Cybersecurity Technology Innovation

How QWERX Uses Time to Strengthen Device Authentication

John Ellingson
John Ellingson
Keys with clocks floating on a black background

Conventional thinking measures security in terms of the strength of the key and the lock. We are all familiar with the concept that a 256-bit key is stronger than a 64-bt key, even though a 64-bit key can produce 18,446,744,073,709,551,616 distinct values.

Conventional thinking measures strength by determining how long it would take a fast computer to break a strong key. The number is usually measured in years and that is considered to be good enough.

There are two basic problems with this approach:

  1. Computers are getting faster -- and even faster quantum computers are almost a reality.
  2. It only takes a fraction of a second to steal a key, regardless of how strong it might be.

At QWERX, we take an entirely different view: that of security over time. Instead of measuring a key simply as a matter of bits, we measure it in bits divided by its useful life, expressed in seconds. We chose seconds, because fast computers can do a lot of computations in a second and an attacker can steal millions of keys in a second. 

For example: A very strong key, like a 2048-bit key refreshed every 30 days (the best of today's best practices) would have a security value of 2048 (bits) divided by 2,592,000 (the number of seconds in 30 days). The result is a QWERX security value of 0.00079012345679.

A 64-bit key refreshed every tenth of a second in a QWERX-protected device would be treated as a value of 64 (bits) divided by 0.1. The result is a QWERX security value of 640, or 810,000 times stronger than the 2048-bit key in standard application for securing device authentication.

Bits plus time equals exponentially stronger security. That’s the QWERX solution.


Interested in how QWERX designed exponentially stronger device authentication into a lightweight, quantum-proof SaaS solution? Click here to learn more.
John Ellingson

John Ellingson

Follow me on LinkedIn Follow me on LinkedIn

John Ellingson is the Chief Technology Officer at QWERX. John started his digital career with the Boeing Company working on the 747 aircraft in the late 1960s. He became a computer-literate attorney performing what is today known as forensic accounting. As the founding chairman of the ABA/YLD Subcommittee on Tax Treatment in Bankruptcy, John worked with the Congressional Joint Tax Committee to create the Internal Revenue Code Provision enabling the tax-free merger and acquisition of debtor corporations. This law became part of the Bankruptcy Tax Act of 1980. John had a national M&A practice in this area and obtained the first IRS Private Letter Ruling on this Code section. As a result of this practice, he observed a frequent element of white-collar crime in many bankruptcy cases, and he subsequently developed and patented a method to detect identity fraud. The product derived from that patent is still deployed at most retail banks throughout the U.S. today. This success started John on a path of protecting digital systems and identity management. He continued in this role with American Operations Corporation and ASM Research before founding infOsci LLC and later QWERX, Inc. John holds numerous method patents in digital system security. John was appointed to the United States Air Force Academy and medically separated before graduation. He holds a Bachelor of Science degree from the University of Wisconsin and a Juris Doctor degree from Seattle University. For 20 years John served as a liaison officer with the United States Naval Academy and the United States Military Academy. He also served on the Service Academy Selection Boards for two U.S. Senators.

Leave a Comment