Using Set for Secure Electronic Commerce

by Drew, Grady N.

• ISBN13: 9780130997159
• ISBN10: 0130997153
• Format: Paperback
• Copyright: 1999-01-01
• Publisher: Pearson P T R

Summary

The SET protocol supercharges E-commerce by providing a standard, secure way to handle credit card transactions online. This is a complete guide to SET for both developers and merchants who want to use SET technology as effectively and reliably as possible. It covers the entire SET protocol, explaining related concepts such as encryption whenever they're necessary to understand SET. All aspects of a transaction are examined, from beginning to end, with multiple examples. Important extensions and proposed extensions to the SET protocol are described, including new cryptographic options. Finally, there's a detailed guide to available SET software and hardware technologies.

Table of Contents

Foreword	xiii	(4)
Preface	xvii
Audience	xvii	(1)
Organization	xvii	(1)
Conventions Used in this Manual	xviii	(1)
About the Author	xix	(1)
Acknowledgments	xix	(1)
Further Reading	xix
Chapter 1 Introduction to SET	1	(14)
Chapter Roadmap	1	(1)
SET Basics	1	(1)
Electronic Commerce	2	(1)
Announcement of SET	2	(1)
The Participants	2	(1)
Electronic Shopping vs. Traditional Shopping	3	(3)
Shopping With SET	6	(4)
SET Purchase Transaction	8	(2)
Interoperability	10	(1)
Interoperability Testing	11	(1)
SET Messages	11	(2)
Message Wrapper	11	(1)
Abstract Syntax Notation One (ASN.1)--Message Content	11	(1)
Distinguished Encoding Rules--Message Encoding	12	(1)
Object Identifiers	13	(1)
SET Error Processing	13	(2)
Chapter 2 Software Components	15	(14)
Chapter Roadmap	15	(1)
SET Software	15	(1)
The Wallet	16	(3)
How the Wallet Works	17	(1)
The Wallet's Core Functionality	17	(1)
Existing Wallets	18	(1)
The Merchant Server (POS)	19	(4)
How The Merchant Server Works	21	(1)
The Merchant Server's Core Functionality	21	(1)
Existing Merchant Servers	22	(1)
The Certificate Authority	23	(2)
How The Certificate Authority Works	23	(1)
The Certificate Authority's Core Functionality	24	(1)
Existing Certificate Authorities	24	(1)
The Payment Gateway	25	(4)
The Gateway's Core Functionality	26	(1)
Existing Gateways	27	(2)
Chapter 3 Encryption and Cryptography	29	(22)
Chapter Roadmap	29	(1)
Important Terms	29	(1)
Encryption/Decryption Explained	30	(1)
Signing/Verification Explained	30	(2)
Who Performs the Actions?	32	(1)
Secret-Key Cryptography	32	(1)
Data Encryption Standard	33	(1)
Public-Key Cryptography	34	(1)
Encryption Key Pair	35	(1)
Signature Key Pair	35	(1)
Public-Key Cryptography Standards	35	(1)
OAEP	36	(1)
RSA	36	(2)
Signature and Encryption Keys in RSA	37	(1)
Security of RSA	37	(1)
Secure Hash Algorithm 1	38	(1)
Why Use a Combination of RSA and DES?	39	(1)
Elliptic Curve Cryptography	39	(1)
SET's Signing and Encryption Process	39	(4)
Message Digest	39	(1)
Digital Signatures	40	(1)
Dual Signatures	40	(2)
Signed Message	42	(1)
Digital Envelopes	43	(1)
Encryption Process Overview	43	(8)
Chapter 4 Certificates and Certification	51	(50)
Chapter Roadmap	51	(1)
What Is a Certificate?	51	(1)
Certificate Management Architecture	52	(2)
Root Certificate Authority (RCA)	52	(1)
Brand Certificate Authority (BCA)	53	(1)
Geo-Political Certificate Authority (GCA)	53	(1)
Cardholder Certificate Authority (CCA)	53	(1)
Merchant Certificate Authority (MCA)	53	(1)
Payment Gateway Certificate Authority (PCA)	53	(1)
Cardholder Certificates	53	(1)
Merchant Certificates	53	(1)
Hierarchy of Trust	54	(3)
Certificate Validation	55	(2)
Types of Certificates	57	(1)
Certificate Revocation Lists	57	(2)
CRL Format	58	(1)
CRL Distribution	58	(1)
Brand CRL Identifier	59	(2)
BCI Format	59	(1)
BCI Distribution	60	(1)
End Entity Certificate Cancellation/Revocation	61	(1)
Cardholder Certificate Cancellation	61	(1)
Merchant Certificate Cancellation	61	(1)
Payment Gateway Certificate Revocation	61	(1)
Certificate Format	61	(1)
X.509 Certificates	61	(1)
