on individual usage of the cryptographic key by each of the plurality of devices. ### Claim 10 (depends on 7) The system of claim 7, wherein the usage of the cryptographic key is a number of encryption operations performed using the cryptographic key. ### Claim 11 (depends on 7) The system of claim 7, wherein the cryptographic key includes an identifier, and replacement of the cryptographic key comprises associating the other cryptographic key with the identifier. ### Claim 12 (depends on 11) The system of claim 11, wherein the system determines the amount of usage of the cryptographic key by at least aggregating usage of the cryptographic key by a plurality of other systems. ### Claim 13 (depends on 12) The system of claim 12, wherein the system aggregates the usage of the cryptographic key by processing logs generated by the plurality of other systems. ### Claim 14 (depends on 7) The system of claim 7, wherein the system further manages a plurality of cryptographic keys that includes the cryptographic key and uses individual cryptographic keys of the plurality of cryptographic keys to fulfill requests received by the system. ### Claim 15 (depends on 7) The system of claim 7, wherein the system performs the algorithm to fulfill requests to use the cryptographic key to perform cryptographic operations. ### Claim 16 A non-transitory computer-readable storage medium storing executable instructions that, as a result of execution by one or more processors of a computer system, cause the computer system to at least: generate, based at least in part on an amount of usage of a cryptographic key, a determination whether to replace the cryptographic key with another cryptographic key, the determination generated to comply with a condition that use of the cryptographic key in an algorithm, used by a set of devices, to generate an initialization vector based at least in part on an input plaintext and an input cryptographic key, is such that a probability of repeated use of the cryptographic key and a same initialization vector with different plaintexts is below a threshold. ### Claim 17 (depends on 16) The non-transitory computer-readable storage medium of claim 16, wherein the algorithm generates the initialization vector based at least in part on output of a preimage-resistant function applied to function input, the function input based at least in part on the plaintext and the cryptographic key. ### Claim 18 (depends on 16) The non-transitory computer-readable storage medium of claim 16, wherein the algorithm applies a cryptographic hash function to a set of inputs based at least in part on the plaintext and the cryptographic key. ### Claim 19 (depends on 16) The non-transitory computer-readable storage medium of claim 16, wherein the amount of usage of the cryptographic key is an amount of encryption operations performed by the set of devices. ### Claim 20 (depends on 16) The non-transitory computer-readable storage medium of claim 16, wherein the amount of usage of the cryptographic key is a number of encryption operations performed using the cryptographic key as the input cryptographic key for the algorithm.