ENCRYPTION: MYTHS AND REALITIES

Montreal, September 2013
René W. Vergé, CEO and Co-Founder, VoD2

"Our entire information society rests on a fragile foundation that mathematicians are racing to dismantle."

SUMMARY

The purpose of this white paper is to demonstrate that encryption is not the miracle solution that it is purported to be. The vast majority of stakeholders generally believe that encryption is the ultimate measure that will ensure total security and privacy of your information. This is a myth. Although encryption, when used properly, can often reduce privacy and confidentiality risks, it is often a smoke screen fraught with obstacles and does not address the true problem.

We hope that this white paper will generate further discussion on the subject. What's happening today with the Internet, cloud computing, mobility, social media, global surveillance and the international legal landscape is unprecedented. Whether encrypted or not, your data is frequently misused, accessed by a large number of people and companies, transferred to subcontractors and surrendered to third parties, without your knowledge or consent. In this context, relying solely on encryption to ensure confidentiality and privacy is a risky proposal and, ultimately, a recipe for disaster.

1. Encrypting data does not ensure its integrity or availability.

ENCRYPTION: MYTHS AND REALITIES

Other security measures, therefore, will have to be deployed to address those requirements. For example, backup copies still have to be performed by the user and by the storage and service providers to ensure availability of your data.

Because of the distributed nature of the Internet, more specifically the cloud, these security measures are implemented by different service providers, with varying degree of reliability and effectiveness, in various geographical locations. There is no coordination between all these providers and you have no guarantee whatsoever that these security measures are adequate or working properly. Your information therefore is more vulnerable and at greater risk.

In fact, encryption may even hamper information availability and render it inaccessible permanently if encryption keys are changed, lost or corrupted.

2. Encrypting data may not prevent it from being stolen

Data encryption may not protect your data from theft or disclosure. For example, if Full Disk Encryption is used at the hardware or storage array level, data will only be protected when the disks are powered off. As soon as the disks are powered up by an authorized user, the data on them is decrypted and available to anyone that can connect to the disk volume.

On the other hand, additional protection may be achieved within the network environment, for example if Network Attached Storage (NAS) or Storage Area Networks (SAN) encryption is used, but all other traditional security measures are still required and become critical within the data centers. Furthermore, cloud services often implement encryption within their infrastructure using encrypted volumes, which use the same username/password or private key to encrypt all customer data. Once someone has unlocked it, they have access to all the data on the drive.

Encryption during data transport, using Transport Layer Security (TLS/SSL), on the other hand, protects only at the edge of the cloud, leaving traffic between servers and within data centers exposed. Regardless of which service provider you use or how encryption is deployed, you become dependent on an environment that you do not control. In the cloud, this problem is exacerbated since you often do not know where your data is located or which service provider or other third party has access to it.

3. Encryption in general is very complex

Cryptography is harder than it looks. What Bruce Schneier wrote in 1998 in "Security Pitfalls in Cryptography" still holds today:
"A cryptographic system can only be as strong as the encryption algorithms, digital signature algorithms, one-way hash functions, and message authentication codes it relies on. Break any of them, and you've broken the system. And just as it's possible to build a weak structure using strong materials, it's possible to build a weak cryptographic system using strong algorithms and protocols."

There are many examples of poor implementation of cryptography, including products that have been certified under the well-known NIST FIPS 140-2 standard, numerous cryptographic products developed by the world's largest software company and many other products.

4. Encryption in the Cloud is even more complex

Encryption in the cloud can be implemented at different levels: 1) data-in-motion, including encrypted communication channels between user or organization and service provider, between provider and sub-contractor, between web servers and application servers, between application servers and databases, between networks, etc.; 2) data-at-rest, including disk encryption, record encryption, device encryption, backup and archive encryption, etc. and 3) data-in-process, including virtual machine encryption (although there is no way currently, nor likely in the near future, to deal with the processing of encrypted data).

Although some cloud security providers have come up with innovative solutions, the fact remains that encryption processes in the cloud are very complex and the risk of failure and data breaches can be much greater than in traditional hosting environments.

5. Managing and protecting encryption keys is difficult

Managing and protecting encryption keys is a major challenge, especially in the cloud. Once data is moved to the cloud and virtual environments, the question becomes "who do I trust?" If you rely on encryption to protect your data, who can you trust with the encryption keys?

