{"id":5174,"date":"2020-12-09T09:44:54","date_gmt":"2020-12-09T13:44:54","guid":{"rendered":"https:\/\/solutionsreview.com\/identity-management\/?p=5174"},"modified":"2020-12-08T16:53:53","modified_gmt":"2020-12-08T20:53:53","slug":"operational-best-practices-for-securing-cryptographic-keys","status":"publish","type":"post","link":"https:\/\/solutionsreview.com\/identity-management\/operational-best-practices-for-securing-cryptographic-keys\/","title":{"rendered":"Operational Best Practices for Securing Cryptographic Keys"},"content":{"rendered":"

\"Operational<\/h2>\n

Operational Best Practices for Securing Cryptographic Keys<\/strong><\/h2>\n

By Jake VanAdrighem, Product Manager of Intertrust<\/a>, sharing his knowledge for the #InfoSecInsightJam<\/a>.\u00a0<\/em><\/p>\n

Protecting the millions of gigabytes of data that are created, transmitted, and stored every day is a complex challenge. This data is generally secured with cryptography to make sure would-be attackers cannot read the information that is often sensitive and private. However, even the strongest cryptographic ciphers cannot keep data safe if the cryptographic keys are compromised.<\/p>\n

Hackers know this, so rather than trying to break complex ciphers, they often invest their efforts in stealing cryptographic keys instead. Once they have obtained the keys, cyber-criminals can eavesdrop on secure communications, manipulate network transactions, impersonate a user, and even exfiltrate sensitive information.<\/p>\n

Increasingly common, and difficult to defend against, are side-channel attacks which exploit indirect, ancillary information to identify and extract cryptographic keys. These types of attacks take many forms including sophisticated differential fault analysis, memory access pattern or cache attacks, timing analysis, and interventions around power usage data.<\/p>\n

Another well-known type of side-channel attack exploits speculative execution vulnerabilities. Recent examples include CacheOut and Zombieload, which leak data on Intel processors via cache evictions,<\/p>\n

Best practices for securing data with cryptography should focus on three areas\u2014generation, storage, and usage.<\/p>\n
Widget not in any sidebars
\n

Generation<\/strong><\/h3>\n

Depending on the purpose of the cryptography and the sensitivity of the data being encrypted, the generation of cryptographic keys can change. It is important to employ strong algorithms and to ensure keys are only generated for a single specific purpose rather than for repetitive usage. Data encryption, user authentication<\/a>, digital signatures, and key wrapping for exchanging keys are examples of single-purpose cryptographic keys.<\/p>\n

There are varying strengths to popular cryptographic systems which are typically applied to data based on the sensitivity and importance of the information itself. For instance, symmetric key algorithms such as AES-128, AES-192, and AES-256 are used by the U.S. government for data classified as Top Secret, while soon-to-be deprecated 3DES provides security to a level of around 112 bits.<\/p>\n

There is also asymmetric cryptography, which is commonly known as public-key cryptography. It is designed to use agreements formed from a public and private key to create safe ways to exchange and decrypt protected data. Some of these methods, approved<\/a> by the U.S. National Institute of Standards and Technology (NIST), include Digital Signature Algorithm (DSA) and Elliptic Curve Digital Signature Algorithm (ECDSA), as well as RSA, Diffie-Hellman, and MQV.<\/p>\n

Storage<\/strong><\/h3>\n

A chief vector of attack for hackers looking to steal cryptographic keys is through a compromised device or application. Bad actors can reverse engineer code, analyze how it works, and then determine where and how to extract keys. Device manufacturers and application publishers therefore must fortify the key storage of their product prior to shipment so that it can deal with attacks that occur outside of their secure environments.<\/p>\n

From the standpoint of hardware-backed secure key storage, there are a number of hardware protection options for cryptographic keys. This spans hardware security modules (HSM), trusted platform modules (TPM), and trusted execution environments (TEE).<\/p>\n

