Digital cryptosystem with re-derivable hybrid keys

1. A hybrid cryptographic system for securing a set of one or more datasets, said system comprising computer executable instructions stored in a non-transitory memory that, when run on a processor, are configured to:

generate a master key, said master key for use with all of the one or more datasets; and

for each of the one or more datasets:

generate a separate initialization vector (“IV”);

stretch the IV via an extendable output function (“XOF”) to produce a stretched IV, wherein said XOF is a function that, given an input, produces a consistent output of a predetermined length;

input the stretched IV and the master key to a keyed hash function to derive an ephemeral key; and

encrypt the dataset by inputting the IV, the dataset, and the ephemeral key to a cryptographic function to produce a ciphertext.

2. The system of claim 1 , wherein the computer executable instructions are further configured to:

link the IV with the ciphertext by appending the IV to the ciphertext to create a combined text; and

store and/or transmit the combined text without the ephemeral key;

wherein, to decrypt the ciphertext, the computer executable instructions are configured to:

extract the IV and the ciphertext from the combined text;

re-produce the stretched IV by inputting the IV to the XOF;

re-derive the ephemeral key via the keyed hash function using the stretched IV and the master key; and

decrypt the ciphertext by inputting the IV, the ciphertext, and the ephemeral key to the cryptographic function to reproduce the dataset in plaintext.

3. The system of claim 1 , wherein: the IV is a string of either 96 or 128 bits;

the master key is a string of 256 bits; and

the computer executable instructions are further configured to stretch the IV by producing, based on the IV and via the XOF, a string of 256 bits for use as the stretched IV.

4. The system of claim 1 , wherein the cryptographic function satisfies the Advanced Encryption Standard (“AES”) cryptographic standard specified in Federal Information Processing Standards Publication 197 (“FIPS PUB 197”).

5. The system of claim 1 , wherein the XOF satisfies the Secure Hash Algorithm-3 (“SHA-3”) standard specified in Federal Information Processing Standards Publication 202 (“FIPS PUB 202”).

6. The system of claim 1 , wherein the keyed hash function satisfies the Keyed-Hash Message Authentication Code (“HMAC”) standard specified in Federal Information Processing Standards Publication 198-1 (“FIPS PUB 198-1”).

7. The system of claim 1 , wherein the computer executable instructions are further configured to input the IV to the cryptographic function to encrypt the dataset using a mode of operation defined by the National Institute of Standards and Technology (“NIST”) in the NIST Special Publications 800-38A through 800-38E.

8. A method for generating an ephemeral key and using the ephemeral key to secure a dataset, said ephemeral key being a digital cryptographic key that is derived to encrypt the dataset, and is rederive-able on demand to decrypt the dataset without the ephemeral key being stored after the encrypting, the method executed by computer code stored in a non-transitory memory running on a hardware processor, the method comprising:

generating a random initialization vector (“IV”);

stretching the IV to produce a stretched IV;

deriving the ephemeral key based on the stretched IV and a master key, said master key being a global cryptographic key that is stored in a secure memory and is shared by other datasets; and

encrypting the dataset using the IV and the ephemeral key to produce a ciphertext; wherein the ciphertext is decrypted by:

re-stretching the IV to re-produce the stretched IV;

re-deriving the ephemeral key based on the re-produced stretched IV and the master key; and

decrypting the ciphertext using the IV and the ephemeral key.

9. The method of claim 8 , wherein: the dataset is a member of a set of datasets; and

the method is executed for each dataset in the set of datasets, wherein the method comprises deriving a separate IV for each dataset in the set of datasets.

10. The method of claim 8 , wherein:

the stretching comprises inputting the IV to an extendable output function (“XOF”) and receiving the stretched IV as output from the XOF, wherein said XOF is a one-way function that, given an input, generates a consistent output of a predetermined length;

the deriving comprises inputting the stretched IV and the master key to a keyed hash function and receiving the ephemeral key as output; and

the encrypting comprises inputting the IV, the dataset, and the ephemeral key to a cryptographic function to produce the ciphertext.

11. The method of claim 10 , wherein:

the XOF satisfies the Secure Hash Algorithm-3 (“SHA-3”) standard specified in Federal Information Processing Standards Publication 202 (“FIPS PUB 202”); the keyed hash function satisfies the Keyed-Hash Message Authentication Code (“HMAC”) standard specified in Federal Information Processing Standards Publication 198-1 (“FIPS PUB 198-1”);

the cryptographic function satisfies the Advanced Encryption Standard (“AES”) cryptographic standard specified in Federal Information Processing Standards Publication 197 (“FIPS PUB 197”); and/or

the inputting the IV to the cryptographic function in the encrypting the dataset and decrypting the ciphertext comprises using a mode of operation defined by the National Institute of Standards and Technology (“NIST”) in the NIST Special Publications 800-38A through 800-38E.

12. The method of claim 8 , wherein:

the IV is a string of either 96 or 128 bits; the master key is a string of 256 bits; and the stretching comprises producing, based on the IV, a string of 256 bits for use as the stretched IV.

13. The method of claim 8 , further comprising:

appending the IV to the ciphertext to create a combined text; and storing and/or transmitting the combined text independent of the ephemeral key.