Secure Electronic Transaction (SET) University of Windsor Shervin Erfani Electrical and Computer Engineering Department University of Windsor December 2003 Reference: Chapter 7 of the Text, pp. 234-247 December 2, 2003 ECE Dept. – University of Windsor

ECE Dept. – University of Windsor Overview of SET What is SET Protocol? What is the Goal of SET? How does it work? What does SET provide? December 2, 2003 ECE Dept. – University of Windsor

ECE Dept. – University of Windsor SET Protocol The current version, SETv1, is a set of security protocol and formats to establish credit card transactions on the Internet. Provides a secure communication channel among all parties involved in an E-commerce transaction Provides trust by the use of X.509v3 digital certificates Ensures privacy December 2, 2003 ECE Dept. – University of Windsor

Secure Electronic Commerce Component December 2, 2003 ECE Dept. – University of Windsor

Participants in the SET System CARDHOLDER – Consumers and corporate purchasers using the Internet to Merchants MERCHANT – An organization that offers goods or services over the Internet ISSUER – A financial institution or bank providing the cardholder with the payment card ACQUIRER – A financial institution that processes payment card authorizations and payments on behalf of the merchant PAYMENT GATEWAT – A security interface function to process merchant payment messages for the Acquirer CERTIFICATION AUTHORITY (CA) – A trusted entity 3rd party issuing X.509v3 public-key certificates for cardholder, merchants, and payment gateways. December 2, 2003 ECE Dept. – University of Windsor

SET Encryption Overview December 2, 2003 ECE Dept. – University of Windsor

SET Encryption Process Sender’s Functions Step 1 – Alice generate MD of the plaintext, using a one-way hash  Data Integrity Step 2 – Alice encrypts the generated MD using her private key  Digital Signature Step 3 – Alice encrypts the plaintext, MD, and her certificate, using a generated session key (i.e., the hypertext)  Privacy Step 4 – Alice encrypts her generated symmetric session key with Bob’s public key ( i.e., a Digital Envelope)  Confidentiality Step 5 – Alice sends the hypertext along with the Digital Envelope to Bob December 2, 2003 ECE Dept. – University of Windsor

SET Encryption Process (Cont.) Receiver’s Functions Step 6 – Receiving Alice’s message, Bob decrypts the Digital Envelope, using his private key to retrieve the session key  Decrypt Digital Envelope Step 7 – Bob decrypts the decrypted message using the session key  Decryption Step 8 – Bob decrypts the digital signature, using Alice’s public key  Recover the MD Step 9 – Bob runs the plaintext through the same one-way hash to produce a new MD for the received plaintext  Integrity Check Step 10 – Bob compares the generated MD with the received MD for Integrity Check; otherwise, he discards the message and notifies Alice  ACk or NAK December 2, 2003 ECE Dept. – University of Windsor

ECE Dept. – University of Windsor Certificate Issuance SET certificates are verified through a hierarchy of trust. The public signature key of the root is known to all SET participants. The root key will be distributed in a self-signed certificate. A party can confirm its valid root key by sending an initiate request to the CA that has the root key. A replacement key for the root key is stored securely until it is needed. December 2, 2003 ECE Dept. – University of Windsor

SET Payment Processing SET defines a variety of transaction protocols to securely conduct E-Commerce: Cardholder Registration Merchant Registration Purchase Request Payment Authorization Payment Capture December 2, 2003 ECE Dept. – University of Windsor

Cardholder Registration December 2, 2003 ECE Dept. – University of Windsor

Merchant Registration December 2, 2003 ECE Dept. – University of Windsor

ECE Dept. – University of Windsor Purchase Request December 2, 2003 ECE Dept. – University of Windsor

Payment Authorization December 2, 2003 ECE Dept. – University of Windsor

ECE Dept. – University of Windsor Payment Capture December 2, 2003 ECE Dept. – University of Windsor

ECE Dept. – University of Windsor What Does SET Provide? Confidentiality of Information: Conventional encryption such as DES is used for passing Cardholder account and payment information. Integrity of Data: RSA digital signature using SHA-1 hash codes are used. Cardholder Account Authentication: using X.509v3 digital certificates with RSA signatures. Merchant Authentication: SET uses X.509v3 digital certificates with RSA signatures December 2, 2003 ECE Dept. – University of Windsor