#birdboxchallenge
The Bird Box Challenge was a social media viral fad in which people uploaded videos of themselves attempting everyday tasks while blindfolded.
What started with people doing mundane household shenanigans quickly spiralled into videos of people crossing railway tracks blindfolded and getting on the road driving blindfolded.
But what if your CEO started signing documents blindfolded?
An accident waiting to happen and perhaps the CEO’s equivalent of driving blindfolded in a Bird Box Challenge.
What if your CEO has already been doing that without realising it?
Let’s take the ‘wet’ ink-on-paper document signing and consider the ‘digital’ document signing using PKI and certificates. If you don’t know what you’re signing then that’s not much different to doing it blindfolded. May as well hashtag it #birdboxchallenge, right? Regardless, at least in that scenario you know that something is being signed, you’re just not sure ‘what’ is being signed because of the lack of visibility (no pun intended).
Roaming Certificates go a step further in removing you from the ‘signing’ action altogether as it is done on your behalf; like giving Power of Attorney not to mix metaphors.
The ‘Roaming Certificate’ PKI private key is held centrally and ‘digital’ document signing also occurs centrally. The process around how the owner of that Roaming Certificate authorises a ‘digital’ signature event is then of paramount importance. Getting it wrong is tantamount to a #birdboxchallenge for PKI.
What does it mean to get the authorisation wrong?
It’s when someone other than the rightful owner of the Roaming Certificate is able to obtain a digital signature. Or when the digital signature is on something different to what the rightful owner thought they were signing.
The common method we’ve seen for remote authorisation of a Roaming Certificate ‘signature’ is through password credentials and SMS OTP. What is lacking in this method is the WYSIWYS (What You See Is What You Sign) that was available with a smartcard and display card reader where the private signing key was held on the smartcard.
Although the password and SMS OTP credential lets the central system know that the owner of the Roaming Certificate is authorising a signing operation, it doesn’t tell them ‘what’ they’re signing – going back to the analogy of a CEO signing with a blindfold.
Displaying the content that’s about to be signed in a desktop browser is an improvement but subject to MitB (man-in-the-browser) where you see one thing whereas the actual signature is on something else – replacing the ‘blindfold’ metaphor with a View-Master (a child’s binoculars toy showing fake pictures on a reel versus showing what’s really in front).
So, to mitigate the MitB we need an out-of-band display and remote authorisation of the Roaming Certificate.
And it just so happens that this is a perfect fit for Mobile MFA – A mobile phone can display rich content therefore can display the content about to the signed by the Roaming Certificate, i.e. WYSIWYS. A mobile phone is a separate out-of-band channel to the desktop and therefore mitigates MitB. Most mobile phones have a biometric capability therefore a step up from password credentials and SMS OTPs.
“So, we remove the shroud of uncertainty.”— Pedram Ghovonlou
So, we remove the shroud of uncertainty by using Mobile MFA as the preferred process for how the owner of a Roaming Certificate authorises a remote ‘digital’ signature. This is something that we [at SALT] are currently working on – to extend the Safetronic platform and introduce a Roaming Certificates capability with remote authorisation using our Mobile MFA tokens. The Roaming Certificate Private Keys will be held centrally on Hardware Security Modules (FIPS120-2 HSMs). The owner of each Roaming Certificate will then be able to provide remote authorisation through their Mobile MFA token. The remote authorisation process will include WYSIWYS so that the user is fully aware of the content that will be digitally signed with their roaming key. And include the user’s biometrics. Safetronic’s Mobile MFA remote authorisation will provide a separate out-of-band authorisation channel that will be distinct from the desktop (and other) channels that initiate the signature requests, thereby mitigating MitB/MitM attacks. Every Roaming Certificate signature event will be authorised through the user’s Safetronic Mobile MFA with a full tamper-evident audit trail for non-repudiation.
The Roaming Certificate feature in Safetronic is currently (at the time of writing) expected to be commercially available in 2022.
