Welcome!

SOA & WOA Authors: Elizabeth White, Pat Romanski, Carmen Gonzalez, Lori MacVittie, Liz McMillan

Related Topics: Security, Java, SOA & WOA, Virtualization, Web 2.0, SDN Journal

Security: Article

Time to Ditch Cryptographic Keys?

Will keyless signatures overtake PKI as the wave of the future? Governments, flying drones, and big telecom all say so

What is the most secure way to authenticate electronic data? Until recently, many technical people would have answered ‘cryptographic keys' without blinking. But recent headline events - and a ‘biggie' last year - have raised serious doubts about the ability of cryptographic keys to protect vital government and corporate data.

Here are two examples from February that should make CIOs, CTOs and CSOs tremble in their boardrooms: McAfee revoking keys for signing apps on the Apple store; and stolen keys from Bit9 being used to sign malware.

In the McAfee case, a McAfee administrator revoked (by mistake) the digital key for certifying desktop apps that run on Apple's OS X, thereby creating serious problems for customers who wanted to install or upgrade Mac antivirus products.

The original Arstechnica article (McAfee revoking keys) noted that the administrator intended to revoke his individual user key, but "instead revoked the code-signing keys Apple uses to help keep the Mac ecosystem free of malware."

The bottom line: the mistake left customers with no safe options to install or upgrade their programs. The big takeaway: this episode paints a graphic picture of the challenges of administering the digital certificates at the heart of public key infrastructures (PKI) - certificates used to validate software and websites, and to encrypt email and other forms of Internet communication.

Also in February, a private key that security firm Bit9 uses to certify software was stolen by crooks and used to put a trusted seal of approval on malware that infected a few Bit9 customers.

However, those sorry episodes pale in comparison to a massive security breach last year when hackers used a stolen master private key from RSA to attack Lockheed Martin (RSA/EMC losing its master private key.) Lockheed, a major defense contractor to the U.S. government, makes the F-16, F-22 and F-35 fighter aircraft, the Aegis naval combat system, and the THAAD missile defense.

Sources close to Lockheed said compromised RSA SecurID tokens - USB keychain dongles that generate strings of numbers for cryptography purposes - played a pivotal role in the Lockheed Martin hack.

Hackers apparently entered Lockheed Martin's servers and accessed the company's virtual private network (VPN). The VPN allows employees to connect over virtually any public network to the company's primary servers, using information streams secured by cryptography.

With the RSA tokens hacked, those supposedly secure VPN connections were compromised.

Predictably, Lockheed said it detected the attack almost immediately, repulsed it quickly, and that the risk was minimal. The company also claimed that no customer, program or personal employee data was compromised.

All of the above examples not only undermine the security of using cryptographic keys but leave people wondering whether there is a better way to authenticate.

The better way - Keyless Signature Infrastructure (KSI) - has been around since 2007, when it was invented by scientists in Estonia. KSI generates digital signatures for electronic data on a massive scale but uses only cryptographic hash functions, meaning there are no keys to be compromised or trusted humans in sight.

Some six years ago, Estonian scientists at Tallinn Technical University posed the question: How can you rely on electronic data if you assume that your entire network has been compromised and nobody - not even the system administrators within your own organization - can be trusted?

KSI, the fruit of those scientists' work, is used by governments and companies around the world. It helps them to authenticate electronic data generated from the Smart Grid, the Connected Car, and networked routers and machines (either virtual or physical) - basically any type of electronic data. In November, China Telecom, the largest fixed line telecommunications service provider in China, became a keyless signature service provider via its Tianyi 3G platform. Most recently Japan Drones, a developer of custom software for miniature Unmanned Aerial Vehicles (UAVs) announced it was using keyless signatures for its drone security. The U.S. military could use the good PR, given publicity over a white hat hacking scheme done by University of Texas students as reported in June by The Huffington Post, which went as far as to say, "Turns out it's not too difficult to hack a drone."

