Broken Security: 5 Ways To Avoid The Coming Cryptopocalypse

Trust, Security On The Internet Could Fail

When the most widely used encryption algorithms are broken, websites that support strong security to protect banking sessions could fail, opening them up to attack; online shopping sites that protect buyers by securing the transaction would be exposed to prying eyes; and VPNs, used by businesses to protect remote employees, would be exposed to attack. The fundamental trust mechanisms and digital certificates that authenticate users and validate software would be severely eroded, according to researchers at iSEC Partners, who spoke about the coming "cryptopocalypse" at the Black Hat 2013 security conference. The security experts said everyone who uses the Internet has a stake in ensuring that trust doesn't erode and security is maintained. Here are five ways to prepare.

Public Key Cryptography: First, Understand The Challenge

Public key cryptography, the current method used for secure communications and authentication on the Internet, is about to be broken, according to security researchers. Security experts from iSEC Partners said it could be cracked in the next five years. Current cryptosystems use either the RSA or Diffie-Hellman (DH) algorithms, which depend on discrete logarithm, a fundamental algebraic method, and factoring. Mathematicians are getting closer to breaking them, the researchers said. Making matters worse is the low cost of additional computational power, which speeds the process of finding a crack. Speaking to attendees at the Black Hat 2013 security conference, the researchers advocated a move to elliptic curve cryptography (ECC), which has remained at its full strength since it was first presented in 1985.

Certificate Authorities Must Fuel ECC Adoption

There's good news to report, according to the researchers. The transition from RSA digital certificates to ECC-based root certificates is taking place at major global certificate authorities, including Thawte, VeriSign, Entrust and Comodog. BlackBerry, which holds more than 100 ECC patents, uses it extensively. But, certificate authorities must make it easy to buy an ECC certificate, the researchers said. Certificate authorities need to update documentation and foster standards to avoid confusion.

Getting The Word Out: A Call To Software Developers

The security researchers said software developers need to call the function that supports ECC in their products, rather than the current method of calling the function that supports RSA. ECC is seen as more efficient and secure than the first-generation public key techniques. Software makers also need to support TLS 1.2 on the endpoints. New cryptosystems should support ECC, and old systems can be wrapped to support the newer cryptography. Some current implementations that support ECC are also poorly designed, causing some software to default to the RSA algorithm. The researchers are calling on operating system vendors to make ECC easier to use, with updated documentation to push developers away from RSA.

What Should Businesses Do?

Companies should survey their exposure, according to the security researchers. To prepare for an eventual crack of the encryption algorithm, use ECC certificates where possible. Businesses need to urge vendors to support TLS version 1.2 and ECC, the researchers said. They need to turn on support of the Elliptic Curve Ephemeral Diffie-Hellman algorithm that provides forward secrecy, a key-agreement protocol that can shield data from full disclosure if a private key is broken in the future.

Patent Holders Must License ECC

ECC's intellectual property has been cited as the main factor in slowing or stalling adoption, the researchers said. Currently, Certicom, a subsidiary of BlackBerry, holds more than 100 patents related to elliptic curves and public key cryptography. Researchers at security firm IOActive are urging BlackBerry to freely license implementations of Suite B. Suite B currently supports the Elliptic Curve Diffie-Hellman protocol. The National Security Agency purchased a license that covers all of its intellectual property in a restricted field of use and can be sublicensed to vendors building products that support ECC.