Welcome!

Java IoT Authors: Pat Romanski, Carmen Gonzalez, Elizabeth White, Liz McMillan, Yeshim Deniz

Related Topics: Cloud Security, Java IoT, Microservices Expo, Containers Expo Blog, Agile Computing, SDN Journal

Cloud Security: Article

Time to Ditch Cryptographic Keys?

Will keyless signatures overtake PKI as the wave of the future? Governments, flying drones, and big telecom all say so

What is the most secure way to authenticate electronic data? Until recently, many technical people would have answered ‘cryptographic keys' without blinking. But recent headline events - and a ‘biggie' last year - have raised serious doubts about the ability of cryptographic keys to protect vital government and corporate data.

Here are two examples from February that should make CIOs, CTOs and CSOs tremble in their boardrooms: McAfee revoking keys for signing apps on the Apple store; and stolen keys from Bit9 being used to sign malware.

In the McAfee case, a McAfee administrator revoked (by mistake) the digital key for certifying desktop apps that run on Apple's OS X, thereby creating serious problems for customers who wanted to install or upgrade Mac antivirus products.

The original Arstechnica article (McAfee revoking keys) noted that the administrator intended to revoke his individual user key, but "instead revoked the code-signing keys Apple uses to help keep the Mac ecosystem free of malware."

The bottom line: the mistake left customers with no safe options to install or upgrade their programs. The big takeaway: this episode paints a graphic picture of the challenges of administering the digital certificates at the heart of public key infrastructures (PKI) - certificates used to validate software and websites, and to encrypt email and other forms of Internet communication.

Also in February, a private key that security firm Bit9 uses to certify software was stolen by crooks and used to put a trusted seal of approval on malware that infected a few Bit9 customers.

However, those sorry episodes pale in comparison to a massive security breach last year when hackers used a stolen master private key from RSA to attack Lockheed Martin (RSA/EMC losing its master private key.) Lockheed, a major defense contractor to the U.S. government, makes the F-16, F-22 and F-35 fighter aircraft, the Aegis naval combat system, and the THAAD missile defense.

Sources close to Lockheed said compromised RSA SecurID tokens - USB keychain dongles that generate strings of numbers for cryptography purposes - played a pivotal role in the Lockheed Martin hack.

Hackers apparently entered Lockheed Martin's servers and accessed the company's virtual private network (VPN). The VPN allows employees to connect over virtually any public network to the company's primary servers, using information streams secured by cryptography.

With the RSA tokens hacked, those supposedly secure VPN connections were compromised.

Predictably, Lockheed said it detected the attack almost immediately, repulsed it quickly, and that the risk was minimal. The company also claimed that no customer, program or personal employee data was compromised.

All of the above examples not only undermine the security of using cryptographic keys but leave people wondering whether there is a better way to authenticate.

The better way - Keyless Signature Infrastructure (KSI) - has been around since 2007, when it was invented by scientists in Estonia. KSI generates digital signatures for electronic data on a massive scale but uses only cryptographic hash functions, meaning there are no keys to be compromised or trusted humans in sight.

Some six years ago, Estonian scientists at Tallinn Technical University posed the question: How can you rely on electronic data if you assume that your entire network has been compromised and nobody - not even the system administrators within your own organization - can be trusted?

KSI, the fruit of those scientists' work, is used by governments and companies around the world. It helps them to authenticate electronic data generated from the Smart Grid, the Connected Car, and networked routers and machines (either virtual or physical) - basically any type of electronic data. In November, China Telecom, the largest fixed line telecommunications service provider in China, became a keyless signature service provider via its Tianyi 3G platform. Most recently Japan Drones, a developer of custom software for miniature Unmanned Aerial Vehicles (UAVs) announced it was using keyless signatures for its drone security. The U.S. military could use the good PR, given publicity over a white hat hacking scheme done by University of Texas students as reported in June by The Huffington Post, which went as far as to say, "Turns out it's not too difficult to hack a drone."

Chaozong Chen, general manager of Ningbo CA, the Certificate Authority for the city of Ningbo in Zhejiang province in China, said, "KSI's unique features such as independency of verification, intrinsic time binding for data, universal accessibility cross platforms and lack of keys allow us to provide functions and values where traditional public key infrastructure (PKI) is limited. The future proof from quantum computing is of course a major benefit."

Here's another example of KSI in action: every payment within the Estonian banking system comes with a keyless signature, ensuring that insiders cannot modify transactions intent on fraud.

In addition, the Estonian government has embarked on a huge project to integrate KSI technology into the rsyslog utility - a project that will enable every system event across all government networks to be authenticated by time, data integrity and server identity. (Note: rsylog is an open source utility used on Unix and Unix-like computers for forwarding log messages in an IP network.)

Further demonstrating Estonia's confidence in KSI, the Estonian Government's Centre of Registers and Information Systems (RIK) recently embraced the technology.

