Integrated circuit configured to carry out symmetric encryption operations without secret key transmission
An integrated circuit includes a secure hardware environment having a first input that receives a key number. A key generation device generates a secret key from the key number and a unique key. A signature generation device generates a signature associated with the key number. A second input of the secure hardware environment receives encrypted binary data. A decryption device operates to decrypt the received encrypted binary data using the secret key. A third input the secure hardware environment receives an authentication signature. An authentication device authorizes use of the secret key to decrypt only if the signature generated by the signature generation device is identical to the authentication signature.
1. An integrated circuit, comprising:
a secure hardware environment including a decryption system;
wherein the decryption system comprises:
a first input configured to receive a key number;
a key generation device configured to generate a secret key from the key number and a unique key;
a signature generation device configured to non-reversibly generate a signature from the key number and the unique key;
a second input configured to receive encrypted binary data;
a decryption device configured to decrypt said encrypted binary data by using the secret key generated by the key generation device;
a third input configured to receive an authentication signature; and
an authentication device configured to authorize the use of the secret key generated by the key generation device to decrypt said encrypted binary data if the signature generated by the signature generation device is identical to the authentication signature.
2. The integrated circuit according to claim 1 , wherein the secure hardware environment further comprises:
a key registry configured to record the secret key generated by the key generation device, and
a switch controlled to pass the secret key to the key registry;
wherein the authentication device is configured to control the switch to pass the secret key to the key registry for recording only if the signature generated by the signature generation device of the decryption system is identical to the authentication signature.
3. The integrated circuit according to claim 2 , wherein an output of the key registry delivers the recorded secret key to the decryption device to decrypt said encrypted binary data.
4. The integrated circuit according to claim 1 , wherein the unique key is a unique hardware key recorded in the secure hardware environment.
5. The integrated circuit according to claim 1 , wherein the decryption device is configured to carry out an AES decryption algorithm.
6. The integrated circuit according to claim 1 , wherein the key generation device is configured to carry out an AES algorithm according to a counter mode with CBC-MAC in order to generate the secret key from the key number and the unique key.
7. The integrated circuit according to claim 1 , wherein the key generation device is configured to implement an AES algorithm according to a mode GCM in order to generate the secret key from the key number and the unique key.
8. The integrated circuit according to claim 1 , wherein the secure hardware environment further includes an encryption system, said encryption system comprising:
a fourth input configured to receive binary data;
a symmetric encryption device configured to encrypt said binary data by using the secret key generated by the key generation device;
a first output configured to deliver the binary data encrypted by the symmetric encryption device; and
a second output configured to deliver the signature generated by the signature generation device.
9. The integrated circuit according to claim 8 , wherein said encryption system further comprises:
a first input configured to receive a key number,
a further key generation device configured to generate the secret key from the key number and the unique key; and
a further signature generation device configured to non-reversibly generate the signature from the key number and the unique key.
10. The integrated circuit according to claim 9 , wherein the further signature generation device of the encryption system is identical to the signature generation device of the decryption system.
11. The integrated circuit according to claim 9 , wherein the further signature generation device of the encryption system is same as the signature generation device of the decryption system.
12. The integrated circuit according to claim 9 , wherein the further key generation device of the encryption system is identical to the key generation device of the decryption system.
13. The integrated circuit according to claim 9 , wherein the further key generation device of the encryption system is same as the key generation device of the decryption system.
14. The integrated circuit according to claim 9 , wherein the secure hardware environment further comprises:
a first key registry configured to record the secret key generated by the key generation device; and
a second key registry configured to record the secret key generated by the further key generation device.
15. The integrated circuit according to claim 9 , wherein the decryption device is configured to carry out an AES decryption algorithm and the symmetric encryption device is configured to carry out an AES encryption algorithm.
16. The integrated circuit according to claim 9 , wherein the key generation device and further key generation device are each configured to carry out an AES algorithm according to a counter mode with CBC-MAC in order to generate the secret key from the key number and the unique key.
17. The integrated circuit according to claim 9 , wherein the key generation device and further key generation device are each configured to implement an AES algorithm according to a mode GCM in order to generate the secret key from the key number and the unique key.
18. A method for decrypting encrypted binary data in a secure hardware environment, comprising:
receiving a key number;
generating a secret key from the key number and a unique key;
non-reversibly generating a signature from the key number and the unique key;
receiving said encrypted binary data;
receiving an authentication signature;
decrypting said encrypted binary data by using said secret key if the signature generated is identical to the authentication signature;
delivering decrypted binary data outside the secure hardware environment.
19. A method for encrypting binary data in a secure hardware environment, comprising:
receiving a key number;
generating a secret key from the key number and a unique key;
non-reversibly generating a signature from the key number and the unique key;
receiving said binary data;
encrypting said binary data by using the secret key;
delivering outside the secure hardware environment encrypted binary data; and
delivering the signature associated with the key number outside the secure hardware environment, said signature being adapted for being used as an authentication signature in a decryption method.