Chaozong Chen, general manager of Ningbo CA, the Certificate Authority for the city of Ningbo in Zhejiang province in China, said, "KSI's unique features such as independency of verification, intrinsic time binding for data, universal accessibility cross platforms and lack of keys allow us to provide functions and values where traditional public key infrastructure (PKI) is limited. The future proof from quantum computing is of course a major benefit."

Here's another example of KSI in action: every payment within the Estonian banking system comes with a keyless signature, ensuring that insiders cannot modify transactions intent on fraud.

In addition, the Estonian government has embarked on a huge project to integrate KSI technology into the rsyslog utility - a project that will enable every system event across all government networks to be authenticated by time, data integrity and server identity. (Note: rsylog is an open source utility used on Unix and Unix-like computers for forwarding log messages in an IP network.)

Further demonstrating Estonia's confidence in KSI, the Estonian Government's Centre of Registers and Information Systems (RIK) recently embraced the technology.

RIK is using keyless signature technology for validating the authenticity of documents that it is digitizing from the archives of the Succession Register and Chamber of Notaries.

Using keyless signature infrastructure, the authenticity of all the records is periodically verified, the re-verification happens automatically, meaning that the information about the integrity of the stored records is always up to date and any breaches create an alert immediately.

As KSI has proven itself for years in various government and commercial entities, the time is ripe to consider it the logical successor to cryptographic keys, which are starting to look outdated and very vulnerable.

"While our PKI based solutions have been widely adopted, we see a growing need to prove data integrity and time on a massive scale, with cases where customer identification registration is unpractical and less important, such as electronic receipts for cash based transactions," said Chaozong Chen. "These are where KSI can help. It is strategically important for us to start integrating KSI with our successful PKI solutions and this will help us maintain our leadership in the field."

More Stories By Herman Mehling

Herman Mehling has been an IT writer and consultant for more than 25 years. He has written thousands of articles for leading trade magazines and websites. His work has appeared in such publications as Computer Reseller News, eWeek, Forbes, Network World and InformationWeek. In the ’80s and ’90s, he worked as a PR executive at many San Francisco Bay Area high-tech agencies, including Niehaus Ryan Haller, which helped to launch Yahoo! and to re-cast the image of Apple as an Internet player. He was a staff editor and reporter at Computer Reseller News for many years.

Comments (0)

Share your thoughts on this story.

Add your comment
You must be signed in to add a comment. Sign-in | Register

In accordance with our Comment Policy, we encourage comments that are on topic, relevant and to-the-point. We will remove comments that include profanity, personal attacks, racial slurs, threats of violence, or other inappropriate material that violates our Terms and Conditions, and will block users who make repeated violations. We ask all readers to expect diversity of opinion and to treat one another with dignity and respect.


