Transaction security

Secure Electronic Transaction and digital signatures

• Secure Electronic Transaction and digital signatures
• In SET, authentication and nonrepudiation are achieved through digital signatures so the parties in the transaction cannot deny that the transaction occurred. Every time a customer initiates an electronic purchase, an encrypted digital certificate is generated for the transaction's participants. This includes the customer, merchant and financial institution.
• Matching digital keys are also generated, so participants can confirm the certificates of the other party and verify the transaction.
• Using a hashing algorithm, SET signs electronic transactions using the sender's private key. This produces a series of values (message digest) that "sign" a message. The transaction's authenticity can be verified by comparing the transaction message and message digest with the sender's public key.
• The algorithms used in SET ensure that only the party with the corresponding digital key can confirm the transaction, no one else.

Security architecture of Secure Electronic Transaction

• Security architecture of Secure Electronic Transaction
• The SET architecture (designed to support PKI) comprises:
• Digital certificates
• Digital signatures authenticate the merchant's and customer's identities to mitigate the risk of a malicious third party manipulating transaction information. The Certificate Authority (CA) issues digital certificates to the issuing bank. The card issuer and acquirer, which may be a bank or other financial institution, both play an important role in issuing digital certificates.
• Dual signatures
• In the SET scheme, the customer's order information and payment information are encrypted with separate public keys. The order information is encrypted with the merchant's public keys, and the payment information is encrypted with the acquiring bank's public keys.
• This system ensures that the encrypted PI can only be decrypted by the acquiring bank, and the encrypted OI can only be decrypted by the merchant.