A Conversation with Whit Diffie

On Tuesday, we had the honor of announcing the establishment of SafeLogic’s advisory board and the first three members.  The trio is absolutely stellar, and it’s a thrill to have the opportunity to work with such accomplished people.  I recently got to chat with Whit Diffie about his thoughts on encryption, technology, and how SafeLogic factors into the long-term outlook of security and compliance.  I’d like to share with you some of his thoughts.  I also just wanted to brag that I was talking cryptography with Whit Diffie!

In the context of the validation of Suite B algorithms, I raised the question of importance with enterprise clients.  In assessing government applications, the procurement officer's analysis is binary – either the cryptography has been validated, or it hasn’t.  Nothing short of a validation is acceptable and there is no gray area.  Business hasn’t embraced the same point of view yet, but it has certainly been evolving.  Does that cultural acceptance of gray area create vulnerability?

Whit replied. “Cryptographic algorithms are the best cooked aspect of information security.  Every other aspect, beginning with algorithm implementation, is prone to error and thus to penetration and compromise.  The importance of validating cryptographic implementation is second to nothing in information security.”

I pressed further.  SafeLogic’s mission is to bring government quality encryption to all, but some enterprise solution vendors believe that it is overkill for certain private sector use cases.  Are there scenarios in theory where cryptography can be unverified and still inherently secure enough?

That didn’t sit well with Whit.  “Cryptography is not just a theory.  In order to secure everything from e-commerce to personal communication, cryptography must be properly implemented.”

Diffie’s response reinforced what I have been carrying as a central tenet to SafeLogic’s goals.  In order to put faith in a solution that contains encryption, like trusting the lock on a door, we must be assured that each facet has been installed correctly and tested.  Without an independent third party to verify it, vendors could claim anything at all.

In 2008, Whit commented in an interview that Suite B could have a major impact, improving the interoperability of cryptographic security systems worldwide.  So I was curious about his thoughts five years later.  Has it played out as he expected?

Whit’s commented on how huge the task really is.  “The adoption of a world-wide cryptographic standard is an ongoing process that may last throughout the century.  At any point, it’s possible to look around and say ‘look how much we have achieved’ but also to look around and say ‘look how much remains to be done.’ ”

Not to be discouraging, Diffie went on.  The interoperability is indeed already showing rewards.

“The importance of standardized, pluggable, cryptographic implementation of the sort SafeLogic provides is that they ease the work of application-specific developers, which frees them to concentrate on their core competencies.  To a non-security developer, cryptography is just another nuisance, a peripheral expertise that must be acquired to get the job done.  The more of security that can be obtained from experts who have made it easy to install, the more quickly projects that depend on security – rather than focusing on security – will go.”

It’s very cool that Whit Diffie sees SafeLogic as a cog in the evolution of application development.  His view is very copasetic with where we are positioned – by leveraging a specialist, companies can innovate faster, better, and more efficiently than ever.

Along with the rest of the SafeLogic team, I am excited to have Whit on the Advisory Board and I’m looking forward to many conversations like this in the future!