Abstract
After the internet first came to fruition, the growth rate of internet users is prodigious. Before 1995, the internet was used only for technical or military research. After 1995, the internet was applied to business. When 1999, there were more than 1500 million users in the world, and by estimate, there will be 2000 million users in 2000. Not only the number of users but also the market is very enormous. It is believed that the price of merchandise transacted via the internet is more than 100 billions, and the scale of E-commerce market is greater than trillion dollars. Many marketanalysts anticipate that the two star industries are internet and communications in early 2000s, and these two are relative to E-commerce. So this thesis will discuss some relative subjects and will begin with E-commerce. In recent years, E-commerce does weigh with many companies in development because of its unfathomable market. Since E-commerce gets involved with money transaction, it is very important to ensure security and privacy. Security and privacy for E-commerce is building on Public Key Infrastructure (PKI) nowadays. Specifically, the information exchanged through the internet is protected from attack by cryptography. Actually, contemporary cryptography has been used for more than 20 years, and its relative theorems are also very complete. The main goal of this thesis is applying cryptographic skills to E-commerce, and then designing a secure and practicable payment system. We can foresee that any merchant who wants to profit from E-commerce has to be equipped with a reliable payment system. Now, there is only one choose for secure payment system. It is Secure Electronic Transaction (SET). SET defines the transaction rules between cardholders, merchants, banks and Certificate Authority (CA). The Public Key Infrastructure for SET is RSA, DES for encryption and DSA for signature. Although SET has been used and famous for payment, its application is only to the internet, but useless for wireless communication. For this reason, this thesis tries to upgrade the Public Key Infrastructure and program implementation of SET specification, and makes it more applicable to wireless communication. Because DES is belong to private key cryptosystem, the encryption key which is the same as decryption key can not be published. Therefore, it is difficult to manage a lot of key. And DES has been used more than 20 years, it cannot insure that the 64-bit key will not be broken. According to the limit of DES, the selection for E-commerce is public key cryptosystem. The most celebrated toolkit today is RSA. However the private key for RSA has to be 512 bits at least, it can be implement only by software. For hardware or chip with limited memory and wireless communication device with finite bandwidth, RSA is imperfect and inefficient. For instance, SET uses RSA as Public Key Infrastructure and DES as session key, it is not advisable to put SET into smart card or mobile phone as security conception without modification. Fortunately the evolution of ECC provides a solution recently. It is currently believed that 160-bit key of ECC can make the same security level as 1024-bit key of RSA. With all of the efficiencies in place, ECC is roughly 10 times faster than RSA. These advantages can well compensate for lack of SET. This thesis designs a payment system based on ECC and implements it for the request of wireless communication or smart card. Except for the discussion about cryptography and payment, the later chapter also makes the market-analysis of Public Key Infrastructure. Usually theses about electrical engineering rarely correspond with commercialization and feasibility. I hope that my proposed system is equally meritorious for theory and application, so I particularly end in market-analysis. Of course, the applications of PKI to E-commerce are well-rounded. I will plan the future work if there is something inadequate.