Secure translation of usage-control values for cryptographic keys

An apparatus for secure translation of a working key from a first encrypted form to a second encrypted form, said first encrypted form being said working key encrypted using a first usage-control value and a first key-encrypting-key, said second encrypted form being said working key encrypted using a second usage-control value and a second key-encrypting-key, said apparatus comprising:

• (a) installation means for combining and encrypting said first usage-control value and said second usage-control value to produce a generated translation control value (TCV);
• (b) means for performing a reencipher cryptographic key operation, with input comprising an input TCV and said first encrypted form of said working key, said means for performing further comprising:
• 1. means for deriving a third usage-control value and a fourth usage-control value from said TCV;
• 2. means for deciphering said first encrypted form of said working key using said third usage-control value and said first key-encrypting-key;
• 3. means said working key using said fourth usage-control value and said second key-encrypting-key and producing a translated result, said translated result being said to be correct only if said input TCV equals said generated TCV, and being another value if said input TCV does not equal said generated TCV, said translated result, when correct, being said second encrypted form of said working key, whereby said input TCV controls whether said translated result is correct.

An apparatus for secure translation of a working key from a fist encrypted form to a second encrypted form, said first encrypted form being said working key encrypted using a first usage-control value (UCV) and a first key-encrypting-key, said second encrypted form being said working key encrypted using a second usage-control value and a second key-encrypting-key, said apparatus comprising:

• (a) installation means for combining and encrypting said first usage-control value and said second usage-control value to produce a generated translation control value (TCV);
• (b) means for performing a reencipher cryptographic key operation without conditioning said operation on UCV or TCV checking, with input comprising an input TCV and said first encrypted form of said working key, said means for performing further comprising:
• 1. means for deriving a third usage-control value and a fourth usage-control value from said TCV;
• 2. means for deciphering said first encrypted form of said working key using said third usage-control value and said first key-encrypting-key;
• 3. means for enciphering said working key using said fourth usage-control value and said second key-encrypting-key and producing a translated result, said translated result being said to be correct only if said input TCV equals said generated TCV, and being another value if said input TCV does nto equal said generated TCV, said translated result, when correct, being said second encrypted form of said working key, whereby said input TCV controls whether said translated result is correct.