Skip to main content
Information Security

Return to Question

replaced http://security.stackexchange.com/ with https://security.stackexchange.com/
Source Link
Community Bot
Community Bot
  • 1

So, when i do an online payment transaction i "signsign" my transaction with my digipass using some sort of a MAC (HMAC) with a shared key and some information that is unique for this transaction.

But using this scheme, how can a bank "proof" later (in court for example) that you did this tranaction? The bank has to store the same shared key? With RSA digital signatures they can claim that only i could sign this transaction because only i have the private key matching the public key. But here the key is symmetric (the shared key between you and the bank)?

How is this done? Can it be done? Is there some sort of formal standard that banks use?

Thanks (as always) for your help!

So, when i do an online payment transaction i "sign" my transaction with my digipass using some sort of a MAC (HMAC) with a shared key and some information that is unique for this transaction.

But using this scheme, how can a bank "proof" later (in court for example) that you did this tranaction? The bank has to store the same shared key? With RSA digital signatures they can claim that only i could sign this transaction because only i have the private key matching the public key. But here the key is symmetric (the shared key between you and the bank)?

How is this done? Can it be done? Is there some sort of formal standard that banks use?

Thanks (as always) for your help!

So, when i do an online payment transaction i "sign" my transaction with my digipass using some sort of a MAC (HMAC) with a shared key and some information that is unique for this transaction.

But using this scheme, how can a bank "proof" later (in court for example) that you did this tranaction? The bank has to store the same shared key? With RSA digital signatures they can claim that only i could sign this transaction because only i have the private key matching the public key. But here the key is symmetric (the shared key between you and the bank)?

How is this done? Can it be done? Is there some sort of formal standard that banks use?

Thanks (as always) for your help!

Tweeted twitter.com/#!/StackSecurity/status/320036701294706689
Source Link
Anonymous
Anonymous
  • 333
  • 2
  • 11

Online banking proof of transaction for vertification in court

So, when i do an online payment transaction i "sign" my transaction with my digipass using some sort of a MAC (HMAC) with a shared key and some information that is unique for this transaction.

But using this scheme, how can a bank "proof" later (in court for example) that you did this tranaction? The bank has to store the same shared key? With RSA digital signatures they can claim that only i could sign this transaction because only i have the private key matching the public key. But here the key is symmetric (the shared key between you and the bank)?

How is this done? Can it be done? Is there some sort of formal standard that banks use?

Thanks (as always) for your help!