Abstract: Various implementations relate to controller in a system, including: a device connected to a network; and a secure sub-system connected to the device via a first wired connection, the secure sub-system configured to: establish a trusted channel with a user certificate authority (CA) via a provisioning device; receive application parameters from user CA; provision a timestamp or secure time server information based upon the timestamp or secure time server information received from the user CA; create a device identity for the device; and terminate the trusted channel after provisioning the timestamp or secure time server information and creating the device identity for the device.

Abstract: A method for secure booting a device having a non-volatile memory (NVM) includes: performing a mission mode including: protecting the protected area of the NVM; protecting the scratch area of the NVM; performing a download boot mode including: protecting a protected area of the NVM; performing a protected area integrity check; loading boot patches; applying download firewall settings; and downloading one of a firmware, a scratch page, or firmware and scratch page for the device including an authentication check of the download; performing commit boot mode including: protecting a scratch area of the NVM; applying commit firewall settings; performing a scratch area authenticity check; copying information from the scratch area into the protected area; and protecting the protected area of the NVM.

Abstract: Various embodiments relate to a system for provisioning a cryptographic device, including: a memory; a processor coupled to the memory, wherein the processor is further configured to: determine the maximum key generation seed size, maximum PQC private key size, maximum PQC public key size, and maximum PQC updater size of a plurality of post quantum cryptography algorithms; provision memory in the cryptographic device to store a key generation seed, PQC private key, PQC public key, and PQC updater based upon the determined maximum key generation seed size, maximum PQC private key size, maximum PQC public key size, and maximum PQC updater size; and provision the cryptographic device with a non-PQC secret key, a non-PQC public key, and non-PQC algorithm code configured to carry out non-PQC cryptographic algorithms.

Abstract: Various embodiments relate to a system for provisioning a cryptographic device, including: a memory; a processor coupled to the memory, wherein the processor is further configured to: determine a maximum PQC private key size, maximum PQC public key size, and maximum PQC updater size of a plurality of post quantum cryptography algorithms; provision memory in the cryptographic device to store a PQC-update non-PQC private key, a secret PQC-update non-PQC public key, PQC private key, PQC public key, and PQC updater based upon the determined maximum PQC private key size, maximum PQC public key size, and maximum updater size; and provision the cryptographic device with the PQC-update non-PQC private key, the secret PQC-update non-PQC public key, a non-PQC secret key, a non-PQC public key, and non-PQC algorithm code configured to carry out non-PQC cryptographic algorithms.

Abstract: Various implementations relate to controller in a system, including: a device connected to a network; and a secure sub-system connected to the device via a first wired connection, the secure sub-system configured to: establish a trusted channel with a user certificate authority (CA) via a provisioning device; receive application parameters from user CA; provision a timestamp or secure time server information based upon the timestamp or secure time server information received from the user CA; create a device identity for the device; and terminate the trusted channel after provisioning the timestamp or secure time server information and creating the device identity for the device.

Abstract: Various embodiments relate to a system for provisioning a cryptographic device, including: a memory; a processor coupled to the memory, wherein the processor is further configured to: determine the maximum key generation seed size, maximum PQC private key size, maximum PQC public key size, and maximum PQC updater size of a plurality of post quantum cryptography algorithms; provision memory in the cryptographic device to store a key generation seed, PQC private key, PQC public key, and PQC updater based upon the determined maximum key generation seed size, maximum PQC private key size, maximum PQC public key size, and maximum PQC updater size; and provision the cryptographic device with a non-PQC secret key, a non-PQC public key, and non-PQC algorithm code configured to carry out non-PQC cryptographic algorithms.

Abstract: Various embodiments relate to a system for provisioning a cryptographic device, including: a memory; a processor coupled to the memory, wherein the processor is further configured to: determine a maximum PQC private key size, maximum PQC public key size, and maximum PQC updater size of a plurality of post quantum cryptography algorithms; provision memory in the cryptographic device to store a PQC-update non-PQC private key, a secret PQC-update non-PQC public key, PQC private key, PQC public key, and PQC updater based upon the determined maximum PQC private key size, maximum PQC public key size, and maximum updater size; and provision the cryptographic device with the PQC-update non-PQC private key, the secret PQC-update non-PQC public key, a non-PQC secret key, a non-PQC public key, and non-PQC algorithm code configured to carry out non-PQC cryptographic algorithms.