# US 2021/0240862 A1 · Integrated circuit configured to carry out symmetric encryption operations without secret key transmission

> Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt

- Number: US 2021/0240862 A1
- Document ID: US20210240862A1
- Status: Published application
- Kind: A1
- Application number: 17/161,194
- Filed: 2021-01-28
- Published: 2021-08-05
- Earliest claimed: 2020-01-31
- Assignees: STMicroelectronics (Grenoble 2) SAS; STMicroelectronics (Alps) SAS
- Applicants: STMicroelectronics (Grenoble 2) SAS; STMicroelectronics (Alps) SAS
- Inventors: Gilles PELISSIER; Nicolas ANQUET; Delphine LE-GOASCOZ
- Web page: https://patentgrep.com/patent/US20210240862A1

## CPC

- G06F 21/72: in cryptographic circuits
- G06F 21/602: {Providing cryptographic facilities or services}
- H04L 9/0631: {Substitution permutation network [SPN], i.e. cipher composed of a number of stages or rounds each involving linear and nonlinear transformations, e.g. AES algorithms}
- H04L 9/0637: {Modes of operation, e.g. cipher block chaining [CBC], electronic codebook [ECB] or Galois/counter mode [GCM]}
- H04L 9/0866: {involving user or device identifiers, e.g. serial number, physical or biometrical information, DNA, hand-signature or measurable physical characteristics}
- H04L 9/3247: {involving digital signatures}
- H04L 2209/12: Details relating to cryptographic hardware or logic circuitry
- G06F: ELECTRIC DIGITAL DATA PROCESSING (computer systems based on specific computational models G06N)
- H04L: TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION (arrangements common to telegraphic and telephonic communication H04M)

## Abstract

An integrated circuit includes a secure hardware environment having a first input that receives a key number. A key generation device generates a secret key from the key number and a unique key. A signature generation device generates a signature associated with the key number. A second input of the secure hardware environment receives encrypted binary data. A decryption device operates to decrypt the received encrypted binary data using the secret key. A third input the secure hardware environment receives an authentication signature. An authentication device authorizes use of the secret key to decrypt only if the signature generated by the signature generation device is identical to the authentication signature.

## Claims

### Claim 1

An integrated circuit, comprising:
a secure hardware environment including a decryption system;
wherein the decryption system comprises:
a first input configured to receive a key number;
a key generation device configured to generate a secret key from the key number and a unique key;
a signature generation device configured to generate a signature associated with the key number;
a second input configured to receive encrypted binary data;
a decryption device configured to decrypt said encrypted binary data by using the secret key generated by the key generation device;
a third input configured to receive an authentication signature,
an authentication device configured to authorize the use of the secret key generated by the key generation device to decrypt said encrypted binary data if the signature generated by the signature generation device is identical to the authentication signature.

### Claim 2 (depends on 1)

The integrated circuit according to claim 1, wherein the secure hardware environment further comprises a key registry configured to record the secret key generated by the key generation device, and wherein the authentication device is configured to authorize recording of the secret key in the key registry only if the signature generated by the signature generation device of the decryption system is identical to the authentication signature

### Claim 3 (depends on 2)

The integrated circuit according to claim 2, wherein an output of the key registry delivers the recorded secret key to the decryption device to decrypt said encrypted binary data.

### Claim 4 (depends on 1)

The integrated circuit according to claim 1, wherein the unique key is a unique hardware key recorded in the secure hardware environment.

### Claim 5 (depends on 1)

The integrated circuit according to claim 1, wherein the decryption device is configured to carry out an AES decryption algorithm.

### Claim 6 (depends on 1)

The integrated circuit according to claim 1, wherein the key generation device is configured to carry out an AES algorithm according to a counter mode with CBC-MAC in order to generate the secret key from the key number and the unique key.

### Claim 7 (depends on 1)

The integrated circuit according to claim 1, wherein the key generation device is configured to implement an AES algorithm according to a mode GCM in order to generate the secret key from the key number and the unique key.

### Claim 8 (depends on 1)

The integrated circuit according to claim 1, wherein the secure hardware environment further includes an encryption system, said encryption system comprising:
a fourth input configured to receive binary data;
a symmetric encryption device configured to encrypt said binary data by using the secret key generated by the key generation device;
a first output configured to deliver the binary data encrypted by the symmetric encryption device; and
a second output configured to deliver the signature generated by the signature generation device.

### Claim 9 (depends on 8)

The integrated circuit according to claim 8, wherein said encryption system further comprises:
a first input configured to receive a key number,
a further key generation device configured to generate the secret key from the key number and the unique key; and
a further signature generation device configured to non-reversibly generate the signature associated with the key number.

### Claim 10 (depends on 9)

The integrated circuit according to claim 9, wherein the further signature generation device of the encryption system is identical to the signature generation device of the decryption system.

### Claim 11 (depends on 9)

The integrated circuit according to claim 9, wherein the further signature generation device of the encryption system is same as the signature generation device of the decryption system.

### Claim 12 (depends on 9)

The integrated circuit according to claim 9, wherein the further key generation device of the encryption system is identical to the key generation device of the decryption system.

### Claim 13 (depends on 9)

The integrated circuit according to claim 9, wherein the further key generation device of the encryption system is same as the key generation device of the decryption system.

### Claim 14 (depends on 9)

The integrated circuit according to claim 9, wherein the secure hardware environment further comprises:
a first key registry configured to record the secret key generated by the key generation device; and
a second key registry configured to record the secret key generated by the further key generation device.

### Claim 15 (depends on 9)

The integrated circuit according to claim 9, wherein the decryption device is configured to carry out an AES decryption algorithm and the symmetric encryption device is configured to carry out an AES encryption algorithm.

### Claim 16 (depends on 9)

The integrated circuit according to claim 9, wherein the key generation device and further key generation device are each configured to carry out an AES algorithm according to a counter mode with CBC-MAC in order to generate the secret key from the key number and the unique key.

### Claim 17 (depends on 9)

The integrated circuit according to claim 9, wherein the key generation device and further key generation device are each configured to implement an AES algorithm according to a mode GCM in order to generate the secret key from the key number and the unique key.

### Claim 18

A method for decrypting encrypted binary data in a secure hardware environment, comprising:
receiving a key number;
generating a secret key from the key number and a unique key;
generating a signature associated with the key number;
receiving said encrypted binary data;
receiving an authentication signature;
decrypting said encrypted binary data by using said secret key if the signature generated is identical to the authentication signature;
delivering decrypted binary data outside the secure hardware environment.

### Claim 19

A method for encrypting binary data in a secure hardware environment, comprising:
receiving a key number;
generating a secret key from the key number and a unique key;
non-reversibly generating a signature associated with the key number;
receiving said binary data;
encrypting said binary data by using the secret key;
delivering outside the secure hardware environment encrypted binary data; and
delivering the signature associated with the key number outside the secure hardware environment, said signature being adapted for being used as an authentication signature in a decryption method.