Impact case study database

Accelerating the deprecation of RC4 and improvement of Transport Layer Security

In February 2015, the IETF, the organization that maintains the TLS standard, published a document entitled “Prohibiting RC4 Cipher Suites” formally deprecating the use of RC4 in TLS, see [E8]. This document cites Paterson’s 2013 research paper, stating “ *Recent cryptanalysis results […] exploit biases in the RC4 keystream to recover repeatedly encrypted plaintexts. These recent results are on the verge of becoming practically exploitable […] As a result, RC4 can no longer be seen as providing a sufficient level of security for TLS sessions.*”

Major vendors, including Apple, Google, Microsoft and Mozilla changed the way their desktop and mobile browsers perform encryption in TLS as a direct consequence of the research. This is clearly evidenced in the accompanying letters of support from Apple [E1], Google [E2] and Mozilla [E3], and from the formal Microsoft announcement in September 2015 that RC4 would no longer be supported in its browsers [E6]; similar public announcements were made by Google [E5] and Mozilla [E7], also in September 2015. These four vendors account for the vast majority of the web-browsing market. Google, Microsoft and Mozilla performed a coordinated switch off of RC4 in their browsers in early 2016, while Apple disabled RC4 in version 10 of Safari desktop (and in iOS 10 in mobile clients) in September 2016.

The world’s leading content distribution networks and website hosting services also changed their default configurations to stop using RC4. A good example is provided by Cloudflare, whose letter of support [E4] states that Paterson’s research “ represented a real threat to the security of TLS” and also states that “[a]s a result of the work, Cloudflare changed the TLS configuration for millions of web domains”.

The amount of TLS traffic encrypted using RC4 has dropped sharply – from approximately 50% of all traffic in 2013 to reach less than 1% by the middle of 2018. This drop is documented in Paterson’s award-winning paper published at ACM IMC 2018, and there is a clear correlation between a drop in the amount of RC4 traffic with the switching off of support for RC4 in major browsers (see figure below, taken directly from the ACM IMC paper) (R5).

As well as leading to the abandonment of RC4 in TLS in web browsers, Paterson’s RC4 research promoted the widespread adoption of TLS 1.2 in web browsers and web servers. TLS 1.2 was standardized in 2008 but, in early 2013, before Paterson’s RC4 research was announced, none of the four main web browsers supported this later version of TLS offering stronger encryption options. By mid-2018, all four browsers did, and the amount of traffic using stronger encryption algorithms (namely AES-GCM) is now approximately 90% (the majority of the remainder still uses CBC mode, and, as noted above, almost none uses RC4). To quote from Mozilla’s letter of support [E3], “ As a direct result of this work, the TLS community rapidly moved to deprecate RC4, resulting in RFC 7465, which banned them entirely” and “ *Dr. Paterson’s work was also a major impetus behind the move to AES-GCM.*” This impact is also evidenced by Apple’s letter of support [E1]: “ TLS 1.2 adoption rates went from a negligible percentage in 2013 to around 90% by 2016”.

In April 2014, the IETF TLS Working Group began to work on a new version of TLS, and this work was completed in late 2018 with the issuance of TLS 1.3 as RFC 8446 ( https://tools.ietf.org/html/rfc8446). This new version does not allow RC4 at all; the TLS Working Group’s charter ( https://datatracker.ietf.org/wg/tls/charter) explicitly says that one of the priorities for TLS 1.3 was to “ Update record payload protection cryptographic mechanisms and algorithms to address known weaknesses in the CBC block cipher modes and to replace RC4.” Thus, Paterson’s research is having a long-lasting impact on the development of the TLS protocol as a whole. To quote from Mozilla’s letter [E3], “ It is very rare to see this direct and immediate an impact by research on a standard as widely deployed as TLS”.

Beyond the impact of the research on the web, it has impacted other sectors including improving the security of card payment data protection. The initial RHUL attack on RC4 in 2013 was assigned a Common Vulnerabilities and Exposures record (CVE-2013-2566). In 2014 the CVE score eventually became high enough that the US Department of Commerce National Institute of Standards and Technology (NIST) published “Guidelines for the Selection, Configuration, and Use of Transport Layer Security (TLS) Implementations” [E9] in which the use of RC4 was not approved. Following the NIST guidelines in February 2015 the Payment Card Industry Security Standards Council banned the use of RC4 when assessing compliance with the PCI-DSS standard for payment data protection [E10].

