com.google.crypto.tink.apps.paymentmethodtoken

Interface PaymentMethodTokenRecipientKem

public interface PaymentMethodTokenRecipientKem

Interface for recipient's key encapsulation mechanism (KEM).

Google Pay's tokens are encrypted using ECIES which is a hybrid encryption mode consisting of two steps: key encapsulation mechanisam (KEM) using Elliptic Curve Diffie Hellman (ECDH) and HKDF and data encapsulation mechanism (DEM) using AES-CTR-HMAC.

During encryption, the KEM step takes the recipient's public key and produces a DEM key and an ephemeral public key. The DEM key is then used to encrypt the credit card data, and the ephemeral public key is sent as the ephemeralPublicKey field of the payload.

To decrypt, the recipient must use their private key to compute an ECDH shared secret from the ephemeral public key, and from that derive the DEM key using HKDF. If the recipient keeps the private key in a HSM, they cannot load the private key in Tink, but they can implement this interface and configure Tink to use their custom KEM implementation with PaymentMethodTokenRecipient.Builder.addRecipientKem(com.google.crypto.tink.apps.paymentmethodtoken.PaymentMethodTokenRecipientKem).

Since:

1.1.0

See Also:

Google Payment Method Token standard

Method Summary

Modifier and Type	Method and Description
byte[]	computeSharedSecret(byte[] ephemeralPublicKey) Computes a shared secret from the ephemeralPublicKey, using ECDH.

Method Detail

computeSharedSecret

byte[] computeSharedSecret(byte[] ephemeralPublicKey)
                    throws GeneralSecurityException

Computes a shared secret from the ephemeralPublicKey, using ECDH.

ephemeralPublicKey is a point on the elliptic curve defined in the Google Payment Method Token standard, encoded in uncompressed point format. In version ECv1 and ECv2 of the standard, the elliptic curve is NIST P-256.

Note that you only needs to compute the shared secret, but you don't have to derive the DEM key with HKDF -- that process is handled by Tink.

Throws:

GeneralSecurityException