Merchant Issuer Acquirer Payment gateway Certification authority How it works Both cardholders and merchants must register with the CA (certificate authority) first, before they can buy or sell on the Internet. Once registration is done, cardholder and merchant can start to do transactions, which involve nine basic steps in this protocol, which is simplified. Customer browses the website and decides on what to purchase Customer sends order and payment information, which includes two parts in one message: a. Purchase order – this part is for merchant b. Card information – this part is for merchant’s bank only. Merchant forwards card information to their bank Merchant’s bank checks with the issuer for payment authorization Issuer sends authorization to the merchant’s bank Merchant’s bank sends authorization to the merchant Merchant completes the order and sends confirmation to the customer Merchant captures the transaction from their bank Issuer prints credit card bill (invoice) to the customer Dual signature As described in : The message digest (MD) of the OI and the PI are independently calculated by the customer. These are concatenated and another MD is calculated from this. Finally, the dual signature is created by encrypting the MD with the customer's secret key. The dual signature is sent to both the merchant and the bank. The protocol arranges for the merchant to see the MD of the PI without seeing the PI itself, and the bank sees the MD of the OI but not the OI itself. The dual signature can be verified using the MD of the OI or PI, without requiring either the OI or PI. Privacy is preserved as the MD can't be reversed, which would reveal the contents of the OI or PI. Note References Credit card terminology Financial routing standards