Global benefits of improved security

Since just about everything that we do on the Internet, including e-commerce, website logins and e-mail relies for its security on TLS, a vulnerability in TLS has a blanket impact, affecting individuals, service providers, merchants, governments, utilities and the military. More succinctly, identifying and fixing a security problem in a protocol that is core to Internet security benefits the approximately 4,800,000,000 Internet users ( http://www.internetlivestats.com/internet-users/), which includes the 2,200,000,000 email users and the approximately 600,000,000 website owners, as well as the companies that provide service hosting solutions and the service providers that run them. The global annual value of e-commerce alone has been estimated at several trillions of US dollars. To suggest a percentage of this that could be affected by the research would be speculation, and of course by detecting and preventing a problem we lose the chance to measure its effects. However, it is clear that the total value of e-commerce makes it an enormous target that justifies attacker efforts to implement very sophisticated attack strategies, and so the research to identify and fix serious vulnerabilities in TLS, the main protocol used to secure e-commerce, and thereby to contain losses, is absolutely vital. The longer-term beneficiary is the emerging electronic society at large, which will benefit from having more secure, and therefore more confidence-inspiring systems. We conclude by quoting from Cloudflare’s letter of support [E4]: “ This research was highly significant: TLS is one of the world's most important secure protocols, and the foundation for most secure communications on the Internet, so understanding and improving its security is of critical importance to Cloudflare’s mission and the Internet at large.”

Context

Prior to the research of the case-study team (2014 to 2020), IBM was struggling with the problem of how to scale and secure their distributed computing products for the cloud computing and Blockchain industries. Solutions founded on Royal Holloway’s research helped to consolidate IBM as a market leader in these industries. This case study describes the economic benefits to IBM and its customers, as well as how the research led to environmental and societal benefits through IBM’s Blockchain platform.

Scaling IBM Cloud Computing to serve large enterprise customers

In the cloud computing sphere, the main beneficiaries were IBM and large enterprise customers using WebSphere Liberty (WL), IBM's market-leading application server platform.

In 2014, the scalability of large enterprise customer deployments of WL was increasingly bottlenecked by the inability of WL's replicated configuration store, Liberty Collectives, to handle the corresponding load increase from configuration and critical metadata updates. These enterprise customers were particularly important to IBM, since access to the Liberty Collectives feature is only available as part of the lucrative WL 'Network Deployment' premium enterprise license.

As a result of Royal Holloway’s research, IBM was able to meet these customers' scalability requirements. According to Vita Bortnikov, Distinguished Engineer, Chief Architect for Cloud and Blockchain Platforms at IBM Research, Haifa, the research “ ... has been contributing to a sustained growth in the product's customer base as well as contributing to new revenue streams.” (Source S1). The financial and economic impact of the research on IBM was recognised by an outstanding recognition award from IBM research, which according to Vita Bortnikov “ *... reflects not only novelty and technical innovations of the work, but also impact it made on IBM revenue of the WebSphere Liberty product it was contributed to.*” (S1)

As an indication of the total economic impact (TEI) and return on investment (ROI) of WL for IBM's customers, IBM commissioned an independent study in 2018 by Forrester (S2). The study surveys 30 US-based IT decision makers in large multinational companies (approximately 14,000 employees and USD4,000,000,000 revenue for a typical company). The overall benefit of WebSphere Liberty to these organisations is estimated at approximately USD150,000,000 (09-2018) over 3 years (USD5,000,000 per org).

Meeting commercial demands of IBM’s Blockchain Platform for security and scalability

Direct beneficiaries of the team’s work in the Blockchain space are IBM and IBM customers and industry consortia using HyperLedger Fabric (HLF). HLF provides the foundation for IBM’s market leading Blockchain platform, in combination with associated cloud computing technology such as IBM Cloud Pak for Applications, of which WL is a key component.

Prior to 2017, the market for so-called 'permissioned' enterprise blockchains was in its infancy, but its potential to transform whole industries through increased collaboration between industry competitors was clear. In conversations with market leaders from several industries (e.g. food and shipping/logistics), IBM identified several key technical shortcomings of existing permissioned Blockchains, which according to IBM’s Vita Bornikov included *“…large volume of transactions and transaction provenance.*” (S1).

