Repository navigation
Questions about unattended EBICS 3.0 downloads for ZKB #54
Description
Hi, thanks for maintaining this project.
I’m helping a business download ZKB statements (camt.053 v08) and PDF bank documents over EBICS 3.0. We only need downloads, not payments. I’m evaluating the current master at 9e45631.
I’m not an EBICS expert. An AI-assisted review raised a few concerns worth checking before we run this unattended:
- Private keys saved outside the password-protected keystore — I see this is already reported in (Copy of) private key is stored unencrypted #38.
- How bank keys and incoming bank responses are verified.
- Downloads overwriting an existing file before the new data is checked.
- How to recover safely if the connection drops around the download acknowledgement.
We checked the code paths and reproduced some behaviors locally, without contacting a bank. We may still be missing context about the intended usage.
Would you be open to findings from an AI-assisted review? Happy to share more details and contribute a focused PR if useful. For the security-related details, is there a private reporting channel you’d prefer?
Activity
uwemaurer commentedon Sep 10, 2026
Yes, I am looking forward to your PR and findings in general. We also use it with ZKB.
I agree the way the configuration is saved currently is bad. It is saving everying using java serialization (including the keys). My plan was to switch to regular JSON or XML files for the settings (without the keys) and store the keys in standard file formats (PKCS#12).
It is cleaner and better to deal with than java serialization. However in the end it is the same data just stored differently, so these files need to be kept private.