Abstract: Methods, systems, and devices for detecting information modification in a memory system are described. A system may generate a first value, such as a first hash value, from information stored in storage component. The system may then generate a second value, such as a second hash value, from content stored in the storage component. After generating the second value, the system may compare the second value to the first value. The system may then determine the modification status of the information based on the comparison, and implement one or more operations based on the modification status.

Abstract: Devices and techniques that provide hardware-protected system measurements are described herein. A system comprises a memory device accessible by a first device and a host device, wherein the first device is configured for use with the host device; processing circuitry coupled to the memory device; and programmable read-only memory coupled to the memory device, the programmable read-only memory comprising instructions to: initialize the first device; validate firmware that is to execute on the first device; obtain a measurement of the firmware; store the measurement in the memory device; and initiate execution of the firmware.

Abstract: Methods, systems, and devices for detecting information modification in a memory system are described. A system may generate a first value, such as a first hash value, from information stored in storage component. The system may then generate a second value, such as a second hash value, from content stored in the storage component. After generating the second value, the system may compare the second value to the first value. The system may then determine the modification status of the information based on the comparison, and implement one or more operations based on the modification status.

Abstract: Methods, systems, and devices for secure key generation using device identifiers are described. A memory system may use a hardware component, a software component, or both as an input to generate a device identifier. The memory system may apply one or more functions to the device identifier, such as a key derivation function, to generate a wrapping key. Additionally, the memory system may generate an asymmetric key pair using one or more second functions. In some cases, the memory system may use a randomly generated number as an input to the one or more second functions. The memory system may encrypt the asymmetric key pair using the wrapping key. In some examples, the memory system may generate a certificate using the encrypted asymmetric key pair, and may transmit the certificate to a host system to attest the identity of the memory system to the host system.

Abstract: A processing device receives, from a host system, a key manifest and a digital signature generated based on the key manifest using a private key corresponding to a public/private key pair. The key manifest comprises one or more verification keys. The digital signature is verified using the public key and the processing device stores the key manifest in a persistent storage component in response to successful verification of the digital signature. The one or more verification keys are utilized in one or more verification operations based on the key manifest being stored in the persistent memory component.

Abstract: A processing device receives a firmware update for a memory sub-system comprising a memory device. Based on the firmware update, the processing device stores a private key of a first device identity key pair in a non-volatile memory component of the memory sub-system such that the private key is persisted upon reset. The first device identity key pair is based on a first device identifier. Upon reset of the memory sub-system, the processing device generates a second device identifier based on the firmware update and generates a second device identity key pair based on the second device identifier. The processing device generates a new device identity certificate based on a public key of the second device identity key pair and signs the new certificate using the private key of the first device identity key pair. The processing device injects the new certificate into a certificate chain for the memory device.

Abstract: A processing device is configured to process an initial set of command types. A command extension module and a digital signature are received. The digital signature is generated based on the command extension module using a private key of a key pair. The command extension module, once installed by the processing device, enables the processing device to process a new command type that is not included in the initial set of command types. The digital signature is verified using a public key of the key pair. Based on a successful verification of the digital signature, the command extension module is temporarily installed by loading the command extension module in a volatile memory device.

Abstract: A processing device receives, from a host system, a key manifest and a digital signature generated based on the key manifest using a private key corresponding to a public/private key pair. The key manifest comprises one or more verification keys. The digital signature is verified using the public key and the processing device stores the key manifest in a persistent storage component in response to successful verification of the digital signature. The one or more verification keys are utilized in one or more verification operations based on the key manifest being stored in the persistent memory component.

Abstract: A request for password generation is received from a host system. In response to receiving the request, a password derivation key is generated based on a key derivation seed. A password is derived from the password derivation key, and a wrapping key is derived from the password. The wrapping key is used to wrap an authorization state indication, which is stored in local memory. Encrypted data is generated based on an encryption of the key derivation seed using an asymmetric encryption key. The encrypted data is provided in response to the request.

Abstract: A request for password generation is received from a host system. In response to receiving the request, a password derivation key is generated based on a key derivation seed. A password is derived from the password derivation key, and a wrapping key is derived from the password. The wrapping key is used to wrap an authorization state indication, which is stored in local memory. Encrypted data is generated based on an encryption of the key derivation seed using an asymmetric encryption key. The encrypted data is provided in response to the request.

