Is it still the DES algorithm used in banking/ financial transaction systems (in spite of the weak key issue)? Or whether it is the ECC algorithm that has replaced the DES? I believed that may be ECC is in use but came to know that it is still DES! Can someone, clarify what algos are actually in use and why.
DES is out-of -date. For confidentiallity we would surely Need AES-128/256/512. The key-size is up to you but 256 is sufficient enough. For integrity and authentification , a signature should be added to the message, which is a key-hashed Version of the message. an AES-HMAC can also be used. For secret key-exchange and non-Repudiation the ECC-based Diffie-Hellmann or RSA algortihm can be used.
Don't mix ECC and DES they are two completely different things. DES, as well as AES (the new standard) are symmetric algorithms this means that there is only one key which is used for both encryption and decryption (like your door). On the other hand, you have public key encryption where you have two keys, one for encryption (public) and a different one, for decryption. Such algorithms are RSA and ECC.
The most common set for transactions (not only financial) is AES, RSA and SHA (for hashing).
VISA (Most popular financial transaction company) is using following algorithms.
https://www.visa-asia.com/ap/sg/merchants/include/ais_bp_encryption.pdf
You can see VISA name on your debit cards also.
so, according to the above documentation, VISA generally uses DES (triple) and AES.
Don't forget that the online banking web interfaces do definitely belong to the familiy of financial transaction systems as well, because, ultimately, many transactions are initiated there! Such web interfaces usually rely on the contemporary versions of common ciphersuites. Thence, you should also regard the well-known TLS (Transport Layer Security) with the appropriate RFC at https://tools.ietf.org/html/draft-ietf-tls-tls13-11 during your research!
Symmetric is best for Confidentiality. Any algorithm with minimum 128 bits is sufficient for confidentially. Usually organizations may not disclose the algorithms used by them.
with today's computational facilities, 128 bit key may not be considered to be a strong key but it certainly to be a min 128 bit.
As per William Stallings Book, Table 2.2, page no. 62, 128 bits is sufficient.
But, it’s a battle between you and the crackers. Sometimes the crackers may success in few attempts.
It’s similar locking your room with your key and giving 100 keys to your friend to open the room. If it success in few attempts, then your friend is winner; if not your room is safe.
@Sivakumar Thangavel :thanks for the nice example!
If my frind is fortunate enough then will be able to open the lock in the very first attempt itself (the best case)and the worst case will need him/ her to try all the 100 keys! But both these are boundary conditions and are rare indeed. The solution space will comprise the average case.
Now coming to the timing part. How much time will b required to arrive at a solution?
If the person can try 5 keys per min then can open the lock in a maximum of 20 mins and if can try 20keys a minute then can reach at the solution merely in 5 mins.
- Badges
- Science topic
- Similar topics
- Biological Science
- Bioecology
- Systems Ecology
- Landscape Ecology
- Connectivity