Storing Cryptographic Keys in Persistent Browser Storage

This blog post is a companion to a presentation made at the 2017 International Cryptographic Module Conference and refers to the presentation slides, revised after the conference. Karen Lewison is a co-author of the presentation and of this blog post.

Slide 2: Key storage in web clients

Most Web applications today use TLS, thus relying on cryptography to provide a secure channel between client and server, and to authenticate the server to the client by means of a cryptographic credential, consisting of a TLS server certificate and its associated private key. But other uses of cryptography by Web applications are still rare. Client authentication still relies primarily on traditional username-and-password, one-time passwords, proof of possession of a mobile phone, biometrics, or combinations of two or more of such authentication factors. Web payments still rely on a credit card number being considered a secret. Encrypted messaging is on the rise, but is not Web-based.

A major obstacle to broader use of cryptography by Web applications is the problem of where to store cryptographic keys on the client side. Continue reading “Storing Cryptographic Keys in Persistent Browser Storage”

Using Near-Field Communication for Remote Identity Proofing

This is the last of a four-part series of posts presenting results of a project sponsored by an SBIR Phase I grant from the US Department of Homeland Security. These posts do not necessarily reflect the position or the policy of the US Government.

We have just published a paper presenting the last three of the five solutions that we have identified in the research project on remote identity proofing that we are now finalizing. Solutions 3–5 use Near-Field Communication (NFC) technology for remote identity proofing. Each of the solutions uses a preexisting NFC-enabled hardware token designed for some other purpose as a credential in remote identity proofing. A native app running on an NFC-enabled mobile device serves as a relay between the NFC token and the remote verifier.

In Solution 3 the token is a contactless EMV payment card. In Solution 4, the token is a medical identification smart card containing a private key and a certificate that binds the associated public key to attributes and a facial image. In Solution 5, the token is an e-Passport with an embedded RFID chip that contains signed data comprising biographic data and a facial image.

In solutions 4 and 5 a native app submits to the verifier an audio-visual stream of the subject reading prompted text. The verifier matches the face in the video to the facial image in the NFC token, uses speech recognition technology to verify that the subject is reading the text that was prompted, and verifies that the audio and video channels of the stream are in synchrony by matching distinguishable visemes in the video channel to phonemes in the audio channel.

See also:

Remote Identity Proofing Discussed at the Internet Identity Workshop

This is Part 3 of a series of posts presenting results of a project sponsored by an SBIR Phase I grant from the US Department of Homeland Security. These posts do not necessarily reflect the position or the policy of the US Government.

To get community feedback on our remote identity proofing project we made a presentation two days ago at the 23rd Internet Identity Workshop in Mountain View. The slides can be found here. We were gratified that the feedback was positive and there were in-depth discussions with identity experts both during and after the presentation.

We started by explaining the goal of the project. Remote identity proofing has often relied on asking the subject multiple-choice “knowledge questions” (e.g. which of the following zip codes did you live in five years ago?). This method is terrible for privacy, since it relies on the identity proofing service gathering and using troves of personal information about people. Furthermore, due to the proliferation of personal data available online, it has now become ineffective. Continue reading “Remote Identity Proofing Discussed at the Internet Identity Workshop”

Implementing a PKI on a Blockchain

This is Part 2 of a series of posts presenting results of a project sponsored by an SBIR Phase I grant from the US Department of Homeland Security. These posts do not necessarily reflect the position or the policy of the US Government.

In the previous post I described the concept of a rich credential, and how a rich credential issued by an identity source can allow a subject to identify him/herself remotely to a verifier with a key pair, a password, and one or more biometric samples such as facial image, even if there is no prior relationship between the subject and the verifier. That was Solution 1, the first of five solutions that we have identified as possible alternatives to knowledge-based verification in the course of our research project on remote identity proofing.

We have now published a paper on Solution 2. In Solution 1 the identity source was a DMV. In Solution 2 the identity source is a bank.

Continue reading “Implementing a PKI on a Blockchain”

Rich Credentials for Three-Factor Identity Verification without Prior Relationship

This is Part 1 of a series of posts presenting results of a project sponsored by an SBIR Phase I grant from the US Department of Homeland Security. These posts do not necessarily reflect the position or the policy of the US Government.

We have just published a paper on the first of five remote identity proofing solutions, which we have identified as possible alternatives to knowledge-based verification in the course of the research project mentioned in the previous post. The paper describes in detail a new type of credential, which we call a rich credential, that could be issued by an identity source such as a DMV and would enable multifactor identity verification by a remote verifier. In this post I will try to explain the motivations that led us to come up with the concept of a rich credential as the basis of Solution 1.

In-person identity proofing typically relies on the presentation of a picture ID, such as a driver’s license or a passport, as the primary evidence of identity, supplemented by secondary evidence from different identity sources, such as proof of ownership of utility, financial or mobile accounts and address verification. Remote presentation of the secondary evidence is not much of a problem, so in the project we have focused on replacing the picture ID with other kinds of primary evidence that can be presented remotely.

Continue reading “Rich Credentials for Three-Factor Identity Verification without Prior Relationship”

Pomcor Receives DHS Grant to Look for Alternatives to Knowledge-Based Verification for Remote Identity Proofing

Last December we saw a Small Business Innovation Research (SBIR) Solicitation from the Department of Homeland Security (DHS) where topic H-SB016.1-010 called for identifying five or more alternatives to knowledge-based verification (KBV) for remote identity proofing. The topic was motivated by multiple data breaches, which, as stated in the Solicitation, showed that “KBV is broken and rapidly becoming less effective as a verification tool as a by-product of the availability of personal information on social media as well as the variety of data breaches of credit bureaus and data brokers”.

We found the topic very interesting for several reasons:

  • In countries like the United States where residents do not have a national identity card, secure identity proofing is difficult but essential for cybersecurity.
  • Effective methods of remote identity proofing would not only make it easier for residents to seek government services, but would also enable new ways of doing business, such as remotely opening a bank account or applying for a mortgage.
  • Reducing the reliance on knowledge-based verification would reduce identity theft, mitigate its damage, and increase privacy by shrinking the market for personally identifiable information (PII). And,
  • Remote identity proofing has been neglected as a research topic.
Continue reading “Pomcor Receives DHS Grant to Look for Alternatives to Knowledge-Based Verification for Remote Identity Proofing”