Secure Data Flow & Implementation Steps

Secure-data requests use a client-generated AES-256 session key, the Payblr RSA-4096 Wrap Public Key, and an encrypted response that the client application decrypts using the original session key.

1

Generate AES session key

The client application or device generates a new AES-256 session key for the request.

2

Keep original key locally

The original AES session key must remain on the client side. It is required later to decrypt the response.

3

Encrypt AES session key

The client encrypts the AES session key using the Payblr RSA-4096 Wrap Public Key.

4

Use RSA OAEP padding

The AES session key must be encrypted using RSA OAEP padding according to the current secure-data configuration.

5

Base64 encode encrypted key

The encrypted AES key is Base64-encoded before being included in the secure-data request body as key.

6

Send Get Card Data request

Send the secure-data request using the card’s publicToken.

POST /thr/thredd/cards/{publicToken}/encrypted

  • paddingMode: PKCS2_2
  • encryptionKeyLength: Rsa4096
  • hashingAlgorithm: Sha256
7

Payblr decrypts session key

Payblr decrypts the AES session key using its private key.

8

Receive encrypted response

Payblr uses the AES session key to encrypt the requested card data and returns the encrypted response.

  • iv
  • encryptedPayload
  • signatureOfPayloadAndIv
9

Verify response signature

Verify the response signature by validating the encrypted payload and iv using the applicable Payblr Signing Public Key.

10

Decrypt response

The client application or device decrypts encryptedPayload using the original AES session key and returned iv.