KEY ENCRYPTION HANDLING

1 . A memory system comprising:

a plurality of memory components;

an encryption key generator comprising:

a random number generator configured to generate a first random number as a salt, and to generate a second random number as a data encryption key (DEK) to encrypt data in the plurality of memory components;

an encryption block configured to generate a key encryption key (KEK) by using a first encryption algorithm, the salt, and a password received from a host device, wherein generating the KEK comprises concatenating the salt onto the password; and

a wrapping block configured to generate a wrapped DEK by wrapping the DEK using a second encryption algorithm and the KEK; and

a memory controller configured to transition the memory system to and from a secure state using the wrapped DEK, the secure state determining access to the data in the plurality of memory components by the host device, wherein the secure state is selected from a plurality of states, wherein the plurality of states comprises a secure locked state that makes the data in the plurality of memory components inaccessible, and wherein transitioning the memory system to and from the secure state using the wrapped DEK comprises:

unwrapping the wrapped DEK using the second encryption algorithm as an unwrapped version of the wrapped DEK; and

transitioning from the secure locked state to a secure unlocked state using the unwrapped version of the wrapped DEK.

2 . The memory system of claim 1 , wherein the first encryption algorithm comprises an advanced encryption standard (AES) tweaked-cookbook mode ciphertext stealing (XTS).

3 . The memory system of claim 2 , wherein the first encryption algorithm comprises XTS-AES-256.

4 . The memory system of claim 1 , wherein the DEK comprises 512 bits that comprises an AES key in a first 256 bits and an XTS key in a second 256 bits.

5 . The memory system of claim 1 comprising an I2C interface configured to receive the password from the host device.

6 . The memory system of claim 1 , wherein the second encryption algorithm comprises a National Institute of Standards Technology (NIST) SP800-38F-compliant wrapping algorithm.

7 . The memory system of claim 1 , wherein generating the KEK comprises using a password-based key derivation function (PBKDF) engine to generate the KEK.

8 . The memory system of claim 7 , wherein the PBKDF engine complies with NIST SP800.

9 . The memory system of claim 7 , wherein the PBKDF engine complies with NIST SP800-232.

10 . The memory system of claim 1 , comprising a non-volatile memory configured to store the wrapped DEK, wherein the memory controller is configured to control access to the non-volatile memory.

11 . The memory system of claim 1 , wherein the plurality of states comprises an unowned state, a secure unlocked state, the secure locked state, and an unsecure state.

12 . The memory system of claim 1 , wherein the plurality of memory components comprises:

volatile memory; and

non-volatile memory.

13 . The memory system of claim 12 , wherein the memory controller is configured to:

read the wrapped DEK from non-volatile memory of the memory components; and

store the unwrapped version of the wrapped DEK to a volatile location.

14 . A method comprising:

receiving, from a host device, a password;

causing, by a memory controller of a memory system, a random number generator to generate a first random number as a salt;

causing, by the memory controller, the random number generator to generate a second random number as a data encryption key (DEK) to encrypt data in a plurality of memory components of the memory system;

causing, by the memory controller, an encryption block to generate a key encryption key (KEK) by using a first encryption algorithm, the salt, and the password from the host device, wherein generating the KEK comprises concatenating the salt onto the password;

causing, by the memory controller, a wrapping block to generate a wrapped DEK by wrapping the DEK using a second encryption algorithm and the KEK; and

causing, by the memory controller, the memory system to transition to and from a secure state using the wrapped DEK, the secure state determining access to the data in the plurality of memory components by the host device, wherein the secure state is selected from a plurality of states, wherein the plurality of states comprises a secure locked state that makes the data in the plurality of memory components inaccessible, and wherein transitioning the memory system to and from the secure state using the wrapped DEK comprises:

unwrapping the wrapped DEK using the second encryption algorithm as an unwrapped version of the wrapped DEK; and

transitioning from the secure locked state to a secure unlocked state using the unwrapped version of the wrapped DEK.

15 . The method of claim 14 , comprising causing, by the memory controller, storage of the wrapped DEK on a non-volatile memory of the memory system and the unwrapped version of the wrapped DEK on a volatile memory of the memory system.

16 . The method of claim 14 , wherein the DEK comprises 512 bits that comprises an AES key in a first 256 bits and an XTS key in a second 256 bits.

17 . The method of claim 14 , wherein the first encryption algorithm comprises an advanced encryption standard (AES) tweaked-cookbook mode ciphertext stealing (XTS).

18 . The method of claim 14 , wherein the second encryption algorithm comprises a National Institute of Standards Technology (NIST) SP800-38F-compliant wrapping algorithm.

19 . The method of claim 14 , wherein generating the KEK comprises using a password-based key derivation function (PBKDF) engine to generate the KEK.

20 . A non-volatile dual in-line memory module comprising:

a plurality of memory components comprising volatile and non-volatile memory components;

an encryption key generator comprising:

a random number generator configured to generate a first random number as a salt, and to generate a second random number as a data encryption key (DEK) to encrypt data in the plurality of memory components;

an encryption block configured to generate a key encryption key (KEK) by using a first encryption algorithm, the salt, and a password received from a host device, wherein generating the KEK comprises concatenating the salt onto the password; and

a wrapping block configured to generate a wrapped DEK by wrapping the DEK using a second encryption algorithm and the KEK; and

a memory controller configured to transition the non-volatile dual in-line memory module to and from a secure state using the wrapped DEK, the secure state determining access to the data in the plurality of memory components by the host device, wherein the secure state is selected from a plurality of states, wherein the plurality of states comprises a secure locked state that makes the data in the plurality of memory components inaccessible, and wherein transitioning the non-volatile dual in-line memory module to and from the secure state using the wrapped DEK comprises:

unwrapping the wrapped DEK using the second encryption algorithm as an unwrapped version of the wrapped DEK; and

transitioning from the secure locked state to a secure unlocked state using the unwrapped version of the wrapped DEK.