Home » Security Bloggers Network » Best practices for encryption key security

Best practices for encryption key security

by Prateek Panda on September 4, 2020

The post Best practices for encryption key security appeared first on Intertrust Technologies.

Why encryption key security is so important

One of the biggest cybersecurity challenges is protecting the millions of gigabytes of data that are created, transmitted, and stored every day. This data generally undergoes some form of encryption to make sure would-be attackers can’t read private and sensitive information. However, even the strongest cryptographic ciphers cannot keep data safe if the encryption keys are compromised.

Hackers know this, so rather than trying to break complex ciphers, they invest their efforts in stealing cryptographic keys instead. Once encryption keys are obtained, attackers can eavesdrop on secure communications, manipulate network transactions, impersonate a user, and exfiltrate sensitive information.

Increasingly common and difficult to defend against are side-channel attacks, which seek to exploit indirect, ancillary information to identify and extract cryptographic keys. These attacks include:

Differential fault analysis
Memory access patterns or cache attacks
Timing analysis
Power usage data
Speculative execution attacks (such as the CacheOut and Zombieload attacks)

In this post, we’ll take a look at the best practices for encryption key security, focusing on three critical and vulnerable areas:

Generation
Storage
Usage

Encryption key security: generation

Depending on the purpose of the cryptography and the sensitivity of the data being encrypted, the generation of encryption keys can change. It is important that strong algorithms are employed and that keys are only generated for a single specific purpose rather than being used repetitively. Examples of single-purpose encryption key usage include:

Data encryption
User authentication
Digital signatures
Key wrapping (for exchanging of keys)

Depending on how important the data is that’s being protected, there are varying strengths to popular cryptographic systems. This includes symmetric key algorithms such as AES-128, AES-192, and AES-256, which the US government uses for data classified as Top Secret, or the soon to be deprecated 3DES, which provides security to a level of around 112 bits.

There is also asymmetric cryptography, which is commonly known as public-key cryptography. This uses agreements formed using a public and private key to create safe methods for the exchange and decryption of protected data. Some of these methods, approved by the US National Institute of Standards and Technology, include:

Digital Signature Algorithm (DSA)
Elliptic Curve Digital Signature Algorithm (ECDSA)
RSA
Diffie-Hellman
MQV

Applying accepted best practices to key generation ensures the most critical data is protected while harnessing the cryptographic power of symmetric and asymmetric systems.

Encryption key security: storage

A chief vector of attack for hackers looking to steal cryptographic keys is through a compromised device or application. Hackers can reverse engineer code, analyze how it works, and understand where and how to extract keys.

Device manufacturers and application publishers therefore must fortify the key storage of their product beforehand so that it can deal with attacks that occur outside of their secure environments.

Hardware-backed secure key storage

There are a number of hardware protection options for cryptographic keys, such as hardware security modules (HSM), trusted platform modules (TPM), and trusted execution environments (TEE).

These come in the form of chips, cards, or devices that store cryptographic keys and perform functions such as encryption, decryption, strong authentication, and digital signing. They provide excellent protection for keys but can be cumbersome and costly to employ. They can also become vulnerable to side-channel attacks and in situations where an attacker has root privileges, like in jailbroken/rooted phones.

Keystores

Major platforms and OSes, such as Android, Microsoft, Apple, and Java, provide their own keystores to guarantee a level of encryption key security for their users, backed by hardware-based security where available. They are sufficient as a basic level of protection for most operations, especially where high-value or sensitive information is not involved. However, their security strength varies across devices and the lack of standardization means that cryptographic operations must be re-implemented for each platform.

White-box cryptography

White-box cryptography uses software-based algorithms to provide protection for cryptographic keys no matter where they are, even without hardware support. It is also employed under the assumption of a hostile, compromised environment to protect against reverse engineering and runtime analysis on compromised devices. For example, whiteCryption Secure Key Box, which is one of the leading solutions in the field, provides a drop-in cryptographic library that ensures encryption keys in mobile, desktop, and web apps remain protected even if an adversary gets root access to the device.

White-box cryptography also has the advantage of cross-platform interoperability and the ability to support a wide range of cryptographic operations while always keeping keys safe—at rest, in transit, or when in use.

Encryption key security: usage

That brings us to one of the most critical elements of encryption key security: their vulnerability during use. While many security processes may focus on keeping cryptographic keys safe in a device or app, it is during use that they are often most at risk. Due to their nature, cryptographic keys must appear somewhere when they are being used. Unfortunately, there are many weapons in a hacker’s arsenal that seek to steal them at exactly that moment, including malware, malicious apps, and side-channel attacks.

For those reasons, an important consideration and an encryption key security best practice is to focus on protecting keys while they are performing cryptographic operations. This can be achieved by performing cryptographic functions within hardware-backed security , with the same limitations as described above, or by using white-box cryptography to make sure keys don’t appear in the clear during runtime.

Why you need to focus on encryption key security

As cryptographic ciphers have gotten stronger and faster, hackers have moved away from trying to crack them. Instead, they’ve shifted their focus to stealing the cryptographic keys that underpin them. Unfortunately, as strong as any algorithm may be, it is only as safe as the keys that are being used. If those can be extracted, an attacker can circumvent protections and decrypt stolen data, pose as an authenticated user, or perform other malicious actions.

There are a number of best practices to take into account when planning encryption key security, but one of the simplest and most effective key protection solutions is employing white-box cryptography. Due to its flexibility and cryptographic strength, white-box cryptography—such as whiteCryption Secure Key Box (SKB)—can provide complete protection to keys no matter what environment they’re in. To find out more about whiteCryption SKB, you can download our whitepaper or reach out to our team.