The importance of cryptography in points of sale

Image courtesy of hrp_images now at Flickr.com

When we analyze the security of point of sale (PoS) applications, we must keep in mind the necessary presence of magnetic bands and the data of the owners of cards, which are extremely sensitive information, both for the owner as well as for the financial institution that provides them.

In any space in which there’s information that needs to be protected and safeguarded, there lies the imperious necessity of using cryptographic solutions, the ones that originated in battlefields and which today are capable of protecting the confidentiality and integrity of said data. It's not enough to use certain safe protocols, it is also necessary and imperative to make a correct and proper implementation at a software and hardware level.

As obvious as it may seem, cryptography is an essential part of a point of sale, as well as in any other digital forms of payment used today. Complementing the pillars of confidentiality and integrity, authentication and non-repudiation come into play, which means that an operation cannot let itself be unknown to the user.

In terminals, mainly three groups of cryptographic algorithms converge which are used in heterogeneous technologies, where they mix with one another and with many architectures within the point-of-sale devices. Each one of these groups has advantages and disadvantages in relation to one another.
The main point where we will be able to distinguish great differences are linked to resource consumption, speed and even the ease of implementation in the different sections that point-of-sale devices have. The way of storing a password, the way of encrypting the communication between two points or even the degree of safety needed will be the way in which either one of the following algorithms will be implemented.

Symmetric-key algorithms

The same password is shared for the encryption and decryption of information. This algorithm is very fast, but at the same time it is less secure and it definitely needs both parts to have already exchanged their key or password to begin the communication. A couple of examples of symmetric-key cryptography are the 3DES and AES algorithms.

Asymmetric-key algorithms

Image courtesy of MIKI Yoshihito at Flickr.com

They contain two keys: a public and a private one. This way, the same one cannot be used to encrypt and decrypt the information. Both keys are generated at the same time and the private one is safeguarded, which is the one that will be used to read; and the public one is distributed, which is the one that will write, encrypting the communication. Two extensively used examples of asymmetric-key cryptography or public key infrastructure (PKI) are email messages sent through PGP (Pretty Good Privacy), or the network traffic encrypted with SSL or TLS. These are widely used in transactional websites or those that require the user to enter a set of credentials.

One-way algorithm or hash

These functions capture a variable-length information and generate an output commonly called fixed-length hash, based on the input. These functions used in cryptography have the property of being easily calculated, which is why they're widely used to store passwords, since it is difficult -in many cases- to recreate the input if only the value of the hash is known.

When it comes to encryption algorithms, size does matter

A general rule for all encryption algorithms is: the bigger, the better. This is due to the fact that the most simple way of attacking encryption is a brute force attack, testing all the possible combinations of bits, until finally the desired string is found. With the data combination processing capacity of modern computers, it is possible to apply brute force techniques to obtain relatively long passwords made out of several bits or characters.

For instance, DES with a 56 bit combination password can be cracked in less than a day. However, the addition of more bits to the string will exponentially increase the time required for the cracking process to finish. The most widely used hash algorithms are MD5 (128 bits) and SHA1 (160 bits) which curiously are not very robust when it comes to security in comparison with Triple DES or AES, both of which are recommended by the NSA.

To sum up, the diversity in the different types of point of sale devices, both in modular and compact machines, will keep rising and the telecommunication technologies will also accompany this constant evolution, generating greater indices of speed and availability. However, cryptographic algorithms in many cases don't go hand-in-hand with the development of point of sale devices from the initial stage of the design, which leaves an open window through which cyber criminals are able to break into systems and extract different types of information.

Malicious codes are able to sort these cryptographic processes in payment terminals or point of sale devices, applied in certain specific layers with the intention of capturing sensitive information.

Recent contents

Read Don Burns' "What Is Encryption And How Can It Work For Me?"

All you need to know about Encrypted Communication basics

Image courtesy of Intel Free Press at Flickr.com

Nearly every computing device we interact with on a daily basis utilizes some form of encryption technology. From smartphones (which can often have their data encrypted), to tablets, desktop, laptops or even your trusty Kindle, encryption is everywhere and it is a good idea to have some notions about this technology and know how to use it in case of need. Let's analyze the basic concepts:

We can define Encryption as the process of encoding messages or information in such a way that only authorized parties can read it. Encryption does not of itself prevent interception, but denies the message content to the interceptor. In an encryption scheme, the intended communication information or message is encrypted using an encryption algorithm. For technical reasons, an encryption scheme usually uses a pseudo-random encryption key generated by an algorithm. It is in principle possible to decrypt the message without possessing the key, but, for a well-designed encryption scheme, large computational resources and skill are required. An authorized recipient can easily decrypt the message with the key provided by the originator to recipients.

When we use the Internet, we're not always just clicking around and passively taking in information, such as reading news articles or blog posts, a great deal of our time online involves sending others our own information. Ordering something over the Internet from an online vendor, or signing up for an online account, requires entering in a good deal of sensitive personal information. A typical transaction might include not only our names, email addresses and physical address and phone number, but also passwords and personal identification numbers. The incredible growth of the Internet has excited businesses and consumers alike with its promise of changing the way we live and work. It's extremely easy to buy and sell goods all over the world while sitting in front of a laptop. But security is a major concern on the Internet, especially when you're using it to send sensitive information between parties.

There is a whole lot of information that we don't want other people to see, such as Credit card information, Social Security numbers, Private correspondence, Personal details, Sensitive company information and Bank account information.

Information security is provided on computers and over the Internet by a variety of methods. A simple but straightforward security method is to only keep sensitive information on removable storage media like portable flash memory drives or external hard drives. But the most popular forms of security all rely on encryption, the process of encoding information in such a way that only the person with the key can decode it.

How does it works?

Encryption is a modern form of cryptography that allows a user to hide information from others. Encryption uses a complex algorithm called a cipher in order to turn normalized data (plaintext) into a series of seemingly random characters (ciphertext) that is unreadable by those without a special key in which to decrypt it. Those that possess the key can decrypt the data in order to view the plaintext again rather than the random character string of ciphertext.

Two of the most widely used encryption methods are Public key (asymmetric) encryption and Private Key (symmetric) encryption.

The Public Key Encryption uses the recipient’s public key as well as a (mathematically) matching private key. With the public key you could enter new information to the storage but you wouldn’t be able to view items already in there, nor would he be able to retrieve anything. The private key is used for encrypting cipher text. On the other hand, with the private key you could open the storage and view all items inside as well as removing them as you see fit by using the matching private key. However you could not add things to the box without having an additional public key.

Image courtesy of Karl Baron at Flickr.com

The Private Key Encryption or symmetric encryption differs from Public Key encryption is in the purpose of the keys themselves. There are still two keys needed to communicate, but each of these keys is now essentially the same. Two users need two different keys, but with them, they both are allowed to encrypt a message as well as decryption it, so they are both allowed to add or remove things from the storage.

We can conclude that Encryption is safe. The amount of time, energy usage and computational cost to crack most modern cryptographic technologies makes the act of attempting to break an encryption (without the key) an expensive exercise that is, relatively speaking, futile. That said, encryption does have vulnerabilities that rest largely outside of the power of the technology. But no matter how secure the encryption, a backdoor could potentially provide access to the private key. This access provides the means necessary to decrypt the message without ever breaking the encryption.

Encrypted Communication Popular in our Day

Image courtesy of brewbooks at Flickr.com

After the major cases of data leakage and hacking of information, more and more individuals, companies, and government entities are looking for solutions to protect their privacy and their deepest secrets. 

The truth is that encrypted communication has always been present. The romans, for example, used encrypted messages to protect information that dealt with military content and to communicate during battles. Caesar was the one to be acknowledged as the first user of this system. That encrypted method was called “Caesar cipher” and it consisted of a strategy where each letter in a message was replaced by another letter, which was changed some places forward in the alphabet. However, it is believed that before him encrypted communication by substitution had already been used.

Before, encryption was mainly exclusive for departments and people in charge of the defense of a nation. Nowadays, companies and individuals want to know more about this technology and start implementing it in their daily communicative exchanges.

Why is it important?

Any communication that takes place in the internet is unencrypted. This means that if there is a malicious user that wants to “spy” the communication between the sender of a message and its recipient, this user is able to access information from this communication, and know exactly what is being transmitted. This fact can have more relevance according to the level of exclusiveness or secrecy of the information. If we were checking out web pages about the latest hairstyles, that would be irrelevant to security. But if we were accessing or providing our bank account information, that is a different story. 

Image courtesy of EFF Photos at Flickr.com

To avoid these sorts of situations, there is a technical solution that protects communication through encryption. Any kind of information can be encrypted. From web pages access information, to e-mails, etc. Encrypting information nowadays is an area of expertise that protects information using mathematics, computer science and engineering approaches.

The benefits of encrypted communication should be used specially in those interactions that transmit sensitive data. These might include passwords, personal information, financial records, etc. Security in this context means to perform communication in ways that does not allow a third party to access, read or listen to the communication session. The ways to protect internet communication can take the following forms:

• Protecting the content: hiding information or digital data.
• Protecting individuals performing communication: anonymity
• Protecting the communication environment: approaches to hide communication environment. 

The Case of WhatsApp

Recently, Whatsapp proved people its concern about protecting its users’ privacy. Its latest update informed the community about the implementation of a new technology where users can talk to friends, family and acquaintances and their communication will be encrypted. This unprecedented action stirred a desire in people to understand more about encryption and to be concerned more about their online privacy.

This newfound concern about online privacy on the web is valid for companies as well. There are many tools and encrypted technology systems for companies that allow organizations to take control over sensitive data, information access and communications policies.

Whatsapp case poses a question, if encryption should be applied to all communications. The truth of the matter is that it entirely depends on the nature of the information that is handled. Companies should identify their key issues and sensitive data that need to be protected and differentiated from trivial, harmless communication. Identification is key to developing policies and strategies for managing data. After the implementation of a communication action plan, raising awareness is crucial for educating personnel about the importance of handling information in a safe way, following the company policies.

Final Considerations

Encryption mechanisms have always existed and will continue existing, whether it is for companies, government agencies or individuals that want to protect valuable information. Recent cases of information leakage have raised awareness of the need for information privacy and protection both in public and private communications. Security in this sense means protecting information or digital data from any sort of attacking techniques, technologies or methods controlled by malicious users.

To sum up, advances in cryptography are offering strong enough protection for most of our e-mail communications, online transactions and valuable information, but the future is still uncertain in the changing face of technology because, when stronger cryptographic systems appear, new means to break them appear as well. The hope is that with the ongoing developments in this area, attacks and security breaking will be exponentially reduced if not eradicated. That is why more research and work needs to take place to take security measures one step further from malicious users and technologies against online privacy. The human factor is still critical in the effectiveness of all security applications and systems. The constant reinvention of online communications privacy still continues.