ANSI X9.49-1998 pdf download American National Standard for Financial Services X9.49 -1998 Secure Remote Access to Financial Services For the Financial Industry
2.2 ANSI References
For a description of these ANSI standards, refer to Annex B: Relevant ANSI Standards
ANSI X3.92-1987 Data Encryption Algorithm (DEA)
ANSI X3.106-1983 Modes of Operation for the DEA
ANSI X9.8-1995 Personal Identification Number (PIN) Management and Security
ANSI X9.9-1994 Financial Institution Message Authentication (Wholesale)
ANSI X9.19-1996 Financial Institution Retail Message Authentication
ANSI X9.17-1995 Financial Institution Key Management (Wholesale)
ANSI X9.23-1995 Encryption of Wholesale Financial Messages
ANSI X9.24-1992 Financial Services Retail Key Management
ANSI X9.26-1990 Financial Institution Sign-On Authentication for Wholesale Transactions
ANSI X9.30-1-1995 The Digital Signature Algorithm (DSA)
ANSI X9.30-2-1996 The Secure Hash Algorithm (SHA-1)
DRAFT ANSI X9.31 Digital Signature Using Reversible Public-key Cryptography
DRAFT ANSI X9.42 Agreement of Symmetric Keys Using Diffie-Hellman and MQV Algorithms
DRAFT ANSI X9.44 Transport of Symmetric Algorithm Keys using RSA
DRAFT ANSI X9.45 Enhanced Management Controls Using Digital Signatures and Attribute Certificates
DRAFT ANSI X9.52 Triple Data Encryption Algorithm – Modes of Operation
ANSI X9.55-1997 Extensions to Public-key Certificates and Certificate Revocation Lists
ANSI X9.57-1997 Certificate Management
DRAFT ANSI X9.62 The Elliptic Curve Digital Signature Algorithm (ECDSA)
DRAFT ANSI X9.63 Key Agreement and Key Transport Using Elliptic Curve Cryptography
ANSI X9/TG-3-1997 PIN Audit Security Guideline
ANSI X9/TG-5-1992 Information Security Guideline
ANSI X9/TG-7-1995 Initial DEA Key Distribution for PIN Entry and Transaction Originating Devices
2.3 US Government References
FIPS 46-2 Data Encryption Standard (DES)
FIPS 81 DES Modes of Operation
FIPS 112 Password Usage
FIPS 140-1 Security Requirements for Cryptographic Modules
FIPS 180-1 Secure Hash Standard (SHS)
FIPS 186 Digital Signature Standard (DSS)
FIPS 190 Guideline for the Use of Advanced Authentication Technology Alternatives
FIPS 196 Entity Authentication Using Public-key Cryptography
2.4 ISO References
ISO 9564 PIN Management and Security
ISO 9807 Banking and Related Financial Services – Requirements for Message Authentication (Retail)
ISO 10126 Procedures for Message Encipherment
ISO 10202 Security Architecture of Financial Transactions Using Integrated Circuit Cards
ISO 11568 Banking – Key Management (Retail)
ISO 13491 Secure Cryptographic Hardware
ISO 13492 Key Management Related Data Elements (Retail)
ISO TR 14516 Guidelines for the Use of Trusted Third Parties
ISO TR 13569 Banking and Related Financial Services – Information Security Guidelines
3. Risk Analysis
3.1 Introduction
Risk to financial institutions through remote access arises from the following possibilities:
a. The customer may, through unauthorized activity, do damage to the financial institution or the financial service provider, or
b. Someone impersonating the customer may do damage to the customer, or
c. Someone impersonating the financial service provider may do damage to the customer, or