Modern cryptographic protection is based on a public key infrastructure -PKI (Public Key Infrastructure). The essence of PKI is to create a key pair: closed (personal, secret) and open (public) keys. The private key belongs to its owner and no one except for this owner knows about it. The public key is available to everyone. There is a direct correspondence between the public and private keys: knowing the private key, you can easily determine the public one. However, the opposite effect is impossible. That's why these keys are called asymmetric ones.

A key is a sequence of bits, the length of which may vary: 256 b, 512 b, 1024 b, etc. The cryptographic endurance of a key depends on its length. Although the bigger the length, the more difficult and slower occur the processes for which the key is used. Meanwhile, the transaction speed may be crucial, for example in web traffic encryption. Moreover, starting from a certain length the cryptographic endurance of a key is so great that it is impossible to determine even in several years. Thus, a fur­ther increase in key length does not make sense.

A certificate is created together with the public key, which is issued by Certification Center (CC) or is generated independently by a private key owner (in the latter case such a certificate is called self-subscription certificate). The public key certificate may be viewed using a web browser or special cryptographic means such as certificate manager, which is built into the Windows operating system and opens key independently. There is an opportunity to learn the name of the key owner, the name of the certification center that issued (signed) and assured this certificate, as well as other pro-prietary information which may be interesting for techsavvy users.

"One can't do without a certificate signed by a trusted certification center when we need to ensure web-site data encryption represented to clients such as a personal account in online bank. Other­wise, a client just could not communicate with us: an Internet browser would provide him with a warning. For some operations, such as the signing of electronic documents, an external VC certificate is not required, so we sign and issue keys to a client via a bank certification center", tells us the expert of financial and credit institution, a member of the top 30 Russian banks.

Private and public keys are stored generally on the so-called carrier key (USB-token, smart card, etc.), which contains a repository of one or more certificates. The repository is password protected to prevent malicious use in case of carrier key loss.

The main cryptographic protection of information (CIPF) during the development of a trusted media between a customer and a credit institution includes Internet traffic encryption exchanged between the client and the bank through the cryptographic encryption with break-in resistant algorithms certified by FSB; bilateral (client-server) authentication using bank web resources (e.g. online banking); one-way (server) authentication; client key for client authentication; signing of relevant legal documents (such as payment orders sent to the bank) by electronic signature (ES).

Internet traffic encryption consists of FSB certified cryptographic reliable (resistance to cracking) encryption algorithms that minimize the probability of valuable information intercept. These include various access passwords, as well as personal data that are exchanged by the client during remote banking transaction performance. When cryptographically weak algorithms are used or at the absence of encryption the information may be easily intercepted by hackers (for example, via sniffers) and used for fraudulent purposes. SSL, or TLS, is used to encrypt traffic and HTTPS (Hyper­text Transfer Protocol Secure) by using web-access to remote banking. We are talk­ing about HTTP-interaction encrypted by SSL/TLS.

According to the requirements of the Russian FSB during transmission of the client's personal data through remote channels the Internet traffic shall be encrypted via the algorithms corresponding to the document "Cryptographic transformation algorithm GOST 28147-89". A 256-bit key is mentioned by GOST. Currently, this value is the standard key size for symmetric cryptographic algorithms. It is also supported by the United States. The American Standard DES (the key size makes 56 bits), which existed before the appearance of GOST 28147-89, did not pass the test of endurance by modern computing facilities.

Two-way (client-server) authentication consists of a client key use for access control by remote banking. In this case, unlike one-way, or server, two-way authentication requests a client certificate from user. If the owner is not able to produce the correct key, the server breaks the connection. This method ensures that the remote banking services will be used only by clients who own a valid certificate, that is, by the client who is trusted by the bank.

The client is obliged to store a key securely, since if it is lost or stolen, a hacker may perform operations on behalf of the owner. When a loss is discovered, the client must immediately inform the bank about it. Then the certificate is revoked and placed in special blacklist repository. If the certificate is revoked, the client can't use it to gain access to the remote office of online banking. But the attackers, who stole the key, will not be able to use it to commit operations that may cause harm to a credit institution or a customer.

A unilateral (server) authentication is a special case of two-way authentication. But in this case, a server does not require a client certificate, does not check it. However, the server still provides its public key to the client, according to which the user can determine if he is connected to the trusted server. This is achieved by signing a bank server public key with one of the world's trusted VC (VeriSign, Thawte).

Another means of protection during the interaction via remote service channels is a client key for user authentication. In this case, upon the key presentation by a customer the bank authenticates the user according to the information contained in the certificate. It's like a personal recognition procedure. After that, the client gets access to the information that relates to his bank accounts, cards, etc. At that, cryptography ensures that no one can introduce himself using the name of another client: each individual has a certificate that can't be forged without knowing the secret bank key. It is kept in strict confidence by a credit institution.

Finally, the signing of legally relevant documents (such as payment orders sent to the bank) with a client's secret key. The tool allows you to sign documents with electronic digital signature which may be checked by any user who owns the client's public key. Thus, the client sends a public key to the bank (if it is not produced by a financial institution), then signs the necessary documents with ES. Accepting a document, a credit institution verifies its authenticity with the client's public key. Cryptographic protection guarantees the preservation of the information integrity, its impossibility of distortion by a hacker, provides the non-passing of a document even if only one bit of it is changed. In Russia the ES is legally equated to a client's handwritten signature.