Abstract: A processing device calculates a set of reference system measurements based on an initial firmware image corresponding to a memory device. The processing device stores the set of reference system measurements in a measurement attestation block of the memory device. A set of current system measurements are calculated by the processing device based on a current firmware image corresponding to the memory device. The processing device performs a comparison of the set of current system measurements with the set of reference system measurements stored in the measurement attestation block of the memory device and performs an action with respect to the memory device based on a result of the comparison.

Abstract: A processing device is configured to process an initial set of command types. A command extension module and a digital signature are received. The digital signature is generated based on the command extension module using a private key of a key pair. The command extension module, once installed by the processing device, enables the processing device to process a new command type that is not included in the initial set of command types. The digital signature is verified using a public key of the key pair. Based on a successful verification of the digital signature, the command extension module is temporarily installed by loading the command extension module in a volatile memory device.

Abstract: A processing device is configured to process an initial set of command types. A command extension module and a digital signature are received. The digital signature is generated based on the command extension module using a private key of a key pair. The command extension module, once installed by the processing device, enables the processing device to process a new command type that is not included in the initial set of command types. The digital signature is verified using a public key of the key pair. Based on a successful verification of the digital signature, the command extension module is temporarily installed by loading the command extension module in a volatile memory device.

Abstract: Methods, systems, and devices for detecting information modification in a memory system are described. A system may generate a first value, such as a first hash value, from information stored in storage component. The system may then generate a second value, such as a second hash value, from content stored in the storage component. After generating the second value, the system may compare the second value to the first value. The system may then determine the modification status of the information based on the comparison, and implement one or more operations based on the modification status.

Abstract: A request for password generation is received from a host system. In response to receiving the request, a password derivation key is generated based on a key derivation seed. A password is derived from the password derivation key, and a wrapping key is derived from the password. The wrapping key is used to wrap an authorization state indication, which is stored in local memory. Encrypted data is generated based on an encryption of the key derivation seed using an asymmetric encryption key. The encrypted data is provided in response to the request.

Abstract: A key delegation request is received from a host system. The key delegation request includes a new public key. A challenge is generated based on the new public key and a root public key, and the challenge is provided to the host system responsive to the request. A first and second digital signature are received from the host system. The first digital signature is generated by cryptographically signing the challenge using a new private key corresponding to the new public key and the second digital signature is generated by cryptographically signing the challenge using a root private key corresponding to the root public key. The first digital signature is validated using the new public key and the second digital signature is validated using the root public key. Based on successful validation of both signatures, the new public key is utilized in one or more cryptographic operations.

Abstract: A request for password generation is received from a host system. In response to receiving the request, a password derivation key is generated based on a key derivation seed. A password is derived from the password derivation key, and a wrapping key is derived from the password. The wrapping key is used to wrap an authorization state indication, which is stored in local memory. Encrypted data is generated based on an encryption of the key derivation seed using an asymmetric encryption key. The encrypted data is provided in response to the request.

Abstract: Methods, systems, and devices for double wrapping for verification are described. In some cases, a memory subsystem can receive a firmware image for the memory subsystem where the firmware image is signed with a first signature according to a first signing procedure. The memory subsystem can then verify an integrity of the firmware image based on the first signing procedure. After verifying the integrity of the firmware image, the memory subsystem can then generate a second signature for the firmware image based on a second signing procedure different from the first signing procedure. The memory subsystem can then write the second signature to the firmware image. The memory subsystem can then perform a verification process to verify the integrity of the firmware image based on one or both of the first signing procedure or the second signing procedure.

Abstract: A processing device is configured to process an initial set of command types. A command extension module and a digital signature are received. The digital signature is generated based on the command extension module using a private key of a key pair. The command extension module, once installed by the processing device, enables the processing device to process a new command type that is not included in the initial set of command types. The digital signature is verified using a public key of the key pair. Based on a successful verification of the digital signature, the command extension module is temporarily installed by loading the command extension module in a volatile memory device.

Abstract: A processing device receives, from a host system, a key manifest and a digital signature generated based on the key manifest using a private key corresponding to a public/private key pair. The key manifest comprises one or more verification keys. The digital signature is verified using the public key and the processing device stores the key manifest in a persistent storage component in response to successful verification of the digital signature. The one or more verification keys are utilized in one or more verification operations based on the key manifest being stored in the persistent memory component.