SMART TOKENS AND THEIR IMPLEMENTATION

Michael F. Jones

Bruce Schneier

ABSTRACT

This paper introduces Smart Tokens, discusses some of their basic properties and outlines their general role in securing software applications on the World-Wide Web. In addition, the completed hardware and software architecture of a current implementation is described. Finally, an electronic commerce application for Smart Tokens involving major US financial institutions is discussed.

1.0 INTRODUCTION

Security concerns impose a severe constraint on a vast array of products and services that can be offered within the context of the World-Wide Web. Electronic commerce on the Web will be enabled by emerging security protocols such as S-HTTP and SSL. Introducing additional choices such as Microsoft's recent release of STT and PCT may have the effect of causing confusion and therefore, delaying implementations. However, it is clear that serious attention to security has now become mainstream. S- HTTP and SSL, which incorporate Public-Key cryptosystems, are just beginning to be implemented by WWW applications developers. Recent announcements by major software vendors indicate that widespread implementation of these standards is likely to occur [10].

Public-Key cryptosystems involve an authority issuing a pair of complimentary encryption keys to each user in the system. One of the keys is intended to be made public, analogous to an e-mail address and is called the Public-Key component. The other key in the pair must be available for use only by the "owner" of the key-pair and is called the Private-Key component. Application software making use of the key- pairs provides users with a rich set of security functions that essentially lifts the current constraints on electronic commerce in the WWW environment. For an introduction to Public-Key cryptography, please refer to [3].

Although Public-Key cryptosystems have many desirable characteristics in securing distributed systems, they typically rely upon the ability of the system to protect the beneficial use of the Private-Key component from all but the intended user. If the Private-Key component can be copied, or is made public, the authenticity of transactions using that Public-Key pair are called into question and therefore, cannot be trusted. In the commercial internetworked environment, software-only solutions for protecting the Private- Key component are inherently vulnerable to attack by viruses and other methods of compromise such as password guessing schemes.

Smart Tokens, the subject of this paper, are hardware devices with associated software that have the ability to perform Private-Key operations without the Private-Key ever being vulnerable to compromise. The WWW security community is in general agreement that Smart Tokens will play a major role in the future of electronic commerce on the Internet. This paper further describes a Smart Token implementation with characteristics that make it suitable for use with general purpose software applications such as word processors, e-mail packages and WWW browsers. Portability and isolation from the hardware layers are important architectural goals. Finally, a major electronic commerce application in which the Smart Token is used as the analog of traditional checkbook functionality is then discussed.

2.0 SMART TOKENS

A "smart token" is an easily portable device that does special-purpose operations for its user, generally identifying the user to some larger computer system. A smart token can look like a PC Card, 3.5" diskette, credit card, pocket calculator, or many other things--the important feature is that it carries some secret information for you, and that it does some internal calculations when you need them performed. A smart token is often designed to be tamper-resistant: It is difficult to take apart. It is protected with a user password, so that even if it is physically stolen, it will be difficult to impersonate their owner.

Just as most pocket calculators are used to do arithmetic, most smart tokens are used to identify their user to some remote computer. If the user's identification checks out, then she is allowed to do something: make a purchase on her credit card account, read her e-mail from a public terminal, board a plane, or log in to a remote computer system, etc.

2.1 THE ROLE OF SMART TOKENS

To see the value of this, consider making a purchase on the Internet. People used to type their credit card numbers directly into a computer, and then send those numbers to the merchant. This is insecure both because those credit card numbers can be easily collected by someone who monitors network traffic, and because the merchant has no way to confirm that the person who typed in the credit card number is the same person who owns the credit card.

Current solutions include encryption, which hides the buyer's personal information during transition, and digital signatures, which confirms the identity of the buyer. Financial models include digital checks, digital credit cards, and digital cash. These solutions protect against network monitoring, but do nothing to stop password guessing, password collection at the buyer terminal, or password compromise. The seller still has to trust that the person who signed the digital payment order has not accidentally disclosed his password or private signature key.

