News

GFG:Secure Mailer to automate cryptographic key management

10 April 2006

GFG is now shipping GFG:Secure Mailer, an off-the-shelf way to automate the remote use and management of secure cryptographic keys, removing the need for multiple personnel to contribute different parts of a key.

GFG:Secure Mailer is a Windows Application designed for use with a THALES Host Security Module (HSM). It’s designed to generate PIN Mailers, Interchange Key Mailers, Public and Private RSA keys and Public Key Verification codes. These can be either printed or securely emailed as encrypted data, further protected by the PGP Corporation.

GFG developed GFG:Secure Mailer in response to customers asking for advice on simplifying management and use of secure cryptographic keys, says GFG Account Director Ewan Wilson.

“When we’re doing implementations onsite, customers often speak of encryption and decryption as a source of pain,” he says.

“It’s an increasingly complicated area – in a single customer there can be literally thousands of different keys in their interchange and terminal management environments. Almost every customer we see has developed their own management method in-house. This usually involves multiple staff members holding different parts of the same key, which is a hassle in terms of always having to get the right staff together at the same time. We also see a lot of customers having to physically go out and visit individual ATM machines. We decided to develop an off-the-shelf way to achieve automated, remote key management, and so GFG:Secure Mailer was born.”

GFG:Secure Mailer provides support for the generation and printing of a range of keys used in the card payments system. These include - but are not limited to - support for the ANSI and ISO standards for Interchange key exchange; support for the AS2805 standards for terminal initialisation; and support for the APCA interchange standards.

In a ANSI or ISO interchange environment each party has to generate the high level DES keys in component form, and transport these components to their partner. In an APCA interchange environment each party exchanges RSA public Keys so they can then exchange KEK’s securely. GFG:Secure Mailer has been developed to fully support these requirements.

DES keys can be printed in component form or output under a higher level key, e.g. a Zone Master Key to be sent to a card association would be generated and printed in a minimum of 3 components, whereas a Terminal Master Key for a ATM may be either printed in component form or output encrypted under a ZMK for transmission to a partner loading the key into an ATM.

With RSA keys the Secret Key is always output under the encryption of the Host Security Module Local Master Key. Whilst the Public Key can be output in clear format , or securely emailed direct from the mailer to a partner using PGP.

< Back to News