23 CAR § 355-1302 – Software verification

(a) In general, all components involved in EGS gaming that have an effect on the integrity of the operation (hereinafter, critical files) must utilize control program storage media that can be verified via a third-party verification procedure.
(b) This would include EGS, all systems addressed herein, and all associated equipment whether it is internal to the EGS or a component of the system.
(c) The third-party verification may be embedded within the game software provided the requirements in subdivision (e)(3) of this section are met or the component shall have an interface port for a third-party device to authenticate the media.
(d) This integrity check will provide a means for field testing the software to identify and validate the program.
(e)
1. (1) Unless otherwise defined, control program storage media must have the ability to authenticate all critical files including, but not limited to:
  1. (A) Executables;
  2. (B) Data;
  3. (C) Operating system files; and
  4. (D) Other files;
2. (2)
  1. (A) The third-party method utilized must employ a secure hashing algorithm (e.g. MD5 or SHA1) or equivalent.
  2. (B) The algorithm shall use a key or seed of sufficient length and complexity.
  3. (C) The manufacturer should be prepared to demonstrate the algorithm choice to the test laboratory for approval.
  4. (D) This would include downloadable software.
3. (3)
  1. (A) The third-party verification process shall not include any process or security software provided by the operating system manufacturer.
  2. (B) A secondary checking method may use commercially available software by the operating system manufacturer.
  3. (C) The third-party verification tool maybe embedded within the program provided:
(i) The test laboratory shall evaluate and approve the method as required within subdivision (e)(2) of this section; and
1. (ii) The test laboratory is supplied with the tools needed to extract the program from the component to have the ability to perform forensic examinations should the EGS or system yield an invalid signature, at the request of the Arkansas Racing Commission or its personnel.