Father of internet security system says best is yet to come

Every time you supply credit card details over the internet to purchase tickets or a book, you should take a few seconds to thank…

Every time you supply credit card details over the internet to purchase tickets or a book, you should take a few seconds to thank Mr Whitfield Diffie. The security specialist is the father of public key encryption, a concept upon which most websites base their security.

Mr Diffie, an American who lives in California and works with Sun Microsystems, remains modest about his own breakthrough, achieved 25 years ago. However, in an interview with The Irish Times at the Cosac security conference in Killarney, he is confident encryption technology will become more important in the medium term.

"The internet is so valuable as a communication mechanism that people and corporations cannot afford not to use it," he says. "But a lot of the internet is out of people's control and it's only cryptography that makes it safe."

The need for encryption was advanced by the rapid development of radio technologies during the first world war. A similar explosion in demand will be experienced because of the development of wireless local area networks and data mobile phones, Mr Diffie says.

READ MORE

But levels of security and range of services available to users today might have been very different if Mr Diffie and his colleagues, Mr Martin Hellman and Mr Ralph Merkle, had not changed the face of modern cryptography in a paper published in 1976.

Encoding and code-breaking had relied for centuries on the fact that a sender and receiver would have to share the same key to gain access to encoded information. This was a major barrier to the development of security systems applicable to the mass market as it effectively removed the possibility of guaranteeing individual security to large numbers of users.

But in his article, "New Directions in Cryptography", Mr Diffie argues that by splitting the key into two, users could have a public key open to all.

This key would encode messages while a second key, which is capable of decoding the messages, would remain private to the user. Public key cryptography was born.

The discovery had an almost immediate impact, as a team of researchers used the concept to develop public key infrastructure (PKI) software and set up a security firm, RSA. This software can support digital signatures and is similar to that used by Irish firm Baltimore Technologies to protect firms' communications.

Mr Diffie is aware of Baltimore but says he has not followed the firm's strategy over the past few years. His knowledge of Ireland is much more focused on an appreciation of stout.

However, Mr Diffie does acknowledge current difficulties in the internet security market and the fact that public key infrastructure has not been as successful to date as had been expected.

"The major problem with PKI is a capital infrastructure one," he says. "It becomes more useful the more infrastructure you've got." It's similar to owning telephones, he points out. "When just 10 per cent of the population had one, it wasn't very useful. By the time, 99 per cent had one, they were crucial," he adds.

A large rollout of PKI would be very costly so it's likely to be structurally slow-growing. Government investment may be required to overcome this, he says.

However, Mr Diffie is no friend of central government. With his long hair and commitment to protecting people's privacy, he remains something of a rebel in the US, where he has campaigned against restrictive legislation since the 1970s.

"I can't claim to be an enthusiast of the RIP Bill in the UK, although, in the US lately, we have made some progress."

An export ban by the US government preventing firms from researching secure communications technologies - one of the main reasons why security firm Hush Communications set up in the Republic - was recently removed, he says.

But Mr Diffie notes that a new threat is posed by the music industry's promotion of digital copyright legislation, which could impact on security research.

The long term future of cryptography is less clear because of major changes in society promoted by mass communications, he believes.

"The world is much more likely to become integrated over the next thousand years," he says. "Cryptography is appropriate to a society with public independence. Human autonomy seems to have little chance against evolving communications. Perhaps a different security will be required then."