DEVICE AND METHOD FOR OBTAINING A CRYPTOGRAPHIC KEY
A computing device for obtaining a first cryptographic key during an enrollment phase, the computing device comprising a key generator for generating the first cryptographic key in dependence upon a seed, the computing device being configured for storing the first cryptographic key on a storage of the computing device for later cryptographic use of the first cryptographic key on the computing device during a usage phase coming after the enrollment phase wherein, the computing device further comprises a physically unclonable function, the key generator being configured for deriving the seed from an output of the physically unclonable function, and an encryption module for encrypting the first cryptographic key using a second cryptographic key derived from the output of the physically unclonable function, the computing device being configured for storing the first cryptographic key on the storage in encrypted form.
1 . A computing device for obtaining a first cryptographic key during an enrollment phase, the computing device comprising a key generator for generating the first cryptographic key in dependence upon a seed, the computing device being configured for storing the first cryptographic key on a storage of the computing device for later cryptographic use of the first cryptographic key on the computing device during a usage phase coming after the enrollment phase
wherein, the computing device further comprises
a physically unclonable function, the key generator being configured for deriving the seed from an output of the physically unclonable function, and
an encryption module for encrypting the first cryptographic key using a second cryptographic key derived from the output of the physically unclonable function,
the computing device being configured for storing the first cryptographic key on the storage in encrypted form.
2 . A computing device as in claim 1 comprising a decryption module for decrypting the stored, encrypted, first cryptographic key using the second cryptographic key derived from a further output of the physically unclonable function, during the usage phase.
3 . A computing device as in claim 1 wherein the first cryptographic key comprises at least a private key from a cryptographic public-private key pair.
4 . A computing device as in claim 1 wherein the second cryptographic key is a symmetric key.
5 . A computing device as in claim 1 wherein the second cryptographic key comprises the seed.
6 . A computing device as in claim 1 wherein the encrypting of the encryption module comprises computing a difference between the second cryptographic key and the first cryptographic key.
7 . A computing device as in claim 1 wherein deriving of the second cryptographic key from the output comprises applying a hash function to the output.
8 . A computing device as in claim 1 wherein the storage is external to the computing device and connectable to the computing device.
9 . A computing device as in claim 1 wherein
generating the first cryptographic key comprises obtaining a prime number, the first cryptographic key comprising multiple key components, at least one of the key components being the prime number,
obtaining the prime number comprises generating in dependency upon the seed candidate prime numbers and testing the candidate prime numbers for primality until the prime number is obtained, an index indicating a number of candidate prime numbers which were tested to obtain the prime number,
encrypting the first cryptographic key comprises representing the prime number with the index.
10 . A computing device as in claim 9 wherein the index represents the arithmetical difference between the seed and the prime number.
11 . A computing device as in claim 1 wherein the computing device is comprised in any one of an rfid tag, smart card, mobile phone, set-top box, and an electronic circuit.
12 . A computing device as in claim 1 wherein the physically unclonable function comprises any one of:
a memory configured as a physically unclonable function, in particular a volatile memory such as an SRAM, Flip Flop, or Register configured as a physically unclonable function,
an FPGA configured as a physically unclonable function, in particular an FPGA configured for a butterfly PUF,
a physically unclonable function based on measuring a delay in an integrated circuit,
an optical physically unclonable function,
an oscillation based PUF, an Arbiter PUF.
13 . A method for obtaining a first cryptographic key during an enrollment phase, comprising
generating the first cryptographic key in dependence upon a seed,
storing the first cryptographic key on a storage for later cryptographic use of the first cryptographic key during a usage phase coming after the enrollment phase
wherein, the method further comprises
deriving the seed from an output of a physically unclonable function
encrypting the first cryptographic key using a second cryptographic key derived from the output of the physically unclonable function, and wherein
storing the first cryptographic key comprises storing the first cryptographic key on the storage in encrypted form.
14 . A computer program comprising computer program code means adapted to perform all the steps of the method of claim 13 when the computer program is run on a computer.
15 . A computer program as claimed in claim 14 embodied on a computer readable medium.