Ratchet-based key management

1 . A device, comprising:

one or more processors, and one or more memories coupled with the one or more processors, the one or more processors comprising:

a cryptographic accelerator configured to perform a cryptographic operation; and

a key derivative function (KDF) component configured to:

receive a ratchet-based key management system (RKMS) key and perfect forward secrecy (PFS) information, and

generate a key based on the RKMS key and the PFS information; and an RKMS component configured to:

provide the PFS information to the KDF component for generation of one or more keys by the KDF component,

receive the key generated by the KDF component,

store the key as a successive RKMS key and as a successive output key,

cause the successive RKMS key to be stored in a non-volatile memory,

obtain, from the non-volatile memory, the successive RKMS key in response to powering on the device after the device being powered off or operated in a low power mode,

provide the successive RKMS key obtained from the non-volatile memory for generation of a next successive RKMS key by the KDF component, and

provide, as an output key, the successive output key to the cryptographic accelerator for performing the cryptographic operation based on the output key according to a cryptography scheme;

wherein the cryptographic accelerator is configured to receive input data, perform the cryptographic operation on the input data according to the cryptography scheme based on the output key, and provide output data to a channel.

2 . The device of claim 1 , wherein the RKMS component is further configured to:

receive an initial key and the PFS information,

store the PFS information, and

store the initial key as the RKMS key.

3 . The device of claim 2 , wherein at least one of the initial key or the PFS information is received from a key exchange processing component.

4 . The device of claim 2 , wherein at least one of the initial key or the PFS information is obtained from a non-volatile memory component.

5 . The device of claim 1 , wherein the RKMS component is further configured to provide the RKMS key to the KDF component in association with generating the key.

6 . The device of claim 1 , wherein the RKMS component is further configured to store the successive output key as the output key based on a key request being received by the device, wherein the successive output key is stored as the output key prior to the output key being provided in association with performing the cryptographic operation.

7 . The device of claim 1 , wherein the RKMS component is further configured to cause at least one of the PFS information or the successive RKMS key to be stored in a non-volatile memory component.

8 . The device of claim 1 , wherein the PFS information includes information determined based on a key agreement performed in a secure execution environment.

9 . The device of claim 1 , wherein the RKMS component is further configured to:

receive updated PFS information, and

provide the updated PFS information to the KDF component in association with generating one or more keys based on the updated PFS information.

10 . The device of claim 1 , wherein the RKMS component is a first RKMS component, and the device further comprises a second RKMS component.

11 . A method, comprising:

receiving, by a key derivative function (KDF) component of a device, a ratchet-based key management system (RKMS) key and perfect forward secrecy (PFS) information;

generating, by the KDF component, a key based on the RKMS key and the PFS information;

receiving, by an RKMS component of the device, the key generated by the KDF component;

storing, by the RKMS component, the key as a successive RKMS key and as a successive output key;

causing the successive RKMS key to be stored in a non-volatile memory;

obtaining, from the non-volatile memory, the successive RKMS key in response to powering on the device after the device being powered off or operated in a low power mode;

providing, by the RKMS component, the successive RKMS key obtained from the non-volatile memory for generation of a next successive RKMS key by the KDF component; and

providing, by the RKMS component, the successive output key as an output key to a cryptographic accelerator for performing a cryptographic operation on input data based on the output key according to a cryptography scheme, wherein the cryptographic accelerator is configured to receive input data, perform the cryptographic operation on the input data according to the cryptography scheme based on the output key, and provide output data to a channel.

12 . The method of claim 11 , further comprising

providing, by the RKMS component, the PFS information to the KDF component.

13 . The method of claim 11 , further comprising:

receiving, by the RKMS component, an initial key and the PFS information,

storing, by the RKMS component, the PFS information, and

storing, by the RKMS component, the initial key as the RKMS key.

14 . The method of claim 13 ,

wherein the method further comprises providing, by the RKMS component, the RKMS key to the KDF component in association with generating the key.

15 . The method of claim 11 , further comprising

storing, by the RKMS component, the successive output key as the output key based on a key request being received by the device, wherein the successive output key is stored as the output key prior to the output key being provided in association with performing the cryptographic operation.

16 . The method of claim 11 , further comprising

causing, by the RKMS component, at least one of the PFS information or the successive RKMS key to be stored in a non-volatile memory component.

17 . The method of claim 11 , further comprising:

receiving, by the RKMS component, updated PFS information, and

providing, by the RKMS component, the updated PFS information to the KDF component.

18 . A ratchet-based key management system (RKMS) device, comprising:

one or more memories; and

one or more processors coupled with the one or more memories and configured to cause the device to:

provide perfect forward secrecy (PFS) information for generation of one or more keys;

receive a key generated based on the PFS information and an RKMS key;

store the key as a successive RKMS key and as a successive output key;

cause the successive RKMS key to be stored in a non-volatile memory,

obtain, from the non-volatile memory, the successive RKMS key in response to powering on the device after the device being powered off or operated in a low power mode,

provide the successive RKMS key obtained from the non-volatile memory for generation of a next successive RKMS key; and

provide an output key to a cryptographic accelerator, the cryptographic accelerator to perform a cryptographic operation on input data according to a cryptographic scheme based on the output key to generate output data, wherein the cryptographic accelerator is configured to receive input data, perform the cryptographic operation on the input data according to the cryptography scheme based on the output key, and provide output data to a channel.

19 . The RKMS device of claim 18 ,

wherein the one or more processors are further configured to provide the RKMS key in association with generating the key.

20 . The RKMS device of claim 18 ,

wherein the one or more processors are further configured to:

receive an initial key and the PFS information,

store the PFS information, and

store the initial key as the RKMS key.