With 25 billion new devices set to hit the Internet by 2025, the need for a better worldwide cryptosystem for securing information is paramount. That’s why the Apache Milagro project is currently incubating at the Apache Software Foundation. It’s a collaboration between MIRACL and Nippon Telegram and Telegraph (NTT), and Brian Spector, MIRACL CEO and Co-Founder, discussed the project in his keynote at ApacheCon in May.
Spector said the project was born in a bar on the back of a napkin after a brainstorm about how one would rebuild Internet security from the ground up. That sounds like a lot of work, but Spector believes it’s absolutely necessary: the future of the Web is going to be very different from the past.
“Something is going to change, and that something is the proliferation of IoT devices and software applications that will be acting in an app-centric way,” Spector said. “If you believe that we’re going to start moving from a browser model to an IoT and app-centric model, the architecture and hence the requirements are going to be fundamentally different. This is where things get interesting.”
That back of the napkin read something like this:
A modern cryptosystem would:
-
Have distributed trust authorities, not centralized on four or five browser companies offering certificates and all from the United States
-
Have no single point of compromise
-
Use state of the art mathematics so that identities are burned into security keys
-
Fix things like revocation of trust so they actually, you know, worked
-
Be open source and easily auditable, not proprietary
And so Apache Milagro was born.
Spector and his team are building a system with no public key infrastructure (PKI) and therefore no passwords at all; you’re not authenticating yourself to billions of different web servers, so there aren’t as many opportunities for fraud. This system allows you to choose your “trust” providers, each with a piece of your master key, distributed around the world in countries whose governments respect privacy of their citizens.
“Milagro envisions a world where we have a fleet of new service providers come on line that we called distributed trust authorities,” Spector said. Instead of certificate authorities that would digitally sign somebody’s public key, thereby stating that you are the owner of that digital certificate and hence the corresponding private key, you get shares, or fractions of a private key issued to you by these distributed trust authority providers. And the keys have your identity burned into them, so you don’t need to have a certificate.
“These keys are issued to clients and services that will run Milagro applications for authentication or secure channel or have the code embedded inside of them,” Spector said. “So what can you do with the keys that have been issued out of the distributed trust authorities? This is where Milagro gets interesting. With Milagro multi-factor authentication, you can embed this into your web or mobile application in minutes.”
Spector believes Milagro does three things no other platform current does:
-
It gets rid of the risk of password database breach, in part because it gets rid of the need for passwords all together.
-
Improves the authentication user experience: Users only need a four-digit pin, with 128-bit security baked in to your master key.
-
It’s extendable to any number of authentication factors, including biometrics, geolocation, hardware, etc.
Spector said the project is in early stages but has some fairly significant implementations, including the British tax office and the credit agency Experian.
However, the project needs people’s feedback and help, and Spector said he welcomes everyone to have a look at the project and make suggestions.
Watch the complete presentation below:
