Re: VISA and Microsoft STT Specs available

At 11:10 AM 9/29/95 -0400, Phill wrote:
>Yes, VISA put the ASCII on their site... 
>We only host the ps version.

Thanks!  I looked at the Visa site, and it has a usable form
of the documents still under construction; I waded through
the 73-separate-page HTML version for a while....
There's some good intro material on how you use the stuff and
who's responsible for what.

Microsoft has the technical specs as one big slightly-HTMLized
text file under http://www.windows.microsoft.com/windows/ie/stt.htm ;
it's _much_ more readable, and has a pointer to the Visa version.
(It's one big <PRE> with a few <B> and hrefs, in black-on-white.)

Some cryptographic high points, from a brief scan.
- 1024-bit RSA signatures, using PKCS#1 format.
- SHA 160-bit hashes
- Symmetric bulk crypto includes two options (I haven't yet seen
  how you choose between them; I assume it's export/domestic?)
  == RC4/64 with 24 bits of salt leaving 40 bits of real key
  == DES-CBC - yes, that's single-DES.  IV=0.
#---
# Bill Stewart, Freelance Information Architect, stewarts@ix.netcom.com
# Phone +1-510-247-0664 Pager/Voicemail 1-408-787-1281
#---

On Fri, 29 Sep 1995, Bill Stewart wrote:

> Some cryptographic high points, from a brief scan.
> - 1024-bit RSA signatures, using PKCS#1 format.
> - SHA 160-bit hashes
> - Symmetric bulk crypto includes two options (I haven't yet seen
>   how you choose between them; I assume it's export/domestic?)
                                 ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
>   == RC4/64 with 24 bits of salt leaving 40 bits of real key
>   == DES-CBC - yes, that's single-DES.  IV=0.

From http://www.windows.microsoft.com/windows/ie/stt.htm:

  NOTE: this document covers the International version of the STT 
  protocol, which includes DES encryption of all financial data, direct 
  RSA encryption of bank card account numbers, and 40 bit RC4 encryption 
  of the purchasing order form contents and receipt.  A US/Canada version 
  of the protocol with triple-DES encryption of the order, receipt, and 
  all financial data and direct RSA encryption of bank card account 
  numbers will be documented and published in the near future.

So it looks like single DES is now OK for export, at least it seems to be 
in this case where its application is strictly limited to "financial data".


- Andy

+-------------------------------------------------------------------------+
| Andrew Brown  Internet <asb@nexor.co.uk>  Telephone +44 115 952 0585    |
| PGP (2048/9611055D): 69 AA EF 72 80 7A 63 3A  C0 1F 9F 66 64 02 4C 88   |
+-------------------------------------------------------------------------+