Cryptography in the Banking Industry

Vol. 1, No. 1, 1-7 Arpan K Kar (corresponding author) [email protected] Supriya K Dey

Abstract: The development of cryptographic techniques has seen a lot of applications in the banking industry. This whitepaper focuses on the review of the major cryptographic techniques which has been used extensively in the banking industry, for the implementation of data security norms and the fulfillment of compliance requirements. While techniques have not been described in details, the focus has been on exploring the business implications of these developments. This paper must be cited as follows: Kar, A.K., Dey, S.K. (2012). Cryptography in the Banking Industry. Business Frontiers, 1(1), 1-7.

2012

Cryptography in the Banking Industry

Kar & Dey

INTRODUCTION TO CRYPTOGRAPHY Cryptography is the study of abstracting information from undesired users of the same. Cryptography techniques have long been used in the banking industries to ensure the security of monetary transactions including the security of ATM cards, computer passwords, and electronic commerce. Until modern times, cryptography referred almost exclusively to encryption, the process of converting ordinary information (plaintext) into unintelligible gibberish (i.e., cipher-text). Decryption is the reverse, moving from unintelligible cipher text to plaintext. A cipher is a pair of algorithms which creates the encryption and the reversing decryption. The detailed operation of a cipher is controlled both by the algorithm and, in each instance, by a key. Some more popular methods used in cryptology in the financial institutions like banks are public-key cryptography, symmetric-key cryptography and triple DES cryptography. Cryptography tries to ensure the following objectives through various techniques: Authentication: The process of proving one's identity. Privacy/confidentiality: Ensuring that no one can read the message except the intended receiver. Integrity: Assuring the receiver that the received message has not been altered in any way from the original. Non-repudiation: A mechanism to prove that the sender really sent this message.

Cryptography, then, not only protects data from theft or alteration, but can also be used for user authentication. TYPES OF CRYPTOGRAPHIC ALGORITHMS There are several ways of classifying cryptographic algorithms. For purposes of this study, they will be categorized based on the type of keys that are employed for encryption and decryption, and further defined by their application and use. The three types of algorithms that will be discussed are Public Key Cryptography (PKC), Symmetric Key Cryptography (SKC) and now use the Triple Data Encryption Standard (TDES). Banks started using cryptographic techniques using PKC at first, and then they started using SKC. SKC usage finally evolved to Triple DES from DES.
Business Frontiers Vol. 1, No. 1. Page 2 of 8

2012

Cryptography in the Banking Industry

Kar & Dey

PUBLIC-KEY CRYPTOGRAPHY OR ASYMMETRIC KEY CRYPTOGRAPHY James H. Ellis, Clifford Cocks and Malcolm Williamson (1972) proposed the first public key cryptography algorithms. Whitfield Diffie and Martin Hellman (1976) furthered their work with contributions on method of public-key agreement. This method of key exchange, which uses exponentiation in a finite field, came to be known as Diffie-Hellman key exchange. Public-key cryptography is a method for secret communication between two parties without requiring an initial exchange of secret keys. It can also be used to create digital signatures. Public key cryptography is a fundamental and widely used technology around the world, and enables secure transmission of information on the Internet and was first embraced by banking institutions for sensitive data transfer operations. It is also known as asymmetric cryptography because the key used to encrypt a message differs from the key used to decrypt it. In public key cryptography, a user has a pair of cryptographic keys a public key and a private key. The private key is kept secret, while the public key may be widely distributed. Messages are encrypted with the recipient's public key and can only be decrypted with the corresponding private key. The keys are related mathematically, but the private key cannot be practically derived from the public key. The two main branches of public key cryptography studies are: Public key encryption a message encrypted with a recipient's public key cannot be decrypted by anyone except a possessor of the matching private key -- presumably, this will be the owner of that key and the person associated with the public key used. This is used for confidentiality. Digital signatures a message signed with a sender's private key can be verified by anyone who has access to the sender's public key, thereby proving that the sender had access to the private key (and therefore is likely to be the person associated with the public key used), and the part of the message that has not been tampered with. A major advantage of using public key encryption is the ease of distribution of the keys. These public keys may be used for distributing subsequent keys, or for protecting data communicated
Business Frontiers Vol. 1, No. 1. Page 3 of 8

