Crypto Expert: Moore's Law fuels app obesity epidemic

Cryptography is no mean field. After all, the science was invented by humans for the purpose of concealing information from other humans. That means that the best cryptographers have to be blindingly smart, with a mastery of mathematics but also a firm grasp of human psychology and, these days, fields such as computer science.

Paul Kocher, president and chief scientist of Cryptography Research is a good example of the breed. A cryptography superstar, Kocher is credited with helping discover two different techniques for defeating certain kinds of encryption algorithms. He’s also a corporate executive who’s devoted his life to helping create cryptographic applications that can be used in the real world.

Kocher sat down to talk security with InfoWorld Senior Editor Paul F. Roberts at the recent RSA Security Conference in San Francisco. Despite making his name by poking holes in encryption, Kocher says that crypto hacks are the last thing enterprise IT should worry about. A much bigger problem is wrestling with the security implications of application and OS “supersizing” that is being fueled by a new generation of powerful processors.

InfoWorld: Tell us a bit about the history of Cryptography Research and how the security environment has changed since you first started the company.

Paul Kocher: I started Cryptography Research 11 years ago. When I first started working on these problems, we were still at the point where you could understand how systems work. This was back in the DOS days. You had 640K of memory and could run one program at a time. These days, I have no clue what’s running on my laptop. And you probably have no idea, either. There’s too much software there. Moore’s Law has created obesity in systems, so when you’re trying to come up with ways to keep things secret despite this, it’s an enormous problem.

IW: Cryptography is often followed as a kind of arms race, with people who want to make stronger encryption pitted against those who want to break it. Is that the wrong discussion to have?

PK: There are a few pieces that are strong. The math behind modern algorithms is incredibly robust. That’s the thing most people focus on: “We have this brick and it’s really strong, so if we have a system that includes this brick, it will also be really strong.” But implementations are where the problems lie. People tend to get enamored with the cryptography and the algorithms and not pay attention to other things that end up failing.

IW: You talk about the “brittleness” in much of application security. If you were an enterprise shop with internally developed applications, what steps would you take to reduce that brittleness?

PK: One thing I’d do is just step back and have the engineers think about how they would attack the system. It’s a different mind set than how to build features. You start looking for that thread that lets you in, and you learn something useful. Also, try to build your application so that it doesn’t need sophisticated security capabilities. If you’ve got an application on the Web where it’s exposed to outside attacks, just leave the feature out that’s going to create the risks.