Dark Reading is part of the Informa Tech Division of Informa PLC

This site is operated by a business or businesses owned by Informa PLC and all copyright resides with them.Informa PLC's registered office is 5 Howick Place, London SW1P 1WG. Registered in England and Wales. Number 8860726.

Perimeter

11/23/2011
11:12 AM
Taher Elgamal
Taher Elgamal
Commentary
50%
50%

Embedding Digital Certificates In Hardware

A natural evolution, but there are a few potential pitfalls to avoid

It was always known that if we chain trust to a known trusted source that the overall trust is improved. Most of the implementations of PKI certificates use some hardware to store the private keys so that forging a signature or obtaining a key is difficult. At this time, the hardware takes the form of hardware security modules (HSMs) in the case of server operations, or a USB device for client machines.

The question is: What if these keys were embedded in the processor itself?

It is only natural for the industry to attempt to combine the trusted hardware into the main processor -- that will enhance the value of the hardware and make strong authentication part of the mainstream industry. The growth of applications that require strong authentication and the growth of e-commerce and other applications that handle sensitive data will perhaps make these feature very important additions to the standard “faster, better, cheaper” way of the growth of the processor industry.

A couple of issues about trust models: First, we should avoid the full flexibility that we did in the browser world since its beginning. A good number of the weaknesses of the current e-commerce environment can be avoided if we prevent “suspect” CAs from being trusted at the root, for example.

Second, we don't want to swing the pendulum the other way completely and create monopolies. Instead, we should embark on designing a good system that will allow us to build this industry correctly. Allowing a trusted CA to be a part of the system should be easy to do, assuming that we know how to revoke a CA key and that revocation checking is a standard part of all operations -- all standard operations.

Recognized in the industry as the "inventor of SSL," Dr. Taher Elgamal led the SSL efforts at Netscape. He also wrote the SSL patent and promoted SSL as the Internet security standard within standard committees and the industry. Dr. Elgamal invented several industry and government standards in data security and digital signatures area, including the DSS government standard for digital signatures. In addition to serving on numerous corporate advisory boards, Dr. Elgamal is the Chief Security Officer at Axway, a global provider of multi-enterprise solutions and infrastructure. He holds a Ph.D. and M.S. in Computer Science from Stanford University. View more of his blog posts here.

Comment  | 
Print  | 
More Insights
Comments
Oldest First  |  Newest First  |  Threaded View
Register for Dark Reading Newsletters
White Papers
Video
Cartoon Contest
Current Issue
2020: The Year in Security
Download this Tech Digest for a look at the biggest security stories that - so far - have shaped a very strange and stressful year.
Flash Poll
Assessing Cybersecurity Risk in Today's Enterprises
Assessing Cybersecurity Risk in Today's Enterprises
COVID-19 has created a new IT paradigm in the enterprise -- and a new level of cybersecurity risk. This report offers a look at how enterprises are assessing and managing cyber-risk under the new normal.
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2021-23901
PUBLISHED: 2021-01-25
An XML external entity (XXE) injection vulnerability was discovered in the Nutch DmozParser and is known to affect Nutch versions < 1.18. XML external entity injection (also known as XXE) is a web security vulnerability that allows an attacker to interfere with an application's processing of XML ...
CVE-2020-17532
PUBLISHED: 2021-01-25
When handler-router component is enabled in servicecomb-java-chassis, authenticated user may inject some data and cause arbitrary code execution. The problem happens in versions between 2.0.0 ~ 2.1.3 and fixed in Apache ServiceComb-Java-Chassis 2.1.5
CVE-2020-12512
PUBLISHED: 2021-01-22
Pepperl+Fuchs Comtrol IO-Link Master in Version 1.5.48 and below is prone to an authenticated reflected POST Cross-Site Scripting
CVE-2020-12513
PUBLISHED: 2021-01-22
Pepperl+Fuchs Comtrol IO-Link Master in Version 1.5.48 and below is prone to an authenticated blind OS Command Injection.
CVE-2020-12514
PUBLISHED: 2021-01-22
Pepperl+Fuchs Comtrol IO-Link Master in Version 1.5.48 and below is prone to a NULL Pointer Dereference that leads to a DoS in discoveryd