The crypto whiz

Wed Apr 28 15:55:41 EDT 2004

<http://news.com.com/2102-7355_3-5201504.html?tag=st.util.print>

CNET News
     http://www.news.com/

 The crypto whiz

 By  Michael Kanellos  and  Charles Cooper
 Staff Writer, CNET News.com
 http://news.com.com/2008-7355-5201504.html

 Story last modified April 28, 2004, 4:00 AM PDT

Paul Kocher, president and chief scientist of Cryptography Research, came
to prominence in the industry by breaking things.

 In 1998, the company cracked security on smart cards by monitoring how
much power their internal microprocessors used. Kocher also came up with
the software inside Deep Crack, a machine tailored to crack encrypted
documents.

Of course, he also fixes things. In the last few years, Kocher has emerged
as one of the key technologists for financial companies and studios that
are hoping to protect their intellectual property. He recently sat down
with CNET News.com to discuss the ongoing melodramas surrounding privacy,
piracy and stolen information.

Q: What is the top agenda issue for cryptography?
 A: Let me tell you what it is not. The one thing that is stable--and
really, nobody should be spending too much time worrying about--is which
algorithms to use and what key sizes to use. Those are simple problems.

 The huge challenge, from a technical perspective, is handling complexity,
because we are getting systems that are just more and more complicated, and
nobody knows how to get the bugs out.

 The software side or hardware?

Every legacy feature is a potential exposure.
 Software, hardware--everything. You pick it, and it is a lot more
complicated today than it used to be, whether it is your network, whether
it is your individual PC, whether it is a device of some kind, whether it
is your microprocessor. Nobody ever removes features; they only add
them--and from a security perspective, every legacy feature is a potential
exposure.

 If you have one component that you understand really well, it is pretty
easy to get your hands around your one simple piece. But then you start
having 600 components that all talk to each other. Not only do you have 600
times as many components to worry about, you have to worry about all of the
interactions between these things.

 So you have now got 360,000 different interactions. This is just horrible,
because one person can no longer understand it; one person can no longer
even begin to debug it. So, then you try to assign groups of people to
individual pieces of the problem. But a lot of people staring at different
angles of the elephant often will miss the big picture.

 In order to just handle this technical problem, what we often try to do is
first simplify things. If you look at some of those things that we design,
once you get your mind on what it is doing, it seems simple, compared to a
lot of other things. That way, we can be more confident that we have not
missed something.

 Can you give us an overview of what Cryptography Research does?
 Typically, our goal is to bring new technical approaches to solving really
hard security problems. When you are dealing with any kind of new
technology, if it backfires, there is a substantial risk. The ones that we
have had the most success with have been with the security challenges of
financial institutions like credit card organizations. Another area we are
focusing on increasingly is piracy. We also do a lot of work with
infrastructure wireless systems.

 Most of our revenues are from technology licensing, but most of our time
goes into services.

 How bad is the privacy situation getting?
 Privacy is going to become a bigger and bigger problem over time, because
sensors and data collection capabilities are improving along with Moore's
Law. People collect data but do not have any plan of how they are going to
get rid of it or what they are going to do with it, and so you end up
aggregating vast quantities of data. It is a huge privacy risk.

 I can now record as much audio as I will ever experience in my entire
life, and video will be there in just a few years. The chips to do location
tracking are getting smaller and smaller. There is one in my cell phone.
Anybody who knows what they are doing can know where I am. There is this
notion that information is bad in aggregate--but good in the cases where
you need it. This is something that is very alien to a lot of people, and I
am not sure how to solve it.

 Piracy continues to be a huge, hot potato, with the studios blaming the
device makers and the hardware makers trying to put responsibility on the
studios.

 How will this get resolved?
The studios are rightly upset that these companies are not spending as much
money as they should to solve their security problems. But is it my job to
keep your house from getting broken into? The way that I believe that it
should work instead is that the studio should put some security code on the
disk, and the player should run it.

 The technical impediments to piracy that's based on copying and storing
the data are going to go away.
 The studios have a pretty powerful incentive to protect these materials,
so how come this system isn't in place now?
 It turns out that there are some very complicated technical problems in
making this work. And fixing the problem from an economic perspective is
not the way most engineers look at it. Most people look at security as this
binary thing: Either it is insecure, or it is secure. If you take that kind
of a perspective, this whole notion of apportioning risk does not even
really apply.

 One of the advantages our research group has is a lot of experience in
working with credit card industries. The philosophy you learn there is
really valuable, because there is this notion of risk. You can copy your
average credit card with a piece of VCR tape and an iron. It is completely
insecure technology, and you are always going to have fraud.

 But what matters is not whether you have fraud; it is what your fraud rate
is. So, Visa's published numbers are 0.07 percent and 0.08 percent.
Overall, it is profitable for the different participants. If the fraud
rates went up by a factor of 10, it would not be.

 I think it has to be applied to other unsolvable problems like spam, like
PC security, like piracy. Your goal here is to keep the rate of compromise
low but to recognize that you cannot get rid of piracy completely or get
rid of spam completely. But if piracy is below 1 percent of your revenues,
it is the cost of doing business.

 How is the notion of risk sitting with the entertainment field?
 We have a guy in Japan who is meeting with CD companies. We've usually got
somebody in Japan and somebody in LA. I am spending about half my time with
studios right now. Nobody is saying anything publicly, but we have
unofficial and strong support from much of the studios for what we are
doing.

 Some studios have one person whose job is piracy across the entire studio.
Others have an actual group of people that are reasonably technical.

 Who is more open to this concept--the music or the movie studios?
 I think that with the movie industry in particular, there is going to be
this sudden and catastrophic point in time, where it becomes more
convenient or more economically advantageous for your average person to
pirate a movie instead of obtaining it legitimately. The music industry has
sort of crossed a threshold already. They are really getting hammered by
piracy.

 With movies, the only big difference is that you have a lot more data,
which takes time to download. Instead of having a couple megabytes, you
have a couple gigabytes. But Moore's Law clearly shows that is going to
change, and when that changes, piracy rates are going to go up
dramatically.  Hard disks double about every 12 months. You will be able to
put every major Hollywood release ever onto an $80 hard disk in high
definition, and if it is not 2013, it will be 2015. The technical
impediments to piracy based on copying and storing the data are going to go
away.

 How did you get into cryptography, anyway?
 Well, you grow up in Oregon, and you have no driver's license, and you
have a PC in your house--that's part of it. I went to Stanford and studied
biology, so I cannot really credit my formal education with anything, but
while I was there, I worked part-time for Martin Hellman (co-inventor of
Public Key Cryptography). When I graduated, Hellman retired the same year
and sent consulting projects my way.

 Also, the neat thing about cryptography is that almost any aspect of
society you pick has some connection to it. When you look at the government
and espionage and military issues, personal liberties to voting, it is very
hard to find any issue that does not have some cryptography angle to it.  ?

-- 
-----------------
R. A. Hettinga <mailto: rah at ibuc.com>
The Internet Bearer Underwriting Corporation <http://www.ibuc.com/>
44 Farquhar Street, Boston, MA 02131 USA
"... however it may deserve respect for its usefulness and antiquity,
[predicting the end of the world] has not been found agreeable to
experience." -- Edward Gibbon, 'Decline and Fall of the Roman Empire'

---------------------------------------------------------------------
The Cryptography Mailing List
Unsubscribe by sending "unsubscribe cryptography" to majordomo at metzdowd.com