To address these issues, in 2017 IBM incorporated Royal Holloway’s research into a new gossip-based dissemination framework for HLF. According to IBM's Vita Bortnikov " Since 2017 there is a huge number of commercial deployments and consortiums based on HLF … The work of this research was instrumental to the important requirements of those customers" (S1). Prominent examples of these consortia include FoodTrust and TradeLens, which according to IBM's Vita Bortnikov " ... are probably the biggest Blockchain consortiums today." (S1). Founding members of FoodTrust include household names such as Walmart and Nestle (S3), while TradeLens (S4) involves 175 unique organizations as of 2019, including 5 of the world’s 6 largest ocean carriers (e.g. Maersk) (S5). In addition to benefiting its customers, the economic and financial impacts on IBM were recognised through IBM outstanding awards at both research and corporate level (S1).

To illustrate the total economic impact on IBM’s customers of IBM DLT (Blockchain), in 2018 IBM commissioned an independent survey by Forrester (S6). Forrester interviewed six organisations with experience using IBM’s Blockchain, including three Canadian companies in the utilities, financial services and IT industries, a global transport and logistics company, and a joint venture of nine global banks. The survey estimated a net benefit from IBM’s Blockchain for a typical organisation over 5 years of between USD2,700,000 (low) - USD36,000,000 (high). For IBM, the revenue from HLF was estimated at approximately USD220,000 (07-2018) per customer per year in licensing and ongoing development fees after an initial pilot phase. Furthermore, in 2018 IBM’s share of the overall blockchain market of approximately USD700,000,000 (01-2018) was estimated at 32% (S10).

Improving the Environment and benefitting Human Rights

Finally, through the IBM Blockchain platform the team’s research has contributed to substantial environmental and societal impacts. For example, a company called PlasticBank are using IBM Blockchain to reduce ocean plastic waste through monetizing recycling in economically disadvantaged parts of the world (S7). As of 2020, PlasticBank have recovered over 14,000 tonnes of ocean-bound plastic, with collectors active in countries such as Haiti, the Philippines and Indonesia (S8).

As another example, iPoint, a market leader in the field of conflict minerals reporting software, used IBM Blockchain in 2018 to 2019 to launch SustainBlock, a platform to track conflict minerals from areas such as the Democratic Republic of Congo and Rwanda, providing an immutable record of the resources throughout the supply chain (S9). SustainBlock gives mines an incentive to comply with sustainability and conflict-free mining requirements, and helps downstream companies ensure their products aren’t used to finance conflicts and are free of slavery and child labour. A pilot study of SustainBlock was conducted in 2019, focused on two tungsten mining sites in the African Great Lakes region. To participate in the network, the companies needed to prove they are following responsible business practices.

“Professor Coles-Kemp’s research has shown that people’s needs, values and preferences have hitherto not been part of cyber security goals and yet are integral to building a more secure organisation…. Professor Lizzie Coles-Kemp’s research and thought leadership in the field has been central to this mindset shift, along with a portfolio of multidisciplinary research that we recognise to being critical to the success of NCSC’s endeavours both now and well into the future”. Head of Research, National Cyber Security Centre (E.5.5).

Coles-Kemp’s research has transformed how the National Cyber Security Centre (NCSC) engages with stakeholders and increased socially inclusive forms of cyber security practice. Her research provided an evidence-based approach that has driven a culture change, resulting in marginalised neighbourhoods and other communities putting in place digital security practices appropriate to their situations. Safer digital inclusion has gained greater political focus during the COVID pandemic and the importance of a digital security for all has come to the fore. Coles-Kemp’s research has informed policy discussions and shaped cyber security practice at a national level in the UK, and as well as providing guidance to communities in the UK, Australia and Sweden.

Informing a step-change in cyber security policy and practices:

The primary beneficiary of Coles-Kemp’s research is NCSC, the UK’s major source of cyber security knowledge for business, industry, government and third sector. Coles-Kemp’s research on the wider social dimensions to security practice has been adopted by the NCSC. It has been central to the organisation, changing the way they design security policies and controls to include with the people who use it. This has led to a significant step-change in its objectives and methods used when engaging with stakeholders resulting in wider participation in cyber security practices and the recognition of a more diverse range of cyber security issues.

This step change was first signalled in the NCSC’s keynote speech at the leading industry conference, CyberUK, in March 2017 (E.5.1) . In 2019, NCSC published guidance, You Shape Security (E.5.2, E.5.5), which emphasises the need for wider engagement practices using approaches such as creative securities to build trust between people and security practitioners. Engagement with the You Shape Security guidance has been extensive, receiving 5,500 unique page views, and a recommendation as a resource by the Centre for the Protection of National Infrastructure (CPNI) (E.5.4). NCSC has used this guidance and Coles-Kemp’s Creative Security engagement toolkit (E.5.2, E.5.5 ) to engage private and public organisations and the wider cyber security community and promoted this approach across its client base. The benefits of this people-centred approach are described by a NCSC client as: “ new trust and communication channels between our employees and the security practitioners in understanding day-to-day frustrations and barriers to good behaviours and in wanting to develop practical, usable solutions that fit with [our] operations and culture.” General Manager, Cyber Resilience, AXELOS (E.5.7).