Homemade Bikini Contest
long dildo ass video Sex Sims
husband accused of sexually harrassing young women and girls Tiny Sex
anne hudgens nude Free Movie Porn pussy deluxe
gay sex audio Jamie Pressly Nude preteennudes
free porn photo gallery Tiny Little Lolitas Nude
pictures of naked prisoners Furry Pussy fresh bdsm
Sexy Horny Moms
Worsley Underground Canal
Illuminary Floral Designs mom sex videos
suck own cock Gays Civil Rights kate richie sex video
lyrics to jump the fuck up Dildo Teens maya devine mommy got boobs
boysfirstporn Daily Lesbian Videos
Virtual Child Pornography military sex
Betty Boobs
disney high school musical nude photos Classic Adult Porn Stars free black cock
tits sex free paris hilton Saratoga Springs Sex Addicts
Stream Porn threesome xxx
Naked Women Pictures Video Free completely naked women
Cuckold Free Hotwife Creampie Story incest sex free stories
Melissa joan hart nude fakes
Nude teen films wwe maria kanellis nude
Nude teen 15 nude body female
madonna nude photo playboy Catfight nude christian aguilera nude
Non nude school
robbs nude celeb Anne hathaway nude havoc video
dead or alive girls nude Teen daughters nude rihanna in nude photo scandal
Free nude amateur girls
Gia from rock of love nude
Daniel radcliffe completely nude nude sreya
nude ballbusting Russian nude nude pics of nikki nova
nude fitness models videos Carlton elizabeth nude free nude centerfold
paris hilton nude clips German nude teens
Men sleeping nude parent directory images nude
Rosana arquette nude
nude persian teens What is a nude beach abby sessoms nude
brooke burke nude picture Normal girl nude
Pamela anderson nude vagina non nude 12 yo
Nude beauty contest pictures bianca beaucamp nude
Miley cyrus leaked nude playboys nude celebrities 2007
shemale orgasm Fuckmymelons
sex wedge Free Nude Pussy Thumbnails
wwe diva porn Free Gay Porn Games
black gay anal 5 Minute Sex Clips hot girl sex
jobs for teens 13up Free Wife Sex Stories illegal porn tube
free fetish videos Guy Eating Creampie
beautiful boobs Ok2bgay gramma mature stories
Skinny Teens
Sexyblogspot
Masturbation Pics how 2 suck a pussy
brunettes naked Income Based Apartments In Essex County Nj jessica steen
gay latin stud video Muslim Hirsute Pussy sextips
analogies Old Xxx Babes
Children And Cockroach Bite amature girls images posting
European Gay Social Clubs
redhead porn Preteen Model Videos porno vault
back burger xxx Ivana Fuckalot 2007
Beloit Sex Pics nude pics of britney spears
Pastoral Poems nude little lolitas
Sexy Pretty Naked Girl Legs stories sex strip poker
Pub Crawl Sex Games
myspace sex birthday comments Taboo Twins Sister Sex
tonta harding sex clips Bat Girl Sex Comic
sex video's free samples Play Anima Sex Games vest sex position picures
same sex marriage oppose Door Restraints Sex Toys sex after female menopause
ukrainian mature sex tube Sex Porn Games Com
freak dancing to sex Avi Video And Sex sex education in canada
Best Taboo Sex Stories
Bi Sexual Sex Videos
Daily Sex Routine Video development of sex organs
hot air balloon sex Free Latina Sex Pics sex south san francisco
actress on sex photo Bullet Boy Sex Scene rescue fantasy porn sex
drunk teen sex video Adult Sex Flash Arcade
Free Asin Sex Movies lubricants for anal sex
Naughty Boy Sex Toy
sex lubricants for men Sex In The Playground tiny japanese teen sex
spagetti sex whipping women Roxanna Diaz Sex Tape
Woman For Sex London womens sex pills work
Find Shower Sex Videos pantyhose sex videos free
Jennifer Lopez Sex Photos mobile sex video sites
You Toube Sex
sex cam cenyral Sex Personal Assistancce
yellow 13 sex Exciting Loving Sex
sex free best Yvonne Strahovsky Sex escorted sex vacations
rt pantyhose sex Brian Griffin Sex muslim phone sex
web sex serchs Sottish Female Sex
animated sex viedos Leabian Oral Sex wet sex costume
Erotic Sex Ideas
Totaly Spys Sex
Toddler Sex Sluts the pitcher sex
sex message parlour Ice Sex Teen ballet and sex
animal sex oops Sex Comics Jon chimps having sex
sexed suckled download Sex Vidios Downloads
Not Likeing Sex amazing sex tips
Triplets Lesbian Sex
big cucumber sex Janes Sex Review mother sex mpegs
newport sex scandal Malayali Sex Vedio
Amatuer Sex Channels jenna\'s sex star
Dpahne Blake Sex incredibles sex xxx
Matur Sex Video sex beginners guide
universal management group gsd group
interest group political american plastics group
hip performance group blue man group briar street the difference between a group and a team
group administrators il freedom investment group rights and resources group
danu irish group jacobs engineering group inc tech
borderline personality disorder group history of group sex investment management consulting group
group of adolescents
group activity game
spal group company basis discussion group
music group l allen group the group sex tube8
group insurance trust group hate crossroads counseling group
group therapy cartoons celiac disease support group
italy tour group group tranny sex
ideal property group
group 1 atoms northeast consulting group current group discussion
group activities adults arag group legal services
group writing exercises divine music group
exit realty deaton group blue kacheek group
periodic table group a 6594th test group
financial services working group group sex lesbians emerald medical group
xxx pics and videos Final fantasy yuna xxx
Road head xxx xxx porn pass
Xxx girle anime hentia xxx
xxx ebony sex Shameless xxx xxx gilr
Streaming hentai xxx
xxx movies hd Cartonn xxx
wicked xxx movies Jan xxx grim adventures of billy and mandy xxx
Older mom xxx
Paris hilton sex xxx
Xxx forced porn xxx main picture glue
adult free xxx Free xxx flash games black sex xxx video
white sluts xxx Free xxx german vintage xxx videos
xxx fan fiction Dirty xxx girls
Caty xxx free big tit xxx
Asian porno xxx
xxx girl on girl action Orgia xxx dragonball z xxx pics
samuraix xxx Asian adult xxx
Android 18 xxx xxx pornovideos
Xxx galleries movies shin chan xxx
Anime lesbians xxx xxx horror porn
Free bisex video
Hentai movie forum bull chicago video
Anara video tape hardcore wrestling video clip
bobbi eden movies Video adulti game hook video
Manticore movie
hampton roads movie Party sex video sample
college party movie Pattycake online movies advent children movie torrent
Free bi sexual video
Swinger party movies
Bad sports movies cars racing video
princess aiko video Rogers video rental store free online movie sites
van diesel films Movie critic gene interpol live video
movie naked prey Dbz video games
Movie palace hamilton ontario girl little match movie
Eminem superman video clip
adult movie pass Alanis ironic morissette video pocahontas movie characters
download king rodney video Burn download video
Apv films londonderry movie nh theater
Intel 82815 video drivers sorenson video 3 codec
Unsinkable molly brown movie dizzee rascal video codes
Strip Sex Public
simulated sister sex Victorian Nude Sex
jamaican phone sex Sex Girl But
handcuff bed sex Girdle Sissy Sex sex machine asian
voyuered beach sex Hospital Nurse Sex sex comics 2d
sex stroies bbw Young Sex Vidies
korean girl sex Rape Sex Scenes sex during exercise
Safer Sex Lesbian
Interracial Threesome Sex
Utah Sex Offendes horse sex creampie
korean tenn sex Lost Bet Sex korean sex amateurs
free sex narratives Buddhism And Sex girlfriedn sex vids
