DOCSLIB.ORG

Advanced Trust Services Facilitated by the Industrial-Scale Blockchain Technology

Total Page：16

File Type：pdf, Size：1020Kb

Download full-text PDF Read full-text
Advanced Trust Services Facilitated by the Industrial-Scale Blockchain Technology Advanced trust services facilitated by the Industrial-Scale Blockchain technology Risto Laanoja Security Engineer Outline • Guardtime • KSI • What it does • How it works • Trust assumptions • KSI / blockchain applicability in providing eIDAS trusted services • Standardization challenges 2 Advanced trust services facilitated by the Industrial-Scale Blockchain technology 1. Company Overview 3 Advanced trust services facilitated by the Industrial-Scale Blockchain technology Introducing Guardtime Who we are: • Systems engineering company, fundamental and applied research into cryptographic applications • Founded in 2007 in Tallinn, Estonia • Offices in Amsterdam, Palo Alto, Tallinn and Tartu • 71 people 4 Advanced trust services facilitated by the Industrial-Scale Blockchain technology 2. KSI Technology An Industrial Scale Blockchain 5 Advanced trust services facilitated by the Industrial-Scale Blockchain technology Keyless Signature Infrastructure (KSI): An Industrial Scale Blockchain KSI enables real-time Scalability Settlement time massive-scale data One of the most significant In contrast to the widely distributed integrity validation. challenges with traditional crypto-currency approach, the blockchain approaches is scalability number of participants in KSI The technology – they scale at O(n) complexity i.e. blockchain distributed consensus overcomes two major they grow linearly with the number protocol is limited. By limiting the weaknesses of traditional of transactions. number of participants it becomes possible to achieve consensus In contrast the KSI blockchain blockchains: synchronously, eliminating the need scales at O(t) complexity – it grows for Proof of Work and ensuring linearly with time and independently settlement can occur within one from the number of transactions. second. 6 Advanced trust services facilitated by the Industrial-Scale Blockchain technology KSI Signature The KSI Signature is a Upon verification, KSI Signature piece of meta-data which allows to assert: enables the properties of • Signing time the data to be verified. • Signing entity • Data integrity KSI uses only hash-function based cryptography to make these assertions without relying on trust. 7 Advanced trust services facilitated by the Industrial-Scale Blockchain technology KSI Properties Open Verification: For KSI Signature Long-term validity: Proof is based only on KSI Signatures provide verification, one needs to trust publicly the properties of hash functions and does proof of time and integrity available information only - verification does not expire. not rely on trusted insiders or security of of electronic data as well key-stores. Carrier Grade: The KSI system architecture is able to deliver 99.999% availability. as attribution of origin. Massively scalable: KSI performance is practically independent of the number of Offline: The KSI system does not require The KSI System has clients or amount of data signed / verified. network connectivity for verification. been in production use Portable: Data can be verified even after Post-Quantum: The proof stays valid even crossing geographical or organizational assuming functioning quantum computers, since 2007. boundaries or service providers. i.e. does not rely on traditional asymmetric or elliptic curve cryptography. Supports Real-time Protection: KSI Signature verification requires milliseconds, Absolute Privacy: KSI does not ingest any which allows clients to perform continuous customer data; data never leaves the monitoring and tamper detection. customer premises. 8 Advanced trust services facilitated by the Industrial-Scale Blockchain technology Introducing the Hash Calendar Blockchain A global asynchronous Aggregation Calendar Blockchain Tree summarizing all submitted Hash Values is built every second and destroyed after all clients have received their hash chains. The same tree is never rebuilt. Global Only the Global Root Hash Values of Aggregation the Aggregation Tree are kept in a Tree public Calendar Blockchain. The Calendar Blockchain has exactly one entry for each second since 1970-01-01 00:00:00 UTC Hash Values Hash Chains 9 Advanced trust services facilitated by the Industrial-Scale Blockchain technology KSI Signatures Are Proof of Data Integrity HASH VALUE Calendar Integrity is verified by recreating the hash value in the calendar using the aggregation hash chain. AGGREGATION HASH CHAIN To connect to a widely witnessed physical artifact, the publication code can be recreated using the calendar hash chain. HASH VALUE The widely witnessed root hash cannot be recreated from altered input data if the hash function used is second pre-image resistant. AGGREGATION HASH CHAIN CALENDAR HASH CHAIN PUBLICATION CODE 10 Advanced trust services facilitated by the Industrial-Scale Blockchain technology KSI Signatures Are PUBLICATION CODE Proof of Signing Time Signing time is encoded into the shape of the CALENDAR ORDER BIT ORDERBIT HASH VALUE HASHVALUE calendar hash chain. 