This is the first class I'm having on security and one of the concepts discussed is the SET protocol. I've read about it in many different sources and although I came into many unknown terms, after looking into them one by one I think I now have a basic understanding of the protocol.
One of the things I don't get is related to the dual signature. I realized that the dual signature came about in order to prevent merchants from altering order information and charging a customer for different items.
I think I've worked out why the dual signature prevents this from happening. However, I can't see how the dual signature prevents the customer from altering the information. I'm sure I'm missing something.
Here is my point of view.
The customer sends the dual signature to the merchant. The dual signature consists of the order information and the purchase information. There is some decryption and hashing going on but the point is the merchant can only see the order information and the 'bank' is only able to see the purchase information.
However, in every source I've found it is stated that the order information doesn't contain anything about the items or the cost of the order. So, what prevents the customer from including a different price in the purchase information?
The only thing that is common is the transaction ID. From what I've read , this ID is included in both PI and OI. I think that this ID is what tackles the problem. But again, this ID is just a number. It could be the same ID in the OI and PI but the information could still be different in each one.
I think there is more to the transaction ID than I'm aware of. Something that guarantees that the transaction ID refers to a specific order, items, price etc. Who creates this ID?
I hope my 'gap' is clear the way I described it.