# US 2025/0165408 A1 · Techniques and devices for configurable memory encryption and authentication > Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt - Number: US 2025/0165408 A1 - Document ID: US20250165408A1 - Status: Published application - Kind: A1 - Application number: 18/839,408 - Filed: 2023-02-24 - Published: 2025-05-22 - Earliest claimed: 2022-02-25 - Assignees: Cryptography Research, Inc. - Applicants: Cryptography Research, Inc. - Inventors: Ajay Kapoor; Marcel Van Loon - Web page: https://patentgrep.com/patent/US20250165408A1 ## CPC - G06F 12/1408: {by using cryptography (for digital transmission H04L9/00)} - G06F 21/72: in cryptographic circuits - G06F 11/1004: {to protect a block of data words, e.g. CRC or checksum (G06F11/1076 takes precedence; security arrangements for protecting computers or computer systems against unauthorized activity G06F21/00)} - G09C 1/00: Apparatus or methods whereby a given sequence of signs, e.g. an intelligible text, is transformed into an unintelligible sequence of signs by transposing the signs or groups of signs or by replacing them by others according to a predetermined system (cryptographic typewriters G09C3/00) - H04L 9/0625: {with splitting of the data block into left and right halves, e.g. Feistel based algorithms, DES, FEAL, IDEA or KASUMI} - H04L 9/0631: {Substitution permutation network [SPN], i.e. cipher composed of a number of stages or rounds each involving linear and nonlinear transformations, e.g. AES algorithms} - G06F 2212/1052: Security improvement - H04L 2209/34: Encoding or coding, e.g. Huffman coding or error correction - G06F: ELECTRIC DIGITAL DATA PROCESSING (computer systems based on specific computational models G06N) - G09C: CIPHERING OR DECIPHERING APPARATUS FOR CRYPTOGRAPHIC OR OTHER PURPOSES INVOLVING THE NEED FOR SECRECY - H04L: TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION (arrangements common to telegraphic and telephonic communication H04M) ## Abstract Disclosed systems and techniques involve flexible encryption, decryption, retrieval, and authentication of data. The systems may include a cryptographic processor that, in a first selectable mode of operation is configured to identify plaintext blocks, generate encrypted ciphertext blocks, process sequentially the ciphertext blocks to obtain an authentication value, encrypt the authentication value, and store the ciphertext blocks and an authentication tag, obtained based on the encrypted authentication value. In a second selectable mode, the cryptographic processor may perform ciphertext block encryption but forgo obtaining the authentication value. ## Claims ### Claim 1 A method to perform a cryptographic operation, the method comprising: identifying, by a processing device, a plurality of plaintext blocks; generating, by the processing device, a plurality of ciphertext blocks, wherein each of the plurality of ciphertext blocks is generated by encrypting a respective block of the plurality of plaintext blocks; processing sequentially, by the processing device, the plurality of ciphertext blocks to obtain an authentication value; encrypting, by the processing device, the authentication value to obtain an encrypted authentication value; and storing the plurality of ciphertext blocks and an authentication tag for the plurality of ciphertext blocks, wherein the authentication tag is based on the encrypted authentication value. ### Claim 2 (depends on 1) The method of claim 1, wherein the plurality of ciphertext blocks are generated using one or more cipher circuits, wherein the one or more cipher circuits implement at least one of AES encryption or SM4 encryption. ### Claim 3 (depends on 1, 3) The method of claim 1, wherein generating the plurality of ciphertext blocks comprises processing the plurality of plaintext blocks in view of an additional input, wherein the additional input comprises a cryptographic key and at least one of a version number associated with the plurality of plaintext blocks, a memory address of a memory location allocated to storing the plurality of ciphertext blocks, or a session-specific information. 4 The method of claim 3, wherein processing sequentially the plurality of ciphertext blocks to obtain the authentication value comprises: using a plurality of addition operations and a plurality of multiplication operations, to obtain the authentication value starting from a seed authentication value, wherein at least a sub-plurality of the plurality of addition operations updates the authentication value by adding, to the authentication value, a respective ciphertext block of the plurality of ciphertext blocks, and wherein the plurality of multiplication operations updates the authentication value by multiplying the authentication value by an auxiliary value. ### Claim 5 (depends on 4) The method of claim 4, wherein the seed authentication value comprises at least one of a version number associated with the plurality of plaintext blocks or a memory address of a memory location allocated to storing the plurality of ciphertext blocks. ### Claim 6 (depends on 1) The method of claim 1, wherein the authentication tag comprises the encrypted authentication value. ### Claim 7 (depends on 1) The method of claim 1, wherein the encrypted authentication value is