2012

Cryptography in the Banking Industry

Kar & Dey

between devices. In a network of n cryptographic devices, on the order of n 2 initial keys are needed in order for all pairs of devices to communicate securely. The most conventional method for distributing the keys has been via manual delivery such as with trusted couriers. This is generally not cost-effective for a large network consisting of thousands of cryptographic devices. With public key cryptography, electronic distribution of initial keys is more feasible and economical using a simple, widely known protocol. For the banking industry, especially in retail banking, this is highly effective, when the number of customers is often large and geographically dispersed. When a device wishes to establish a secure channel, it first generates a public and private key pair. The public key is sent to the intended receiving device on the open communication channel, and the private key is retained by the generating device. On receipt of the public key, the receiving device encrypts an initial DEA key-encrypting key with the public key and sends the encrypted key value to the originating device. Since the private key is known only to the originating and only this device can decrypt the encrypted initial keyencrypting key to establish a secure communication session with the other device. Various methods have been proposed for certifying and registering public keys, and for improving the integrity of the key distribution process. First, with public-key-based key distribution, the certification center or the authentication server can be off line and key distribution is still possible. In contrast, with secret-key-based key distribution, on-line access to a key distribution center is usually needed each time the communicating parties establish an initial keying relationship. Second, in public-key-based key distribution, the degree of trust placed on the central authority (e.g., a certification center) is generally less than the degree of trust placed on the central authority in secret-key-based key distribution. With public key cryptography, electronic distribution of initial keys is more feasible and economical using a simple, widely known protocol. Public key cryptography is also well-suited to the digital signature mechanism that supports non-repudiation applications, which are applications that can establish the authenticity of an originator of a message or data. The RSA algorithm, which uses a variable size encryption block and a variable size key, is the first and most common algorithm that was used for encryption in the banking industry.

Business Frontiers

Vol. 1, No. 1.

Page 4 of 8

2012

Cryptography in the Banking Industry

Kar & Dey

SYMMETRIC KEY CRYPTOGRAPHY OR SECRET KEY CRYPTOGRAPHY Symmetric-key algorithms are a class of algorithms for cryptography that use trivially related, often identical, cryptographic keys for both decryption and encryption. In symmetric-key cryptography, the plain text is encrypted by mangling it with a secret key. Decryption requires knowledge of the same key, and decryption reverses the mangling. The encryption key is trivially related to the decryption key, in that they may be identical or there is a simple transform to go between the two keys. The keys, in practice, represent a shared secret between two or more parties that can be used to maintain a private information link. Other terms for symmetric-key encryption are secret-key, single-key, shared-key, one-key and eventually private-key encryption. Symmetric-key algorithms can be divided into stream ciphers and block ciphers. Stream ciphers encrypt the bits of the message one at a time, and block ciphers take a number of bits and encrypt them as a single unit. Blocks of 64 bits are commonly used for encryption processes when high security concerns rule rather than computational intensity. The Advanced Encryption Standard algorithm approved by NIST in December 2001 uses 128-bit blocks. Symmetric-key algorithms are generally much less computationally intensive than asymmetric key algorithms. In practice, asymmetric key algorithms are typically hundreds to thousands times slower than symmetric key algorithms. One disadvantage of symmetric-key algorithms is the requirement of a shared secret key, with one copy at each end. In order to ensure secure communications between everyone in a population of n people a total of n(n 1)/2 keys are needed, which is the total number of possible communication channels. To limit the impact of a potential discovery by a cryptographic adversary, they should be changed regularly and kept secure during distribution and in service. The process of selecting, distributing and storing keys is known as key management, and is difficult to achieve reliably and securely. Public distribution need manual delivery of keys by a reliable agent, and as such is a cost intensive operation.

