The PKI Guy explores quantum-ready solutions with Bruno Couillard of Crypto4A

Q&A with Bruno Couillard, president and CTO, Crypto4A

TPG: Your hardware security module (HSM) architecture team has an interesting history in the world of cryptography—can you tell us about that?

BC: Many of our team, (including myself and the other three founders) have been consistently in the crypto and cybersecurity space for decades. Some of us come from Chrysalis (you may recall the Luna HSM) and some of the team are former employees of Entrust, the company that developed the first commercial PKI solution. It is a testament to these solutions that both are still de facto standards around the world. Our current team brings hundreds of years of collective crypto and security market experience as we embark on our next-generation cybersecurity platform called QASM [pronounced kaz-uh m]. The challenge is clear—current crypto products and their related solutions are aging, crypto architectures aren’t ready for the quantum threat, and there’s a serious lack of talent to build, deploy or manage these very complex security solutions.

TPG: How do you help organizations protect sensitive data? 

BC: Crypto4A provides a universal cybersecurity platform that is designed for hosting various types of security-centric solutions inside a tamper-proof appliance. Think of our appliance as a “TrustServer.” QASM can host one or many interconnected cybersecurity solutions including those that provide or leverage database security, Identity and Access Management (IAM), PKI—as well as managing the critical key management and crypto operations necessary to all of the above. We protect data and operations naturally as part of the elemental architecture within.

TPG: What sets you apart from other HSM platforms?

BC: We’re not just another HSM. There’s a next generation HSM at the core of QASM, but there’s much, much more. We addressed the simple fact that HSM technology hasn’t changed to adapt to the ever-changing cyber threat landscape, or quantum threat, or scale to meet cloud and IoT demand or adapt to the skills shortage required to manage these legacy devices. QASM provides a quantum-safe, multi-tenant, multi-threaded HSM surrounded by four single board computers. All operations and business process flows are enforced by QASM’s HSM policy management engine called Trusted Communication Matrix (TCMx). This patent-pending architecture acts like a traffic cop to ensure traffic flow management between physically isolated secure enclaves based on core crypto-based and best-practice cybersecurity principles.

TPG: Tell us about your quantum-ready cybersecurity solutions.

BC: When we were first thinking about building our platform, a core element had to be the principles around “quantum safe” or “quantum ready.” To that end, we wanted to ensure that any field updatable software or configuration elements of our platform would always be digitally signed using quantum-safe signatures (e.g. hash-based signatures). We strongly believed then and still do now, that this “future proofing” is fundamental to anyone deploying a solution that will start secure and remain secure for decades to come, even in the face of new threats from quantum computing platforms. Since then, and in addition to our own crypto expertise, we have evolved a fantastic eco-system of industry colleagues and partners (e.g. ISARA Corporation, evolutionQ) that we collaborate with to ensure every internal operation is quantum safe.

TPG: How would the military, for example, use your technology?

BC: The beauty of QASM is its ability to be used as a universal cybersecurity appliance. As a team, we cumulate many decades of experience at designing and/or operating military communications systems requiring the highest levels of cybersecurity and key management techniques. QASM is the embodiment of our collective expertise in that field and can beconfigured to address PKI, IAM, as well as a data diode, cross-domain solutions, multi-layer VPN, and many other military security requirements and use cases.

TPG: What security challenges do you see organizations facing?

BC: The biggest challenge we see is the enormous complexity of security architecture design and deployment in current and future environments. We believe the worsening skills shortage poses a massive problem for implementing and managing ever-changing security solutions. If we can simplify, consolidate, and automate the solutions to be utilized, the market will adapt and respond positively to this new paradigm.

The reality is the threat of quantum computing is fast approaching. Organizations are challenged with updating current and existing solutions (e.g. PKI or IAM) that are designed around classical algorithms such as RSA or ECDSA. Migrating these solutions to using quantum-safe algorithms will be a multi-step process requiring a highly coordinated plan where both current and quantum-safe versions of these solutions will need to be tightly integrated to manage and control the entire transition process. This will be both lengthy and complex.

TPG: What is the latest in quantum cryptography advances?

BC: There is a tremendous amount of activity in the cryptographic community to develop new quantum-safe algorithms to replace conventional public key algorithms, which are vulnerable to quantum computing-based analysis. This includes algorithms leveraging hash-based, code-based, multivariate, lattice-based and super-singular isogeny elliptic curve cryptography. These all have various pros and cons with regard to maturity, implementation difficulty, resource usage, security, and performance. One challenge is that standardization efforts of new quantum-safe algorithms by NIST and other organizations are ongoing, so it is important for solution providers to take advantage of a cryptographically-agile platform such as QASM, which allows them to implement quantum-safe solutions today while still being flexible enough to adapt to new algorithms and variations as the standards and best practices evolve.

TPG: How are you addressing post-quantum computing security challenges?

BC: QASM will provide a best-in-class suite of quantum-safe algorithms and security services, implemented by Crypto4A, and optionally including advanced and expanded quantum-safe algorithm suites provided by partners such as ISARA. Keep in mind that conventional symmetric key algorithms such as AES-256 are quantum-safe and we will continue to support those as well.

As mentioned, many new quantum-safe algorithms are still somewhat of a moving target from a standardization perspective, so it is important to have a platform that can be updated securely and dynamically with new or revised algorithms and configurations. This is exactly what QASM provides, and our platform field update mechanisms leverage quantum-safe hash-based digital signatures from day one to ensure that QASM can be securely updated and maintained today and in tomorrow’s post-quantum world. Other platforms that use code signing and update mechanisms based on conventional public key cryptography are NOT quantum-safe, and this represents a big vulnerability.

TPG: How would you define cryptographic agility and why is it important?

BC: Cryptographic agility is the ability for a security system to switch to alternative cryptographic mechanisms and credentials without significant change to the system infrastructure and is particularly important with the emergence of quantum computing-based threats. This flexibility is at the core of QASM’s architecture and design philosophy. Cryptographic agility, if not carefully designed and implemented, however, may represent an exploit path for attackers to “dumb down” active security suites, which is why we have paid special attention to ensure that our update and policy configuration mechanisms are rock solid and quantum safe. Another aspect of cryptographic agility is that if a product is not designed with cryptographic agility in mind, then the only way to update its cryptographic suite is to perform a complete physical replacement of the product.

TPG: What cybersecurity advice would you give to organizations for 2019?

BC: Our advice is to think inside our box. Outside of a small group of companies including Crypto4A and our partners, there has been little innovation in the areas we address and the problems we solve. We believe organizations should look for dynamic, next generation approaches to solving these problems instead of the “racking and stacking” approach. The smartphone is a great example of an application platform that emerged for the masses, re- defined application simplicity and cost-management—with security designed in. Organizations should consider how much they are expending on specific solutions to solve multiple cybersecurity problems. Perhaps QASM is a good start for a discussion on how to solve more than one problem in a more simple, cost-effective way.