Businesses often struggle to secure their online interactions with customers, partners, and different teams within their own company. Enterprise security rests on a few important standards and tools for safe use. Public Key Infrastructure (PKI) is one such tool that’s commonly used by businesses to thwart bad guys and keep enterprise data secure. However, traditional PKI has its limitations – a few being the fact that it still works on - an outdated design and comes with a great deal of complexity for any enterprise to manage. Help is on the way. Blockchain is emerging as the foundation for the next generation applications, delivering a modern foundation for businesses so that their PKI performs more effectively.
When PKI took root, the Internet was a Department of Defense research project, and networked business applications were largely non-existent. Instead, organizations relied on central servers sitting in corporate data centers. Securing transactions meant protecting two sides of static, well understood, centralized connections. PKI was largely created for these static transactions. However, the modern web has evolved and given that everything is based on a client-server and cloud model these days, the old PKI design is having a hard time scaling up to a modern, distributed nature of application interactivity.
How PKI Works
PKI technology relies on a combination of private/public keys, which are 2 altogether different cryptographic keys that are related in such a way that only someone who owns the private key can successfully decrypt any messages that are encrypted by the public key. The most common use case of PKI is when it’s used to protect communication between a client (you, using a browser) and a server (the website you’re visiting). This allows for a safe transit of any and all information between you and the website you’re visiting, protecting the user’s information from eavesdropping by malicious parties. Many browsers will indicate this security of a webpage by a green text or a green bar, alongside the word ‘secure’ with a lock signature on the browser address bar. When your browser gives you this information, it’s basically reading the digital certificate of a page and verifying the safety of the page through that certificate.
These digital certificates create a key pair in order to bind a specific user and/or a device/machine to a certificate. During such pairing, it also verifies the identity of the user and/or machine it’s linking to. This not only ensures that all users and machines within companies or organizations are verified with a digital identity but also works to make connections, websites and applications more secure and less prone to malicious attacks such as Phishing.
The problem with traditional PKI
PKI works because of digital certificates. These certificates are typically issued by a trusted third party, called a certificate authority. These “authorities” are basically businesses that vet the identity of the person or device requesting a certificate and issues one based on certain proof or vetting of the individual or device. This reliance on a central trusted party creates quite a few issues.
First is that the CAs operate without any formal oversight. Sure they are obligated to comply with the CA/B forum (which is an organization run by CA’s and Browsers to set the standards and practices in the CA industry) but how they distribute the keys is their decision and sometimes, they make questionable choices. For instance, in 2015, Google found that Symantec employees were issuing certificates under Google’s name. Symantec claimed that the certificates were created for testing purposes, but such actions open up a complex can of worms. For instance, a third party with a Google certificate could create a domain using the company’s name and launch a phishing attack.
Secondly, because of the ability to impersonate another user or a website, CA systems are well-known targets for hackers. By breaching them, the bad guys gain access to a treasure-trove of personal and financial information traveling on the Internet. DigiNotar was a Dutch CA whose systems were attacked. As a result, so many fraudulent certificates were issued that the firm eventually filed for bankruptcy. Also, because a PKI system is asymmetric, users need access to a public key and recipients must have a private key to decrypt the information. Should a private key become compromised, an attacker gains access to all of the data intended for the recipient. Attackers that gain access to private keys can also eavesdrop and decrypt other interactions as they occur. Fixing the problem is not easy or efficient. If a key is compromised, the CA needs to issue a new one and revoke the old one.
Lastly, corporations can also be sloppy in managing and securing their digital certificates. D-Link is a successful network equipment supplier that mistakenly included private keys in a release of its open source networking firmware. Microprocessor supplier Infineon built a cryptographic library that allowed hackers to compute the private key for any RSA PKI key-pair if they knew the corresponding public key. These are just a few of the many examples that have caused issues due to bad certificate management practices.
Blockchain Eliminates Traditional PKI Vulnerabilities
Application design has changed dramatically since PKI emerged. With cloud and mobility, employees are no longer tied to their desks when they access computer services. They are in a remote office, at home, traveling, or visiting clients. In addition, cloud computing moves information processing out of the enterprise data center and into vendor’s premises. Rather than one homogenous block of code processed in sequential fashion on central systems, information is now divided up and sent to numerous servers residing in multiple locations.
A new foundation is needed to secure such applications because there is no simple, centralized connection from endpoint to server. Blockchain was built to meet today’s business needs. The architecture is based on a distributed database that maintains a continuously growing list of ordered records, called blocks. Since blockchain runs on tens of thousands of computers simultaneously, its design eliminates the risks found with Old School PKI systems.
Blockchain has an open, transparent, secure architecture. Anyone on a blockchain can read all of its contents. This feature eliminates the potential problems stemming from relying on a third party CA’s actions. Companies no longer need to put their trust in CAs that may be duplicitous or error-prone in creating public and private keys. Everything that happens on a blockchain is available to anyone using it. So if a CA issues keys in someone else’s name, that information is seen by everyone on the chain.
Information is time stamped, and a record is created each time an update occurs. Consequently, it is clear who did what when. Altering the source code becomes impossible. A hacker needs to change every item in the blockchain rather than just one record. Also, the metadata in its database is read only, which means that it is impossible to manipulate independently. The solution protects information in a secure distributed fashion and is more in tune with current needs than traditional PKI systems.
What can organizations do now?
We at Remme have been developing a distributed Public Key Infrastructure protocol to PKI-enable apps for the modern web.
Implementation of this new technology is making its first steps with the first partners that share the same vision.
Until the full maturity of a blockchain-based PKI solutions, organizations should pay attention to the following points to secure their PKI.
1. Plan everything, connected with deployment of PKI in advance. It includes planning certificate hierarchy, cryptographic algorithms, validation period etc. Each of the components influences PKI design and the way certificates are used and validated in the future.
2. Create and constantly update the correct policies, standards and procedures, use automation tools. Maintaining order will help reduce human factor and eliminate potential weaknesses.
3. Follow the changes and use up-to-date cryptographic protocols. Evolution of the security protocols has been running for more than a decade. During that time almost every of the protocol or system that protects HTTPS transmissions has been cracked. So it is important to use the latest versions or at least TLS 1.1.
4. It is obvious to use long and strong key. The standard now is 2048 bit keys. 1024 bit key which was commonly used before is already outdated and requires to be changed.
All the data have to be stored and managed securely with help of special purpose tools rather than kept in spreadsheets on the flash or google drive. In addition, it is better to rotate certificates once per particular amount of time, so even if they were stolen or somehow fell into hands of hackers - they will be invalid soon.
5. Constantly monitor the infrastructure and related processes. To be always on the look out it is important to define a list of activities indicating suspicious activity and set up alerts on them. It will help to investigate issues properly.
Protecting information moving along network connections is challenging. PKI emerged as a viable option when applications were processed on centralized servers. As the industry has moved to distributed processing, the need for a new approach became clear. Blockchain offers a sound foundation to build a distributed security solution, Remme is ready to provide the tools so organization take advantage of the technology.
.png)
