METHOD AND APPARATUS FOR PROTECTING CRYPTOGRAPHIC KEYS IN THE PROCESS OF MIGRATION TO POST-QUANTUM CRYPTOGRAPHY

1 . A method of securing a device having processor, the processor communicatively coupled to a secure memory storing a pre-provisioned, protected symmetric boot key, the method comprising:

performing a secure boot of the processor, using the pre-provisioned, protected symmetric boot key, comprising:

performing boot instructions with the processor, the boot instructions including instructions for:

loading at least a portion of the boot code, and boot code verification data into a memory; and

verifying the loaded at least of portion of the boot code according to the pre-provisioned protected symmetric boot key and the boot code verification data;

generating, by the processor, at least one post quantum cryptography (PQC) key pair having a PQC private key and a PQC public key;

encrypting the PQC private key according to the pre-provisioned protected symmetric key;

storing the encrypted PQC private key in the secure memory;

generating a request having the PQC public key; and

transmitting the request to an agency external to the processor.

2 . The method of claim 1 , wherein:

the request is a certificate signing request and the external agency is a certificate authority; and

the method further comprises receiving a signed digital certificate.

3 . The method of claim 1 , wherein:

generating, by the processor, at least one PQC key pair having a PQC private key and a PQC public key comprises:

receiving PQC software and PQC software verification data the PQC software, the PQC software for generating the at least one PQC key pair;

authenticating the PQC software according to the pre-provisioned protected symmetric key and the PQC software verification data;

installing the authenticated PQC software on the device; and

executing the authenticated PQC software to generate the PQC key pair.

4 . The method of claim 1 , wherein:

the secure memory further stores a pre-provisioned protected symmetric key provisioning key; and

the method further comprises:

receiving, in the device, a symmetric unique device key encrypted according to the pre-provisioned protected symmetric key provisioning key;

decrypting the symmetric unique device key according to the pre-provisioned protected symmetric key provisioning key;

encrypting the symmetric unique device key according to the pre-provisioned, protected symmetric boot key; and

storing the encrypted symmetric unique device key in the secure memory.

5 . The method of claim 4 , wherein:

transmitting the request to the agency external to the processor comprises:

transmitting a request for data to a third party;

the method further comprises:

receiving the requested data from the third party, the requested data encrypted according to the symmetric unique device key;

decrypting the symmetric unique device key according to the pre-provisioned, protected symmetric boot key; and

decrypting the encrypted requested data according to the symmetric unique device key.

6 . The method of claim 5 , further comprising:

receiving a request in the key-sharing infrastructure from the third party to provide the data to the device;

retrieving the symmetric unique device key from the hardware security module of the key-sharing infrastructure;

providing the symmetric unique device key to the third party;

encrypting, by the third party, the data according to the symmetric unique device key; and

transmitting the encrypted data to the device.

7 . The method of claim 6 , wherein the pre-provisioned protected symmetric key provisioning key is:

created by a multi-party controlled key ceremony;

stored in a hardware security module of a key sharing infrastructure; and

pre-provisioned from a hardware security device of the key sharing infrastructure to the secure memory.

8 . A device for performing post quantum cryptography safe operations, comprising:

a processor, the processor communicatively coupled to a secure memory storing a pre-provisioned, protected symmetric boot key;

a memory, the memory storing processing instructions including processor instructions for

performing a secure boot of the processor, using the pre-provisioned, protected symmetric boot key, the processing instructions for performing the secure boot of the processor comprising processor instructions for:

loading at least a portion of the boot code, and boot code verification data into a memory; and

verifying the loaded at least of portion of the boot code according to the pre-provisioned protected symmetric boot key and the boot code verification data;

generating, by the processor, at least one post quantum cryptography (PQC) key pair having a PQC private key and a PQC public key;

encrypting the PQC private key according to the pre-provisioned protected symmetric key;

storing the encrypted PQC private key in the secure memory;

generating a request having the PQC public key; and

transmitting the request to an agency external to the processor.

9 . The device of claim 8 , wherein:

the request is a certificate signing request and the external agency is a certificate authority; and

the method further comprises receiving a signed digital certificate.

10 . The device of claim 8 , wherein:

the processor instructions for generating, by the processor, at least one PQC key pair having a PQC private key and a PQC public key comprise processor instructions for:

receiving PQC software and PQC software verification data the PQC software, the PQC software for generating the at least one PQC key pair;

authenticating the PQC software according to the pre-provisioned protected symmetric key and the PQC software verification data;

installing the authenticated PQC software on the device; and

executing the authenticated PQC software to generate the PQC key pair.