RIK is using keyless signature technology for validating the authenticity of documents that it is digitizing from the archives of the Succession Register and Chamber of Notaries.

Using keyless signature infrastructure, the authenticity of all the records is periodically verified, the re-verification happens automatically, meaning that the information about the integrity of the stored records is always up to date and any breaches create an alert immediately.

As KSI has proven itself for years in various government and commercial entities, the time is ripe to consider it the logical successor to cryptographic keys, which are starting to look outdated and very vulnerable.

"While our PKI based solutions have been widely adopted, we see a growing need to prove data integrity and time on a massive scale, with cases where customer identification registration is unpractical and less important, such as electronic receipts for cash based transactions," said Chaozong Chen. "These are where KSI can help. It is strategically important for us to start integrating KSI with our successful PKI solutions and this will help us maintain our leadership in the field."

More Stories By Herman Mehling

Herman Mehling has been an IT writer and consultant for more than 25 years. He has written thousands of articles for leading trade magazines and websites. His work has appeared in such publications as Computer Reseller News, eWeek, Forbes, Network World and InformationWeek. In the ’80s and ’90s, he worked as a PR executive at many San Francisco Bay Area high-tech agencies, including Niehaus Ryan Haller, which helped to launch Yahoo! and to re-cast the image of Apple as an Internet player. He was a staff editor and reporter at Computer Reseller News for many years.

Comments (0)

Share your thoughts on this story.

Add your comment
You must be signed in to add a comment. Sign-in | Register

In accordance with our Comment Policy, we encourage comments that are on topic, relevant and to-the-point. We will remove comments that include profanity, personal attacks, racial slurs, threats of violence, or other inappropriate material that violates our Terms and Conditions, and will block users who make repeated violations. We ask all readers to expect diversity of opinion and to treat one another with dignity and respect.