1 The order bits encode the path 0 from the root to the leaf and prove the time offset of the leaf from the 1 publication time P of the root hash value if the hash function used is 0 second pre-image resistant. THERE IS NO TRUSTED TIME SOURCE Time = P - 10 11 Advanced trust services facilitated by the Industrial-Scale Blockchain technology Introducing Identity HASH TREE OF THE PARENT AGGREGATION SERVER Identity: the result of an authentication request (whether PKI, LDAP, Biometric etc) as an identity tag in the KSI distributed hash tree. A B This works for machines. PARENT SERVER IDENTITY TAG IDENTITY TAG For a true digital signature system for humans we need non- Root hash request from Root hash request from server “A” server “B” repudiation. Proposal: BLT CHILD SERVER CHILD SERVER signature scheme. “A” “B” 12 Advanced trust services facilitated by the Industrial-Scale Blockchain technology 3. KSI in eIDAS context 13 Advanced trust services facilitated by the Industrial-Scale Blockchain technology KSI and eIDAS trust services Signature / seal: - Identification, RA work are hard! Registered - Employ PKI authentication or external identity delivery provider ? - Cryptomathic and other vendors: no secure element necessary? Electronic KSI blockchain - Verifying user certificates at signing time signature applicability simplifies the validation data Electronic Time stamping: natural fit, “post quantum Electronic indemnification” time stamp seal Preservation service: Preservation - Long term integrity guarantee service - No insider threat Registered delivery: proof of sending, receiving, time, integrity 14 Advanced trust services facilitated by the Industrial-Scale Blockchain technology Interoperability Relying party protection: Independent verification Interoperability: hard question • There is a copy of calendar blockchain in each Gateway • Notary service to translate the formats? appliance, public information • Validation Authority (privacy?) • “Root of trust” is publication printed in globally available newspaper Reality of business use: • It is possible to create self-contained “extended” signature token for true offline verifiability • Server-side processing, "apps", fixed workflow. • No service provider help necessary • Preservation: usually closed systems. 15 Advanced trust services facilitated by the Industrial-Scale Blockchain technology 4. The Message Standardization challenge for non-traditional technology 16 Advanced trust services facilitated by the Industrial-Scale Blockchain technology The message Risk-based accreditation process Standards should be technology neutral. Freedom to create profiles, use alternative (future) algorithms and protocols. • Trust services are based on different technologies with very different trust assumptions. Qualification • Example: XAdES – locks time-stamp to RFC 3161 format. procedures must be based on actual risk, not Signature field has algorithm ID though. baseline of measures/features. • Example: evolution of Guardtime signature token: started with • Example: time-stamping service provider audit the profiling of RFC 3161: used it as a container, specified our included ETSI TS 102 023 (Policy requirements for own signature format with registered OID inside. Positive: few time-stamping authorities) conformance check; fine, insignificant applications were able to time-stamp data (no we found some keys with formal management verification). Switched to proprietary format: 40% smaller, “local procedures and HSM protection. aggregation” for very high-volume local data signing. • Security primitives might not be plug-in replacements. Example: many post-quantum secure schemes must keep state (e.g. spent keys), KSI needs service URIs. 17 Advanced trust services facilitated by the Industrial-Scale Blockchain technology Thank you Risto Laanoja [email protected] .
Load more

Recommended publications
  • Executing Large Scale Processes in a Blockchain
    The current issue and full text archive of this journal is available on Emerald Insight at: www.emeraldinsight.com/2514-4774.htm JCMS 2,2 Executing large-scale processes in a blockchain Mahalingam Ramkumar Department of Computer Science and Engineering, Mississippi State University, 106 Starkville, Mississippi, USA Received 16 May 2018 Revised 16 May 2018 Abstract Accepted 1 September 2018 Purpose – The purpose of this paper is to examine the blockchain as a trusted computing platform. Understanding the strengths and limitations of this platform is essential to execute large-scale real-world applications in blockchains. Design/methodology/approach – This paper proposes several modifications to conventional blockchain networks to improve the scale and scope of applications. Findings – Simple modifications to cryptographic protocols for constructing blockchain ledgers, and digital signatures for authentication of transactions, are sufficient to realize a scalable blockchain platform. Originality/value – The original contributions of this paper are concrete steps to overcome limitations of current blockchain networks. Keywords Cryptography, Blockchain, Scalability, Transactions, Blockchain networks Paper type Research paper 1. Introduction A blockchain broadcast network (Bozic et al., 2016; Croman et al., 2016; Nakamoto, 2008; Wood, 2014) is a mechanism for creating a distributed, tamper-proof, append-only ledger. Every participant in the broadcast network maintains a copy, or some representation, of the ledger. Ledger entries are made by consensus on the states of a process “executed” on the blockchain. As an example, in the Bitcoin (Nakamoto, 2008) process: (1) Bitcoin transactions transfer Bitcoins from a wallet to one or more other wallets. (2) Bitcoins created by “mining” are added to the miner’s wallet.
