The Use of Cryptographic Techniques in Europe

[Deliverable – 2011-12-19]

Updated on 2012-04-20

Contributors to this report

Authors:  Edward Hamilton and Mischa Kriens of Analysys Mason Ltd  Rodica Tirtea of ENISA Supervisor of the project: Rodica Tirtea of ENISA ENISA staff involved in the project: Demosthenes Ikonomou, Stefan Schiffner

Agreements or Acknowledgements

ENISA would like to thank the contributors and reviewers of this study.

Study on the use of cryptographic techniques in Europe III

About ENISA

The European Network and Information Security Agency (ENISA) is a centre of network and information security expertise for the EU, its member states, the private sector and Europe’s citizens. ENISA works with these groups to develop advice and recommendations on good practice in information security. It assists EU member states in implementing relevant EU legislation and works to improve the resilience of Europe’s critical information infrastructure and networks. ENISA seeks to enhance existing expertise in EU member states by supporting the development of cross-border communities committed to improving network and information security throughout the EU. More information about ENISA and its work can be found at www.enisa.europa.eu.

Contact details

For contacting ENISA or for general enquiries on cryptography, please use the following details:  E-mail: sta@enisa.europa.eu  Internet: http://www.enisa.europa.eu

Legal notice

Notice must be taken that this publication represents the views and interpretations of the authors and editors, unless stated otherwise. This publication should not be construed to be a legal action of ENISA or the ENISA bodies unless adopted pursuant to the ENISA Regulation (EC) No 460/2004 as lastly amended by Regulation (EU) No 580/2011. This publication does not necessarily represent state-of the-art and ENISA may update it from time to time. Third-party sources are quoted as appropriate. ENISA is not responsible for the content of the external sources including external websites referenced in this publication. This publication is intended for information purposes only. It must be accessible free of charge. Neither ENISA nor any person acting on its behalf is responsible for the use that might be made of the information contained in this publication. Reproduction is authorised provided the source is acknowledged. © European Network and Information Security Agency (ENISA), 2011

Study on the use of cryptographic techniques in Europe 1

1 Executive Summary

The increasing use of e-government services has led to significant growth in the amount of citizens’ sensitive data being transmitted over public networks (e.g. the Internet) and stored within applications that are accessible from anywhere on the Internet. Data leakage or security breaches in such systems have a direct impact on the right to privacy and may have legal implications. Moreover, citizens are exposed to financial risks, if financial information (e.g. banking details) is disclosed. Lastly, due to the quality and the quantity of data, leakages expose citizens to various risks and can cause substantial reputational damage to official bodies. Beside other measures, the correct use of cryptography minimises certain threats and secures e-government services. This study examined the cryptographic documents and specifications defined by European Union (EU) Member States (MS) related to the encryption of unclassified information stored and transmitted by e-government services. This study surveys cryptographic guidelines, requirements and specifications defined and used by the Member States (MS). It relies on answers received from 13 MS, covering almost 75% of the EU population; detailed answers for the questionnaire have been received from 11 countries covering more than 61% of the EU population. Additionally, selected members of the European ICT industry have been asked to provide feedback on their experience of working with, deploying, auditing and testing MS cryptographic solutions. The survey indicates that many cryptographic specifications/recommendations prepared and used for e-government services recommend good practice encryption algorithms. However, according to the feedback provided by IT industry, many of the cryptographic solutions that they audit and test are poorly deployed; in many cases the deployment teams for systems/services handling unclassified information are lacking cryptographic expertise. This all leads to the following findings and recommendations.

 Cryptography is continuously evolving. This is driven by increasing processing power, enabling weaker cryptographic solutions to be broken by brute force, weaknesses being identified in certain cryptographic solutions and technological advances. To overcome these challenges designers must consider the system’s expected lifespan and ensure that the selected encryption algorithms have the potential to last for at least that period. Organisations must pro-actively review their encryption documents and solutions, updating them in line with the changing circumstances. Clear processes for withdrawal of compromised or algorithms, or those that are too weak, must be included in the policies.  Many encryption policies assume that the reader has a good level of knowledge of cryptography. However, often this is not the case – especially for services handling unclassified information – and readers struggle to grasp essential information. Cryptographic guidelines need to target such a readership and need to be tailored for their

use in order to maximise the benefits. Best practice needs to be promoted; clear guidelines and policies need to be developed.

Many of the MS, the USA and Japan have government programmes and bodies to define cryptography standards, specifications and/or recommendations, which are used to secure egovernment services. However, still some MS develop cryptographic recommendations for each e-government service in isolation. The authors strongly recommend bundling such efforts, at least at an MS level. Significant benefits are expected from an EU-wide initiative to specify a common minimum standard for cryptography of unclassified data in e-government services. From a long-term perspective this would not only ensure a certain level of protection for all EU citizens, but also would simplify the exchange of government data between MS – which becomes increasingly important with the increasing mobility of citizens. Providing these guidelines publicly, other stakeholders will benefit from such an initiative, for instance could bring economies of scale to the commercial market outside e-government services.

Study on the use of cryptographic techniques in Europe 3

2 Introduction

Over the last decade there has been a significant migration to e-government services, with numerous government departments offering their services online. According to EUROSTAT, in 2010, in the EU 27 MS, the online availability and interactivity of public services reached 84%, up from 58% in 2007. This shift in service provision has meant significant growth in the number of applications that provide services over public networks (e.g. the Internet) that are marked as ‘unclassified ’. Just because a system is unclassified, it does not mean that there are no issues concerning IT security. Data leakage or security breaches in such systems have a direct impact on a citizen’s right to privacy and may have legal implications. Furthermore, they can have a significant impact on, and cause substantial reputational damage to, official bodies. One area of security controls that can be used to minimise the threat and secure these applications is cryptography. In its proposal for a European Digital Agenda , the European Commission is aiming towards “building people's trust in using the Internet”, thereby creating conditions for the Internet ecosystem to flourish. This can be achieved by safeguarding the integrity of information, protecting the source of information and protecting personal data, securing the privacy of the individuals; while protecting the underlying network infrastructure and supporting services. The cryptographic recommendations and specifications that MS promote have a direct impact on the privacy of European citizens. When configuring encryption for instance, there are many settings, and management choices to be made, that have direct implications on the level of security and privacy that the encryption solution provides.