Business Frontiers

Vol. 1, No. 1.

Page 5 of 8

2012

Cryptography in the Banking Industry

Kar & Dey

In modern cryptosystems designs, both asymmetric (public key) and symmetric algorithms are used to take advantage of the virtues of both. Asymmetric algorithms are used to distribute symmetric-keys at the start of a session. Once a symmetric key is known to all parties of the session, faster symmetric-key algorithms using that key can be used to encrypt the remainder of the session. This simplifies the key distribution problem, because asymmetric keys only have to be distributed authentically, whereas symmetric keys need to be distributed in an authentic and confidential manner. Symmetric ciphers have historically been susceptible to known-plaintext attacks, chosen plaintext attacks, differential cryptanalysis and linear cryptanalysis. Careful construction of the functions for each round can greatly reduce the chances of a success of attacks. Triple Data Encryption standard or triple DES Feistel, Walter Tuchman, Don Coppersmith, Alan Konheim, Carl Meyer, Mike Matyas, Roy Adler, Edna Grossman, Bill Notz, Lynn Smith and Bryant Tuckerman (1974) proposed the Data Encryption Standard while working for IBM Research labs. This Data Encryption Standard is a method for encrypting information that is based on a Symmetric-key algorithm that uses a 56bit key. DES is considered to be insecure for many applications. This is chiefly due to the 56-bit key size being too small. DES consequently came under intense academic scrutiny which motivated the modern understanding of block ciphers and their cryptanalysis. This led to the development of Triple DES. These algorithms are essentially symmetric encryption techniques only, only modified to support greater security concerns. Triple DES is a block cipher formed from the Data Encryption Standard (DES) cipher by using it three times. In general TDES with three different keys (3-key TDES) has a key length of 168 bits: three 56-bit DES keys (with parity bits 3-key TDES has the total storage length of 192 bits), but due to the meet-in-the-middle attack the effective security it provides is only 112 bits. When it was found that a 56-bit key of DES is not enough to guard against brute force attacks, TDES was chosen as a simple way to enlarge the key space without a need to switch to a new

Business Frontiers

Vol. 1, No. 1.

Page 6 of 8

2012

Cryptography in the Banking Industry

Kar & Dey

algorithm. The use of three steps is essential to prevent meet-in-the-middle attacks that are effective against double DES encryption. TDES can be operated with variations in two parameters: number of keys used and order of operations. In general TDES with three different keys (3-key TDES) has a key length of 168 bits: three 56-bit DES keys (with parity bits 3-key TDES has the total storage length of 192 bits), but due to the meet-in-the-middle attack the effective security it provides is only 112 bits. A variant, called two-key TDES (2-key TDES), uses k1 = k3, thus reducing the key size to 112 bits and the storage length to 128 bits. However, this mode is susceptible to certain chosen-plaintext or knownplaintext attacks. The best attack known on 3-key TDES requires around 232 known plaintexts, 2113 steps, 290 single DES encryptions and 288 bits of memory, which given the current computational development, is impossible. Today most of the banking transactions use TDES encryption because it is not possible to crack the key of TDES given the current stage of developments in computation speed and capabilities.

Business Frontiers

Vol. 1, No. 1.

Page 7 of 8

2012

Cryptography in the Banking Industry

Kar & Dey

REFERENCES Common Cryptographic Architecture: Cryptographic Application Programming Interface Reference, SC40-1675, IBM Corporation (1992) W. Diffie and M. E. Hellman, "New Directions in Cryptography," IEEE Transactions on Information Theory IT-22, No. 6, 644-645 (November 1976) C. S. Kline and G. J. Popek, "Public Key vs. Conventional Key Encryption," American Federation Information Processing Societies Conference Proceedings, 1979 A public key extension to the Common Cryptographic Architecture, Le, An V, Matyas, Stephen M, Johnson, Donald B, John D, Wilkins, IBM Systems Journal, 1993

Business Frontiers

Vol. 1, No. 1.

Page 8 of 8