Descriptors are used to wrap common security objects such as encryption keys. This allows common key exchange mechanisms to be used regardless of key or encryption type.

USB features are defined to represent security-related control elements present in devices. The USB framework is used to manipulate these features in the standard USB manner.

USB Requests are defined for the security-related command elements. These requests are used for key management, challenge-response verification, and encryption control.

6.2.4 Encryption Methods

The standard method of encryption for the first generation of Wireless USB is AES-128 Counter with CBCMac (CCM). This is a symmetric encryption algorithm that uses the AES block cipher to create a robust stream cipher that can be used to provide integrity, encryption, or both. It is capable of real-time operation when implemented in hardware. This is the only method currently defined for general session encryption.

Wireless USB also supports public key encryption, but only for authentication. Devices may choose to start a first-time authentication with public key encryption. In this case, PK encryption is used to authenticate the device and to protect the distribution of the initial CCM key. When PK is used, it will be used in a manner that will allow for software implementations of the algorithms.

The CCM encryption suite provides 128 bits of security for run-time operation. The PK cryptography suite must provide the same level of strength or else the strength of the entire suite is compromised. For this reason, Wireless USB will use RSA with 3072 bit keys for encryption and SHA-256 for hashing.

The Security Architecture also recognizes a wired connection as an encryption method. This allows the SME to recognize a wired connection as a secure connection, without resorting to additional cryptography. This allows for wired/wireless devices, where the wired connection can be used for initial CCM Connection Key distribution.

6.2.5 Message Format

Encryption will generally cause the message length to grow. In addition to the original message, the encrypted message must now contain additional keying material, freshness values, and an integrity value. The exact nature of these additional message components is dependent on the type of encryption used. In general, any new additional material added to the message, other than the integrity value, will be added as a header. This header will immediately precede the encrypted message. The integrity value will immediately follow the message.

6.2.6 Encryption Keys

This section describes the various keys identified for USB Security. In general, the keys fall into two classes of keys, master keys and session keys.

6.2.6.1Master Keys

Master keys refer to keys that are generally long-lived. Master keys are typically used as the shared secret for authentication. They are also used to derive or protect distribution of session keys

6.2.6.1.1PK Association Key

This is really a Public Key encryption key-pair. It is optionally used by devices for establishing new connections. The PK pair can be used if the device has no other means for accepting distribution of the CC. The host and device exchange their public keys. The owner must validate that the correct public keys have been received to insure that the correct connection has been made. The host then uses the device public key to protect the distribution of the CC.

If implemented, this key-pair must reside in device memory at the time of the first connection. This key-pair must also be unique to the device.

121

If the device creates the key-pair dynamically, it must do so in a manner that does not greatly increase device initialization time. The current goal is that a device be capable of transitioning from power-up to fullyconnected in 3 seconds or less. Exceeding this time seriously impacts user satisfaction.

6.2.6.1.2Symmetric Association Key

The symmetric association key is another optional key used for establishing new connections. In this case, the key is a symmetric 128-bit CCM key that exists in device memory at the time of the new connection. This key is transferred to the host via the owner. This could be accomplished via installation software, data entry, or any suitable OOB channel means. This key is only used to protect the distribution of the CC.

6.2.6.1.3Connection Key

The Connection key (CK) is the primary key used for establishing connections (see 6.2.10 below for details regarding the connection model). This key is created by the host and distributed to the device, along with a corresponding CHID and a CDID at the time of first connection or using an out-of-band method. The key is a 128-bit CCM key. The host should update this key periodically as this will only increase security robustness. The host is expressly forbidden from distributing one CK to multiple devices, unless the CK is the Diagnostic CK and the key is being distributed for diagnostic purposes. Each device must be given a unique CK. Wireless USB uses the CK for authentication and for derivation of the initial session key, the PTK.

Possession of a CK and the CHID/CDID pair implies that the possessor has the owner’s trust, allowing the host and device to connect or reconnect without owner intervention.

6.2.6.2Session Keys

Session keys are short-lived keys, typically used for operational encryption and decryption. These keys are created when a connection is established and discarded when the connection ends.

6.2.6.2.1Pair-wise Temporal Key (PTK)

PTKs are the “working” keys for USB data encryption. These keys are derived during a 4 way handshake. The host maintains a separate PTK for every device connected. The host uses this key to encrypt all data packets sent to the corresponding device and to decrypt all packets received from the device.

The device uses this key to decrypt all data packets received from the host and to encrypt all packets sent to the host.

6.2.6.2.2Group Temporal Key (GTK)

The GTK is a specialized temporary key that is shared by all members of the current USB cluster. It allows the host to send secured messages in a broadcast manner, such as an MMC. These messages are not encrypted, but they still require the addition of a MIC.

Devices may not use the GTK for encryption. Only the host can transmit messages secured with the GTK.

6.2.6.2.3Names for Session Keys

The underlying MAC layer uses names for both PTKs and GTKs. This name is referred to as the Temporal Key ID (TKID) and is present in every secured packet sent between host and device. The TKID identifes the key used to encrypt the secured packet. The host is responsible for creating TKID values and supplying these to devices at the time of key derivation or key distribution.

122