Coherent key management across multiple chiplets
Systems and techniques are provided for establishing a connection. For instance, a first chiplet root of trust (C-RoT) of a first chiplet of a plurality of chiplets can receive a request for a cryptographic key. The first C-RoT can generate the cryptographic key and wrap the cryptographic key using a wrapping key to generate a wrapped cryptographic key. The first C-RoT can output the wrapped cryptographic key and a second C-RoT of a second chiplet of the plurality of chiplets can receive the wrapped cryptographic key. The second C-RoT can unwrap the wrapped cryptographic key using the wrapping key and can perform an operation based on the cryptographic key.
1 . An electronic device, comprising:
a memory system comprising instructions; and
a processor system coupled to the memory system, the processor system including a plurality of chiplets, wherein the processor system is configured to:
receive, at a first chiplet root of trust (C-RoT) of a first chiplet of the plurality of chiplets, a request for a cryptographic key;
generate, by the first C-RoT, the cryptographic key;
wrap, by the first C-RoT, the cryptographic key using a wrapping key to generate a wrapped cryptographic key;
output, by the first C-RoT, the wrapped cryptographic key for a second C-RoT of a second chiplet of the plurality of chiplets;
receive the wrapped cryptographic key at the second C-RoT of the second chiplet of the plurality of chiplets;
unwrap the wrapped cryptographic key by the second C-RoT of the second chiplet using the wrapping key; and
perform, by the second C-RoT, an operation based on the cryptographic key.
2 . The electronic device of claim 1 , wherein, to wrap the cryptographic key, the processor system is configured to encrypt, by the first C-RoT, the cryptographic key using the wrapping key.
3 . The electronic device of claim 1 , wherein the cryptographic key is generated based on a common pairing key.
4 . The electronic device of claim 3 , wherein the common pairing key is provisioned to two or more C-RoTs of the plurality of chiplets.
5 . The electronic device of claim 1 , wherein the wrapped cryptographic key is received at a cryptographic endpoint associated with the second C-RoT.
6 . The electronic device of claim 5 , wherein the wrapped cryptographic key is unwrapped by the cryptographic endpoint.
7 . The electronic device of claim 1 , wherein the wrapping key comprises one of a common transport key or a key swap key.
8 . The electronic device of claim 7 , wherein the wrapping key comprises a key swap key and wherein, to output the wrapped cryptographic key, the processor system is configured to store the wrapped cryptographic key in the memory system, and wherein the wrapped cryptographic key is received from the memory system.
9 . The electronic device of claim 1 , wherein the wrapping key is provisioned to C-RoTs of the plurality of chiplets.
10 . The electronic device of claim 1 , wherein the wrapping key is provisioned during a boot procedure of the processor system.
11 . A method for secure processing, comprising:
receiving, at a first chiplet root of trust (C-RoT) of a first chiplet of a plurality of chiplets, a request for a cryptographic key;
generating, by the first C-RoT, the cryptographic key;
wrapping, by the first C-RoT, the cryptographic key using a wrapping key to generate a wrapped cryptographic key;
outputting, by the first C-RoT, the wrapped cryptographic key for a second C-RoT of a second chiplet of the plurality of chiplets;
receiving the wrapped cryptographic key at the second C-RoT of the second chiplet of the plurality of chiplets;
unwrapping, the wrapped cryptographic key by the second C-RoT of the second chiplet using the wrapping key; and
performing, by the second C-RoT, an operation based on the cryptographic key.
12 . The method of claim 11 , wherein wrapping the cryptographic key comprises encrypting, by the first C-RoT, the cryptographic key using the wrapping key.
13 . The method of claim 11 , wherein the cryptographic key is generated based on a common pairing key.
14 . The method of claim 13 , wherein the common pairing key is provisioned to two or more C-RoTs of the plurality of chiplets.
15 . The method of claim 11 , wherein the wrapped cryptographic key is received at a cryptographic endpoint associated with the second C-RoT.
16 . The method of claim 15 , wherein the wrapped cryptographic key is unwrapped by the cryptographic endpoint.
17 . The method of claim 11 , wherein the wrapping key comprises one of a common transport key or a key swap key.
18 . The method of claim 17 , wherein the wrapping key comprises a key swap key and wherein outputting the wrapped cryptographic key comprises storing the wrapped cryptographic key in a memory system, and wherein the wrapped cryptographic key is received from the memory system.
19 . The method of claim 11 , wherein the wrapping key is provisioned to C-RoTs of the plurality of chiplets.
20 . The method of claim 11 , wherein the wrapping key is provisioned during a boot procedure of the plurality of chiplets.
21 . A non-transitory computer-readable medium having stored thereon instructions that, when executed by a processor system, cause the processor system to:
receive, at a first chiplet root of trust (C-RoT) of a first chiplet of a plurality of chiplets, a request for a cryptographic key;
generate, by the first C-RoT, the cryptographic key;
wrap, by the first C-RoT, the cryptographic key using a wrapping key to generate a wrapped cryptographic key;
output, by the first C-RoT, the wrapped cryptographic key for a second C-RoT of a second chiplet of the plurality of chiplets;
receive the wrapped cryptographic key at the second C-RoT of the second chiplet of the plurality of chiplets;
unwrap the wrapped cryptographic key by the second C-RoT of the second chiplet using the wrapping key; and
perform, by the second C-RoT, an operation based on the cryptographic key.
22 . The non-transitory computer-readable medium of claim 21 , wherein, to wrap the cryptographic key, the instructions further cause the processor system to cryptographically encrypting, by the first C-RoT, the cryptographic key using the wrapping key.
23 . The non-transitory computer-readable medium of claim 21 , wherein the cryptographic key is generated based on a common pairing key.
24 . The non-transitory computer-readable medium of claim 23 , wherein the common pairing key is provisioned to two or more C-RoTs of the plurality of chiplets.
25 . The non-transitory computer-readable medium of claim 21 , wherein the wrapped cryptographic key is received at a cryptographic endpoint associated with the second C-RoT.
26 . The non-transitory computer-readable medium of claim 25 , wherein the wrapped cryptographic key is unwrapped by the cryptographic endpoint.
27 . The non-transitory computer-readable medium of claim 21 , wherein the wrapping key comprises one of a common transport key or a key swap key.
28 . The non-transitory computer-readable medium of claim 27 , wherein the wrapping key comprises a key swap key and wherein, to output the wrapped cryptographic key, the instructions cause the processor system to store the wrapped cryptographic key in a memory system, and wherein the wrapped cryptographic key is received from the memory system.
29 . The non-transitory computer-readable medium of claim 21 , wherein the wrapping key is provisioned to C-RoTs of the plurality of chiplets.
30 . The non-transitory computer-readable medium of claim 21 , wherein the wrapping key is provisioned during a boot procedure of the plurality of chiplets.