@ThingsExpo Stories
The IoT is changing the way enterprises conduct business. In his session at @ThingsExpo, Eric Hoffman, Vice President at EastBanc Technologies, discuss how businesses can gain an edge over competitors by empowering consumers to take control through IoT. We'll cite examples such as a Washington, D.C.-based sports club that leveraged IoT and the cloud to develop a comprehensive booking system. He'll also highlight how IoT can revitalize and restore outdated business models, making them profitable...
The IoTs will challenge the status quo of how IT and development organizations operate. Or will it? Certainly the fog layer of IoT requires special insights about data ontology, security and transactional integrity. But the developmental challenges are the same: People, Process and Platform. In his session at @ThingsExpo, Craig Sproule, CEO of Metavine, will demonstrate how to move beyond today's coding paradigm and share the must-have mindsets for removing complexity from the development proc...
Customer experience has become a competitive differentiator for companies, and it’s imperative that brands seamlessly connect the customer journey across all platforms. With the continued explosion of IoT, join us for a look at how to build a winning digital foundation in the connected era – today and in the future. In his session at @ThingsExpo, Chris Nguyen, Group Product Marketing Manager at Adobe, will discuss how to successfully leverage mobile, rapidly deploy content, capture real-time d...
SYS-CON Events announced today that ContentMX, the marketing technology and services company with a singular mission to increase engagement and drive more conversations for enterprise, channel and SMB technology marketers, has been named “Sponsor & Exhibitor Lounge Sponsor” of SYS-CON's 18th Cloud Expo, which will take place on June 7-9, 2016, at the Javits Center in New York City, New York. “CloudExpo is a great opportunity to start a conversation with new prospects, but what happens after the...
What a difference a year makes. Organizations aren’t just talking about IoT possibilities, it is now baked into their core business strategy. With IoT, billions of devices generating data from different companies on different networks around the globe need to interact. From efficiency to better customer insights to completely new business models, IoT will turn traditional business models upside down. In the new customer-centric age, the key to success is delivering critical services and apps wit...
Join us at Cloud Expo | @ThingsExpo 2016 – June 7-9 at the Javits Center in New York City and November 1-3 at the Santa Clara Convention Center in Santa Clara, CA – and deliver your unique message in a way that is striking and unforgettable by taking advantage of SYS-CON's unmatched high-impact, result-driven event / media packages.
In his keynote at 18th Cloud Expo, Andrew Keys, Co-Founder of ConsenSys Enterprise, will provide an overview of the evolution of the Internet and the Database and the future of their combination – the Blockchain. Andrew Keys is Co-Founder of ConsenSys Enterprise. He comes to ConsenSys Enterprise with capital markets, technology and entrepreneurial experience. Previously, he worked for UBS investment bank in equities analysis. Later, he was responsible for the creation and distribution of life ...
SYS-CON Events announced today that BMC Software has been named "Siver Sponsor" of SYS-CON's 18th Cloud Expo, which will take place on June 7-9, 2015 at the Javits Center in New York, New York. BMC is a global leader in innovative software solutions that help businesses transform into digital enterprises for the ultimate competitive advantage. BMC Digital Enterprise Management is a set of innovative IT solutions designed to make digital business fast, seamless, and optimized from mainframe to mo...
SYS-CON Events announced today that MobiDev will exhibit at SYS-CON's 18th International Cloud Expo®, which will take place on June 7-9, 2016, at the Javits Center in New York City, NY. MobiDev is a software company that develops and delivers turn-key mobile apps, websites, web services, and complex software systems for startups and enterprises. Since 2009 it has grown from a small group of passionate engineers and business managers to a full-scale mobile software company with over 200 develope...
SoftLayer operates a global cloud infrastructure platform built for Internet scale. With a global footprint of data centers and network points of presence, SoftLayer provides infrastructure as a service to leading-edge customers ranging from Web startups to global enterprises. SoftLayer's modular architecture, full-featured API, and sophisticated automation provide unparalleled performance and control. Its flexible unified platform seamlessly spans physical and virtual devices linked via a world...
SYS-CON Events announced today that Alert Logic, Inc., the leading provider of Security-as-a-Service solutions for the cloud, will exhibit at SYS-CON's 18th International Cloud Expo®, which will take place on June 7-9, 2016, at the Javits Center in New York City, NY. Alert Logic, Inc., provides Security-as-a-Service for on-premises, cloud, and hybrid infrastructures, delivering deep security insight and continuous protection for customers at a lower cost than traditional security solutions. Ful...
Companies can harness IoT and predictive analytics to sustain business continuity; predict and manage site performance during emergencies; minimize expensive reactive maintenance; and forecast equipment and maintenance budgets and expenditures. Providing cost-effective, uninterrupted service is challenging, particularly for organizations with geographically dispersed operations.
As cloud and storage projections continue to rise, the number of organizations moving to the cloud is escalating and it is clear cloud storage is here to stay. However, is it secure? Data is the lifeblood for government entities, countries, cloud service providers and enterprises alike and losing or exposing that data can have disastrous results. There are new concepts for data storage on the horizon that will deliver secure solutions for storing and moving sensitive data around the world. ...
SYS-CON Events announced today TechTarget has been named “Media Sponsor” of SYS-CON's 18th International Cloud Expo, which will take place on June 7–9, 2016, at the Javits Center in New York City, NY, and the 19th International Cloud Expo, which will take place on November 1–3, 2016, at the Santa Clara Convention Center in Santa Clara, CA. TechTarget is the Web’s leading destination for serious technology buyers researching and making enterprise technology decisions. Its extensive global networ...
SYS-CON Events announced today that Commvault, a global leader in enterprise data protection and information management, has been named “Bronze Sponsor” of SYS-CON's 18th International Cloud Expo, which will take place on June 7–9, 2016, at the Javits Center in New York City, NY, and the 19th International Cloud Expo, which will take place on November 1–3, 2016, at the Santa Clara Convention Center in Santa Clara, CA. Commvault is a leading provider of data protection and information management...
SYS-CON Events announced today that MangoApps will exhibit at SYS-CON's 18th International Cloud Expo®, which will take place on June 7-9, 2016, at the Javits Center in New York City, NY. MangoApps provides modern company intranets and team collaboration software, allowing workers to stay connected and productive from anywhere in the world and from any device. For more information, please visit https://www.mangoapps.com/.
The essence of data analysis involves setting up data pipelines that consist of several operations that are chained together – starting from data collection, data quality checks, data integration, data analysis and data visualization (including the setting up of interaction paths in that visualization). In our opinion, the challenges stem from the technology diversity at each stage of the data pipeline as well as the lack of process around the analysis.
Designing IoT applications is complex, but deploying them in a scalable fashion is even more complex. A scalable, API first IaaS cloud is a good start, but in order to understand the various components specific to deploying IoT applications, one needs to understand the architecture of these applications and figure out how to scale these components independently. In his session at @ThingsExpo, Nara Rajagopalan is CEO of Accelerite, will discuss the fundamental architecture of IoT applications, ...
SYS-CON Events announced today that Tintri Inc., a leading producer of VM-aware storage (VAS) for virtualization and cloud environments, will exhibit at the 18th International CloudExpo®, which will take place on June 7-9, 2016, at the Javits Center in New York City, New York, and the 19th International Cloud Expo, which will take place on November 1–3, 2016, at the Santa Clara Convention Center in Santa Clara, CA.
In his session at 18th Cloud Expo, Bruce Swann, Senior Product Marketing Manager at Adobe, will discuss how the Adobe Marketing Cloud can help marketers embrace opportunities for personalized, relevant and real-time customer engagement across offline (direct mail, point of sale, call center) and digital (email, website, SMS, mobile apps, social networks, connected objects). Bruce Swann has more than 15 years of experience working with digital marketing disciplines like web analytics, social med...