Advances in Card Solutions 7 th Annual CACR April 25, th Annual CACR April 25, 2001

Certicom Overview  Founded in 1985, 340 employees - Offices in Toronto, San Francisco, Dulles, and London - Listed on both Toronto Stock Exchange & the NASDAQ  Strong patent portfolio in wireless/mobile security  Sponsors cryptographic research at University of Waterloo and Stanford University  Has over 150 licensees  Founded in 1985, 340 employees - Offices in Toronto, San Francisco, Dulles, and London - Listed on both Toronto Stock Exchange & the NASDAQ  Strong patent portfolio in wireless/mobile security  Sponsors cryptographic research at University of Waterloo and Stanford University  Has over 150 licensees

Security for the Next 20 Years  Encryption Underlies all Internet Security  Existing Encryption Technology is 20 Years Old  Certicom Owns the Next Generation Encryption Technology - Elliptic Curve Cryptography (ECC)  Designed for Mobile, Wireless Smart Card Environments  Security for the Next 20 Years  Encryption Underlies all Internet Security  Existing Encryption Technology is 20 Years Old  Certicom Owns the Next Generation Encryption Technology - Elliptic Curve Cryptography (ECC)  Designed for Mobile, Wireless Smart Card Environments  Security for the Next 20 Years

Industry Leading Customers

Agenda  PKI, Cards, Wireless – Where are we?  Common challenges  Security Solutions – how can Crypto help?  Success stories to watch…  Concluding Remarks  PKI, Cards, Wireless – Where are we?  Common challenges  Security Solutions – how can Crypto help?  Success stories to watch…  Concluding Remarks

Classic Hype Cycle Visibility Technology Trigger Peak of Inflated Expectations Trough of Disillusionment Slope of Enlightenment Plateau of Productivity Time

PKI Hype Cycle Source: Gartner Group Visibility Technology Trigger Peak of Inflated Expectations Trough of Disillusionment Slope of Enlightenment Plateau of Productivity Time Public Key Encryption Developed PGP Introduced 1994 RSA Conference Verisign formed Verisign IPO Entrust IPO 1999 RSA Conference Scotia Bank Deploys B2C PKI American Express Releases Blue Identrus Formed Verisign Acquires NSI Entrust Merges with EnCommerce Visa Announces 3-D SSL E-Sign Laws Signed PKI Disappears Into Application PC Makers add SmartCard Readers Industry Policy Authorities Form We are here

Smart Card Hype Cycle 1996 Olympics (Visa Cash) 1995 Mondex Swindon, England EMV New York Joint Trials American Express Launches Blue Visa Launches eVisa Are we here? Smart Card Disappears into card, device, etc PC Makers add SmartCard Readers Industry Policy Authorities Form Visibility Technology Trigger Peak of Inflated Expectations Trough of Disillusionment Slope of Enlightenment Plateau of Productivity Time

Wireless Hype Cycle Are we here? WAP SMS WTLS Location-based Services Visibility Technology Trigger Peak of Inflated Expectations Trough of Disillusionment Slope of Enlightenment Plateau of Productivity Time

Coming Together Visibility Time PKI Cycle Smart CardWireless eCommerce We must be here My “Optimist’s” view!

Information Security Threats Fraud  Problem - Impersonation or identity theft - Credit card fraud  Impact - Massive financial loss - Merchants absorb most of the losses - Slows adoption of e-Commerce  Problem - Impersonation or identity theft - Credit card fraud  Impact - Massive financial loss - Merchants absorb most of the losses - Slows adoption of e-Commerce

Credit Card Fraud  Meridien Research predicts that by 2001, online credit card fraud could cost merchants $9 billion a year, and that by 2003 the cost could reach $15 billion

Challenges  Wireless is bandwidth constrained - Pay per byte transmitted over networks - Latency of messaging - Proximity card performance  Battery life  Resource limitations - Smart card processors fit within 25 sq mm - PDA, pager, cell handsets  Devices may look different, but It’s the same problem  Wireless is bandwidth constrained - Pay per byte transmitted over networks - Latency of messaging - Proximity card performance  Battery life  Resource limitations - Smart card processors fit within 25 sq mm - PDA, pager, cell handsets  Devices may look different, but It’s the same problem

