Stronger Netscape Encryption

Peter Hofland and Jim Utsler

Brokat (Böblingen, Germany) addresses server security with its so-called Integration Platform. This scheme applies proxy technology that allows users to access mirror images of a bank's database without accessing the database itself.

Brokat recently joined forces with Netscape to incorporate Java into its security products targeted at the banking industry. Using cryptography applets, Brokat's XsPresso Security Package adds 128-bit encryption to Netscape Navigator's 40-bit keys, which U.S. export laws prescribe. German banks Bank 24 ( http://www.bank24.de ), Advance Bank ( http://www.advance-bank.de ), and Direkt Anlage Bank ( http://www.diraba.de ) have all decided to implement this Brokat/Netscape transaction-security solution.

Meanwhile, G&H Bankensoftware (Berlin, Germany) has developed a similar approach, called Bancos Online. This Internet home-banking package includes a multilevel security architecture. In addition to using the encryption of Netscape's Secure Sockets Layer (SSL) protocol, Bancos Online transfers data between the customer and the bank according to a Java-based 128-bit algorithm. This higher level of security is possible because the encryption system was developed in Europe, therefore not conflicting with strict U.S. export regulations.

The Bancos Java applet uses three security schemes. It performs Rivest-Shamir-Adleman (RSA) public- and private-key encryption; uses a 128-bit International Data Encryption Algorithm (IDEA), developed by Ascom Systec (Mägenwill, Switzerland) and the Swiss Federal Institute of Technology (Zürich); and employs the Message Authentication Code (MAC), which checks for message integrity.

Both the Brokat Integration Platform and the Bancos Online system require users to enter personal identification numbers (PINs) and other personal identifiers to obtain access to their account information. Without them, any access to other than the most public Internet interface is disallowed. "With just your PIN or p assword, you might be able to check on the latest interest rates, but you're not allowed to download currency or transfer funds," a German on-line banking expert explains.