Managed Security Services

Security and Moore's Law: Whitfield Diffie's Thoughts

Ever faster CPUs make life difficult for a variety of industries—ISPs, for example, operate in a market suffering constant deflation—but, as the inventor of public key cryptography noted, Moore's Law is particularly challenging to security vendors.

by Alex Goldman ISP-Planet Managing Editor [November 10, 2005]

At the symposium for The Marconi Foundation's presentation of a lifetime achievement award to Gordon Moore and a fellowship to Claude Berrou, speakers voiced their thoughts on the era of Moore's Law.

We found Whitfield Diffie's short talk particularly intriguing.

The bacteria
When we think of the kind of exponential growth described by Moore's Law, Diffie noted, we find it difficult to visualize. The only exponential growth we're accustomed to considering is that of bacteria, whose population doubles regularly, given sufficient food in the environment.

It's not a positive image.

Diffie suggested that the CPU was so successful in part because it reached a universal market with a standardized product. Now that the potential rewards of technology are well known, it is possible that few products will achieve the same growth rate because as companies compete to patent portions of each market, that market fragments, reaching a smaller population.

The barrier
Diffie said that technology will solve problems that require a specific speed or capability, but may never solve others. Security, for example, is an arms race. As faster chips are produced, better attacks are made possible, and better security is therefore demanded. On the other hand, barriers that are determined by human capabilities, not computer capabilities, should all eventually be overcome.

For example, crystal clear digital voice is well within reach. Once the problems are solved, they will remain solved. The human ear does not require more from a CPU when that CPU is capable of doing more.

On the other hand, a cryptographic system guarantees that a message will not be cracked for a specific period of time. If a code is guaranteed for thirty years, and someone sends a message in that code on the last day it's guaranteed, fully expecting the security to last for another twenty years, then you need to be able to guarantee security for fifty years.

It seems to us that codes might cascade downward through security levels over time as new codes are invented. Code Alpha, invented in 2000, would be a top code for five or ten years until the invention of Code Beta, and so on.

The concern
Nevertheless, in an era of constantly improving computers, Diffie's concern is understandable. As Chief Security Officer for Sun Microsystems, the concern is immediate.

Reading a 1994 biography of Diffie in Wired Magazine, Whitfield Diffie: Prophet of Privacy (the author of the article, who now works for Newsweek, was also present at the Marconi symposium, and has co-authored a book with Diffie), it seems clear that Diffie focuses on a single meta problem for years at a time.

Although it seems obvious that the security arms race cannot be won by the security firms—that another battle will always be visible on the horizon—it once also seemed obvious that you could not have a public key.

Only time will tell whether or not Diffie is tackling a problem that is unsolvable.

—End