Contactless Payments on Mobile Phones
Mobile phones are increasingly used as contactless payment terminals. Developing payment software for general-purpose phones is significantly cheaper and more convenient than creating specialized hardware for traditional point-of-sale systems. The danger lies in that software-based security systems are easier to reverse engineer than special-purpose hardware. By extracting the internal cryptographic keys, an adversary can collect sensitive data, steal money, or disrupt business operations. The industry-standard approach to mitigating key extraction risks on general-purpose devices is white-box cryptography. In fact, the Payment Card Industry Security Standards Council (PCI SSC) requires all vendors to employ white-box cryptography for mobile contactless payment applications to protect keys. zKeyBox is a white-box cryptography library, which means that by using it in a software-based payment system you are able to satisfy the PCI SSC security and testing requirements and ensure strong security.
it becomes challenging for attackers to locate, modify, and extract cryptographic keys even when the device is under the attacker’s control.
白盒密码技术(White-Box Cryptography)是能够抵抗白盒攻击的加解密方法,以实现对密钥的安全保护。
白盒密码的一般构造方法通常基于标准密码算法的白盒化策略,通过将标准密码算法中的密钥与算法实现融合和混淆,使得密钥与加密程序不可区分,即使攻击者掌握了对白盒密码系统的控制能力,也无法进一步获取原始的密钥信息。
白盒攻击是指攻击者通过对一个系统的内部结构和工作原理有详细了解的情况下,对其进行攻击的一种方式。