obtained by processing the authentication value using a cipher circuit. ### Claim 8 (depends on 1) The method of claim 1, wherein the authentication tag is obtained using the encrypted authentication value and a tweak value, wherein the tweak value is obtained by using an encrypted, by a cipher circuit, authentication data, wherein the authentication data comprises a memory address of a memory location allocated to storing the plurality of ciphertext blocks. ### Claim 9 A method comprising: storing, at a first memory location, a plurality of ciphertext blocks; storing, at the first memory location, an authentication tag for the plurality of ciphertext blocks; storing, at a second memory location, an error correction code (ECC) for the plurality of ciphertext blocks; retrieving, from the first memory location, the plurality of ciphertext blocks; retrieving, from the first memory location, the authentication tag; obtaining, using the plurality ciphertext blocks, a control authentication tag for the plurality of ciphertext blocks; and determining, responsive to a comparison of the authentication tag to the control authentication tag, whether to retrieve the ECC. ### Claim 10 (depends on 9) The method of claim 9, further comprising: responsive to determining that the control authentication tag matches the authentication tag, forgoing retrieval of the ECC. ### Claim 11 (depends on 9) The method of claim 9, further comprising: responsive to determining that the control authentication tag does not match the authentication tag, retrieve the ECC from the second memory location; and determining, based on the retrieved ECC, whether a security breach has occurred. ### Claim 12 (depends on 11) The method of claim 11, wherein determining whether a security breach has occurred comprises: obtaining, using the retrieved ECC, a corrected control authentication tag; responsive to determining that corrected control authentication tag does not match the authentication tag, determining that a security breach has occurred. ### Claim 13 (depends on 9) The method of claim 9, wherein the authentication tag and the plurality of ciphertext blocks are stored at a same address of the first location or at a plurality of contiguous addresses of the first location. ### Claim 14 A cryptographic processor comprising: one or more cipher circuits configured to: process a plurality of plaintext blocks and to output a plurality of ciphertext blocks, wherein each of the plurality of ciphertext blocks comprises an encrypted respective block of the plurality of plaintext blocks; and one or more processing circuits configured to: in a first selectable mode, process sequentially the plurality of ciphertext blocks to obtain an authentication value; in a second selectable mode, perform no processing; wherein the one or more cipher circuits are further configured to: in the first selectable mode, encrypt the authentication value to obtain an encrypted authentication value; and in the second selectable mode, perform no processing. ### Claim 15 (depends on 14) The cryptographic processor of claim 14, wherein the one or more cipher circuits implement at least one of AES encryption or SM4 encryption. ### Claim 16 (depends on 14) The cryptographic processor of claim 14, wherein to output the plurality of ciphertext blocks, the one or more circuits are configured to process the plurality of plaintext blocks in view of an additional input, wherein the additional input comprises a cryptographic key and at least one of a version number associated with the plurality of plaintext blocks, a memory address of a memory location allocated to storing the plurality of ciphertext blocks, or a session-specific information. ### Claim 17 (depends on 14) The cryptographic processor of claim 14, wherein the one or more processing circuits are configured to: in the first selectable mode, update the authentication value by adding, to the authentication value, a respective ciphertext block of the plurality of ciphertext blocks. ### Claim 18 (depends on 17) The cryptographic processor of claim 17, wherein the one or more processing circuits comprise a plurality of multiplication circuits configured to: in the first selectable mode, update the authentication value by multiplying the authentication value by an auxiliary value. ### Claim 19 (depends on 14) The cryptographic processor of claim 14, wherein the one or more processing circuits are configured to: in the first selectable mode, obtain the authentication value starting from a seed authentication value, wherein the seed authentication value comprises at least one of a version number associated with the plurality of plaintext blocks or a memory address of a memory location allocated to storing the plurality of ciphertext blocks. ### Claim 20 (depends on 14) The cryptographic processor of claim 14, wherein the one or more cipher circuits are further configured to: in the first selectable mode, encrypt authentication data to obtain a tweak value, wherein the authentication data comprises a memory address of a memory location allocated to storing the plurality of ciphertext blocks; and wherein the one or more processing circuits are further configured to: generate an authentication tag using the tweak value and the authentication value.