eWEEK content and product recommendations are editorially independent. We may make money when you click on links to our partners. Learn More.
New technology from RSA Security Inc. could hobble hackers ability to make off with user information—from Social Security numbers to simple passwords—through the compromise of a single machine.
The Nightingale system, being revealed this week at the companys RSA Conference in San Francisco, is based on a venerable cryptographic concept known as secret sharing and first advanced by RSA co-founder Adi Shamir in the 1970s.
The idea is to split encrypted data into two parts and store each half on a separate server. Because of the way the data is divided, discovering half the ciphertext does not allow an attacker to ascertain the other half and, thus, the secure data.
RSA officials said Nightingale will help solve many problems associated with securing personally identifiable information such as Social Security numbers, bank records and even simple passwords.
The most intriguing commercial application of the technology is likely to be its use as part of a “roaming authentication” service, such as Microsoft Corp.s Passport. Because the Nightingale system can transmit keys for portable credentials without seeing the keys themselves, sensitive user data need not be stored at a central vendor location, such as Microsoft.
“A normal server represents a single point of compromise. We can eliminate that by two means. One is the secret splitting, but the second, and perhaps more important method, is putting the Nightingale server behind the application server,” said Ari Juels, a research scientist at RSA Labs, in Bedford, Mass., and the driving force behind the new technology.
With Nightingale, users log in to an application, such as a home-banking system, via a trusted client. When users enter the correct ATM card number and PIN, the PIN is encrypted, and the resulting ciphertext is split. Half the ciphertext is stored on the application server, while the other half goes to the Nightingale server.
|
WHAT CAN NIGHTINGALE PROTECT?
|
If the user forgot a PIN and needed it e-mailed back, each server would send its own portion of the encrypted data to the customer, whose machine would then reconstruct the data. Key to this system is that at no point does either server see both portions of the ciphertext. As such, the system can check whether the PIN submitted by the user is the same as the one the user has stored, without reassembling either number.
Security experts say the technology shows promise but might have some limitations initially.
“An inside system administrator who can access all the systems in which the secrets are stored will still be able to get information. To prevent this, the very structure of the security and systems management organization must be adjusted,” said Stuart Schechter, a security researcher at Harvard University, in Cambridge, Mass. “Social engineering attacks are usually used to attack individual data, and these attacks will still work if individual data can be accessed by insiders on a limited basis, as is necessary with medical records.”
Nightingale can also be used in authentication. It will be sold first as a tool kit, which is available now, then integrated into RSAs Passage platform later this year, officials said.
Most Recent Security Stories:
Search for more stories by Dennis Fisher.
Find white papers on security.
For more security news, check out Ziff Davis Medias Security Supersite.