These come in the form of chips, cards, or devices that store cryptographic keys and perform functions such as encryption, decryption, strong authentication, and digital signing. They provide excellent protection for keys but are often considered cumbersome and costly to employ. They are also vulnerable to side-channel attacks and in situations where an attacker has root privileges, like with jailbroken phones.<\/p>\n

Major platforms and OSes, such as Android, Microsoft, Apple, and Java, provide their own key stores to guarantee a level of cryptographic key security for their users. These are backed by hardware-based security where available. They are sufficient as a basic level of protection for most operations, especially where high-value or sensitive information is not involved. However, their security strength varies across devices and the lack of standardization means that cryptographic operations must be re-implemented for each platform<\/p>\n

White-box cryptography, on the other hand, uses software-based algorithms to provide protection for cryptographic keys no matter where they are, even without hardware support. It is also employed under the assumption of a hostile, compromised environment to protect against reverse engineering and runtime analysis on compromised devices.<\/p>\n

For example, a white-box cryptography implementation approach provides a drop-in cryptographic library that ensures cryptographic keys in mobile, desktop, and web apps remain protected even if an adversary gets root access to the device. Implementations can offer cross-platform interoperability and the ability to support a wide range of cryptographic operations.<\/p>\n

Usage<\/strong><\/h3>\n

Among the most critical elements of cryptographic key security is their vulnerability during use. While many security processes may focus on keeping cryptographic keys safe in a device or app, it is during use that they are often most at risk. By nature, cryptographic keys must appear somewhere when they are being used. Unfortunately, there are many weapons in a hacker\u2019s arsenal that seek to steal them at exactly that moment, including malware, malicious apps, and side-channel attacks.<\/p>\n

For those reasons, a best practice is to focus on protecting keys while they are performing cryptographic operations. This can be achieved by executing cryptographic functions within hardware-backed security with the same limitations as previously described, or by using white-box cryptography to make sure keys do not appear in the clear during runtime.<\/p>\n

As cryptographic ciphers have become stronger and faster, hackers have moved away from trying to crack them. Instead, the focus has shifted to stealing the cryptographic keys that underpin them. Unfortunately, as strong as any algorithm may be, it is only as safe as the keys that are being used. If those can be extracted, an attacker can circumvent protections and decrypt stolen data, pose as an authenticated user, or perform other malicious actions.<\/p>\n

<\/div>\n

Jake VanAdrighem, Product Manager of Intertrust<\/a>, sharing his knowledge for the #InfoSecInsightJam<\/a>. Learn more in our Identity Management Buyer’s Guide<\/a>.\u00a0<\/em><\/p>\n
Widget not in any sidebars
\n

\"Solutions<\/p>\n","protected":false},"excerpt":{"rendered":"

