Endorsed device certificate chain autonomous extension

A method comprising:

• receiving, by a processing device, an update to firmware of memory sub-system comprising a memory device;
• and
• in response to receiving the update to the firmware, storing a private key of a first device identity key pair in a non-volatile memory component of the memory sub-system such that the private key is persisted upon reset of the memory sub-system, the first device identity key pair being generated based on a first device identifier associated with the memory device,
• the storing of the private key comprising:
• deriving a wrapping key using a key derivation function based on a first set of firmware measurements;
• and
• wrapping the private key using the wrapping key;
• upon reset of the memory sub-system,
• generating, by the processing device, a second device identifier associated with the memory device based on the update to the firmware of the memory sub-system;
• generating, by the processing device, a second device identity key pair based on the second device identifier;
• generating, by the processing device, a new device identity certificate for the memory sub-system based on a public key of the second device identity key pair;
• accessing the private key of the first device identity key pair;
• signing, by the processing device, the new device identity certificate using the private key of the first device identity key pair;
• and
• injecting, by the processing device, the new device identity certificate into a certificate chain for the memory device.

A non-transitory computer-readable storage medium comprising instructions that, when executed by a processing device, configure the processing device to perform operations comprising:

• in response to receiving an update to firmware of a memory sub-system comprising a memory device, storing a private key of a first device identity key pair in a non-volatile memory component of the memory sub-system such that the private key is persisted upon reset of the memory sub-system, the first device identity key pair being generated based on a first device identifier associated with the memory device, the storing of the private key comprising:
• deriving a wrapping key using a key derivation function based on a first set of firmware measurements;
• and
• wrapping the private key using the wrapping key;
• generating a second device identifier associated with the memory device based on the update to the firmware of the memory sub-system;
• generating a second device identity key pair based on the second device identifier;
• generating a new device identity certificate for the memory sub-system based on a public key of the second device identity key pair;
• accessing the private key of the first device identity key pair;
• signing the new device identity certificate using the private key of the first device identity key pair;
• destroying the private key of the first device identity key pair;
• and
• injecting the new device identity certificate into a certificate chain for the memory device.