@ThingsExpo Stories
From a software development perspective IoT is about programming "things," about connecting them with each other or integrating them with existing applications. In his session at @ThingsExpo, Yakov Fain, co-founder of Farata Systems and SuranceBay, will show you how small IoT-enabled devices from multiple manufacturers can be integrated into the workflow of an enterprise application. This is a practical demo of building a framework and components in HTML/Java/Mobile technologies to serve as a platform that can integrate new devices as they become available on the market.
SYS-CON Events announced today that SOA Software, an API management leader, will exhibit at SYS-CON's 15th International Cloud Expo®, which will take place on November 4–6, 2014, at the Santa Clara Convention Center in Santa Clara, CA. SOA Software is a leading provider of API Management and SOA Governance products that equip business to deliver APIs and SOA together to drive their company to meet its business strategy quickly and effectively. SOA Software’s technology helps businesses to accelerate their digital channels with APIs, drive partner adoption, monetize their assets, and achieve a...
BSQUARE is a global leader of embedded software solutions. We enable smart connected systems at the device level and beyond that millions use every day and provide actionable data solutions for the growing Internet of Things (IoT) market. We empower our world-class customers with our products, services and solutions to achieve innovation and success. For more information, visit www.bsquare.com.
Almost everyone sees the potential of Internet of Things but how can businesses truly unlock that potential. The key will be in the ability to discover business insight in the midst of an ocean of Big Data generated from billions of embedded devices via Systems of Discover. Businesses will also need to ensure that they can sustain that insight by leveraging the cloud for global reach, scale and elasticity.
SYS-CON Events announced today that Red Hat, the world's leading provider of open source solutions, will exhibit at Internet of @ThingsExpo, which will take place on November 4–6, 2014, at the Santa Clara Convention Center in Santa Clara, CA. Red Hat is the world's leading provider of open source software solutions, using a community-powered approach to reliable and high-performing cloud, Linux, middleware, storage and virtualization technologies. Red Hat also offers award-winning support, training, and consulting services. As the connective hub in a global network of enterprises, partners, a...
SYS-CON Events announced today that Utimaco will exhibit at SYS-CON's 15th International Cloud Expo®, which will take place on November 4–6, 2014, at the Santa Clara Convention Center in Santa Clara, CA. Utimaco is a leading manufacturer of hardware based security solutions that provide the root of trust to keep cryptographic keys safe, secure critical digital infrastructures and protect high value data assets. Only Utimaco delivers a general-purpose hardware security module (HSM) as a customizable platform to easily integrate into existing software solutions, embed business logic and build s...
How do APIs and IoT relate? The answer is not as simple as merely adding an API on top of a dumb device, but rather about understanding the architectural patterns for implementing an IoT fabric. There are typically two or three trends: Exposing the device to a management framework Exposing that management framework to a business centric logic • Exposing that business layer and data to end users. This last trend is the IoT stack, which involves a new shift in the separation of what stuff happens, where data lives and where the interface lies. For instance, it’s a mix of architectural style...
Connected devices are changing the way we go about our everyday life, from wearables to driverless cars, to smart grids and entire industries revolutionizing business opportunities through smart objects, capable of two-way communication. But what happens when objects are given an IP-address, and we rely on that connection, sometimes with our lives? How do we secure those vast data infrastructures and safe-keep the privacy of sensitive information? This session will outline how each and every connected device can uphold a core root of trust via a unique cryptographic signature – a “bir...
SYS-CON Events announced today that Matrix.org has been named “Silver Sponsor” of Internet of @ThingsExpo, which will take place on November 4–6, 2014, at the Santa Clara Convention Center in Santa Clara, CA. Matrix is an ambitious new open standard for open, distributed, real-time communication over IP. It defines a new approach for interoperable Instant Messaging and VoIP based on pragmatic HTTP APIs and WebRTC, and provides open source reference implementations to showcase and bootstrap the new standard. Our focus is on simplicity, security, and supporting the fullest feature set.
Internet of @ThingsExpo Silicon Valley announced on Thursday its first 12 all-star speakers and sessions for its upcoming event, which will take place November 4-6, 2014, at the Santa Clara Convention Center in California. @ThingsExpo, the first and largest IoT event in the world, debuted at the Javits Center in New York City in June 10-12, 2014 with over 6,000 delegates attending the conference. Among the first 12 announced world class speakers, IBM will present two highly popular IoT sessions, which will take place November 4-6, 2014 at the Santa Clara Convention Center in Santa Clara, Calif...
P2P RTC will impact the landscape of communications, shifting from traditional telephony style communications models to OTT (Over-The-Top) cloud assisted & PaaS (Platform as a Service) communication services. The P2P shift will impact many areas of our lives, from mobile communication, human interactive web services, RTC and telephony infrastructure, user federation, security and privacy implications, business costs, and scalability. In his session at Internet of @ThingsExpo, Robin Raymond, Chief Architect at Hookflash Inc., will walk through the shifting landscape of traditional telephone a...
WebRTC defines no default signaling protocol, causing fragmentation between WebRTC silos. SIP and XMPP provide possibilities, but come with considerable complexity and are not designed for use in a web environment. In his session at Internet of @ThingsExpo, Matthew Hodgson, technical co-founder of the Matrix.org, will discuss how Matrix is a new non-profit Open Source Project that defines both a new HTTP-based standard for VoIP & IM signaling and provides reference implementations.

