Smart Cards: Is SET Safe Without Being Smart?

Officials of two software firms say that the secure electronic transaction (SET) protocol, which relies on digital certificates for authentication and private communications, isn't safe enough. So much so that they beat MasterCard and Visa to the punch with a system that integrates smart cards and readers with SET. "SET is reasonably secure and it offers a lot of advantages over existing systems," says Mark Wolfe, president of Maithean, who's NetPay payment system is integrated with Litronic Inc.'s Datakey SignaSURE CIP smart card system. "That said, smart cards do add additional security."

Last year, Europay, MasterCard and Visa announced that the companies would jointly create a similar specification, though nothing has materialized to date. "We believe that when available and economically feasible, this will be an appropriate solution for many people, as opposed to a purely PC-based, software-based type of implementation," says Steve Mott, svp of electronic commerce, MasterCard. "Maithean and other companies have come up with some interesting developments that we think could further the acceptance of this type of solution in the marketplace."

Maithean and Litronic say several large U.S. banks are beta testing for both internal and retail applications.

There are several clear advantages to using SET-enabled smart cards, namely greater security for the private cryptographic keys used in transactions by keeping the keys from entering the hard drive of the user's computer. This eliminates the remote possibility that a hacker could find a hole in the system and steal a large number of private keys off a file server. Other benefits are portability for the end-user and easier management of the system for either a bank or a corporation that distributes the digital certificates. "With smart cards, the consumer doesn't even have to get on-line to get the certificate,"Wolfe says.

Analysts agree that smart cards and SET are a worthwhile combination. "They're going to ride this waveothe SET electronic payment wave,"says analyst Michael Killen of Killen & Associates. "I would say issuers are definitely going to have a great interest in smart cards that support SET. ...I can't see any real future for smart cards that wouldn't support a SET."

sausner tfn.com