ISA accessible physical unclonable function
Techniques for encrypting data using a key generated by a physical unclonable function (PUF) or a virtual PUF key are described. An apparatus according to the present disclosure may include decoder circuitry to decode an instance of a single instruction having a field for an opcode to indicate that execution circuitry is to encrypt at least encrypt secret information from an input data structure with either a physical unclonable function (PUF) generated encryption key or a virtual PUF key, bind the wrapped secret information to an identified target, update the input data structure, generate a MAC over the updated data structure, store the MAC in the input data structure to generate a wrapped output data structure, store the wrapped output data structure having the encrypted secret information and an indication of the target.
1 . An apparatus comprising:
decoder circuitry to decode an instance of a single instruction having a field for an opcode to indicate that execution circuitry is to encrypt at least secret information from an input data structure with either a physical unclonable function (PUF) generated encryption key or a virtual PUF key, bind the encrypted secret information to an identified target, update the input data structure, generate a MAC over the updated data structure, store the MAC in the input data structure to generate a wrapped output data structure, store the wrapped output data structure having the encrypted secret information and an indication of the target, wherein the input data structure is to include a field to identify a challenge used by the PUF to generate the key; and
execution circuitry to execute the decoded instance of the single instruction according to the opcode.
2 . The apparatus of claim 1 , wherein the input data structure is to include an identifier of a target.
3 . The apparatus of claim 1 , wherein the instance of the single instruction is to include an identifier of a destination operand to store an operation status of the execution of the instruction.
4 . The apparatus of claim 1 , wherein the instance of the single instruction is to include an identifier of a source operand which is to store or encode a location of the input data structure.
5 . The apparatus of claim 1 , wherein the instance of the single instruction is to include an identifier of a destination operand which is to store or encode a location of a destination for the wrapped output data structure.
6 . The apparatus of claim 5 , wherein the destination operand is a register.
7 . The apparatus of claim 1 , wherein the output data structure is to include a sequence identifier to be used in decrypting.
8 . The apparatus of claim 1 , wherein an operational status is to indicate one of success, failure, or entropy error.
9 . The apparatus of claim 1 , wherein the execution circuitry is to clear a zero flag (ZF) when the secret information is decrypted successfully, and the execution circuitry is to set the ZF to one otherwise.
10 . The apparatus of claim 1 , wherein the instruction is associated with a most-privileged protection level.
11 . A method comprising:
decoding an instance of a single instruction having a field for an opcode to indicate that execution circuitry is to encrypt at least secret information from an input data structure with either a physical unclonable function (PUF) generated encryption key or a virtual PUF key, bind the encrypted secret information to an identified target, update the input data structure, generate a MAC over the updated data structure, store the MAC in the input data structure to generate a wrapped output data structure, store the wrapped output data structure having the encrypted secret information and an indication of the target wherein the execution circuitry is to clear a zero flag (ZF) when the secret information is encrypted successfully, and the execution circuitry is to set the ZF to one otherwise; and
executing the decoded instruction according to the opcode.
12 . The method of claim 11 , wherein the input data structure is to include an identifier of a target.
13 . The method of claim 11 , wherein the instance of the single instruction is to include an identifier of a destination operand to store an operation status of the execution of the instruction.
14 . The method of claim 11 , wherein the instance of the single instruction is to include an identifier of a source operand which is to store or encode a location of the input data structure.
15 . The method of claim 11 , wherein the instance of the single instruction is to include an identifier of a destination operand which is to store or encode a location of a destination for the wrapped output data structure.
16 . The method of claim 11 , wherein the output data structure is to include a field to identify a challenge used by the PUF to generate the key.
17 . The method of claim 11 , wherein an operational status is to indicate one of success, failure, or entropy error.
18 . The method of claim 11 , wherein the instruction is associated with a most-privileged protection level.
19 . A non-transitory machine-readable medium storing an instance of a single instruction that, when processed by one or more processors, is cause the one or more processors to:
decode the single instruction having a field for an opcode to indicate that execution circuitry is to encrypt at least secret information from an input data structure with either a physical unclonable function (PUF) generated encryption key or a virtual PUF key, bind the encrypted secret information to an identified target, update the input data structure, generate a MAC over the updated data structure, store the MAC in the input data structure to generate a wrapped output data structure, store the wrapped output data structure having the encrypted secret information and an indication of the target, wherein the input data structure is to include a field to identify a challenge used by the PUF to generate the key; and
execute the decoded instruction according to the opcode.