Time Stamping Protocol (TSP) and Secure Electronic Transaction (SET)

In Unit 3, TSP and SET are two specialized cryptographic protocols designed to solve real-world legal and financial problems:

1. TSP (Time Stamping Protocol): Proves when a digital document was created or signed.
2. SET (Secure Electronic Transaction): Protects credit/debit card payments during online shopping.

Part 1: Time Stamping Protocol (TSP)

Why Do We Need a Trusted Timestamp?

Suppose an inventor creates a new software design on 1st January, or a company signs a digital contract before a deadline. If someone just checks the clock on their own Windows laptop, anyone can easily change their laptop’s date and time in settings to fake when the file was created!

To prevent date manipulation, we use the Time Stamping Protocol (TSP) (defined in RFC 3161).

What is TSP? (In Simple Words)

The Time Stamping Protocol (TSP) is a cryptographic protocol that uses a trusted third party called a Time Stamping Authority (TSA) to issue an unforgeable digital proof (a Timestamp Token) proving that a specific file or document existed at an exact, verified date and time and has not been changed since!

How Time Stamping Protocol (TSP) Works Step-by-Step:

1. Step 1 (Hashing the Document): The user runs their document through a hash function (like SHA-256) to create a short digital fingerprint (Hash).
2. Step 2 (Sending to TSA): The user sends only the Hash (not the secret document itself) to the Time Stamping Authority (TSA).
3. Step 3 (Adding Trusted Time & Digital Signature): The TSA combines the document’s Hash with the exact current time from a tamper-proof Atomic Clock and signs them together using the TSA’s Private Key.
4. Step 4 (Verification): Anyone can later verify the Timestamp Token using the TSA’s Public Key to prove in court that the document existed at that exact second!

Part 2: Secure Electronic Transaction (SET)

What is SET? (In Simple Words)

Secure Electronic Transaction (SET) is a security protocol jointly developed in 1996 by Visa and MasterCard (along with Microsoft, IBM, and Netscape) specifically to secure online credit and debit card payments over the internet.

Why Was SET Created? (The Problem with Normal Online Shopping)

When you buy shoes on an e-commerce website using a credit card:

• If you simply send your Credit Card number to the Merchant (Shopkeeper), a dishonest shopkeeper or a hacker who hacks the shop’s database can steal your card number!
• On the other hand, your Bank only needs to know the payment amount—your bank does not need to know what items (shoes, medicines, books) you bought!

SET solves both problems simultaneously!

1. It hides your Credit Card details from the Merchant (only the Bank can read your card number).
2. It hides your Shopping Order details from the Bank (only the Merchant can read what items you ordered).

Key Participants in a SET Transaction

The Heart of SET: “Dual Signature” (Most Important Exam Concept!)

How does SET link your Shopping Order and your Payment Card Info together without letting the Merchant see your card or the Bank see your items? It uses an ingenious invention called a Dual Signature!

The customer’s computer divides the purchase into two parts:

1. OI (Order Information): List of items bought and price — meant ONLY for the Merchant.
2. PI (Payment Information): Credit card number, expiry, and amount — meant ONLY for the Bank.

How the Dual Signature is Created:

1. Compute the Hash of the Order Info: H(OI)
2. Compute the Hash of the Payment Info: H(PI)
3. Join both hashes together and hash them again, then sign with the Customer’s Private Key (PRc):

   Formula: Dual Signature (DS) = EPRc\Big(H\big(H(OI) \parallel H(PI)\big)\Big)

How Verification Works:

• What the Merchant Receives: The actual OI (encrypted for the merchant) + only the Hash H(PI) (NOT the actual credit card details!). The merchant can verify the Dual Signature without ever seeing the credit card number!
• What the Bank Receives: The actual PI (encrypted with the Bank’s Public Key) + only the Hash H(OI) (NOT the list of items bought!). The bank can verify the Dual Signature and approve the money transfer without knowing what items the customer bought!

💡 DAVV Exam Preparation Tips

5-Mark / 10-Mark Question: “Explain Time Stamping Protocol (TSP) and Secure Electronic Transaction (SET). What is a Dual Signature in SET?”

• For TSP, draw the 4-step flow (Hash Document → Send to TSA → TSA adds Atomic Time + Private Key Signature → Timestamp Token).
• For SET, list the 6 participants (Cardholder, Merchant, Issuer, Acquirer, Payment Gateway, CA) and explain the Dual Signature (OI for Merchant, PI for Bank).