    [Show full text]
  • Keyless Signature Infrastructure for Digital India's Security
    ISSN (Online) 2456 -1304 International Journal of Science, Engineering and Management (IJSEM) Vol 4, Issue 10, October 2019 Keyless Signature Infrastructure for Digital India’s Security [1] Mridul Sharma, [2]Rupali Sharma [1][2] University Institute of Engineering, Rayat Bahra University, Mohali, Punjab, India Abstract— In the making of new Digital India there are lots of threats which are there in the path of this dream. Acts of data breach of AADHAAR and Bank Accounts due to the lack of security in our digital services are common but the world is now, moving towards digital era so to be with the world in this digital transformation we must work on our security enhancement to provide a secure platform to government organisations. To serve the three aspects of security that is confidentiality, integrity, and availability of data we need an infrastructure that ensures all these. The Blockchain-Based KSI is the new technology which will support the government of India to achieve its goal of ensuring secure digital Services. It will help the government in providing strong authentication through digital signatures, and will also give the citizens a trust that their PII data is secure and confidential so that they can use these digital services for their all daily work. On the inspiration from Estonia where all their government services are digital in a way such that every government work from issuing a birth certificate to passport verification all these tasks are done digitally. This paper is made to help India in the implementation of this powerful Infrastructure for the digital governmental services providing ease to people and bureaucrats.
    [Show full text]
  • Keyless Signatures' Infrastructure
    Keyless Signatures' Infrastructure: How to Build Global Distributed Hash-Trees Ahto Buldas1;2, Andres Kroonmaa1, and Risto Laanoja1;2 1 GuardTime AS, Tammsaare tee 60, 11316 Tallinn, Estonia. 2 Tallinn University of Technology, Raja 15, 12618 Tallinn, Estonia. Abstract. Keyless Signatures Infrastructure (KSI) is a globally dis- tributed system for providing time-stamping and server-supported digi- tal signature services. Global per-second hash trees are created and their root hash values published. We discuss some service quality issues that arise in practical implementation of the service and present solutions for avoiding single points of failure and guaranteeing a service with reason- able and stable delay. Guardtime AS has been operating a KSI Infras- tructure for 5 years. We summarize how the KSI Infrastructure is built, and the lessons learned during the operational period of the service. 1 Introduction Keyless signatures are an alternative solution to traditional PKI signatures. The word keyless does not mean that no cryptographic keys are used during the signature creation. Keys are still necessary for authentication, but the signatures can be reliably verified without assuming continued secrecy of the keys. Keyless signatures are not vulnerable to key compromise and hence provide a solution to the long-term validity of digital signatures. The traditional PKI signatures may be protected by timestamps, but as long as the time-stamping technology itself is PKI-based, the problem of key compromise is still not solved completely. Keyless signatures are a solution to this problem. In a keyless signature system, the functions of signer identification and of evidence integrity pro- tection are separated and delegated to cryptographic tools suitable for those functions.
    [Show full text]
  • Block Chain Based KSI for Delivering Governmental Services in Democratic Nations
    International Journal of Recent Engineering Research and Development (IJRERD) ISSN: 2455-8761 www.ijrerd.com || Volume 03 – Issue 07 || July 2018 || PP. 15-24 Block chain based KSI for delivering governmental services in democratic nations Vedna Sharma Junior Research Fellow Institute of Technology Management (Defense Research & Development Organization) Landour Cantt. Mussoorie Uttarakhand (India) Abstract: There are various challenges that government organizations are addressing naturally characterized by transparency and security in government records, improved confidentiality and integrity of data, secure transactions and information security. Government has to be choosing the design that best fits for balancing security and central control with the convenience and opportunity of sharing information or data between organizations and individuals. Government Organizations are also investing in digital technologies to support their goals. Significant investment in technology and efforts has yielded great progress in growth, efficiency & demand of organizations. Block chain stands out as a technology in which various organizations see potential to solve these challenges by implementing strong authentication, data encryption and digital signature. Keywords: Blockchain, Digital Signature, Hashing, public key Infrastructure, Keyless Signature Infrastructure and Governmental Services 1. Introduction Blockchain is decentralized technology that is built on the model of offering security and trust. Blockchain technology have the potential to help governments to collect taxes, deliver benefits, issue passports, record land registries, assure the supply chain of goods and generally ensure the integrity of government records and services. Blockchain technology can simplify the management of trusted information, making it easier for government agencies to access and use critical public-sector data while maintaining the security of this information.