2.1 Terminology

This study is structured such that a general audience can understand sections of the report (Sections 1, 2, 5 and 6), while significant parts of other sections (Sections 3 and 4) would benefit from an understanding of cryptography. Background information regarding cryptography is summarised in Annex C, while a Terminology and Abbreviations list is provided in Annex D. Furthermore, there are numerous books, (a 5 6 small selection is outlined in a footnote ) and online books , which the reader could refer to for a wider understanding of cryptography.

2.2 Scope

This study investigated the cryptographic specifications and recommendations used by governments to protect unclassified data. ‘Unclassified’ is the lowest level of government protective marking. This study does not cover the use of cryptography to protect classified information.

2.3 Methodology

In undertaking this study, the business requirements for communicating and holding unclassified data were examined. For this purpose three core categories of information exchange and storage requiring cryptographic techniques were identified:

 communications between citizens and their governments, typically using web services  data being shared between government bodies across public networks (e.g. the Internet)  unclassified data being stored within publicly accessible web applications, which because of the aggregation of stored data could have a significant impact on governments if a security breach was to occur (for example, reputational damage from an unclassified web service being compromised).

To undertake this study, a survey has been prepared: The authors identified the key government bodies responsible for the definition of cryptographic documents for protecting unclas-

Study on the use of cryptographic techniques in Europe 5

sified data within EU MS, and requested that they complete the survey. In parallel, we contacted a range of IT service organisations across the EU to obtain their opinion regarding the experience with government bodies when implementing/testing/auditing/consulting egovernment cryptographic solutions.

2.4 Limitations

This study relies on the responses provided by experts and contacts from EU MS on a voluntary basis to our questionnaire. In a number of countries, the agencies maintaining cryptographic specifications for the use in the context of classified information are also providing guidelines/recommendations for the use of unclassified information; experts from some MS avoided discussing the cryptographic specifications for unclassified information.

2.5 Target audience

The intended audience for this report includes policymakers and e-government departments defining national and departmental documents on the subject of cryptography. This report is also of interest to organisations designing, implementing and utilising online services that require cryptography and which wish to educate themselves about the practices of their peers with regard to cryptography.

2.6 Short overview of findings

Outlined below is an overview of the core findings of this study.  Some policies allow the use of encryption and signature algorithms that are considered to be weak by experts in the cryptographic community.  A relatively large number of MS recommendations allow the storage of encryption keys within the operating system of a device. If the security of the device is compromised the key can be extracted easily and used to decrypt the data.  Many documents treating the subject of encryption assume the reader has a good level of cryptographic knowledge, however, often teams developing solutions lack experts in cryptography (when developing services for unclassified information).

 Good cryptographic solutions not only consist of technology, but also of a set of processes. Many of the solutions that are currently being deployed do not have the appropriate level of supporting processes.  Cryptography is continuously developing. Weaknesses are identified in cryptographic algorithms every day and the processing power of IT systems is continuously improving. This means that cryptographic algorithms that were once considered secure may no longer be secure in practice.  Some government bodies appear to be developing cryptographic policies in isolation. Many MS, the USA and Japan have government programmes to define cryptography standards and recommendations.

2.7 Structure of the study

This sub-section outlines the structure of the study. This report is laid out as follows:

 Section 3 – a presentation and analysis of the results of the surveys  Section 4 – an overview of the cryptographic specifications (and how they are developed and maintained) outside the EU and some initiatives at EU level  Section 5 – concluding remarks  Section 6 – our recommendations  Section 7 – references.

The report includes a number of annexes containing supplementary material:  Annex A includes the most relevant cryptographic specifications in MS (based on the survey); the standards which were mentioned in the answers to the questionnaires; and some recommended standards (based on the industry interviews)  Annex B is a summary of the commonality of the cryptographic specifications outlined in the survey  Annex B list the questions from questionnaire addressed to MS bodies and from the interviews with industry experts  Annex C provides background information regarding cryptography  Annex D lists the terminology, abbreviations and references used within this document with a description.

Study on the use of cryptographic techniques in Europe 7

3 Survey results

The survey consisted of two core parts: the primary part, a questionnaire sent to a wide range of government departments across MS that are involved in designing and implementing unclassified government services, such as e-government, telemedicine, e-procurement and eidentity. The secondary part supported the investigation and consisted in conducting interviews with cryptographic specialists working in organisations providing services to EU governments. Three different types of process and service have been considered within this study:  secure access for citizens to web services  encrypting communications between servers  encrypting data within applications.

This section of the report provides a breakdown of the results of the survey, and provides recommendations to improve security practices. The survey defined four areas of interest:  general information regarding the information sources that are used to define an organisation’s cryptographic policy  the type of cryptographic tools used to protect network traffic between citizens’ PCs

and e-government applications

 the cryptographic techniques recommended for protecting data stored within e-

government applications and databases

 the cryptographic techniques used to protect network communications between servers, e.g. the exchange of data between two different departments.

Each MS was contacted to request their participation in this study. Outlined in Figure 3.1 is a graphical representation of the MS who responded to this study. ENISA received information from 13 countries consisting of 74.9% of the EU population. Outlined in the sections below are the core findings of the survey:  From Sub-section 3.1 to 3.12 inclusive, the content and analysis rely on the answers received, based on the questionnaire, from the countries where encryption policies have been identified (covering 61.3% of the EU population)  Sub-section 3.13 covers the responses of industry experts that participated in the interviews.