ECC – A Part of any Solution ECC Key Size (Bits) ECC Key Size (Bits) RSA Key Size (Bits) RSA Key Size (Bits) Key Size Ratio 1631,0241 : ,0721 : ,6801 : ,3601 : ,0241 : ,0721 : ,6801 : ,3601 : 27

Traditional Technology  Digitally Signed Transaction on a Palm VII Using Traditional Encryption Technology Not Viable!

Certicom Technology  Digitally Signed Transaction on a Palm VII Using Certicom Technology Instantaneous Trust!

Solutions emerging  Proximity devices  Intelligent use of Public Key technology - Not just PKI - Combinations of PK, PKI and trust models  Solutions for business needs  Proximity devices  Intelligent use of Public Key technology - Not just PKI - Combinations of PK, PKI and trust models  Solutions for business needs

Incentives for end customers  Sex appeal factor  Hide security from consumers  Assure privacy, integrity of transactions  For Financials - Make it smooth for the merchants - Avoid discount rate discussions ;-)  Sex appeal factor  Hide security from consumers  Assure privacy, integrity of transactions  For Financials - Make it smooth for the merchants - Avoid discount rate discussions ;-)

Example successes  Proximity in North America - WMATA - Mobil Speed Pass  Large card rollouts - American Express Blue - eVisa - MasterCard announcement with Keycorp  Key differences… - Proximity solutions seem to gain user acceptance!  Proximity in North America - WMATA - Mobil Speed Pass  Large card rollouts - American Express Blue - eVisa - MasterCard announcement with Keycorp  Key differences… - Proximity solutions seem to gain user acceptance!

Proximity solutions  ECC enables secure solutions - Payment - Terminal communications  Total transaction time required - <150ms  ECDSA Sign Performance by Certicom - < 90 ms for a signature  Viable for demanding proximity protocol solutions  ECC enables secure solutions - Payment - Terminal communications  Total transaction time required - <150ms  ECDSA Sign Performance by Certicom - < 90 ms for a signature  Viable for demanding proximity protocol solutions

On Card Key Generation  Private key is “perfect secret” - A random number  Public key is computed by multiplying private key with the “generator point” - Same complexity as signature generation  No risk of primality testing  Total process typically less than 2 seconds  Enables keys as demanded by business process, user generated - Avoids key injection requirements at mfg time  Private key is “perfect secret” - A random number  Public key is computed by multiplying private key with the “generator point” - Same complexity as signature generation  No risk of primality testing  Total process typically less than 2 seconds  Enables keys as demanded by business process, user generated - Avoids key injection requirements at mfg time

PK Solutions to Match  Digital Signature Authentication Solutions  Just in time security - On card key generation for business app use - TrustPoint PKI Portal registration of keys - MobileTrust CA services  Small certificates by design - CA supports business process - NOT business process driven by CA  Digital Signature Authentication Solutions  Just in time security - On card key generation for business app use - TrustPoint PKI Portal registration of keys - MobileTrust CA services  Small certificates by design - CA supports business process - NOT business process driven by CA

System Architecture Secure Client Application Secure Client Application Secure Server Application Secure Server Application PKI Client Protocols Client Certificate Crypto PKI Tools Server Certificate Protocols Crypto Certificate Authority (CA)Registration Authority (RA) Public-key Infrastructure Wireless Device Application Server

TrustPoint PKI Portal

Conclusions  ECC solutions provide the Right solution for todays security needs  Proximity solutions need high security – ECC meets the challenge - On card key generation - <150ms total transaction times  Emerging business applications need Public Key Technology  ECC solutions provide the Right solution for todays security needs  Proximity solutions need high security – ECC meets the challenge - On card key generation - <150ms total transaction times  Emerging business applications need Public Key Technology