Authentication and control of encryption keys

1. An apparatus comprising:

a peripheral circuit that includes:

an interface control circuit configured to receive a data packet including a particular cryptographic keyword and a policy value, wherein the policy value includes one or more data bits indicative of one or more policies that define allowable usage of the particular cryptographic keyword; and

a security circuit configured to:

extract the policy value from the data packet;

determine that the policy value includes an indication of a number of bits in the particular cryptographic keyword;

extract the indicated number of bits from a bit field in the data packet that includes the particular cryptographic keyword; and

use the policy value to determine whether the particular cryptographic keyword is valid for use by the peripheral circuit.

2. The apparatus of claim 1 , wherein the security circuit is further configured to:

determine that the policy value indicates that the data packet includes a different cryptographic keyword; and

extract an indicated number of bits from the bit field in the data packet that includes the different cryptographic keyword, wherein the particular cryptographic keyword and the different cryptographic keyword are included in different bits of the bit field.

3. The apparatus of claim 2 , wherein the security circuit is further configured to, using the policy value:

restrict the particular cryptographic keyword for use with encrypting data; and

restrict the different cryptographic keyword for use with decrypting data.

4. The apparatus of claim 1 , wherein the security circuit is further configured to, using the policy value, descramble the particular cryptographic keyword.

5. The apparatus of claim 1 , wherein the security circuit is further configured to:

using the policy value, determine an amount of time to elapse before updating a revocation list, wherein the revocation list includes a list of previously issued cryptographic keywords that are no longer valid; and

discard the particular cryptographic keyword in response to a determination that the particular cryptographic keyword is on the updated revocation list.

6. The apparatus of claim 1 , wherein the security circuit is further configured, in response to the interface control circuit receiving the data packet, to:

authenticate the data packet prior to extracting the policy value; and

extract the policy value in response to a successful authentication of the data packet.

7. The apparatus of claim 1 , wherein the security circuit is further configured, in response to extracting the policy value, to use the policy value to determine one or more additional operations required to unwrap the particular cryptographic keyword from the data packet.

8. An apparatus comprising:

a peripheral circuit including:

an interface control circuit configured to receive a data packet including a first cryptographic keyword, a second cryptographic keyword, and a policy value, wherein the policy value includes one or more data bits indicative of one or more policies that define allowable usage of the first and second cryptographic keywords; and

a security circuit configured to:

extract the first and second cryptographic keywords and the policy value from the data packet;

based on the policy value, combine the first cryptographic keyword with the second cryptographic keyword to generate a third cryptographic keyword; and

use the policy value to determine whether the particular cryptographic keyword is valid for use by the peripheral circuit.

9. The apparatus of claim 8 , wherein to generate the third cryptographic keyword, the security circuit is configured to perform a logic operation using the first and second cryptographic keywords.

10. The apparatus of claim 8 , wherein the security circuit is further configured to:

using the policy value, determine an expiration date and time of day for the first and second cryptographic keywords; and

discard the first and second cryptographic keywords in response to a determination that the expiration date and the time of day have been reached.

11. The apparatus of claim 8 , wherein the policy value includes an indication of a number of bits included in the first and second cryptographic keywords.

12. The apparatus of claim 8 , wherein the security circuit is further configured, in response to the interface control circuit receiving the data packet, to:

authenticate the data packet prior to extracting the first and second cryptographic keywords; and

extract the first and second cryptographic keywords and the policy value in response to a successful authentication of the data packet.

13. The apparatus of claim 8 , wherein the security circuit is further configured, in response to extracting the policy value, to use the policy value to determine one or more additional operations required to unwrap the first and second cryptographic keywords from the data packet.

14. An apparatus comprising:

a peripheral circuit that includes:

an interface control circuit configured to receive a data packet including a particular cryptographic keyword and a policy value, wherein the policy value includes one or more data bits indicative of one or more policies that define allowable usage of the particular cryptographic keyword; and

a security circuit configured to:

extract the particular cryptographic keyword and the policy value from the data packet;

use the policy value to determine if the particular cryptographic keyword is valid for use by the peripheral circuit; and

limit usage of the particular cryptographic keyword to encrypting data in response to a determination that the policy value restricts the particular cryptographic keyword to encryption usage.

15. The apparatus of claim 14 , wherein the security circuit is further configured to determine that the data packet includes a different cryptographic keyword.

16. The apparatus of claim 15 , wherein the security circuit is further configured to limit usage of the different cryptographic keyword to decrypting data in response to a determination that the policy value restricts the different cryptographic keyword to decryption usage.

17. The apparatus of claim 14 , wherein to limit usage of the particular cryptographic keyword to encrypting data, the security circuit is further configured to limit usage of the particular cryptographic keyword to use with a particular encryption algorithm indicated by the policy value.

18. The apparatus of claim 14 , wherein the security circuit is further configured, in response to the interface control circuit receiving the data packet, to:

authenticate the data packet prior to extracting the particular cryptographic keyword; and

extract the particular cryptographic keyword and the policy value in response to a successful authentication of the data packet.

19. The apparatus of claim 18 , wherein to authenticate the data packet, the security circuit is configured to:

perform a hashing function on one or more of bit fields of the data packet to generate a hash value; and

compare the generated hash value to a received hash value included in the data packet.

20. The apparatus of claim 14 , wherein the security circuit is further configured, in response to extracting the particular cryptographic keyword and the policy value, to use the policy value to determine one or more additional operations required to unwrap the particular cryptographic keyword from the data packet.