3.1 Availability of cryptographic policies

A cryptographic policy is a document that defines how a cryptographic solution should be configured and operated. Outlined, in Figure 3.2 is a representation of the survey results by population. At the time of the survey, 61.3% (by population) of European citizens’ government bodies had a defined encryption policy for unclassified information, and 13.5% utilised a risk management process .

Study on the use of cryptographic techniques in Europe

3.2 Surveyed cryptographic policies (by type of application)

The surveyed cryptographic policies were mostly designated for e-government services and eidentity applications (46% and 54% respectively) while only some of them were addressing ehealth, e-education or e-procurement. Figure 3.3 provides the answers for the question: ‘what application types are you/your team/your organisation responsible for defining/implementing cryptography (select all that apply)?’

3.3 Data recommended to be encrypted

When and how encryption should be used is often a source of confusion. In fact, 64% of respondents to the survey stated that they recommend encrypting all data that is traversing a public network from the citizen to e-government applications. With web applications, encrypting the whole session can cause issues in terms of web caching (of graphics and other static information) and significant slowing of page load times. However, the performance impact of encryption is decreasing through hardware improvements , and confidentiality of information could be compromised by partial encryption. It is recommended that when deploying web services, sensitive data is encrypted while trying to maximise the performance of the application. Selected data based on legal and regulatory requirements 36%

3.4 Encryption of data between the citizens and e-government services

Across Europe, numerous MS have migrated their citizen services to Internet-based applications, enabling citizens to access services by simply using a standard web browser. By default, the communication between a web browser and an application is not encrypted. Secure Socket Layer (SSL) and Transport Layer Security (TLS) are the main encryption protocols that can be used to encrypt this type of network traffic. Within SSL and TLS there are multiple versions

Study on the use of cryptographic techniques in Europe

and the new versions are considered more secure than the old ones. For more information regarding SSL/TLS see Annex C.

Outlined in Figure 3.5 are the cryptographic protocols that are recommended for use by respondents.

A small number of the MS still support legacy weak cryptographic protocols (e.g. SSL version 2) that are not recommended for use. It is important to note that deploying solutions utilising weak cryptography does not provide a suitable level of security.

In some MS, the cryptographic policies do not name specific algorithms as being recommended; however recommendations are made regarding key sizes. Also vulnerabilities are identified and flagged.

Study on the use of cryptographic techniques in Europe

3.5 Encryption of data shared between government systems

As more systems are connected to the Internet and public networks, an increasing number of government systems are using these networks as a cost-effective mechanism for exchanging data. Data must be suitably protected when transmitted on these public networks. Respondents to the survey use a range of cryptographic protocols to secure the communications, as shown in Figure 3.6.

For more information regarding SSL/TLS and IPSec see Annex C.

Many MS develop and use non-standard cryptographic protocols. In the past, the deployment of this proprietary cryptography has complicated the sharing of government data across national boundaries.

3.6 Protection of data at rest

The types of data that are protected while stored within e-government applications vary greatly from country to country, as shown in Figure 3.7.

Study on the use of cryptographic techniques in Europe

When considering what data needs to be protected using cryptographic techniques, it is essential that industry-specific regulation (e.g. health), and local and European legislation are considered.

Figure 3.8 shows that mainly commercial encryption (publically available off-the-shelf) products are used by respondents to encrypt data at rest that is stored within e-government applications.

3.7 Recommended cryptographic techniques

The selection of the cryptographic algorithms that make up a cryptographic solution (cipher suite ) is one of the most important elements to consider when designing a cryptographic solution. Mistakes in selecting cipher suite components can leave a solution open to compromise, while the selection of very robust cipher suite components could affect the performance of a system. It is essential that the correct cipher suite algorithms are selected appropriately to secure the data while at rest and in transit. The following sub-sections outline the results of the survey regarding some of the cipher suite elements that policies recommend.

3.7.1 Key exchange algorithms

Key exchange algorithms are used to establish a common ‘secret’ among parties over an unsecure communication channel. This secret usually results in one or more agreed (symmetric) keys for efficient communication. Any public key encryption system can be used as key exchange protocol by encrypting a symmetric key with the public key of the recipient. Note that key exchange protocols might not provide authentication of the communication partner. Common key exchange algorithms rely on Diffie-Hellman (DH) and Rivest, Shamir and Adleman (RSA).

Study on the use of cryptographic techniques in Europe

3.7.2 Signature schemes

Signature schemes are used to generate electronic signatures. These are used, for example, to demonstrate the authenticity of a message: a message can be signed only by the owner of the private key of the signature scheme, but can be checked by anyone else who has access to the corresponding public key. The signed message might be a public key of another party, which is called certification. Some of the common signature algorithms are using Digital Signature Algorithm (DSA) and RSA schemes.

Figure 3.10 shows the wide range of signature schemes that European governments recommend. The majority of MS are recommending a range of signature schemes . Key lengths can only be interpreted when the associated signature scheme is identified.

Study on the use of cryptographic techniques in Europe

3.7.3 Data encryption algorithms

Data encryption algorithms are the method by which data is encrypted. Well known encryption algorithms include Advanced Encryption Standards (AES) and the currently weaker Data Encryption Standard (DES).

As outlined in Figure 3.11, 77% of the survey respondents recommend using AES 256. Encouragingly, no organisations recommended using the encryption protocols that are commonly considered as broken, namely DES 40 and 56.

However, within some commonly used applications and devices, it is common for the weaker encryption algorithms to be enabled by default.

Modes of operation describe how the encryption is applied to data blocks. For ECB (Electronic Code Book) the message is divided in blocks and encryption is applied for each sepa-

Study on the use of cryptographic techniques in Europe 17

rately. The other modes are used to generate different encryption result when the same key is applied to a combination of clear text blocks. Cipher Block chaining (CBC) for example renders the encryption of block n dependent upon the previous n-1 blocks, which means that blocks of ciphertext cannot be decrypted on an individual basis. ECB mode does not hide patterns. Regarding the modes of operation used with block algorithms in MS cryptographic policies, ECB is not recommended; CBC, OFB (Output Feedback) and CFB (Cipher Feedback) are recommended by 62% of the respondents; CTR (Counter Mode) is recommended by 38% and XTS by 15%. 38% of participants in the survey do not make recommendations on modes of operation.