    [Show full text]
  • Ingham County News; Mason, Mich
    urcr. Rep. Ralph Young, East Lan· On the bonrd of directors are sing, m!lde the. dedicatory ad· K G. Brow.n, Glen Watkins, Dorr dress. Howard Seibert, president Ecl;hart, Fred L. JOrcher, Mrs. of the hospital board, presented Mary 0, Blacl> and Wilfred Jew· the hospital .to the community. ctt from the Ingl1am county Mayor Paul D. Richat•ds of Ma· board of supervisors and Hulett son accepted it on behalf of the and Otto Hartig. · community. · Hartig stepped down from the Y,oung, former coach and ath· pl·esident's job ll1ls year. · letic director at Michigan State, · Spcnny and Davis will both go ct·edited the· hospital to com· alonrr with the Mason delegation munity teamwork and sacrifice. to the, state mectii1g slated for - Detroit in .January to sign 1959! Seibert told of the devotion of - Othet· who came from afat• tri fair attractions. · hundreds of men and women who attend the dedication included 3 had a part In providing the funds men from Wyeth Laboratories and maldng and carrying out Ine: They were George Pattison, plans for the hospital. Mayor Cleveland, divisional sales man­ Richards likened the dedication of the hospital to the birth of a agel", and Robert Messetlgcr,­ Council Looks child, pointing out that 'the com· Flint, and Thomas Newburgcr, munity has an expanded respon- Toledo, district sale~ managers. , If horses do any wondering, sibillty to maintain the hospital. A, G. Benson, assistant vice­ Bonnie is probably wondering For Big Gift Earlier resldents built school president, and' Milbert Anderson;-­ about her master, Ralph Hink· houses and churches, he declared, assistant cashier, of the National ley.
    [Show full text]
  • Cloud Service Provider Case
    TALLINN UNIVERSITY OF TECHNOLOGY Faculty of Information Technology Institute of Informatics Chair of Information Systems Analysis of Digital Integrity: Cloud Service Provider Case Master’s Thesis Student: Oskar Poola Student code: 132245IVGM Supervisor: prof. Ahto Buldas Tallinn 2015 I hereby declare that this thesis, which is the result of my work as an independent, are presented in Tallinn University of Technology to apply for a Master’s degree, and on that basis have not previously applied for an academic degree. Author Oskar Poola ”.....”..............2015 The work complies with the applicable requirements. Instructor Dr. Ahto Buldas ”.....”..............2015 Approved by ”.....”..............2015 1 Abstract Digital integrity in an adjective that technological solutions can create for a system. Integrity is not as understandable as we think it to be in dif- ferent cases and systems. Different scenarios will be shown and that every situation is different in terms of digital integrity. This work aims to bring to light what integrity means in a certain case such a data owner storing data in a third party cloud storage service provider. The author will provide dif- ferent models to show, what can be the most effective protocol for cloud storage in an insecure world with potentially malicious actors. 2 Abbreviations SLA Service Level Agreement NSA National Security Agency SHA Secure hash algorithm CA Certification Authority TSP Trust Service Provider ISP Internet Service Provider ISKE Estonian Security Management Standard STORK Secure idenTity
    [Show full text]
  • Improved Internet Security Protocols Using Cryptographic One-Way Hash Chains" (2014)
    University of Central Florida STARS Electronic Theses and Dissertations, 2004-2019 2014 Improved Internet Security Protocols Using Cryptographic One- Way Hash Chains Amerah Alabrah University of Central Florida Part of the Computer Sciences Commons, and the Engineering Commons Find similar works at: https://stars.library.ucf.edu/etd University of Central Florida Libraries http://library.ucf.edu This Doctoral Dissertation (Open Access) is brought to you for free and open access by STARS. It has been accepted for inclusion in Electronic Theses and Dissertations, 2004-2019 by an authorized administrator of STARS. For more information, please contact [email protected]. STARS Citation Alabrah, Amerah, "Improved Internet Security Protocols Using Cryptographic One-Way Hash Chains" (2014). Electronic Theses and Dissertations, 2004-2019. 4599. https://stars.library.ucf.edu/etd/4599 IMPROVED INTERNET SECURITY PROTOCOLS USING CRYPTOGRAPHIC ONE-WAY HASH CHAINS by AMERAH ABDULRAHMAN ALABRAH B.S. King Saud University, 2006 M.S. Colorado State University, 2008 A dissertation submitted in partial fulfillment of the requirements for the degree of Doctor of Philosophy in the Department of Electrical Engineering and Computer Science in the College of Engineering and Computer Science at the University of Central Florida Orlando, Florida Fall Term 2014 Major Professor: Mostafa Bassiouni © 2014 Amerah Alabrah ii ABSTRACT In this dissertation, new approaches that utilize the one-way cryptographic hash functions in designing improved network security protocols are investigated. The proposed approaches are designed to be scalable and easy to implement in modern technology. The first contribution explores session cookies with emphasis on the threat of session hijacking attacks resulting from session cookie theft or sniffing.