real sex polls Sex Spokane Washington
Nasty Ghetto Sex chunky girl sex
Thugs 4 Sex
tiffany joslyn sex Sex Tourism Derby hawthorn berry sex
sex blow jobs Tripple Sex Penetration
Sex Female Condon skype sex babes
Lesbian Older Sex movie sex streaming
Celebrities Sex Movies swnger sex stories
Kate Winslet Sex Scne
free porn world sex Soha Ali Khan Sex
real homade sex videos Hot Wives Sex Videos
black strip club sex videos Sq Techno Sex fantasy girl sex
moms and daughters having sex together Sex Machine Vibrator new sex trick
hot lebians sex Celebrity Fake Sex Pics
free sex movies doctor Real Gay Men Sex trailer park sex stories
Seinfeld Sex Game
How To Have Sex With A Porn Star
Student Teacher Sex Movies sex scenes in gta 4
sex xxx ass Arabic Sex Images registered sex offenders in mo
amatuer latina sex Free Full Length Incest Sex Videos men sex with girl
do sex sites work Free Anna Nicole Smith Sex Videos
Nikki Hilton Sex Tape hermaphrodites video sex
How To Make Anal Sex More Comfortable
tall women sex videos Sex And Rum men sex tools
group sex party photos Free Sex Parties Videos
Erotic Lingerie Sex verne troy sex tape
English Sex Tube meget sex
Coolstreaming Sex sex rated r
Naked Sex Woman
sissy cock sex Split Roast Sex
online sex sims Office And Sex
minor sex laws Romantic Love Sex video speedo sex
bangla private sex Stockings Sex Pics sex prosituts montreal
sex and muscle Bite Sex Gay
clombia animal sex Young Sex Fetish dracula and sex
Sex Bodypainting Pics
Keral Sex Story
Baby Sex Predicition sleepwalking and sex
skirt party sex Sex Recovery Time internet sex rater
alt sex storiews Pokemon Sex Animataion workout pants sex
amature sex tubes Nudist Outdoor Sex
Anal Sex Swing prep anal sex
Love Makeing Sex
gillian\'s sex tape Kerie Hart Sex audition sex men
celeberty sex photos Black Sex Ppv
Evangalist Gay Sex ebony sex albany
Cyber Sex O adult picture sex
30 Petite Sex skeletal sex determination
Preview Xxx
free xxx ass Real Xxx
milf bone 3 xxx dvdrip xvid divxfactory Sex Xxx Arabic
free xxx hard core porn Porno Xxx Imagenes sinhala xxx videos
sly cooper xxx Main Xxx bideos porno xxx
mobile xxx free Mexicana Xxx
final fantasy xxx video Pakistani Sex Xxx xxx hentia videos
Free Xxx Videos Hardcore
Hot Xxx Girl
Bangladeshi Xxx Video videos xxx dormidas
xxx thums Naruto Xxx Vids movies xxx samples
free wap xxx Xxx Old Ladies sporty xxx
hentai xxx free videos Pajinas Xxx
Mom 46 Son Xxx gatomon xxx
Predator 2 The Return Xxx
asian xxx mp4 Middle School Xxx 13 years old xxx
free watch online xxx Ebony Xxx Video
Xxx Belly Dance gail force and friends xxx workout
Xxx Videoporno sexe video xxx
Taboo Porn Xxx sexo porno xxx
A Porn Videos
johnny gunn porn Natasha From Rock Of Love Does Porn
cougar porn movies Chocolate Ass Porn
sandy sweet free porn forum Elf Sex Porn my best friend\'s mom porn
best homemade porn video Babaloo Porn slut tube porn
porn boy on boy Suite Life Of Zack And Cody Porn
little girl child porn Gay Japan Porn cunnilingus porn
Free Ebony Porn Download
Gay Cartoon Comic Porn
Titties Porn porn muslim
wrangler porn Myles Hernandez Porn military women porn
two girls one guy porn Mature Porn Online india porn tgp
free black bubble butt porn Gabrielle Lupin Porn
Internet Free Porn your amateur porn tube
Free Unusual Porn
asian porn video download Nasty Grandma Porn free chubby bear porn
free real rape porn videos The Lord Of The Rings Porn
Cock Porn Pictures free downloadable cartoon porn videos
Bouncer Porn darryl hanah free porn
Tight Porn Pics gay porn in public
Crying Fuck
fuck chris brown song Electro Fuck
mom fuck stream Fuck A Dude
island fuck White And Black Fuck fuck the nanny
fuck toon games Womens Fuck fuck a neighbor
couple fuck on webcam School Teen Fuck
fuck gents Lil Wayne Fuck Tha World Lyrics public humiliation fuck
Fuck Friend Lyrics
Hookers Fuck
Fuck Girls Vedio momy fuck son
fuck go Parents Fuck You Up Poem fuck english girls
perfect ass fuck Slut Fuck Videos dog fuck mature
pov fuck free As Bad As You Wanna Fuck I Wanna Fuck Too
Fuck Top horse fuck with girl
Moroccan Fuck
hot wife rio fuck I D Rather Fuck With You Eazy E fuck his cock
blonde big tits fuck Fuck Her Videos
Filipina Fuck Video brothers fuck sister
Fuck A Gang wendy ho fuck me
Sexy Hot Fuck girl dog fuck
Hot Blowjob Sex
Arabic Blowjob
Old Lady Blowjob striptease and blowjob
dog interrupts blowjob Little Girls Blowjob chloe savigny blowjob
asian blowjob free Linsay Lohan Blowjob blowjob guys
ava devine blowjob videos Shemale Gets A Blowjob
Blowjob My Brother wanda nara blowjob
Blowjob From A Dog
goth blowjob Speed Blowjob blowjob reviews
free hd blowjob movies Blonde Slut Blowjob
Artificial Girl 3 Blowjob fun blowjob
Busty Wife Blowjob blowjob dirty
Superhead Blowjob blowjob in classroom
blowjob photography Extreme Blowjob Pics black blowjob cum
sensual blowjob Blowjob Meaning sister brother blowjob video
Blowjob Matures shyla stylez blowjob video
Blowjob In Public Video maria ozawa blowjob
blowjob techniques video Blowjob Competition Videos amature gay blowjob
paki blowjob Anne Hathaway Havoc Blowjob thai blowjob videos
Big Cock Gay Blowjob blowjob 3d
temptations song my girl Gossip girl 3 2
special occasion little girl dresses Boy and girl jumping how to use a dildo on a girl
the litle girl Young black girl dancing lost girl found
hot star trek girl Nick chat girl sex
i have a crush on this girl Big booty girl video of girl giving head
Free girl pissing video
Girl scout theater badge
Sexy dancing girl video sexy dancing girl video
don t take the girl album Fucking 14 year old girl teen girl stip
madonna bad girl snl Glitch girl episode list of gossip girl
girl who died from drinking too much water Squirting asian girl
Girl riding bikes sex anime girl
Girl with nipples
girl toddler dress shoes Every girl music video by lil wayne sex skinny girl
girl gets attacked by shark 5 guys fucking one girl
Girl orgasm compilation emo girl nude
Girl fucks real doll get girl friends
Girl moaning noise rock of love girl porno
everything but the girl sheet music Girl i wanna lay you down jack milkman girl
girl lil wayne You look kinda cute in that polka dot bakini girl the girl from twilight
i like a bitch A Bitch In Heat damn that bitch is fine
5 star bitch by yo gotti Kristen Stewart Bitch Face a bitch a lover
Lyrics For Baddest Bitch logan you son of a bitch
Im A Bitch Alanis Morrisette
tupac bitch Bitch Cat im in miami bitch remix lyrics
Lyrics Fuck You Bitch lyin\' ass bitch
kyle\'s mom is a bitch mp3 Bitch Slappin fuck that bitch i dont need that bitch
i want my change bitch Id Rather Give You My Bitch Lyrics santa\'s a fat bitch
bitch ass niggers Bitch Boy Tube
You Dirty Bitch no ones the bitch
Is My Bitch Pregnant
you son of bitch Lil Wayne A Bitch kyles mom is a big bitch
metallica bitch Dance Bitch Dance
Dave Chappelle Im Rick James Bitch sexy bitch pics
Fat Bitch Naked bad bitch trina
Fabolous Bad Bitch Lyrics skinny bitch shirt
julia voth bitch slap Gangster Bitch Apache life\'s a bitch sayings
selena roberts is a bitch Im A Fuck A White Bitch cut throat bitch
Webster Bitch god bitch
I\'m A Bitch Im A Lover ultimate bitch slap
Xxx You Tube
meaty pussy lips Mommy Cunt Seducing Son Henry
oral pleasure Free Nude Cheerleader Movies
sexy tits movies Cocksuck melanie griffiths sexy
