Cryptography Fundamentals
Symmetric Encryption
- Its a Private Key.
- Single shared secret key for both encryption and decryption.
- Mainly used for bulk data processing.
- Algorithm used : AES (Advanced Encryption Standard) and 3DES ( Triple Data Encryption Standard ).
- 3DES is migrated to AES under current RBI cybersecurity guidelines.
Asymmetric Encryption
- Its a Public Key.
- Uses a mathematically linked key pair (Public Key & Private Key)
- Data encrypted with the Public Key can only be decrypted by the corresponding Private Key.
- Algorithms include RSA and ECC (Elliptic Curve Cryptography).
Public Key Infrastructure (PKI)
- PKI binds public keys to real-world identities using Digital Certificates issued by a trusted Certificate Authority (CA).
Key Management
- Private Key must never be shared or transmitted.
- It should ideally be stored inside a tamper-resistant Hardware Security Module (HSM).
Hashing
- one-way, irreversible function that takes an input and generates a fixed-size string.
- Used for data integrity.
- Algorithms: SHA-256, SHA-3
Digital Signatures
- Provides Authentication, Non-repudiation, and Integrit.
- The sender hashes the message and encrypts the hash using their Private Key.
- The recipient decrypts it using the sender’s Public Key to verify identity.
Data Protection in Banking Environments
Data at Rest
- Stored data in databases, SAN, core banking systems.
- Protected using AES-256 Transparent Data Encryption (TDE).
Data in Transit
- Data moving across networks.
- Secured via SSL/TLS (Transport Layer Security).
- TLS 1.2 or TLS 1.3.
Tokenization
- Replaces sensitive data (like a 16-digit Debit Card number) with a non-sensitive equivalent called a Token.
- The original data is stored in a secure centralized token vault. Essential for PCI-DSS compliance.
Data Masking
- Modifies the data structure so it remains unreadable to unauthorized users but retains its format (e.g., masking a bank account number as XXXXXX1234).
- It can be Static (altering data in a test database environment) or Dynamic (altering it on-the-fly based on user role privilege).
Questions Set 1
- Which international standard governs PIN block formatting (such as ISO Format 0, 1, 3, or 4) during ATM and POS transaction messaging? ISO 9564 defines the PIN management and security, including the exact structures for formatting PIN blocks.
Questions Set 2
Notes
"Inherently provide" means that a feature is naturally, automatically, and permanently built into a system.
What is the one security feature you get AUTOMATICALLY from a Digital Signature, which you CANNOT get automatically from basic symmetric encryption (like AES or 3DES)?
Non-repudiation means that a person or entity cannot deny the authenticity of their signature on a document or the sending of a message that they originated. You cannot say 'I didn't do it' when you actually did.
Digital Signatures use asymmetric encryption (Unique Private Keys) and are the only tool that inherently provides non-repudiation.
Vulnerability Assessment and Penetration Testing - VAPT
Asymmetric encryption is computationally expensive for large files. How does reducing the data size help?
Online Certificate Status Protocol (OCSP)
Certificate Revocation Lists (CRLs)
Which apex body provides the digital certificate infrastructure and secure network backbone for RTGS transactions in India? IDRBT stands for Institute for Development and Research in Banking Technology.IDRBT publishes the "Cyber Security Checklist for Banks" and frameworks for cloud computing, mobile banking security, and biometric authentication.
1 Round Trip Time (1-RTT)
PCI-DSS ??
Top comments (0)