    [Show full text]
  • Enhancing the Security Through the Usage of Merkle Tree and Timestamp in Peerto Peer Messaging
    International Journal of Pure and Applied Mathematics Volume 119 No. 7 2018, 13-20 ISSN: 1311-8080 (printed version); ISSN: 1314-3395 (on-line version) url: http://www.ijpam.eu Special Issue ijpam.eu Enhancing the security through the usage of merkle tree and timestamp in peerto peer messaging Katyayani Sharma Dr. VairamuthuS* School of Computer Science and Engineering Associate Professor VIT University, Vellore Campus School of Computer Science and Engineering VIT Tamil Nadu, India University, Vellore Campus [email protected] Tamil Nadu, India [email protected] Abstract— One of the critical aspects of resource sharing The first distributed type of Merkle‟s authentication tree among p2p clients is security. Common security issues like trust, was Distributed Merkle Tree.This has provided authentication privacy and message integrity still extends to peers and affecting framework for decentralized systems with little trust the reliability of services over P2P. In this paper, we propose a presumptions.In order to detect the infected content peer to time stamped algorithm of merkle tree based on block chain peer streaming peer protocol (PPSPP) came into effect with concepts which provides an authentication tree that is secure against pre-image attack. The proposed algorithm is tested using the use of merkle hash tree with protection of integrity [10]. python and verified with different hash values that are generated Here we have proposed a more secure distributed merkle tree for secure messaging. hashing algorithm with the usage of timestamps to provide integrity to the data shared among the peers in messaging.The Keywords— timestamped algorithm, merkle tree , p2p clients.
    [Show full text]
  • Keyless Signature Infrastructure® (KSI™) Technology Introduction
    Guardtime Federal, LLC Proprietary Keyless Signature Infrastructure® (KSI™) Technology An Introduction to KSI Blockchain Technology and Its Benefits Executive Summary The use of blockchain technology to provide digital integrity has exploded in financial applications. Widely proliferated blockchain technology consumes significant storage, communications bandwidth and time for each transaction, whereas Guardtime-Federal, LLC provides Keyless Signature Infrastructure (KSI) that is a blockchain designed for security, scalability and speed. Through the properties of verifiable authenticity, identity of the client, and non-global positioning system-based non-spoofable time; KSI provides provenance, integrity and identity associated with digital assets. This implementation consumes far less storage and bandwidth than widely proliferated blockchain technology and can provide the above defined attributes for thousands of files a second scalable to billions. KSI cryptographically links data assets with immutable properties provided by the KSI infrastructure, and implemented in a KSI signature. KSI promises this additional integrity and authenticity in newly created or already existing data whether on the network, in embedded systems or traversing the cloud. Customers who implement KSI can prove their current and future information systems are in a truthful state and meet business and mission needs with increased security. KSI was designed with considerations for security, scalability, and speed to meet the requirements for a host of complex applications. By integrating KSI into healthcare systems, irrespective of where a digital asset is transmitted or stored, every component, configuration, and digital health record/entry generated by humans or machines can be verified independently in real-time, independent of trusted administrators. KSI provides a truth-based system wherein the need for trust can be completely eliminated.
