Cryptographic key management
Methods, systems, and devices for cryptographic key management are described. A memory device can issue, by a firmware component, a command to generate a first cryptographic key for encrypting or decrypting user data stored on a memory device. The memory device can generate, by a hardware component, the first cryptographic key based on the command. The memory device can encrypt, by the hardware component, the first cryptographic key using a second cryptographic key and an initialization vector. The memory device can store the encrypted first cryptographic key in a nonvolatile memory device separate from the hardware component.
1. A method at a memory sub-system, comprising:
receiving, by a firmware component of the memory sub-system and from a nonvolatile memory device separate from the memory sub-system, an encrypted first cryptographic key and a second cryptographic key, wherein the encrypted first cryptographic key is for encrypting or decrypting data stored on a memory device of the memory sub-system and different from the nonvolatile memory device;
generating, by a hardware component of the memory sub-system, an initialization vector based at least in part on the first cryptographic key, the data, or both;
decrypting, by the hardware component, the encrypted first cryptographic key using the second cryptographic key and the initialization vector; and
storing the first cryptographic key in a volatile memory device on the hardware component based at least in part on decrypting the encrypted first cryptographic key.
2. The method of claim 1 , wherein the initialization vector is for encrypting or decrypting the first cryptographic key using the second cryptographic key.
3. The method of claim 1 , further comprising:
receiving, by the firmware component from the nonvolatile memory device, error correction information associated with the encrypted first cryptographic key; and
performing, by the hardware component, an error correction operation on the encrypted first cryptographic key using the error correction information.
4. The method of claim 3 , further comprising:
determining that a quantity of errors detected during the error correction operation satisfies a threshold of errors; and
issuing, by the firmware component, a command to update the first cryptographic key.
5. The method of claim 1 , further comprising:
receiving, from a host device, an access command associated with the data stored on the memory device; and
encrypting or decrypting the data using the first cryptographic key based at least in part on receiving the access command.
6. The method of claim 1 , further comprising:
receiving, by the firmware component from the nonvolatile memory device, an encrypted third cryptographic key;
decrypting, by the hardware component, the encrypted third cryptographic key using the second cryptographic key; and
storing the third cryptographic key in a second volatile memory device on the hardware component based at least in part on decrypting the encrypted third cryptographic key.
7. The method of claim 6 , wherein the first cryptographic key comprises an encryption key for encrypting the data stored on the memory device and the second cryptographic key comprises a decryption key for decrypting the data stored on the memory device.
8. The method of claim 1 , further comprising:
transmitting, by the firmware component, the encrypted first cryptographic key and the second cryptographic key to the hardware component based at least in part on receiving the encrypted first cryptographic key and the second cryptographic key from the nonvolatile memory device.
9. The method of claim 1 , wherein the encrypted first cryptographic key and the second cryptographic key are received by the firmware component based at least in part on a boot up of the hardware component.
10. The method of claim 1 , wherein the second cryptographic key is stored at a register of the hardware component.
11. A system, comprising:
a memory sub-system operable to couple with a nonvolatile memory device that is separate from the memory sub-system via a firmware component of the memory sub-system, the memory sub-system configured to:
receive, by the firmware component and from the nonvolatile memory device, an encrypted first cryptographic key and a second cryptographic key, wherein the encrypted first cryptographic key is for encrypting or decrypting data stored on a memory device of the memory sub-system and different from the nonvolatile memory device;
generate, by a hardware component of the memory sub-system, an initialization vector based at least in part on the first cryptographic key;
decrypt, by the hardware component, the encrypted first cryptographic key using the second cryptographic key and the initialization vector; and
store the first cryptographic key in a volatile memory device on the hardware component based at least in part on decrypting the encrypted first cryptographic key.
12. The system of claim 11 , wherein the initialization vector is for encrypting or decrypting the first cryptographic key using the second cryptographic key.
13. The system of claim 11 , wherein the memory sub-system is further configured to:
receive, by the firmware component from the nonvolatile memory device, error correction information associated with the encrypted first cryptographic key; and
perform, by the hardware component, an error correction operation on the encrypted first cryptographic key using the error correction information.
14. The system of claim 13 , wherein the memory sub-system is further configured to:
determine that a quantity of errors detected during the error correction operation satisfies a threshold of errors; and
issue, by the firmware component, a command to update the first cryptographic key.
15. The system of claim 11 , wherein the memory sub-system is further configured to:
receive, from a host device, an access command associated with the data stored on the memory device; and
encrypt or decrypt the data using the first cryptographic key based at least in part on receiving the access command.
16. The system of claim 11 , wherein the memory sub-system is further configured to:
decrypt, by the hardware component, an encrypted third cryptographic key using the second cryptographic key; and
store the third cryptographic key in a second volatile memory device on the hardware component based at least in part on decrypting the encrypted third cryptographic key.
17. The system of claim 11 , wherein the memory sub-system is further configured to:
transmit, by the firmware component, the encrypted first cryptographic key and the second cryptographic key to the hardware component based at least in part on receiving the encrypted first cryptographic key and the second cryptographic key from the nonvolatile memory device.
18. The system of claim 11 , wherein the encrypted first cryptographic key and the second cryptographic key are received by the firmware component based at least in part on a boot up of the hardware component.
19. The system of claim 11 , wherein the second cryptographic key is stored at a register of the hardware component.
20. A non-transitory computer-readable medium storing code, the code comprising instructions executable by processing logic to:
receive, by a firmware component of a memory sub-system and from a nonvolatile memory device separate from the memory sub-system, an encrypted first cryptographic key and a second cryptographic key, wherein the encrypted first cryptographic key is for encrypting or decrypting data stored on a memory device of the memory sub-system and different from the nonvolatile memory device;
generate, by a hardware component of the memory sub-system, an initialization vector based at least in part on the first cryptographic key;
decrypt, by the hardware component, the encrypted first cryptographic key using the second cryptographic key and the initialization vector; and
store the first cryptographic key in a volatile memory device on the hardware component based at least in part on decrypting the encrypted first cryptographic key.