Q16Information Security Systems
Question
Outline the Secure Electronic Transaction (SET) protocol for e-commerce.
Answer
A concise outline of the SET Protocol architecture. Explains how Dual Signatures and public-key cryptography are mathematically executed to shield credit card data from merchants while authenticating all parties involved.
Engineered in the 1990s by a massive consortium (Visa, Mastercard, IBM), SET is a highly complex, mathematically rigorous cryptographic architecture designed specifically to secure E-commerce credit card transactions.
Architectural Objectives
Standard SSL/TLS only protects data in transit. SET was engineered to provide absolute mathematical authentication of all parties (Customer, Merchant, and Bank) using X.509 Digital Certificates, and crucially, to guarantee that the Merchant NEVER physically possesses the customer's credit card number.
The Dual Signature Mathematics
The core engine of SET is the Dual Signature. The customer software generates two distinct data packets:
- 1. Order Information (OI): The items being purchased. Encrypted strictly for the Merchant.
- 2. Payment Information (PI): The raw credit card data. Violently encrypted using the Bank's Public Key.
- 3. Both packets are mathematically hashed together and signed with the Customer's Private Key (The Dual Signature).
The Merchant receives the entire bundle. They can decrypt the OI to ship the product, but they are mathematically incapable of decrypting the PI. They forward the PI to the Bank. The Bank decrypts the PI, verifies the Dual Signature, and authorizes the payment, completely isolating the Merchant from catastrophic credit card data breaches.