Computers & Security, 18 (1999) 429-431
E-Commerce And Encryption: Barriers To Growth
The growth in the number of transactions carried out
between organizations, or organizations and individ-
uals, by means of an electronic network is projected to grow by 400% over the next two years. For this
level of growth to be achieved and sustained, it will be necessary to develop and effectively manage an
infrastructure to support the authenticity and con& dentiality of messages traversing the Internet or other
networks that support E-business communications.
Without this infrastructure, confidence is unlikely to grow sufficiently to allow electronic business to
develop to its full potential. Although some organiza- tions may be able to put in place sufficient internal
systems to manage the security of data during trans-
actions, this is not an option for everyone. For exam- ple, problems will arise if bespoke systems are
required to communicate with every single supplier and customer. The need for standards, which will
facilitate interoperation between systems, will reduce
system complexity and hence increase security, and
are of paramount importance to the well-being of the E-commerce marketplace.
The majority of E-business sites are currently located
in the US, where local call charges are free and home PC ownership is high. Additionally US sites are
allowed to support 128 bit encryption, and US users
have browsers capable of exploiting this higher level of security. At the moment, the rest of the world is restricted to support for 40 bit encryption, with some having none at all. In some cases, country specific ven- dors have provided encryption plug-ins to allow high-
er levels of security. These only address individual
country issues. and do nothing to increase security on a worldwide basis.
As clearly the marketplace for E-business is global,
there is a strong need to provide interoperability
and uniformity between local legislation and the requirements of the global community. The key
to a truly international, E-business infrastructure is
the use of strong encryption to protect mformation in transit and to authenticate users by means of elec- tronic 111s.
The Strong Encryption Argument Strong encryption is defined as an encryption algo- rithm which. combined with a key, will produce a
cipher that will be computationally unfeasible to break
using ‘brute force’. In other words, unless the key is available, it will take a large number of very powerful
computers many years to decode the information.The
current Data Encryption Standard (11ES) cracking project being undertaken by the Electronic Frontier Foundation is able to break the encryption for 56 bit
DES in twenty-two hours.
International export agreements restrict the export of
products capable of encrypting information and the transportation of encrypted data between nations. Many of these restrictions have been put in place on the basis of dual use technology, i.e. items that may be used for both peaceful and military purposes.
0167-4048/99$20.00 0 1999 Elsevier Science Ltd. All rights reserved. 429
E-Commerce And Encryption/Neil Jarvis
Current cross border restrictions allow organizations
to use symmetric encryption algorithms with keys of up to 56bits. Financial institutions are allowed sym-
metric keys of up to 128 bits. For the general business
community, strong encryption is still forbidden.
Many governments have stated that the reason for
restricting the use of strong encryption outside mili- tary operations is to prevent its use by criminals, ter-
rorists and paedophiles. The initial argument for key
escrow was that all users of strong encryption would
be obliged to lodge their keys with a Trusted Third
Party (TTP). Key escrow is a mechanism whereby
recovery keys for all users are stored in a secure cen-
tral location. In the event that a user loses their key or there is a need to recover encrypted information, their
key may be released by the Trusted Third Party (which holds keys on behalf of users), provided a warrant has
been obtained.
Law Enforcement issues Unfortunately there is a fundamental misconception
with the above concept: it assumes that everyone will lodge their keys with a TTP This may be the case for
law abiding citizens, who have nothing to fear from
the law enforcement agencies, however those individ- uals who operate outside the law are unlikely to coop-
erate. It is perhaps interesting to compare the assump- tions about key escrow with the more familiar territo-
ry of firearms registration.The table below shows UK
Home Office figures for the percentage of legally held firearms that were recovered after a homicide:
ii-cumstance 0
The parallels between this and the likely reaction by the criminal fraternity to the use of key escrow should stimulate thought!
Regardless of any legislation concerning the use of encrypted data, criminals, terrorists and paedophiles
are still likely to use it to transfer information.
However, for that information to have any value, it must be decrypted.Arguments may be made that it is
desirable for the information exchanged between these illegal groups to be transferred in a secure man-
ner within a closed community of known individuals,
thus protecting innocent parties.
The law enforcement agencies argue that strong
encryption will hamper their investigative procedures
and they have powerful statistics to support their cause. They have stated that during 1996-7 the lawful
interception of communications led to 1200 arrests, the seizure of three tonnes of Class A drugs, 112
tonnes of other drugs, A700 million in cash and prop-
erty, and 450 f irearms. This was based on 2600 inter-
ception warrants being issued over the course of the
year. Others would argue, however, that rather than
looking at encryption issues, there are other more urgent matters which should be addressed. For exam- ple, the introduction of prepaid digital mobile phones
in the UK has provided the criminal fraternity with a
secure anonymous communications mechanism that may be acquired or disposed of at low cost.This poses
a greater threat than that of strong encryption to the
law enforcement authorities’ investigative procedures.
Legal Standing of Digital Signatures
The initial UK government consultation document
regarding E-business used escrow as an instrument to support legal accreditation of digital signatures. Provided that keys were lodged with a licensed TTP digital signatures were to be underwritten and given the same standing as a hand-written signature. However, this has now been replaced with a require-
ment to obtain digital signatures from a licensed Certificate Authority (CA). A CA acts as a trusted intermediary for individuals or organizations
430
Computers and Security, Vol. 18, No. 5
exchanging public keys, and guarantees that the key
originated from the correct source. Licensing for CAs is voluntary but the government’s consultation paper gives no indication as to the requirements for becom-
ing a licensed CA. Perhaps even more worrying it that
there is also no guidance on the use of unlicensed
CAs, and the standing of a signature obtained from such an organization.
A decision needs to be taken either way: licensing
should either be mandatory or not required at all.The half-way house of voluntary licensing is meaningless
and has the potential to cause more problems than it
solves, especially where the loss or misuse of digital
signatures is concerned.
Interaction between Certificate Authorities is critical.
Organizations deal with multiple suppliers and cus-
tomers. If they are required to have a certificate for
each of these companies, certificate management becomes extremely complex. One of the require-
ments for licensing of CAs should be interoperability
between other licensed CAs, thus allowing registered keys to be interpreted by any organization, regardless of which CA they are dealing with.
What is the answer? There is a strong argument that the government focus with respect to digital signa- tures should be to amend existing legislation to allow
them to carry the same weight as a hand-written sig-
nature. If licensing is a requirement, then it should be made mandatory and part of this licensing must
encompass interoperability between CA systems.
Conclusion For the UK to achieve the Government’s stated objective of becoming “the worlds best environment
for electronic trading by 2002”, efforts must be
focused on authentication and confidentiality of information which will form the basis of E-business.
To do this will require standards to allow interoper-
ability between Certificate Authorities and a relax- ation in the legitimate use of strong encryption.
Efforts must be made to increase the standing of dig-
ital signatures and make them equivalent to hand-
written signatures.
While the UK government has suspended the
requirement for key escrow to support strong cncryp-
tion within the E-commerce consultation paper, they
have asked for commerce and industry to propose an
alternative which may meet the requirements of the
law enforcement agencies for access to encrypted data.The need for this additional legislation is ques-
tionable and is likely to do little to help the
Government achieve its ‘best environment’ target.
For the projected 400% growth to be achieved over
the next two years, the infrastructure to support this
growth must be put in place. Without suficient stan- dardized systems businesses will be forced to imple-
ment their own.This will allow a level of growth but will not meet current expectations. If the government
implements suitable policies to facilitate the required infrastructure the 400% figure may be a significant underestimate. However unless businesses examine
existing internal infrastructures they will be left
behind in the race.
431