I received a couple questions via email and wanted to take the time to provide a "coupla" of answers. If you have any questions about anything I've blogged about over the past year, feel free to shoot me one. I've got my email below:
Here's the first question:
Q: Is Triple DES a better encryption standard than DUKPT? (Derived Unique Key Per Transaction)?
A: I've used the terms Triple DES and DUKPT quite a bit in recent posts. To clarify, let's just start by saying that DUKPT does not really compete with Triple DES. Let's go over them one by one.
Worldwide, POS devices handle billions of transactions per day. If the keys to even a small portion of that traffic was discovered, we'd have a tremendously huge problem. Which is my segway to DUKPT.
The benefit of DUKPT is that even if an attacker discovered the key to a particular transaction, none of the other transactions from the same device could be decrypted with that key.
The DES stands for Data Encryption Standard, a block cipher that was selected as an official Federal Information Processing Standard (FIPS) for the United States in 1976.
Triple DES, sometimes shortened further as 3DES, increases the difficulty of cracking the encryption by applying three rounds of action: an encryption, a decryption and an encryption, each with independent keys.
3DES has become popular for encrypting financial transactions because it is potentially far more secure than DES, which has been shown to yield its secrets somewhat quickly to relatively cheap hardware.
Both DES and 3DES use a symmetric key. In other words, the same key enciphers and deciphers the protected data. To keep the key secret, a secure key-management system is required.
One way to prevent fraud is to use a different key for "each transaction," (Derived Unique Key Per Transaction) HomeATM's secure devices (and thus your transactions) are "Protected by DUKPT" and each one is initialized with a master key. The master key is from which the unique keys are derived, one for each"per" transaction.
That said, a potential attack point (from a fraudster) would be the master key stored in the encrypting device. However, because HomeATM utilizes DUKPT, our device is built so that tampering with the device wipes this master key out.
These derived keys are used to encrypt transaction data with a symmetric cipher such as 3DES. HomeATM also takes it one step further and encrypts the Track 2 data as well. If you ever have any questions regarding financial transaction security or how HomeATM provides true end-to-end-encrypted transactions, feel free to email me.
Before I get to the next question, I've got one for you.
When you "type" your card number into a "box" on a merchant website, is it protected by DUKPT? Is it encrypted? If so, DES or 3DES? First one to send me the correct answer gets a Free HomeATM PED!
Q: What is TRUE end-to-end encryption? (E2EE)
A: First of all, "true" end-to-end encryption can only occur with a PIN based transaction. It doesn't exist outside of that scope because there is a point in the process where the cardholder data is decrypted and before it is re-encrypted is that is the point where it is vulnerable.
With that said, Heartland's proposal for end-to-end encryption has promulgated E2EE into a hot topic.
I would point out that Heartland's E2EE proposal came "AFTER" their breach...while HomeATM instituted their end-to-end encryption from "the very beginning." I'm not bragging. I'm proudly displaying our insight into the weaknesses inherent in the payments system and how we improved upon said weaknesses.
With that said, Heartland's proposal for end-to-end encryption has promulgated E2EE into a hot topic.
I would point out that Heartland's E2EE proposal came "AFTER" their breach...while HomeATM instituted their end-to-end encryption from "the very beginning." I'm not bragging. I'm proudly displaying our insight into the weaknesses inherent in the payments system and how we improved upon said weaknesses.
But let's get back to Heartland, shall we? In this post I will attempt to explain why they CANNOT magically snap their fingers and introduce E2EE on their own. They need cooperation from others in the industry.
While it's true that some large U.S. retailers encrypt cardholder data while in transit, it's also true that most don't. Therefore...in order for E2EE to work, a lot of retailers would need to revamp their system(s). Very costly indeed.
In addition, the top full-service U.S. payment processors don't currently support E2EE; thus, retailers that encrypt card data in transit typically must decrypt it before they send it to their processor.
The key word here is decrypt. That is the weak point, the vulnerability, and as such, also the problem.
