Reusing one secret across devices creates a broad compromise: break one device, and every device may be exposed. A key encryption key (KEK) helps protect a device-specific data encryption key (DEK) instead. section 13.2.4
The relationship is simple:
- The DEK encrypts protected device data. section 13.2.4
- The KEK encrypts the DEK rather than encrypting the data directly. section 13.2.4
- A device can combine its hardware UID and the user PIN through password-based key derivation to obtain the KEK-related protection. section 13.2.4
- Because the DEK is protected by the KEK, users can change their PIN quickly without directly rederiving the DEK. section 13.2.4
Device unlock example
An Apple Secure Enclave has a device-specific UID. The UID and user PIN participate in deriving protection for a KEK, while the KEK encrypts the DEK used for the device’s data. section 13.2.4
Figure 13.3 A chip implementing the TPM 2.0 standard, plugged into a motherboard. This chip can be called by the system’s motherboard components as well as user applications running on the computer’s OS. Photo from Wikipedia (http://mng.bz/Q2je).
A TPM 2.0 chip provides the hardware setting in which device-specific cryptographic keys and protected operations can be anchored. section 13.2.4