Operational Best Practices for Securing Cryptographic Keys By Jake VanAdrighem, Product Manager of Intertrust, sharing his knowledge for the #InfoSecInsightJam.\u00a0 Protecting the millions of gigabytes of data that are created, transmitted, and stored every day is a complex challenge. This data is generally secured with cryptography to make sure would-be attackers cannot read the information […]<\/p>\n","protected":false},"author":41,"featured_media":5170,"comment_status":"closed","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"inline_featured_image":false,"footnotes":""},"categories":[5,1],"tags":[1602,142,125,1604,16,1588,1204,76,425,70,1601,1603],"acf":[],"yoast_head":"\nOperational Best Practices for Securing Cryptographic Keys<\/title>\n<meta name=\"description\" content=\"Jake VanAdrighem, Product Manager of Intertrust, shares his knowledge on securing cryptographic keys for the #InfoSecInsightJam.\" \/>\n<meta name=\"robots\" content=\"index, follow, max-snippet:-1, max-image-preview:large, max-video-preview:-1\" \/>\n<link rel=\"canonical\" href=\"https:\/\/solutionsreview.com\/identity-management\/operational-best-practices-for-securing-cryptographic-keys\/\" \/>\n<meta name=\"twitter:label1\" content=\"Written by\" \/>\n\t<meta name=\"twitter:data1\" content=\"Ben Canner\" \/>\n\t<meta name=\"twitter:label2\" content=\"Est. reading time\" \/>\n\t<meta name=\"twitter:data2\" content=\"5 minutes\" \/>\n<script type=\"application\/ld+json\" class=\"yoast-schema-graph\">{\"@context\":\"https:\/\/schema.org\",\"@graph\":[{\"@type\":\"WebPage\",\"@id\":\"https:\/\/solutionsreview.com\/identity-management\/operational-best-practices-for-securing-cryptographic-keys\/\",\"url\":\"https:\/\/solutionsreview.com\/identity-management\/operational-best-practices-for-securing-cryptographic-keys\/\",\"name\":\"Operational Best Practices for Securing Cryptographic Keys\",\"isPartOf\":{\"@id\":\"https:\/\/solutionsreview.com\/identity-management\/#website\"},\"primaryImageOfPage\":{\"@id\":\"https:\/\/solutionsreview.com\/identity-management\/operational-best-practices-for-securing-cryptographic-keys\/#primaryimage\"},\"image\":{\"@id\":\"https:\/\/solutionsreview.com\/identity-management\/operational-best-practices-for-securing-cryptographic-keys\/#primaryimage\"},\"thumbnailUrl\":\"https:\/\/solutionsreview.com\/identity-management\/files\/2020\/12\/oie_ZLclKDdLMbLe.jpg\",\"datePublished\":\"2020-12-09T13:44:54+00:00\",\"dateModified\":\"2020-12-08T20:53:53+00:00\",\"author\":{\"@id\":\"https:\/\/solutionsreview.com\/identity-management\/#\/schema\/person\/357f925262827fcf840b4341920a1541\"},\"description\":\"Jake VanAdrighem, Product Manager of Intertrust, shares his knowledge on securing cryptographic keys for the #InfoSecInsightJam.\",\"breadcrumb\":{\"@id\":\"https:\/\/solutionsreview.com\/identity-management\/operational-best-practices-for-securing-cryptographic-keys\/#breadcrumb\"},\"inLanguage\":\"en-US\",\"potentialAction\":[{\"@type\":\"ReadAction\",\"target\":[\"https:\/\/solutionsreview.com\/identity-management\/operational-best-practices-for-securing-cryptographic-keys\/\"]}]},{\"@type\":\"ImageObject\",\"inLanguage\":\"en-US\",\"@id\":\"https:\/\/solutionsreview.com\/identity-management\/operational-best-practices-for-securing-cryptographic-keys\/#primaryimage\",\"url\":\"https:\/\/solutionsreview.com\/identity-management\/files\/2020\/12\/oie_ZLclKDdLMbLe.jpg\",\"contentUrl\":\"https:\/\/solutionsreview.com\/identity-management\/files\/2020\/12\/oie_ZLclKDdLMbLe.jpg\",\"width\":800,\"height\":400,\"caption\":\"Omada 2021 Predictions by Morten Boel Sigurdsson\"},{\"@type\":\"BreadcrumbList\",\"@id\":\"https:\/\/solutionsreview.com\/identity-management\/operational-best-practices-for-securing-cryptographic-keys\/#breadcrumb\",\"itemListElement\":[{\"@type\":\"ListItem\",\"position\":1,\"name\":\"Home\",\"item\":\"https:\/\/solutionsreview.com\/identity-management\/\"},{\"@type\":\"ListItem\",\"position\":2,\"name\":\"Operational Best Practices for Securing Cryptographic Keys\"}]},{\"@type\":\"WebSite\",\"@id\":\"https:\/\/solutionsreview.com\/identity-management\/#website\",\"url\":\"https:\/\/solutionsreview.com\/identity-management\/\",\"name\":\"Identity and Access Management Solutions | Solutions Review\",\"description\":\"Evaluating Enterprise IAM Software, Identity Governance & Access Control Tools.