Related article on encryption from WSJ($) site
TriStrata to Sell New Software For Protecting Computer Data
By DON CLARK
Staff Reporter of THE WALL STREET JOURNAL
REDWOOD SHORES, Calif. -- A quiet start-up company called TriStrata Security Inc. is starting to make noise in the hush-hush world of computer security.
The closely held company this month will begin marketing an unusual technology for scrambling computer files, electronic mail and multimedia data to keep them from thieves or eavesdroppers. TriStrata says its software, under development for five years, is hundreds of times as fast as conventional encryption techniques that banks and companies have used since the 1970s and that are the current favorites for protecting electronic commerce on the Internet.
TriStrata's claims have caused controversy in security circles. Bruce Schneier, an expert at security-consulting firm Counterpane Systems in Minneapolis, criticizes the company for being stingy with technical details and doubts it offers speed or security advantages. "These guys have no clue," he says.
But Fred Piper, a British code expert hired to try to crack the system, said he has seen enough to conclude that TriStrata's technology may represent a breakthrough in a field that has been rehashing similar ideas for two decades. "I don't want to go over the top until we've completed our analysis, but what they've done is something I didn't realize could be done," said Mr. Piper, who runs an information-security group associated with the University of London. "It's exciting."
Founder's Past Achievements
TriStrata's founder, John Atalla, has made waves before. The 74-year-old scientist is credited with inventing personal-identification number systems used in automated-teller machines, and pioneered a landmark change in early semiconductor manufacturing techniques. Individual investors in the company include former Hewlett-Packard Co. Chief Executive John Young, former Wells Fargo & Co. President William Zuendt and Thomas Perkins, co-founder of the venture-capital firm Kleiner Perkins Caufield & Byers.
In a surprise coup, TriStrata last week recruited Paul Wahl, the highly regarded U.S. chief of German software giant SAP AG, who helped build that unit to nearly $2 billion in annual sales. "TriStrata could be as big as SAP America," Mr. Wahl predicted in an interview Friday.
Mr. Atalla built and sold a company that supplies encryption devices that protect withdrawals and deposits on about 80% of ATM machines. He said he was persuaded to come out of retirement by Mr. Zuendt and other bankers who were looking for new ways to safeguard similar transactions on the Internet.
In conventional encryption, computer data are scrambled using mathematical operations based on a special formula that acts as a key. The recipient of a scrambled message, armed with the right key, can reverse the process and turn a stream of gibberish into readable text.
But managing thousands or millions of encryption keys is a complex, computing-intensive task. Mr. Atalla says he concluded in 1993 that companies would find conventional encryption too cumbersome to commit fully to doing business electronically.
An Idea From 1917
Mr. Atalla, like some others, was inspired by a concept that scientist Gilbert Vernam developed in 1917 and still is used by spies. In this approach, each letter of a message is changed to code by an addition process determined by randomly generated characters. Spies kept code books containing pages of random letters; the difficulty of distributing and protecting the random data has prevented Vernam codes from wide use in business.
But Mr. Atalla believed computers would one day be powerful enough to generate a set of random numbers so vast that the same set could be used in every server computer that manages encryption operations. If the repository of numbers is large enough, the odds become infinitesimal that any code pattern will repeat to help eavesdroppers crack the system, he argued. Since TriStrata uses simpler calculations than conventional encryption, data can be scrambled very quickly.
In a demonstration, the company's software scrambles a standard word-processing file in one-hundredth of a second; a larger file of about 14 million bytes (which might be the size of a graphics file for a house design) can be changed to code in one-fifth of a second. The system is fast enough to scramble computerized video signals at the moment they are sent over the Web, a capability that the company expects customers to use to protect video conferences or entertainment broadcasts.
TriStrata also has a radical strategy for helping companies manage security. Every coded transaction is centrally authorized by its server software, which closely monitors all attempts to tap into a system. A small group of people at each company is designated to set security policies, and must act unanimously to modify rules or retrieve data.
The approach runs counter to the decentralized philosophy of the Internet, and means that an attacker who could crack its central server machine could steal an entire company's information, Counterpane's Mr. Schneier argues. Assuming that won't happen, however, some companies like the idea of being able to swiftly cut off an errant user's access to their systems or retrieve sensitive information that an employee encrypted. So does the U.S. government, which wants to retain the ability to decode information needed for law enforcement or national-security reasons; as a result, TriStrata's technology has been granted unusually broad export approval.
TriStrata's software typically costs $250,000 for each server, plus $100 to $200 for each user. PricewaterhouseCoopers, the big accounting and consulting firm, has announced plans to use it internally and is setting up a business to help companies install it. So is Vanstar Corp., an Atlanta computer-services company. Andrew Shimberg, a Vanstar vice president, said top company executives are excited about the centralized approach, though some corporate security officers are scratching their heads. "It really does challenge what they know," he said. |
