Does anyone have an idea of what kind of public-key technologies are used in the bank perimeter ? Does banking card embedded x509 certificate ? OpenPGP ?

Perhaps a standard exists or a de-facto standard.

  • What kind of card? Emboss card can have only the information you see. Magnetic stripe cards in most cases don't have any additional data encoded. Chip cards you can read about here: en.wikipedia.org/wiki/EMV – Agent_L Jan 2 '15 at 14:23
  • Can you explain what you mean by the "bank perimeter"? Online banking, bank cards, credit cards? There are many standards involved. You might want to look up information on "PCI" compliance. – Julian Knight Jan 2 '15 at 23:47
  • My question may not be really accurate, but I wonder if bank cards are quite similar to "corporate PKI" smartcard regarding certificate issue (x509, RSA key pair for authentication/signature) ? – crypto-learner Jan 3 '15 at 0:37

No, banks tend to use somewhat different technologies from the rest of the world. This doesn't necessarily mean that they use weak cryptography: banks tend to be good at risk management, and to put just enough money in security to make attacks rare without putting so much that security would cost more than the attacks that it would prevent. (As a customer of banks, the flaw in this approach is that it doesn't take account risk for the customer — that only enters the equation when banks are worried that some customers will be so unhappy that they'll change banks, which itself has a high cost for the customer.) For example, a lot of banking protocols still use 3DES when most of the rest of the world has standardized on AES.

The current standard used by major banking card providers is EMV. EMV uses some well-known building blocks: 3DES, SHA-1, RSA. This has been the standard protocol suite in Europe since the mid 2000s; a lot of other countries have migrated since then or are migrating. Many cards and terminals also support various legacy (often national) protocols for backward compatibility. Security is only as strong as the weakest link in the chain. Banks are pushing for EMV adoption by shifting liability for breaches to merchants when legacy protocols are used for a transaction, in order to convince merchants to renew their equipment to a newer generation that supports EMV.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.