Doing an integration with an online payment provider. Payment provider will be making a web request to my server to provide some information about the basket content. On my end there's no payment processing involved, I only need to be able to capture the basket information along with the merchant ID. The payment provider will be acting on behalf of multiple eCommerce merchants in capturing and processing credit card details.
- I need to be able to verify that a request has come from a specific merchant
- I need to be able to verify that the message hasn't been tampered with
- I need to be able to validate the client time stamp
Few alternatives that I have.
- Payment provider to generates a HMAC signature (SHA-256). (With a pre-agreed signing key per Merchant) StringToSign = MerchantId + BasketInfo + Timestamp
- Payment provider sends the above signature along with MerchantId, BasketInfo and Timestamp in clear text in a HTTP post.
- Signature is verified on my end
Public key encryption along with symmetric encryption
- SymmetricEncryptedText = AES_Encryption( BasketInfo + Timestamp) using a pre-agreed symmetric encryption key
- TextToPublicKeyEncrypt = MerchantId + SymmetricEncryptedText
- FinalEncryptedText = Public Key Encryption using my public key (TextToPublicKeyEncrypt ) FinalEncryptedText is sent in HTTP Post
- On my end, FinalEncryptedText is decrypted using my private key. This gives me access to MerchantId + SymmetricEncryptedText
- Decrypt SymmetricEncryptedText using MerchantId specific symmetric key
Symmetric Key Encryption
- StringToEncrypt = BasketInfo + Timestamp
- EncryptedText = AES Encryption (StringToEncrypt )
- MerchantId and EncryptedText is sent by payment provider in HTTP Post
- EncryptedText is decrypted using the MerchantId specific symmetric key
Appreciate you could shed some light on evaluating these options (Or any other suggestions) All communication is using SSL/TLS. So a man in the middle attack can be ruled out.
In my view, Option #1 and #3 are of the same nature. In Option #2, due to public key encryption, MerchantId is not shown on plaintext on user's HTML source. But does it really make #2 more secure due to MerchantId not being visible on user's HTML source?
Apologies in advance for the lengthy question. Let me know if any clarifications required.