UK mobile application developer Masabi has launched a lightweight Java security package for mobile phones in a bid to make m-commerce applications more user-friendly and secure.

Masabi's EncryptME Java mobile security component is the only such application to use officially validated implementations of RSA and AES encryption, according to BT, which tested the technology. The application provides RSA with PKCS Padding for keys up to 4,096 bits, AES with keys up to 256 bits, and an approved secure random number generator. Ed Howson, co-Founder of Masabi, told El Reg the technology provided web commerce-level security on the vast majority of existing handsets.

The technology, which has been validated by BT, occupies a footprint of only 3K, meaning it can run on any mobile phone that can run Java. Its small footprint leaves room for developers to squeeze in rich graphics and a friendly interface to new or existing mobile payment or messaging applications.

Using a single SMS message, or a few bytes of GPRS data, EncryptME can set up a secure session and sign up a new user, a new credit card, and make a transaction. The software is available in multiple currencies and languages and targeted towards applications including mobile banking and transport.

Masabi plans to run a pilot of the technology later this summer with train ticketing technology specialist YourRail, enabling transport tickets to be securely bought using mobile phone handsets. YourRail already provides a mobile ticketing system for Chiltern Railways that allows ticket purchases to be made on a PC.

By extending their system with EncryptME, new customers can sign up and purchase a ticket straight away from their mobile without the need for pre-registration or use of a PC. ®

Related stories

Secure Java coding course aims to push best practice (23 November 2007)
http://www.theregister.co.uk/2007/11/23/secure_java_course/
Windows random number generator is so not random (13 November 2007)
http://www.theregister.co.uk/2007/11/13/windows_random_number_gen_flawed/
Chiltern Railways completes mobile phone ticketing circle (22 October 2007)
http://www.theregister.co.uk/2007/10/22/secure_tickets/
Mobile wallet opens (4 September 2007)
http://www.theregister.co.uk/2007/09/04/payforit_launch/
Visa takes a punt on m-payments (30 March 2007)
http://www.theregister.co.uk/2007/03/30/visa_m-payments/
PlayTech goes mobile with Masabi (25 January 2007)
http://www.theregister.co.uk/2007/01/25/playtech_masabi/
Banks warned over m-commerce security peril (22 July 2005)
http://www.theregister.co.uk/2005/07/22/m-banking_security_risks/
Simpay halts mobile commerce project (27 June 2005)
http://www.theregister.co.uk/2005/06/27/simpay_halts_project/
m-commerce security risks exposed (1 June 2005)
http://www.theregister.co.uk/2005/06/01/dial_m_for_m-commerce/
eBay UK goes mobile (11 August 2004)
http://www.theregister.co.uk/2004/08/11/ebay_anywhere/
Crypto booster tech for mobile phones (28 January 2004)
http://www.theregister.co.uk/2004/01/28/crypto_booster_tech_for_mobile/
Abbey National bins WAP, Digital TV banking (5 June 2003)
http://www.theregister.co.uk/2003/06/05/abbey_national_bins_wap_digital/
UK to test mobile digital signatures (15 March 2001)
http://www.theregister.co.uk/2001/03/15/uk_to_test_mobile_digital/