OFF-CHIP KEYSTORE SYSTEMS AND METHODS
A system and method for storing keys, secrets, and passwords securely in an off-chip keystore are provided. An off-chip keystore stores a plurality of ciphertext keys that include encrypted keys, secrets, and passwords. A programmable logic device, such as a system on a chip, is coupled to the off-chip keystore. The programable logic device enrolls a physical unclonable function (PUF) within the programmable logic device. The PUF generates a keystore encryption key (KEK) that a secure processor, such as a cryptographic engine, uses to encrypt a plaintext key into a ciphertext key, and decrypt the ciphertext key into the plaintext key. The ciphertext key is stored in the off-chip keystore. When the programmable logic device is powered down, the KEK is not stored within the programmable logic device, but is regenerated to decrypt cyphertext keys and encrypt plaintext keys once the programmable logic device is powered up.
1 . A system comprising:
an off-chip keystore configured to store a plurality of ciphertext keys; and
a programmable logic device coupled to the off-chip keystore, the programable logic device configured to:
enroll a physical unclonable function (PUF) within the programmable logic device;
generate a keystore encryption key (KEK) using the PUF, wherein the KEK is configured to encrypt a plaintext key into a ciphertext key within the programmable logic device; and
store the ciphertext key at the off-chip keystore as one of the plurality of ciphertext keys.
2 . The system of claim 1 , further comprising:
a cryptographic engine within the programmable logic device, the cryptographic engine configured to:
receive the KEK generated using the PUF;
generate the plaintext key; and
encrypt the plaintext key into the ciphertext key using the KEK.
3 . The system of claim 2 , wherein the cryptographic engine is further configured to:
receive a request that the plaintext key is to be used in a decryption process or an authentication process;
retrieve the ciphertext key from the off-chip keystore;
decrypt the ciphertext key into the plaintext key using the KEK; and
perform the decryption process or the authentication process using the plaintext key.
4 . The system of claim 3 , wherein the programmable logic device is further configured to:
determine that the KEK is not present at the programmable logic device; and
regenerate the KEK using the PUF.
5 . The system of claim 4 , wherein the decryption process or the authentication process is to occur during a boot of the programmable logic device.
6 . The system of claim 1 , wherein the KEK is not stored within the programmable logic device when the programmable logic device powers down.
7 . The system of claim 6 , wherein the programmable logic device is further configured to regenerate the KEK using the PUF after the programmable logic device is powered up.
8 . The system of claim 1 , wherein the off-chip keystore and the programmable logic device are within a same package.
9 . A system comprising:
an off-chip keystore configured to securely store a plurality of ciphertext keys; and
a programmable logic device coupled to the off-chip keystore and the programmable logic device configured to:
enroll a physical unclonable function (PUF) in the programmable logic device; and
generate a keystore encryption key (KEK) using the PUF, wherein the KEK is configured to decrypt a ciphertext key stored in the off-chip keystore as one of the plurality of ciphertext keys into a plaintext key.
10 . The system of claim 9 , further comprising:
a cryptographic engine within the programmable logic device, and the cryptographic engine configured to:
receive a request that the plaintext key is to be used in a decryption process or an authentication process;
retrieve the ciphertext key corresponding to the plaintext key from the off-chip keystore;
decrypt the ciphertext key into the plaintext key using the KEK; and
perform the decryption process or the authentication process using the plaintext key.
11 . The system of claim 10 , wherein the programmable logic device is further configured to:
determine that the KEK is not present at the programmable logic device; and
regenerate the KEK using the PUF.
12 . The system of claim 11 , wherein the decryption process or the authentication process is to occur during a boot-up of the programmable logic device.
13 . The system of claim 9 , further comprising:
a cryptographic engine within the programmable logic device, and the cryptographic engine configured to:
generate the plaintext key to perform a decryption process or an authentication process;
encrypt the plaintext key into the ciphertext key using the KEK generated using the PUF; and
transmit the ciphertext key to the off-chip memory for storage as one of the plurality of ciphertext keys.
14 . The system of claim 9 , wherein the KEK is not stored within the programmable logic device after the programming logic device is powered down.
15 . The system of claim 14 , wherein the programmable logic device is further configured to:
regenerate the KEK using the PUF of the programmable logic device after the programmable logic device is powered back up.
16 . The system of claim 9 , wherein the off-chip keystore and the programmable logic device are within a same package.
17 . A method comprising:
enrolling a physical unclonable function (PUF) at a programmable logic device; and
generating a keystore encryption key (KEK) using the PUF, wherein the KEK is configured to encrypt a plaintext key into a ciphertext key or decrypt the ciphertext key into the plaintext key, wherein the ciphertext key is stored in an off-chip keystore coupled to the programmable logic device.
18 . The method of claim 17 , further comprising:
receiving, during boot-up of the programming logic device, a request that the plaintext key is to be used in a decryption process or an authentication process;
retrieving the ciphertext key from the off-chip keystore;
decrypting, at a cryptographic engine, the ciphertext key into the plaintext key using the KEK; and
performing the decryption process or the authentication process using the plaintext key.
19 . The method of claim 17 , further comprising:
generating, at a cryptographic device within the programming logic device, the plaintext key configured to perform a decryption process or an authentication process;
encrypting the plaintext key into the ciphertext key using the KEK generated using the PUF; and
storing the ciphertext key to the off-chip memory as one of a plurality of ciphertext keys.
20 . The method of claim 17 , wherein the KEK is not stored within the programmable logic device after the programming logic device is powered down, and further comprising:
regenerating the KEK using the PUF of the programmable logic device after the programmable logic device is powered back up.