Thank you for posting the actual technical pdf, that was interesting reading
> Certificate-Based Authentication
Heh, so I can look forward to the biennial banking outage as they forget to renew their certs :-D
But in seriousness, I have some experience with x509 auth from the early days of kubernetes using it and unless the system has some robust CRL mechanisms I look forward to knowing how such a scheme will deauthorize users
Interestingly, they also seem to be doing belt-and-suspenders since the messages themselves are signed with the private key of the institution, which appears to be registered out of band from the system itself
Transactions take a few seconds. They must finish within 20 seconds or they time out, and they're expected to take much less time. Here's a technical overview.[2]
The bank to Fed to bank API uses IBM MQ and ISO 20022. These are a bit dated but widely used in the financial sector. Down at the bottom, it's XML.
[1] https://www.frbservices.org/resources/fees/fednow-2023
[2] https://explore.fednow.org/resources/technical-overview-guid...