Glass Class - Cloud Encryption: When 256-bit AES Isn't as Strong as Advertised
Hi I'm Rich Campagna with Bitglass and thanks for joining today's Glass Class session. Today we're going to be talking about cloud encryption and specifically when is 256-bit AES not what it's advertised to be. Let's first look at a couple of the basics of encryption.
A typical encryption scheme includes two components. One is the cipher, and the cipher is what takes human-readable text and translates it into what's known as cipher text, or something that's not readable by a human. The most common cipher in use today in most organizations is 256-bit AES.
There's another component to encryption that's equally as important, that's what's known as the initialization vector. The initialization vector is what gets us randomness in our cipher text. It's a seed that appended to the front end of the plain text before it's run through the encryption algorithm. This is what ensures that if I encrypt the word Chris as an example it's translated into something entirely different every single time I encrypt that word.
When you look across this encryption scheme the effective strength of your encryption is the lesser of these two. In other words if I have 256 Bit AES but only had 10 Bit initialization vector, the effective strength of the encryption that I've now achieved is 10 Bits. Certainly if we're going to go for the type of organization that is security conscious enough to want to encrypt data at rest inside of a cloud based application, 10 Bit encryption is just not going to cut it.
Let's look at some of the tricks that served that first gen of cloud encryption gateway vendors have taken. If you look at some of their materials on their website, their marketing materials. What they'll advertise on their data sheets is exactly that well known, government grade, cipher AES-256. Then you dig into the details, the fine print, so to speak. What you'll see is something like this ... Millions of IVs. Millions of Initialization Vectors. Millions sounds like a great big number. When you break this down one million is less than 2 to the 20th ... Or 20 Bit encryption.
We've gone through the process of selecting a vendor for cloud encryption, we start rolling it out. We turn on AES-256, but what we have here is millions of initialization vectors. What's the reason behind this? Why would you roll out a scheme that is less than full strength encryption?
The challenge is with a cloud based application, as soon as you encrypt data that data can no longer be operated on by the application itself. Preserving a function like search is critically important. You're not going to use SalesForce.com if you can't search across the data to find who the contacts are, as an example, that are stored inside of that CRM system. That's what these vendors do, they'll limit the strength of the ... Limit the length of the initialization vectors in order to accomplish things like search and other operations of the application itself.
At Bitglass we have a patented approach to full strength, searchable, cloud encryption. With none of the limitations of the first generation of cloud encryption gateways. If you want to find out how we do it, stay tuned for the next Glass Class session. We'll be breaking it down exactly.
Thanks for joining today's session, my name is Rich Campagna.