Hardware-generated dynamic identifier
In an example, there is disclosed an electronic apparatus, comprising: a hardware-encoded internal private key; and one or more logic elements comprising a key generation engine to: receive an third-party key; and operate on the third-party key and the internal private key to generate a hardware-generated dynamic identifier (HGDI). There is also disclosed a method of providing an HGDI engine, and one or more computer-readable mediums having stored thereon executable instructions for providing an HGDI.
1. An electronic apparatus, comprising:
a hardware-encoded internal private key, comprising a hardware-encoded fuse array not reasonably directly readable without destructively examining the electronic apparatus; and
one or more logic elements comprising a passive key generation engine, the key generation engine having write permission only to one or more special-purpose memory locations for storing pseudo-unique hardware-generated dynamic identifiers (HGDIs), the key generation engine comprising:
circuitry to receive an unencrypted third-party key from a third party;
function circuitry to apply a one-directional operation to the third-party key and the internal private key to generate a pseudo-unique HGDI, wherein the HGDI is unique and persistent with respect to the third party key; and
derivation circuitry to derive a cypher of the public key and the function circuitry.
2. The electronic apparatus of claim 1 , wherein the one or more logic elements are immutable hardware logic elements.
3. The electronic apparatus of claim 1 , wherein the key generation engine is further to encrypt the HGDI.
4. The electronic apparatus of claim 1 , wherein the key generation engine is further to encrypt the HGDI with a salt.
5. The electronic apparatus of claim 1 , further comprising a filter to reject third-party keys not provided by a key authority.
6. The electronic apparatus of claim 1 , wherein the one or more special-purpose memory locations are not read restricted.
7. The electronic apparatus of claim 1 , wherein the one or more special-purpose memory locations are not read restricted to system-level resources.
8. The electronic apparatus of claim 1 , further comprising means to mitigate a replay attack.
9. The electronic apparatus of claim 8 , wherein the means comprise a temporal counter.
10. One or more tangible, non-transitory computer-readable storage mediums having stored thereon executable instructions for a processor of a hardware platform to provide passive key generation, wherein the instructions are to write only to one or more special-purpose memory locations for storing pseudo-unique hardware-generated dynamic identifiers (HGDIs), further operable to:
provide an internal private key, comprising a hardware-encoded fuse array not reasonably directly readable without destructively examining the hardware platform;
receive an unencrypted third-party key from a third party; and
apply a one-directional operation to the third-party key and the internal private key to generate a pseudo-unique HGDI, wherein the HGDI is unique and persistent with respect to the third party key; and
derive a cypher of the public key and the function circuitry.
11. The one or more tangible, non-transitory computer-readable storage mediums of claim 10 , wherein the one or more storage mediums comprise immutable hardware logic elements.
12. The one or more tangible, non-transitory computer-readable storage mediums of claim 10 , wherein the instructions are further to encrypt the HGDI with a salt.
13. The one or more tangible, non-transitory computer-readable storage mediums of claim 10 , wherein the instructions are further to reject third-party keys not provided by a key authority.
14. The one or more tangible, non-transitory computer-readable storage mediums of claim 10 wherein the one or more special-purpose memory locations are not read restricted to system-level resources.
15. The one or more tangible, non-transitory computer-readable storage mediums of claim 10 , wherein the instructions are further to mitigate a replay attack.
16. The one or more tangible, non-transitory computer-readable storage mediums of claim 15 , wherein the instructions are further to mitigate a replay attack comprising inspecting a temporal counter.
17. The one or more tangible, non-transitory computer-readable storage mediums of claim 10 , wherein providing the internal private key comprises deriving the internal private key from a value encoded in hardware.
18. The one or more tangible, non-transitory computer-readable storage mediums of claim 17 , wherein deriving the internal private key from the value encoded in hardware comprises applying a one-way function to the value encoded in hardware.
19. A method of providing a hardware-generated device identifier (HGDI) engine within immutable hardware of an electronic apparatus, the HGDI engine having write permission only to one or more special-purpose memory locations for storing pseudo-unique HGDIs, comprising providing passive key generation, and further comprising:
providing a hardware-encoded internal private key, comprising a hardware-encoded fuse array not reasonably directly readable without destructively examining the electronic apparatus;
receiving an unencrypted third-party key from a third party; and
applying a one-directional operation to the third-party key and the internal private key to generate a pseudo-unique HGDI, wherein the HGDI is unique and persistent with respect to the third party key; and
deriving a cypher of the public key and the function circuitry.
20. The method of claim 19 , further comprising encrypting the HGDI with a salt.
21. The method of claim 19 , further comprising rejecting third-party keys not provided by a key authority.