Felix Eigelshoven, DFNS Asia-Pacific head, delivers keynote at WDAF
Digital signature-based protections vulnerable to AI pattern recognition
AI-driven social engineering attacks set to grow more sophisticated
Flexible, hardware-agnostic systems and zero-trust model urged
"Will the assets you hold today still be safe tomorrow?"
As AI and quantum computing advance rapidly, experts are warning that the current framework for protecting financial assets may no longer be secure. Digital signature-based protections are particularly at risk, given AI's strength in recognizing patterns — and the call is growing for a new security architecture built on flexible, platform- and hardware-agnostic systems capable of adapting to external shocks.
Felix Eigelshoven, head of Asia-Pacific at DFNS, sounded that alarm Monday at the first World Digital Assets Forum (WDAF), hosted by The Herald Business and The Korea Herald at The Grand Lotte Seoul in Sogong-dong. "Every industry that relies on digital signatures — finance, telecommunications and beyond — needs to worry about this problem," he said. "Digital assets stored on blockchains, which are largely built on digital signature mechanisms, are particularly exposed."
Eigelshoven pointed to an inherent vulnerability in the digital signature system itself. AI and quantum computers are purpose-built for probing weaknesses and identifying patterns, he said, and the lattice-based structure that underpins digital signatures makes them a natural target for AI-driven attacks.
"Digital signature technology uses a lattice-based approach that relies on geometric structures — and given AI's exceptional ability to recognize patterns and uncover structure, that is a dangerous characteristic," he warned. "AI is being used to probe for vulnerabilities and find patterns, and in many fields it is accelerating timelines faster than anyone anticipated."
He said the nature of recent attacks makes them increasingly difficult to counter. "Attackers are not breaking the cryptographic system directly — they are deceiving people to gain access," Eigelshoven said. "As AI advances, these attacks will only become more sophisticated."
Some have argued that simply storing assets in a completely air-gapped environment eliminates the risk, but Eigelshoven said that is not a complete solution either. "As quantum computers advance, there is a real possibility of deriving a private key from a public key," he said. "If a public key has ever been exposed, that could become a serious problem."
He added that public keys can be exposed in the ordinary course of using a wallet address, meaning that storing assets in a cold wallet alone is not sufficient. Eigelshoven said an overhaul of security frameworks is inevitable, and stressed that any new architecture must avoid dependence on specific hardware, cloud services or platforms. "It is uncertain which approach will prevail as new security standards are developed, but every industry may need to change its security infrastructure at least once," he said. "Dependence on any single piece of hardware or cloud service must be avoided."
His proposed solution centers on two principles: flexible systems and a zero-trust model. "When infrastructure changes, organizations must be able to migrate to a different system," he said. "If an entire infrastructure and business model depends on a single piece of hardware or a single vendor, that is a vulnerability."
"A zero-trust model must be implemented — one that does not inherently trust any user or system, but verifies everything," he said. "Every external access attempt must be verified."
The zero-trust model is a concept the Financial Services Commission recently highlighted in its plan to reform the financial sector's security framework. The regulator said it would fully lift network-separation regulations while introducing a model that verifies all external access attempts.
"When choosing a technology, you need to ask whether it will remain secure in the quantum computing era, and whether you can switch to a different technology when necessary," Eigelshoven said. "When you change technologies, you must also be able to change the underlying infrastructure — hardware, cloud and all."
hyuk@heraldcorp.com
