Understanding Secretless Security

In everyday life, basic security often relies on some form of secrecy. If you have $1,000 in cash under your bed, you are reasonably safe as long as no one knows it is there. Likewise, if you have all your money in a safe and the combination is 35-21-02-31, you can be pretty sure that it will still be there when you wake up tomorrow morning as long as the number remains secret. These security solutions are all based on secrecy, a concept that makes up the most basic form of security possible. If no one knows about it, or no one knows how to gain access to it, then it is reasonably secure. The only problem is that secrets are difficult to keep.

Relying on secrets for security has several weaknesses. For example, secrets have a tendency to leak out. If you talk in your sleep or if you unlock your safe in front of a window, your secret can be easily compromised. Secrets can also be guessed. A thief may look under your bed while in your house, or he/she may steal your safe and spend hours guessing the correct combination. The basic point is that secrets are very hard to keep secret. If you magnify this problem by a few thousand end-users and several administrators, then you will probably be spending more time securing your secrets than securing your valuables.

Secretless Security

The best security solutions are those that rely as little as possible on secrecy for protection. Our strongest forms of protection come from devices and applications that the entire world could know about, and yet would still remain secure. We should never assume that systems will remain secure simply because no one knows where they sit or what their addresses are. Likewise, we should never base security on the idea that a hacker would have to know a great many things about an environment to be able to break in. It should always be assumed that all secrets are going to be discovered. Let's take a look at some classic examples where secretless security is commonly applied.

Open Encryption Algorithms

Many older forms of encryption relied on secrecy for protecting information. For example, the writer of an encrypted message would scramble up the words, and the reader would reverse the process to decode the message. If, however, someone knew how the words were scrambled, they could also unscramble them and thus, would have access to the information.

Most modern encryption is based on secretless algorithms. The computation that is used to scramble and unscramble a message can be known to everyone in the world and yet the encrypted information remains safe. The algorithm is published for the world to see, giving everyone an opportunity to find a flaw and break it. Bad algorithms are broken in a manner of weeks, while good algorithms remain secure.

The weakness of any encryption algorithm exists in its key. The key is the small component that is only known by people with permission to decrypt the information. Therefore, the focus of encryption is mostly concerned with protecting the key.

Open Security Applications

A security application is at its best when the code for the application can be seen by everyone, and yet the application still remains secure. Applications that base their security on a secret provide a very weak level of protection in comparison. As has been proven time and again, the secret will eventually be discovered and the security will be rendered useless. Good security applications never base their security on secrets. I will discuss this more in the section titled Open Source vs. Closed Source Security in Chapter 10, Modern Considerations.

Secretless Authorization

Secretless authorization has been an emerging trend in information security over the past several years. With the dismal failure of secret-based solutions like passwords in protecting large enterprises, many organizations have implemented alternate approaches. Advanced authentication no longer bases its decision on something you know, but also on something you have or something you are. It is much easier, for example, to fake someone's password at an authentication prompt than it is to fake their eye pattern during a retinal scan. I will discuss this further in the section titled, Handling Authentication in Chapter 11.

The Necessary Evil of Passwords

Passwords are the most common form of security based on secrecy. Unfortunately, passwords are everywhere, including at the very start and end of an encryption process. Keeping a large number of passwords secret is extremely difficult if not impossible for large organizations. A high percentage of hacker attacks begin with the use of a stolen or guessed password, making these things one of the biggest problems in modern security. Chapter 11 will discuss the password problem in detail; for now, we will address it as yet another area where security based on secrecy fails. It is important to recognize the incredible weakness inherent in secrecy-based security mechanisms such as passwords. Organizations that must rely on passwords for security should go to great lengths to secure them from unauthorized access.

ZDNet published a good article on the secret password epidemic called "Psst… I Know Your Password"; you can find it at: http://zdnet.com.com/2100-1105-920092.html