Thread by @TalBeerySec

1/ Solving the root cause of #GoldenSAML attacks, recently used in #Sunburst attacks.
Don't of scale security "UP", burying #SAML's private key deeper in HSM,
scale it "OUT": distribute it w/ modern crypto (#TSS #MPC)+ service architecture, as we do for #cryptocurrency @ZenGo

https://twitter.com/ZenGo/status/1353704727255642112

2/ Advanced attackers (#APT) steal long term secrets ("the stamp") that allow them to issue access tokens and thus access all services in victims' environment, bypassing all security, including multi-factor auth (#MFA,#2FA)

3/ @CISAgov recommends protecting such secrets with hardware (HSM), but this solution is not always feasible, does not scale well and is susceptible to vulnerabilities especially when facing #APT attackers (hence: "aggressively updated")
media.defense.gov/2020/Dec/17/20…

4/ Therefore a more feasible solution can be distributing the defenders' private key ("the stamp") with modern cryptography Threshold Signatures (#TSS) and having some portion of it outside of the defenders reach, and hence also outside of the attackers reach.

5/ The solution consists of 2 mandatory parts, TSS cryptography and the security architecture of an external service. It is the combination of these two parts that makes this solution effective.
See discussion @LindellYehuda @veorq @matthew_d_green

https://twitter.com/LindellYehuda/status/1322880088707420160?s=20

6/ This solution is VERY practical. We are using it to protect @ZenGo #cryptocurrency wallet customers for few years now. The problems are almost identical: protecting a private key by distributing it while still being able to sign (in fact #cryptocurrency is a bit harder)

7/ and if one service is not enough security, it can be easily scaled out to distributing the secret to multiple (>2) services
github.com/ZenGo-X/multi-…

A big shout out to @UriKelman for these great illustrations