GLI-19: - Gaming Laboratories International

GLI Standard #19 – Standards for Interactive Gaming Systems (Suppliers) Version 1.0
Final
a) Where sensitive data is being passed over communication lines, such data must be
encrypted. Examples of data that may require encryption are PINs or passwords, account
numbers (including card numbers) and details, encryption keys, player identity details,
funds transfers to and from customer accounts, changes to account details (e.g.: change of
address, change of credit card, change of name, etc.), and game play (i.e.: games played,
amounts bet, amounts won, jackpots won etc.).
b) Data that is not required to be hidden but must be authenticated must use some form of
message authentication technique;
c) Sensitive data must be encrypted on an end-to-end basis (i.e. the data must never appear
on a LAN or WAN in an un-encrypted form). This includes sensitive data transmitted
between computer Gaming Platforms within an operator's premises;
d) Sensitive data transmitted between Gaming Platforms on a switched network within a
single secure data center need not be encrypted;
e) Sensitive data transmitted between Gaming Platforms that are located within separate
secure data centers need not be encrypted if the communications path is physically secure
and cannot be access by unauthorized people;
f) All communications between operator terminals and the Gaming Platform must be
strongly authenticated and strongly encrypted during transmission outside their respective
secure data centers; and
g) Authentication must be available via a Secure Socket Link (SSL) and a security
certificate from an approved organization.
h) Encryption algorithms are to be demonstrably secure against cryptanalytic attacks;
i) Operators must have approved procedures for following up reports of weaknesses in
encryption algorithms used in any part of the Gaming Platform (including, but not limited
to, RNGs, firewalls, authentication systems and operating Gaming Platform). Changes to
encryption algorithms to correct weaknesses must be implemented as soon as practical. If
no such changes are available, the algorithm must be replaced.
7.3.8 Cryptographic Key Management.
a) The minimum width (size) for encryption keys is 112 bits for symmetric algorithms and
1024 bits for public keys.
Chapter Seven: Information Systems Security (ISS) Requirements Page 57
Copyright © 2011 Gaming Laboratories International, LLC
All Rights Reserved.