Public-key encryption is considered to be a
mind-bogglingly abstract and confusing concept by a wide range of
people, which hinders its deployment on the one hand (eg., for
securing e-mail), and erodes security on the other (eg., when a user
cannot make an informed decision whether to accept an unverfiable
certificate or not).
(This article is somewhat
obsolete.)
A while back I spent a few days worth of idle time on subways and
under the shower trying to find good metaphors for crypto primitives,
and failed to find one for digital signatures or MACs. Now, the
blindingly obvious answer came to me in a dream. Of course it was one
of those dreams where you invent a device to advance civilization by a
hundred years, but once you are fully awake you don't remember the
technical details and have to start all over again. But at least it
made me start all over again. Here is what I came up with. (I also
googled
for the subject real quick, but couldn't find anything. I will post
any pointers you send me as a PS below).
If you encrypt a message, what you do is you put it into a vault
that nobody can open without the right key. (More often, the notion
of sealed envelope is used, but I like vault better because
it makes it more plain that penetration is hard. If you want to get
sophisticated, you can imagine a mechanism that breaks an acid flask
inside the vault and destroys the message if you try to force it open.
The idea is attributed to DaVinci, although I suspect it to be older,
and became widely known recently by a poorly written and exceedingly
famous novel on the wrong-doings of the catholic church.) If you
decrypt it, you put use the right key to open the envolop, and take
out the plaintext message.
Now, from our experience with door locks, we expect there to be two
identical copies of the key; one is used to close the vault by the
sender of the e-mail, and one is used to open it by the recipient.
However, it turned out
that what we want to do can be restated as follows: The recipient
gives the sender a machine that produces vaults (let's call it
vault-manufacturing machine and give it an acronym: VMM). These
vaults come out of the machine open, the door can be closed without a
key, and only the sender can open the vaults with her key (and discard
them after having taken out the message).
The VMM is better known as the public key, the key to open
vaults is called private key. If you configure a
cryptosystem like PGP or S/MIME, you generate a pair of VMM and key to
the vaults. Then you hand over (a copy of) the key to anybody who
wants to send you a message in private, and only you can open any
incoming vaults with your private key.
Math: The VMM is called K_pub, and the vault-key is called K_priv.
Encryption, ie., producing a vault, putting a message M in, and
closing the door, yielding a securely closed vault C, is written C =
E(K_pub, M). (Non-metaphorically, C is called the ciphertext.)
Opening the vault, yielding the plaintext message again, is written M
= D(K_priv, C). A cryptosystem consists of three methods: One for
generating key pairs (K_pub, K_priv), one for encryption called E, and
one for decryption called D. RSA and ElGamal are the most prominent
representatives of public-key encryption methods. Products like PGP,
S/MIME and SSL all can use varying methods, depending on the
configuration, but the structure is always the above.
Data integrity (or the
equivalent, message authenticity) means that nobody can mess
with your data or, in other words, that the vault is
transparent. A digital signature method is that similar to a
public-key encryption method, but somehow the other way around: The
VMM is kept private (as are all vaults that haven't been sealed /
closed yet), and the key to open the vaults is published for everybody
to open the vault and take out the message.
Hm. This is still a little too simple to be useful. Signature
vaults have two important features:
- A vault can only be opened once, by breaking it; it is never shut
again with a new message inside, but discarded. (The only person who
can sign messages is the one in posession of the VMM, because it is
the only source of vaults that have never been closed yet.)
- It is infeasible to build a vault that opens on a given key, if
you haven't generated the key together with the VMM.
Hm. The second one is where the metaphor breaks. Up to this
point, I was hoping to be able to break both digital signatures and
public-key encryption down to security against lock-picking, but this
only works with encryption. For digital signatures, we need a signet
ring that is so intricate that nobody can realistically forge it.
This signet ring is part of the VMM, and each glass vault is embossed
with the signet. The VMM-holder publishes an inverse signet that can
be pressed into the vault's door, and you can see whether the two
match or not. If you get a match, you know that what's in the vault
is authentic, and you can decide to open it or not. As long as you
leave the vault sealed, the message is intact. As soon as you open
it, the message become just a piece of unreliable data to anybody who
receives it from you; only you still know about its origin and
integrity.
This is not entirely satisfactory either: Nowadays, signet rings
are as good as signets, because a signet can be turned into a ring to
produce more signets easily. However, signet forgery used to be an
obstacle few adversaries where capable of overcoming. Hence, it used
to be a valid method for enforcing message integrity. So maybe this
is a good way of explaining it after all? I am not as sure any more
as I was this morning.
Metaphors are vital for making cryptography accessible to a wide
range of people in a robust way. Many people have made the (seemingly
obvious, but nevertheless important to mention) point that security
without usability is no security; insert your favorite link here.
However, metaphors for digital signatures suck. Legislation and
administration have been on the project of making digital signature
technology widely available to society for many years, and with
disappointing success. I claim that there is a good reason and a bad
reason for this:
- Many technical issues with the wide deployment of digital
signatures have not been satisfactorily addressed, most of them about
key management and secure key distribution. However, I don't believe
that would keep the technology from being a success: If you look at PC
operating systems, you will notice a strong correlation between
vulnerability against malicious code and popularity. This is a
perfect example that usability is the key to success of new
technology.
- And then there is usability. This may be considered the bad
reason. One might hold the opinion that bad technology that is easy
to use should be less popular than good technology that is challenging
and complicated to use. But it is the reason that hinders deployment
of digital signature technology.
The glass vault with signet is a disappointment. It is clumsy and
complex to understand, and dubious to trust, given the experiences of
our world as opposed to that of a medieval king. But at least it's a
little different from all the other explanations that I have heard of
so far. I have posted it anyway in the hopes of inspiring somebody
(me?) to finally come up with the perfect, simple-and-stupid,
straight-forward explanation that captures aspects of usage as well as
of security.
And if this should ever happen, good metaphors are still missing
for a vast number building blocks. Start with blind signatures: You
can hand over an opaque vault to somebody who wraps it into a glass
vault, and then you remove the opaque vault without opening the glass
vault that contains it and can basically not be opened without
destroying the glass signature. This is quite far from intuitive.
