John Markoff's writes in today's New York Times about research done at Princeton University and sponsored in part by the Department of Homeland Security that proves the vulnerability of computer data stored using today's encryption standards. It turns out that while the data is safely encrypted using advanced security algorithms, the encryption keys are stored in unencrypted form, allowing them to be stolen from the memory chips on which they reside. So if someone gets possession of your computer, they can freeze the chips and read out the data containing the encryption key, giving them the ability to access all your encrypted data. (Link to article)
It's not a living-room technique likely to be used by a common thief, although it takes nothing more than a can of compressed air to freeze the chips. However it raises questions about the standard assumptions many people make about security and the efforts criminals or intelligence agencies may make when they have a high-value target. There are ways to separate the key from the computer containing the encrypted data – for example, putting the key on a USB flash drive or a smart card – but those additional measures require extra effort for the computer owner and thus inhibit the adoption of stronger security practices.
Does this mean that data sent over the internet to data centers for backup and disaster recovery purposes and stored in encrypted format is vulnerable? Probably not, for several reasons. The research did not prove a vulnerability in the data encryption itself; it showed that the current method of storing encryption keys was vulnerable. So it's the equivalent of saying that the locks on the house are providing good security, but if someone can find out where you hid the key under the rock in the garden, they can open the doors and get into the house. The research was aimed at personal computers and laptops in which the encryption key was stored on memory chips on the same device. Separating the storage locations for the key and the data is a significant barrier – and if the key resides on a computer system miles away from the encrypted data, and further requires authenticated access to the account using an account identifier and user password, the risk is considerable lower.
The Princeton results might actually make a case for more extensive use of remote data storage facilities for sensitive data. Presumably the data would never get into the physical possession of criminal elements (we have to leave out government access to facilities and the possibility of willing or forced cooperation of the data center under national security justifications, legal or otherwise). With the growth in cloud computing in which information assets are kept on servers in data centers and accessed over the internet, the Princeton researchers have made another case for thin-client computing, in which the local device is nothing more than a terminal providing a screen, keyboard, and network connection to the data, and holds no data locally.
There are other risks in this scenario – what if the USB key or smart card is lost or stolen? With enough information about the owner of the device and the associated accounts, secure data might be compromised. But it would be much harder to gain access to the data – and there are always risks, which is why having a set of sound security policies and practices is the only way to reduce vulnerability (the "attack surface") and to be able to manage quickly the problems resulting from a security breach.
