Experimenting with Electronic Commerce on the Palm Pilot

Experimenting with Electronic Commerce on the Palm. Pilot Neil Daswani, Dan Boneh, Stanford University 1

Trade-offs z. Vs. Smart. Cards yno tamper resistance yno cryptographic accelerators ydirect line of communication with user ymore processing power ymore memory 2

Trade-offs z. Vs. Desktops yless memory yless processing power yportable 3

Cryptographic Primitives DES, SHA-1, RSA figures obtained with SSLeay * ECC-DSA figures obtained with Certicom Security Builder Toolkit * 4

E-Commerce on a PDA z. Small payments ($5 -> $50) z. Target Application: Pony Vending Machine y. Pre-pay y. Vendor-specific z. Where to start? y. Pay. Word (Rivest, Shamir) 5

PDA-Pay. Word z. Palm. Pilot implementation of Pay. Word z. Minimize cryptographic operations z. Minimize storage requirements 6

PDA-Pay. Word: Withdrawal User’s Wallet Yk Bank {Yk, k, d, vid}SECCDSA(User) Pre-Paid? Yes HCC= {Yk, k, d, exp, vid}SRSA (Bank) Y 1 Y 0 7

PDA-Pay. Word: Purchase Yk User’s Wallet Yk-i+1 Yk-i, i, HCC Yk-i Y 1 Vendor Y 0 8

PDA-Pay. Word: Withdrawal Timings Note: d = 5 9

PDA-Pay. Word: Purchase Timings (First time $1. 50 buy) 10

Conclusions / Summary z. PDA = portable commerce device w/o tamper resistance z. Suitable for small payments z. Commerce protocols can be adapted z. Example: PDA-Pay. Word yleverages best of ECC and RSA Acknowledgements: Andrew Toy & Certicom 11