Zero-Knowledge Proofs Offer Secure Cyber Risk Sharing for Critical Infrastructure
A new cryptographic approach, zero-knowledge proofs, could enable companies to share vital cyber risk information with the government without revealing sensitive proprietary data.
Zero-knowledge proofs (ZKPs) present a novel cryptographic solution that could allow organizations, particularly those operating critical infrastructure, to share essential cyber risk data without compromising proprietary information. This technology enables companies to cryptographically prove the existence of specific vulnerabilities within their systems, such as in power grids or communication networks, without disclosing detailed asset inventories, network configurations, or vulnerability scan results.
The challenge of sharing sensitive cybersecurity data has long been a hurdle for effective government-industry collaboration. While existing programs facilitate the exchange of indicators of compromise and incident reports, they have largely failed to encourage the sharing of pre-incident vulnerability data, which is often the most valuable for proactive defense. The very data that could help identify widespread risks – like detailed vulnerability scans – is also the most sensitive, as its exposure could provide attackers with a roadmap to exploit systems.
Traditional methods of data sharing also carry inherent risks. Once sensitive information leaves a company's control, it can be lost, stolen, subpoenaed, or used in unintended regulatory contexts. ZKPs offer a way to mitigate these risks by allowing a company to prove that an evaluation of its authorized scan data meets specific criteria, such as the presence of a particular software flaw, without revealing the underlying data itself.
The mechanism involves a cryptographic process where a company's internal scan data is used to generate a mathematical proof. This proof, when verified, confirms that a specific condition is met (e.g., a vulnerability exists within a defined set of systems) without exposing the raw data. The government or verifying entity receives only the verifiable proof, not the sensitive asset lists, network maps, or configuration details.
Recent tests conducted by FDD's Center on Cyber and Technology Innovation have demonstrated the viability of this approach. Using anonymized vulnerability data from three operational environments, researchers successfully verified the presence of 38 known vulnerabilities through ZKPs, sharing only the proofs and answers. This pilot confirmed that the core concept works, allowing for the assessment of vulnerability prevalence without exposing the underlying sensitive data.
Despite these promising results, widespread government adoption requires further development. Experts caution against rushing to implement national systems based on this technology. Instead, the recommended next step involves structured pilot programs, focusing on narrow, practical questions like vulnerability presence or security control implementation. Agencies like CISA and NIST, along with regulatory bodies, are well-positioned to lead these pilots and define the standards for trustworthy proofs.
While ZKPs may not be a panacea for all cyber information-sharing challenges, they offer a compelling solution to one of the most persistent problems: obtaining trustworthy answers about cyber risks without forcing companies to expose the very systems they are tasked with protecting. Proactive testing and development of this technology are crucial to prepare for future cyber crises.