11 . The device of claim 8 , wherein:

the secure memory further stores a pre-provisioned protected symmetric key provisioning key;

the processor instructions further comprise processor instructions for:

receiving, in the device, a symmetric unique device key encrypted according to the pre-provisioned protected symmetric key provisioning key;

decrypting the symmetric unique device key according to the pre-provisioned protected symmetric key provisioning key;

encrypting the symmetric unique device key according to the pre-provisioned, protected symmetric boot key; and

storing the encrypted symmetric unique device key in the secure memory.

12 . The device of claim 11 , wherein:

the processor instructions for transmitting the request to the agency external to the processor comprise:

processor instructions for transmitting a request for data to a third party;

the processor instructions further comprise processor instructions for:

receiving the requested data from the third party, the requested data encrypted according to the symmetric unique device key; and

decrypting the symmetric unique device key according to the pre-provisioned, protected symmetric boot key; and

decrypting the encrypted requested data according to the symmetric unique device key.

13 . The device of claim 12 , wherein the processor instructions further comprise processor instructions for:

receiving a request in the key-sharing infrastructure from the third party to provide the data to the device;

retrieving the symmetric unique device key from the hardware security module of the key-sharing infrastructure;

providing the symmetric unique device key to the third party;

encrypting, by the third party, the data according to the symmetric unique device key; and

transmitting the encrypted data to the device.

14 . The device of claim 13 , wherein the pre-provisioned protected symmetric key provisioning key is:

created by a multi-party controlled key ceremony;

stored in a hardware security module of a key sharing infrastructure; and

pre-provisioned from a hardware security device of the key sharing infrastructure to the secure memory.

15 . A system securing a device having processor, the processor communicatively coupled to a secure memory storing a pre-provisioned, protected symmetric boot key, the method comprising:

means for performing a secure boot of the processor, using the pre-provisioned, protected symmetric boot key, comprising:

means for performing boot instructions, the boot instructions including instructions for:

loading at least a portion of the boot code, and boot code verification data into a memory; and

verifying the loaded at least of portion of the boot code according to the pre-provisioned protected symmetric boot key and the boot code verification data;

means for generating at least one post quantum cryptography (PQC) key pair having a PQC private key and a PQC public key;

means for encrypting the PQC private key according to the pre-provisioned protected symmetric key;

means for storing the encrypted PQC private key in the secure memory;

means for generating a request having the PQC public key; and

means for transmitting the request to an agency external to the processor.

16 . The system of claim 15 , wherein:

the request is a certificate signing request and the external agency is a certificate authority; and

the system further comprises means for receiving a signed digital certificate.

17 . The system of claim 15 , wherein:

the means for generating, by the processor, at least one PQC key pair having a PQC private key and a PQC public key comprises:

means for receiving PQC software and PQC software verification data the PQC software, the PQC software for generating the at least one PQC key pair;

means for authenticating the PQC software according to the pre-provisioned protected symmetric key and the PQC software verification data;

means for installing the authenticated PQC software on the device; and

means for executing the authenticated PQC software to generate the PQC key pair.

18 . The system of claim 15 , wherein:

the secure memory further stores a pre-provisioned protected symmetric key provisioning key;

the system further comprises:

means for receiving, in the device, a symmetric unique device key encrypted according to the pre-provisioned protected symmetric key provisioning key;

means for decrypting the symmetric unique device key according to the pre-provisioned protected symmetric key provisioning key;

means for encrypting the symmetric unique device key according to the pre-provisioned, protected symmetric boot key; and

means for storing the encrypted symmetric unique device key in the secure memory.

19 . The means for of claim 18 , wherein:

the means for transmitting the request to the agency external to the processor comprises:

means for transmitting a request for data to a third party;

the system further comprises:

means for receiving the requested data from the third party, the requested data encrypted according to the symmetric unique device key; and

means for decrypting the symmetric unique device key according to the pre-provisioned, protected symmetric boot key; and

means for decrypting the encrypted requested data according to the symmetric unique device key.

20 . The system of claim 19 , further comprising:

means for receiving a request in the key-sharing infrastructure from the third party to provide the data to the device;

means for retrieving the symmetric unique device key from the hardware security module of the key-sharing infrastructure;

means for providing the symmetric unique device key to the third party;

means for encrypting, by the third party, the data according to the symmetric unique device key; and

means for transmitting the encrypted data to the device.