SET INTRO
SET is an open encryption and security specification designed to protect credit card
transactions on the Internet.
SET is a set of security protocols and formats that enables users to employ the
existing credit card payment infrastructure on an open network, such as the Internet,
in a secure fashion, by providing:
a secure communications channel among all parties involved in a transaction
trust through the use of X.509v3 digital certificates
privacy because the information is only available to parties in a transaction when and
where necessary.
SET COMPONENTS
Cardholder: purchasers interact with merchants from personal computers over the
Internet
Merchant: a person or organization that has goods or services to sell to the
cardholder
Issuer: a financial institution, such as a bank, that provides the cardholder with the
payment card.
Acquirer: a financial institution that establishes an account with a merchant and
processes payment card authorizations and payments
Payment gateway: a function operated by the acquirer or a designated third party that
processes merchant payment messages
Certification authority (CA): an entity that is trusted to issue X.509v3 public-key
certificates for cardholders, merchants, and payment gateways
SET Transaction
[Link] opens account
[Link] receives a certificate
[Link] have their own certificates
[Link] places an order
[Link] is verified
[Link] and payment are sent
[Link] requests payment authorization
[Link] confirms order
[Link] provides goods or service
10. merchant requests payment
DUAL SIGN
Purpose: Links Order Information (OI) and Payment Information (PI) so they stay
connected, but securely hidden from the wrong party (merchant doesn’t see PI, bank
doesn’t see OI).
Process: Customer hashes PI and OI, combines the hashes, hashes again, and signs with
their private key to create the dual signature.
Formula:
👉 DS = E(PRc, H(H(PI) || H(OI)))
(Encrypt the hash of combined PI and OI hashes using customer’s private key)
SET PURCHASE
The purchase request exchange consists of four messages: Initiate Request, Initiate
Response, Purchase Request, and Purchase Response.
In order to send SET messages to the merchant, the cardholder must have a copy of the
certificates of the merchant and the payment gateway.
The customer requests the certificates in the Initiate Request message, sent to the
merchant. The merchant generates a response and signs it with its private signature key.
The cardholder verifies the merchant and gateway certificates by means of their
respective CA signatures and then creates the OI and PI.
Next, the cardholder prepares the Purchase Request message with Purchase-related
information & Order-related information.
The Purchase Response message includes a response block that acknowledges the order
and references the corresponding transaction number.
PURCHASE REQUEST CUSTOMER
Payment Information (PI), Dual Signature, and OI Message Digest (OIMD)
• Sent to the merchant, who will forward the PI to the payment gateway.
• PI includes card details (encrypted for the bank), and OIMD ensures integrity
of order.
Order Information (OI), Dual Signature, and PI Message Digest (PIMD)
• Used by the merchant to process the order.
• PIMD ensures the merchant can validate the link between OI and PI.
Cardholder Certificate
• Contains the customer’s public key, used to verify the dual signature.
PURCHASE REQUEST MERCHANT
When the merchant receives the Purchase Request message, the actions listed are performed.
The Purchase Response message includes a response block that acknowledges the order and
references the corresponding transaction number.
This block is signed by the merchant using its private signature [Link] block and its
signature are sent to the customer, along with the merchant’s signature certificate.
PAYMENT GATEWAY AUTHORIZATION
Verify all digital certificates
Decrypt digital envelope of payment block
Verify dual signature on payment block
Match transaction ID from merchant and PI
Decrypt digital envelope of authorization block
Verify merchant’s signature on authorization block
Request authorization from issuer
Send authorization response to merchant