lesbian sorority Nude Natural Blonde gay cum eating
sex stories Amatuer Naked Videos
games with nude Giant Dick tips on girl masturbation
Android 18 Gets Fucked
Small Dick Humiliation
World Record Cock hot good looking mens with large dicks
british women amateur open Underage Girl Nude Child Sex Free Pic Illegal Gallery naked girl
bestteens Guys Sucking Guys dragon ball xxx
hmong sex Black Lesbian Sex
Teenage Girls Getting Raped free pictures of naked female school teachers
Sophie Monk Nude
scat sex Sandy Hook Nude Beach mature women pics
handjob paradise Free Ilustrated Sex Stories
Webcam Fun jokes for teens
Fucked My Wife edmonton nude models
Free Ebony Teen Movies go track someone uls on line you fuck ip scaner
Nude Celebrity Movie Archives
nude girls on web cams Nude In Theaters
sara miles nude Hot Nude Wife Pics
old ladies in the nude Barbara Howard Nude kimberly holland nude video
redhead girls nude Nude Women Drawings sexy muscle men nude
nancy benoit nude Nude Step Mom
fat pregnant nude Miss California Nude Shots nude gf
Nude Supermodels Video
Ashley Candy Nude Video
Black And White Nude Couples paris hilton hot nude
nude arab male Nude Hairy Beach nude at club
g4 nude Nude Cheerleaders Pic cory nadine nude
hot nude love Julia Ormond Nude Pictures
Tonya Elliott Nude nude sexy japanese girls
Kloe Kardashian Nude Pics
cougar club nude Nude Woman Running linda pearl nude
samos nude Butterface Nude
Andi Pink Nude nude athlete
Sexy Nude Womans dexter laboratory nude
Hillary Duff Nude Pic nude black celbs
brutal first anal free anal pain video
anal creampies pics anal squirt movie
big black butt anal anal piles painful anal penetration
fitness anal pee in anal julia ann anal video
brazilian girls like anal kandi kream anal
blondes that love to do anal dirty daisy anal anal double penetration videos
double anal creampies
vanilla deville office anal
lesbians anal fist lady anal
latina anal fuck your wife to have anal sex anal orgys
double anal cream does anal sex feel gay anal positions
my wife loves anal anal photographs
kates playground anal anal glands on dogs
asleep anal
nina hartley guide to anal free anal mobile porn sweden anal
how to have good gay anal sex ebony porn anal
best anal scenes anal rape erotica
anal bestiality gay anal hardcore
free videos anal black chicks anal
male anal dildo anal birthday drunk girl anal sex
Ron jeremy anal sex anal sex toys video
emo anal fuck Anal while sleeping jade fire anal
black anal milfs Anal mastrabation
free anal por Rough anal rape first anal clips
Margarita does anal
Free anal hard
Pornos anal anal cum bubble
gonzo anal Brazil girls anal milf anal xxx
dirty black anal Male on male anal sex anal sex fetish
losing anal virginity Liz vicious anal videos
Zack and miri make a porno anal scene jo anal lube
Anal pentration
hot blondes anal Extreme anal sex movies anal toys for boys
anal sex with dad Hot anal orgasm
Girls anal video russian milf anal
Teenage anal porn anal action video
Gay anal love female to male anal
g string anal Enemas and anal sex japanese anal whores
rough anal sex videos K9 anal gland anal cumshots pics
Anal hygene anal sex with large penis
sex pistols drummer Young Sex Parters
little kds sex Charity Sex Disabled
sex on bench Casual Sex Brighton
kara sex scene Teenager Sex Movies milk run sex
sex jennie fuck Predators Sex List kitchen sex scene
585 phone sex Diego Sex Dc
first sex tube Mormons Having Sex hentai sex videos
Cleb Sex Clips
Sex Romans History
Sex Free Teenager cheap sex cam
southern sex pic Sex With Reptile trivandrum sex guide
porn demon sex Indian Posh Sex teen auditions sex
kyndra sex tape Sex Magic Wand
Sex Gay Site chinese sex licking
Adoult Having Sex
phone sex latinas Real Sex Swingstock arab sex mpegs
virginity sex games Twlight Sex Gallery
Sex Stories Pos stafford sex catholic
Asian News Sex miami sex dates
Lidsey Lohan Sex taurus sex rough
Mature gay cock sucking xtube fat cock
Best of freaks of cock mother suck son cock
wifes big cock Crossdresser sucking cock girlfriends sucking cock
black cock porn videos Old women love cock twink cock suck
Ass cock pussy big gay monster cock
Angelica\'s heart craves cock
bisexual men sucking cock Teen cock gagging small tranny cock
Black bitches sucking cock free horse cock sex
virginal cunt dog cock Cock whipping stories she hates big black cock
cock crush clips Monsters of shemale cock huge cum cock
cock squirting Big cock gay pic
Freaks of cock movie cock fights video
Suck my shemale cock
amateur cock gallery Asians love cock chastity cock
long horse cock Huge gay cock tgp
Worship the cock art cock
Guy with a big cock school girl sucks cock
Why do white girls like black cock black cock throat fuck
cock ring jewelry Huge cock brothers white teen big black cock
long cock tight pussy Cock fighting in puerto rico big cock abuse
porn billy Longhorn Girls Nude
free clips girls fuck guys Nude Massage
hot new sex toys Nude Celebrity Video Clips
houston gay community Free Porn Sex Video video sex scenes
preteen magazine pics Sex Kilt Man shemales fucking girls
mature blow job xtube porn camelstyle Free Full Length Gay Movies
free porn niggers lactating Private Home Porn Videos anal sex free photos
Black Pussy Chat
Twin Brothers Gay
Aussie Jewel Nude Vids stable sexual partner
white dicks black chicks Free Nude Ladies nude masturbation
gay doctors Open Door Naked Shower Sister young lolita sex
pregnancy signs for teens Smallville Sex
Pedo Bbs Nude high school porno
Independent Phone Sex Operator
nudedude Nude Fat Women latin nudes
fuckmymelons Vanessa Hugdens In The Nude
Teen Witch naked vince vaughn
Freepornowebcam free black on white sex
Sex Shops teen sex videos
x-ray oral sex Anal Group Sex
ohio sex partners Having Sex Dry
pajama sex cum Sex Pics Gallires
vaginal sex videos Bound Sex Comics ren stimpy sex
filetube desi sex Solo Sex Pictures sex party 4
teen moan sex Birthday Sex Lyrics
gay hunks sexs Sex Tape Karshadian ethiopian sex stars
Guys Havin Sex
Horse Sex Boob
Granny Phoe Sex cheerleaders sex orgy
valerie lee sex Cathy Free Sex boys women sex
statutory sex stories Wallpaper Anime Sex myspace sex graphics
sex studies videos Sex N Sun
Msture Sex Videos interracial sex sissy
Sex In Recliner
youngsters sex tapes Small Titty Sex porn sex redtube
showering before sex Weeds Sex Scenes
Amateur Sex Streaming strap-ons sex videos
Gay Sex Boundage sex positions iphone
Sex Meetings Uk mature sex v
brutal first anal free anal pain video
anal creampies pics anal squirt movie
big black butt anal anal piles painful anal penetration
fitness anal pee in anal julia ann anal video
brazilian girls like anal kandi kream anal
blondes that love to do anal dirty daisy anal anal double penetration videos
double anal creampies
vanilla deville office anal
lesbians anal fist lady anal
latina anal fuck your wife to have anal sex anal orgys
double anal cream does anal sex feel gay anal positions
my wife loves anal anal photographs
kates playground anal anal glands on dogs
asleep anal
nina hartley guide to anal free anal mobile porn sweden anal
how to have good gay anal sex ebony porn anal
best anal scenes anal rape erotica
anal bestiality gay anal hardcore
free videos anal black chicks anal
male anal dildo anal birthday drunk girl anal sex