3.7.4 Hash functions

A cryptographic hash function takes a possible unbounded amount of data and calculates a digest of fixed length, called a hash. For a good hash function it is very efficient to calculate the hash of a given message, but hard to find a message given a hash (this is the concept of a ‘one-way function’). Hashes are essential for practical signature schemes since signature algorithms make assumptions about message size and statistical properties, which are not valid for natural messages. Furthermore, hash functions are used to build Message Authentication Code (MAC) algorithms, which are used for data integrity. These are symmetric mechanisms, i.e. the same key is used to check and generate a MAC. These schemes are very efficient and can be used to detect if a message was altered on the network or on the drive. Well known hash functions are the Message Digest Algorithm (MD5) and the Secure Hash Algorithm (SHA). As outlined in Figure 3.11, 85% and 69% of the survey respondents recommend using SHA2- 256 or SHA2-512respectively, with 15% of surveyed organisations allowing the use of SHA-1. 90% 85% 80% 69% 70% 60% 50% 40% 30% 23% 20% 15% 15% 8% 10% 0% 0% MD5 RIPEMD128 RIPEMD 160 SHA-1 SHA 256 SHA 512 No answer

The findings from the survey demonstrate that the majority of governments are promoting the use of the stronger, good practice hash algorithms. Where no specific algorithm is recommended, recommendations include information regarding minimum accepted length of hash.

3.8 Consistency of cryptography specifications

To obtain a comprehensive understanding of the cryptographic specifications that are used across Europe, ENISA approached a range of government bodies that have migrated some of their provision of services to unclassified web services on the Internet. Where ENISA received multiple responses from a country, we expected to see cryptographic standards with each government body referencing national standards. However, this does not appear to be the case. Government bodies appear to be developing cryptographic policies in isolation.

3.9 Key management

Key management does not seem to be well addressed according to the results of our survey. There should be separate specifications for key management including key generation, key storage, key establishment, key archiving and key deletion. Based on the feedback provided by IT industry (section 3.13), in practice, the majority of cases where encryption has been compromised involve the compromise of encryption keys (i.e. use of vendor default or weak pre-shared keys), rather than attackers breaking the encryption itself. 25 26 According to the survey, 77% of respondents used certificates , pre-shared keys are used by 23% (some of them use both), and 23% did not provide an answer. Once certificates are being used, it is essential that the signing keys of the signing authority are appropriately secured. In one interview with an IT auditor, it was suggested that it is very common to find such keys stored within the operating system. To secure keys, there are spe-

Study on the use of cryptographic techniques in Europe 19

cialist devices that can be used such as Hardware Security Modules (HSMs) and smart cards. Both these devices are highly secure and provide the keys with significant protection. The results from the survey (Figure 3.13) support such comments, with 23% of specifications allowing keys to be stored within operating systems. 70% 62% 60% 54% 50% 38% 40% 30% 23% 20% 10% 0% Within OS Within HSM Held on a smart card No answer

3.10 Auditing

Auditing and security testing is essential to ensure that the cryptography is configured in line with the adequate cryptographic documents, and that any weaknesses, default settings, or misconfigurations are identified and removed. All of the survey respondents reported having well defined, robust auditing and testing of the configuration of their cryptographic solutions.

3.11 Maintaining policies and guidelines

The world of cryptography is changing quickly, virtually every day new vulnerabilities are found, most of which are revealed by the academic community; however, as the BEAST vulnerability showed, they might also have an impact on widely used protocols. Thus policies and guidelines need to be reviewed regularly.

All the survey respondents stated that they regularly review their cryptographic policies to ensure that they are in alignment with good practice. Typically, this review originated from their incident management process, taking information that is available from their national Computer Emergency Reponses Team (CERT) and other sources (such as ECRYPT ) to identify new weaknesses in the cryptographic solutions and their configurations.

3.12 Information resources used for defining recommendations and policies

To ensure consistency in the deployment of cryptography, it is essential that each country defines a cryptographic policy regarding the minimum level of acceptable security. Figure 3.14 illustrates the breadth of information sources that are used to create these cryptographic policies.

Two thirds of the ‘other sources’ responses are covered by in-house expertise driven by continuous monitoring of the state-of-the-art in the field. Using this wide range of sources ensures that a cryptographic policy is well thought through and that it covers the diverse range of topics that need be considered when defining cryptography documents.

Study on the use of cryptographic techniques in Europe 21

3.13 Perceptions of the IT industry

After seeing in previous sections the responses and the findings from the questionnaire addressed to e-Government bodies, this section looks at the perspective of the IT industry, which is working with MS cryptographic specifications, and deploying, auditing and testing MS cryptographic solutions. The findings of this section rely on interviews with six experts : two from organisations providing cryptographic products and services , two from system integra- 31 32 tors , one consultant and one expert in testing cryptographic solutions.

3.13.1 General level of expertise and knowledge of specific standards

All interviewees recognised two levels of knowledge and expertise within government organisations regarding cryptography: when working on highly secure systems with elevated protective markings, the level of knowledge was outstanding; while on unclassified systems (the focus of this study), the general level of knowledge was regarded as being generally poor.

In the opinion of the IT industry experts interviewed, there is generally a good awareness of international cryptographic standards, especially when related to a product. The understanding of specific, country-level cryptographic standards appears to be directly related to the experience of the project team and the previous projects on which they have worked.

