SAKEM Effective Security

Return->

The main services of cryptography, confidentiality and authentication, are provided under the simple assumption that who knows a cryptographic key is reliably known. This calls for a security service that we call dependable installation of identity in the absence of a recognized term.

Actually, very few publications discuss this recurrent issue of dependable installation of identity. Typically, the issue is left out of the subject matter with phrases like "outside the scope of this standard XYZ" in a standards document, or "done as a preparatory step using alternate means" in an academic publication.

In this respect, even publications about the role of a CAs (Certification Authority) are puzzling: they discuss at length how a CA signifies that person 'X' uses a given public cryptographic key (through an immaterial X.509 certificate); they refer to a Certificate Practice Statement about how a CA might meterially verify the identity of person 'X'; but they are almost silent about how a CA corroborates the double logical bind respectively from the public key to the private key and from the private key to the person 'X'. In other words, behind the extensive formalism in the role of a CA, the actual fulfillment of its core function remains obscure, if not squarely problematic.

SAKEM is simply a streamlined procedure that securely ties each verification of identity to an authentication key or secret. In the perspective that "security goals and assumptions should be based on industry practice in the application area, not on general 'computer' concepts" (reference [1] at page 243), the SAKEM procedure security is effective whenever who knows a cryptographic key must be reliably known.

Return->

Reference

[1] Anderson, Ross J., Liability and Computer Security: Nine Principles, in Computer Security - Esorics '94, Third European Symposium on Research in Computer Security, November 1994, LNCS (Lecture Notes in Computer Science) 875, Springer Verlag, pp 231-245