Tamper-resistant tokens are needed to compute the digital signatures for electronic commerce applications; they are the best way to prevent disclosure of the signer's private signature key. If the private signature key is disclosed, then anyone can use it to forge the signer's signature. If significant numbers of private keys are disclosed and are used to forge electronic checks, electronic credit cards, or electronic cash, then these forms of money will not be accepted. In a situation like purchases on the WWW, where other forms of identification can't be used, merchants must rely on the security of the signer's private signature key.

Enough tamper-resistance is needed to make it economically unattractive for attackers to steal signature cards, extract the private key, and pass bad "checks" with that key before the card is reported stolen and the account changed.

Smart tokens often require a password in order to function. This provides the token some certainty that the person using it is the person who is supposed to be using it. This isn't always necessary--for some applications, entering a password each time the token is used is more trouble than it's worth. In general, if a person can use the token to spend money or access sensitive data, it will have a password. The user enters the password on his keyboard, or directly into the token via a keypad. Even if the computer has been hacked to record passwords, that won't allow anyone to break the system; they still have to get possession of the smart token.

The most common application for a smart token is to convince some larger system of a user's identity, so that the larger system, perhaps with help from the token, will allow the user to do something. Protocols for proof of identity are a well-studied area of cryptography, and several techniques are discussed in [8]. For example, in order to allow a user to log in to a remote system, a computer might require the user to use a "one-time password" stored in the token. Since only the token and the remote computer know what the next password should be, only this token could have given the right password.

Once the user and token have identified themselves to the larger system, then the system and the token can work together to allow the user to do something. For example, a software metering token, after it has identified itself to the software being metered, can authorize another execution of the software and increment its internal counter by one.

2.2 APPLICATIONS OF SMART TOKENS

Restricting access to remote computer systems: A physical "key" token can be used to restrict access to a computer system accessible via Internet or modem. The computer system and the smart token can work through an interactive protocol that verifies each to the other, and can even agree on a session encryption key. This type of system allows a user to log in through an untrustworthy terminal without leaving access to his remote account with the terminal.

A physical "key" for digital signatures: Suppose a user has a private signature key that she uses to authorize contracts of up to $10 million. She may not feel comfortable trusting this key to her personal computer. Even if it's protected with a password, a really capable attacker might install some software to capture her password, and later, her key. A million-dollar contract can't be signed without both smart token and personal computer being involved. The smart token can be kept physically locked up, and will be protected by a password in any event. Similarly, she could use a threshold signature scheme, which might require the agreement of (say) three of five high-level executives in order to sign a major contract. Each of these executives can be given a smart token, and can be required to enter their password to permit the contract to be signed. These protocols are described in [8].

WWW Purchases: In place of a normal VISA card, a user has a smart token. When she wants to buy something, she puts her card in her computer and enters her password. The card then handles the transaction automatically. It should be impossible for anyone to capture enough information from the transaction to perform more transactions. It's even possible for the smart token to keep a transaction log. Other payments systems, called "digital cash" systems, keep the user's transactions anonymous unless she tries to defraud the payment system (i.e., by spending the same electronic dollar twice). These sorts of schemes are discussed in [8].

Software metering: Another nice application for smart tokens is in application software metering. Ideally, a user would be able to load up a single token (perhaps a PC Card) with the licensing information for all her software. Each time she or one of her employees opened an application, that application's meter would be incremented by one. The metering might measure hours or minutes of application time used, maximum number of users, or might even bill specific functions of some applications more heavily than others. This kind of token mimics the little meters that are used in some self-service photocopy shops, where a user is given a meter, which is required to run the copying machines, and which counts the copies used. When the meter is returned, the user is charged for her copies. The physical security of the token is trusted to prevent the user from resetting the counters. The same metering token can also be used for other metering applications: interactive-TV set-top boxes, automobile tolls, and public transportation payments.