That said, PIN Debit is an entirely different animal. Card brand standards require that PINs are encrypted end-to-end. In fact, speaking about Heartland's quest for E2EE, Distinguished Gartner Analyst Avivah Litan stated:
End-to-end encryption would be most effective if data was encrypted from the timea card was swiped at a POS until it reached the card issuer, similar tothe way personal identification numbers (PINs) currently are encrypted according to card brand standards.
Starting to get the point? If not here's some more insight as Ms. Litan went on to state:
"Heartland is limited by the scope of systems it manages and from which it accepts data;it can only seek to influence the card industry to carry end-to-end encryption beyond the processor stage, through the card networks and onto the card issuers.
"The proposal's success also depends on merchants' willingness to invest in terminal upgrades that support card data encryption."
(Editor's Note: For instance...HomeATM's PCI 2.0 Certified SafeTPIN PED which also encrypts the Track 2 data.) Avivah continues:
"If Heartland implements its proposed project more securely than it hasmanaged in the past with its network, it will make payment cardprocessing more secure for merchants, especially if they don't managethe encryption keys and leave key management to their processor.
Nevertheless, the process will always include vulnerabilities at the point where data is encrypted and decrypted.
"These vulnerabilities can be limited by using "sound key management practices" and enforcing extra security measures, such as "requiring two separately managed sets of keys for cryptographic operation"
HomeATM practices what she preaches by incorporating a"sound key management practice."
That is why HomeATM is the closest thing to TRUE end-to-end encryption in the industry. (our industry being eCommerce payments and Real Time Money Transfer.)
In the bricks and mortar world, end-to-end encryption doesn't exist and the whole system would need to be revamped. You can learn more about that in this related post where Avivah Litan asks:
In addition, the top full-service U.S. payment processors don't currently support E2EE; thus, retailers that encrypt card data in transit typically must decrypt it before they send it to their processor.
The key word here is decrypt. That is the weak point, the vulnerability, and as such, also the problem.
That said, PIN Debit is an entirely different animal. Card brand standards require that PINs are encrypted end-to-end. In fact, speaking about Heartland's quest for E2EE, Distinguished Gartner Analyst Avivah Litan stated:
End-to-end encryption would be most effective if data was encrypted from the timea card was swiped at a POS until it reached the card issuer, similar tothe way personal identification numbers (PINs) currently are encrypted according to card brand standards.
Starting to get the point? If not here's some more insight as Ms. Litan went on to state:
"Heartland is limited by the scope of systems it manages and from which it accepts data;it can only seek to influence the card industry to carry end-to-end encryption beyond the processor stage, through the card networks and onto the card issuers.
"The proposal's success also depends on merchants' willingness to invest in terminal upgrades that support card data encryption."
(Editor's Note: For instance...HomeATM's PCI 2.0 Certified SafeTPIN PED which also encrypts the Track 2 data.) Avivah continues:
"If Heartland implements its proposed project more securely than it hasmanaged in the past with its network, it will make payment cardprocessing more secure for merchants, especially if they don't managethe encryption keys and leave key management to their processor.
Nevertheless, the process will always include vulnerabilities at the point where data is encrypted and decrypted.
"These vulnerabilities can be limited by using "sound key management practices" and enforcing extra security measures, such as "requiring two separately managed sets of keys for cryptographic operation"
HomeATM practices what she preaches by incorporating a"sound key management practice."
That is why HomeATM is the closest thing to TRUE end-to-end encryption in the industry. (our industry being eCommerce payments and Real Time Money Transfer.)
In the bricks and mortar world, end-to-end encryption doesn't exist and the whole system would need to be revamped. You can learn more about that in this related post where Avivah Litan asks:
Hacked! Is Visa Next? (pindebit.blogspot.com)
- New Standard for Encrypting Card Data in the Works - HomeATM Already Done (pindebit.blogspot.com)
- Safe-T-PIN Receives PCI 2.0 PED Certification - The Paypers (pindebit.blogspot.com)
- HomeATM Prevents Cloned Bank Site Threat! (pindebit.blogspot.com)
- Visa & Interlink Interchange Rates (Reimbursement Fees) (pindebit.blogspot.com)
