Secure key delivery

Abstract

Approaches in accordance with various illustrative embodiments provide for the encryption of communications going into and out of a device, such as a chip or proprietary bus. The encryption can occur in a central Root-of-Trust (RoT), which can include agents for individual communication protocols to generate session keys used to encrypt communications for individual sessions, and the data can be sent to a crypto engine for the respective communication protocol. A key tunnel unit can be used to receive a wrapped session key over the public bus and then unwrap the key in hardware, then able to then transmit the unwrapped session key to the corresponding crypto engine without exposing the session key to software executing on the device outside the RoT. A nonce can be used with a current derivation key, of a set of ephemeral keys, to generate a new set of ephemeral keys to be used to perform various cryptographic operations, allowing for secure rotation of wrapping keys, as well as other keys such as derivation and message keys.