Method and system for secure storage, transmission and control of cryptographic keys

A cryptographic system, comprising:

• a host system communicatively coupled to at least one source;
• a security module within a security boundary that is communicatively coupled to the host system, wherein the security module is configured to receive a secure key block, the secure key block containing
• an encrypted key field containing an encrypted key,
• a control field identifying attributes of the key, and
• a message authentication code (MAC) field that cryptographically ties the control field and the encrypted key field,
• wherein the security module is configured to
• apply a MAC algorithm using a first key across the control field and the encrypted key field to create a computed MAC field;
• compare the received MAC field to the computed MAC field;
• if the received MAC field is equal to the computed MAC field, decrypt the encrypted key field to reveal at least one clear key using a second key.

A cryptographic system, comprising:

• means for receiving a secure key block that includes a control field with associated control attributes, an encrypted key field, and a message authentication code (MAC) field
• means for applying a MAC algorithm using a first key across the control field and the encrypted key field to create a computed MAC field;
• means for comparing the received MAC field to the computed MAC field;
• means for decrypting the encrypted key field to reveal at least one clear key using a second key if the received MAC field is equal to the computed MAC field.

A method for encapsulating and controlling a clear key in a secure key block, comprising:

• generating an encrypted key field by applying an encryption algorithm to the clear key;
• appending a control field to the encrypted key field, wherein the control field contains attributes of the clear key;
• applying a message authentication code (MAC) algorithm to the concatenated control field and the encrypted key field to create a MAC field that cryptographically ties the control field to the encrypted key field;
• and
• appending the MAC field to the control field and the encrypted key field.

A cryptographic system, comprising:

• a host system communicatively coupled to at least one source;
• a security module within a security boundary that is communicatively coupled to the host system, wherein the security module is configured to provide a key in a secure key block when the key is passed outside of the security boundary, the secure key block containing
• an encrypted key field containing an encrypted key,
• a control field identifying attributes of the key, and
• a message authentication code (MAC) field that cryptographically ties the control field and the encrypted key field;
• and
• an unsecure storage medium configured to store the at least one secure key block.

A cryptographic system, comprising:

• means for generating an encrypted key field, by application of an encryption algorithm to a key;
• means for appending a control field to the encrypted key field, wherein the control field contains attributes of the key;
• and
• means for applying a message authentication code (MAC) algorithm to the concatenated control field and the encrypted key field to create a MAC field that cryptographically ties the control field to the encrypted key field.