Integration Guide

Table Of Contents
PayPal Payments Standard Integration Guide June 2012 343
Securing Your PayPal Payments Standard Buttons
Protecting Payment Buttons by Using Encrypted Website Payments
8
How Encrypted Website Payments Helps Prevent Fraudulent Payments
Using Encrypted Website Payments helps secure payment buttons that you generate or write
manually. Encrypted Website Payments protects the HTML button code that contains pricing
information by encrypting it. HTML button code that you protect by using Encrypted Website
Payments cannot be altered by malicious third parties to create fraudulent payments.
Encrypted Website Payments relies on standard public key encryption for protection. With
public and private keys, you can dynamically generate HTML code for payment buttons and
encrypt the payment details before displaying the buttons on your website. The below table
illustrates the sequence of actions that occur with payment buttons protected by using
Encrypted Website Payments.
How Encrypted Website Payments Works
Public Key Encryption Used by Encrypted Website Payments
Encrypted Website Payments uses public key encryption, or asymmetric cryptography, which
provides security and convenience by allowing senders and receivers of encrypted
communication to exchange public keys to unlock each others messages. The fundamental
aspects of public key encryption are:
Website Actions Payer Actions PayPal Actions
Generate a public key for the website,
upload it to PayPal, and download the
PayPal public certificate to the website.
NOTE: Do this action only once, when you
first integrate PayPal Payments
Standard with your website.
Generate HTML code for a payment
button.
Encrypt the generated code by using the
PayPal public key and then signing the
encrypted code with the website’s private
key.
Publish the signed, encrypted HTML code
for the payment button to the website.
Click the published PayPal
payment button.
Check the authenticity of the data by
using the website’s public key, which
was previously uploaded to PayPal.
Decrypt the protected button code by
using the PayPal private key.
Redirect the payers browser to the
appropriate PayPal checkout
experience, as specified in the HTML
variables of the decrypted button
code.