3.13.2 How cryptographic parameters are selected

Interviewees suggested that in many circumstances, the architect designing the solution cannot identify the relevant government standard to use, and in these circumstances it generally appears that the cryptographic configuration depends on:

 information available on the Internet or coming from equipment suppliers (e.g. technical whitepapers from vendors on how to configure cryptography for the device or software)  the default configuration  selecting the latest version or the largest number (e.g. SHA2-512 over SHA2-256 over SHA-1) for each of the cipher suite options.

3.13.3 Common errors in the configuration of cryptography

The most common fault that the interviewees identified was the lack of any key management process or procedures. The use of vendor default or weak pre-shared keys is a common mistake that is made. This leads to weak cryptographic keys being used and those keys not being appropriately secured, which is mainly due to the lack of a suitable certificate solution or budgetary constraints preventing the design and deployment of a suitable certificate solution. Another area of concern that was identified by the interviewees was in the use of vendor guidance, with some users following the provided guides step by step and command by command, without actually understanding what they are configuring. Vendor guidance is primarily provided to enable the configuration of the solution. By following vendor guidance the solution will often work and protect data, but the cryptographic techniques that have been configured may include weak ciphers.

For a non-cryptography expert, working through the various standards available on the Internet is very complex and challenging. It is very hard for somebody who is trying to configure a system to understand how these various cryptography algorithms, ciphers, keys and hashing techniques work together to enable the relevant data to be protected.

Study on the use of cryptographic techniques in Europe 23

The consequence of not utilising specialised trained staff is that the cryptographic solution is deployed, but the level of protection that it provides is variable. Tasks such as defining the key management processes may not have been completed, making the solution considerably more complex to manage and upgrade.

This guidance should be in a format that those implementing different solutions can understand, explaining how cryptography is configured within applications and devices. It should be targeted at technical staff, but taking into account that they may have limited knowledge of cryptography. Within many training courses organised by vendors, the basics of symmetric and asymmetric cryptography are taught. What is not taught is what constitutes a good cipher suite.

3.13.4 What should European governments do to improve the deployment of cryptography?

The experts that were interviewed agreed that there needs to be:

 simple, easy-to-understand guidance on deployment of cryptography, outlining what constitutes good configuration (as one interviewee stated, not everybody deploying cryptography will have a doctorate, and lack of knowledge of cryptography can lead to serious problems)  a promotion of the fact that cryptography is not just about the initial configuration, but also about the long-term management of all the cryptographic keys.

4 Cryptographic specifications beyond MS borders

This section provides a short summary on initiatives to:

 evaluate and select cryptographic algorithms to be used for e-government services in the USA and Japan  a range of initiatives funded by the EU.

Reference is made to global organisations and standardisation bodies. Further information is available in Annex B.

4.1 Cryptographic specifications in USA and Japan

This section provides a short summary on initiatives to evaluate and select cryptographic algorithms in the USA and Japan. Some of the standards have a global use, and when this is the case references are provided.

4.1.1 USA and NIST standards

The National Institute of Standards and Technology (NIST) is the US federal technology agency that works with the industry to develop and apply technology, measurements, and standards. NIST develops standards and guidelines for federal computer systems to address requirements for security and interoperability that are not covered by other industry standards and/or solutions. These standards and guidelines are issued by NIST as Federal Information Processing Standards (FIPS) . Some examples are FIPS 140-2 (Security Requirements for Cryptographic Modules, 2001), FIPS 199 (Standards for Security Categorization of Federal Information and Information Systems, 2004), FIPS 200 (Minimum Security Requirements for Federal Information and Information Systems, 2006). An overview of the key FIPS cryptographic standard 140 is outlined in Annex C. NIST opens public consultations for the selection of the cryptographic algorithms. For example, FIPS 197, Advanced Encryption Standard (AES) was published in 2001 following a public competition for which NIST requested the assistance of the cryptographic research communi-

Study on the use of cryptographic techniques in Europe 25

4.1.2 Japan and CRYPTREC IPA research project

The Information-technology Promotion Agency (IPA) in Japan has initiated the CRYPTography Research and Evaluation Committees (CRYPTREC) project with the scope to define standard cryptographic algorithms for use within the Japanese e-Government infrastructure . CRYPTREC evaluated and examined cryptographic techniques; based on these evaluation results, the list of ciphers that are recommended for the procurement of e-Government (e- Government Recommended Ciphers List) was published in 2003 followed shortly by a Policy for the use of ciphers in information system procurement of each governmental agency. The activities of the CRYPTREC project have been extended since then to monitor and investigate the security of ciphers enumerated in the e-Government Recommended Ciphers List. CRYPTREC Reports are updated every year. A new round of CRYPTREC evaluations was started in 2010 and is scheduled to be completed in 2012. While CRYPTREC uses independent outside experts for evaluations and publishes their reports, there are entry barriers, such as the use of Japanese language in the workshops and the delay in translating documents.

4.2 EU-funded initiatives related to the use of cryptographic techniques

Until now similar initiatives have been limited at a European level. Most national bodies publish their own cryptographic specifications and make general recommendations for the use of cryptographic algorithms. In this field, a European approach would maximise the results of the

investments, in research and development of cryptographic specifications, made by governmental bodies and the cryptography industry. Some initiatives outlined in this section could serve as a valuable starting point for such an approach. For instance, as a result of research initiatives (projects, or Networks of Excellences (NoE)) we can identify recommendations for the use of cryptographic techniques. Also, at a European level an Action Plan has been initiated on e-signatures and e-identification.