NCSC has adopted Coles-Kemp’s creative security methods to deliver parts of its sociotechnical events programme. Examples include the use of creative security methods to run workshops at CyberUK, a security industry conference that attracts approximately 8,000 delegates each year (E.5.5). In 2016 her creative methods were used in a CyberUK workshop to encourage people-centred approaches among cyber security practitioners, and their feedback helped NCSC to position the You Shape Security guidance. In 2017, NCSC used Coles-Kemp’s toolkit in a CyberUK workshop where circa 50 security practitioners used creative engagements to describe and explore their career paths into cyber security (E.5.5). The approach was also used to encourage more girls to consider computing and cyber security as a career. The technical architect of the CyberFirst Girls competition for Year 8 girls applied Coles-Kemp’s thinking, reaching more than 4,000 girls in 2018 (E.5.5).

Coles-Kemp’s research has also influenced security practitioners in Melbourne, Australia who are part of The Security, Influence and Trust Group – a Melbourne-based security practitioner organisation. The group has placed Coles-Kemp’s people-centred approach at the core of its programme since its inception in 2016. “ This relationship helps to ensure our communities continue to benefit from new methodologies to solve complex cyber security challenges.” Co-Founder Security, Influence and Trust group, Australia *(*E.5.6 ).

Creating digital security resilience within marginalised communities and young people:

Coles-Kemp’s collaborative research with third sector and educational organisations has shaped understandings of digital security issues leading to process, practice and policy change.

Marginalised communities: Coles-Kemp’s research in Sunderland between 2013 and 2016 led community groups (Pallion Action Group, Parker Trust and the Jubilee Centre) to identifying the security issues that affect them. This enabled community workers to develop support programmes that engaged a wider community in digital security issues. For example, digital welfare research conducted with Pallion Action Group enabled community workers to plan for changes to the welfare system (E.5.8). The Director of Parker Trust and Manager of Pallion Action Group explains the research has (E.5.8): “ given us a sense of the challenges that our community is likely to experience as a result of the services going on-line and this enabled us to plan ahead and put the necessary support in place.” Coles-Kemp’s research was also used by Pallion Action Group to set-up a support group for families separated by prison.

Between 2018 and 2020, Coles-Kemp extended this mode of engagement to work with hard-to-reach groups in Hull to support the establishment of practical programmes for safer digital inclusion. She then used the same approach with two schools in Southern Sweden that specialised in supporting refugees to re-settle in Sweden in order to help the schools develop safer digital inclusion programmes.

Young People: Coles-Kemp’s research has been adopted by those working with young people to address issues of digital safety and develop a pupil-centered e-safety programmes. For example, a secondary school in Oxfordshire used Coles-Kemp’s participatory approach to establish a pupil committee that works together with staff and senior management to develop and implement school e-safety policies. The research has led to a transformation of the school’s e-safety programme and practice, leading to more controlled mobile phone and social media use, the reduction of pupil stress-levels and a programme of collaborative engagement with parents and pupils (E.5.9).

Safer Digital Inclusion in a Post-COVID Society

In the build-up to the UK’s COVID lockdown in March 2020, Coles-Kemp’s expertise was sought after to inform programmes orientated towards community digital service delivery. As part of her work as Co-Investigator on the EPSRC-funded Network+ Not-Equal, Coles-Kemp worked with other members of Not-Equal to consult with 20 non-academic partners, predominantly from the Third Sector, to find out what challenges they faced in their work to support communities (E.5.3). This consultation enabled Coles-Kemp to understand the pressures and challenges of safely using digital technologies during COVID lockdowns. This informed the community research that Coles-Kemp undertook during the latter half of 2020, including a consultation on digital identity commissioned by DCMS.

DCMS used this report to inform its digital identity programme. The need to focus on safer digital inclusion has become even more apparent in the shift to digital delivery and engagement necessitated by the COVID pandemic and, as a result, the consultation report has been of use to a number of other government departments and agencies, including the Ministry of Justice, Office for National Statistics and NCSC. The work was described by Matt Warman, the Minister for Digital Infrastructure, as “ *vital research on digital identity and inclusion that will inform our policy development going forward, ensuring everyone who wants a digital identity can have one.*” (E.5.10)