Single-copy documents: If a user has a document that needs to be readable, but not copyable, a smart token can act as that document. When someone reads the smart token, they first verify its identity, then read the contents of the token's document. This document may also be digitally signed by some kind of notary. So long as an attacker cannot recover the token's secret information, which it uses to identify itself, the token can't be copied. A single token can conceivably carry many such documents. Variations on this allow the token to "spend" the documents (perhaps they're rail or bus passes), deleting the special identifying information from each document as it is spent. This is discussed in [2]. Note that this doesn't prevent anyone from copying the document from the token--instead, it simply keeps them from claiming that their copy is the original.

Electronic Subscriptions: If a user wishes to purchase a six-month subscription to an electronic newspaper or news service, he buys a newspaper token. When he gets to a terminal (maybe in a hotel room), his token can authorize him to access the latest news from this newspaper. Probably, additional services will be made available for extra charges, such as more extensive photo coverage, or expanded coverage of specific areas of the news--these can also be known and authorized by the smart token.

Secure storage devices: Some smart tokens hold significant amounts of flash-RAM, which can be used to hold secret user data. The token also holds some physically secure memory, which keeps an encryption/decryption key. The user must enter the right password to gain access to the data. (Often, the password and the internally-stored data must both be used to determine the encryption/decryption key.) It is possible to split the flash-RAM into many partitions, and encrypt each with different passwords and keys.

Secure tokens can also be used to implement protocols for electronic auctions, secure voting, anonymous transactions, and others.

2.3 HOW SMART TOKENS WORK

This section is meant as a brief introduction to the operations of smart tokens. To get a better understanding of the algorithms and protocols discussed here, see [2] and [8].

Passwords: A token can deal with passwords in two basic ways. The simplest is to check the user's password against an internally stored value, and authorize the user's request if the password matches that value. (The actual password isn't usually stored. Instead, some value based on the password is stored, so that the password isn't revealed even if an attacker manages to read the token's internal memory.) The second way, more complex but more secure, uses the password as a decryption key, to decrypt some internal set of values, which are then used to authorize the user's request. In this case, the token itself has no way to determine whether the password was correct--the larger system being connected to must do that. When secret data is stored in the token, it is common for it to be encrypted under a key derived from the password.

Identification Protocols: A token can identify itself to another system in many different ways. The most common method is for the system and the token to share some secret data. The outside system sends a "challenge" (a random string of bits) to the token, and the token must calculate the proper "response," based on the secret data. Other systems allow a token to identify itself, using a public and private key. The token must hold the private key, the outside system must only know the public key. For a good introduction to this kind of system, see [8].

Digital Signatures and Message Authentication Codes: A token may authorize a transaction if the token digitally signs a timestamped request for the transaction to take place. This involves a secret key kept in the token, and a public key known by the system. See [2] and [8] for discussions of this kind of algorithm and system. More generally, a digital signature may be used anytime a block of data needs to be verified as having come from this token, and the systems that will do the verification don't share any secret data with this token.

3.0 CRYPTOGRAPHIC API STANDARDS

In order to integrate cryptographic functionality with "off the shelf" commercial software, there have been many recent efforts to develop a modular Cryptographic Application Program Interface (CAPI). Of these, there are three proposals that are proving to be widely accepted. They are: the GSS-API (Internet Engineering Task Force)[5], the GCS-API (X/Open)[9], and Cryptoki (RSA)[5].

Although it is beyond the scope of this section to describe these three CAPIs, it is important to note that they differ significantly in the degree of cryptographic knowledge required on the part of the application developer for implementation. The GSS-API requires the least knowledge of the underlying cryptography and Cryptoki requires the most understanding. In addition, Cryptoki is the only one of the three CAPIs that was written primarily for smart cards and tokens. It includes an abstract token interface that is intended to be the only layer in a software architecture that requires change in order to implement a wide variety of Smart Tokens. A useful analysis of CAPIs can be found in [7].

Since Cryptoki requires more knowledge of the underlying cryptography, it will be helpful to some application developers for an additional higher level API to be provided along with the Smart Token software development tools.

4.0 AN EXISTING SMART TOKEN IMPLEMENTATION

4.1 GENERAL DESCRIPTION

The currently implemented Smart Token combines high-density flash memory and data security functions in a ubiquitous PC Card Type I package. It is compatible with PC Card release 1.x and 2.x memory card specifications. The design provides the computer user with removable, secure non-volatile memory plus data and communications security support in a single package.

This Smart Token implementation is available with storage capacities from 1 to 24 Megabytes. In normal operation, the Smart Token's memory is compatible with host computers having PC Card adapter slots for additional memory or removable media. The Smart Token uses flash memory with 64-Kbyte block erase capability and supports both word-wide and byte-wide transfer modes.

Security features provide memory access control as well as support for data security functions such as secure remote log in, Public-Key encryption, digital signatures, etc. The security feature is provided by the FIPS PUB 140-1 Level 3 compliant Cryptographic Support Processor (CSP) embedded in the card. The CSP is an integrated circuit based on ISO standard smart card technology which is recognized internationally as a secure vessel for key and password storage. The Smart Token's CSP provides secure computing functions such as random number generation, key encoding, and key comparisons, while the private key information never leaves the secure silicon. Multiple passwords can be stored on the chip.

Passwords stored in the CSP can be changed, but not read, by host resident software. The Smart Token is shipped with default memory passwords installed in the CSP. The operating environment and software resident in the CSP prevents access to the secure storage, but allows certain defined operations using the secure data. The CSP can detect physical security violation, attempts such as probing the chip, de- soldering the chip, and electronic probing involving single stepping the clock.

Access to the CSP is through host-resident software and Smart Token drivers described below. The electrical interface between the host and the Smart Token is compatible with PC Card memory-only release 1.x and 2.x. Data transfer between the host and the CSP interface is controlled by the card interface ASIC which supports the ISO 7816-3 standard. Host resident software supports the RSA Cryptoki standard.

The presence of the CSP allows host resident software to execute secure data interchange such as remote log in, data communications, digital signatures, information "metering" and electronic funds transfer (EFT), using standards including DES, DSS, PKCS and RSA. The Smart Token is all solid state, requires no batteries and is robust compared to storage media such as floppy disks.