    [Show full text]
  • Keyless Signatures' Infrastructure
    Keyless Signatures' Infrastructure: How to Build Global Distributed Hash-Trees Ahto Buldas1;2, Andres Kroonmaa1, and Risto Laanoja1;2 1 Guardtime AS, Tammsaare tee 60, 11316 Tallinn, Estonia. 2 Tallinn University of Technology, Raja 15, 12618 Tallinn, Estonia. Abstract. Keyless Signatures Infrastructure (KSI) is a globally distributed system for providing time- stamping and server-supported digital signature services. Global per-second hash trees are created and their root hash values published. We discuss some service quality issues that arise in practical implementation of the service and present solutions for avoiding single points of failure and guaranteeing a service with reasonable and stable delay. Guardtime AS has been operating a KSI Infrastructure for 5 years. We summarize how the KSI Infrastructure is built|and the lessons learned during the operational period of the service. 1 Introduction Keyless signatures are an alternative solution to traditional PKI signatures. The word keyless does not mean that no cryptographic keys are used during the signature creation. Keys are still necessary for authentication, but the signatures can be reliably verified without assuming continued secrecy of the keys. Keyless signatures are not vulnerable to key compromise and thus provide a solution to the problem of long-term validity of digital signatures. The traditional PKI signatures may be protected by timestamps, but as long as the time-stamping technology itself is PKI-based, the problem of key compromise is still not solved. In a keyless signature system, the functions of signer identification—and of evidence integrity protection| are separated and delegated to cryptographic tools suitable for those functions.
    [Show full text]
  • Efficient Quantum-Immune Keyless Signatures with Identity
    Efficient Quantum-Immune Keyless Signatures with Identity Ahto Buldas1;2, Risto Laanoja1;2, and Ahto Truu1 1 Guardtime AS, Tammsaare tee 60, 11316 Tallinn, Estonia. [email protected] 2 Tallinn University of Technology, Ehitajate tee 5, 12618 Tallinn, Estonia. Abstract. We show how to extend hash-tree based data signatures to server-assisted personal digital signature schemes. The new signature scheme does not use trapdoor functions and is based solely on cryptographic hash functions and is thereby, considering the current state of knowledge, resistant to quantum computational attacks. In the new scheme, we combine hash-tree data signature (time- stamping) solutions with hash sequence authentication mechanisms. We show how to implement such a scheme in practice. 1 Introduction Electronic signatures use secret keys to protect the integrity of data. Keys can be compromised because of technical failures, human factor, or both threats in combination. In the creation process of electronic signatures, some types of secrets (keys, passwords, etc.) seem unavoidable, because secrets are necessary for authenticating the signer. Even if one uses biometric authentication, there must be a secure channel between the biometric reader and the signature creation device, and even if the signature creation device is physically (and securely) connected to biometric reader, the signature itself must be protected against modification (the integrity of signatures) and traditional solutions use public-key cryptography for that. This means that the validity of signatures depend on assumptions that some private keys are secure. For example, the keys of Public Key Infrastruc- ture (PKI) service providers like the OCSP responders are used to sign the validity statements of public-key certificates.
    [Show full text]
  • Blockchain and PKI
    About & Beyond PKI Blockchain and PKI André Clerc Dipl. Inf.-Ing. FH, CISSP, CAS PM TEMET AG, Zürich February 9, 2017 1 Agenda • Does blockchain secure PKIs in the long- term? – Disadvantages of classic PKIs – Facts about blockchain – Implementation approaches – Advantages and disadvantages of blockchain • What can we do if post quantum cryptography (PQC) is not available yet? • What shall we do if PQC can be used? 09.02.2017 About & Beyond PKI - Blockchain and PKI 2 Blockchain and PKI Introduction • It is assumed that all current PKIs are based on cryptographic procedures which will be broken in the future by quantum computers • It’s even worse: – There are physicists who believe that the breaking of the asymmetric key is more efficient than its creation! • The question arise: – Will new technologies (e.g. blockchain) help us to solve the above mentioned fact or do we have to look for new solutions? 09.02.2017 About & Beyond PKI - Blockchain and PKI 3 Blockchain and PKI Disadvantages of classic PKIs • The identity verification process may be insufficient • An offered guarantees of identity retention may not be strong enough • A certificate authority (CA) may issue unauthorized certificates • The misbehavior of a CA may not be detected – Expect log-based PKIs 09.02.2017 About & Beyond PKI - Blockchain and PKI 4 Blockchain and PKI Disadvantages of classic PKIs • Responding to CA misbehavior takes time and requires manual effort • A CRL check can be based on a outdated list (inadequate update cycle) • A CRL or OCSP check can been disabled
    [Show full text]