Cryptography for Payment Professionals

Although cryptography plays an essential part in most modern solutions, especially in payments, cryptographic algorithms remain a black box for most users of these tools. Just as a sane backend developer does not drill down into low-level disk access details of a server filesystem, payments professionals have enough things to worry about before they ever need to bother themselves with debugging an encrypted value or a message digest. However, at a certain point, an engineer faces the need to identify a problem with a particular algorithm or, perhaps, to create a testing tool that would simulate a counterpart in a protocol that involves encryption.

The world of cryptography has moved on with giant leaps. Available technical standards mention acronyms and link to more standards, some of which are very large while others are not available for free. After finding the standards for the algorithm, the specific mode of operation must also be identified. Most implementations use several cryptographic primitives--for example, key derivation with a block cipher, which produces a secret that is used together with a hash function and a double padding scheme to produce a digital signature of a base64-encoded value. Understanding this requires more sifting through online sources, more reading of platform and library documents, and finally, when some code can be written, there are very few test cases to validate it.

Cryptography for Payment Professionals is intended for technical people, preferably with some background in software engineering, who may need to deal with a cryptographic algorithm in the payments realm. It does not cover the payment technology in-depth, nor does it provide more than a brief overview of some regulations and security standards. Instead, it focuses on the cryptographic aspects of each field it mentions. Highlights include:

• Major cryptographic algorithms and the principles of their operation
• Cryptographic aspects of card-present (e.g., magnetic stripe, EMV) and online (e.g., e-Commerce and 3DS 2.0) transactions
• A detailed description of TDES DUKPT and AES DUKPT protocols, as well as an example implementation and test cases for both

It is best if the reader understands programming, number and string representations in machine memory, and bit operations. Knowledge of C, Python, or Java may make the examples easier to read but this is not mandatory.

Code related to the book is available at the author's GitHub site: https: //github.com/ilya-dubinsky/cfpp

儘管密碼學在大多數現代解決方案中扮演著重要角色，特別是在支付領域，但對於這些工具的大多數用戶來說，密碼算法仍然是一個黑盒子。就像一個明智的後端開發人員不會深入研究服務器文件系統的低級磁盤訪問細節一樣，支付專業人員在需要煩惱調試加密值或消息摘要之前，已經有足夠的事情需要擔心。然而，在某個時候，工程師需要解決特定算法的問題，或者創建一個測試工具，模擬涉及加密的協議中的對應方。

密碼學的世界已經取得了巨大的進步。可用的技術標準提到了縮寫並鏈接到更多的標準，其中一些非常大，而其他一些則不免費提供。在找到算法的標準之後，還必須確定特定的操作模式。大多數實現使用多個密碼原語，例如使用區塊密碼進行密鑰派生，該密鑰與哈希函數和雙重填充方案一起用於生成base64編碼值的數字簽名。理解這一點需要更多的在線資料搜尋，更多的閱讀平台和庫文件，最後，當一些代碼可以編寫時，很少有測試用例可以驗證它。

《支付專業人員的密碼學》適用於技術人員，最好具有一些軟件工程背景，可能需要處理支付領域中的密碼算法。它不深入介紹支付技術，也不提供超過一個簡要概述的法規和安全標準。相反，它專注於提到的每個領域的密碼學方面。重點包括：

- 主要的密碼算法及其操作原則
- 卡片在場（例如磁條、EMV）和在線（例如電子商務和3DS 2.0）交易的密碼學方面
- TDES DUKPT和AES DUKPT協議的詳細描述，以及兩者的示例實現和測試用例

最好讀者了解編程、機器內存中的數字和字符串表示，以及位操作。對C、Python或Java的了解可能會使示例更容易閱讀，但這不是必需的。

與本書相關的代碼可在作者的GitHub網站上找到：https://github.com/ilya-dubinsky/cfpp

Ilya Dubinsky has 20 years of experience in the software industry. He is the VP of CTO Office in Finaro (formerly Credorax), the fastest-growing cross-border acquiring bank in the European Union. Ilya defines technological roadmap of the company, manages its IP portfolio and guides participation in international standard bodies. He also leads the in-house technology research, including in the fields of cryptography, blockchain, and AI. Ilya participates in global groups and bodies, including ISO, The Berlin Group banking industry standards initiative, the Payment Services User Group of Bank of Malta and the Fintech Forum of Bank of Israel. Capitalizing on his years of experience in software development, product and project management in Telecom and Finance industries, Ilya teaches a fin-tech class in Holon Institute of Technology and oversees joint research projects with Tel Aviv University.

Ilya Dubinsky在軟體產業擁有20年的經驗。他是歐盟增長最快的跨境收購銀行Finaro（前身為Credorax）的CTO辦公室副總裁。Ilya定義了公司的技術路線圖，管理其知識產權組合並指導參與國際標準組織。他還領導內部技術研究，包括密碼學、區塊鏈和人工智慧等領域。Ilya參與全球組織和機構，包括ISO、柏林集團銀行業標準倡議、馬爾他銀行支付服務用戶組和以色列銀行金融科技論壇。利用他在電信和金融行業的軟體開發、產品和專案管理方面的多年經驗，Ilya在Holon技術學院教授金融科技課程並監督與特拉維夫大學的聯合研究項目。