SUNNYVALE, Calif., Oct. 20, 2014 /PRNewswire/ -- Spansion Inc. (NYSE: CODE), a global leader in embedded systems, today added 96 new products to the Spansion® FM4 Family of flexible microcontrollers (MCUs). Based on the ARM® Cortex®-M4F core, the new MCUs boast a 200 MHz operating frequency and support a diverse set of on-chip peripherals for enhanced human machine interfaces (HMIs) and machine-to-machine (M2M) communications. The rich set of periphera...

SYS-CON Events announced today that Aria Systems, the recurring revenue expert, has been named "Bronze Sponsor" of SYS-CON's 15th International Cloud Expo®, which will take place on November 4-6, 2014, at the Santa Clara Convention Center in Santa Clara, CA. Aria Systems helps leading businesses connect their customers with the products and services they love. Industry leaders like Pitney Bowes, Experian, AAA NCNU, VMware, HootSuite and many others choose Aria to power their recurring revenue business and deliver exceptional experiences to their customers.
The Internet of Things (IoT) is going to require a new way of thinking and of developing software for speed, security and innovation. This requires IT leaders to balance business as usual while anticipating for the next market and technology trends. Cloud provides the right IT asset portfolio to help today’s IT leaders manage the old and prepare for the new. Today the cloud conversation is evolving from private and public to hybrid. This session will provide use cases and insights to reinforce the value of the network in helping organizations to maximize their company’s cloud experience.
The Internet of Things (IoT) is making everything it touches smarter – smart devices, smart cars and smart cities. And lucky us, we’re just beginning to reap the benefits as we work toward a networked society. However, this technology-driven innovation is impacting more than just individuals. The IoT has an environmental impact as well, which brings us to the theme of this month’s #IoTuesday Twitter chat. The ability to remove inefficiencies through connected objects is driving change throughout every sector, including waste management. BigBelly Solar, located just outside of Boston, is trans...
SYS-CON Events announced today that Matrix.org has been named “Silver Sponsor” of Internet of @ThingsExpo, which will take place on November 4–6, 2014, at the Santa Clara Convention Center in Santa Clara, CA. Matrix is an ambitious new open standard for open, distributed, real-time communication over IP. It defines a new approach for interoperable Instant Messaging and VoIP based on pragmatic HTTP APIs and WebRTC, and provides open source reference implementations to showcase and bootstrap the new standard. Our focus is on simplicity, security, and supporting the fullest feature set.
Predicted by Gartner to add $1.9 trillion to the global economy by 2020, the Internet of Everything (IoE) is based on the idea that devices, systems and services will connect in simple, transparent ways, enabling seamless interactions among devices across brands and sectors. As this vision unfolds, it is clear that no single company can accomplish the level of interoperability required to support the horizontal aspects of the IoE. The AllSeen Alliance, announced in December 2013, was formed with the goal to advance IoE adoption and innovation in the connected home, healthcare, education, aut...
SYS-CON Events announced today that Red Hat, the world's leading provider of open source solutions, will exhibit at Internet of @ThingsExpo, which will take place on November 4–6, 2014, at the Santa Clara Convention Center in Santa Clara, CA. Red Hat is the world's leading provider of open source software solutions, using a community-powered approach to reliable and high-performing cloud, Linux, middleware, storage and virtualization technologies. Red Hat also offers award-winning support, training, and consulting services. As the connective hub in a global network of enterprises, partners, a...
The only place to be June 9-11 is Cloud Expo & @ThingsExpo 2015 East at the Javits Center in New York City. Join us there as delegates from all over the world come to listen to and engage with speakers & sponsors from the leading Cloud Computing, IoT & Big Data companies. Cloud Expo & @ThingsExpo are the leading events covering the booming market of Cloud Computing, IoT & Big Data for the enterprise. Speakers from all over the world will be hand-picked for their ability to explore the economic strategies that utility/cloud computing provides. Whether public, private, or in a hybrid form, clo...