\",\"potentialAction\":[{\"@type\":\"SearchAction\",\"target\":{\"@type\":\"EntryPoint\",\"urlTemplate\":\"https:\/\/solutionsreview.com\/identity-management\/?s={search_term_string}\"},\"query-input\":{\"@type\":\"PropertyValueSpecification\",\"valueRequired\":true,\"valueName\":\"search_term_string\"}}],\"inLanguage\":\"en-US\"},{\"@type\":\"Person\",\"@id\":\"https:\/\/solutionsreview.com\/identity-management\/#\/schema\/person\/357f925262827fcf840b4341920a1541\",\"name\":\"Ben Canner\",\"image\":{\"@type\":\"ImageObject\",\"inLanguage\":\"en-US\",\"@id\":\"https:\/\/solutionsreview.com\/identity-management\/#\/schema\/person\/image\/\",\"url\":\"https:\/\/secure.gravatar.com\/avatar\/63f68345052a446ce0cc9c802dd3f373?s=96&d=mm&r=g\",\"contentUrl\":\"https:\/\/secure.gravatar.com\/avatar\/63f68345052a446ce0cc9c802dd3f373?s=96&d=mm&r=g\",\"caption\":\"Ben Canner\"},\"description\":\"Ben Canner is an enterprise technology writer and analyst covering Identity Management, SIEM, Endpoint Protection, and Cybersecurity writ large. He holds a Bachelor of Arts Degree in English from Clark University in Worcester, MA. He previously worked as a corporate blogger and ghost writer. You can reach him via Twitter and LinkedIn.\",\"url\":\"https:\/\/solutionsreview.com\/identity-management\/author\/bcanner\/\"}]}<\/script>\n<!-- \/ Yoast SEO plugin. -->","yoast_head_json":{"title":"Operational Best Practices for Securing Cryptographic Keys","description":"Jake VanAdrighem, Product Manager of Intertrust, shares his knowledge on securing cryptographic keys for the #InfoSecInsightJam.","robots":{"index":"index","follow":"follow","max-snippet":"max-snippet:-1","max-image-preview":"max-image-preview:large","max-video-preview":"max-video-preview:-1"},"canonical":"https:\/\/solutionsreview.com\/identity-management\/operational-best-practices-for-securing-cryptographic-keys\/","twitter_misc":{"Written by":"Ben Canner","Est. reading time":"5 minutes"},"schema":{"@context":"https:\/\/schema.org","@graph":[{"@type":"WebPage","@id":"https:\/\/solutionsreview.com\/identity-management\/operational-best-practices-for-securing-cryptographic-keys\/","url":"https:\/\/solutionsreview.com\/identity-management\/operational-best-practices-for-securing-cryptographic-keys\/","name":"Operational Best Practices for Securing Cryptographic Keys","isPartOf":{"@id":"https:\/\/solutionsreview.com\/identity-management\/#website"},"primaryImageOfPage":{"@id":"https:\/\/solutionsreview.com\/identity-management\/operational-best-practices-for-securing-cryptographic-keys\/#primaryimage"},"image":{"@id":"https:\/\/solutionsreview.com\/identity-management\/operational-best-practices-for-securing-cryptographic-keys\/#primaryimage"},"thumbnailUrl":"https:\/\/solutionsreview.com\/identity-management\/files\/2020\/12\/oie_ZLclKDdLMbLe.jpg","datePublished":"2020-12-09T13:44:54+00:00","dateModified":"2020-12-08T20:53:53+00:00","author":{"@id":"https:\/\/solutionsreview.com\/identity-management\/#\/schema\/person\/357f925262827fcf840b4341920a1541"},"description":"Jake VanAdrighem, Product Manager of Intertrust, shares his knowledge on securing cryptographic keys for the #InfoSecInsightJam.","breadcrumb":{"@id":"https:\/\/solutionsreview.com\/identity-management\/operational-best-practices-for-securing-cryptographic-keys\/#breadcrumb"},"inLanguage":"en-US","potentialAction":[{"@type":"ReadAction","target":["https:\/\/solutionsreview.com\/identity-management\/operational-best-practices-for-securing-cryptographic-keys\/"]}]},{"@type":"ImageObject","inLanguage":"en-US","@id":"https:\/\/solutionsreview.com\/identity-management\/operational-best-practices-for-securing-cryptographic-keys\/#primaryimage","url":"https:\/\/solutionsreview.com\/identity-management\/files\/2020\/12\/oie_ZLclKDdLMbLe.jpg","contentUrl":"https:\/\/solutionsreview.com\/identity-management\/files\/2020\/12\/oie_ZLclKDdLMbLe.jpg","width":800,"height":400,"caption":"Omada 2021 Predictions by Morten Boel Sigurdsson"},{"@type":"BreadcrumbList","@id":"https:\/\/solutionsreview.com\/identity-management\/operational-best-practices-for-securing-cryptographic-keys\/#breadcrumb","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https:\/\/solutionsreview.com\/identity-management\/"},{"@type":"ListItem","position":2,"name":"Operational Best Practices for Securing Cryptographic Keys"}]},{"@type":"WebSite","@id":"https:\/\/solutionsreview.com\/identity-management\/#website","url":"https:\/\/solutionsreview.com\/identity-management\/","name":"Identity and Access Management Solutions | Solutions Review","description":"Evaluating Enterprise IAM Software, Identity Governance & Access Control Tools.","potentialAction":[{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https:\/\/solutionsreview.com\/identity-management\/?s={search_term_string}"},"query-input":{"@type":"PropertyValueSpecification","valueRequired":true,"valueName":"search_term_string"}}],"inLanguage":"en-US"},{"@type":"Person","@id":"https:\/\/solutionsreview.com\/identity-management\/#\/schema\/person\/357f925262827fcf840b4341920a1541","name":"Ben Canner","image":{"@type":"ImageObject","inLanguage":"en-US","@id":"https:\/\/solutionsreview.com\/identity-management\/#\/schema\/person\/image\/","url":"https:\/\/secure.gravatar.com\/avatar\/63f68345052a446ce0cc9c802dd3f373?s=96&d=mm&r=g","contentUrl":"https:\/\/secure.gravatar.com\/avatar\/63f68345052a446ce0cc9c802dd3f373?s=96&d=mm&r=g","caption":"Ben Canner"},"description":"Ben Canner is an enterprise technology writer and analyst covering Identity Management, SIEM, Endpoint Protection, and Cybersecurity writ large. He holds a Bachelor of Arts Degree in English from Clark University in Worcester, MA. He previously worked as a corporate blogger and ghost writer. You can reach him via Twitter and LinkedIn.","url":"https:\/\/solutionsreview.com\/identity-management\/author\/bcanner\/"}]}},"_links":{"self":[{"href":"https:\/\/solutionsreview.com\/identity-management\/wp-json\/wp\/v2\/posts\/5174"}],"collection":[{"href":"https:\/\/solutionsreview.com\/identity-management\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/solutionsreview.com\/identity-management\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/solutionsreview.com\/identity-management\/wp-json\/wp\/v2\/users\/41"}],"replies":[{"embeddable":true,"href":"https:\/\/solutionsreview.com\/identity-management\/wp-json\/wp\/v2\/comments?post=5174"}],"version-history":[{"count":0,"href":"https:\/\/solutionsreview.com\/identity-management\/wp-json\/wp\/v2\/posts\/5174\/revisions"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/solutionsreview.com\/identity-management\/wp-json\/wp\/v2\/media\/5170"}],"wp:attachment":[{"href":"https:\/\/solutionsreview.com\/identity-management\/wp-json\/wp\/v2\/media?parent=5174"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/solutionsreview.com\/identity-management\/wp-json\/wp\/v2\/categories?post=5174"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/solutionsreview.com\/identity-management\/wp-json\/wp\/v2\/tags?post=5174"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}