Computers & Security, 18 (1999) 429-431

E-Commerce And Encryption: Barriers To Growth

The growth in the number of transactions carried out

between organizations, or organizations and individ-

uals, by means of an electronic network is projected to grow by 400% over the next two years. For this

level of growth to be achieved and sustained, it will be necessary to develop and effectively manage an

infrastructure to support the authenticity and con& dentiality of messages traversing the Internet or other

networks that support E-business communications.

Without this infrastructure, confidence is unlikely to grow sufficiently to allow electronic business to

develop to its full potential. Although some organiza- tions may be able to put in place sufficient internal

systems to manage the security of data during trans-

actions, this is not an option for everyone. For exam- ple, problems will arise if bespoke systems are

required to communicate with every single supplier and customer. The need for standards, which will

facilitate interoperation between systems, will reduce

system complexity and hence increase security, and

are of paramount importance to the well-being of the E-commerce marketplace.

The majority of E-business sites are currently located

in the US, where local call charges are free and home PC ownership is high. Additionally US sites are

allowed to support 128 bit encryption, and US users

have browsers capable of exploiting this higher level of security. At the moment, the rest of the world is restricted to support for 40 bit encryption, with some having none at all. In some cases, country specific ven- dors have provided encryption plug-ins to allow high-

er levels of security. These only address individual

country issues. and do nothing to increase security on a worldwide basis.

As clearly the marketplace for E-business is global,

there is a strong need to provide interoperability

and uniformity between local legislation and the requirements of the global community. The key

to a truly international, E-business infrastructure is

the use of strong encryption to protect mformation in transit and to authenticate users by means of elec- tronic 111s.

The Strong Encryption Argument Strong encryption is defined as an encryption algo- rithm which. combined with a key, will produce a

cipher that will be computationally unfeasible to break

using ‘brute force’. In other words, unless the key is available, it will take a large number of very powerful

computers many years to decode the information.The

current Data Encryption Standard (11ES) cracking project being undertaken by the Electronic Frontier Foundation is able to break the encryption for 56 bit

DES in twenty-two hours.

International export agreements restrict the export of

products capable of encrypting information and the transportation of encrypted data between nations. Many of these restrictions have been put in place on the basis of dual use technology, i.e. items that may be used for both peaceful and military purposes.

0167-4048/99$20.00 0 1999 Elsevier Science Ltd. All rights reserved. 429

E-Commerce And Encryption/Neil Jarvis

Current cross border restrictions allow organizations

to use symmetric encryption algorithms with keys of up to 56bits. Financial institutions are allowed sym-

metric keys of up to 128 bits. For the general business

community, strong encryption is still forbidden.

Many governments have stated that the reason for

restricting the use of strong encryption outside mili- tary operations is to prevent its use by criminals, ter-

rorists and paedophiles. The initial argument for key

escrow was that all users of strong encryption would

be obliged to lodge their keys with a Trusted Third

Party (TTP). Key escrow is a mechanism whereby

recovery keys for all users are stored in a secure cen-

tral location. In the event that a user loses their key or there is a need to recover encrypted information, their

key may be released by the Trusted Third Party (which holds keys on behalf of users), provided a warrant has

been obtained.

Law Enforcement issues Unfortunately there is a fundamental misconception

with the above concept: it assumes that everyone will lodge their keys with a TTP This may be the case for

law abiding citizens, who have nothing to fear from

the law enforcement agencies, however those individ- uals who operate outside the law are unlikely to coop-

erate. It is perhaps interesting to compare the assump- tions about key escrow with the more familiar territo-

ry of firearms registration.The table below shows UK

Home Office figures for the percentage of legally held firearms that were recovered after a homicide:

ii-cumstance 0

The parallels between this and the likely reaction by the criminal fraternity to the use of key escrow should stimulate thought!

Regardless of any legislation concerning the use of encrypted data, criminals, terrorists and paedophiles

are still likely to use it to transfer information.

However, for that information to have any value, it must be decrypted.Arguments may be made that it is

desirable for the information exchanged between these illegal groups to be transferred in a secure man-

ner within a closed community of known individuals,

thus protecting innocent parties.

The law enforcement agencies argue that strong

encryption will hamper their investigative procedures

and they have powerful statistics to support their cause. They have stated that during 1996-7 the lawful

interception of communications led to 1200 arrests, the seizure of three tonnes of Class A drugs, 112

tonnes of other drugs, A700 million in cash and prop-

erty, and 450 f irearms. This was based on 2600 inter-

ception warrants being issued over the course of the

year. Others would argue, however, that rather than

looking at encryption issues, there are other more urgent matters which should be addressed. For exam- ple, the introduction of prepaid digital mobile phones

in the UK has provided the criminal fraternity with a

secure anonymous communications mechanism that may be acquired or disposed of at low cost.This poses

a greater threat than that of strong encryption to the

law enforcement authorities’ investigative procedures.

Legal Standing of Digital Signatures

The initial UK government consultation document

regarding E-business used escrow as an instrument to support legal accreditation of digital signatures. Provided that keys were lodged with a licensed TTP digital signatures were to be underwritten and given the same standing as a hand-written signature. However, this has now been replaced with a require-

ment to obtain digital signatures from a licensed Certificate Authority (CA). A CA acts as a trusted intermediary for individuals or organizations

430

Computers and Security, Vol. 18, No. 5

exchanging public keys, and guarantees that the key

originated from the correct source. Licensing for CAs is voluntary but the government’s consultation paper gives no indication as to the requirements for becom-

ing a licensed CA. Perhaps even more worrying it that

there is also no guidance on the use of unlicensed

CAs, and the standing of a signature obtained from such an organization.

A decision needs to be taken either way: licensing

should either be mandatory or not required at all.The half-way house of voluntary licensing is meaningless

and has the potential to cause more problems than it

solves, especially where the loss or misuse of digital

signatures is concerned.

Interaction between Certificate Authorities is critical.

Organizations deal with multiple suppliers and cus-

tomers. If they are required to have a certificate for

each of these companies, certificate management becomes extremely complex. One of the require-

ments for licensing of CAs should be interoperability

between other licensed CAs, thus allowing registered keys to be interpreted by any organization, regardless of which CA they are dealing with.

What is the answer? There is a strong argument that the government focus with respect to digital signa- tures should be to amend existing legislation to allow

them to carry the same weight as a hand-written sig-

nature. If licensing is a requirement, then it should be made mandatory and part of this licensing must

encompass interoperability between CA systems.

Conclusion For the UK to achieve the Government’s stated objective of becoming “the worlds best environment

for electronic trading by 2002”, efforts must be

focused on authentication and confidentiality of information which will form the basis of E-business.

To do this will require standards to allow interoper-

ability between Certificate Authorities and a relax- ation in the legitimate use of strong encryption.

Efforts must be made to increase the standing of dig-

ital signatures and make them equivalent to hand-

written signatures.

While the UK government has suspended the

requirement for key escrow to support strong cncryp-

tion within the E-commerce consultation paper, they

have asked for commerce and industry to propose an

alternative which may meet the requirements of the

law enforcement agencies for access to encrypted data.The need for this additional legislation is ques-

tionable and is likely to do little to help the

Government achieve its ‘best environment’ target.

For the projected 400% growth to be achieved over

the next two years, the infrastructure to support this

growth must be put in place. Without suficient stan- dardized systems businesses will be forced to imple-

ment their own.This will allow a level of growth but will not meet current expectations. If the government

implements suitable policies to facilitate the required infrastructure the 400% figure may be a significant underestimate. However unless businesses examine

existing internal infrastructures they will be left

behind in the race.

431