Hardware specific cryptographic key
System and techniques to generate a cryptographic key specific to a type of hardware are described herein. Software distribution and execution can use cryptographic keys tailored to specific hardware. A secret is generated from a hardware public key. The secret is used to create software public and private keys. The secret is used to protect the data and the public key is distributed with the software for use on a class of hardware to which the hardware private key is applicable. The hardware then uses the software public key and a local copy of the hardware private key to find the secret and decrypt the software to run the software locally.
1 . A non-transitory machine readable medium including instructions for a hardware specific cryptographic key, the instructions, when executed by processing circuitry, cause the processing circuitry to perform operations comprise:
requesting a hardware public key for a class of computer hardware;
generating a secret based on the hardware public key;
encrypting data based on the secret to create encrypted data;
packaging a software public key with the encrypted data to create a software package, the software public key based on the secret;
releasing, upon a request, the software package for use on an instance of computer hardware that is part of the class of computer hardware, the software package being decrypted by the instance of computer hardware using the secret derived from the software public key;
receiving second data;
generating a second secret based on the hardware public key;
encrypting the second data using the second secret to create second encrypted data;
packaging a second software public key with the second encrypted data to create a second software package, the second software public key based on the second secret; and
releasing, upon a request, the second software package for use with the instance of computer hardware, the second software package being decrypted by the instance of computer hardware using the second secret derived from the second software public key.
2 . The non-transitory machine readable medium of claim 1 , wherein the instance of the computer hardware includes a hardware private key that is used with the software public key to determine the secret.
3 . The non-transitory machine readable medium of claim 1 , wherein the hardware public key, the software public key, and the secret are related by a Diffie-Helman key agreement protocol.
4 . The non-transitory machine readable medium of claim 3 , wherein the Diffie-Helman key agreement protocol is an Elliptic-curve Diffie-Helman key agreement protocol.
5 . The non-transitory machine readable medium of claim 1 , wherein encrypting the data based on the secret includes:
creating an encryption-decryption key based on the secret; and
encrypting the data using the encryption-decryption key.
6 . The non-transitory machine readable medium of claim 1 , wherein the data and the second data are components of a software system.
7 . The non-transitory machine readable medium of claim 6 , wherein the software system includes third data that is not encrypted.
8 . The non-transitory machine readable medium of claim 1 , wherein the second data is a different version of the data.
9 . A device for a hardware specific cryptographic key, the device comprising:
an interface to connect to a network;
memory including instructions; and
processing circuitry that, when in operation, is configured by the instructions to:
request, via the interface, a hardware public key for a class of computer hardware;
generate a secret based on the hardware public key;
encrypt data based on the secret to create encrypted data;
package a software public key with the encrypted data to create a software package, the software public key based on the secret;
release, upon a request, the software package for use on an instance of computer hardware that is part of the class of computer hardware, the software package being decrypted by the instance of computer hardware using the secret derived from the software public key;
receive second data;
generate a second secret based on the hardware public key;
encrypt the second data using the second secret to create second encrypted data;
package a second software public key with the second encrypted data to create a second software package, the second software public key based on the second secret; and
release, upon a request, the second software package for use with on the instance of computer hardware, the second software package being decrypted by the instance of computer hardware using the second secret derived from the second software public key.
10 . The device of claim 9 , wherein the instance of the computer hardware includes a hardware private key that is used with the software public key to determine the secret.
11 . The device of claim 9 , wherein the hardware public key, the software public key, and the secret are related by a Diffie-Helman key agreement protocol.
12 . The device of claim 11 , wherein the Diffie-Helman key agreement protocol is an Elliptic-curve Diffie-Helman key agreement protocol.
13 . The device of claim 9 , wherein, to encrypt the data based on the secret, the processing circuitry is configured to:
create an encryption-decryption key based on the secret; and
encrypt the data using the encryption-decryption key.
14 . The device of claim 9 , wherein the data and the second data are components of a software system.
15 . The device of claim 14 , wherein the software system includes third data that is not encrypted.
16 . The device of claim 9 , wherein the second data is a different version of the data.
17 . A method for a hardware specific cryptographic key, the method comprising:
requesting a hardware public key for a class of computer hardware;
generating a secret based on the hardware public key;
encrypting data based on the secret to create encrypted data;
packaging a software public key with the encrypted data to create a software package, the software public key based on the secret;
releasing, upon a request, the software package for use on an instance of computer hardware that is part of the class of computer hardware, the software package being decrypted by the instance of computer hardware using the secret derived from the software public key;
receiving second data;
generating a second secret based on the hardware public key;
encrypting the second data using the second secret to create second encrypted data;
packaging a second software public key with the second encrypted data to create a second software package, the second software public key based on the second secret; and
releasing, upon a request, the second software package for use with on the instance of computer hardware, the second software package being decrypted by the instance of computer hardware using the second secret derived from the second software public key.
18 . The method of claim 17 , wherein the hardware public key, the software public key, and the secret are related by a Diffie-Helman key agreement protocol.
19 . The method of claim 18 , wherein the Diffie-Helman key agreement protocol is an Elliptic-curve Diffie-Helman key agreement protocol.
20 . The method of claim 17 , wherein the data and the second data are components of a software system.