What is Secure Chorus GCHQ's new encrypted voice and video standard explained
The website outlining Secure Chorus is still pretty sparse when it comes to technical explanation so we thought we'd look a little deeper at what it is being proposed and what influence it might come to have on
What is Secure Chorus
Secure Chorus is intended to provide a foundation of interoperable standards for the emerging business market for secure voice, video, conferencing, IM and file transfer applications. Secure Chorus refers to the common protocols that will be adopted and developed by a non-profit consortium of the same name.
What applications will be affected
In short, voice, video and (usually) email and text messaging. In the consumer space the market is served to varying levels of security by WhatsApp, Facetime, Skype, Telegram and many others. Businesses want similar end-to-end security but more suited to the need to manage security centrally and without the sort of uncertainty and security weaknesses that afflict consumer apps. It's early days for the business market but a range of mainly startup firms has started developing the often complex communications platforms required.
Why is Secure Chorus needed
Currently, the small number of vendors offering this kind of software to enterprises develop within their own proprietary islands, which in time will start to hurt the market with inconvenience and higher costs. Businesses also need interoperability, which stops them being trapped with one vendor's technology, especially if that firm is later acquired. Not all platforms support all security features and can't offer a basic level of security when connecting to one another.
Who is backing it
The release mentions Armour Communications, BT, CESG (GCHQ's security evaluation wing), Cryptify, Cyber Y, Finmeccanica UK, Samsung, SQR Systems and Vodafone. The unusual aspect of this list is that with the exception of Samsung and Cryptify, all of these names are UK organisations, including two startups. CESG is a wing of GCHQ, which gives the initiative weight in the UK government sector and in all likelihood far beyond. Other members are expected to join.
Why so UK-oriented
The UK currently seems to have plenty of encrypted communications expertise on hand. The Government is not alone in thinking that UK firms, including those in its supply chain, should start using security communications platforms and CESG is pushing that as a requirement. The UK was also a leader in the development of mobile voice and data standards such as 3G and 4G.
What standards are included in Secure Chorus
We quote from the press release: "Secure Chorus is built upon Identity-based Public Key Cryptography (IDPKC) with MIKEY-SAKKE and ECCSI at its core (RFCs 6507 and 6509). These modern standards permit flexible and dynamic security associations to be made without the costs associated to public key infrastructure such as X.509 certificates and online certificate authorities. Instead, users' identifiers (such as their phone number) are used as their public keys."
According to the CESG, Secure Chorus will initially focus on secure voice communications before moving on to video at a later stage.
But Wasn't MIKEY-SAKKE accused of having a backdoor
Not using that term but by University College London researcher Steven Murdoch, criticised the centralised key escrow feature of its encryption design as potentially allowing "mass surveillance." The term 'backdoor' was then thrown at MIKEY-SAKKE by some commentators without justification. But access to keys is part of all centralised key management server designs. For a host of reasons, large organisations always need to access encryption keys for the same reasons they need to access all data and emails sent and received by employees. CESG even points out in its MIKEY-SAKKE FAQ that the ability to decrypt communication is as necessary for government IT as it is for many commercial organisations.
MIKEY-SAKKE, then, does allow lawful intercept because that has always bene one of its central design criteria. This does not mean that a securely implemented platform using MIKEY-SAKKE allows Government surveillance of an organisation's communications.
Expert comment
"You can't achieve interoperability unless you have aa flexible way off managing the keys. MIKEY-SAKKE is very flexible that can't be done with traditional models because you end up with the vendor or telco controlling everything," points out Nithin Thomas of SQR Communications, one of the UK firms involved in Secure Chorus. His firm's platform is Ceerus, which sister title Techworld included in its recent survey of secure messaging applications.
"The next challenge is going to be making sure be build the community of service providers for months and years to come. We also need to add more functionality such as video."
GCHQ Secure Chorus explained - what will happen next
Secure Chorus is not a crowd-pleasing standard that will deliver the goodies in weeks or months. This is a complex area of software and development will take time. All the parties seem committed so Secure Chorus won't go away. We expect it to take years.
Thomas's point about service providers is important because a growing number of organisations want to host their systems in the cloud but with Secure Chorus that still needs to be done in a way that the key management administration is maintained by the customer.
Secure Chorus also needs more members. Buy-in across the industry will be important and that will need to include US vendors in time if it is to have any chance of succeeding.
A more detailed explanation of Secure Chorus can be found on the CESG website.