When it comes to robust encryption, the key is… well, it’s the key.
Encryption is used to ensure the confidentiality, integrity, authentication and non-repudiation of data. In layman’s terms, it ensures that your data remains secret, that nobody has tampered with it, that it was sent to the right person in the right order and that you can prove who sent it.
Best practice in data security assumes that any unauthorised user (hacker) has an in-depth knowledge of your cryptosystem (algorithm); so the security of the system relies primarily on the secrecy of the encryption key. This is summarised in Kerckhoff’s Principle: “Only secrecy of the key provides security”. Thus, the encryption key is the cornerstone of secure cryptography.
Given this, it is surprising how weak some keys in use in modern cryptography are and how little attention is paid to the key generation process. So, what makes a good key? In order to provide robust encryption, a key has to adhere to three simple rules. It needs to be unique, it needs to be truly random and it needs to be kept securely.
Whilst this seems simple enough in theory, in practice it is a little harder to achieve. Generating unique, truly random keys is complex to ensure and even more complex to test. There have been a number of high-profile instances recently of weak keys. The BBC ran an article in August 2015 warning that the web’s random numbers are too weak and in November 2015, Hacker News revealed that millions of IoT devices are re-using the same crypto keys.
Generating predictable or weak keys is also a handy way to insert a back door into a crypto system, as was the case with the EC DRBG key generation standard. While geeks questioned the quality of the keys generated by EC DRBG as early as 2007, it was only withdrawn as a standard by NIST after the Snowden revelations.
How random is random?
True randomness (entropy) is difficult to achieve. In fact, given a finite random number sequence, it is not possible to test how random the sequence is – it is one of the fundamental properties or a random number. What is possible is to test the statistical properties of your random numbers; though this offers limited benefits.
For example, statistical analysis does not allow you to distinguish between a sequence of random numbers generated “on the fly” by a random number generator and a random sequence stored in a memory and replayed on demand. Because it is impossible to test the randomness of the output, it becomes necessary to verify the processes by which entropy is created.
When it comes to generating random numbers, you have a choice between hardware and software-based random number generators (RNG). Whilst some would argue for the cost and portability advantages of software RNGs, these arguments also frequently use terms like deterministic, pseudo-randomness and sufficiently random. They don’t say “truly random”. This is where Hardware RNGs come in.
Hardware or True RNGs
Using True RNGs based on quantum optical processes is one of the best options for generating good keys, as quantum physics is fundamentally and provably random. It is possible to model the quantum process and prove its randomness in two ways. Firstly, it is possible to identify and monitor critical parameters in real-time during the key generation process to guarantee, ex-ante, the quality of the random bits produced.
Secondly, it is possible to model and evaluate failure modes within the quantum process. This allows for the design of RNGs that “fail gracefully”; ensuring, for example the inhibition of the random bit stream in case of failure, instead of producing imperfect random numbers.
Another advantage of using quantum optics is the sheer simplicity of the underlying quantum processes. This means that it is very easy to build a model of how it should perform (a so-called “stochastic model”) and monitor any deviations from this model. As a result, testing and certifying QRNGs is relatively simple.
So, when it comes to encryption, don’t settle for just any old key. To provide robust data security, you need a key you can TRUST. It needs to be Truly Random, Unique, Secure and Tested. Remember, entropy, not apathy.
Find out more about quantum random number generation at https://www.idquantique.com/random-number-generation/quantis-random-number-generator/