Unlimited reprovisionable hardware root of trust
Technologies for protecting a secure context in a hardware root of trust (ROT) are described. One hardware ROT includes key generation logic and a cryptographic circuit. The key generation logic generates a first key from a value, corresponding to a physical variation of the hardware ROT, and first helper data associated with the physical variation of the hardware ROT. The key generation logic generates a second key from the value and second helper data associated with the physical variation of the hardware ROT. The cryptographic circuit receives a first encrypted secure context from off-chip storage and decrypts the first encrypted secure context using the first key to obtain a secure context. The cryptographic circuit encrypts the secure context using the second key to obtain a second encrypted secure context and stores the second encrypted secure context in the off-chip storage.
1 . A hardware root of trust (ROT) comprising:
key generation logic to generate a first key from a value corresponding to a physical variation of the hardware ROT, and first helper data associated with the physical variation of the hardware ROT, and to generate a second key from the value and second helper data associated with the physical variation of the hardware ROT; and
a cryptographic circuit to:
receive a first encrypted secure context from off-chip storage;
decrypt the first encrypted secure context using the first key to obtain a secure context;
encrypt the secure context using the second key to obtain a second encrypted secure context; and
store the second encrypted secure context in the off-chip storage.
2 . The hardware ROT of claim 1 , further comprising a physically unclonable function (PUF), wherein the value corresponding to the physical variation of the hardware ROT is associated with an output of the PUF, wherein the first key is further generated based on the output of the PUF and the first helper data, and wherein the second key is further generated based on the output of the PUF and the second helper data.
3 . The hardware ROT of claim 1 , wherein the first helper data comprises PUF helper data and first version information, and wherein the second helper data comprises the PUF helper data and second version information that is different from the first version information.
4 . The hardware ROT of claim 1 , wherein the first helper data comprises first PUF helper data, and wherein the second helper data comprises second PUF helper data that is different from the first PUF helper data.
5 . The hardware ROT of claim 1 , further comprising:
volatile memory to store the secure context; and
battery-backed storage to store first version information at a first time and second version information at a second time after the first time, wherein the first helper data comprises the first version information and the second helper data comprises the second version information.
6 . The hardware ROT of claim 5 , wherein the key generation logic is to generate the first key using the value, PUF helper data, and the first version information, wherein the first key is a first device-unique version key, and wherein the key generation logic is to generate the second key using the value, the PUF helper data, and the second version information, wherein the second key is a second device-unique version key.
7 . The hardware ROT of claim 6 , wherein, in response to a reset event of the hardware ROT:
the key generation logic is to re-generate the second key using the value, the PUF helper data, and the second version information, and
the cryptographic circuit is further to:
receive the second encrypted secure context from the off-chip storage;
decrypt the second encrypted secure context using the second key to recreate the secure context; and
store the secure context in the volatile memory.
8 . The hardware ROT of claim 1 , wherein the cryptographic circuit is to receive the first encrypted secure context, decrypt the first encrypted secure context, encrypt the secure context, and store the second encrypted secure context in response to a reset event of the hardware ROT.
9 . The hardware ROT of claim 1 , wherein the secure context is updated during execution after the first encrypted secure context is decrypted and before the secure context is encrypted.
10 . A method of operating a hardware root of trust (ROT), the method comprising:
generating a first key from a value, corresponding to a physical variation of the hardware ROT, and first helper data associated with the physical variation of the hardware ROT;
receiving a first encrypted secure context from off-chip storage;
decrypting the first encrypted secure context using the first key to obtain a secure context;
generating a second key from the value and second helper data associated with the physical variation of the hardware ROT; and
encrypting the secure context using the second key to obtain a second encrypted secure context; and
storing the second encrypted secure context in the off-chip storage.
11 . The method of claim 10 , wherein the value corresponding to the physical variation of the hardware ROT is associated with an output of a physically unclonable function (PUF), wherein:
generating the first key comprises generating the first key using the output of the PUF and the first helper data; and
generating the second key comprises generating the second key using the output of the PUF and the second helper data.
12 . The method of claim 10 , wherein the first helper data comprises PUF helper data and first version information, and wherein the second helper data comprises the PUF helper data and second version information that is different from the first version information, wherein:
generating the first key comprises generating the first key using the value, the PUF helper data, and the first version information; and
generating the second key comprises generating the second key using the value, the PUF helper data, and the second version information.
13 . The method of claim 10 , wherein the first helper data comprises first PUF helper data, and wherein the second helper data comprises second PUF helper data that is different from the first PUF helper data, wherein:
generating the first key comprises generating the first key using the value and the first PUF helper data; and
generating the second key comprises generating the second key using the value and the second PUF helper data.
14 . The method of claim 10 , further comprising:
storing the secure context in volatile memory of the hardware ROT; and
storing, at a first time, first version information in battery-backed storage of the hardware ROT; and
storing, at a second time after the first time, second version information in the battery-backed storage, wherein the first helper data comprises the first version information and the second helper data comprises the second version information.
15 . The method of claim 10 , wherein:
generating the first key comprises generating the first key using the value, PUF helper data, and first version information, the first key being a first device-unique version key; and
generating the second key comprises generating the second key using the value, the PUF helper data, and second version information, wherein the second key is a second device-unique version key.
16 . The method of claim 15 , further comprising, in response to a reset event of the hardware ROT:
re-generating the second key using the value, the PUF helper data, and the second version information;
receiving the second encrypted secure context from the off-chip storage;
decrypting the second encrypted secure context using the second key to recreate the secure context; and
storing the secure context in volatile memory of the hardware ROT.
17 . The method of claim 15 , wherein the receiving, the decrypting, the encrypting, and the storing are performed in response to a reset event of the hardware ROT.
18 . The method of claim 15 , further comprising updating the secure context during execution after the decrypting the first encrypted secure context and before the encrypting the secure context.
19 . A computing system comprising:
a non-volatile storage device; and
a hardware root of trust (ROT), wherein the hardware ROT comprises:
key generation logic to generate a first key from a value corresponding to a physical variation of the hardware ROT, and first helper data associated with the physical variation of the hardware ROT, and to generate a second key from the value and second helper data associated with the physical variation of the hardware ROT; and
a cryptographic circuit to:
receive a first encrypted secure context from off-chip storage;
decrypt the first encrypted secure context using the first key to obtain a secure context;
encrypt the secure context using the second key to obtain a second encrypted secure context; and
store the second encrypted secure context in the off-chip storage.
20 . The computing system of claim 19 , wherein the hardware ROT further comprises:
volatile memory to store the secure context; and
battery-backed storage to store first version information at a first time and second version information at a second time after the first time, wherein the first helper data comprises the first version information and the second helper data comprises the second version information.