“REALSEC’s Encryption and Digital Signature proposals are highly valued in Latin America”
– Digital signature has mathematical algorithms that protect the information and authenticity of the signature and management such as SHA. What other security measures make up digital signatures? What are the security components of digital signatures?
Basically, the keys used to sign make up the security of digital signatures. Especially the private key, which should never be ceded and should be jealously custodied.
For the generation of these keys to be correct and secure, it must comply with very important premises:
- Absolute randomness, with generation based on entropic variables.
- Total primality among key construction mathematical components. Obtained through the most efficient primality tests.
Without these two conditions, private keys (with which it is signed) can be weak in the face of mathematical attacks.
And they are not met when they are generated by a general purpose computer. But they are met when these keys are generated by a cryptographic device such as an HSM, Hardware Security Module.
– How are these algorithms conformed?
Both signature (encryption) and verification (decryption) are mathematical exponentiation calculations.
Because of this, we clearly perceive an increase in execution times as we increase the length of the keys (they act as exponents and exponentiation is the most “hard” basic calculation for a common processor).
– What new processes are you implementing to ensure security in addition to SHA 1 and SHA 2?
Actually, hashes (digest or summary) act more as data to verify than as a security element in its purest sense.
Obviously, it is the data that is encrypted with the private key, constituting a proof of the integrity and non-alteration of the signed document.
It is an unrepeatable summary calculated on the set of bytes that make up the document. Altering a single bit in the file involves obtaining a different hash.
Thanks to this, you can calculate the hash (and therefore sign) any type of digital file; including graphics, video, voice…
For some time now, SHA-1 has been out of security certification. This was because, by statistical empirical methods, it was shown that there was a certain (although minimal) risk of a “collision” (same hash result from two different documents).
The protocol that is used today to perform a “hash” encryption is SHA-2, which is a derivation of SHA-1 but with the security issue, which I have mentioned before, resolved.
Both algorithms and cryptographic protocols and functions are secure until, over time, an expert cybercriminal proves its vulnerability. To avoid this type of risk, the National Institute of Standards and Technology (NIST) publishes and recommends the use of new cryptographic protocols, discouraging the usability of others as vulnerable.
As an example, although SHA-2 is a standard recognized by NIST as secure, the same body published in 2015 the availability of SHA-3, which although is not a derivation of SHA-2, is very likely to replace SHA-2 as standard in the near future. This kind of things are part of the process of evolution and improvement of Cybersecurity.
– How are these algorithms integrated into the final system?
If by final system we mean a fully constructed digital signature, we must distinguish two different sets:
- The main and cryptographic core. It consists of the hash of the document encrypted with the private key.
- A wide variety of additional data that “self-document” the signature: hash method used, date and time, certificate, etc. With all this information, who receives the signature, apart from verifying it, can validate the signer’s certificate and decide whether to give that signature confidence.
– Could you explain the following types of electronic signature, how are electronic certificates generated for each of them and if there are different security components in each one: centralized signature, biometric signature and local signature?
Let’s start with the biometric signature, which has nothing to do with the others. First, within the biometric algorithms and data to be captured on the individual, many and very diverse data can be used. Also, in the so-called biometric signature, there is no Recognized Certification Authority attests the identity of the holder; or is not subject to internationally recognized technological standards, perfectly guided, that allow a global exchange contemplated by the laws of each country and allowing the full confidence of the recipient of a signed document.
The best biometric algorithms yield a significant percentage of “false positives”, becoming a valuable instrument of identification and not authentication. That is, they are useful for police evidence search methods in which a 90% chance has value if it is added to other evidence.
However, digital signature (with legal value worldwide) guarantees 100% the uniqueness of the private key. And a supervised (reliable) Certification Authority attests the identity of its exclusive holder.
Centralized or local is just a matter of which secure cryptographic device the private key is stored on: whether a pocket key or a shared central key. We should discard the storage on a computer that only hides the key, does not prevent its proxy or clearness.
Pocket or centralized, which one is safer? A question similar to that of our savings, at the bank or at home? Our savings can be centralized in the vault of a bank shared by thousands or millions of savers, although only each holder has access to be able to dispose of their money…
You can also be in a small safe at home… Exactly the same, private keys can be stored on a single local device, with unique and exclusive access from each holder. Or each holder is responsible for possible theft, loss, deterioration by carrying it on a small “pocket” device.
In these two cases, the certificates are the same and the security components are also the same (except as stated above that the dispersion itself increases the risks).
– What aspects should be taken into account when hiring the service provider to generate the electronic signature?
I suppose you refer to the generation of the certificate that is used to perform electronic signatures.
Certification Service Providers (CSPs) should be recognized and supervised by the competent authority in each country where they are located.
- Appear on the TSL (List of Reliable Providers) that each country publishes on the Internet.
- Appear in that TSL the modality, type or certificate that it offers us (some certifiers have types of certificates accredited and others that are not).
- If the country does not already have a TSL, Web Trust accreditation may, by default, serve as a support for trust.
– Is it wise to revoke a certificate and generate a new one from time to time? How much does this involve in costs?
Generating a pair of new keys (in theory the holder should do so and not the certifier) is always a measure of prudence in order to avoid risks of attacks on the key “by brute force” (iterations until found it).
It should always be done after a period of existence of the key significantly less than the estimated computing time as necessary to take over.
Another thing is that, in addition to this need, the need for funding from Certification Service Providers is added.
– What can breach security?
The factors that put security at risk are basically two:
- Mathematical weakness of the key
- Pseudo-random predictability
- Non-primality of key components
- Inadequate choice of public key exponent.
- Storage of the private key on a non-cryptographic device
- Transfer of access to the key to third parties
- Defects in device custody or access PIN, etc.
– Please, mention some recommendations for a good use of this resource without compromising security.
On the user’s part, they are the same ones that they are always hearing about bank cards or similar:
- Never lend it.
- Store it securely and in a cryptographic device.
- Take care when you type the PIN.
In short, all protections aimed at ensuring the personal exclusivity of use.
– What recommendations should we consider when signing digitally?
In my opinion, we should consider three things:
- That the signature is based on the use of a digital certificate that has been issued by the PKI of an accredited certification entity, so that the digital signature has legal validity.
- That the private key of the certificate used in the signing process is not exposed, and we have it custodied and protected in a secure device to avoid the risk of phishing.
The most reliable option is to store and custody that key in an HSM (Hardware Security Module).
- The validity of digitally signed is subject to the validity period of the certificate used in the signing process so it is advisable to renew that certificate so that the signature continues to have legal validity.