In the previous episode of What That Means, Camille delved into the world of post-quantum cryptography. Today, she explores cryptographic services with Eduardo Cabre, who is a Principal Engineer with the Intel Product Assurance and Security Division; they discuss the future threats organizations will face and possible preventions.

We cover:

• The difference between the two kinds of cryptography - symmetric and asymmetric

• What exactly is meant by attestation

• What “keys” are and how they’re generated

• Why encryption is crucial for protecting things like biometrics

• How much of a threat quantum computing could pose to public and private keys in the future

• What kinds of new cryptographic services are in development

... and more

Be sure to tune in, and also check out WTM Episode 46 if you haven’t already for a great companion piece!

The views and opinions expressed are those of the guests and author and do not necessarily reflect the official policy or position of Intel Corporation.

Here are some key take-aways:

• Cryptographic services are essential to securing data in computing devices.

• There are two types of cryptography - symmetric cryptography and asymmetric cryptography; symmetric cryptography deals with the process of encrypting data (typically in very large volumes), while asymmetric cryptography can be used (for example) to authenticate to a remote system using TLS or some other authentication protocol.

• Cryptocurrency uses asymmetric cryptography.

• Quantum computers are good at breaking asymmetric cryptography, quantum-resistant algorithms are in development through organizations like NIST to combat this threat.

• The cryptography system is implemented at a very, very low-level hardware trust level, and is not happening in your CPU.

Some interesting quotes from today’s episode:

“Users expect computing devices to protect their data against unauthorized access, and to do so, cryptography is a very critical tool.”

“The device changes hands a number of times prior to being deployed, and so certainly attestation can be utilized to confirm that the device that you purchase is the device that you received. But in addition to that, attestation can really be executed at any point in time you want.”

“Certainly the private key is the most sensitive part of the key, and so you want to protect it as best you can. If that key leaks, then whoever obtains access to the key can then impersonate that device.”

“As long as the key that is used to encrypt that data resides locally on your device, the encrypted data could live anywhere.”

“Anybody that has access to the public key and a quantum computer will be able to reverse engineer your private key. And that's bad news when that happens.”

“Basically, most network security protocols are based on public key cryptography, and all of those will break effectively. Right? So no more TLS, no more MCTP. All those protocols that utilize asymmetric cryptography for the underlying security will break.”

“We're going to be going from hundreds of millions or billions of keys to dozens of billions of keys in the next few years.”

“The other thing is there is a new concept of platform root of trust, where the platform internally has the ability to interrogate all of its components, obtain evidence that each one of its components is operating in a trustworthy way before the platform boots.”