3Skey
3SKey lets corporate users authenticate transactions with a single token and password across all subscribed banks . Developed with the banking community, it’s an interoperable, multibank solution built on the trusted Swift PKI infrastructure. Each bank assigns a unique identifier to their customers, for secure, unaltered, and legally binding transactions. 3SKey works with any electronic banking channel and internal workflow, providing central limit management and a complete audit trail.
Benefits
Flexible deployment
3SKey Digital Token
A mobile app-based solution offering the same high-level security—without hardware. Great for easy key management in hybrid or remote work settings.
Type: Software-based digital key
Setup: Zero footprint and simple setup
Security: Secure and trustworthy
Logistics: No need to ship or manage USB keys
Functionality: Sign transactions and authenticate identity
Compliance: PSD2 compliant
3SKey Physical Token
A USB device that securely stores your digital identity. Ideal for environments needing physical control and offline signing, with simple setup and strong protection.
Type: Physical USB key
Setup: Low footprint and simple setup
Security: Secure and trustworthy
Logistics: Hardware compatible
Functionality: Sign transactions and authenticate identity
Compliance: PSD2 compliant
Find out more about 3SKey
FAQs
What is SMPC?
SMPC, or Secure Multi-Party Computation, is a cryptographic technique where multiple parties collaborate to compute a function over their private inputs without revealing them individually. It ensures privacy by allowing each party to learn only the output of the computation and nothing about the inputs of others
Key shares are separate parts of the private key generated through the capability of SMPC technology to split the key into multiple shares.
In context of 3SKey Digital token solution, the private key associated with PKI certificate is split into two key shares:
- Digital token client share: this is one part of the split private key, securely stored on the user’s mobile device
- Token server share: This is the other part of the split private key, securely stored on a central server maintained by Swift.
The two are distinct and cannot be used individually.
How is a digital token created?
A digital token is created at the time of activation. One share is set up on the corporate user mobile device, while the other share is stored centrally by Swift. The activation process interacts with Swift 3SKey CA through a set of APIs to obtain the certificate associated with the generated key pair.
What platforms are supported?
The SMPC technology supports mobile clients (Android, iOS) only at present.
What is the validity of the Digital Token?
The digital tokens will have the same validity period of three years as we currently have with the hardware tokens.
Is the same CRL used for 3SKey physical and digital tokens?
Yes. The current CRL will also cover the certificates of digital tokens.
How about the CA?
In the 3SKey Digital solution, the certificates are issued from the same Certificate Authority (CA) used for the physical hardware tokens. However, there is a key difference in the certificate length employed for signature validation and the policy ID.
While the hardware tokens utilize 2Kbit certificates, the 3SKey Digital solution leverages certificates that are 6Kbit in length. Additionally, as the policy ID is different, the validation process will include the new policy ID.
How is the key share usage protected?
To protect the key share usage, the SMPC technology employs additional security measures through several layers. Firstly, the two key shares generated by SMPC are created individually at the separate locations. The client-side key share, generated at the client device, is more susceptible to exposure compared to the token server share residing on the central server at Swift.
The SMPC technology applies a second level of splitting to the client-side key share. One-part stays on the client side and the other is at the server side. This splitting technique ensures that even if the client device is compromised, the complete client-side key share cannot be accessed or reconstructed without the involvement of the server.
Furthermore, the client-side key share is protected by a PIN set by the user. The PIN is used to derive the encryption/decryption key for the client-side key share stored on the device. Only by entering the correct PIN can a valid signature be generated, as it is necessary to involve both the client device and the corresponding PIN input.
This multi-layered approach significantly reduces the risk of exposing or compromising the key-shares, as an attacker would need to overcome multiple security barriers, including gaining access to the client device, obtaining the correct PIN, and compromising the server component, to reconstruct the complete key.
Is the certificate tightly associated with the device and user?
The digital certificates used in the SMPC technology digital taken solution are tightly associated with both the user and the device. This close binding between the certificate, user, and device is a key security feature that enhances the overall protection of the system.
In 3SKey Digital solution scenario, the certificate is tightly associated with the user’s mobile device for security reasons. It offers a secure and mobile friendly alternative to the users.
This approach provides mobility while maintaining strong security. The user’s mobile device, therefore, acts as a secure out-of-band factor for authentication.
Leverage the mobile device’s security features – The mobile devices built in security features and user authentication mechanism (like PIN) protect the certificate.
Does this mean that a user cannot sign using a specific key share from multiple devices?
Yes. To ensure the security of the 3SKey Digital solution, each key share is tightly associated with and stored on a specific device. This means that a user cannot sign using a particular key share from multiple devices.
If the user has multiple devices, they will need to obtain the same number of digital certificates, each associated with a different device and its corresponding key share.
By restricting the usage of a key share to a single device, the solution enhances the overall security in the following ways -
- Prevents key share duplication – limiting the key share to a single device eliminates the risk of the share being copied or replicated across multiple devices, which could compromise the security of the system.
- Strengthens device-level access control – the tight binding of the key share to a specific device allows for more granular access control and authentication, ensuring that only the authorized device can generate valid signature.
- Mitigates risks of lost or stolen devices – If a user’s device is lost or stolen, the exposure is limited to the key share stored on that device, reducing the potential impact of a compromise.
- Enhanced accountability – If a user’s key share is used for unauthorized transaction signing, the connection with the device helps in identifying the source and assigning responsibility.
What security due diligence has been performed on the solution?
As part of our due diligence, Swift has taken several steps to validate the security of the 3SKey Digital solution. Our security assessments indicate that this technology is a sound alternative to physical tokens. This software-only solution is based on a solid crypto foundation and provides adequate key protection. Steps taken include, but are not limited to:
- Third-party security risk assessment, a process that ensures visibility and transparency of the risks involved by our suppliers.
- Cryptographic review of the technology and the protocols by a neutral external party
- Logical Security Assessment to model and understand cyber threats and define relevant security requirements to protect the solution.
- Security Readiness Testing, also known as Logical Intrusion Testing, performed by our Global Security Red Team
Is there any third-party certification of the technology?
The underlying technology is undergoing FIPS 140-2 certification, which evaluates the security of cryptographic modules implemented in hardware, software, or a combination of both. While FIPS 140-2 Level 2 certification is available for software solutions, it's important to note that FIPS 140-2 defines four levels of security, with Level 4 being the highest. This certification provides assurance that cryptographic modules meet industry-accepted standards for protecting keys.
Can you provide more information about FIPS?
The Federal Information Processing Standard 140-2 was originally published in 2001 by the US National Institute of Standards and Technology. The standard’s purpose is to assess the security level of cryptographic modules; namely, their ability to protect the confidentiality and integrity of cryptographic keys. Since then, governmental and private sector organizations around the world have adopted FIPS 140-2 as a practical security benchmark and best practice.
Do digital tokens support multi-factor authentication during activation and day-to-day usage?
Yes, digital tokens do support multi-factor authentication both during the activation process and for day-to-day usage.
The user information collected in the 3SKey portal (email address and phone number) while adding new users to the group, this is used to authenticate the end user during the Activation process of the digital key.
For day-to-day usage of the digital token to sign the transaction, the user needs to authenticate using the PIN that was created during the activation of the key.