Cardholder Certificates	62	(1)
Merchant Certificates	63	(2)
Payment Gateway Certificates	65	(2)
Cardholder Certificate Authority (CCA) Certificates	67	(1)
Geo-Political Certificate Authority (GCA) Certificates	68	(2)
Brand Certificate Authority (BCA) Certificates	70	(1)
Root Certificate Authority (RCA) Certificates	71	(1)
Thumbprints	72	(1)
Issuing Certificates	73	(25)
Certificate Request Types	73	(1)
Initial Root Certificate Generation and Distribution	74	(1)
Issuing Certificate Authority Certificates	75	(1)
Issuing End Entity Certificates	76	(1)
Message Wrappers	76	(22)
Certificate Inquiry	98	(3)
Chapter 5 SET Payment Messaging	101	(60)
Chapter Roadmap	101	(1)
Common Business Scenarios	101	(3)
Authorize Now and Capture Later	102	(1)
Authorize and Capture Now	103	(1)
Authorize Now and Capture Later With Partial Reversal	103	(1)
Split Shipments	103	(1)
Installment or Recurring Payments	103	(1)
A Typical SET Purchase Transaction	104	(1)
Message Wrappers	105	(2)
Purchase Initialization Request/Response Messages (Optional)	107	(3)
PInitReq	107	(2)
PInitRes	109	(1)
Purchase Order Request/Response Messages	110	(8)
Order Instruction (OI)	111	(1)
Payment Instruction (PI)	111	(1)
PReq	111	(5)
PRes	116	(2)
Cardholders without Certificates	118	(1)
Inquiry Request/Response Messages (Optional)	118	(1)
InqReq	119	(1)
InqRes	119	(1)
Authorization Request/Response Messages	119	(9)
Split Shipments	120	(1)
AuthReq	120	(4)
Referral Processing	124	(1)
AuthRes	125	(3)
Authorization Reversal Request/Response (Optional)	128	(5)
AuthRevReq	129	(2)
AuthRevRes	131	(2)
Capture Request/Response Messages (Optional)	133	(5)
CapToken	133	(1)
CapReq	134	(2)
CapRes	136	(2)
Capture Reversal Request/Response and Credit Request/Response Data	138	(3)
CapRevOrCredReqData	138	(2)
CapRevOrCredResData	140	(1)
Capture Reversal Request/Response Messages (Optional)	141	(2)
CapRevReq	141	(1)
CapRevRes	142	(1)
Credit Request/Response (Optional)	143	(3)
CredReq	144	(1)
CredRes	145	(1)
Credit Reversal Request/Response (Optional)	146	(2)
CredRevReq	146	(1)
CredRevRes	147	(1)
Transaction Phases and Reversals	148	(9)
Batch Administration	149	(1)
Batch Administration Request Message	150	(5)
BatchAdminRes	155	(2)
Payment Gateway Certificate Request/Response	157	(4)
PCertReq	158	(1)
PCertRes	159	(2)
Chapter 6 SET Protocol Extensions and Additions	161	(20)
Chapter Roadmap	161	(1)
SET Debit Architecture	161	(1)
Private Environments	162	(1)
Public Environments	162	(1)
Personal Identification Number-Based (PIN) Debit	162	(2)
PIN Entry and Encryption	163	(1)
How PIN-Based Debit Works	163	(1)
Integrated Circuit Cards (Smart Cards) and Security Tokens	164	(3)
Integrated Circuit Cards Explained	165	(1)
ICC Proposed Architecture	165	(2)
Example ICC Transaction	167	(1)
Algorithm Independence	167	(5)
Elliptic Curve Enabled Secure Electronic Transactions (ECSET)	168	(1)
Elliptic Curves Explained	168	(1)
Elliptic Curve Digital Signature Algorithm	169	(2)
Security of ECC	171	(1)
ECSET Pilots	171	(1)
Japanese Payment Options (JPO)	172	(6)
Payment Modes	173	(1)
JPO Mode Parameters	174	(4)
SET 2.0 Proposed Additions	178	(3)
Functionality Enhancements	178	(1)
Encryption Alternatives	178	(1)
Certificate Enhancements	178	(1)
Order Enhancements	179	(1)
Payment Enhancements	179	(1)
Transaction Processing Enhancements	179	(2)
Chapter 7 SET Standards and Compliance	181	(10)
Chapter Roadmap	181	(3)
What is SETCo?	181	(2)
Membership in SETCo	182	(1)
SETCo Advisors Panels	183	(1)
The SETMark	184	(1)
Licensing the SETMark	184	(1)
SET Compliance Testing	184	(1)
SET Compliance Testing Enrollment	184	(1)
Compliance Testing	185	(2)
Tested Components	187	(1)
SET Checklist	187	(1)
SET Tests	187	(2)
Vendor Status Matrix	189	(1)
Tenth Mountain Systems, Inc.	190	(1)
Appendix A SET ASN.1 Code	191	(60)
Appendix B JPO ASN.1 Code	251	(6)
Appendix C PKCS #7 Formats	257	(4)
SignedData Type	257	(1)
EnvelopedData	258	(1)
EncryptedData	259	(1)
DigestedData	260	(1)
Index	261