Independent Banker - November 2017 - 76

Nuts & Bolts
communications have primarily been
used to warn about forms that request
sensitive data such as account details
and passwords. However, in this latest
update, any password input boxes
will be flagged as insecure if all traffic
to and from that site is not protected.
This may be a problem for some
community banks, says Ira H. Aurit,
CEO of BankSITE Services, a specialist
in web development and secure
hosting for banks. In the past, Aurit
explains, security certificates were
primarily needed for compliance on
the online banking portal part of a
site, which is often accessed by clicking
a login button on the homepage
that directs the browser to a separate
server. Homepages are less likely to
offer encryption because it's not a
regulatory issue.
But now, encryption is important
everywhere. That's why it pays to
understand how it works.
Symmetric vs.
asymmetric encryption
There are two common forms of
cryptography for scrambling digital
files and communications: symmetric
" Backups have to be
stored off-site, for
business continuity.
And all backedup
data should be
encrypted both when
being transferred to
a backup location and
when at rest. "
-BILL BAUMAN, IRONCORE
and asymmetric encryption.
In symmetric encryption, a
" key " is used in conjunction with a
complex mathematical algorithm
to create a coded message. The key
can be a password or a long string of
characters, but the same key is used
to encrypt and decrypt whatever message
is being sent.
For online communications,
symmetric encryption presents a
challenge. Both the receiver and
the sender of a message (the classic
cryptography textbook examples
are named Alice and Bob) have to
Encryption decoded
(128/256-bit) are
usually shorter than
asymmetric keys
(1024/2048-bit).
»Advanced Encryption
Standard (AES) is
a symmetric block
cipher algorithm
commonly used in
TSL communications
(see below).
» The key length usually
refers to the number
of bits in an encryption
algorithm's key
(128/256/1024/2048bit).
Symmetric keys
» Digital Certificate
contains security
credentials such as the
public parts of a key.
» Certificate Authority
(CA) issues digital
certificates to servers
that web browsers can
verify as genuine.
» Hash functions are a
one-way cryptographic
algorithm that cannot
be decrypted and is
used for password
verification on websites.
» PGP (Pretty Good
Privacy) is an
encryption program for
files and emails.
»RSA is the most
common asymmetric
algorithm and is often
used for TSL handshake.
»Secure Sockets Layer
(SSL) is a protocol for
encrypting communications
online and was
replaced by Transport
Security Layer (TSL).
» Virtual Private
Network (VPN)
securely communicates
with business servers
using encryption over
the internet.
76 ICBA IndependentBanker November 2017
use the same encryption key. This
means that at some stage, they have
to share that key with each other.
If this was done over the internet
in such a way that they could both
read it-say, in an email-an attacker
would be able to intercept the key
and read all future correspondence
between Alice and Bob.
To get around this, we use " asymmetric
cryptography, " in which the
decryption key for the algorithm is
different from the encryption key.
To use asymmetric encryption,
Alice asks Bob for his encryption
key before she sends him a message.
Alice then creates her secret
message using this key and sends it
over the internet knowing that only
someone who has Bob's decryption
key will be able to read it.
If Bob wants to reply, he'll encrypt
his message using Alice's encryption
key, so that only she can read it.
It doesn't matter if anyone has
intercepted the encryption keys
while they were being exchanged;
they're useless for decoding messages.
As long as Alice and Bob never
share their private key with anyone,
Independent Banker - November 2017

Table of Contents for the Digital Edition of Independent Banker - November 2017
