Integration Guide

Website Payments Standard Integration Guide September 2008 259
Securing Your Website Payments Standard Buttons
Protecting Payment Buttons by Using Encrypted Website Payments
6
illustrates the sequence of actions that occur with payment buttons protected by using
Encrypted Website Payments.
Public Key Encryption Used by Encrypted Website Payments
Encrypted Website Payments uses public key encryption, or asymmetric cryptography, which
provides security and convenience by allowing senders and receivers of encrypted
communication to exchange public keys to unlock each others messages. The fundamental
aspects of public key encryption are:
z Public keys – Public keys are created by receivers and are given to senders before they
encrypt and send information. Public certificates comprise a public key and identity
information, such as the originator of the key and an expiry date. Public certificates can be
signed by certificate authorities, who guarantee that public certificates and their public
keys belong to the named entities.
You and PayPal exchange each others’ public certificates.
TABLE 6.1 How Encrypted Website Payments Works
Website Actions Payer Actions PayPal Actions
Generate a public key for the website, upload it
to PayPal, and download the PayPal public
certificate to the website.
N OTE: Do this action only once, when you
first integrate Website Payments
Standard with your website.
Generate HTML code for a payment button.
Encrypt the generated code by using the
PayPal public key and then signing the
encrypted code with the website’s private key.
Publish the signed, encrypted HTML code for
the payment button to the website.
Click the published PayPal
payment button.
Check the authenticity of the data
by using the website’s public key,
which was previously uploaded
to PayPal.
Decrypt the protected button
code by using the PayPal private
key.
Redirect the payer’s browser to
the appropriate PayPal checkout
experience, as specified in the
HTML variables of the decrypted
button code.