4.2 SOFTWARE ARCHITECTURE

This section provides an overview of the software architecture of the PC Card Smart Token. Applications are presented in a Microsoft Windows 3.1 environment, with PC Card software support provided by SystemSoft card and socket services. Some of the architectures presented are considered to be building blocks for higher level functionality, and are designed in a way which will promote future advanced application development. There are six major software components which interface with various levels of DOS, Windows, and PC Card architectures. They are:

Smart Token resident software for encryption and protection services provided by the CSP

a DOS driver interface to the CSP, with block driver hooks to support transparent file encryption.

a DOS card service vendor specific driver to support file system initialization.

a Windows DLL which implements a CSP API protocol layer through DPMI services and the CSP driver.

a Windows GUI user application for administration of card protection and encryption.

a Cryptoki support library which implements the Cryptoki API with CSP services

The first component is Motorola 6805 instruction code which is resident in the CSP memory space of the Smart Token card. The other components are loadable or installable drivers and applications that execute on the host machine. A configuration for these components is illustrated in Figure 1. In this scheme, the CSP and encryption support driver is a DOS TSR application which is loaded at boot time and executes in real or virtual 86 processor modes. The card and socket service components are contributed by SystemSoft and provide PC Card 2.1 compliant support for Smart Token card interfacing. A Smart Token specific DOS driver is provided which implements a card service vendor specific call to reinitialize file system components when required by Smart Token protocols. The flash translation layer (FTL) is a SystemSoft character driver which emulates a random access block device on a flash platform. In Windows, several components allow for high level application and end-user card management. The CSP protocol DLL implements an API for performing CSP operations through the CSP driver. The Cryptoki support library implements a similar interface packaged into a Cryptoki API set. Cryptoki applications may link with the library to receive Cryptoki support on the Smart Token platform. The Windows File Manager is the standard Windows 3.1 file system management application, and represents any number of high level file components running in Windows protected mode. Lastly, the Smart Token Card Manager is a Windows protected mode GUI administration utility.

Figure 1

Socket Services: Socket Services provides an interface between Card Services and the host socket hardware. It is intended to allow software layers above it to be independent of the socket hardware implementation, aiding software portability.

Card Services: Card Services coordinates access to cards, sockets, and system resources.

CSP Access Support: This driver contains an application service function for high level pass through communication to the Smart Token CSP. The driver acts as a PC Card, Card Services client, and registers for callbacks on card insertion and removal. When a Smart Token card is inserted, the driver handles the required CSP initialization functionality of requesting a memory window to the Smart Token card and mapping the window to the CSP control register space. It also resets the CSP controller and looks for the proper response sequence. The driver is implemented as a DOS TSR application, loaded prior to Windows.

FTL Transparent Encryption Support: Support for transparent file encryption to the Smart Token flash is implemented on top of SystemSoft's flash translation layer (FTL). The driver traps file system requests targeted to FTL and, if the request is directed to an unlocked Smart Token card, may automatically encrypt or decrypt the request data with the embedded Smart Token key. Encryption is implemented with DES cipher block chaining on a sector basis. Transparent encryption is enabled through high level applications by setting the Smart Token encryption state using the CSP resident API.

Card Service Vendor Specific driver: A DOS character device driver is implemented to provide special vendor specific services required by the Smart Token card. Following a card lock or unlock, high level file system access to the Smart Token flash area changes. However, without notification of the change, the file system will not reinitialize itself to detect the new state. This driver monitors card service registrations for memory clients, and saves card service callback addresses. Following a lock or unlock of the card, a vendor specific card service API is provided which allows for issuing a card service REMOVE or INSERT callback to registered clients in order to force data structure reinitialization.

Cryptoki support: The Smart Token Cryptoki application library provides public entry points for Cryptoki defined functions. This library implements general Cryptoki layer support for token, session, and object management. The library makes use of the RSA BSAFE library for key generation and the support of Cryptoki defined cryptographic functionality. In the current implementation, the Smart Token card supports two predefined global objects which are created with the C_InitToken function. These objects are a public and private RSA key pair. All global objects (predefined or user defined) are stored in an encrypted format on the flash memory of the Smart Token card. Access to this memory is protected by the locking mechanism inherent to the Smart Token hardware design. When a Cryptoki session is started with an application, the Smart Token card must be unlocked, and the global objects loaded into memory. The software logic for unlocking the Smart Token card is implemented in the CSP driver and Smart Token CSP resident support. Once the card is unlocked, an application has access to global Cryptoki objects through the flash file system. Before objects can be loaded, they must be decrypted using a CSP resident secret key. When a Cryptoki session is closed, all global objects (including any new defined objects) are stored on the flash and encrypted with the CSP secret key. The Smart Token card is then relocked until another session is started.

5.0 WWW IMPLEMENTATION - FSTC ELECTRONIC CHECK PROJECT

The Financial Services Technology Consortium (FSTC) is a collaboration of major banks, technology companies and laboratories that was formed to address the critical need for viable means of conducting electronic commerce on public networks such as the Internet. Currently, over sixty organizations are members of the consortium. A secure payment system and deposit gathering mechanism for the banks is considered to be an essential enabling component in the commercialization of these networks.

The Electronic Check Project was developed by the FSTC to provide a secure, all electronic payment system modeled after the familiar paper check. It is an integration of a traditional form of payment within the existing financial services infrastructure and the rapidly growing electronic networks. A detailed description of the project, the functional flows and its objectives can be found in [4]. On September, 21, 1995, a live demo of the Electronic Check Project took place at the Bank of America in San Francisco. Participants in the demo included Bank of America, Bank of Boston, Bank of Montreal, Bank One, Chemical Bank, BBN, IBM, Sun Microsystems, Telequip and Bellcore.

The demo was conducted over the Internet using the World Wide Web. It included the purchase and payment by electronic check of a "Teddy Bear" for the Vice President of the United States, Al Gore, from PC Gifts and Flowers. One of the more remarkable aspects of the demo was that the check actually cleared electronically through the Automated Clearing House of the US banking system. Telequip's PC Card Smart Token implemented as described in Section 4, performed the role of the Electronic Checkbook, generating and signing the first electronic check through the US banking system.

In the demo and subsequent pilot program, Electronic Check makes use of a PC Card Smart Token in the form of an Electronic Checkbook which can be used within the context of the World-Wide Web. A Web browser in conjunction with an Electronic Check application has been integrated with the implementation described in Section 4. Two additional software layers are provided between the Electronic Check client application and the Cryptoki API in order to provide a higher level interface as discussed in Section 3 and to fulfill specific functional requirements of the Electronic Check initiative. The overall goal of this architecture is to make maximum use of existing standards and lower the risks associated with lower level interfaces to cryptographic devices.

