Regulations Governing the Standards for Information System and Security Management of Electronic Payment Institutions Article 9

The security design of confidentiality, integrity, authentication, non-duplication, and non-repudiation referred to in the preceding article shall meet the following requirements:1. Confidentiality: Adopt algorithm at or above 3DES 112bits, AES 128bits, RSA 2048bits, ECC 256bits, or other algorithms with same or greater security strength to undergo encryption.2. Integrity: Adopt algorithm at or above SHA1, 3DES 112bits, AES 128bits, RSA 2048bits, ECC 256bits, or other algorithms with same or greater security strength for message authentication code (MAC) or encryption.3. Authentication: Adopt algorithm at or above 3DES 112bits, AES 128bits, RSA 2048bits, ECC 256bits, or other algorithms with same or greater security strength for message authentication code (MAC), encryption or digital signature.4. Non-duplication: Adopt serial numbers, one-time random numbers, or timestamps.5. Non-repudiation: Adopt algorithm at or above SHA256 or other algorithms with same or greater security strength for message authentication code (MAC), and adopt algorithm at or above RSA 2048bits, ECC 256bits or other algorithms with same or greater security strength for digital signature.