Re: VISA and Microsoft STT Specs available
At 11:10 AM 9/29/95 -0400, Phill wrote:
Yes, VISA put the ASCII on their site... We only host the ps version.
Thanks! I looked at the Visa site, and it has a usable form of the documents still under construction; I waded through the 73-separate-page HTML version for a while.... There's some good intro material on how you use the stuff and who's responsible for what. Microsoft has the technical specs as one big slightly-HTMLized text file under http://www.windows.microsoft.com/windows/ie/stt.htm ; it's _much_ more readable, and has a pointer to the Visa version. (It's one big <PRE> with a few <B> and hrefs, in black-on-white.) Some cryptographic high points, from a brief scan. - 1024-bit RSA signatures, using PKCS#1 format. - SHA 160-bit hashes - Symmetric bulk crypto includes two options (I haven't yet seen how you choose between them; I assume it's export/domestic?) == RC4/64 with 24 bits of salt leaving 40 bits of real key == DES-CBC - yes, that's single-DES. IV=0. #--- # Bill Stewart, Freelance Information Architect, stewarts@ix.netcom.com # Phone +1-510-247-0664 Pager/Voicemail 1-408-787-1281 #---
On Fri, 29 Sep 1995, Bill Stewart wrote:
Some cryptographic high points, from a brief scan. - 1024-bit RSA signatures, using PKCS#1 format. - SHA 160-bit hashes - Symmetric bulk crypto includes two options (I haven't yet seen how you choose between them; I assume it's export/domestic?) ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^ == RC4/64 with 24 bits of salt leaving 40 bits of real key == DES-CBC - yes, that's single-DES. IV=0.
NOTE: this document covers the International version of the STT protocol, which includes DES encryption of all financial data, direct RSA encryption of bank card account numbers, and 40 bit RC4 encryption of the purchasing order form contents and receipt. A US/Canada version of the protocol with triple-DES encryption of the order, receipt, and all financial data and direct RSA encryption of bank card account numbers will be documented and published in the near future. So it looks like single DES is now OK for export, at least it seems to be in this case where its application is strictly limited to "financial data". - Andy +-------------------------------------------------------------------------+ | Andrew Brown Internet <asb@nexor.co.uk> Telephone +44 115 952 0585 | | PGP (2048/9611055D): 69 AA EF 72 80 7A 63 3A C0 1F 9F 66 64 02 4C 88 | +-------------------------------------------------------------------------+
participants (2)
-
Andy Brown -
Bill Stewart