The Federal Government has brought the idea of building a Public Key Infrastructure (PKI) as mooted by the Nigerian Computer Society (NCS) and other stakeholders in the Information Technology (IT) sector. But without the enabling law, the project may remain wishful thinking, LUCAS AJANAKU reports.
Perhaps, one of the legacies Prof Cleopas Angaye would love to leave behind as helmsman of the National Information Technology Development Agency (NITDA) is the actualisation of the Public Key Infrastructure (PKI) designed to secure the country’s cyber space.
Angaye said if the nation is to achieve its Vision 20:2020, it must embrace the PKI initiative. The project, he said, would be founded by the public and private sectors. He added that PKI is the only framework that satisfies the privacy, authentication, integrity and non-repudiation (PAIN) principle of security.
“A PKI is a collection of security technologies, procedures and policies that collectively provide a framework for addressing, using cryptography, the fundamental security issues of privacy, authentication, integrity, non-repudiation and access control in data communication,” Angaye said.
He said PKI would lead to the creation of digital signatures, which provide evidence of “who did what to whom” that is critical to securing electronic transactions involving high legal risks or meeting compliance requirements. He added that when digital signatures are finally integrated into smartcards, the technology will be recognised as “the only practical solution to (eavesdropping and account hijacking) which is plaguing the country today.”
“Digital certificates can convey authority information like credentials, licenses and affiliations, among others, and digital signatures bind that authority information directly to messages to decentralise and greatly simplify transaction processing,” the former NITDA boss said.
He said digital signatures are persistent over both time and “distance” stressing that at any future time, a digitally signed transaction can be easily re-validated to prove where it originated from.
“The integrity of digitally signed data is not reduced by being copied or forwarded across systems or across borders.
“In contrast, other authentication technologies rely heavily upon audit logs to prove ‘who did what to whom’ therefore forwarding non-PKI transactions from one system to another complicates and dilutes the strength of the audit trail. So, KPI is uniquely suited to complex transaction environments where there might be multiple relying parties, structured data, formal authorisations and/or long lifetimes,” he explained.
The Central Bank of Nigeria (CBN) said when the PKI initiative is finally implemented, it will add a new vigour to ongoing reforms of the CBN under Sanusi Lamido Sanusi to encourage electronic forms of payment in line with the apex bank’s cahsless and financial inclusion strategies.
An Assistant Director, Information Technology Department, CBN, Segun Osunaike, said the initiative would boost electronic payment platform being promoted by the apex bank. He spoke on The Experience of the CBN on PKI in Lagos.
According to him, the apex bank had earlier run a model framework on PKI which recorded huge success because it guarded against the perpetration of fraud.
He said with the initiative, there will be absolute safety of transaction data. “We are talking of fraud here. It will give authorisation and authentication (to transactions and all the data associated with such transactions). If you by-pass the security, the ability to prove that you did it will be there. So it will eliminate fraud,” he told The Nation.
President, Nigeria Computer Society (NCS), Sir demola Aladekomo, said the response from Federal Government so far on deploying IT to address emerging challenges in the country has not been exciting. But he said the group has being working with other agencies of government to chat a way out of the new challenges posed by the mebrace of technology.
“We have been working with other agencies of government towards implementing a PKI infrastucrture for the country and our memebers are putting a lot of time, efforts and resources. The PKI is a basic infrastructure. When it comes to fighting crimes that are committed through IT, especially cyber crimes and crimes that involve the use of IT infrastructure. One of these tools is obviously the telephone. There is no crime that is committed without telephony, that will not involve possibly, the use of the mobile phone, possibly sometime, a personal computer. So, using PKI, after its implementation, we are going to be able to reduce crimes that involve telephony and other IT infrastructure drastically. We must thank NITDA for the major role it played towards producing the PKI blueprint for the country.
“Another is working with the National Assembly towards instituting or legislating on particular Act that can empower the Federal Government and the practitioners in minimising damages that can be caused,” Aladekomo told The Nation.
According to the draft document titled Public Key Infrastructure (PIK) Blueprint for Nigeria, the widespread use of digital signatures underscores the need for some form of entity to serve as a trusted third party (TTP) to vouch for individual’s identities and their relationship to their public keys. This entity in PKI terminology is referred to as Certificate Authority (CA), which is a trusted third party that issues digital certificates to its subscribers, binding their identities to the key pairs they use to digitally sign electronic communications.
“Digital certificates contain the name of the of the subscriber, the subscriber’s public key, the digital signature of the issuing CA, the issuing CA’s public key and other pertinent information about the subscriber nad his organisation, such as his authority to conduct certain transactions. These certificates have a life cycle of betwenn one and two years and can be revoked upon private key compromise, separation from an organisation,” the document read.
The document added that digital signatures are critical to the electronic conversion of any presently paper-based process that requires strong authentification of both the sender and the contents of the message and/or non-repudiation. The number of such applications is virtually endless, ranging from purchase order systems, form filling with any government, form processing to contracts and remote financial transactions or inquiries. PKI enbales the basic security services for such varied systems such as document management system, online value added tax (VAT) retuns, company registration, e-procurment, online banking and other functions.
On the legal teeth to make all these happen, the NCS boss said the computer body and other stakeholders are working on three bills that will help give teeth to the various initiatives of the government that will boost cybersecurity.
“There are about three different security bills that we are looking at. If these bills are expeditiously passed by the National Assembly, this will go a long way in addressing some of the concerns of the stakeholders in the industry,” he said