5.1 FUNCTIONAL FLOWS

Unlike some of the newer stored value proposals for electronic commerce such as Mondex, Electronic Check is based on the familiar paper check model. Email is substituted for paper delivery by the postal service and digital signatures on the Electronic Check message replace the hand written signatures on paper checks. Since the functional flows are essentially the same as in the paper check model, the system is easy to understand. It is anticipated that rapid adoption of the Electronic Check will take place due to ease of integration and significant cost savings. Support for payment instruments like certified checks, cashiers checks, credit card charge slips and additional features such as future dating, limit checks and multi- currency payments can be accommodated.

Several scenarios for functional flows are described below:

Figure 2

Figure 2 above depicts the typical Electronic Check flow. The payer receives an invoice from payee, generates a Electronic Check and sends it to the payee via email. The payee then emails the received payment to his bank and settles the transaction with payer's bank

The Cash and Transfer Scenario

Figure 3

In Figure 3 above, the payer receives a bill/invoice from payee, issues an Electronic Check, and sends it to the payee. The payee presents it directly to the payer's bank to be paid to the payee's account at his bank.

The Lockbox Scenario

Figure 4

In Figure 3 above, the Payer receives a bill/invoice from payee, issues an Electronic Check, and sends it to the payee's bank, either directly or via a lockbox. The Payee's Bank then sends accounts receivable information to the payee and clears the payment with the payer's bank. In this scenario, there may be no payee endorsement.

The Funds Transfer Scenario

Figure 5

In Figure 5 above, the payer receives a bill/invoice from his bank, (assuming electronic bill presentment allows for capture of the payee's bills by the payer's bank), issues an Electronic Check, an sends it to his bank. The payer's bank, in turn, transfers funds to the payee's account at the payee's bank.

5.2 KEY DESIGN OBJECTIVES

Parameterized Electronic Payments Instrument: By specifying parameters in the Electronic Check message, the check can be transformed into various instruments such as a traveler's check, credit card slip, cashier's check, etc.

Open Integration with Accounting Systems: Commercial accounting systems will have the ability to interface with Electronic Check modules through standard API's

Open Integration with Existing Inter-Bank Payments Mechanisms: Trusted gateways will allow connectivity between the public networks and the secured financial networks.

Authentication of Electronic Checks: Checks and checkbooks at any point in settlement cycle through the use of public key certificates.

Fraud Prevention and Confidentiality: Smart Token technology will help eliminate most of the losses due to forgery, alteration, duplication and fraudulent deposits.

5.3 PROJECT PLAN

The demonstration phase of the project was completed in September of 1995. A limited commercial pilot is expected to commence in 1996 and be in place for approximately six months. After evaluation and subsequent modifications have been implemented, a more extensive pilot will be followed by a full production version of the system.

6.0 CONCLUSION

Smart Tokens have the potential to enable a revolutionary expansion in products and services that can be offered on internetworked systems. The essential elements needed to bring this expansion to fruition are just beginning to appear in the marketplace. APIs have now evolved to the point at which mainstream commercial software applications can be architected to include Smart Token capability as a standard feature. Implementations in conjunction with projects initiated by major financial institutions, such as the one described in this paper, offer a starting point and a glimpse of a whole new industry that will underpin the future of electronic commerce on the Web.

7.0 ACKNOWLEDGMENTS

The authors would like to thank John Kelsey, who assisted with the theoretical sections on smart tokens, and Chris Carlisle, who assisted with the section on the current implementation GLOSSARY OF CRYPTOGRAPHY TERMS

Digital Cash - An anonymous electronic payment system, where users withdraw electronic "coins" from their bank, and spend them with other users, without ever having to reveal their identity. Should the user try to spend the same "coin" more than once, his identity would be revealed.

Digital Signature - A digital signature is a way of marking a digital document (like a computer file), so that only a person who knew some private key value could have marked this document this way. There is a public key value that can be used to verify that this document was properly signed, which is published somehow. Digital signatures are commonly done using systems such as RSA, DSA, and El Gamal. A good introduction to this is [3].

Encryption/Decryption - Encryption scrambles a message so that it can't be read without a key, which is known to the intended recipients of the message. Decryption unscrambles the scrambled message, so that it can again be read. Encryption is a generally good way to keep private data (such as a premium television channel) away from unauthorized users.

One-time password - Many computer systems require a password to allow a user to log in. Unfortunately, if a user is logging in over a modem or the Internet, her password can be seen by someone eavesdropping on the line. To defeat this, there are systems that use a different password each time a user wants to log in. The new passwords are generated by some cryptographic scheme, so that even when an eavesdropper catches a user's password, he can't use it to log in to the system. Generally, a token carried around by the user either generates the one-time passwords, or stores them for the user.

Public/Private Key - A public key system has two keys--a private key, known only to an authorized user or system, and used to digitally sign or decrypt documents, and a public key, used to verify digital signatures or to encrypt messages to the owner of the public/private key pair.

Tamper Resistant - A tamper-resistant device is difficult for someone to take apart and change its operation, or recover secret information in it. It's probably not possible to design a computer device that's absolutely tamper resistant, just as it's probably not possible to design a safe that can't be drilled through. It is possible, however, to make tampering with a computer device (such as a smart token) so time- consuming, difficult and expensive, that it's not worth the trouble to try.

Threshold Scheme - A method for splitting up a secret into n "shares," so that it takes k of those n shares to recover the secret. For example, a 2-of-5 threshold scheme creates five shares of a secret, and any two of the five shares together can recover the secret, but a single share can't recover it. See [3] for more information on this kind of scheme REFERENCES

[1] R.J. Anderson, "Why Cryptosystems Fail," Communications of the ACM, v. 37, n. 11, Nov 1994, pp. 32-40.

[2] D.W. Davies and W.L. Price, Security for Computer Networks, John Wiley & Sons, 1989.

[3 ] P. Fahn, Answers to Frequently Asked Questions About Today's Cryptography, Version 2.0, RSA Laboratories, 1993

[4] FSTC, "Electronic Check Proposal: Public Document" Financial Services Technology Consortium, 1995

[5] B. Kaliski, PKCS #11, Cryptoki, RSA Laboratories, 1995

[6] J. Linn, "Generic Security Service Application Programming Interface," RFC 1508, Nov 1993.

[7] National Security Agency, "Security Service API: Cryptographic API Recommendation," NSA Cross Organization CAPI Team, 12 Jun 1995.

[8] B. Schneier, Applied Cryptography, Second Edition, John Wiley & Sons, 1996.

[9] X/Open, "X/Open Preliminary Specification: Generic Cryptographic Service API," draft 3, Mar 1995.

[10] M. Zurko, WWW Security Standards Forecast: Partly Cloudy, IEEE Cipher #7, 1995