One option is to store the keys in the cloud, either on the same cloud infrastructure you use for your data, or with a dedicated key management vendor. Doing this means that you trust the chosen provider to keep your keys safe. Recent security incidents however confirm that security providers themselves are exposed to attacks. Therefore, many will argue that you should trust no one with your encryption keys.

The other option therefore is to store the encryption keys on your own premise. That approach however may defeat the purpose of moving to the cloud in the first place, since an infrastructure deployment will still be required on your own premise or back in the data center. More often than not, this will result in an expensive solution, as well as the loss of important cloud advantages such as scalability and elasticity.

6. Encryption systems can be bypassed or may contain backdoors

You are never certain that someone out there does not possess the decryption keys for your encrypted data. The encryption technology supplier, the service provider, a sub-contractor of the supplier, an employee, a government agency, a hacker or anyone else can have access to or possess the decryption keys. You have no real way to confirm or deny this.

There are many examples of situations where encryption systems have been bypassed and there are many ways to implement backdoors into encryption systems. More recently, following the Snowden/PRISM leaks, it has been revealed that Microsoft worked with the NSA to bypass its own encryption for email, chat and cloud storage. Although Microsoft has denied such a claim, the simple fact that these encryption systems can be bypassed, and that backdoor access can be given to a third party, should be enough to ring a bell and shed light on the extent of the security and privacy problem globally.

7. Local laws may compel someone to decrypt or provide the keys

Contrary to popular belief, key disclosure laws are a reality and vary widely between national jurisdictions. There are numerous examples of such laws being applied, or where an individual or an entity has been forced to provide decryption keys or decrypt the data under its control.

This is a very controversial subject, but it has been demonstrated over and over again in the past that encryption is not infallible. Weaknesses in encryption algorithms are regularly discovered and research is ongoing. Who would have thought that AES-256 had its own weaknesses, or that it could be cracked in some situations?

8. Sooner or later, encryption will be broken

Some jurisdictions may also force telecommunication companies, internet service providers and storage providers to compromise encryption or provide backdoors to their systems. All organizations keeping encrypted data may find themselves vulnerable over time due to evolving technology and computational power.

9. Data encryption has an impact on performance

Depending where and how encryption is implemented may have a noticeable impact on the performance of data transfer, processing and storage. Furthermore, since encryption occurs in different ways and at several points throughout the computing environment and the communication cycle, performance degradation and technical problems are compounded. Maintaining performance objectives in these scenarios require more powerful equipment or the use of dedicated hardware encryption devices.

10. Encrypted data must be decrypted so that it can be used

Accessing encrypted data is always dependent on the availability of the decryption key and, depending on the implementation, the password or passphrase required to activate this key. Lose any one of them and your data may be lost forever.

This is true with all types of encryption implementation, but particularly so when disk encryption is used and the disk fails. Not only do you need a backup copy of the data, but you also need a backup copy of the decryption key. It goes without saying therefore that security measures will also have to be deployed to protect this key. Once again, this increases the vulnerability of your data and the risks of a data breach.

11. Restoring encrypted data from backup copies is hazardous

Restoring encrypted data from backups and other storage devices is tricky and fraught with obstacles. Encryption and decryption processes may work fine during normal operations, but it's a different story when it comes to restore data from encrypted backups, especially if they haven't been used for some time. Backups are the traditional starting point for data protection. It enables safe transport and storage of the data, as long as the passwords and encryption keys are kept separate from the data itself, of course. When the time comes to restore data from the backups however, encryption makes things harder, not easier.

CONCLUSION

This article demonstrates that encryption is not the miracle cure to security and privacy problems that it is often purported to be. In this new era of cloud computing, your data is sent all over the place, in different geographical locations and jurisdictions. You cannot prevent your data from crossing national boundaries. Your data is frequently misused, accessed by a large number of people and companies, transferred to subcontractors and surrendered to third parties, without your knowledge or consent. Your data can be accessed by hundreds of individuals and organizations, as part of regular operations, and it is constantly exposed to breaches. In this context, encryption alone is definitely not the answer.

Internet service providers and storage providers are not immune to risk. No matter which security measures they deploy, including encryption, they will never be fully responsible for the damages that may result from a data security or privacy breach. Data protection and privacy laws, on the other hand, are disparate throughout the world and cannot keep up with technological advancements. Encryption alone will not solve information security and privacy problems, let alone liberty, freedom and democracy.

It is time to think out of the box and change the current paradigm.