The Power of Cryptography: A Q&A with Taher Elgamal of Salesforce

On a recent edition of the Early Adopter Research (EAR) podcast, EAR’s Dan Woods covered cryptography, a crucial topic in cybersecurity. To delve into the issue, he spoke with Taher Elgamal, CTO for security at Salesforce. Elgamal was one of more than 30 contributors to the upcoming book by Fortinet’s CISO, Phil Quade, The Digital Big Bang: The Hard Stuff, the Soft Stuff and the Future of Cybersecurity. The Digital Big Bang book puts forth a history-style explanation of cybersecurity and it proposes a framework for creating a truly scientific approach to cybersecurity. Phil Quade’s ambition is to find a way to systematically address many of the problems that have risen because cybersecurity was not properly incorporated into the design of the internet. Taher is an expert in cryptography and he spoke about what cybersecurity professionals should know about cryptography. Woods, a technology analyst and founder of earlyadopter.com, played a role as editor for Phil Quade’s book which came out in preview in April but will be published in August of 2019 by John Wiley. This is an edited version of their conversation that can be heard in full on the EAR Podcast.

Woods: In your contribution, you really make it very clear that a lot of people are crying wolf about quantum computing and how that is going to “break” cybersecurity cryptography and make things obsolete. You argue that this is not going to be the problem that a lot of people think it is. Why is that?

Elgamal: That particular event is something that we are anticipating many, many, many years in advance. The world has time to prepare for how to handle such an event. 

Could you explain why it’s a threat?

With quantum computing, if such a computer were to exist today, then the cryptographic algorithms that we use to secure the web at large would be threatened and would be broken. Because quantum computers have parallel computation capabilities that traditional computers don’t. So, one can actually find all the secret keys that we use to conduct business on the internet or to exchange messages or what have you. By virtue of the parallelism that they can actually deploy when you’re trying to compute a lot of different things in parallel.

So, right now, it would take more time — a hundred trillion years that goes with modern computers but a quantum computer, maybe it’ll take 20 minutes?

Yes. Because it could possibly do a trillion operations at the same time.

You argue that we can be safe in a quantum-powered future. What would we do to make ourselves safe?

The part that everybody is already working on is to find algorithms that are not susceptible to a quantum computer break. There are north of 60 different algorithms that were proposed to NIST. NIST is out looking for a standard and I think they have narrowed the search down to 20-some. So, there are research communities working on finding algorithms that will not be breakable under that quantum computer threat. The flipside is we need to prepare because the scale of the web and the internet today, we actually need to prepare to change things in a better way. There is no agility when it comes to cryptography algorithms. Everything is built-in so for us to change something, we have to perform surgery in hundreds of thousands of different places to change algorithms. And I think part of preparing for such an event would be to inject the agility controls into our vendor products, our ecosystems in almost everywhere so that we can replace things. It will not be completely seamless but it would be an easier way to switch algorithms when we need to.

In other words, the quantum threat has distracted the world of cybersecurity from doing what it should be doing to prepare for not only the quantum threat but for any new changes that come along. What you’re proposing is that instead of having these big black boxes that are powered by a certain type of cryptography, we should have a smaller set of components that create our cybersecurity and we should be able to evolve those or replace those?

Yes, but because we started 25 years ago along this journey and we have not allowed for agility in general, there are certain places where you can replace algorithms but most of the time you cannot. The quantum computer threat is actually a good change agent for us because it’s forcing everybody to think about it rather than change the algorithm because we need to increase the key size or we need a different hashing algorithm, or what have you. We needed to do agility for other reasons but the quantum computer threat is actually a very useful set of events that haven’t happened yet but it’s a good change agent for us.

Is it just the vendors who have to become more agile or can the users of cybersecurity become more agile as well?

The users have to be agile. Vendors need to provide products and services and cloud services, in certain cases, that provide agility but I think the end-users need to ask the questions. People need to know what cryptography is running. It is no longer sufficient that we say, “I’ve got the best cryptography of the standard cryptography,” because not all standards will actually satisfy the requirements that we need.

What do you think the biggest mistakes are in implementing cryptography now? 

The vulnerabilities are often in the implementation of the cryptography algorithms themselves. There are a wide range of attacks that people refer to as side-channel attacks that basically allow you to listen to a conversation that is being encrypted and because of timing differences or such a thing, you can actually defer what the keys are. There are also implementation errors in the software that uses the cryptography algorithm. The most famous one was called Heartbleed in the OpenSSL package several years ago. And that was an error in using cryptography because cryptography needs secret keys and if the implementation can have access to the secret keys to somebody else then, obviously, we’re not going to be very successful. So finding vulnerabilities in the use of cryptography is actually extremely important. And patching, that is just as important.

Ultimately what you’re saying is everybody needs to be a sophisticated consumer of cryptography, they need to know what’s happening a little bit more than people do now and just it can’t be buying the big black box — you have to be understanding what’s going on under the hood.

Yes, everybody needs to ask the questions about which cryptography to adopt? If people are using a third-party piece of software or an open source library, they need to know which one of these and they need to know how to update it and it just does not work anymore to buy a black box. There are a lot of implementations today that use vulnerable cryptography implementations that people maybe do not even know exist.

Author: Dan Woods

My mission: Find technology for Early Adopters. Follow me on Twitter @danwoodsearly and on LinkedIn www.linkedin.com/in/danwoodsearly/. I am a CTO, writer, and consultant. For tech vendors, I help explain their technology. For users, I help find, select, and deploy new solutions that have explosive business value. I love to speak and share ideas.