4.2.1 ECRYPT

The European Network of Excellence for Cryptology II (ECRYPT II) is a four-year project, with 11 partners, funded by the Information & Communication Technologies (ICT) Programme of the European Commission’s Seventh Framework Programme (FP7). ECRYPT II started on 01 August 2008. Its predecessor was the Network of Excellence ECRYPT (2004–2008). The objective of ECRYPT II is to continue intensifying the collaboration of European researchers in information security. Every year ECRYPT publishes a study entitled ECRYPT II Yearly Report on Algorithms and Key Lengths . The last version available is dated 30 June 2011. The report provides a list of recommended cryptographic algorithms (e.g. block ciphers, hash functions, signature schemes, etc.) and recommended key sizes and other parameter settings (where applicable) to reach specified security objectives. The report respects state-of-the-art technology at the time of writing. It builds upon a series of earlier reports produced by the ECRYPT NoE from the Sixth Framework Programme (FP6). Based on the questionnaire responses, the ECRYPT yearly report is a reference used by some of the MS. The ECRYPT project has run an open evaluation of stream ciphers; the results of the eSTREAM project are available on the ECRYPT II website and are documented in the ECRYPT yearly report.

4.2.2 NESSIE

New European Schemes for Signatures, Integrity and Encryption (NESSIE) was a European research project funded from 2000–2003 to identify secure cryptographic primitives. Due to the evaluation process addressing different cryptographic primitives, the project scope was

Study on the use of cryptographic techniques in Europe 27

somehow comparable at that time to the NIST AES process and the Japanese governmentsponsored CRYPTREC project. However, the output of NESSIE was a portfolio of algorithms that was submitted to standardisation bodies; no European governmental agency has adopted or promoted the NESSIE results.

4.2.3 Action Plan on e-signatures and e-identification and ESI

The mutual recognition of e-identification and e-authentication across the EU is identified as a top priority of the Digital Agenda for Europe. The same applies in the support for seamless cross-border e-government services in the single market. Some steps towards this have already been made. For instance, in the Cross-Border Interoperability of Electronic Signatures (CROBIES ) study, launched by the European Commission in August 2008 in support of the Action Plan on e-signature and e-identification, solutions are proposed to remove barriers to cross-border interoperability of qualified electronic signatures and advanced electronic signatures based on qualified certificates. In one of the work package of the CROBIES study, issues and tasks are identified for electronic signatures. Reference is made to the possible involvement of ENISA in the process of establishing the lists of algorithms and parameters for secure electronic signatures. On 28 November 2008, the European Commission adopted the Action Plan on e-signatures and e-identification to facilitate the provision of cross-border public services in the Single Market (COM(2008) 798). On 22 December 2009, the European Commission issued a standardisation mandate on electronic signatures (M/460) for the definition of a rationalised standardisation framework. In 2010, ETSI’s Electronic Signatures and Infrastructures (ESI) Technical Committee prepared the first phase of its response to the European Commission Mandate on Electronic Signature Standardisation (M/460), which was issued in December 2009. The goal of this mandate is to achieve the interoperability of electronic signatures throughout Europe, by providing a rationalised European electronic signature standardisation framework which will allow mutual recognition and the cross-border interoperability of electronic signatures. Further work is needed in this area as the existing technical specifications in this field have not been updated on a regular basis.

Study on the use of cryptographic techniques in Europe

Study on the use of cryptographic techniques in Europe 29

5 Concluding remarks

One of the most complex areas of the security industry is cryptography. This complexity makes it challenging to select the most appropriate cryptographic configuration for a solution –the reader needs to have significant background knowledge to understand many of the numerous cryptographic standards. In a large number of MS that have been surveyed, the cryptographic specifications designed for unclassified information are difficult to locate. The level of cryptographic specifications is heterogeneous. While some MS/government bodies recommend certain algorithms (and parameters) others are only naming parameters (key sizes, hash length, etc.). Key management is not covered in every specification. Annex A lists the most relevant cryptographic specifications that have been indicated during the survey (some MS are more advanced and could be used as a reference point for others). It also lists some of the industry standards that are recommended by experts. The survey of the MS cryptographic specifications indicated that many recommend good practice cryptographic algorithms. In contrast, the survey of the IT industry experts identified that many of the cryptographic solutions that they audit and test are poorly deployed and insecure. Outlined below is a consolidated view of this study’s recommendations.

Appropriate use of security – data to be protected

When operating unclassified systems, the data that requires encryption can vary greatly. It is essential that during the design of the solution the appropriate data is identified for encryption. Government bodies need to consider carefully what data needs to be encrypted and how best to encrypt it.

Identifying the appropriate cryptographic policy

Currently, finding specific advice and guidance on what is considered to be strong cryptography is complex. Many MS have cryptographic policies for use by their government organisations. Locating these policies is challenging. MS must make sure their cryptographic policies are easily identifiable and accessible.

Deploying the solution in compliance with good security practices

To understand many of these policies you need to have a good understanding of cryptography. Cryptography can be a complex issue because of the advanced mathematics that are at the foundations of cryptographic algorithms. Only cryptographic experts with a good understanding of system security should develop implementations of cryptographic algorithms and protocols. Cryptographic libraries should be provided with clear and simple interfaces.

The technicians deploying cryptography should have access to simple, clear deployment guidance on the specific cipher suite elements they need to configure.

Understand the audience for the cryptographic policies

Many cryptographic policies assume a good level of cryptography knowledge. Some policies define requirements that cannot be configured on many standard commercial cryptographic products. Consequently, when implementing cryptographic solutions, it is a complex process to try and take the policy and cross-reference it to the way software and hardware vendors present the cryptographic options. This complexity leads to misunderstandings. When developing cryptographic policies, MS should consider the intended readership and how the information will be used in order to maximise the benefits and use of the policy.

Auditing

Many commercial products have default cipher suite policies that are automatically enabled, and many vendors enable weak cipher suites to make the solution as simple as possible to configure and deploy. To minimise the risk of this occurring, MS should ensure that all cryptographic solutions are audited by a suitable cryptographic expert before the solutions are used to secure citizen data.

Processes

Selecting and deploying good practice cryptographic algorithms is just the start. A cryptographic solution consists of more than just the technology, it also requires a comprehensive set of processes, and the solution needs to be kept up to date (as weaknesses are identified in the cryptographic algorithms, the solution must be updated to ensure its continuing security). It is essential that MS develop clear guidance on developing the essential cryptographic processes that are required for every solution that uses cryptography.

