Encryption Could Make You More Vulnerable

narramissic writes "It sounds like a headline straight out of The Onion, but security researchers from IBM Internet Security Systems, Juniper, nCipher and elsewhere are warning that the use of data encryption could make organizations vulnerable to new risks and threats. There is potential for 'A new class of DoS attack,' says Richard Moulds, nCipher's product strategy EVP. 'If you can go in and revoke a key and then demand a ransom, it's a fantastic way of attacking a business.'"

Comments

To sum up:

[Actually, I do RTFA]

The threats discussed are:

1. Losing keys/passwords
2. Missing business opportunities because of the difficulty of sharing data internally (or presumably with third-parties
3. Hackers stealing your keys, deleting them, and ransoming them back to you
4. Hackers performing DOS on your authentication key-serving server./li

revoke isn't that big

[X0563511]

Revoking a key isn't going to harm a company. They can just issue a new key.

A revoked key can usually still be used without limitations, however a revoked key should not be trusted and should be considered exposed.

Re:revoke isn't that big

[Zeinfeld]

Its storage encryption keys they are talking about and nCipher makes a key management product.

This is hardly a new issue, its been a significant concern for at least a decade. One of the problems with dealling with it was that for many years the mere mention of Key Escrow had people screaming about black helicopters.

Key escrow is neither necessary nor desirable for communications security. You use session keys, preferably with a round of Diffie Hellman to provide perfect forward secrecy and protect against kelptographic attacks. But for storage encryption it is all a matter of how you keep the keys safe.

It isn't that difficult to do, you simply make sure that keys are backed up in multiple places and are governed by separation of duties and multi-party control. The VeriSign Certification Practices Statement provides a complete primer in how to do this properly.