Single-use password generation
A request for password generation is received from a host system. In response to receiving the request, a password derivation key is generated based on a key derivation seed. A password is derived from the password derivation key, and a wrapping key is derived from the password. The wrapping key is used to wrap an authorization state indication, which is stored in local memory. Encrypted data is generated based on an encryption of the key derivation seed using an asymmetric encryption key. The encrypted data is provided in response to the request.
1. A system comprising:
a memory component; and
a processing device, operatively coupled with the memory component, to perform operations comprising:
receiving, from a host system, a request for password generation;
in response to receiving the request, generating a key derivation seed for deriving a password, the key derivation seed comprising a random or pseudo-random number generated by a random or pseudo-random number generator;
generating a password object based on the key derivation seed for deriving the password, the generating of the password object comprising encrypting binary data and a hash of the binary data, the binary data comprising the key derivation seed; and
providing a response to the request, the response comprising the password object.
2. The system of claim 1 , wherein the operations further comprise scrambling one or more fields of the password object using a scramble key.
3. The system of claim 1 , wherein the operations further comprise encoding the password object using a binary-to-text encoding scheme.
4. The system of claim 1 , wherein the password object comprises an object header and encrypted data, the encrypted data being based on an encryption of the key derivation seed.
5. The system of claim 4 , wherein the generating of the password object comprises:
constructing the object header; and
concatenating the encrypted data and the object header to form the password object.
6. The system of claim 1 , wherein the binary data comprises at least one: a version, a wrap type, configuration information, a password length, a timestamp, device information, and a scramble key.
7. The system of claim 1 , wherein the binary data comprises one or more non-random data fields.
8. The system of claim 1 , wherein the operations further comprise:
wrapping an authorization state indication using a wrapping key; and
storing the wrapped authorization state indication in the memory component.
9. The system of claim 8 , wherein the operations further comprise:
receiving an authentication request comprising the password;
deriving an unwrapping key from the password;
unwrapping the wrapped authorization state indication using the unwrapping key; and
providing, in response to the authentication request, the authorization state indication based on the unwrapping.
10. The system of claim 9 , wherein the operations further comprise:
receiving supplemental text from a user;
generating a password derivation key by providing the key derivation seed and the supplemental text as a seed for a key derivation function; and
deriving the password from the password derivation key.
11. A method comprising:
receiving, from a host system, a request for password generation;
in response to receiving the request, generating, by a processing device, a key derivation seed for deriving a password, the key derivation seed comprising a random or pseudo-random number generated by a random or pseudo-random number generator;
generating, by the processing device, a password object based on the key derivation seed for deriving the password, the generating of the password object comprising encrypting binary data and a hash of the binary data, the binary data comprising the key derivation seed; and
providing a response to the request, the response comprising the password object.
12. The method of claim 11 , further comprising scrambling one or more fields of the password object using a scramble key.
13. The method of claim 11 , further comprising encoding the password object using a binary-to-text encoding scheme.
14. The method of claim 11 , wherein the password object comprises an object header and encrypted data, the encrypted data being based on an encryption of the key derivation seed.
15. The method of claim 14 , wherein the generating of the password object comprises:
constructing the object header; and
concatenating the encrypted data and the object header to form the password object.
16. The method of claim 11 , wherein the binary data comprises at least one: a version, a wrap type, configuration information, a password length, a timestamp, device information, and a scramble key.
17. The method of claim 14 , wherein the binary data comprises one or more non-random data fields.
18. The method of claim 11 , further comprising:
wrapping an authorization state indication using a wrapping key; and
storing the wrapped authorization state indication in a memory component that is operatively coupled with the processing device.
19. The method of claim 18 , further comprising:
receiving an authentication request comprising the password;
deriving an unwrapping key from the password;
unwrapping the wrapped authorization state indication using the unwrapping key; and
providing, in response to the authentication request, the authorization state indication based on the unwrapping.
20. A non-transitory computer-readable storage medium comprising instructions that, when executed by a processing device, configure the processing device to perform operations comprising:
receiving, from a host system, a request for password generation;
in response to receiving the request, generating a key derivation seed for deriving a password, the key derivation seed comprising a random or pseudo-random number generated by a random or pseudo-random number generator;
generating a password object based on the key derivation seed for deriving the password, the generating of the password object comprising encrypting binary data and a hash of the binary data, the binary data comprising the key derivation seed; and
providing a response to the request, the response comprising the password object.