Building solutions for longevity and keeping up to date with the latest risks

Many government IT systems have an expected lifespan of over five years. Even algorithms believed to be strong during their design, might show vulnerabilities by the time the solution is decommissioned. Updating a cryptographic solution once a system is in operation is very complex, challenging and costly. However, this risk can be mitigated if the design foresees procedures to replace relevant modules. Moore’s Law (Gordon E. Moore ) describes a trend that the number of components in integrated circuits had doubled every year from the invention of the integrated circuit in 1958 until 1966, and it predicted that the trend will continue “for at least ten years”. His prediction has proved to be accurate. This development in processing power means that when designing a cryptographic solution, the architect must consider the expected lifespan for the system and ensure the cryptographic algorithms selected have the potential to be appropriate for the expected lifespan of the solution.

Study on the use of cryptographic techniques in Europe 31

Cryptographic technologies are continuously developing. This is driven by:

 increasing processing power enabling weaker cryptographic solutions to be broken by brute force (i.e. testing every combination of the encryption key)  weaknesses being identified in cipher suite elements  technological advances that support new cryptographic mechanisms.

To ensure the cryptographic policies that the government bodies recommend, all organisations must pro-actively review their cryptographic policies and solutions, and update them in line with changing circumstances.

A pan-European approach for setting cryptographic policies, evaluation and recommendation of minimum requirements

Initiatives and studies, such as the one published by the ECRYPT project (the annual report), could be initiated at European level for the use of minimum cryptographic requirements in egovernment services. Furthermore, NIST or CRYPTREC projects could be used as examples of successful instances of such initiatives. This could be set as a permanent activity, with annual recommendations reports, to which all stakeholders, namely from academia, government, and industry, could contribute. Such an activity would maximise the effect of investments made currently in a distributed manner in most of the MS. In this way, those research funds could be channelled for new technologies or new solutions that are needed. An independent organisation such as ENISA could support such a pan-European initiative.

Study on the use of cryptographic techniques in Europe

7 References

Study on the use of cryptographic techniques in Europe

Study on the use of cryptographic techniques in Europe

Annex A Cryptographic specifications and recommended standards List of relevant MS specifications (based on the survey)

 Portal Group Security Classes ,

 Recommended cipher suites for SSL/TLS in E-Government ,

 Standards und Architekturen fur E-government andwendungen (SAGA) ,

 BSI Grundschutz Standards , BSI TR-02102 & BSI TR-03111 ,

 Algorithmenkatalog 2011

 Référentiel général de sécurité (in French) ,

 PKI Overheid ,

 CCN-STIC

Some recommended standards/specifications/reports (based on the survey)

 NESSIE / ECRYPT and ECRYPT II Yearly report on Algorithms and Keysizes

 Recommendation for key management

 Electronic signatures (ETSI 102 176-1, ETSI 102 176-2 )

 OASIS: WebServices

 OASIS Standard: SAML WebSSO profile’

 OASIS Standard: XACML

Study on the use of cryptographic techniques in Europe 37

Some standards recommended as reference (based on interviews)

In discussions with the IT industry, numerous encryption standards where referred to as improving the level and configuration of encrypted solutions. Table below outlines the most common standards that where mentioned by the interviewees

Commonality in cryptographic specification

Using the information gathered from the survey respondents, there is significant commonality in the encryption standards that are recommended across Europe. This commonality enables a common standard to be proposed, which could enable and simplify the secure exchange of unclassified data between European governments, and could assist Europe in defining a cryptographic baseline to improve the overall level of trust that citizens can have in electronic communications and e-government services. The proposed standard, outlined below, is designed to be achievable with existing commercially available products.

Certified products should be used

When installing encryption solutions it can be very hard to ensure that the product is encrypting the data to the desired level. One method of ensuring that the products, namely, the encryption hardware and software, operates as desired, and that the cipher suites also operate as defined in the relevant Request For Comments (RFC) or international standards, is to utilise certified products.

Recommendations for citizen access to e-government services

Typically, governments use HTTPS to secure communications from citizen devices to egovernment web servers. Below is a high-level proposed outline for the core elements of an encryption policy for encrypted web services based on the collated survey results:

Study on the use of cryptographic techniques in Europe

Recommendations for sharing data between government systems over a public network

A wide range of technologies are used to encrypt data while it is being transmitted between government bodies. Two of the most common encryption protocols are SSL/TLS or IPsec. Below is a high-level proposed outline for the core elements of an encryption policy for encrypting data while in transit between government bodies, based on the collated survey results.

Study on the use of cryptographic techniques in Europe

Data at rest

While attacking data in transit is a realistic possibility, the majority of successful security breaches have been against applications that hold the data. To protect data while it is held within applications, it is possible to encrypt the data. Below is a high-level proposed outline for the core elements of an encryption policy for encrypting data while stored within an application, based on the collated survey results.

Recommendations for key management

Encryption keys must be suitably stored in HSMs or on smartcards with an appropriate common criteria rating.

One of the most common denial-of-service events is when certificates expire. To overcome this issue, it is recommended that a key diary is maintained to record when certificates are going to expire.

Recommendations for auditing

Prior to the sensitive data being transmitted or loaded into an application, the encryption must be suitably tested to ensure that the data will be encrypted as defined, and to identify any weaknesses in the deployment. On an annual basis, the encryption solution must be validated to ensure that the data is being encrypted as defined in the encryption policy, and to identify any potential weaknesses in the deployment.

Study on the use of cryptographic techniques in Europe

Annex B Simplified lists of questions

Outlined below is an overview of the questionnaire sent to MS and to the IT industry.

