Stefan Mileschin

Now that it has been revealed that the NSA has the keys to your data centre, analysts are working out new methods to shut them out.

One of the plans is to develop corporate datacentres that encrypt data beyond the ability of the NSA to crack it.

The idea is to use a new encryption technique that allows data to be stored, transported and even used by applications without giving away any secrets.

The concept was presented by security researchers from Denmark and the UK to the European Symposium on Research in Computer Security.

It looks at a long-discussed encryption concept called Multi-Party Computation (MPC).

MPC allows two parties who have to collaborate on an analysis or computation to do so without revealing their own data to the other party.

The idea has been kicking around since 1982. Ways to accomplish it with more than two parties, or with standardised protocols and procedures was considered impractical.

The Danish/British team have revamped an MPC protocol nicknamed SPDZ, which uses secret, securely generated keys to distribute a second set of keys that can be used for MPC encryptions.

This allows parties on one end of a transaction to verify that they know a piece of information such as a password by offering a different piece of information that could be known only to the other party.

The technique could allow secure password-enabled login without requiring users to type in a password or send it across the internet.

http://news.techeye.net/security/res...ur-data-centre