Member State questionnaire IT industry interviews

Study on the use of cryptographic techniques in Europe

Study on the use of cryptographic techniques in Europe 43

Annex C Background information Symmetric and asymmetric techniques

There are two basic techniques for encrypting information: symmetric encryption and asymmetric encryption (also called public key encryption). In the case of symmetric encryption, a secret key, is applied to the text of a message to change the content in a specific way. As long as both sender and recipient know the secret key, they can encrypt and decrypt all messages that use this key. The difficulty with secret keys is exchanging them in a secure manner: anyone who knows the secret key can decrypt the message. For asymmetric encryption, there are two related keys – a key pair. A public key is made freely available to anyone who might want to send you a message. A second, private key is kept secret, so that only the key owner knows it. Any data that is encrypted using the public key can only be decrypted by applying the same encryption algorithm, but by using the matching private key. The authenticity of the public key needs to be protected while passing public keys over the Internet (the keys are supposed to be public). A problem with asymmetric encryption, however, is that it is slower than symmetric encryption. It requires more processing power to both encrypt and decrypt the content of the message. That is why one uses in practice hybrid encryption: asymmetric techniques are used to establish a secret key, and subsequently symmetric techniques are used to guarantee data confidentiality and authentication. Besides encryption – used for confidentiality purposes, one needs also entity and message authentication, data integrity, non-repudiation etc., objectives which are achieved using cryptographic techniques (symmetric keys or asymmetric keys primitives). Data origin authentication or message authentication techniques provide to one party which receives a message assurance of the identity of the party which originated the message. Data origin authentication implicitly provides data integrity since, if the message was modified during transmission, the originator is not the same. Message authentication codes (MACs) allows message authentication by symmetric techniques. MAC algorithms take two distinct inputs, a message and a secret key, and produce a fixed-size output; should be impossible to produce the same output without knowing the key. Digital signatures schemes are also used for message authentication, and provide additionally non-repudiation of data origin. When designing an encryption solution it is necessary to select the algorithms i.e. used for encrypting data and for computing the message authentication code. The collection of these algorithms is often called a cipher suite. In case of SSL/TLS , IPsec, a cipher suite consists of four components:

 Key establishment algorithm – the method by which cryptographic keys are exchanged between parties.  Digital signature algorithm – i.e. for entity authentication. Entity authentication is the process whereby one party is assured of the identity of a second party involved in a protocol.  Data encryption algorithm – used to encrypt data. As mentioned above, there are two basic types of encryption algorithm, symmetric and asymmetric. Example of algorithms includes Advanced Encryption Standards (AES) and Data Encryption Standard (DES).  Data integrity algorithm – used to check the integrity of the data. E.g. MAC algorithms (SHA-1, etc.)

Business roles for cryptography covered within this study

This study investigated three types of cryptographic solution:  Cryptography used to secure citizens’ access to e-government websites  Cryptography used to secure a network connection between government machines  Encryption of data stored within e-government applications.

The sections below provide a selection of background information regarding these three types of encryption solutions.

Secure access to web services

When a user accesses a website using a web browser, typically it will utilise a protocol called hypertext transfer protocol (HTTP). This protocol is not encrypted; the data passes over the network between the user’s PC to the web server in clear text. This information could be intercepted and the data reconstructed. The most common way to secure such a communication is by encrypting the data using hypertext transfer protocol secure (HTTPS). HTTPS can utilise the encryption protocol’s secure socket layer (SSL) and transport layer security (TLS) to encrypt the data. SSL was originally developed by Netscape. Version 1.0 was never publicly released; version 2.0 was released in February 1995, and version 3.0 in 1996. There have been a number of releases of TLS, TLS 1.0 (RFC 2246, in 1999), etc., TLS 1.2 (RFC 5246 defined in 2008) and TLS 1.2 (RFC 6176 further refined in March 2011).

Secure communications between nodes

When developing systems and applications, there is often a business requirement to collate data from a variety of sources and to exchange data between systems. Sometimes these systems are geographically separated and have no appropriate network connection. For large and complex systems, it can be appropriate to connect the systems through a dedicated network connection, but often this is not cost-effective so the connection is established over a

Study on the use of cryptographic techniques in Europe 45

public network such as the Internet. In these cases, cryptography should be utilised to secure the data while in transit over the public network. With this, an encrypted tunnel is constructed between two end points. Date is encrypted when it enters the tunnel and decrypted when it leaves. Typically three types of encryption protocol are used: SSL/TLS, as described above; Internet protocol security (IPsec) and Government-developed encryption. IPsec was originally defined in RFC 1825 and RFC 1829, published in 1995. In 1998, these documents were superseded by RFC 2401 and RFC 2412. In 2005, updated standards were defined in RFC 4301 and RFC 4309.

Encrypting data within applications

While attacking data in transit is a realistic possibility, the majority of successful security breaches have been against the applications that hold the data. To protect the data while it is held within the applications, it is possible to encrypt the data. In this context there are two basic types of encryption – encryption that works at the operating system level, and encryption that is built into the application. With encryption that works at the operating system level, it is possible to encrypt all the data on the system, or just a specific area of the hard disk. If the data is being held within an application, then depending on the nature of the application and any supporting database, it may be possible to encrypt a selection of the data held within that application or database. The cipher suite and the encryption capabilities are directly linked to the applications that are selected.

NIST standards – Federal Information Processing Standard (FIPS)

The National Institute of Standards and Technology (NIST) is the USA’s federal technology agency, which has developed cryptographic standards, notably the Federal Information Processing Standard (FIPS) 140 security requirements for cryptographic modules and the recommendations in the Special Publication (SP) 800-57 for key management. NIST SP 800-57 is cross-referenced by the PCI DSS standard.

Study on the use of cryptographic techniques in Europe

Annex D Terminology and abbreviations

Defined below is the core terminology and abbreviations utilised within this document.

Study on the use of cryptographic techniques in Europe

P.O. Box 1309, 71001 Heraklion, Greece www.enisa.europa.eu